713 files changed, 174116 insertions, 0 deletions

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000..1a01c26c
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,33 @@
+*.o
+*.a
+Makefile.in
+.deps
+
+build-target
+aclocal.m4
+autom4te.cache
+config.log
+config.status
+config.guess
+config.sub
+configure
+compile
+depcomp
+install-sh
+missing
+stamp-h1
+core
+core.*
+
+# Backups, vi, merges
+*~
+*.sw?
+*.orig
+*.sav
+
+# development environment
+/.autotools
+/.cproject
+/.project
+/.settings/
+
diff --git a/.gitreview b/.gitreview
new file mode 100644
index 00000000..65d8bd85
--- /dev/null
+++ b/.gitreview
@@ -0,0 +1,3 @@
+[gerrit]
+host=gerrit.osmocom.org
+project=osmocom-bb
diff --git a/contrib/jenkins.sh b/contrib/jenkins.sh
new file mode 100755
index 00000000..f886c218
--- /dev/null
+++ b/contrib/jenkins.sh
@@ -0,0 +1,38 @@
+#!/bin/sh
+
+set -ex
+
+base="$PWD"
+deps="$base/deps"
+inst="$deps/install"
+export deps inst
+
+osmo-clean-workspace.sh
+
+mkdir "$deps" || true
+
+osmo-build-dep.sh libosmocore "" ac_cv_path_DOXYGEN=false
+
+# TODO: ask whether fail is expected, because osmocom-bb build succeeds?
+#"$deps"/libosmocore/contrib/verify_value_string_arrays_are_terminated.py $(find . -name "*.[hc]")
+
+export PKG_CONFIG_PATH="$inst/lib/pkgconfig:$PKG_CONFIG_PATH"
+export LD_LIBRARY_PATH="$inst/lib"
+
+set +x
+echo
+echo
+echo
+echo " =============================== OsmocomBB ==============================="
+echo
+set -x
+
+
+for dir in gprsdecode gsmmap layer23 osmocon trxcon virt_phy; do
+	cd $base/src/host/$dir
+	autoreconf -fi
+	./configure
+	make
+done
+
+osmo-clean-workspace.sh
diff --git a/doc/calypso-block.svg b/doc/calypso-block.svg
new file mode 100644
index 00000000..6f872676
--- /dev/null
+++ b/doc/calypso-block.svg
@@ -0,0 +1,707 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="297mm"
+   height="210mm"
+   id="svg2383"
+   sodipodi:version="0.32"
+   inkscape:version="0.46"
+   sodipodi:docname="calypso-block.svg"
+   inkscape:output_extension="org.inkscape.output.svg.inkscape"
+   inkscape:export-filename="/home/laforge/calypso-block.png"
+   inkscape:export-xdpi="90"
+   inkscape:export-ydpi="90">
+  <defs
+     id="defs2385">
+    <marker
+       inkscape:stockid="CurveIn"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="CurveIn"
+       style="overflow:visible">
+      <path
+         id="path3349"
+         d="M 4.6254930,-5.0456926 C 1.8654930,-5.0456926 -0.37450702,-2.8056926 -0.37450702,-0.045692580 C -0.37450702,2.7143074 1.8654930,4.9543074 4.6254930,4.9543074"
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;marker-end:none;fill:none"
+         transform="scale(0.6)" />
+    </marker>
+    <marker
+       inkscape:stockid="DotM"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="DotM"
+       style="overflow:visible">
+      <path
+         id="path3229"
+         d="M -2.5,-1.0 C -2.5,1.7600000 -4.7400000,4.0 -7.5,4.0 C -10.260000,4.0 -12.5,1.7600000 -12.5,-1.0 C -12.5,-3.7600000 -10.260000,-6.0 -7.5,-6.0 C -4.7400000,-6.0 -2.5,-3.7600000 -2.5,-1.0 z "
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;marker-end:none"
+         transform="scale(0.4) translate(7.4, 1)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow2Mstart"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow2Mstart"
+       style="overflow:visible">
+      <path
+         id="path7719"
+         style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round"
+         d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z "
+         transform="scale(0.6) translate(0,0)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow2Mend"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow2Mend"
+       style="overflow:visible;">
+      <path
+         id="path3191"
+         style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round;"
+         d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z "
+         transform="scale(0.6) rotate(180) translate(0,0)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow1Send"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow1Send"
+       style="overflow:visible;">
+      <path
+         id="path3179"
+         d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z "
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;"
+         transform="scale(0.2) rotate(180) translate(6,0)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow1Mend"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow1Mend"
+       style="overflow:visible;">
+      <path
+         id="path3173"
+         d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z "
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;"
+         transform="scale(0.4) rotate(180) translate(10,0)" />
+    </marker>
+    <marker
+       inkscape:stockid="TriangleOutL"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="TriangleOutL"
+       style="overflow:visible">
+      <path
+         id="path3307"
+         d="M 5.77,0.0 L -2.88,5.0 L -2.88,-5.0 L 5.77,0.0 z "
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none"
+         transform="scale(0.8)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow2Lend"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow2Lend"
+       style="overflow:visible;">
+      <path
+         id="path3185"
+         style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round;"
+         d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z "
+         transform="scale(1.1) rotate(180) translate(1,0)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow1Lend"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow1Lend"
+       style="overflow:visible;">
+      <path
+         id="path3188"
+         d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z "
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;"
+         transform="scale(0.8) rotate(180) translate(12.5,0)" />
+    </marker>
+    <inkscape:perspective
+       sodipodi:type="inkscape:persp3d"
+       inkscape:vp_x="0 : 372.04724 : 1"
+       inkscape:vp_y="0 : 1000 : 0"
+       inkscape:vp_z="1052.3622 : 372.04724 : 1"
+       inkscape:persp3d-origin="526.18109 : 248.03149 : 1"
+       id="perspective2392" />
+  </defs>
+  <sodipodi:namedview
+     inkscape:document-units="mm"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="0.96166971"
+     inkscape:cx="576.3753"
+     inkscape:cy="495.79724"
+     inkscape:current-layer="layer1"
+     id="namedview2387"
+     showgrid="true"
+     inkscape:snap-global="true"
+     inkscape:window-width="1022"
+     inkscape:window-height="731"
+     inkscape:window-x="1024"
+     inkscape:window-y="0"
+     inkscape:snap-guide="true"
+     inkscape:object-paths="false"
+     inkscape:object-nodes="false"
+     objecttolerance="3"
+     gridtolerance="10000">
+    <inkscape:grid
+       type="xygrid"
+       id="grid2400"
+       visible="true"
+       enabled="true"
+       units="mm"
+       spacingx="5mm"
+       spacingy="5mm"
+       empspacing="2" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata2389">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer"
+     id="layer1">
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#CurveIn);stroke-miterlimit:4;stroke-dasharray:none"
+       d="M 992.12598,230.31495 L 1045.2756,230.31495 L 1045.2756,159.44881 L 1045.2756,159.44881"
+       id="path22123" />
+    <g
+       id="g12239">
+      <rect
+         y="35.433064"
+         x="70.866142"
+         height="265.74802"
+         width="177.16536"
+         id="rect7161"
+         style="fill:#ffffff;stroke:#000000;stroke-width:1.77165353000000003;stroke-miterlimit:4;stroke-dasharray:none" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text7163"
+         y="53.149601"
+         x="72.866142"
+         style="font-size:20px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="53.149601"
+           x="72.866142"
+           id="tspan7165"
+           sodipodi:role="line">CALYPSO</tspan></text>
+    </g>
+    <g
+       id="g20347">
+      <rect
+         y="70.77356"
+         x="389.63159"
+         height="230.24446"
+         width="106.56361"
+         id="rect2406"
+         style="fill:#ffffff;stroke:#000000;stroke-width:1.50725651;stroke-miterlimit:4;stroke-dasharray:none" />
+      <text
+         transform="scale(1.0221827,0.9782987)"
+         sodipodi:linespacing="100%"
+         id="text7157"
+         y="92.63372"
+         x="381.30542"
+         style="font-size:21.45465279px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="92.63372"
+           x="381.30542"
+           id="tspan7159"
+           sodipodi:role="line">TWL3025</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text12244"
+         y="216.1601"
+         x="394.66666"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="216.1601"
+           x="394.66666"
+           id="tspan12246"
+           sodipodi:role="line">BSP</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text12248"
+         y="252.99342"
+         x="395.16666"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="252.99342"
+           x="395.16666"
+           id="tspan12250"
+           sodipodi:role="line">USP</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text12252"
+         y="286.42783"
+         x="396.16666"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="286.42783"
+           x="396.16666"
+           id="tspan12254"
+           sodipodi:role="line">TSP</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text20330"
+         y="163.44881"
+         x="464.62991"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="163.44881"
+           x="464.62991"
+           id="tspan20332"
+           sodipodi:role="line">BUL</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text20334"
+         y="146.96971"
+         x="463.70053"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="146.96971"
+           x="463.70053"
+           id="tspan20336"
+           sodipodi:role="line">BDL</tspan></text>
+    </g>
+    <g
+       id="g13450">
+      <rect
+         y="177.16687"
+         x="885.82831"
+         height="88.888702"
+         width="106.29617"
+         id="rect12310"
+         style="fill:#ffffff;stroke:#000000;stroke-width:1.77468574;stroke-miterlimit:4;stroke-dasharray:none" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text13440"
+         y="230.31496"
+         x="903.54333"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="230.31496"
+           x="903.54333"
+           id="tspan13442"
+           sodipodi:role="line">Antenna</tspan><tspan
+           id="tspan13444"
+           y="242.31496"
+           x="903.54333"
+           sodipodi:role="line">Switch</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text13446"
+         y="194.88188"
+         x="887.82678"
+         style="font-size:20px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="194.88188"
+           x="887.82678"
+           id="tspan13448"
+           sodipodi:role="line">ASM4532</tspan></text>
+    </g>
+    <rect
+       style="fill:#ffffff;stroke:#000000;stroke-width:1.61511528;stroke-miterlimit:4;stroke-dasharray:none"
+       id="rect11596"
+       width="142.16623"
+       height="88.074844"
+       x="885.74847"
+       y="35.354794" />
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#550000;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-end:url(#Arrow2Mend)"
+       d="M 496.06299,283.46456 L 850.3937,283.46456 L 850.3937,106.29921 L 885.82677,106.29921"
+       id="path21554" />
+    <path
+       style="fill:#ff0000;fill-rule:evenodd;stroke:#ff0000;stroke-width:3.54330707;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       d="M 248.0315,212.59842 L 389.76378,212.59842 L 389.76378,212.59842"
+       id="path7167" />
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#0000ff;stroke-width:3.54330708999999988;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-end:url(#Arrow2Mend)"
+       d="M 248.0315,283.46456 L 389.76378,283.46456"
+       id="path7171" />
+    <path
+       style="fill:#ff0000;fill-rule:evenodd;stroke:#ff0000;stroke-width:3.54330707;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       d="M 248.03149,248.03149 L 389.76378,248.03149 L 389.76378,248.03149"
+       id="path9925" />
+    <g
+       id="g12217">
+      <rect
+         y="35.433064"
+         x="637.79529"
+         height="212.59842"
+         width="141.73228"
+         id="rect2408"
+         style="fill:#ffffff;stroke:#000000;stroke-width:1.77165354;stroke-miterlimit:4;stroke-dasharray:none" />
+      <text
+         sodipodi:linespacing="125%"
+         id="text7153"
+         y="53.149601"
+         x="637.79529"
+         style="font-size:20px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           id="tspan11602"
+           y="78.149597"
+           x="637.79529"
+           sodipodi:role="line">TRF6151</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text12175"
+         y="88.582672"
+         x="655.51184"
+         style="font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="88.582672"
+           x="655.51184"
+           id="tspan12177"
+           sodipodi:role="line">Transceiver</tspan><tspan
+           id="tspan12179"
+           y="104.58267"
+           x="655.51184"
+           sodipodi:role="line">Mixers</tspan><tspan
+           id="tspan12183"
+           y="120.58267"
+           x="655.51184"
+           sodipodi:role="line">VCO</tspan><tspan
+           id="tspan12181"
+           y="136.58267"
+           x="655.51184"
+           sodipodi:role="line">PLL</tspan></text>
+    </g>
+    <text
+       xml:space="preserve"
+       style="font-size:20px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="885.82678"
+       y="53.149601"
+       id="text11598"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         id="tspan11600"
+         x="885.82678"
+         y="53.149601">RF3166</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="903.54333"
+       y="88.582672"
+       id="text12185"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         x="903.54333"
+         y="88.582672"
+         id="tspan12193">RF PA</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="218.59842"
+       y="287.46457"
+       id="text12256"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         id="tspan12258"
+         x="218.59842"
+         y="287.46457">TSP</tspan></text>
+    <g
+       id="g12268">
+      <path
+         id="path11606"
+         d="M 779.52756,53.149601 L 885.82677,53.149601 L 885.82677,53.149601"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12260"
+         y="51.149601"
+         x="814.96063"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="51.149601"
+           x="814.96063"
+           id="tspan12262"
+           sodipodi:role="line">GSM</tspan></text>
+    </g>
+    <g
+       id="g12273">
+      <path
+         id="path12195"
+         d="M 779.52756,70.866136 L 885.82677,70.866136 L 885.82677,70.866136"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12264"
+         y="68.866135"
+         x="814.96063"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="68.866135"
+           x="814.96063"
+           id="tspan12266"
+           sodipodi:role="line">DCS/PCS</tspan></text>
+    </g>
+    <g
+       id="g12290">
+      <path
+         id="path12197"
+         d="M 885.82677,194.88188 L 779.52756,194.88188 L 779.52756,194.88188"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12278"
+         y="192.88188"
+         x="814.96063"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="192.88188"
+           x="814.96063"
+           id="tspan12280"
+           sodipodi:role="line">GSM</tspan></text>
+    </g>
+    <g
+       id="g12295">
+      <path
+         id="path12165"
+         d="M 885.82677,212.59841 L 779.52756,212.59841 L 779.52756,212.59841"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12282"
+         y="210.59842"
+         x="814.96063"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="210.59842"
+           x="814.96063"
+           id="tspan12284"
+           sodipodi:role="line">DCS</tspan></text>
+    </g>
+    <g
+       id="g12300">
+      <path
+         id="path12199"
+         d="M 885.82677,230.31495 L 779.52756,230.31495 L 779.52756,230.31495"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12286"
+         y="228.31496"
+         x="814.96063"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="228.31496"
+           x="814.96063"
+           id="tspan12288"
+           sodipodi:role="line">PCS</tspan></text>
+    </g>
+    <g
+       id="g18005">
+      <text
+         sodipodi:linespacing="100%"
+         id="text14594"
+         y="49.149601"
+         x="425.21259"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           id="tspan14598"
+           y="49.149601"
+           x="425.21259"
+           sodipodi:role="line">RFCLK</tspan></text>
+      <path
+         id="path14605"
+         d="M 637.79528,53.149601 L 248.0315,53.149601 L 248.0315,53.149601"
+         style="fill:none;fill-rule:evenodd;stroke:#ffff00;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-end:url(#Arrow2Mend)" />
+    </g>
+    <g
+       id="g18583">
+      <path
+         inkscape:label="#path2410"
+         id="path241011111"
+         d="M 496.06299,141.73228 L 637.79528,141.73228 L 637.79528,141.73228 L 637.79528,141.73228"
+         style="fill:#00ff00;fill-rule:evenodd;stroke:#00ff00;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12167"
+         y="137.73228"
+         x="539.21259"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="137.73228"
+           x="539.21259"
+           id="tspan12169"
+           sodipodi:role="line">I/Q Analog</tspan></text>
+      <path
+         id="path15170"
+         d="M 531.49606,141.73228 L 531.49606,159.44881 L 496.06299,159.44881 L 496.06299,159.44881"
+         style="fill:none;fill-rule:evenodd;stroke:#00ff00;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+    </g>
+    <g
+       id="g18000">
+      <path
+         id="path17431"
+         d="M 248.0315,88.582671 L 389.76378,88.582671"
+         style="fill:none;fill-rule:evenodd;stroke:#ffff00;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-end:url(#Arrow2Mend)" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text17996"
+         y="84.582672"
+         x="295.18109"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="84.582672"
+           x="295.18109"
+           id="tspan17998"
+           sodipodi:role="line">CLK13M</tspan></text>
+    </g>
+    <g
+       id="g18593">
+      <path
+         id="path18010"
+         d="M 496.06299,194.88188 L 637.79528,194.88188"
+         style="fill:none;fill-rule:evenodd;stroke:#550000;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text18589"
+         y="188.88188"
+         x="537.49603"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="188.88188"
+           x="537.49603"
+           id="tspan18591"
+           sodipodi:role="line">AFC Analog</tspan></text>
+    </g>
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#0000ff;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-end:url(#Arrow2Mend)"
+       d="M 212.59843,301.1811 L 212.59843,372.04724 L 921.25984,372.04724 L 921.25984,265.74803"
+       id="path19726" />
+    <text
+       xml:space="preserve"
+       style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="354.33072"
+       y="368.04724"
+       id="text20291"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         id="tspan20293"
+         x="354.33072"
+         y="368.04724">TSP Parallel</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="356.33072"
+       y="330.89764"
+       id="text20295"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         id="tspan20297"
+         x="356.33072"
+         y="330.89764">TSP Serial</tspan></text>
+    <g
+       id="g20314"
+       transform="translate(-4.7244095e-7,-17.716533)">
+      <path
+         id="path20301"
+         d="M 248.0315,124.01574 L 389.76378,124.01574"
+         style="fill:none;fill-rule:evenodd;stroke:#ffff00;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text20303"
+         y="120.01574"
+         x="295.18109"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           id="tspan20310"
+           y="120.01574"
+           x="295.18109"
+           sodipodi:role="line">CLK32K</tspan></text>
+    </g>
+    <g
+       id="g20421">
+      <path
+         id="path12871"
+         d="M 956.69291,124.01574 L 956.69291,177.16535"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         transform="matrix(0,-1,1,0,0,0)"
+         sodipodi:linespacing="100%"
+         id="text20402"
+         y="952.69293"
+         x="-159.44881"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="952.69293"
+           x="-159.44881"
+           id="tspan20404"
+           sodipodi:role="line">GSM</tspan></text>
+    </g>
+    <g
+       id="g20415">
+      <g
+         id="g20410">
+        <path
+           style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none"
+           d="M 921.25984,124.01574 L 921.25984,177.16535"
+           id="path12312" />
+        <text
+           xml:space="preserve"
+           style="font-size:11.36807537px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+           x="-184.69075"
+           y="867.06183"
+           id="text20406"
+           sodipodi:linespacing="100%"
+           transform="matrix(0,-0.9473396,1.0555877,0,0,0)"><tspan
+             sodipodi:role="line"
+             id="tspan20408"
+             x="-184.69075"
+             y="867.06183">DCS/PCS</tspan></text>
+      </g>
+    </g>
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#0000ff;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-start:url(#DotM);marker-end:url(#Arrow2Mend)"
+       d="M 921.25984,372.04724 L 1009.8425,372.04724 L 1009.8425,124.01574 L 1009.8425,124.01574"
+       id="path20426" />
+    <text
+       xml:space="preserve"
+       style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="539.21259"
+       y="279.46457"
+       id="text22119"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         id="tspan22121"
+         x="539.21259"
+         y="279.46457">APC Analog</tspan></text>
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#0000ff;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-start:url(#DotM);marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none"
+       d="M 318.89764,283.46456 L 318.89764,336.61417 L 673.22835,336.61417 L 673.22835,248.03149"
+       id="path18598" />
+  </g>
+</svg>
diff --git a/doc/calypso-gsm-notes.txt b/doc/calypso-gsm-notes.txt
new file mode 100644
index 00000000..4377ceb4
--- /dev/null
+++ b/doc/calypso-gsm-notes.txt
@@ -0,0 +1,2 @@
+GSM burst duration: 577uS
+RITA synthesizer retuning max: 170uS
diff --git a/doc/calypso-signals.txt b/doc/calypso-signals.txt
new file mode 100644
index 00000000..be49cf03
--- /dev/null
+++ b/doc/calypso-signals.txt
@@ -0,0 +1,184 @@
+CALYPSO PAD AND NAME		I/O	CONNECTS TO						TO BFIN?
+========================================================================================================
+C12	CLK32K_OUT		O	TWL3025:CLK32K	(32kHz clock input)			M
+F12	CLK13M_OUT_START_BIT	O	TWL3025:CLK13M	(master clock input)			M
+D12	nRESPWON		I	TWL3025:RESPWONz (dbb power-on reset @ batt insert)	O
+P1	EXT-FIQ			I	TWL3025:INT1						O
+M3	EXT-IRQ			I	TWL3025:INT2						M
+A12	TCXOEN			O	TRF6151:XSEL,XEN (enable 26MHz oscillator)		M
+F10	ON_OFF			I	TWL3025:ON_nOFF (dbb reset @ each switch on)		O
+B14	IT_WAKEUP		O	TWL3025:ITWAKEUP (real-time wake-up irq)		O
+B11	NEMU0				NC
+E10	NEMU1				NC
+D11	NBSCAN				NC
+D10	TDI			I
+C10	TDO			O
+B10	TCK			I
+E9	TMS			I
+L11	BFSR			I	TWL3025:BFSX (bb-serial tx frame sync)			M
+K10	BDR			I	TWL3025:BDX (bb-serial tx data)				M
+P12	BFSX			O	TWL3025:BFSR (bb-serial rx frame sync)			M
+M11	BDX			O	TWL3025:BDR (bb-serial rx data)				M
+N11	BCLKX-IO6			NC
+P11	BCLKR-ARMCLK			GND
+P14	VDX			O	TWL3025:VDR (vb-serial rx data)
+N13	VDR			I	TWL3025:VDX (vb-serial tx data)	
+M13	VFSRX			I	TWL3025:VFS (vb-serial frame sync)
+N12	VCLKRX			I	TWL3025:VCK (vb-serial clock)
+N7	MCUDI			I	TWL3025:UDX (spi output)				M
+M7	MCUDO			O	TWL3025:UDR (spi input)					M
+M8	MCUEN0			O	TWL3025:UEN (spi enable)				M
+P8	MCUEN1-IO9			NC
+L8	MCUEN2-IO13			NC
+G13	SIM_IO			IO	TWL3025:DBBSIO (sim card shifter data)			L
+F13	SIM_CLK			O	TWL3025:DBBSCK (sim card shifter clock)			L
+G10	SIM_RST			O	TWL3025:DBBSRST (sim card shifter reset inp)		L
+G11	SIM_CD-MAS0			V_IO
+F14	SIM_PWRCTRL-IO5		O	TWL3025:DBBSIO (via 10k)				L
+B13	OSC32K_OUT		O	XTAL
+C13	OSC32K_IN		I	XTAL
+A14	VSSO				GND
+E13	CLKTCXO			I	TRF6151C:RFCLK (TCXO clock output)			M
+M2	IDDQ				GND
+N1	NI BOOT				GND (via 100k)
+N2	nRESET_OUT		O	NC
+M4	IO3-SIM_RNW			NC
+L4	IO2-IRQ4			NC
+P3	IO1-TPU_IDLE		O	S3C2410
+N3	IO0-TPU_WAIT			NC
+L7	LT-PWL				NC
+K7	BU-PWT				NC
+L6	KBR4-XDIO7			NC
+N6	KBR3-XDIO6			NC
+P6	KBR2-XDIO5			NC
+M6	KBR1-XDIO4			NC
+K6	KBR0-XDIO3			NC
+M5	KBC4-XDIO2			NC
+P5	KBC3-XDIO1			NC
+L5	KBC2-XDIO0			NC
+K5	KBC1-nIRQ			NC
+N4	KBC0-nFIQ			NC
+K9	MCSI_FSYNCH-IO12		NC
+N10	MCSI_CLI-IO11			NC
+M10	MCSI_RXD-IO10			NC
+L10	MCSI_TXD-IO9			NC
+C9	CTS_MODEM-X_F			S3C24xx
+D9	DSR_MODEM-LPG			S3c24xx
+E8	RTS_MODEM-TOUT			S3c24xx
+A9	RX_MODEM		I	S3c24xx
+B9	TX_MODEM		O	S3c24xx
+B8	SD_IRDA-CLKOUT_DSP		NC
+A8	RXIR_IRDA-X_A1			NC
+C7	TXIR_IRDA-X_A4			NC
+D8	RX_IRDA			I	socket
+C8	TX_IRDA			O	socket
+N9	NSCS(1)-X_A32			NC
+L9	NSCS0-SCL			NC
+M9	SDI-SDA			I	V-IO
+K8	SDO-nINT10		I	NC
+P9	SCLK-nINT1		I	INT0
+I14	TSPCLKX			O	TRF6151:CLK (serial clock)			M
+H11	TSPDO			O	TWL3025:TDR,TRF6151:DATA (serial data)		M
+H10	DSPDI-IO4		I	NC
+H13	TSPEN0			O	TWL3025:TEN (TSP enable)			M
+H12	TSPEN1				NC
+H14	TSPEN2				TRF6151:STROBE (serial strobe)			M
+G12	TSPEN3-nSCS2			NC
+M12	TSPACT0			O	TRF6151:RESETz (serial interface reset)		M
+M14	TSPACT1			O	ASM4532:VC2					M
+L12	TSPACT2			O	ASM4532:VC1					M
+L13	TSPACT3			O	RF3166:BAND_SELECT				M
+I10	TSPACT4-nRDYMEM		O	ASM4532:VC3					M
+K11	TSPACT5-DPLLCLK			NC
+K13	TSPACT6-nCS6			NC
+K12	TSPACT7-CLKX_SPI		NC
+K14	TSPACT8-nMREQ			NC
+I11	TSPACT9-MAS1			RF3166:TX_ENABLE (PA TX)			M
+I12	TSPACT10-nWAIT			NC
+I13	TSPACT11-MCLK			NC
+B7	DATA0				RAM/FLASH
+D7	DATA1				RAM/FLASH
+E7	DATA2				RAM/FLASH
+D6	DATA3				RAM/FLASH
+A6	DATA4				RAM/FLASH
+C6	DATA5				RAM/FLASH
+E6	DATA6				RAM/FLASH
+C6	DATA7				RAM/FLASH
+B5	DATA8				RAM/FLASH
+D5	DATA9				RAM/FLASH
+E5	DATA10				RAM/FLASH
+B4	DATA11				RAM/FLASH
+C4	DATA12				RAM/FLASH
+D4	DATA13				RAM/FLASH
+A3	DATA14				RAM/FLASH
+B3	DATA15				RAM/FLASH
+F3	ADD0				RAM/FLASH
+F2	ADD1				RAM/FLASH
+G5	ADD2				RAM/FLASH
+G4	ADD3				RAM/FLASH
+G2	ADD4				RAM/FLASH
+G3	ADD5				RAM/FLASH
+H1	ADD6				RAM/FLASH
+H3	ADD7				RAM/FLASH
+H2	ADD8				RAM/FLASH
+H4	ADD9				RAM/FLASH
+H5	ADD10				RAM/FLASH
+I1	ADD11				RAM/FLASH
+I2	ADD12				RAM/FLASH
+I3	ADD13				RAM/FLASH
+K3	ADD15				RAM/FLASH
+K2	ADD16				RAM/FLASH
+K4	ADD17				RAM/FLASH
+I5	ADD18				RAM/FLASH
+L1	ADD19				RAM/FLASH
+L2	ADD20				RAM/FLASH
+L3	ADD21-CLK16X_IRDA		RAM/FLASH
+B2	RNW				RAM/FLASH
+E3	nFEW-X_A0			NC
+E2	nFOE-X_A3			RAM/FLASH
+F4	FDP-nIACK			RAM/FLASH
+E4	nBLE-IO15			RAM/FLASH
+F5	nBHE-IO14			RAM/FLASH
+C2	nCS0
+C3	nCS1				RAM/FLASH
+C1	nCS2				NC
+D3	nCS3-nINT4			NC
+D2	CS4-ADD22			RAM/FLASH
+C11	nCS4-CO35			RAM/FLASH
+A4	VDDS-MF1			V-FLASH
+B6	VDDS-MF2			V-FLASH
+G1	VDDS-MF3			V-FLASH
+D1	VDDS-MF4			V-FLASH
+A11	VDDS_2				V-IO
+L14	VDDS_1				V-IO
+N5	VDDS_1				V-IO
+A5	VDD1				V-DBB
+B12	VDD2				V-DBB
+N14	VDD3				V-DBB
+P7	VDD4				V-DBB
+M1	VDD5				V-DBB
+E1	VDD6				V-DBB
+F1	VSS1				GND
+N8	VSS2				GND
+K1	VSS3				GND
+P2	VSS4				GND
+P4	VSS5				GND
+P10	VSS6				GND
+P13	VSS7				GND
+G14	BSS8				GND
+A10	VSS9				GND
+A7	VSS10				GND
+A2	VSS11				GND
+B1	VSS12				GND
+D13	VDDS_RTC			V-RTC
+D14	VDD_RTC				V-RTC
+C14	VSS_RTC				GND
+E11	VDD_ANG				V-IO
+E12	VSS_ANG				GND
+F11	VDD_PLL				V-DBB
+E14	VSS_PLL				GND
+
+Other signals
+
+MODEM_ON
+MODEM_RST
diff --git a/doc/examples/mobile/default.cfg b/doc/examples/mobile/default.cfg
new file mode 100644
index 00000000..cc816305
--- /dev/null
+++ b/doc/examples/mobile/default.cfg
@@ -0,0 +1,62 @@
+!
+! OsmocomBB example configuration for mobile application
+!!
+!
+line vty
+ no login
+!
+gps device /dev/ttyACM0
+gps baudrate default
+no gps enable
+!
+no hide-default
+!
+ms 1
+ layer2-socket /tmp/osmocom_l2
+ sap-socket /tmp/osmocom_sap
+ sim reader
+ network-selection-mode auto
+ imei 000000000000000 0
+ imei-fixed
+ no emergency-imsi
+ no sms-service-center
+ no call-waiting
+ no auto-answer
+ no force-rekey
+ no clip
+ no clir
+ tx-power auto
+ no simulated-delay
+ no stick
+ location-updating
+ neighbour-measurement
+ codec full-speed prefer
+ codec half-speed
+ no abbrev
+ support
+  sms
+  a5/1
+  a5/2
+  p-gsm
+  e-gsm
+  r-gsm
+  no gsm-850
+  dcs
+  no pcs
+  class-900 4
+  class-850 4
+  class-dcs 1
+  class-pcs 1
+  channel-capability sdcch+tchf+tchh
+  full-speech-v1
+  full-speech-v2
+  half-speech-v1
+  min-rxlev -106
+  dsc-max 90
+  no skip-max-per-band
+ test-sim
+  imsi 001010000000000
+  ki comp128 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+  no barred-access
+  rplmn 001 01
+ no shutdown
diff --git a/doc/examples/mobile/lua_helloworld.lua b/doc/examples/mobile/lua_helloworld.lua
new file mode 100644
index 00000000..fd5abccc
--- /dev/null
+++ b/doc/examples/mobile/lua_helloworld.lua
@@ -0,0 +1,9 @@
+-- See https://www.lua.org/manual/5.3/ for Lua
+-- See http://ftp.osmocom.org/docs/latest/osmocombb-usermanual.pdf -- Scripting with Lua
+
+-- Standard print and log_* are forwarded to the Osmocom logging framework
+print("Hellp from Lua");
+log_notice("Notice from lua");
+log_debug("Debug from Lua");
+log_error("Error from Lua");
+log_fatal("Fatal from Lua");
diff --git a/doc/examples/mobile/lua_ms_on_off.lua b/doc/examples/mobile/lua_ms_on_off.lua
new file mode 100644
index 00000000..57e492d9
--- /dev/null
+++ b/doc/examples/mobile/lua_ms_on_off.lua
@@ -0,0 +1,23 @@
+-- See https://www.lua.org/manual/5.3/ for Lua
+-- See http://ftp.osmocom.org/docs/latest/osmocombb-usermanual.pdf -- Scripting with Lua
+
+
+-- Switch the MS on/off but this can only be done if the MS
+-- is in the right state. This assumes that the MS is fully
+-- connected and doesn't stall.
+
+local start = false
+osmo.ms().start()
+function toggle_ms_state()
+	timer = osmo.timeout(20, function()
+		if start then
+			print("STARTING", osmo.ms().start())
+			start = false
+		else
+			print("STOPPING", osmo.ms().stop(true))
+			start = true
+		end
+		toggle_ms_state()
+	end)
+end
+toggle_ms_state()
diff --git a/doc/examples/mobile/lua_sms_on_attach.lua b/doc/examples/mobile/lua_sms_on_attach.lua
new file mode 100644
index 00000000..8d73f2fc
--- /dev/null
+++ b/doc/examples/mobile/lua_sms_on_attach.lua
@@ -0,0 +1,32 @@
+-- See https://www.lua.org/manual/5.3/ for Lua
+-- See http://ftp.osmocom.org/docs/latest/osmocombb-usermanual.pdf -- Scripting with Lua
+
+
+-- State change
+local sent_sms = false
+function mm_cb(new_state, new_substate, old_substate)
+	-- The system has attached and returned to idle. Send a SMS the first time
+	-- it happens.
+	if new_state == 19 and new_substate == 1 then
+		if not sent_sms then
+			sent_sms = true
+			osmo.ms():sms_send_simple("1234", "21321324", "fooooooo", 23)
+		end
+	end
+end
+
+-- Called when a new SMS arrives or status for delivery
+-- is updated. Check the msg_ref field.
+function sms_cb(sms, cause, valid)
+	print("SMS data cb", sms, cause, valid)
+	for i, v in pairs(sms) do
+		print(i, v)
+	end
+end
+
+-- We need to register a callback 
+local cbs = {
+	Sms=sms_cb,
+	Mm=mm_cb
+}
+osmo.ms():register(cbs)
diff --git a/doc/examples/mobile/lua_sms_receive.lua b/doc/examples/mobile/lua_sms_receive.lua
new file mode 100644
index 00000000..4be4e0a5
--- /dev/null
+++ b/doc/examples/mobile/lua_sms_receive.lua
@@ -0,0 +1,15 @@
+-- See https://www.lua.org/manual/5.3/ for Lua
+-- See http://ftp.osmocom.org/docs/latest/osmocombb-usermanual.pdf -- Scripting with Lua
+
+function sms_cb(sms, cause, valid)
+	print("SMS data cb", sms, cause, valid)
+	for i, v in pairs(sms) do
+		print(i, v)
+	end
+end
+
+local cbs = {
+	Sms=sms_cb,
+}
+
+osmo.ms():register(cbs)
diff --git a/doc/examples/mobile/lua_timer.lua b/doc/examples/mobile/lua_timer.lua
new file mode 100644
index 00000000..1119af81
--- /dev/null
+++ b/doc/examples/mobile/lua_timer.lua
@@ -0,0 +1,12 @@
+-- See https://www.lua.org/manual/5.3/ for Lua
+-- See http://ftp.osmocom.org/docs/latest/osmocombb-usermanual.pdf -- Scripting with Lua
+
+-- Start and stop timer with callback. Schedule a timeout and
+-- resume execution then.
+
+-- Timeout in 10 seconds
+local timer = osmo.timeout(10, function()
+	print("Timeout occurred");
+end)
+-- We can cancel it. The callback will not be called
+timer:cancel()
diff --git a/doc/examples/mobile/multi_ms.cfg b/doc/examples/mobile/multi_ms.cfg
new file mode 100644
index 00000000..bef2406e
--- /dev/null
+++ b/doc/examples/mobile/multi_ms.cfg
@@ -0,0 +1,112 @@
+!
+! OsmocomBB example configuration for mobile application
+!!
+!
+line vty
+ no login
+!
+gps device /dev/ttyACM0
+gps baudrate default
+no gps enable
+!
+no hide-default
+!
+ms one
+ layer2-socket /tmp/osmocom_l2.one
+ sap-socket /tmp/osmocom_sap.one
+ sim reader
+ network-selection-mode auto
+ imei 000000000000000 0
+ imei-fixed
+ no emergency-imsi
+ no sms-service-center
+ no call-waiting
+ no auto-answer
+ no force-rekey
+ no clip
+ no clir
+ tx-power auto
+ no simulated-delay
+ no stick
+ location-updating
+ neighbour-measurement
+ codec full-speed prefer
+ codec half-speed
+ no abbrev
+ support
+  sms
+  a5/1
+  a5/2
+  p-gsm
+  e-gsm
+  r-gsm
+  no gsm-850
+  dcs
+  no pcs
+  class-900 4
+  class-850 4
+  class-dcs 1
+  class-pcs 1
+  channel-capability sdcch+tchf+tchh
+  full-speech-v1
+  full-speech-v2
+  half-speech-v1
+  min-rxlev -106
+  dsc-max 90
+  no skip-max-per-band
+ test-sim
+  imsi 001010000000001
+  ki comp128 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+  no barred-access
+  rplmn 001 01
+ no shutdown
+!
+ms two
+ layer2-socket /tmp/osmocom_l2.two
+ sap-socket /tmp/osmocom_sap.two
+ sim reader
+ network-selection-mode auto
+ imei 000000000000000 0
+ imei-fixed
+ no emergency-imsi
+ no sms-service-center
+ no call-waiting
+ no auto-answer
+ no force-rekey
+ no clip
+ no clir
+ tx-power auto
+ no simulated-delay
+ no stick
+ location-updating
+ neighbour-measurement
+ codec full-speed prefer
+ codec half-speed
+ no abbrev
+ support
+  sms
+  a5/1
+  a5/2
+  p-gsm
+  e-gsm
+  r-gsm
+  no gsm-850
+  dcs
+  no pcs
+  class-900 4
+  class-850 4
+  class-dcs 1
+  class-pcs 1
+  channel-capability sdcch+tchf+tchh
+  full-speech-v1
+  full-speech-v2
+  half-speech-v1
+  min-rxlev -106
+  dsc-max 90
+  no skip-max-per-band
+ test-sim
+  imsi 001010000000002
+  ki comp128 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  no barred-access
+  rplmn 001 01
+ no shutdown
diff --git a/doc/gsmdevboard-block.svg b/doc/gsmdevboard-block.svg
new file mode 100644
index 00000000..cb19bc0a
--- /dev/null
+++ b/doc/gsmdevboard-block.svg
@@ -0,0 +1,746 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="297mm"
+   height="210mm"
+   id="svg2383"
+   sodipodi:version="0.32"
+   inkscape:version="0.46"
+   sodipodi:docname="gsmdevboard-block.svg"
+   inkscape:output_extension="org.inkscape.output.svg.inkscape"
+   inkscape:export-filename="/sunbeam/home/laforge/gsmdevboard-block.png"
+   inkscape:export-xdpi="90"
+   inkscape:export-ydpi="90">
+  <defs
+     id="defs2385">
+    <marker
+       inkscape:stockid="CurveIn"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="CurveIn"
+       style="overflow:visible">
+      <path
+         id="path3349"
+         d="M 4.6254930,-5.0456926 C 1.8654930,-5.0456926 -0.37450702,-2.8056926 -0.37450702,-0.045692580 C -0.37450702,2.7143074 1.8654930,4.9543074 4.6254930,4.9543074"
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;marker-end:none;fill:none"
+         transform="scale(0.6)" />
+    </marker>
+    <marker
+       inkscape:stockid="DotM"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="DotM"
+       style="overflow:visible">
+      <path
+         id="path3229"
+         d="M -2.5,-1.0 C -2.5,1.7600000 -4.7400000,4.0 -7.5,4.0 C -10.260000,4.0 -12.5,1.7600000 -12.5,-1.0 C -12.5,-3.7600000 -10.260000,-6.0 -7.5,-6.0 C -4.7400000,-6.0 -2.5,-3.7600000 -2.5,-1.0 z "
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;marker-end:none"
+         transform="scale(0.4) translate(7.4, 1)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow2Mstart"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow2Mstart"
+       style="overflow:visible">
+      <path
+         id="path7719"
+         style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round"
+         d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z "
+         transform="scale(0.6) translate(0,0)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow2Mend"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow2Mend"
+       style="overflow:visible;">
+      <path
+         id="path3191"
+         style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round;"
+         d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z "
+         transform="scale(0.6) rotate(180) translate(0,0)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow1Send"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow1Send"
+       style="overflow:visible;">
+      <path
+         id="path3179"
+         d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z "
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;"
+         transform="scale(0.2) rotate(180) translate(6,0)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow1Mend"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow1Mend"
+       style="overflow:visible;">
+      <path
+         id="path3173"
+         d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z "
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;"
+         transform="scale(0.4) rotate(180) translate(10,0)" />
+    </marker>
+    <marker
+       inkscape:stockid="TriangleOutL"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="TriangleOutL"
+       style="overflow:visible">
+      <path
+         id="path3307"
+         d="M 5.77,0.0 L -2.88,5.0 L -2.88,-5.0 L 5.77,0.0 z "
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none"
+         transform="scale(0.8)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow2Lend"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow2Lend"
+       style="overflow:visible;">
+      <path
+         id="path3185"
+         style="font-size:12.0;fill-rule:evenodd;stroke-width:0.62500000;stroke-linejoin:round;"
+         d="M 8.7185878,4.0337352 L -2.2072895,0.016013256 L 8.7185884,-4.0017078 C 6.9730900,-1.6296469 6.9831476,1.6157441 8.7185878,4.0337352 z "
+         transform="scale(1.1) rotate(180) translate(1,0)" />
+    </marker>
+    <marker
+       inkscape:stockid="Arrow1Lend"
+       orient="auto"
+       refY="0.0"
+       refX="0.0"
+       id="Arrow1Lend"
+       style="overflow:visible;">
+      <path
+         id="path3188"
+         d="M 0.0,0.0 L 5.0,-5.0 L -12.5,0.0 L 5.0,5.0 L 0.0,0.0 z "
+         style="fill-rule:evenodd;stroke:#000000;stroke-width:1.0pt;marker-start:none;"
+         transform="scale(0.8) rotate(180) translate(12.5,0)" />
+    </marker>
+    <inkscape:perspective
+       sodipodi:type="inkscape:persp3d"
+       inkscape:vp_x="0 : 372.04724 : 1"
+       inkscape:vp_y="0 : 1000 : 0"
+       inkscape:vp_z="1052.3622 : 372.04724 : 1"
+       inkscape:persp3d-origin="526.18109 : 248.03149 : 1"
+       id="perspective2392" />
+  </defs>
+  <sodipodi:namedview
+     inkscape:document-units="mm"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="0.96166971"
+     inkscape:cx="386.08127"
+     inkscape:cy="495.79724"
+     inkscape:current-layer="layer1"
+     id="namedview2387"
+     showgrid="true"
+     inkscape:snap-global="true"
+     inkscape:window-width="1598"
+     inkscape:window-height="1163"
+     inkscape:window-x="0"
+     inkscape:window-y="0"
+     inkscape:snap-guide="true"
+     inkscape:object-paths="false"
+     inkscape:object-nodes="false"
+     objecttolerance="3"
+     gridtolerance="10000">
+    <inkscape:grid
+       type="xygrid"
+       id="grid2400"
+       visible="true"
+       enabled="true"
+       units="mm"
+       spacingx="5mm"
+       spacingy="5mm"
+       empspacing="2" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata2389">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer"
+     id="layer1">
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#000000;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#CurveIn);stroke-miterlimit:4;stroke-dasharray:none"
+       d="M 992.12598,230.31495 L 1045.2756,230.31495 L 1045.2756,159.44881 L 1045.2756,159.44881"
+       id="path22123" />
+    <g
+       id="g20347">
+      <rect
+         y="70.77356"
+         x="389.63159"
+         height="230.24446"
+         width="106.56361"
+         id="rect2406"
+         style="fill:#ffffff;stroke:#000000;stroke-width:1.50725651;stroke-miterlimit:4;stroke-dasharray:none" />
+      <text
+         transform="scale(1.0221827,0.9782987)"
+         sodipodi:linespacing="100%"
+         id="text7157"
+         y="92.63372"
+         x="381.30542"
+         style="font-size:21.45465279px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="92.63372"
+           x="381.30542"
+           id="tspan7159"
+           sodipodi:role="line">TWL3025</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text12244"
+         y="216.1601"
+         x="394.66666"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="216.1601"
+           x="394.66666"
+           id="tspan12246"
+           sodipodi:role="line">BSP</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text12248"
+         y="252.99342"
+         x="395.16666"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="252.99342"
+           x="395.16666"
+           id="tspan12250"
+           sodipodi:role="line">USP</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text12252"
+         y="286.42783"
+         x="396.16666"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="286.42783"
+           x="396.16666"
+           id="tspan12254"
+           sodipodi:role="line">TSP</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text20330"
+         y="163.44881"
+         x="464.62991"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="163.44881"
+           x="464.62991"
+           id="tspan20332"
+           sodipodi:role="line">BUL</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text20334"
+         y="146.96971"
+         x="463.70053"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="146.96971"
+           x="463.70053"
+           id="tspan20336"
+           sodipodi:role="line">BDL</tspan></text>
+    </g>
+    <g
+       id="g13450">
+      <rect
+         y="177.16687"
+         x="885.82831"
+         height="88.888702"
+         width="106.29617"
+         id="rect12310"
+         style="fill:#ffffff;stroke:#000000;stroke-width:1.77468574;stroke-miterlimit:4;stroke-dasharray:none" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text13440"
+         y="230.31496"
+         x="903.54333"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="230.31496"
+           x="903.54333"
+           id="tspan13442"
+           sodipodi:role="line">Antenna</tspan><tspan
+           id="tspan13444"
+           y="242.31496"
+           x="903.54333"
+           sodipodi:role="line">Switch</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text13446"
+         y="194.88188"
+         x="887.82678"
+         style="font-size:20px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="194.88188"
+           x="887.82678"
+           id="tspan13448"
+           sodipodi:role="line">ASM4532</tspan></text>
+    </g>
+    <rect
+       style="fill:#ffffff;stroke:#000000;stroke-width:1.61511528;stroke-miterlimit:4;stroke-dasharray:none"
+       id="rect11596"
+       width="142.16623"
+       height="88.074844"
+       x="885.74847"
+       y="35.354794" />
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#550000;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-end:url(#Arrow2Mend)"
+       d="M 496.06299,283.46456 L 850.3937,283.46456 L 850.3937,106.29921 L 885.82677,106.29921"
+       id="path21554" />
+    <path
+       style="fill:#ff0000;fill-rule:evenodd;stroke:#ff0000;stroke-width:3.54330707;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       d="M 248.0315,212.59842 L 389.76378,212.59842 L 389.76378,212.59842"
+       id="path7167" />
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#0000ff;stroke-width:3.54330708999999988;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-end:url(#Arrow2Mend)"
+       d="M 248.0315,283.46456 L 389.76378,283.46456"
+       id="path7171" />
+    <path
+       style="fill:#ff0000;fill-rule:evenodd;stroke:#ff0000;stroke-width:3.54330707;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       d="M 248.03149,248.03149 L 389.76378,248.03149 L 389.76378,248.03149"
+       id="path9925" />
+    <g
+       id="g12217">
+      <rect
+         y="35.433064"
+         x="637.79529"
+         height="212.59842"
+         width="141.73228"
+         id="rect2408"
+         style="fill:#ffffff;stroke:#000000;stroke-width:1.77165354;stroke-miterlimit:4;stroke-dasharray:none" />
+      <text
+         sodipodi:linespacing="125%"
+         id="text7153"
+         y="53.149601"
+         x="637.79529"
+         style="font-size:20px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:125%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           id="tspan11602"
+           y="78.149597"
+           x="637.79529"
+           sodipodi:role="line">TRF6151</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text12175"
+         y="88.582672"
+         x="655.51184"
+         style="font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="88.582672"
+           x="655.51184"
+           id="tspan12177"
+           sodipodi:role="line">Transceiver</tspan><tspan
+           id="tspan12179"
+           y="104.58267"
+           x="655.51184"
+           sodipodi:role="line">Mixers</tspan><tspan
+           id="tspan12183"
+           y="120.58267"
+           x="655.51184"
+           sodipodi:role="line">VCO</tspan><tspan
+           id="tspan12181"
+           y="136.58267"
+           x="655.51184"
+           sodipodi:role="line">PLL</tspan></text>
+    </g>
+    <text
+       xml:space="preserve"
+       style="font-size:20px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="885.82678"
+       y="53.149601"
+       id="text11598"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         id="tspan11600"
+         x="885.82678"
+         y="53.149601">RF3166</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-size:16px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="903.54333"
+       y="88.582672"
+       id="text12185"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         x="903.54333"
+         y="88.582672"
+         id="tspan12193">RF PA</tspan></text>
+    <g
+       id="g12268">
+      <path
+         id="path11606"
+         d="M 779.52756,53.149601 L 885.82677,53.149601 L 885.82677,53.149601"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12260"
+         y="51.149601"
+         x="814.96063"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="51.149601"
+           x="814.96063"
+           id="tspan12262"
+           sodipodi:role="line">GSM</tspan></text>
+    </g>
+    <g
+       id="g12273">
+      <path
+         id="path12195"
+         d="M 779.52756,70.866136 L 885.82677,70.866136 L 885.82677,70.866136"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12264"
+         y="68.866135"
+         x="814.96063"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="68.866135"
+           x="814.96063"
+           id="tspan12266"
+           sodipodi:role="line">DCS/PCS</tspan></text>
+    </g>
+    <g
+       id="g12290">
+      <path
+         id="path12197"
+         d="M 885.82677,194.88188 L 779.52756,194.88188 L 779.52756,194.88188"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12278"
+         y="192.88188"
+         x="814.96063"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="192.88188"
+           x="814.96063"
+           id="tspan12280"
+           sodipodi:role="line">GSM</tspan></text>
+    </g>
+    <g
+       id="g12295">
+      <path
+         id="path12165"
+         d="M 885.82677,212.59841 L 779.52756,212.59841 L 779.52756,212.59841"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12282"
+         y="210.59842"
+         x="814.96063"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="210.59842"
+           x="814.96063"
+           id="tspan12284"
+           sodipodi:role="line">DCS</tspan></text>
+    </g>
+    <g
+       id="g12300">
+      <path
+         id="path12199"
+         d="M 885.82677,230.31495 L 779.52756,230.31495 L 779.52756,230.31495"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12286"
+         y="228.31496"
+         x="814.96063"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="228.31496"
+           x="814.96063"
+           id="tspan12288"
+           sodipodi:role="line">PCS</tspan></text>
+    </g>
+    <g
+       id="g18005">
+      <text
+         sodipodi:linespacing="100%"
+         id="text14594"
+         y="49.149601"
+         x="425.21259"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           id="tspan14598"
+           y="49.149601"
+           x="425.21259"
+           sodipodi:role="line">RFCLK</tspan></text>
+      <path
+         id="path14605"
+         d="M 637.79528,53.149601 L 248.0315,53.149601 L 248.0315,53.149601"
+         style="fill:none;fill-rule:evenodd;stroke:#ffff00;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-end:url(#Arrow2Mend)" />
+    </g>
+    <g
+       id="g18583">
+      <path
+         inkscape:label="#path2410"
+         id="path241011111"
+         d="M 496.06299,141.73228 L 637.79528,141.73228 L 637.79528,141.73228 L 637.79528,141.73228"
+         style="fill:#00ff00;fill-rule:evenodd;stroke:#00ff00;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text12167"
+         y="137.73228"
+         x="539.21259"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="137.73228"
+           x="539.21259"
+           id="tspan12169"
+           sodipodi:role="line">I/Q Analog</tspan></text>
+      <path
+         id="path15170"
+         d="M 531.49606,141.73228 L 531.49606,159.44881 L 496.06299,159.44881 L 496.06299,159.44881"
+         style="fill:none;fill-rule:evenodd;stroke:#00ff00;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-start:url(#Arrow2Mstart);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+    </g>
+    <g
+       id="g18000">
+      <path
+         id="path17431"
+         d="M 248.0315,88.582671 L 389.76378,88.582671"
+         style="fill:none;fill-rule:evenodd;stroke:#ffff00;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-end:url(#Arrow2Mend)" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text17996"
+         y="84.582672"
+         x="295.18109"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="84.582672"
+           x="295.18109"
+           id="tspan17998"
+           sodipodi:role="line">CLK13M</tspan></text>
+    </g>
+    <g
+       id="g18593">
+      <path
+         id="path18010"
+         d="M 496.06299,194.88188 L 637.79528,194.88188"
+         style="fill:none;fill-rule:evenodd;stroke:#550000;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text18589"
+         y="188.88188"
+         x="537.49603"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="188.88188"
+           x="537.49603"
+           id="tspan18591"
+           sodipodi:role="line">AFC Analog</tspan></text>
+    </g>
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#0000ff;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-end:url(#Arrow2Mend)"
+       d="M 212.59843,301.1811 L 212.59843,372.04724 L 921.25984,372.04724 L 921.25984,265.74803"
+       id="path19726" />
+    <text
+       xml:space="preserve"
+       style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="354.33072"
+       y="368.04724"
+       id="text20291"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         id="tspan20293"
+         x="354.33072"
+         y="368.04724">TSP Parallel</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="356.33072"
+       y="330.89764"
+       id="text20295"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         id="tspan20297"
+         x="356.33072"
+         y="330.89764">TSP Serial</tspan></text>
+    <g
+       id="g20314"
+       transform="translate(-4.7244095e-7,-17.716533)">
+      <path
+         id="path20301"
+         d="M 248.0315,124.01574 L 389.76378,124.01574"
+         style="fill:none;fill-rule:evenodd;stroke:#ffff00;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text20303"
+         y="120.01574"
+         x="295.18109"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           id="tspan20310"
+           y="120.01574"
+           x="295.18109"
+           sodipodi:role="line">CLK32K</tspan></text>
+    </g>
+    <g
+       id="g20421">
+      <path
+         id="path12871"
+         d="M 956.69291,124.01574 L 956.69291,177.16535"
+         style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464575;stroke-linecap:butt;stroke-linejoin:miter;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         transform="matrix(0,-1,1,0,0,0)"
+         sodipodi:linespacing="100%"
+         id="text20402"
+         y="952.69293"
+         x="-159.44881"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="952.69293"
+           x="-159.44881"
+           id="tspan20404"
+           sodipodi:role="line">GSM</tspan></text>
+    </g>
+    <g
+       id="g20415">
+      <g
+         id="g20410">
+        <path
+           style="fill:none;fill-rule:evenodd;stroke:#ff00ff;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none"
+           d="M 921.25984,124.01574 L 921.25984,177.16535"
+           id="path12312" />
+        <text
+           xml:space="preserve"
+           style="font-size:11.36807537px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+           x="-184.69075"
+           y="867.06183"
+           id="text20406"
+           sodipodi:linespacing="100%"
+           transform="matrix(0,-0.9473396,1.0555877,0,0,0)"><tspan
+             sodipodi:role="line"
+             id="tspan20408"
+             x="-184.69075"
+             y="867.06183">DCS/PCS</tspan></text>
+      </g>
+    </g>
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#0000ff;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none;marker-start:url(#DotM);marker-end:url(#Arrow2Mend)"
+       d="M 921.25984,372.04724 L 1009.8425,372.04724 L 1009.8425,124.01574 L 1009.8425,124.01574"
+       id="path20426" />
+    <text
+       xml:space="preserve"
+       style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+       x="539.21259"
+       y="279.46457"
+       id="text22119"
+       sodipodi:linespacing="100%"><tspan
+         sodipodi:role="line"
+         id="tspan22121"
+         x="539.21259"
+         y="279.46457">APC Analog</tspan></text>
+    <path
+       style="fill:none;fill-rule:evenodd;stroke:#0000ff;stroke-width:2.83464567;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;marker-start:url(#DotM);marker-end:url(#Arrow2Mend);stroke-miterlimit:4;stroke-dasharray:none"
+       d="M 318.89764,283.46456 L 318.89764,336.61417 L 673.22835,336.61417 L 673.22835,248.03149"
+       id="path18598" />
+    <g
+       id="g3366">
+      <rect
+         y="35.433064"
+         x="70.866142"
+         height="265.74802"
+         width="177.16536"
+         id="rect7161"
+         style="fill:#ffffff;stroke:#000000;stroke-width:1.77165353;stroke-miterlimit:4;stroke-dasharray:none" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text7163"
+         y="53.149601"
+         x="72.866142"
+         style="font-size:20px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           id="tspan3352"
+           y="53.149601"
+           x="72.866142"
+           sodipodi:role="line">BF537</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text12256"
+         y="287.46457"
+         x="218.59842"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="287.46457"
+           x="218.59842"
+           id="tspan12258"
+           sodipodi:role="line">TSP</tspan></text>
+      <path
+         d="M 158.52718,76.505608 A 0.46875,0.46875 0 1 1 157.58968,76.505608 A 0.46875,0.46875 0 1 1 158.52718,76.505608 z"
+         sodipodi:ry="0.46875"
+         sodipodi:rx="0.46875"
+         sodipodi:cy="76.505608"
+         sodipodi:cx="158.05843"
+         style="fill:#000000;stroke:none"
+         id="path2520"
+         sodipodi:type="arc" />
+      <path
+         id="path2522"
+         d="M 159.44882,35.327311 L 159.44882,301.07535 L 159.44882,301.07535 L 159.44882,301.07535 L 159.44882,301.07535"
+         style="fill:none;fill-opacity:0.75;fill-rule:evenodd;stroke:#000000;stroke-width:1.47677553;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <text
+         sodipodi:linespacing="100%"
+         id="text3348"
+         y="53.149601"
+         x="159.44882"
+         style="font-size:20px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           id="tspan3358"
+           y="53.149601"
+           x="159.44882"
+           sodipodi:role="line">Spartan</tspan><tspan
+           id="tspan3356"
+           y="73.149597"
+           x="159.44882"
+           sodipodi:role="line">3E</tspan></text>
+      <text
+         sodipodi:linespacing="100%"
+         id="text3362"
+         y="290.92511"
+         x="89.994156"
+         style="font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;text-align:start;line-height:100%;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;font-family:Bitstream Vera Sans;-inkscape-font-specification:Bitstream Vera Sans"
+         xml:space="preserve"><tspan
+           y="290.92511"
+           x="89.994156"
+           id="tspan3364"
+           sodipodi:role="line">Ethernet</tspan></text>
+    </g>
+  </g>
+</svg>
diff --git a/include/l1ctl_proto.h b/include/l1ctl_proto.h
new file mode 100644
index 00000000..c6156f5a
--- /dev/null
+++ b/include/l1ctl_proto.h
@@ -0,0 +1,361 @@
+/* Messages to be sent between the different layers */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Holger Hans Peter Freyther
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef __L1CTL_PROTO_H__
+#define __L1CTL_PROTO_H__
+
+enum {
+	_L1CTL_NONE		= 0,
+	L1CTL_FBSB_REQ,
+	L1CTL_FBSB_CONF,
+	L1CTL_DATA_IND,
+	L1CTL_RACH_REQ,
+	L1CTL_DM_EST_REQ,
+	L1CTL_DATA_REQ,
+	L1CTL_RESET_IND,
+	L1CTL_PM_REQ,		/* power measurement */
+	L1CTL_PM_CONF,		/* power measurement */
+	L1CTL_ECHO_REQ,
+	L1CTL_ECHO_CONF,
+	L1CTL_RACH_CONF,
+	L1CTL_RESET_REQ,
+	L1CTL_RESET_CONF,
+	L1CTL_DATA_CONF,
+	L1CTL_CCCH_MODE_REQ,
+	L1CTL_CCCH_MODE_CONF,
+	L1CTL_DM_REL_REQ,
+	L1CTL_PARAM_REQ,
+	L1CTL_DM_FREQ_REQ,
+	L1CTL_CRYPTO_REQ,
+	L1CTL_SIM_REQ,
+	L1CTL_SIM_CONF,
+	L1CTL_TCH_MODE_REQ,
+	L1CTL_TCH_MODE_CONF,
+	L1CTL_NEIGH_PM_REQ,
+	L1CTL_NEIGH_PM_IND,
+	L1CTL_TRAFFIC_REQ,
+	L1CTL_TRAFFIC_CONF,
+	L1CTL_TRAFFIC_IND,
+	L1CTL_BURST_IND,
+
+	/* configure TBF for uplink/downlink */
+	L1CTL_TBF_CFG_REQ,
+	L1CTL_TBF_CFG_CONF,
+
+	L1CTL_DATA_TBF_REQ,
+	L1CTL_DATA_TBF_CONF,
+};
+
+enum ccch_mode {
+	CCCH_MODE_NONE = 0,
+	CCCH_MODE_NON_COMBINED,
+	CCCH_MODE_COMBINED,
+	CCCH_MODE_COMBINED_CBCH,
+};
+
+enum neigh_mode {
+	NEIGH_MODE_NONE = 0,
+	NEIGH_MODE_PM,
+	NEIGH_MODE_SB,
+};
+
+enum l1ctl_coding_scheme {
+	L1CTL_CS_NONE,
+	L1CTL_CS1,
+	L1CTL_CS2,
+	L1CTL_CS3,
+	L1CTL_CS4,
+	L1CTL_MCS1,
+	L1CTL_MCS2,
+	L1CTL_MCS3,
+	L1CTL_MCS4,
+	L1CTL_MCS5,
+	L1CTL_MCS6,
+	L1CTL_MCS7,
+	L1CTL_MCS8,
+	L1CTL_MCS9,
+};
+
+/*
+ * NOTE: struct size. We do add manual padding out of the believe
+ * that it will avoid some unaligned access.
+ */
+
+/* there are no more messages in a sequence */
+#define L1CTL_F_DONE	0x01
+
+struct l1ctl_hdr {
+	uint8_t msg_type;
+	uint8_t flags;
+	uint8_t padding[2];
+	uint8_t data[0];
+} __attribute__((packed));
+
+/*
+ * downlink info ... down from the BTS..
+ */
+struct l1ctl_info_dl {
+	/* GSM 08.58 channel number (9.3.1) */
+	uint8_t chan_nr;
+	/* GSM 08.58 link identifier (9.3.2) */
+	uint8_t link_id;
+	/* the ARFCN and the band. FIXME: what about MAIO? */
+	uint16_t band_arfcn;
+
+	uint32_t frame_nr;
+
+	uint8_t rx_level;	/* 0 .. 63 in typical GSM notation (dBm+110) */
+	uint8_t snr;		/* Signal/Noise Ration (dB) */
+	uint8_t num_biterr;
+	uint8_t fire_crc;
+
+	uint8_t payload[0];
+} __attribute__((packed));
+
+/* new CCCH was found. This is following the header */
+struct l1ctl_fbsb_conf {
+	int16_t initial_freq_err;
+	uint8_t result;
+	uint8_t bsic;
+	/* FIXME: contents of cell_info ? */
+} __attribute__((packed));
+
+/* CCCH mode was changed */
+struct l1ctl_ccch_mode_conf {
+	uint8_t ccch_mode;	/* enum ccch_mode */
+	uint8_t padding[3];
+} __attribute__((packed));
+
+/* TCH mode was changed */
+struct l1ctl_tch_mode_conf {
+	uint8_t tch_mode;	/* enum tch_mode */
+	uint8_t audio_mode;
+	uint8_t padding[2];
+} __attribute__((packed));
+
+/* data on the CCCH was found. This is following the header */
+struct l1ctl_data_ind {
+	uint8_t data[23];
+} __attribute__((packed));
+
+/* traffic from the network */
+struct l1ctl_traffic_ind {
+	uint8_t data[0];
+} __attribute__((packed));
+
+/*
+ * uplink info
+ */
+struct l1ctl_info_ul {
+	/* GSM 08.58 channel number (9.3.1) */
+	uint8_t chan_nr;
+	/* GSM 08.58 link identifier (9.3.2) */
+	uint8_t link_id;
+	uint8_t padding[2];
+
+	uint8_t payload[0];
+} __attribute__((packed));
+
+struct l1ctl_info_ul_tbf {
+	/* references l1ctl_tbf_cfg_req.tbf_nr */
+	uint8_t tbf_nr;
+	uint8_t coding_scheme;
+	uint8_t padding[2];
+	/* RLC/MAC block, size determines CS */
+	uint8_t payload[0];
+} __attribute__((packed));
+
+/*
+ * msg for FBSB_REQ
+ * the l1_info_ul header is in front
+ */
+struct l1ctl_fbsb_req {
+	uint16_t band_arfcn;
+	uint16_t timeout;	/* in TDMA frames */
+
+	uint16_t freq_err_thresh1;
+	uint16_t freq_err_thresh2;
+
+	uint8_t num_freqerr_avg;
+	uint8_t flags;		/* L1CTL_FBSB_F_* */
+	uint8_t sync_info_idx;
+	uint8_t ccch_mode;	/* enum ccch_mode */
+	uint8_t rxlev_exp;	/* expected signal level */
+} __attribute__((packed));
+
+#define L1CTL_FBSB_F_FB0	(1 << 0)
+#define L1CTL_FBSB_F_FB1	(1 << 1)
+#define L1CTL_FBSB_F_SB		(1 << 2)
+#define L1CTL_FBSB_F_FB01SB	(L1CTL_FBSB_F_FB0|L1CTL_FBSB_F_FB1|L1CTL_FBSB_F_SB)
+
+/*
+ * msg for CCCH_MODE_REQ
+ * the l1_info_ul header is in front
+ */
+struct l1ctl_ccch_mode_req {
+	uint8_t ccch_mode;	/* enum ccch_mode */
+	uint8_t padding[3];
+} __attribute__((packed));
+
+/*
+ * msg for TCH_MODE_REQ
+ * the l1_info_ul header is in front
+ */
+struct l1ctl_tch_mode_req {
+	uint8_t tch_mode;	/* enum gsm48_chan_mode */
+#define AUDIO_TX_MICROPHONE	(1<<0)
+#define AUDIO_TX_TRAFFIC_REQ	(1<<1)
+#define AUDIO_RX_SPEAKER	(1<<2)
+#define AUDIO_RX_TRAFFIC_IND	(1<<3)
+	uint8_t audio_mode;
+	uint8_t padding[2];
+} __attribute__((packed));
+
+/* the l1_info_ul header is in front */
+struct l1ctl_rach_req {
+	uint8_t ra;
+	uint8_t combined;
+	uint16_t offset;
+} __attribute__((packed));
+
+/* the l1_info_ul header is in front */
+struct l1ctl_par_req {
+	int8_t ta;
+	uint8_t tx_power;
+	uint8_t padding[2];
+} __attribute__((packed));
+
+struct l1ctl_h0 {
+	uint16_t band_arfcn;
+} __attribute__((packed));
+
+struct l1ctl_h1 {
+	uint8_t hsn;
+	uint8_t maio;
+	uint8_t n;
+	uint8_t _padding[1];
+	uint16_t ma[64];
+} __attribute__((packed));
+
+struct l1ctl_dm_est_req {
+	uint8_t tsc;
+	uint8_t h;
+	union {
+		struct l1ctl_h0 h0;
+		struct l1ctl_h1 h1;
+	};
+	uint8_t tch_mode;
+	uint8_t audio_mode;
+} __attribute__((packed));
+
+struct l1ctl_dm_freq_req {
+	uint16_t fn;
+	uint8_t tsc;
+	uint8_t h;
+	union {
+		struct l1ctl_h0 h0;
+		struct l1ctl_h1 h1;
+	};
+} __attribute__((packed));
+
+struct l1ctl_crypto_req {
+	uint8_t algo;
+	uint8_t key_len;
+	uint8_t key[0];
+} __attribute__((packed));
+
+struct l1ctl_pm_req {
+	uint8_t type;
+	uint8_t padding[3];
+
+	union {
+		struct {
+			uint16_t band_arfcn_from;
+			uint16_t band_arfcn_to;
+		} range;
+	};
+} __attribute__((packed));
+
+#define BI_FLG_DUMMY (1 << 4)
+#define BI_FLG_SACCH (1 << 5)
+
+struct l1ctl_burst_ind {
+	uint32_t frame_nr;
+	uint16_t band_arfcn;    /* ARFCN + band + ul indicator               */
+	uint8_t chan_nr;        /* GSM 08.58 channel number (9.3.1)          */
+	uint8_t flags;          /* BI_FLG_xxx + burst_id = 2LSBs             */
+	uint8_t rx_level;       /* 0 .. 63 in typical GSM notation (dBm+110) */
+	uint8_t snr;            /* Reported SNR >> 8 (0-255)                 */
+	uint8_t bits[15];       /* 114 bits + 2 steal bits. Filled MSB first */
+} __attribute__((packed));
+
+/* a single L1CTL_PM response */
+struct l1ctl_pm_conf {
+	uint16_t band_arfcn;
+	uint8_t pm[2];
+} __attribute__((packed));
+
+enum l1ctl_reset_type {
+	L1CTL_RES_T_BOOT,	/* only _IND */
+	L1CTL_RES_T_FULL,
+	L1CTL_RES_T_SCHED,
+};
+
+/* argument to L1CTL_RESET_REQ and L1CTL_RESET_IND */
+struct l1ctl_reset {
+	uint8_t type;
+	uint8_t pad[3];
+} __attribute__((packed));
+
+struct l1ctl_neigh_pm_req {
+	uint8_t n;
+	uint8_t padding[1];
+	uint16_t band_arfcn[64];
+	uint8_t tn[64];
+} __attribute__((packed));
+
+/* neighbour cell measurement results */
+struct l1ctl_neigh_pm_ind {
+	uint16_t band_arfcn;
+	uint8_t pm[2];
+	uint8_t tn;
+	uint8_t padding;
+} __attribute__((packed));
+
+/* traffic data to network */
+struct l1ctl_traffic_req {
+	uint8_t data[0];
+} __attribute__((packed));
+
+struct l1ctl_tbf_cfg_req {
+	/* future support for multiple concurrent TBFs. 0 for now */
+	uint8_t tbf_nr;
+	/* is this about an UL TBF (1) or DL (0) */
+	uint8_t is_uplink;
+	uint8_t padding[2];
+
+	/* one USF for each TN, or 255 for invalid/unused */
+	uint8_t usf[8];
+} __attribute__((packed));
+
+#endif /* __L1CTL_PROTO_H__ */
diff --git a/src/Makefile b/src/Makefile
new file mode 100644
index 00000000..d92acbc1
--- /dev/null
+++ b/src/Makefile
@@ -0,0 +1,140 @@
+
+# this is not really used as we don't do 'make install'. You can still specify
+# it in case you _want_ to manually 'make install' the target libosmocore.
+CROSS_INST_PREFIX ?= /usr/local/stow/osmocom-bb/arm-2010.09
+
+# this is the host tuple of your cross-toolchain
+CROSS_HOST ?= $(shell which arm-elf-gcc >/dev/null 2>&1 && echo arm-elf || echo arm-none-eabi)
+
+# this is the prefix of your cross-toolchain programs
+CROSS_TOOL_PREFIX=$(CROSS_HOST)-
+
+TOPDIR=$(shell pwd)
+
+all: libosmocore-target nofirmware firmware mtk-firmware
+
+nofirmware: layer23 osmocon trxcon gsmmap gprsdecode virtphy
+
+libosmocore-target: shared/libosmocore/build-target/src/.libs/libosmocore.a
+
+shared/libosmocore/configure: shared/libosmocore/configure.ac
+	cd shared/libosmocore && autoreconf -fi
+
+shared/libosmocore/build-target:
+	mkdir $@
+
+shared/libosmocore/build-target/Makefile: shared/libosmocore/configure shared/libosmocore/build-target
+	cd shared/libosmocore/build-target && ../configure \
+			--host=$(CROSS_HOST) --enable-embedded --disable-shared \
+			--disable-tests ac_cv_header_sys_select_h=no \
+			--disable-tests ac_cv_header_sys_socket_h=no \
+		CFLAGS="-Os -ffunction-sections -I$(TOPDIR)/target/firmware/include -nostartfiles -nodefaultlibs"
+
+shared/libosmocore/build-target/src/.libs/libosmocore.a: shared/libosmocore/build-target/Makefile
+	cd shared/libosmocore/build-target && make
+
+
+.PHONY: osmocon
+osmocon: host/osmocon/osmocon
+
+host/osmocon/configure: host/osmocon/configure.ac
+	cd host/osmocon && autoreconf -i
+
+host/osmocon/Makefile: host/osmocon/configure
+	cd host/osmocon && ./configure $(HOST_CONFARGS)
+
+host/osmocon/osmocon: host/osmocon/Makefile
+	make -C host/osmocon
+
+.PHONY: virtphy
+virtphy: host/virt_phy/virtphy
+
+host/virt_phy/configure: host/virt_phy/configure.ac
+	cd host/virt_phy && autoreconf -i
+
+host/virt_phy/Makefile: host/virt_phy/configure
+	cd host/virt_phy && ./configure $(HOST_CONFARGS)
+
+host/virt_phy/virtphy: host/virt_phy/Makefile
+	make -C host/virt_phy
+
+.PHONY: trxcon
+trxcon: host/trxcon/trxcon
+
+host/trxcon/configure: host/trxcon/configure.ac
+	cd host/trxcon && autoreconf -i
+
+host/trxcon/Makefile: host/trxcon/configure
+	cd host/trxcon && ./configure $(HOST_CONFARGS)
+
+host/trxcon/trxcon: host/trxcon/Makefile
+	make -C host/trxcon
+
+
+.PHONY: gsmmap
+gsmmap: host/gsmmap/gsmmap
+
+host/gsmmap/configure: host/gsmmap/configure.ac
+	cd host/gsmmap && autoreconf -i
+
+host/gsmmap/Makefile: host/gsmmap/configure
+	cd host/gsmmap && ./configure $(HOST_CONFARGS)
+
+host/gsmmap/gsmmap: host/gsmmap/Makefile
+	make -C host/gsmmap
+
+
+.PHONY: layer23
+layer23: host/layer23/layer23
+
+host/layer23/configure: host/layer23/configure.ac
+	cd host/layer23 && autoreconf -i
+
+host/layer23/Makefile: host/layer23/configure
+	cd host/layer23 && ./configure $(HOST_CONFARGS)
+
+host/layer23/layer23: host/layer23/Makefile
+	make -C host/layer23
+
+.PHONY: gprsdecode
+gprsdecode: host/gprsdecode/gprsdecode
+
+host/gprsdecode/configure: host/gprsdecode/configure.ac
+	cd host/gprsdecode && autoreconf -i
+
+host/gprsdecode/Makefile: host/gprsdecode/configure
+	cd host/gprsdecode && ./configure $(HOST_CONFARGS)
+
+host/gprsdecode/gprsdecode: host/gprsdecode/Makefile
+	make -C host/gprsdecode
+
+.PHONY: firmware
+firmware: libosmocore-target
+	make -C target/firmware CROSS_COMPILE=$(CROSS_TOOL_PREFIX)
+
+.PHONY: mtk-firmware
+mtk-firmware: libosmocore-target
+	make -C target/firmware -f Makefile.mtk CROSS_COMPILE=$(CROSS_TOOL_PREFIX)
+
+
+clean:
+	make -C shared/libosmocore/build-target $@
+	make -C host/layer23 $@
+	make -C host/osmocon $@
+	make -C host/gsmmap $@
+	make -C host/gprsdecode $@
+	make -C host/virt_phy $@
+	make -C host/trxcon $@
+	make -C target/firmware $@
+	make -C target/firmware -f Makefile.mtk $@
+
+distclean:
+	rm -rf shared/libosmocore/build-target
+	make -C host/layer23 $@
+	make -C host/osmocon $@
+	make -C host/gsmmap $@
+	make -C host/gprsdecode $@
+	make -C host/virt_phy $@
+	make -C host/trxcon $@
+# 'firmware' also handles 'mtk-firmware'
+	make -C target/firmware $@
diff --git a/src/README.building b/src/README.building
new file mode 100644
index 00000000..d7cc7944
--- /dev/null
+++ b/src/README.building
@@ -0,0 +1,40 @@
+== How to build OsmocomBB? ==
+
+=== Prerequisites ===
+
+We assume you are building on a GNU/Linux host system such as Debian
+GNU/Linux.  Successful builds have also been reported using MacOS X
+and the Cygwin environment for MS Windows, but we do not officially support
+this.
+
+ * Make sure you have compiled and installed a recent version of
+   libosmocore. See https://osmocom.org/projects/libosmocore/wiki/Libosmocore
+
+   DO NOT USE the libosmocore version embedded in this git tree. This
+   is a special version used internally and MUST NOT be used as
+   system-wide libosmocore.
+
+ * Get a GNU toolchain (gcc/binutils) for ARM (e.g. from http://gnuarm.com/)
+   See https://osmocom.org/projects/baseband/wiki/GnuArmToolchain
+
+ * Set your path to include the arm-elf-* executables of your toolchain
+
+ * call 'make' in this (the src) subdirectory
+
+=== Details ===
+
+The master Makefile will build:
+
+ * libosmocore for the target (ARM)
+ * osmocon and layer23 executables for the host (linking libosmocore)
+ * the actual target firmware images (in src/target/firmware/board/*/*.bin)
+
+
+== Transmitting ==
+
+For safety reasons, all code that can enable the transmitter on the phone is
+disabled in the default builds.  Plese check the src/target/firmware/Makefile
+for the "#CFLAGS += -DCONFIG_TX_ENABLE" line.
+
+Please notice that GSM operates in licensed spectrum and in most jurisdictions
+you will need a license from a regulatory authority to transmit.
diff --git a/src/README.development b/src/README.development
new file mode 100644
index 00000000..64821438
--- /dev/null
+++ b/src/README.development
@@ -0,0 +1,86 @@
+= Contributing to OsmocomBB development =
+
+Feel free to help us by extending the code.  Always make sure to
+send back all your patches to Gerrit (recommended) or to the
+baseband-devel@lists.osmocom.org mailing list - Free Software
+is all about sharing. For details, see:
+
+https://osmocom.org/projects/cellular-infrastructure/wiki/Gerrit
+https://gerrit.osmocom.org/
+
+== Coding Style ==
+
+Like all C language Osmocom projects, we use the Linux Kernel coding
+style, you can find it in the Documentation/CodingStyle subdirectory
+of any Linux Kernel source. For details, see:
+
+https://osmocom.org/projects/cellular-infrastructure/wiki/Coding_standards
+
+== More Information ==
+
+Please consult the https://osmocom.org/projects/baseband/wiki/.
+
+If you have any technical questions regarding the code, don't hesitate
+to ask the baseband-devel@lists.osmocom.org mailing list.
+
+== subdirectories containing libraries and code ==
+
+=== src/shared/libosmocore ===
+
+This is a library of various utility routines, including linked lists,
+message buffers, bit-vectors, memory allocator, signals, select loop
+handling, timers - as well as some more specifically GSM related things
+like a TLV parser, a Comp128V1 implementation and utility functions for
+RSL (TS 08.58) and CC/MM/RR (TS 04.08).
+
+libosmocore is maintained in git://git.osmocom.org/libosmocore.git, so
+
+	DO NOT DIRECTLY COMMIT TO libosmocore IN THIS REPOSITORY!
+
+We simply maintain a copy (synchronized by git-subtree) in this
+repository for the ease of building and to make sure everyone is using
+the proper/compatible version of libosmocore
+
+Please note, whatever you add to libosmocore will need to build as a
+Linux userspace program (using glibc) just as well as on the OsmocomBB
+embedded target without OS.  So please refrain from using fancy
+functions.
+
+
+=== src/target/firmware ===
+
+The firmware is what we build for the actual target (phone).  It was
+written with some idea of modularity in mind, i.e. we have
+
+ * Ti Calypso specific code in calypso/
+ * Analog Baseband code in abb/
+ * RF Mixer code in rf/
+ * Layer1 code in layer1/
+ * NOR flash handling in flash/
+ * LCD display handling in display/
+ * minimal C-Library code in lib/
+ * communications utility routines in comm/
+ * Board (phone model/family) specific code in board/
+   * board/compal_e88 is the Motorola C115-C124 family
+   * board/compal_e99 is the Motorola C155 family
+ * Applications (each app builds one firmware image) in apps/
+
+=== src/target/trx_toolkit ===
+
+A set of tools in Python for debugging TRX interface and creating
+a virtual Um-interface between OsmocomBB and OsmoBTS. For details,
+please refer:
+
+https://osmocom.org/projects/baseband/wiki/TRX_Interface
+https://osmocom.org/projects/baseband/wiki/FakeTRX
+target/trx_toolkit/README
+
+=== src/target_dsp/calypso ===
+
+This is where we keep some (assembly) code that we wrote for
+the DSP that is part of the Calypso DBB.
+
+=== src/host/layer23 ===
+
+The Layer2 (LAPDm / TS 04.06) and Layer3 (CC/MM/RR / TS 04.08)
+implementations, as they are growing.
diff --git a/src/host/calypso_pll/pll.pl b/src/host/calypso_pll/pll.pl
new file mode 100755
index 00000000..52c91319
--- /dev/null
+++ b/src/host/calypso_pll/pll.pl
@@ -0,0 +1,10 @@
+#!/usr/bin/perl
+
+my $f_in = 26*1000*1000;
+
+for (my $mult = 1; $mult < 31; $mult++) {
+	for (my $div = 0; $div < 3; $div++) {
+		my $fout = $f_in * ($mult / ($div+1));
+		printf("%03.1f MHz (mult=%2u, div=%1u)\n", $fout/(1000*1000), $mult, $div);
+	}
+}
diff --git a/src/host/fb_tools/bdf_to_c.py b/src/host/fb_tools/bdf_to_c.py
new file mode 100755
index 00000000..86be6a6b
--- /dev/null
+++ b/src/host/fb_tools/bdf_to_c.py
@@ -0,0 +1,293 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+'''
+This script converts a bdf-font to a c-source-file containing
+selected glyphs in the format defined by the <fb/font.h> header.
+'''
+
+# (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from optparse import OptionParser
+import sys
+import os
+
+def unique_name(thisname,existingnames) :
+	# return first of thisname, thisname_1, thisname_2, ...
+	# that does not yet exist in existingnames. This is used
+	# because somethings glyphs with non-unique names exist
+	# in fonts!
+	retname=thisname
+	N=1
+	while retname in existingnames :
+		N=N+1
+		retname='%s_%d'%(thisname,N)
+	return retname
+
+
+# return number N (for a character), optionally including
+# the ascii character
+def ascii_charnum(n) :
+	if n >= 32 and n < 127 :
+		if n != 34 : # """ looks stupid
+			return '(%d, ASCII "%s")'%(n,chr(n))
+		else :
+			return '(%d, ASCII \'%s\')'%(n,chr(n))
+	return '(%d)'%(n)
+
+def is_zeroes(s) :
+	# check if list s consists entirely of "00" strings
+	# (used to detect empty lines in fonts)
+	for x in s :
+		if s != '00' :
+			return False
+	return True
+
+def byte_to_bits(x) :
+	# convert byte x to a string representing the bits #=1, .=0
+	# used for drawing pretty pictures in the comments of the
+	# generated C-file
+	ret = ''
+	for i in range(8) :
+		if x & 1<<(7-i) :
+			ret = ret + '#'
+		else :
+			ret = ret + '.'
+	return ret
+
+class BDF_Font(object) :
+	# this class stores a read-in bdf font
+	def __init__(self,filename) :
+		self.filename = filename
+		self.glyphs = dict()
+		self.enc = dict()
+		self.height = None
+		self.registry = None
+		self.encoding = None
+		self.ascent = 0
+		self.descent = 0
+		self.read_font(filename)
+
+	def add_header(self,data) :
+		#print 'Header data: ',data
+		self.registry = data.get('charset_registry','none')
+		self.encoding = data.get('charset_encoding','unknown')
+		self.ascent = int(data['font_ascent'])
+		self.descent = int(data['font_descent'])
+		bbx = data['fontboundingbox'].split(None,3)
+		self.height = int(bbx[1])
+
+	def add_glyph(self,charname,data,bitmap) :
+		chnum = int(data['encoding'])
+#		print 'add_glyph(%s) -> %s'%(charname,ascii_charnum(chnum))
+		self.enc[chnum] = charname
+		self.glyphs[charname] = data
+		self.glyphs[charname]['bitmap']=bitmap
+
+	def read_font(self,filename) :
+		f = file(filename)
+
+		hdr_data = dict()
+		# read in header
+		for l in f :
+			l = l.strip()
+			if l == '' :
+				continue
+			arr = l.split(None,1)
+			if len(arr) > 1 :
+				hdr_data[ arr[0].lower() ] = arr[1]
+			if arr[0].lower() == 'chars' :
+				break
+
+		self.add_header(hdr_data)
+
+		# now read in characters
+		inchar = None
+		data = dict() # store glyph data
+		bitmap = None
+		for l in f :
+			l = l.strip()
+			if l == '' :
+				continue
+
+			# waiting for next glyph
+			if inchar == None :
+				if l.lower() == 'endfont' :
+					break # end of font :-)
+				arr = l.split(None,1)
+				if len(arr) < 2 and \
+				    arr[0].lower() != 'STARTCHAR' :
+					print >>sys.stderr,'Not start of glyph: %s'%(l)
+					continue
+				inchar = unique_name(arr[1],self.glyphs)
+				continue
+
+			# ENDCHAR always ends the glyph
+			if l.lower() == 'endchar' :
+				self.add_glyph(inchar,data,bitmap)
+				inchar = None
+				bitmap = None
+				data = dict()
+				continue
+
+			# in bitmap
+			if bitmap != None :
+				bitmap.append(l)
+				continue
+
+			# else: metadata for this glyph
+			arr = l.split(None,1)
+
+			if arr[0].lower() == 'bitmap' :
+				bitmap = list() # start collecting pixels
+				continue
+
+			if len(arr) < 2 :
+				print >>sys.stderr,'Bad line in font: %s'%(l)
+				continue
+			data[arr[0].lower()] = arr[1]
+
+if __name__ == '__main__' :
+	P = OptionParser(usage='%prog [options] bdf-file')
+	P.add_option('-o','--out',action='store', dest='out', default=None,
+		metavar='FILE',help='write .c-code representing font to FILE')
+	P.add_option('-b','--base',action='store',dest='base',default=None,
+		metavar='base_symbol',help='prefix for all generated symbols')
+	P.add_option('-f','--firstchar',action='store',dest='firstchar',type="int",
+		metavar='N',default=None,help='numeric value of first char')
+	P.add_option('-l','--lastchar',action='store',dest='lastchar',type="int",
+		metavar='N',default=None,help='numeric value of last char')
+
+	opts,args = P.parse_args()
+
+	if len(args) != 1 :
+		P.error('Please specify (exactly one) bdf input file.')
+
+	font = BDF_Font(args[0])
+
+	if opts.firstchar == None :
+		opts.firstchar = min(font.enc)
+		print 'First character in font: %d, %s'%(opts.firstchar,
+			font.enc[opts.firstchar])
+
+	if opts.lastchar == None :
+		opts.lastchar = max(font.enc)
+		print 'Last character in font: %d, %s'%(opts.lastchar,
+			font.enc[opts.lastchar])
+
+	if opts.base == None :
+		opts.base = 'font_'+os.path.basename(args[0])
+		if opts.base[-4:] == '.bdf' :
+			opts.base = opts.base[:-4]
+		print >>sys.stderr,'Guessing symbol prefix to be %s.'%(opts.base)
+
+	if opts.out == None :
+		opts.out = os.path.basename(args[0])
+		if opts.out[-4:] == '.bdf' :
+			opts.out = opts.out[:-4]
+		opts.out = opts.out + '.c'
+		print >>sys.stderr,'Guessing output filename to be %s.'%(opts.out)
+
+		if os.path.exists(opts.out) :
+			print >>sys.stderr,'Will *NOT* overwrite existing file when guessing output!'
+			sys.exit(1)
+
+	of = file(opts.out,'w')
+	
+	print >>of,'#include <fb/font.h>'
+	print >>of,'/* file autogenerated by %s */'%(sys.argv[0])
+
+	offsets = list()
+	glyphnames = list()
+
+	print >>of,'static const uint8_t %s_data[] = {'%(opts.base)
+
+	pos = 0
+
+	# output font data, build up per-character information
+
+	for i in range(opts.firstchar,opts.lastchar+1) :
+		if not i in font.enc :
+			offsets.append(0xffff)
+			glyphnames.append('(no glyph)')
+			continue
+
+		charname = font.enc[i]
+		glyphnames.append('%s %s'%(charname,ascii_charnum(i)))
+		offsets.append(pos)
+		glyph = font.glyphs[charname]
+		bbx = map(int,glyph['bbx'].split(None,3))
+		bitmap = glyph['bitmap']
+
+		if bbx[1] != len(bitmap) :
+			print >>sys.stderr,'ERROR: glyph',charname,'has wrong number of lines of data!'
+			print >>sys.stderr,' want: ',bbx[1],'but have',len(bitmap)
+			sys.exit(1)
+
+		removedrows = 0
+
+		while len(bitmap) > 1 and is_zeroes(bitmap[0]) :
+			removedrows = removedrows + 1
+			bbx[1] = bbx[1] - 1 # decrease height
+			bitmap = bitmap[1:]
+
+		while len(bitmap) > 1 and is_zeroes(bitmap[-1]) :
+			removedrows = removedrows + 1
+			bbx[1] = bbx[1] - 1  # decrease height
+			bbx[3] = bbx[3] + 1  # increase y0
+			bitmap = bitmap[:-1]
+
+		if removedrows > 0 :
+			print "Glyph %s: removed %d rows."%(charname,removedrows)
+
+		w = int(glyph['dwidth'].split(None,1)[0])
+
+		print >>of,'/* --- new character %s %s starting at offset 0x%04x --- */'%(
+				charname,ascii_charnum(i),pos)
+		print >>of,'\t/*%04x:*/\t%d, %d, %d, %d, %d, /* width and bbox (w,h,x,y) */'%(
+			pos,w,bbx[0],bbx[1],bbx[2],bbx[3])
+
+		pos += 5
+
+		for k,l in enumerate(bitmap) :
+			bytes = [ int(l[i:i+2],16) for i in range(0,len(l),2) ]
+			if len(bytes) != (bbx[0]+7)/8 :
+				print >>sys.stderr,'ERROR: glyph',charname,'has wrong # of bytes'
+				print >>sys.stderr,' per line. Want',(bbx[0]+7)/8,'have',len(bytes)
+				sys.exit(1)
+			cdata = ','.join([ '0x%02x'%v for v in bytes ])
+			comment = ''.join([ byte_to_bits(b) for b in bytes ])
+			print >>of,'\t/*%04x:*/\t'%(pos)+cdata+',  /* '+comment+' */'
+			pos += len(bytes)
+
+	print >>of,"};"
+
+	x = ',\n\t'.join(['0x%04x /* %s */'%(w,n) for w,n in zip(offsets,glyphnames)])
+	print >>of,'static const uint16_t %s_offsets[] = {\n\t%s\n};'%(opts.base,x)
+
+	height = font.ascent + font.descent
+
+	print >>of,'const struct fb_font %s = {'%(opts.base)
+	print >>of,'\t.height = %d,'%(height)
+	print >>of,'\t.ascent = %d,'%(font.ascent)
+	print >>of,'\t.firstchar = %d, /* %s */'%(opts.firstchar,font.enc.get(opts.firstchar,"?"))
+	print >>of,'\t.lastchar = %d, /* %s */'%(opts.lastchar,font.enc.get(opts.lastchar,"?"))
+	print >>of,'\t.chardata = %s_data,'%(opts.base)
+	print >>of,'\t.charoffs = %s_offsets,'%(opts.base)
+	print >>of,'};'
diff --git a/src/host/gprsdecode/.gitignore b/src/host/gprsdecode/.gitignore
new file mode 100644
index 00000000..8e883922
--- /dev/null
+++ b/src/host/gprsdecode/.gitignore
@@ -0,0 +1,13 @@
+# GNU automake
+Makefile
+
+# Final executables
+gprsdecode
+
+# GNU autotest
+tests/package.m4
+tests/atconfig
+tests/atlocal
+tests/testsuite
+tests/testsuite.dir/
+tests/testsuite.log
diff --git a/src/host/gprsdecode/Makefile.am b/src/host/gprsdecode/Makefile.am
new file mode 100644
index 00000000..542d54b6
--- /dev/null
+++ b/src/host/gprsdecode/Makefile.am
@@ -0,0 +1,36 @@
+AUTOMAKE_OPTIONS = foreign dist-bzip2 1.6
+SUBDIRS = tests
+
+AM_CPPFLAGS = \
+	$(all_includes) \
+	$(NULL)
+
+AM_CFLAGS = \
+	-Wall -O3 \
+	-Wno-missing-braces \
+	$(LIBOSMOGSM_CFLAGS) \
+	$(LIBOSMOCORE_CFLAGS) \
+	$(LIBOSMOCODING_CFLAGS) \
+	$(NULL)
+
+bin_PROGRAMS = gprsdecode
+
+gprsdecode_SOURCES = \
+	gsmtap.c \
+	rlcmac.c \
+	gprs.c \
+	main.c \
+	$(NULL)
+
+noinst_HEADERS = \
+	l1ctl_proto.h \
+	rlcmac.h \
+	gsmtap.h \
+	gprs.h \
+	$(NULL)
+
+gprsdecode_LDADD = \
+	$(LIBOSMOCODING_LIBS) \
+	$(LIBOSMOCORE_LIBS) \
+	$(LIBOSMOGSM_LIBS) \
+	$(NULL)
diff --git a/src/host/gprsdecode/README b/src/host/gprsdecode/README
new file mode 100644
index 00000000..dbe45dc5
--- /dev/null
+++ b/src/host/gprsdecode/README
@@ -0,0 +1,8 @@
+GPRS decoder for OsmocomBB
+
+Usage: ./gprsdecode <burstfile>
+
+The burstfile should contain samples, captured using burst_ind branch.
+An example of decoded output as well as few sample capture files could be found in tests/
+
+Based on the version from git://git.srlabs.de/gprsdecode.git
diff --git a/src/host/gprsdecode/configure.ac b/src/host/gprsdecode/configure.ac
new file mode 100644
index 00000000..8da68c80
--- /dev/null
+++ b/src/host/gprsdecode/configure.ac
@@ -0,0 +1,29 @@
+dnl Process this file with autoconf to produce a configure script
+AC_INIT([gprsdecode], [0.0.0])
+AM_INIT_AUTOMAKE
+
+dnl kernel style compile messages
+m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+
+dnl Tests
+AC_CONFIG_TESTDIR(tests)
+
+dnl checks for programs
+AC_PROG_MAKE_SET
+AC_PROG_CC
+AC_PROG_INSTALL
+AC_PROG_RANLIB
+
+dnl checks for libraries
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore)
+PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm)
+PKG_CHECK_MODULES(LIBOSMOCODING, libosmocoding)
+
+dnl checks for header files
+AC_HEADER_STDC
+
+dnl generates the output files
+AC_OUTPUT(
+	Makefile
+	tests/Makefile
+)
diff --git a/src/host/gprsdecode/gprs.c b/src/host/gprsdecode/gprs.c
new file mode 100644
index 00000000..ae59cf90
--- /dev/null
+++ b/src/host/gprsdecode/gprs.c
@@ -0,0 +1,153 @@
+/*
+ * (C) 2017-2018 by sysmocom - s.f.m.c. GmbH, Author: Max <msuraev@sysmocom.de>
+ * (C) 2018 by Vadim Yanitskiy <axilirator@gmail.com>
+ * (C) 2011-2012 by Luca Melette <luca@srlabs.de>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/bits.h>
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/coding/gsm0503_coding.h>
+
+#include "l1ctl_proto.h"
+#include "rlcmac.h"
+#include "gprs.h"
+
+/**
+ * We store both DL and UL burst buffers
+ * for all possible timeslots...
+ */
+static struct burst_buf burst_buf_dl[8] = { 0 };
+static struct burst_buf burst_buf_ul[8] = { 0 };
+
+int process_pdch(struct l1ctl_burst_ind *bi, bool verbose)
+{
+	int n_errors, n_bits_total, rc, len, i;
+	ubit_t buf[GSM_BURST_PL_LEN];
+	struct gprs_message *gm;
+	struct burst_buf *bb;
+	uint8_t l2[200];
+	uint16_t arfcn;
+	uint32_t fn;
+	uint8_t tn;
+	bool ul;
+
+	/* Get burst parameters */
+	fn = ntohl(bi->frame_nr);
+	arfcn = ntohs(bi->band_arfcn);
+	ul = !!(arfcn & GSMTAP_ARFCN_F_UPLINK);
+	tn = bi->chan_nr & 7;
+
+	/* Select a proper DL / UL buffer */
+	bb = ul ? &burst_buf_ul[tn] : &burst_buf_dl[tn];
+
+	/* Align to first frame */
+	if ((bb->count == 0) && (((fn % 13) % 4) != 0))
+		return 0;
+
+	/* Debug print */
+	if (verbose)
+		printf("Processing %s burst fn=%u, tn=%u\n",
+			ul ? "UL" : "DL", fn, tn);
+
+	/* Unpack hard-bits (1 or 0) */
+	osmo_pbit2ubit_ext(buf,  0, bi->bits,  0, 57, 0);
+	osmo_pbit2ubit_ext(buf, 59, bi->bits, 57, 57, 0);
+
+	/* Set the stealing flags */
+	buf[57] = bi->bits[14] & 0x10;
+	buf[58] = bi->bits[14] & 0x20;
+
+	/* Convert hard-bits (1 or 0) to soft-bits (-127..127) */
+	for (i = 0; i < GSM_BURST_PL_LEN; i++)
+		bb->bursts[GSM_BURST_PL_LEN * bb->count + i] = buf[i] ?
+			-(bi->snr >> 1) : (bi->snr >> 1);
+
+	/* Store the first frame number */
+	if (bb->count == 0)
+		bb->fn_first = fn;
+
+	/* Collect the measurements */
+	bb->rxl[bb->count] = bi->rx_level;
+	bb->snr[bb->count] = bi->snr;
+
+	/* Wait until complete set of bursts (4/4) */
+	if (++bb->count < 4)
+		return 0;
+
+	/* Debug print */
+	if (verbose)
+		printf("Collected 4/4 bursts on tn=%u\n", tn);
+
+	/* Flush the burst counter */
+	bb->count = 0;
+
+	/* Attempt to decode */
+	len = gsm0503_pdtch_decode(l2, bb->bursts, NULL,
+		&n_errors, &n_bits_total);
+
+	/* Debug print */
+	if (verbose)
+		printf("GSM 05.03 decoding %s (%s=%d)\n",
+			len <= 0 ? "failed" : "success",
+			len <= 0 ? "rc" : "len", len);
+
+	/* Skip bad blocks... */
+	if (len <= 0)
+		return -EIO;
+
+	/**
+	 * HACK: for some reason, the handler expects
+	 * 53-byte messages, while libosmocoding
+	 * generates 54 bytes ?? O_o ??
+	 */
+	len--;
+
+	/* Handle decoded message */
+	gm = (struct gprs_message *) malloc(sizeof(struct gprs_message) + len);
+	if (!gm)
+		return -ENOMEM;
+
+	gm->fn = bb->fn_first;
+	gm->arfcn = arfcn;
+	gm->len = len;
+	gm->tn = tn;
+
+	/* Average the measurements */
+	gm->rxl = MEAS_AVG(bb->rxl);
+	gm->snr = MEAS_AVG(bb->snr);
+
+	/* Copy the message payload */
+	memcpy(gm->msg, l2, len);
+
+	/* Handle the message */
+	rc = rlc_type_handler(gm);
+	free(gm);
+
+	return rc;
+}
diff --git a/src/host/gprsdecode/gprs.h b/src/host/gprsdecode/gprs.h
new file mode 100644
index 00000000..1147d543
--- /dev/null
+++ b/src/host/gprsdecode/gprs.h
@@ -0,0 +1,23 @@
+#pragma once
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#define GSM_BURST_PL_LEN	116
+#define GPRS_BURST_PL_LEN	GSM_BURST_PL_LEN
+
+#define MEAS_AVG(meas) \
+	((meas[0] + meas[1] + meas[2] + meas[3]) / 4)
+
+/* Burst decoder state */
+struct burst_buf {
+	unsigned snr[4];
+	unsigned rxl[4];
+	unsigned errors;
+	unsigned count;
+
+	sbit_t bursts[GSM_BURST_PL_LEN * 4];
+	uint32_t fn_first;
+};
+
+int process_pdch(struct l1ctl_burst_ind *bi, bool verbose);
diff --git a/src/host/gprsdecode/gsmtap.c b/src/host/gprsdecode/gsmtap.c
new file mode 100644
index 00000000..5c124b23
--- /dev/null
+++ b/src/host/gprsdecode/gsmtap.c
@@ -0,0 +1,105 @@
+/*
+ * (C) 2017-2018 by sysmocom - s.f.m.c. GmbH, Author: Max <msuraev@sysmocom.de>
+ * (C) 2018 by Vadim Yanitskiy <axilirator@gmail.com>
+ * (C) 2011-2012 by Luca Melette <luca@srlabs.de>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <stdbool.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/core/gsmtap_util.h>
+
+#include "l1ctl_proto.h"
+#include "gsmtap.h"
+
+static struct gsmtap_inst *gti = NULL;
+
+int gsmtap_init(const char *addr)
+{
+	gti = gsmtap_source_init(addr, GSMTAP_UDP_PORT, 0);
+	if (!gti)
+		return -EIO;
+
+	gsmtap_source_add_sink(gti);
+	return 0;
+}
+
+void gsmtap_send_rlcmac(uint8_t *msg, size_t len, uint8_t ts, bool ul)
+{
+	if (!gti)
+		return;
+
+	/* FIXME: explain params */
+	gsmtap_send(gti,
+		ul ? GSMTAP_ARFCN_F_UPLINK : 0,
+		ts, GSMTAP_CHANNEL_PACCH, 0, 0, 0, 0, msg, len);
+}
+
+void gsmtap_send_llc(uint8_t *data, size_t len, bool ul)
+{
+	struct gsmtap_hdr *gh;
+	struct msgb *msg;
+	uint8_t *dst;
+
+	if (!gti)
+		return;
+
+	/* Skip null frames */
+	if ((data[0] == 0x43) &&
+	    (data[1] == 0xc0) &&
+	    (data[2] == 0x01))
+		return;
+
+	/* Allocate a new message buffer */
+	msg = msgb_alloc(sizeof(*gh) + len, "gsmtap_tx");
+	if (!msg)
+	        return;
+
+	/* Put header in front */
+	gh = (struct gsmtap_hdr *) msgb_put(msg, sizeof(*gh));
+
+	/* Fill in header */
+	gh->version = GSMTAP_VERSION;
+	gh->hdr_len = sizeof(*gh) / 4;
+	gh->type = GSMTAP_TYPE_GB_LLC;
+	gh->timeslot = 0;
+	gh->sub_slot = 0;
+	gh->arfcn = ul ? htons(GSMTAP_ARFCN_F_UPLINK) : 0;
+	gh->snr_db = 0;
+	gh->signal_dbm = 0;
+	gh->frame_number = 0;
+	gh->sub_type = 0;
+	gh->antenna_nr = 0;
+
+	/* Put and fill the payload */
+	dst = msgb_put(msg, len);
+	memcpy(dst, data, len);
+
+	/* Finally, send to the sink */
+	gsmtap_sendmsg(gti, msg);
+}
+
diff --git a/src/host/gprsdecode/gsmtap.h b/src/host/gprsdecode/gsmtap.h
new file mode 100644
index 00000000..fc7dc6a2
--- /dev/null
+++ b/src/host/gprsdecode/gsmtap.h
@@ -0,0 +1,9 @@
+#pragma once
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdbool.h>
+
+int gsmtap_init(const char *addr);
+void gsmtap_send_rlcmac(uint8_t *msg, size_t len, uint8_t ts, bool ul);
+void gsmtap_send_llc(uint8_t *data, size_t len, bool ul);
diff --git a/src/host/gprsdecode/l1ctl_proto.h b/src/host/gprsdecode/l1ctl_proto.h
new file mode 120000
index 00000000..75862bae
--- /dev/null
+++ b/src/host/gprsdecode/l1ctl_proto.h
@@ -0,0 +1 @@
+../../../include/l1ctl_proto.h
\ No newline at end of file
diff --git a/src/host/gprsdecode/main.c b/src/host/gprsdecode/main.c
new file mode 100644
index 00000000..7e094896
--- /dev/null
+++ b/src/host/gprsdecode/main.c
@@ -0,0 +1,200 @@
+/*
+ * (C) 2017-2018 by sysmocom - s.f.m.c. GmbH, Author: Max <msuraev@sysmocom.de>
+ * (C) 2018 by Vadim Yanitskiy <axilirator@gmail.com>
+ * (C) 2011-2012 by Luca Melette <luca@srlabs.de>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <getopt.h>
+#include <signal.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdbool.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/signal.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/application.h>
+
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+#include "l1ctl_proto.h"
+#include "gsmtap.h"
+#include "gprs.h"
+
+static struct {
+	char *capture_file;
+	char *gsmtap_ip;
+	bool verbose;
+	bool quit;
+} app_data;
+
+static void burst_handle(struct l1ctl_burst_ind *bi)
+{
+	uint8_t type, subch, ts;
+	uint32_t fn;
+
+	fn = ntohl(bi->frame_nr);
+	rsl_dec_chan_nr(bi->chan_nr, &type, &subch, &ts);
+
+	switch (type) {
+	case RSL_CHAN_Bm_ACCHs:
+		/* FIXME: what is (fn % 13) != 12? */
+		/* TODO: use the multiframe layout here */
+		if ((ts > 0) && ((fn % 13) != 12))
+			process_pdch(bi, app_data.verbose);
+		break;
+	default:
+		/* We are only interested in GPRS messages */
+		break;
+	}
+}
+
+static void print_help(const char *app)
+{
+	printf(" Some help...\n\n");
+
+	printf(" Usage: %s [OPTIONS]\n\n", app);
+
+	printf("  -h --help          this text\n");
+	printf("  -c --capture       The capture file to decode\n");
+	printf("  -i --gsmtap-ip     The destination IP used for GSMTAP\n");
+	printf("  -v --verbose       Increase the verbosity level\n");
+}
+
+static int handle_options(int argc, char **argv)
+{
+	/* Init defaults */
+	app_data.capture_file = NULL;
+	app_data.gsmtap_ip = NULL;
+	app_data.verbose = false;
+	app_data.quit = false;
+
+	/* Parse options */
+	while (1) {
+		int option_index = 0, c;
+		static struct option long_options[] = {
+			{"help", 0, 0, 'h'},
+			{"verbose", 0, 0, 'v'},
+			{"capture", 1, 0, 'c'},
+			{"gsmtap-ip", 1, 0, 'i'},
+			{0, 0, 0, 0}
+		};
+
+		c = getopt_long(argc, argv, "c:i:vh",
+			long_options, &option_index);
+		if (c == -1)
+			break;
+
+		switch (c) {
+		case 'h':
+			print_help(argv[0]);
+			return 1;
+		case 'c':
+			app_data.capture_file = optarg;
+			break;
+		case 'i':
+			app_data.gsmtap_ip = optarg;
+			break;
+		case 'v':
+			app_data.verbose = true;
+			break;
+		default:
+			break;
+		}
+	}
+
+	/* Make sure we have the capture file path */
+	if (!app_data.capture_file) {
+		print_help(argv[0]);
+		printf("\nPlease specify the capture file\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+static void signal_handler(int signal)
+{
+	fprintf(stderr, "signal %d received\n", signal);
+
+	switch (signal) {
+	case SIGINT:
+		app_data.quit = true;
+		break;
+	default:
+		break;
+	}
+}
+
+int main(int argc, char **argv)
+{
+	struct l1ctl_burst_ind bi;
+	FILE *burst_fd;
+	int rc;
+
+	/* Setup signal handlers */
+	signal(SIGINT, &signal_handler);
+	osmo_init_ignore_signals();
+
+	/* Parse options */
+	rc = handle_options(argc, argv);
+	if (rc)
+		return EXIT_FAILURE;
+
+	/* Attempt to open the capture for reading */
+	burst_fd = fopen(app_data.capture_file, "rb");
+	if (!burst_fd) {
+		printf("Cannot open capture file '%s': %s\n",
+			app_data.capture_file, strerror(errno));
+		return EXIT_FAILURE;
+	}
+
+	/* Init GSMTAP sink if required */
+	if (app_data.gsmtap_ip != NULL)
+		gsmtap_init(app_data.gsmtap_ip);
+
+	/* Application main loop */
+	while (!app_data.quit) {
+		/* The end of capture file */
+		if (feof(burst_fd))
+			break;
+
+		/* Read a single burst */
+		rc = fread(&bi, sizeof(bi), 1, burst_fd);
+		if (!rc)
+			break;
+
+		/* Filter or handle burst */
+		burst_handle(&bi);
+
+		osmo_select_main(1);
+	}
+
+	/* Close the capture file */
+	fclose(burst_fd);
+
+	return 0;
+}
diff --git a/src/host/gprsdecode/rlcmac.c b/src/host/gprsdecode/rlcmac.c
new file mode 100644
index 00000000..d33cb1eb
--- /dev/null
+++ b/src/host/gprsdecode/rlcmac.c
@@ -0,0 +1,418 @@
+/*
+ * (C) 2017-2018 by sysmocom - s.f.m.c. GmbH, Author: Max <msuraev@sysmocom.de>
+ * (C) 2018 by Vadim Yanitskiy <axilirator@gmail.com>
+ * (C) 2011-2012 by Luca Melette <luca@srlabs.de>
+ *
+ * All Rights Reserved
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <sys/time.h>
+
+#include <osmocom/core/gsmtap.h>
+
+#include "l1ctl_proto.h"
+#include "rlcmac.h"
+#include "gsmtap.h"
+
+static struct gprs_tbf tbf_table[32 * 2];
+
+static inline int too_old(uint32_t current_fn, uint32_t test_fn)
+{
+	uint32_t delta = (current_fn - test_fn) & 0xffffffff;
+
+	/* More and less 30 seconds from now */
+	return abs(delta) > OLD_TIME;
+}
+
+static inline int bsn_is_next(uint8_t first, uint8_t second)
+{
+	return ((first + 1) % 128) == second;
+}
+
+void print_pkt(uint8_t *msg, size_t len)
+{
+	size_t i;
+
+	printf("MSG: ");
+	for (i = 0; i < len; i++)
+		printf("%.02x", msg[i]);
+	printf("\n");
+}
+
+void process_blocks(struct gprs_tbf *t, bool ul)
+{
+	uint8_t llc_data[65536], llc_first_bsn, llc_last_bsn = 0;
+	unsigned skip, llc_len = 0;
+	uint8_t bsn, bsn2, li_off;
+	uint32_t current_fn;
+	struct gprs_frag *f;
+	struct gprs_lime *l;
+
+	/* Get current "time", oldest unreassembled frag */
+	bsn = t->start_bsn;
+	while (t->frags[bsn].len == 0) {
+		bsn = (bsn + 1) % 128;
+		if (bsn == t->start_bsn) {
+			printf("no valid  blocks in current TBF!\n");
+			fflush(stdout);
+			return;
+		}
+	}
+	current_fn = t->frags[bsn].fn;
+	t->start_bsn = bsn;
+
+	/* Walk through fragments, mark reassembled/used blocks */
+	skip = 0;
+	for (bsn = t->start_bsn; bsn != ((t->last_bsn + 1) % 128); bsn = (bsn + 1) % 128) {
+		/* Get fragment descriptor */
+		f = &t->frags[bsn];
+
+		printf(" bsn %d ", bsn);
+		fflush(stdout);
+
+		/* Already processed or null */
+		if (!f->len) {
+			printf("null\n");
+			fflush(stdout);
+			llc_len = 0;
+			skip = 1;
+			continue;
+		}
+
+		/* Check fragment age */
+		if (too_old(current_fn, f->fn)) {
+			printf("old segment\n");
+			fflush(stdout);
+			llc_len = 0;
+			skip = 1;
+			continue;
+		}
+
+		/* Update "time" */
+		current_fn = f->fn;
+
+		if (llc_len && !bsn_is_next(llc_last_bsn, bsn)) {
+			printf("missing bsn, previous %d\n", llc_last_bsn);
+			fflush(stdout);
+			llc_len = 0;
+			skip = 1;
+			continue;
+		}
+
+		/* Check for multiple blocks/parts */
+		if (f->n_blocks == 0) {
+			/* Check if first part of message */
+			if (!llc_len)
+				llc_first_bsn = bsn;
+
+			/* Append data to buffer */
+			memcpy(&llc_data[llc_len], f->data, f->len);
+
+			llc_len += f->len;
+
+			llc_last_bsn = bsn;
+
+			/* Last TBF block? (very rare condition) */
+			if (f->last) {
+				printf("end of TBF\n");
+				fflush(stdout);
+				print_pkt(llc_data, llc_len);
+
+				gsmtap_send_llc(llc_data, llc_len, ul);
+
+				/* Reset all fragments */
+				for (bsn2 = 0; bsn2 < 128; bsn2++) {
+					f = &t->frags[bsn2];
+					f->len = 0;
+					f->n_blocks = 0;
+				}
+
+				/* Reset buffer state */
+				llc_len = 0;
+				t->start_bsn = 0;
+			}
+		} else {
+			/* Multiple data parts */
+			unsigned i;
+			li_off = 0;
+			for (i = 0; i < f->n_blocks; i++) {
+				printf("\nlime %d\n", i);
+				fflush(stdout);
+				l = &f->blocks[i];
+				if (l->used) {
+					if (llc_len) {
+						printf("\nlime error!\n");
+						fflush(stdout);
+						llc_len = 0;
+					}
+				} else {
+					if (!llc_len)
+						llc_first_bsn = bsn;
+
+					/* Append data to buffer */
+					memcpy(&llc_data[llc_len], &f->data[li_off], l->li);
+
+					llc_len += l->li;
+
+					llc_last_bsn = bsn;
+
+					if (!l->e || !l->m || (l->e && l->m)) {
+						/* Message ends here */
+						printf("end of message reached\n");
+						fflush(stdout);
+						print_pkt(llc_data, llc_len);
+
+						gsmtap_send_llc(llc_data, llc_len, ul);
+
+						/* Mark frags as used */
+						l->used = 1;
+						if (llc_first_bsn != bsn) {
+						}
+
+
+						llc_len = 0;
+						if (!skip)
+							t->start_bsn = bsn;
+					}
+				}
+
+				li_off += l->li;
+			}
+
+			/* Is spare data valid? */
+			if (l->m) {
+				if (llc_len) {
+					printf("spare and buffer not empty!\n");
+					print_pkt(llc_data, llc_len);
+					fflush(stdout);
+				}
+				if ((f->len > li_off) && (f->len-li_off < 65536)) {
+					memcpy(llc_data, &f->data[li_off], f->len-li_off);
+					llc_len = f->len - li_off;
+					llc_first_bsn = bsn;
+					llc_last_bsn = bsn;
+					t->start_bsn = bsn;
+				}
+			}
+
+		}
+	}
+
+	/* Shift window if needed */
+	if (((t->last_bsn - t->start_bsn) % 128) > 64) {
+		t->start_bsn = (t->last_bsn - 64) % 128;
+		printf("shifting window\n");
+		fflush(stdout);
+	}
+}
+
+void rlc_data_handler(struct gprs_message *gm)
+{
+	int ul, off, d_bsn;
+	uint8_t tfi, bsn, cv = 1, fbi = 0;
+	uint32_t d_same_bsn, d_last_bsn;
+	struct gprs_tbf *t, *t_prev;
+	struct gprs_frag *f;
+	struct gprs_lime *l;
+
+	tfi = (gm->msg[1] & 0x3e) >> 1;
+	bsn = (gm->msg[2] & 0xfe) >> 1;
+
+	/* Get "end of TBF" according to direction */
+	ul = !!(gm->arfcn & GSMTAP_ARFCN_F_UPLINK);
+	if (ul) {
+		cv = (gm->msg[0] & 0x3c) >> 2;
+		printf("TFI %d BSN %d CV %d ", tfi, bsn, cv);
+	} else {
+		fbi = (gm->msg[1] & 0x01);
+		printf("TFI %d BSN %d FBI %d ", tfi, bsn, fbi);
+	}
+
+	/* Get TBF descriptor for TFI,UL couple */
+	t = &tbf_table[2 * tfi + ul];
+
+	d_same_bsn = (gm->fn - t->frags[bsn].fn) & 0xffffffff;
+	d_last_bsn = (gm->fn - t->frags[t->last_bsn].fn) & 0xffffffff;
+	d_bsn = (bsn - t->last_bsn) % 128;
+
+	printf("\nfn_same_bsn %d fn_last_bsn %d delta_bsn %d old_len %d\n",
+		d_same_bsn, d_last_bsn, d_bsn, t->frags[bsn].len);
+
+	/* New / old fragment decision */
+	if (d_same_bsn > OLD_TIME) {
+		if (d_last_bsn > OLD_TIME) {
+			/* New TBF is starting, close old one... */
+			t_prev = &tbf_table[2 * ((tfi + 1) % 32) + ul];
+			printf("clearing TBF %d, first %d last %d\n",
+				(tfi + 1) % 32, t_prev->start_bsn, t_prev->last_bsn);
+			f = &t_prev->frags[t_prev->last_bsn];
+
+			/* ...only if data is present */
+			if (f->len) {
+				f->last = 1;
+				process_blocks(t_prev, ul);
+			}
+
+			printf("new TBF, starting from %d\n", bsn);
+			t->start_bsn = 0;
+			t->last_bsn = bsn;
+			memset(t->frags, 0, 128 * sizeof(struct gprs_frag));
+		} else {
+			/* Fresh frag, current TBF */
+			if ((d_bsn >= 0) || (d_bsn < -64)) {
+				/* New frag */
+				t->last_bsn = bsn;
+			} else {
+				/* Out of sequence / duplicate */
+				t->frags[bsn].fn = gm->fn;
+				printf("duplicate\n");
+				fflush(stdout);
+				return;
+			}
+		}
+	} else {
+		if (d_last_bsn > OLD_TIME) {
+			printf("fucking error last_bsn!\n");
+			fflush(stdout);
+			return;
+		} else {
+			/* Fresh frag, current TBF */
+			if (d_bsn > 0) {
+				printf("fucking error d_bsn!\n");
+				fflush(stdout);
+				return;
+			} else {
+				if (d_bsn < -64) {
+					/* New frag */
+					t->last_bsn = bsn;
+				} else {
+					/* Duplicate */
+					t->frags[bsn].fn = gm->fn;
+					printf("duplicate2\n");
+					fflush(stdout);
+					return;
+				}
+			}
+		}
+	}
+
+	/* Get fragment struct for current BSN */
+	f = &t->frags[bsn];
+
+	/* Scan for LI_M_E entries */
+	off = 2;
+	f->n_blocks = 0;
+	while (!(gm->msg[off++] & 0x01)) {
+		l = &f->blocks[f->n_blocks++];
+		l->li = (gm->msg[off] & 0xfc) >> 2;
+		l->m = (gm->msg[off] & 0x02) >> 1;
+		l->e = (gm->msg[off] & 0x01);
+		l->used = 0;
+	}
+
+	/* End of TBF? */
+	f->last = (!cv || fbi) ? 1 : 0;
+
+	/* Optional fields for uplink, indicated in TI and PI */
+	if (ul) {
+		if (gm->msg[1] & 0x01) {
+			printf("TLLI 0x%.02x%.02x%.02x%.02x ", gm->msg[off],
+				gm->msg[off+1], gm->msg[off + 2], gm->msg[off + 3]);
+			off += 4;
+		}
+		if (gm->msg[1] & 0x40) {
+			printf("PFI %d ", gm->msg[off]);
+			off += 1;
+		}
+	}
+
+	/* Copy data part of message */
+	f->len = gm->len - off;
+	f->fn = gm->fn;
+	memcpy(f->data, &gm->msg[off], f->len);
+
+	process_blocks(t, ul);
+}
+
+int rlc_type_handler(struct gprs_message *gm)
+{
+	bool ul = !!(gm->arfcn & GSMTAP_ARFCN_F_UPLINK);
+	uint8_t rlc_type = (gm->msg[0] & 0xc0) >> 6;
+	int rc = 0;
+
+	/* Determine the RLC type */
+	switch (rlc_type) {
+	case 0:
+		printf("TS %d ", gm->tn);
+
+		switch(gm->len) {
+		case 23:
+			printf("CS1 ");
+			break;
+		case 33:
+			printf("CS2 ");
+			break;
+		case 39:
+			printf("CS3 ");
+			break;
+		case 53:
+			printf("CS4 ");
+			break;
+		default:
+			printf("unknown (M)CS ");
+		}
+
+		printf(ul ? "UL " : "DL ");
+
+		gsmtap_send_rlcmac(gm->msg, gm->len, gm->tn, ul);
+
+		printf("DATA ");
+		rlc_data_handler(gm);
+		printf("\n");
+		fflush(stdout);
+		break;
+
+	/* Control block */
+	case 1:
+	case 2:
+		gsmtap_send_rlcmac(gm->msg, gm->len, gm->tn,
+			!!(gm->arfcn & GSMTAP_ARFCN_F_UPLINK));
+		rc = 0;
+		break;
+
+	/* Reserved */
+	case 3:
+		printf("RLC type: reserved\n");
+		rc = 0;
+		break;
+
+	default:
+		printf("Unrecognized RLC type: %d\n", rlc_type);
+		return -EINVAL;
+	}
+
+	return rc;
+}
diff --git a/src/host/gprsdecode/rlcmac.h b/src/host/gprsdecode/rlcmac.h
new file mode 100644
index 00000000..2381d771
--- /dev/null
+++ b/src/host/gprsdecode/rlcmac.h
@@ -0,0 +1,43 @@
+#pragma once
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#define OLD_TIME 2000
+
+struct gprs_message {
+	uint16_t arfcn;
+	uint32_t fn;
+	uint8_t tn;
+	uint8_t rxl;
+	uint8_t snr;
+	uint8_t len;
+	uint8_t msg[0];
+};
+
+struct gprs_lime {
+	uint8_t li:6,
+		m:1,
+		e:1;
+	uint8_t used;
+} __attribute__ ((packed));
+
+struct gprs_frag {
+	uint32_t fn;
+	uint8_t last;
+	uint8_t len;
+	uint8_t data[53];
+	uint8_t n_blocks;
+	struct gprs_lime blocks[20];
+} __attribute__ ((packed));
+
+struct gprs_tbf {
+	uint8_t last_bsn;
+	uint8_t start_bsn;
+	struct gprs_frag frags[128];
+} __attribute__ ((packed));
+
+void print_pkt(uint8_t *msg, size_t len);
+void process_blocks(struct gprs_tbf *t, bool ul);
+void rlc_data_handler(struct gprs_message *gm);
+int rlc_type_handler(struct gprs_message *gm);
diff --git a/src/host/gprsdecode/tests/Makefile.am b/src/host/gprsdecode/tests/Makefile.am
new file mode 100644
index 00000000..4a0c4669
--- /dev/null
+++ b/src/host/gprsdecode/tests/Makefile.am
@@ -0,0 +1,48 @@
+# The `:;' works around a Bash 3.2 bug when the output is not writeable.
+$(srcdir)/package.m4: $(top_srcdir)/configure.ac
+	:;{ \
+		echo '# Signature of the current package.' && \
+		echo 'm4_define([AT_PACKAGE_NAME],' && \
+		echo '  [$(PACKAGE_NAME)])' && \
+		echo 'm4_define([AT_PACKAGE_TARNAME],' && \
+		echo '  [$(PACKAGE_TARNAME)])' && \
+		echo 'm4_define([AT_PACKAGE_VERSION],' && \
+		echo '  [$(PACKAGE_VERSION)])' && \
+		echo 'm4_define([AT_PACKAGE_STRING],' && \
+		echo '  [$(PACKAGE_STRING)])' && \
+		echo 'm4_define([AT_PACKAGE_BUGREPORT],' && \
+		echo '  [$(PACKAGE_BUGREPORT)])'; \
+		echo 'm4_define([AT_PACKAGE_URL],' && \
+		echo '  [$(PACKAGE_URL)])'; \
+	} >'$(srcdir)/package.m4'
+
+DISTCLEANFILES = atconfig
+TESTSUITE = $(srcdir)/testsuite
+
+EXTRA_DIST = \
+	$(srcdir)/package.m4 \
+	testsuite.at \
+	$(TESTSUITE) \
+	$(NULL)
+
+EXTRA_DIST += \
+	cs2.sample \
+	cs3.sample \
+	cs2.decoded \
+	cs3.decoded \
+	$(NULL)
+
+check-local: atconfig $(TESTSUITE)
+	$(SHELL) '$(TESTSUITE)' $(TESTSUITEFLAGS)
+
+installcheck-local: atconfig $(TESTSUITE)
+	$(SHELL) '$(TESTSUITE)' AUTOTEST_PATH='$(bindir)' $(TESTSUITEFLAGS)
+
+clean-local:
+	test ! -f '$(TESTSUITE)' || $(SHELL) '$(TESTSUITE)' --clean
+
+AUTOM4TE = $(SHELL) $(top_srcdir)/missing --run autom4te
+AUTOTEST = $(AUTOM4TE) --language=autotest
+$(TESTSUITE): $(srcdir)/testsuite.at $(srcdir)/package.m4
+	$(AUTOTEST) -I '$(srcdir)' -o $@.tmp $@.at
+	mv $@.tmp $@
diff --git a/src/host/gprsdecode/tests/cs2.decoded b/src/host/gprsdecode/tests/cs2.decoded
new file mode 100644
index 00000000..ea3cf944
--- /dev/null
+++ b/src/host/gprsdecode/tests/cs2.decoded
@@ -0,0 +1,450 @@
+TS 7 CS2 UL DATA TFI 21 BSN 0 CV 1 
+fn_same_bsn 494819 fn_last_bsn 494819 delta_bsn 0 old_len 0
+clearing TBF 22, first 0 last 0
+new TBF, starting from 0
+ bsn 0 
+TS 7 CS2 UL DATA TFI 21 BSN 1 CV 0 
+fn_same_bsn 494823 fn_last_bsn 4 delta_bsn 1 old_len 0
+ bsn 0  bsn 1 
+lime 0
+end of message reached
+MSG: 01c001080102e5e071070405f41b40072b62f208000100121953422ae57ef909006aa4d594321200d5401716cfabbb
+
+TS 7 CS2 UL DATA TFI 21 BSN 0 CV 1 
+fn_same_bsn 8 fn_last_bsn 4 delta_bsn -1 old_len 30
+duplicate2
+
+TS 7 CS2 UL DATA TFI 21 BSN 1 CV 0 
+fn_same_bsn 9 fn_last_bsn 9 delta_bsn 0 old_len 29
+duplicate2
+
+TS 7 CS2 UL DATA TFI 21 BSN 0 CV 1 
+fn_same_bsn 9 fn_last_bsn 4 delta_bsn -1 old_len 30
+duplicate2
+
+TS 7 CS2 DL DATA TFI 16 BSN 0 FBI 0 
+fn_same_bsn 494866 fn_last_bsn 494866 delta_bsn 0 old_len 0
+clearing TBF 17, first 0 last 0
+new TBF, starting from 0
+ bsn 0 
+lime 0
+end of message reached
+MSG: 01c0010802012a0462f2080001001805f444f70250b6151a
+
+TS 7 CS4 DL DATA TFI 16 BSN 1 FBI 0 
+fn_same_bsn 494897 fn_last_bsn 31 delta_bsn 1 old_len 0
+ bsn 0 
+lime 0
+ bsn 1 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 2 FBI 0 
+fn_same_bsn 494914 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 1 
+lime 0
+
+lime 1
+ bsn 2 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 3 FBI 0 
+fn_same_bsn 494936 fn_last_bsn 22 delta_bsn 1 old_len 0
+ bsn 2 
+lime 0
+ bsn 3 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 UL DATA TFI 20 BSN 0 CV 0 
+fn_same_bsn 494953 fn_last_bsn 494953 delta_bsn 0 old_len 0
+clearing TBF 21, first 1 last 1
+ bsn 1 
+lime 0
+new TBF, starting from 0
+ bsn 0 
+lime 0
+end of message reached
+MSG: 01c00508038d8a47
+
+TS 7 CS4 UL DATA TFI 20 BSN 0 CV 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 7 CS4 UL DATA TFI 20 BSN 0 CV 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 7 CS4 UL DATA TFI 20 BSN 0 CV 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 7 CS4 DL DATA TFI 16 BSN 4 FBI 0 
+fn_same_bsn 494992 fn_last_bsn 56 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 5 FBI 0 
+fn_same_bsn 495009 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 4 
+lime 0
+ bsn 5 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 6 FBI 0 
+fn_same_bsn 495031 fn_last_bsn 22 delta_bsn 1 old_len 0
+ bsn 5 
+lime 0
+ bsn 6 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 UL DATA TFI 19 BSN 0 CV 1 
+fn_same_bsn 495048 fn_last_bsn 495048 delta_bsn 0 old_len 0
+clearing TBF 20, first 0 last 0
+ bsn 0 
+lime 0
+new TBF, starting from 0
+ bsn 0 
+TS 7 CS4 UL DATA TFI 19 BSN 1 CV 0 
+fn_same_bsn 495053 fn_last_bsn 5 delta_bsn 1 old_len 0
+ bsn 0  bsn 1 
+lime 0
+end of message reached
+MSG: 01c0090a4105030e00001f10000000000000000000000201212806056a7564666f272680c0230f0100000f04666a6b640567666a6d668021100100001081060000000083060000000032e5d0
+
+TS 7 CS4 UL DATA TFI 19 BSN 0 CV 1 
+fn_same_bsn 9 fn_last_bsn 4 delta_bsn -1 old_len 50
+duplicate2
+
+TS 7 CS4 UL DATA TFI 19 BSN 1 CV 0 
+fn_same_bsn 8 fn_last_bsn 8 delta_bsn 0 old_len 49
+duplicate2
+
+TS 7 CS4 DL DATA TFI 16 BSN 7 FBI 0 
+fn_same_bsn 495066 fn_last_bsn 35 delta_bsn 1 old_len 0
+ bsn 6 
+lime 0
+ bsn 7 
+TS 7 CS4 UL DATA TFI 19 BSN 0 CV 1 
+fn_same_bsn 9 fn_last_bsn 5 delta_bsn -1 old_len 50
+duplicate2
+
+TS 7 CS4 DL DATA TFI 16 BSN 8 FBI 0 
+fn_same_bsn 495074 fn_last_bsn 8 delta_bsn 1 old_len 0
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 
+lime 0
+end of message reached
+MSG: 01c0058a42030e23621f72993f3f1143ffff000000002b0601210a00000627148080211002000010810608080808830600000000d68800
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 9 FBI 0 
+fn_same_bsn 495096 fn_last_bsn 22 delta_bsn 1 old_len 0
+ bsn 8 
+lime 0
+
+lime 1
+ bsn 9 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 10 FBI 0 
+fn_same_bsn 495113 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 11 FBI 0 
+fn_same_bsn 495131 fn_last_bsn 18 delta_bsn 1 old_len 0
+ bsn 10 
+lime 0
+ bsn 11 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 12 FBI 0 
+fn_same_bsn 495148 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 11 
+lime 0
+ bsn 12 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 13 FBI 0 
+fn_same_bsn 495165 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 12 
+lime 0
+ bsn 13 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 14 FBI 0 
+fn_same_bsn 495183 fn_last_bsn 18 delta_bsn 1 old_len 0
+ bsn 13 
+lime 0
+ bsn 14 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 15 FBI 0 
+fn_same_bsn 495200 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 14 
+lime 0
+ bsn 15 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 16 FBI 0 
+fn_same_bsn 495217 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 15 
+lime 0
+ bsn 16 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 17 FBI 0 
+fn_same_bsn 495235 fn_last_bsn 18 delta_bsn 1 old_len 0
+ bsn 16 
+lime 0
+ bsn 17 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 18 FBI 0 
+fn_same_bsn 495252 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 17 
+lime 0
+ bsn 18 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 19 FBI 0 
+fn_same_bsn 495269 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 18 
+lime 0
+ bsn 19 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 20 FBI 0 
+fn_same_bsn 495287 fn_last_bsn 18 delta_bsn 1 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 21 FBI 0 
+fn_same_bsn 495304 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 20 
+lime 0
+ bsn 21 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 22 FBI 0 
+fn_same_bsn 495321 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 21 
+lime 0
+ bsn 22 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 23 FBI 0 
+fn_same_bsn 495339 fn_last_bsn 18 delta_bsn 1 old_len 0
+ bsn 22 
+lime 0
+ bsn 23 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 24 FBI 0 
+fn_same_bsn 495356 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 23 
+lime 0
+ bsn 24 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 25 FBI 0 
+fn_same_bsn 495373 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 24 
+lime 0
+ bsn 25 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 26 FBI 0 
+fn_same_bsn 495391 fn_last_bsn 18 delta_bsn 1 old_len 0
+ bsn 25 
+lime 0
+ bsn 26 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 27 FBI 0 
+fn_same_bsn 495408 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 26 
+lime 0
+ bsn 27 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 28 FBI 0 
+fn_same_bsn 495425 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 27 
+lime 0
+ bsn 28 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 29 FBI 0 
+fn_same_bsn 495443 fn_last_bsn 18 delta_bsn 1 old_len 0
+ bsn 28 
+lime 0
+ bsn 29 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 30 FBI 0 
+fn_same_bsn 495460 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 29 
+lime 0
+ bsn 30 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 31 FBI 0 
+fn_same_bsn 495477 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 30 
+lime 0
+ bsn 31 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 32 FBI 0 
+fn_same_bsn 495495 fn_last_bsn 18 delta_bsn 1 old_len 0
+ bsn 31 
+lime 0
+ bsn 32 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 33 FBI 0 
+fn_same_bsn 495512 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 32 
+lime 0
+ bsn 33 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 34 FBI 0 
+fn_same_bsn 495529 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 33 
+lime 0
+ bsn 34 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 35 FBI 0 
+fn_same_bsn 495547 fn_last_bsn 18 delta_bsn 1 old_len 0
+ bsn 34 
+lime 0
+ bsn 35 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 36 FBI 0 
+fn_same_bsn 495564 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 35 
+lime 0
+ bsn 36 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 37 FBI 0 
+fn_same_bsn 495581 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 36 
+lime 0
+ bsn 37 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 38 FBI 0 
+fn_same_bsn 495599 fn_last_bsn 18 delta_bsn 1 old_len 0
+ bsn 37 
+lime 0
+ bsn 38 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 39 FBI 0 
+fn_same_bsn 495616 fn_last_bsn 17 delta_bsn 1 old_len 0
+ bsn 38 
+lime 0
+ bsn 39 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 7 CS4 DL DATA TFI 16 BSN 40 FBI 1 
+fn_same_bsn 495620 fn_last_bsn 4 delta_bsn 1 old_len 0
+ bsn 39 
+lime 0
+ bsn 40 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
diff --git a/src/host/gprsdecode/tests/cs2.sample b/src/host/gprsdecode/tests/cs2.sample
new file mode 100644
index 00000000..4fe83da6
--- /dev/null
+++ b/src/host/gprsdecode/tests/cs2.sample
diff --git a/src/host/gprsdecode/tests/cs3.decoded b/src/host/gprsdecode/tests/cs3.decoded
new file mode 100644
index 00000000..7af0753c
--- /dev/null
+++ b/src/host/gprsdecode/tests/cs3.decoded
@@ -0,0 +1,6278 @@
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 16895 fn_last_bsn 16895 delta_bsn 0 old_len 0
+clearing TBF 1, first 0 last 0
+new TBF, starting from 0
+ bsn 0 
+lime 0
+end of message reached
+MSG: 41c001081502de8e9a
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 1 FBI 0 
+fn_same_bsn 16986 fn_last_bsn 39 delta_bsn 1 old_len 0
+ bsn 0 
+lime 0
+
+lime 1
+ bsn 1 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS2 DL DATA TFI 0 BSN 1 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 29
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 16999 fn_last_bsn 8 delta_bsn 1 old_len 0
+ bsn 1 
+lime 0
+ bsn 2 
+lime 0
+end of message reached
+MSG: 41c005081501c7d312
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS2 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 3 FBI 0 
+fn_same_bsn 17064 fn_last_bsn 30 delta_bsn 1 old_len 0
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS2 DL DATA TFI 0 BSN 3 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 29
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 3 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 29
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 3 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 29
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 3 FBI 0 
+fn_same_bsn 9 fn_last_bsn 9 delta_bsn 0 old_len 29
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 5 FBI 0 
+fn_same_bsn 17090 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+end of message reached
+MSG: 2b2b2b
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS2 DL DATA TFI 0 BSN 5 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 5 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 5 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 5 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS2 DL DATA TFI 0 BSN 5 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 28
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 6 FBI 0 
+fn_same_bsn 17142 fn_last_bsn 30 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 0 BSN 6 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 6 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 6 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 6 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 6 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 17177 fn_last_bsn 13 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7 
+TS 4 CS3 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 36
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 36
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 36
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 36
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 36
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 9 FBI 0 
+fn_same_bsn 17203 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 0 BSN 9 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 9 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 9 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 9 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 9 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 10 FBI 0 
+fn_same_bsn 17264 fn_last_bsn 39 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 0 BSN 10 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 10 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 10 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 10 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 10 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 11 FBI 0 
+fn_same_bsn 17324 fn_last_bsn 39 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+ bsn 11 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 0 BSN 11 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 11 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 11 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 11 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 11 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 12 FBI 0 
+fn_same_bsn 17381 fn_last_bsn 35 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+ bsn 11 
+lime 0
+ bsn 12 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 0 BSN 12 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 12 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 12 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 12 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 12 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 17441 fn_last_bsn 39 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+ bsn 11 
+lime 0
+ bsn 12 
+lime 0
+ bsn 13 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 14 FBI 0 
+fn_same_bsn 17498 fn_last_bsn 35 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+ bsn 11 
+lime 0
+ bsn 12 
+lime 0
+ bsn 13 
+lime 0
+ bsn 14 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 0 BSN 14 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 14 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 14 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 14 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 14 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 15 FBI 0 
+fn_same_bsn 17558 fn_last_bsn 39 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+ bsn 11 
+lime 0
+ bsn 12 
+lime 0
+ bsn 13 
+lime 0
+ bsn 14 
+lime 0
+ bsn 15 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 0 BSN 15 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 15 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 15 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 15 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 15 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 16 FBI 1 
+fn_same_bsn 18005 fn_last_bsn 425 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+ bsn 11 
+lime 0
+ bsn 12 
+lime 0
+ bsn 13 
+lime 0
+ bsn 14 
+lime 0
+ bsn 15 
+lime 0
+ bsn 16 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 0 BSN 16 FBI 1 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 16 FBI 1 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 16 FBI 1 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 16 FBI 1 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 16 FBI 1 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 35
+duplicate2
+
+TS 4 CS3 DL DATA TFI 1 BSN 1 FBI 0 
+fn_same_bsn 18109 fn_last_bsn 18109 delta_bsn 1 old_len 0
+clearing TBF 2, first 0 last 0
+new TBF, starting from 1
+ bsn 1 
+TS 4 CS3 DL DATA TFI 1 BSN 0 FBI 0 
+fn_same_bsn 18113 fn_last_bsn 4 delta_bsn -1 old_len 0
+duplicate
+
+TS 4 CS3 DL DATA TFI 1 BSN 2 FBI 0 
+fn_same_bsn 18117 fn_last_bsn 8 delta_bsn 1 old_len 0
+ bsn 1  bsn 2 
+lime 0
+end of message reached
+MSG: 26818000010001000000000277730367746d046163657203636f6d0000010001c00c00010001000000070004c76b780a5a9f7f
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 1 BSN 1 FBI 0 
+fn_same_bsn 13 fn_last_bsn 5 delta_bsn -1 old_len 36
+duplicate2
+
+TS 4 CS3 DL DATA TFI 1 BSN 0 FBI 0 
+fn_same_bsn 13 fn_last_bsn 9 delta_bsn -2 old_len 0
+duplicate2
+
+TS 4 CS3 DL DATA TFI 1 BSN 2 FBI 0 
+fn_same_bsn 13 fn_last_bsn 13 delta_bsn 0 old_len 34
+duplicate2
+
+TS 4 CS3 DL DATA TFI 1 BSN 1 FBI 0 
+fn_same_bsn 13 fn_last_bsn 5 delta_bsn -1 old_len 36
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 18174 fn_last_bsn 44 delta_bsn 1 old_len 0
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 8 fn_last_bsn 8 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 3 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 5 FBI 0 
+fn_same_bsn 18234 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+end of message reached
+MSG: 64010303000101080a2df10b9001cbcbdf04020000d10cd2
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 5 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 5 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 5 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 5 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 5 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 6 FBI 0 
+fn_same_bsn 18286 fn_last_bsn 30 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 6 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 6 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 6 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 6 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 6 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 7 FBI 0 
+fn_same_bsn 18343 fn_last_bsn 35 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 7 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 7 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 7 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 7 FBI 0 
+fn_same_bsn 8 fn_last_bsn 8 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 9 FBI 0 
+fn_same_bsn 18395 fn_last_bsn 31 delta_bsn 2 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7 
+lime 0
+ bsn 8 null
+ bsn 9 
+lime 0
+end of message reached
+MSG: 0a2df10e5d01cbcc1afd50b8
+
+TS 4 CS4 DL DATA TFI 1 BSN 11 FBI 0 
+fn_same_bsn 18399 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 9 
+lime 0
+ bsn 10 null
+ bsn 11 
+TS 4 CS4 DL DATA TFI 1 BSN 13 FBI 0 
+fn_same_bsn 18403 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 9 
+lime 0
+ bsn 10 null
+ bsn 11  bsn 12 null
+ bsn 13 
+TS 4 CS4 DL DATA TFI 1 BSN 15 FBI 0 
+fn_same_bsn 18408 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 9 
+lime 0
+ bsn 10 null
+ bsn 11  bsn 12 null
+ bsn 13  bsn 14 null
+ bsn 15 
+TS 4 CS4 DL DATA TFI 1 BSN 17 FBI 0 
+fn_same_bsn 18412 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 9 
+lime 0
+ bsn 10 null
+ bsn 11  bsn 12 null
+ bsn 13  bsn 14 null
+ bsn 15  bsn 16 null
+ bsn 17 
+TS 4 CS4 DL DATA TFI 1 BSN 19 FBI 0 
+fn_same_bsn 18416 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 9 
+lime 0
+ bsn 10 null
+ bsn 11  bsn 12 null
+ bsn 13  bsn 14 null
+ bsn 15  bsn 16 null
+ bsn 17  bsn 18 null
+ bsn 19 
+lime 0
+end of message reached
+MSG: 696c61626c653c2f68323e0d0a3c6872ae2662
+
+TS 4 CS4 DL DATA TFI 1 BSN 21 FBI 0 
+fn_same_bsn 18421 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 null
+ bsn 21 
+TS 4 CS4 DL DATA TFI 1 BSN 8 FBI 0 
+fn_same_bsn 18425 fn_last_bsn 4 delta_bsn -13 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 1 BSN 10 FBI 0 
+fn_same_bsn 18429 fn_last_bsn 8 delta_bsn -11 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 1 BSN 12 FBI 0 
+fn_same_bsn 18434 fn_last_bsn 13 delta_bsn -9 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 1 BSN 14 FBI 0 
+fn_same_bsn 18438 fn_last_bsn 17 delta_bsn -7 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 1 BSN 16 FBI 0 
+fn_same_bsn 18442 fn_last_bsn 21 delta_bsn -5 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 1 BSN 18 FBI 0 
+fn_same_bsn 18447 fn_last_bsn 26 delta_bsn -3 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 1 BSN 20 FBI 0 
+fn_same_bsn 18451 fn_last_bsn 30 delta_bsn -1 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 18455 fn_last_bsn 34 delta_bsn 1 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 null
+ bsn 21  bsn 22 
+lime 0
+end of message reached
+MSG: c015650000044500003406b94000ee0685e8c76b780ac0a800040050db85d1b579a8c324e273801112058d9300000101080a2df10e5e01cbcc1a1347bb
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 9 FBI 0 
+fn_same_bsn 65 fn_last_bsn 5 delta_bsn -13 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 11 FBI 0 
+fn_same_bsn 65 fn_last_bsn 9 delta_bsn -11 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 13 FBI 0 
+fn_same_bsn 65 fn_last_bsn 13 delta_bsn -9 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 22 fn_last_bsn 22 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 22 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 23 FBI 0 
+fn_same_bsn 18559 fn_last_bsn 39 delta_bsn 1 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 null
+ bsn 21  bsn 22 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 23 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 23 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 23 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 23 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 23 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 23 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 24 FBI 0 
+fn_same_bsn 18616 fn_last_bsn 35 delta_bsn 1 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 null
+ bsn 21  bsn 22 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 23 
+lime 0
+ bsn 24 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 24 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 24 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 24 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 24 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 24 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 25 FBI 0 
+fn_same_bsn 18676 fn_last_bsn 39 delta_bsn 1 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 null
+ bsn 21  bsn 22 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 23 
+lime 0
+ bsn 24 
+lime 0
+ bsn 25 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 25 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 25 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 25 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 25 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 25 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 26 FBI 0 
+fn_same_bsn 18733 fn_last_bsn 35 delta_bsn 1 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 null
+ bsn 21  bsn 22 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 23 
+lime 0
+ bsn 24 
+lime 0
+ bsn 25 
+lime 0
+ bsn 26 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 26 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 26 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 26 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 26 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 26 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 27 FBI 0 
+fn_same_bsn 18793 fn_last_bsn 39 delta_bsn 1 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 null
+ bsn 21  bsn 22 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 23 
+lime 0
+ bsn 24 
+lime 0
+ bsn 25 
+lime 0
+ bsn 26 
+lime 0
+ bsn 27 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 27 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 27 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 27 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 27 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 27 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 28 FBI 0 
+fn_same_bsn 18850 fn_last_bsn 35 delta_bsn 1 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 null
+ bsn 21  bsn 22 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 23 
+lime 0
+ bsn 24 
+lime 0
+ bsn 25 
+lime 0
+ bsn 26 
+lime 0
+ bsn 27 
+lime 0
+ bsn 28 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 28 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 28 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 28 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 28 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 28 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 29 FBI 1 
+fn_same_bsn 19296 fn_last_bsn 425 delta_bsn 1 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 null
+ bsn 21  bsn 22 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 23 
+lime 0
+ bsn 24 
+lime 0
+ bsn 25 
+lime 0
+ bsn 26 
+lime 0
+ bsn 27 
+lime 0
+ bsn 28 
+lime 0
+ bsn 29 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 1 BSN 29 FBI 1 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 29 FBI 1 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 29 FBI 1 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 29 FBI 1 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 1 BSN 29 FBI 1 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 1 FBI 0 
+fn_same_bsn 2409 fn_last_bsn 1374 delta_bsn -15 old_len 29
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 3 FBI 0 
+fn_same_bsn 2318 fn_last_bsn 1378 delta_bsn -13 old_len 29
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 5 FBI 0 
+fn_same_bsn 2297 fn_last_bsn 1383 delta_bsn -11 old_len 28
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 2466 fn_last_bsn 1387 delta_bsn -16 old_len 28
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 2383 fn_last_bsn 1391 delta_bsn -14 old_len 28
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 4 FBI 0 
+fn_same_bsn 19422 fn_last_bsn 1396 delta_bsn -12 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 6 FBI 0 
+fn_same_bsn 2262 fn_last_bsn 1400 delta_bsn -10 old_len 35
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 1 FBI 0 
+fn_same_bsn 30 fn_last_bsn 1404 delta_bsn -15 old_len 29
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 3 FBI 0 
+fn_same_bsn 31 fn_last_bsn 1409 delta_bsn -13 old_len 29
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 2275 fn_last_bsn 1448 delta_bsn -9 old_len 36
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 4 fn_last_bsn 1452 delta_bsn -9 old_len 36
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 4 fn_last_bsn 1456 delta_bsn -9 old_len 36
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 5 fn_last_bsn 1461 delta_bsn -9 old_len 36
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 4 fn_last_bsn 1465 delta_bsn -9 old_len 36
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 4 fn_last_bsn 1469 delta_bsn -9 old_len 36
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 9 FBI 0 
+fn_same_bsn 2275 fn_last_bsn 1474 delta_bsn -7 old_len 35
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 8 FBI 0 
+fn_same_bsn 19504 fn_last_bsn 1478 delta_bsn -8 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 10 FBI 0 
+fn_same_bsn 2223 fn_last_bsn 1482 delta_bsn -6 old_len 35
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 9 FBI 0 
+fn_same_bsn 13 fn_last_bsn 1487 delta_bsn -7 old_len 35
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 11 FBI 0 
+fn_same_bsn 2171 fn_last_bsn 1491 delta_bsn -5 old_len 35
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 2058 fn_last_bsn 1495 delta_bsn -3 old_len 35
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 15 FBI 0 
+fn_same_bsn 1946 fn_last_bsn 1500 delta_bsn -1 old_len 35
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 17 FBI 0 
+fn_same_bsn 19530 fn_last_bsn 1504 delta_bsn 1 old_len 0
+ bsn 3 
+lime 0
+ bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+ bsn 11 
+lime 0
+ bsn 12 old segment
+ bsn 13 
+lime 0
+ bsn 14 old segment
+ bsn 15 
+lime 0
+ bsn 16 
+lime 0
+ bsn 17 
+lime 0
+end of message reached
+MSG: b40402080aeee79bbe01cbce350103030706c7b8
+
+TS 4 CS4 DL DATA TFI 0 BSN 11 FBI 0 
+fn_same_bsn 17 fn_last_bsn 4 delta_bsn -6 old_len 35
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 18 fn_last_bsn 9 delta_bsn -4 old_len 35
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 16 FBI 0 
+fn_same_bsn 1521 fn_last_bsn 17 delta_bsn -1 old_len 35
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 18 FBI 0 
+fn_same_bsn 19552 fn_last_bsn 22 delta_bsn 1 old_len 0
+ bsn 17 
+lime 0
+ bsn 18 
+lime 0
+end of message reached
+MSG: 03c03d6500000e4500003c000040003206359e57fafa77c0a8000401bb95e64c065295b7e109dba0126e004ec700000204058c0402080a163d99fb01cbce330103030804ed0d
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 20 FBI 0 
+fn_same_bsn 19556 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 18 
+lime 0
+
+lime 1
+ bsn 19 null
+ bsn 20 
+lime 0
+end of message reached
+MSG: b40402080aeee79bfc01cbce3501030307a1edee
+
+TS 4 CS4 DL DATA TFI 0 BSN 19 FBI 0 
+fn_same_bsn 19560 fn_last_bsn 4 delta_bsn -1 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 21 FBI 0 
+fn_same_bsn 19565 fn_last_bsn 9 delta_bsn 1 old_len 0
+ bsn 20 
+lime 0
+ bsn 21 
+lime 0
+end of message reached
+MSG: 03c0456500001045000038000040002f06df04364c75c3c0a8000401bbb5d384caa283890c2130901245eafe620000020423010402080a1bdb18a601cbce42f8f843
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 20 FBI 0 
+fn_same_bsn 13 fn_last_bsn 4 delta_bsn -1 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 19 FBI 0 
+fn_same_bsn 13 fn_last_bsn 8 delta_bsn -2 old_len 0
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 21 FBI 0 
+fn_same_bsn 13 fn_last_bsn 13 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 22 FBI 0 
+fn_same_bsn 19608 fn_last_bsn 30 delta_bsn 1 old_len 0
+ bsn 21 
+lime 0
+
+lime 1
+ bsn 22 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 22 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 22 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 22 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 22 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 22 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 23 FBI 0 
+fn_same_bsn 19669 fn_last_bsn 39 delta_bsn 1 old_len 0
+ bsn 22 
+lime 0
+ bsn 23 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 23 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 23 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 23 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 23 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 23 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 25 FBI 0 
+fn_same_bsn 19695 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 23 
+lime 0
+ bsn 24 null
+ bsn 25 
+lime 0
+end of message reached
+MSG: 0a163d9a2801cbce5fe94175
+
+TS 4 CS4 DL DATA TFI 0 BSN 27 FBI 0 
+fn_same_bsn 19699 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27 
+TS 4 CS4 DL DATA TFI 0 BSN 29 FBI 0 
+fn_same_bsn 19703 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29 
+lime 0
+end of message reached
+MSG: 34e27903be69e04f8071066d74967e6bf6b6a56b6bfdf5fa35
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 25 FBI 0 
+fn_same_bsn 13 fn_last_bsn 5 delta_bsn -4 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 27 FBI 0 
+fn_same_bsn 13 fn_last_bsn 9 delta_bsn -2 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 29 FBI 0 
+fn_same_bsn 13 fn_last_bsn 13 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 25 FBI 0 
+fn_same_bsn 13 fn_last_bsn 5 delta_bsn -4 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 27 FBI 0 
+fn_same_bsn 13 fn_last_bsn 9 delta_bsn -2 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 29 FBI 0 
+fn_same_bsn 13 fn_last_bsn 13 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 26 FBI 0 
+fn_same_bsn 19738 fn_last_bsn 9 delta_bsn -3 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 28 FBI 0 
+fn_same_bsn 19742 fn_last_bsn 13 delta_bsn -1 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 24 FBI 0 
+fn_same_bsn 19747 fn_last_bsn 18 delta_bsn -5 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 28 FBI 0 
+fn_same_bsn 13 fn_last_bsn 26 delta_bsn -1 old_len 0
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 24 FBI 0 
+fn_same_bsn 13 fn_last_bsn 31 delta_bsn -5 old_len 0
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 31 FBI 0 
+fn_same_bsn 19773 fn_last_bsn 44 delta_bsn 2 old_len 0
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29 
+lime 0
+
+lime 1
+ bsn 30 null
+ bsn 31 
+lime 0
+end of message reached
+MSG: 8c0402080a1639ca4501cbce3301030308e9532c
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 33 FBI 0 
+fn_same_bsn 19777 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29 
+lime 0
+
+lime 1
+ bsn 30 null
+ bsn 31 
+lime 0
+
+lime 1
+ bsn 32 null
+ bsn 33 
+lime 0
+end of message reached
+MSG: 0a163d996401cbce603a0eaa
+
+TS 4 CS4 DL DATA TFI 0 BSN 35 FBI 0 
+fn_same_bsn 19781 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 33 
+lime 0
+ bsn 34 null
+ bsn 35 
+TS 4 CS4 DL DATA TFI 0 BSN 37 FBI 0 
+fn_same_bsn 19786 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 33 
+lime 0
+ bsn 34 null
+ bsn 35  bsn 36 null
+ bsn 37 
+lime 0
+end of message reached
+MSG: 555117cafb1754b8f4c55e19a4ac7c2e7ad6797c0eb8aa1f9b
+
+TS 4 CS4 DL DATA TFI 0 BSN 39 FBI 0 
+fn_same_bsn 19790 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 37 
+lime 0
+ bsn 38 null
+ bsn 39 
+TS 4 CS4 DL DATA TFI 0 BSN 30 FBI 0 
+fn_same_bsn 19794 fn_last_bsn 4 delta_bsn -9 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 35 FBI 0 
+fn_same_bsn 18 fn_last_bsn 9 delta_bsn -4 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 37 FBI 0 
+fn_same_bsn 17 fn_last_bsn 13 delta_bsn -2 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 39 FBI 0 
+fn_same_bsn 17 fn_last_bsn 17 delta_bsn 0 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 34 FBI 0 
+fn_same_bsn 19812 fn_last_bsn 5 delta_bsn -5 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 36 FBI 0 
+fn_same_bsn 19816 fn_last_bsn 9 delta_bsn -3 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 38 FBI 0 
+fn_same_bsn 19820 fn_last_bsn 13 delta_bsn -1 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 42 FBI 0 
+fn_same_bsn 19825 fn_last_bsn 18 delta_bsn 3 old_len 0
+ bsn 37 
+lime 0
+ bsn 38 null
+ bsn 39  bsn 40 null
+ bsn 41 null
+ bsn 42 
+lime 0
+end of message reached
+MSG: 8c0402080a0d9c84ec01cbce3301030308ffb276
+
+TS 4 CS4 DL DATA TFI 0 BSN 41 FBI 0 
+fn_same_bsn 19829 fn_last_bsn 4 delta_bsn -1 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 44 FBI 0 
+fn_same_bsn 19838 fn_last_bsn 13 delta_bsn 2 old_len 0
+ bsn 42 
+lime 0
+ bsn 43 null
+ bsn 44 
+TS 4 CS4 DL DATA TFI 0 BSN 41 FBI 0 
+fn_same_bsn 13 fn_last_bsn 4 delta_bsn -3 old_len 0
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 43 FBI 0 
+fn_same_bsn 19846 fn_last_bsn 8 delta_bsn -1 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 45 FBI 0 
+fn_same_bsn 19851 fn_last_bsn 13 delta_bsn 1 old_len 0
+ bsn 42 
+lime 0
+ bsn 43 null
+ bsn 44  bsn 45 
+lime 0
+end of message reached
+MSG: 03c06d6500001a4500003c0000400034063d045fd3e938c0a800040050e05adb5fece59e0ae323a01238907b6a0000020405b40402080aeee7a13501cbce350103030754e3ff
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 47 FBI 0 
+fn_same_bsn 19855 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 42 
+lime 0
+ bsn 43 null
+ bsn 44  bsn 45 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 46 null
+ bsn 47 
+lime 0
+end of message reached
+MSG: 0a1639ca9d01cbce68dafaea
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 19859 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 47 
+lime 0
+ bsn 48 null
+ bsn 49 
+TS 4 CS4 DL DATA TFI 0 BSN 51 FBI 0 
+fn_same_bsn 19864 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 47 
+lime 0
+ bsn 48 null
+ bsn 49  bsn 50 null
+ bsn 51 
+lime 0
+end of message reached
+MSG: 5e8ae919aa7cd608b26f7b8864c5b2498d8e2687925c30fb00
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 45 FBI 0 
+fn_same_bsn 17 fn_last_bsn 4 delta_bsn -6 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 47 FBI 0 
+fn_same_bsn 17 fn_last_bsn 8 delta_bsn -4 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 18 fn_last_bsn 13 delta_bsn -2 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 51 FBI 0 
+fn_same_bsn 17 fn_last_bsn 17 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 8 fn_last_bsn 4 delta_bsn -2 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 51 FBI 0 
+fn_same_bsn 9 fn_last_bsn 9 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 9 fn_last_bsn 4 delta_bsn -2 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 51 FBI 0 
+fn_same_bsn 8 fn_last_bsn 8 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 53 FBI 0 
+fn_same_bsn 19907 fn_last_bsn 9 delta_bsn 2 old_len 0
+ bsn 47 
+lime 0
+ bsn 48 null
+ bsn 49  bsn 50 null
+ bsn 51 
+lime 0
+
+lime 1
+ bsn 52 null
+ bsn 53 
+lime 0
+end of message reached
+MSG: 0a1639c92a01cbce686b9012
+
+TS 4 CS4 DL DATA TFI 0 BSN 55 FBI 0 
+fn_same_bsn 19911 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 53 
+lime 0
+ bsn 54 null
+ bsn 55 
+TS 4 CS4 DL DATA TFI 0 BSN 57 FBI 0 
+fn_same_bsn 19916 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 53 
+lime 0
+ bsn 54 null
+ bsn 55  bsn 56 null
+ bsn 57 
+lime 0
+end of message reached
+MSG: b8bd67b7679737b1c39971d041f73e4bbd717654a340ef7aee
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 53 FBI 0 
+fn_same_bsn 13 fn_last_bsn 4 delta_bsn -4 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 55 FBI 0 
+fn_same_bsn 13 fn_last_bsn 8 delta_bsn -2 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 57 FBI 0 
+fn_same_bsn 13 fn_last_bsn 13 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 54 FBI 0 
+fn_same_bsn 19937 fn_last_bsn 8 delta_bsn -3 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 19942 fn_last_bsn 13 delta_bsn 1 old_len 0
+ bsn 53 
+lime 0
+ bsn 54 null
+ bsn 55  bsn 56 null
+ bsn 57 
+lime 0
+
+lime 1
+ bsn 58 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 60 FBI 0 
+fn_same_bsn 19972 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 53 
+lime 0
+ bsn 54 null
+ bsn 55  bsn 56 null
+ bsn 57 
+lime 0
+
+lime 1
+ bsn 58 
+lime 0
+ bsn 59 null
+ bsn 60 
+lime 0
+end of message reached
+MSG: 0a0d9c859b01cbce6b917ee3
+
+TS 4 CS4 DL DATA TFI 0 BSN 62 FBI 0 
+fn_same_bsn 19976 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62 
+TS 4 CS4 DL DATA TFI 0 BSN 64 FBI 0 
+fn_same_bsn 19981 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+end of message reached
+MSG: f1055b922d58930fad49f9855f360b6a8edbc53e5af6808100
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 66 FBI 0 
+fn_same_bsn 19985 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66 
+TS 4 CS4 DL DATA TFI 0 BSN 68 FBI 0 
+fn_same_bsn 19989 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68 
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 26 fn_last_bsn 5 delta_bsn -10 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 60 FBI 0 
+fn_same_bsn 26 fn_last_bsn 9 delta_bsn -8 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 66 FBI 0 
+fn_same_bsn 17 fn_last_bsn 13 delta_bsn -2 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 68 FBI 0 
+fn_same_bsn 18 fn_last_bsn 18 delta_bsn 0 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 65 FBI 0 
+fn_same_bsn 20011 fn_last_bsn 4 delta_bsn -3 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 67 FBI 0 
+fn_same_bsn 20015 fn_last_bsn 8 delta_bsn -1 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 69 FBI 0 
+fn_same_bsn 20020 fn_last_bsn 13 delta_bsn 1 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+end of message reached
+MSG: 687474702f312e31140303000101160303002896ddbd90638cc55a2a61f5ecb3a75e6441d434e27903be69e04f8071066d74967e6bf6b6a56b6bfd645a6c
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 66 FBI 0 
+fn_same_bsn 22 fn_last_bsn 4 delta_bsn -3 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 70 FBI 0 
+fn_same_bsn 20028 fn_last_bsn 8 delta_bsn 1 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 70 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 70 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 70 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 70 FBI 0 
+fn_same_bsn 9 fn_last_bsn 9 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 72 FBI 0 
+fn_same_bsn 20080 fn_last_bsn 30 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+end of message reached
+MSG: 0aeee7a5a901cbce6dd5597d
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 74 FBI 0 
+fn_same_bsn 20085 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74 
+TS 4 CS4 DL DATA TFI 0 BSN 76 FBI 0 
+fn_same_bsn 20089 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76 
+TS 4 CS4 DL DATA TFI 0 BSN 78 FBI 0 
+fn_same_bsn 20093 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78 
+TS 4 CS4 DL DATA TFI 0 BSN 80 FBI 0 
+fn_same_bsn 20098 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80 
+TS 4 CS4 DL DATA TFI 0 BSN 82 FBI 0 
+fn_same_bsn 20102 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82 
+TS 4 CS4 DL DATA TFI 0 BSN 84 FBI 0 
+fn_same_bsn 20106 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82  bsn 83 null
+ bsn 84 
+TS 4 CS4 DL DATA TFI 0 BSN 86 FBI 0 
+fn_same_bsn 20111 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82  bsn 83 null
+ bsn 84  bsn 85 null
+ bsn 86 
+TS 4 CS4 DL DATA TFI 0 BSN 88 FBI 0 
+fn_same_bsn 20115 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82  bsn 83 null
+ bsn 84  bsn 85 null
+ bsn 86  bsn 87 null
+ bsn 88 
+TS 4 CS4 DL DATA TFI 0 BSN 90 FBI 0 
+fn_same_bsn 20119 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82  bsn 83 null
+ bsn 84  bsn 85 null
+ bsn 86  bsn 87 null
+ bsn 88  bsn 89 null
+ bsn 90 
+TS 4 CS4 DL DATA TFI 0 BSN 92 FBI 0 
+fn_same_bsn 20124 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82  bsn 83 null
+ bsn 84  bsn 85 null
+ bsn 86  bsn 87 null
+ bsn 88  bsn 89 null
+ bsn 90  bsn 91 null
+ bsn 92 
+TS 4 CS4 DL DATA TFI 0 BSN 94 FBI 0 
+fn_same_bsn 20128 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82  bsn 83 null
+ bsn 84  bsn 85 null
+ bsn 86  bsn 87 null
+ bsn 88  bsn 89 null
+ bsn 90  bsn 91 null
+ bsn 92  bsn 93 null
+ bsn 94 
+TS 4 CS4 DL DATA TFI 0 BSN 96 FBI 0 
+fn_same_bsn 20132 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82  bsn 83 null
+ bsn 84  bsn 85 null
+ bsn 86  bsn 87 null
+ bsn 88  bsn 89 null
+ bsn 90  bsn 91 null
+ bsn 92  bsn 93 null
+ bsn 94  bsn 95 null
+ bsn 96 
+TS 4 CS4 DL DATA TFI 0 BSN 98 FBI 0 
+fn_same_bsn 20137 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82  bsn 83 null
+ bsn 84  bsn 85 null
+ bsn 86  bsn 87 null
+ bsn 88  bsn 89 null
+ bsn 90  bsn 91 null
+ bsn 92  bsn 93 null
+ bsn 94  bsn 95 null
+ bsn 96  bsn 97 null
+ bsn 98 
+TS 4 CS4 DL DATA TFI 0 BSN 100 FBI 0 
+fn_same_bsn 20141 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82  bsn 83 null
+ bsn 84  bsn 85 null
+ bsn 86  bsn 87 null
+ bsn 88  bsn 89 null
+ bsn 90  bsn 91 null
+ bsn 92  bsn 93 null
+ bsn 94  bsn 95 null
+ bsn 96  bsn 97 null
+ bsn 98  bsn 99 null
+ bsn 100 
+TS 4 CS4 DL DATA TFI 0 BSN 103 FBI 0 
+fn_same_bsn 20150 fn_last_bsn 9 delta_bsn 3 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 null
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 null
+ bsn 74  bsn 75 null
+ bsn 76  bsn 77 null
+ bsn 78  bsn 79 null
+ bsn 80  bsn 81 null
+ bsn 82  bsn 83 null
+ bsn 84  bsn 85 null
+ bsn 86  bsn 87 null
+ bsn 88  bsn 89 null
+ bsn 90  bsn 91 null
+ bsn 92  bsn 93 null
+ bsn 94  bsn 95 null
+ bsn 96  bsn 97 null
+ bsn 98  bsn 99 null
+ bsn 100  bsn 101 null
+ bsn 102 null
+ bsn 103 
+lime 0
+end of message reached
+MSG: ee0c389b4e15e6e0f8a5d57991a3b726998d0271
+
+lime 1
+end of message reached
+MSG: 03c09d253023e4e2adccdabd57986c3ecc83f8
+
+TS 4 CS4 DL DATA TFI 0 BSN 105 FBI 0 
+fn_same_bsn 20154 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 103 
+lime 0
+
+lime 1
+ bsn 104 null
+ bsn 105 
+TS 4 CS4 DL DATA TFI 0 BSN 107 FBI 0 
+fn_same_bsn 20158 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 103 
+lime 0
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106 null
+ bsn 107 
+TS 4 CS4 DL DATA TFI 0 BSN 109 FBI 0 
+fn_same_bsn 20163 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 103 
+lime 0
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106 null
+ bsn 107  bsn 108 null
+ bsn 109 
+TS 4 CS4 DL DATA TFI 0 BSN 111 FBI 0 
+fn_same_bsn 20167 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 103 
+lime 0
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106 null
+ bsn 107  bsn 108 null
+ bsn 109  bsn 110 null
+ bsn 111 
+TS 4 CS4 DL DATA TFI 0 BSN 113 FBI 0 
+fn_same_bsn 20171 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 103 
+lime 0
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106 null
+ bsn 107  bsn 108 null
+ bsn 109  bsn 110 null
+ bsn 111  bsn 112 null
+ bsn 113 
+lime 0
+end of message reached
+MSG: ec8bd7f1fb76d96eee54ec86ab6e2d2d266762c91bb72697164d8fe3aa656fbb95c6a9fc3615931fc6d54ea59a987a
+
+TS 4 CS4 DL DATA TFI 0 BSN 115 FBI 0 
+fn_same_bsn 20176 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114 null
+ bsn 115 
+TS 4 CS4 DL DATA TFI 0 BSN 117 FBI 0 
+fn_same_bsn 20180 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114 null
+ bsn 115  bsn 116 null
+ bsn 117 
+TS 4 CS4 DL DATA TFI 0 BSN 119 FBI 0 
+fn_same_bsn 20184 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114 null
+ bsn 115  bsn 116 null
+ bsn 117  bsn 118 null
+ bsn 119 
+TS 4 CS4 DL DATA TFI 0 BSN 121 FBI 0 
+fn_same_bsn 20189 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114 null
+ bsn 115  bsn 116 null
+ bsn 117  bsn 118 null
+ bsn 119  bsn 120 null
+ bsn 121 
+TS 4 CS4 DL DATA TFI 0 BSN 123 FBI 0 
+fn_same_bsn 20193 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114 null
+ bsn 115  bsn 116 null
+ bsn 117  bsn 118 null
+ bsn 119  bsn 120 null
+ bsn 121  bsn 122 null
+ bsn 123 
+TS 4 CS4 DL DATA TFI 0 BSN 125 FBI 0 
+fn_same_bsn 20197 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114 null
+ bsn 115  bsn 116 null
+ bsn 117  bsn 118 null
+ bsn 119  bsn 120 null
+ bsn 121  bsn 122 null
+ bsn 123  bsn 124 null
+ bsn 125 
+TS 4 CS4 DL DATA TFI 0 BSN 127 FBI 0 
+fn_same_bsn 20202 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114 null
+ bsn 115  bsn 116 null
+ bsn 117  bsn 118 null
+ bsn 119  bsn 120 null
+ bsn 121  bsn 122 null
+ bsn 123  bsn 124 null
+ bsn 125  bsn 126 null
+ bsn 127 
+TS 4 CS4 DL DATA TFI 0 BSN 3 FBI 0 
+fn_same_bsn 775 fn_last_bsn 8 delta_bsn -124 old_len 29
+ bsn 113 
+lime 0
+ bsn 114 null
+ bsn 115  bsn 116 null
+ bsn 117  bsn 118 null
+ bsn 119  bsn 120 null
+ bsn 121  bsn 122 null
+ bsn 123  bsn 124 null
+ bsn 125  bsn 126 null
+ bsn 127  bsn 0 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 1 
+lime 0
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3 
+TS 4 CS4 DL DATA TFI 0 BSN 5 FBI 0 
+fn_same_bsn 806 fn_last_bsn 5 delta_bsn 2 old_len 28
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 724 fn_last_bsn 9 delta_bsn 4 old_len 36
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 9 FBI 0 
+fn_same_bsn 710 fn_last_bsn 13 delta_bsn 6 old_len 35
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 11 FBI 0 
+fn_same_bsn 694 fn_last_bsn 18 delta_bsn 8 old_len 35
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 693 fn_last_bsn 22 delta_bsn 10 old_len 35
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 15 FBI 0 
+fn_same_bsn 710 fn_last_bsn 26 delta_bsn 12 old_len 35
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 17 FBI 0 
+fn_same_bsn 711 fn_last_bsn 31 delta_bsn 14 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 3 FBI 0 
+fn_same_bsn 35 fn_last_bsn 35 delta_bsn 0 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 19 FBI 0 
+fn_same_bsn 676 fn_last_bsn 4 delta_bsn 16 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 22 FBI 0 
+fn_same_bsn 628 fn_last_bsn 13 delta_bsn 19 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 24 FBI 0 
+fn_same_bsn 502 fn_last_bsn 17 delta_bsn 21 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 26 FBI 0 
+fn_same_bsn 529 fn_last_bsn 22 delta_bsn 23 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 28 FBI 0 
+fn_same_bsn 516 fn_last_bsn 26 delta_bsn 25 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 30 FBI 0 
+fn_same_bsn 481 fn_last_bsn 30 delta_bsn 27 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 32 FBI 0 
+fn_same_bsn 20280 fn_last_bsn 35 delta_bsn 29 old_len 0
+ bsn 113 
+lime 0
+ bsn 114 null
+ bsn 115  bsn 116 null
+ bsn 117  bsn 118 null
+ bsn 119  bsn 120 null
+ bsn 121  bsn 122 null
+ bsn 123  bsn 124 null
+ bsn 125  bsn 126 null
+ bsn 127  bsn 0 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 1 
+lime 0
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3  bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+ bsn 11 
+lime 0
+ bsn 12 old segment
+ bsn 13 
+lime 0
+ bsn 14 old segment
+ bsn 15 
+lime 0
+ bsn 16 
+lime 0
+ bsn 17 
+lime 0
+ bsn 18 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 19 null
+ bsn 20 
+lime 0
+ bsn 21 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 22 
+lime 0
+ bsn 23 
+lime 0
+ bsn 24 null
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29 
+lime 0
+
+lime 1
+ bsn 30 null
+ bsn 31 
+lime 0
+
+lime 1
+ bsn 32 
+TS 4 CS4 DL DATA TFI 0 BSN 34 FBI 0 
+fn_same_bsn 472 fn_last_bsn 4 delta_bsn 2 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 36 FBI 0 
+fn_same_bsn 472 fn_last_bsn 8 delta_bsn 4 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 38 FBI 0 
+fn_same_bsn 473 fn_last_bsn 13 delta_bsn 6 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 40 FBI 0 
+fn_same_bsn 20297 fn_last_bsn 17 delta_bsn 8 old_len 0
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29 
+lime 0
+
+lime 1
+ bsn 30 null
+ bsn 31 
+lime 0
+
+lime 1
+ bsn 32  bsn 33 
+lime 0
+
+lime error!
+ bsn 34 null
+ bsn 35  bsn 36 null
+ bsn 37 
+lime 0
+ bsn 38 null
+ bsn 39  bsn 40 
+TS 4 CS4 DL DATA TFI 0 BSN 42 FBI 0 
+fn_same_bsn 476 fn_last_bsn 4 delta_bsn 2 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 44 FBI 0 
+fn_same_bsn 468 fn_last_bsn 9 delta_bsn 4 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 46 FBI 0 
+fn_same_bsn 20310 fn_last_bsn 13 delta_bsn 6 old_len 0
+ bsn 37 
+lime 0
+ bsn 38 null
+ bsn 39  bsn 40  bsn 41 null
+ bsn 42 
+lime 0
+ bsn 43 null
+ bsn 44  bsn 45 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 46 
+TS 4 CS4 DL DATA TFI 0 BSN 48 FBI 0 
+fn_same_bsn 20314 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 42 
+lime 0
+ bsn 43 null
+ bsn 44  bsn 45 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 46  bsn 47 
+lime 0
+
+lime error!
+ bsn 48 
+TS 4 CS4 DL DATA TFI 0 BSN 50 FBI 0 
+fn_same_bsn 20319 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 47 
+lime 0
+ bsn 48  bsn 49  bsn 50 
+TS 4 CS4 DL DATA TFI 0 BSN 52 FBI 0 
+fn_same_bsn 20323 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 47 
+lime 0
+ bsn 48  bsn 49  bsn 50  bsn 51 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 52 
+TS 4 CS4 DL DATA TFI 0 BSN 54 FBI 0 
+fn_same_bsn 390 fn_last_bsn 4 delta_bsn 2 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 56 FBI 0 
+fn_same_bsn 20332 fn_last_bsn 9 delta_bsn 4 old_len 0
+ bsn 47 
+lime 0
+ bsn 48  bsn 49  bsn 50  bsn 51 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 52  bsn 53 
+lime 0
+
+lime error!
+ bsn 54 null
+ bsn 55  bsn 56 
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 342 fn_last_bsn 4 delta_bsn 2 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 60 FBI 0 
+fn_same_bsn 342 fn_last_bsn 8 delta_bsn 4 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 62 FBI 0 
+fn_same_bsn 369 fn_last_bsn 13 delta_bsn 6 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 65 FBI 0 
+fn_same_bsn 342 fn_last_bsn 21 delta_bsn 9 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 67 FBI 0 
+fn_same_bsn 343 fn_last_bsn 26 delta_bsn 11 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 69 FBI 0 
+fn_same_bsn 342 fn_last_bsn 30 delta_bsn 13 old_len 48
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 71 FBI 0 
+fn_same_bsn 20366 fn_last_bsn 34 delta_bsn 15 old_len 0
+ bsn 53 
+lime 0
+ bsn 54 null
+ bsn 55  bsn 56  bsn 57 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 58 
+lime 0
+ bsn 59 null
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71 
+TS 4 CS4 DL DATA TFI 0 BSN 73 FBI 0 
+fn_same_bsn 20371 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73 
+TS 4 CS4 DL DATA TFI 0 BSN 75 FBI 0 
+fn_same_bsn 20375 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75 
+TS 4 CS4 DL DATA TFI 0 BSN 77 FBI 0 
+fn_same_bsn 20379 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77 
+TS 4 CS4 DL DATA TFI 0 BSN 79 FBI 0 
+fn_same_bsn 20384 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79 
+TS 4 CS4 DL DATA TFI 0 BSN 81 FBI 0 
+fn_same_bsn 20388 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81 
+TS 4 CS4 DL DATA TFI 0 BSN 83 FBI 0 
+fn_same_bsn 20392 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83 
+TS 4 CS4 DL DATA TFI 0 BSN 85 FBI 0 
+fn_same_bsn 20397 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83  bsn 84  bsn 85 
+TS 4 CS4 DL DATA TFI 0 BSN 87 FBI 0 
+fn_same_bsn 20401 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83  bsn 84  bsn 85  bsn 86  bsn 87 
+TS 4 CS4 DL DATA TFI 0 BSN 89 FBI 0 
+fn_same_bsn 20405 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83  bsn 84  bsn 85  bsn 86  bsn 87  bsn 88  bsn 89 
+TS 4 CS4 DL DATA TFI 0 BSN 91 FBI 0 
+fn_same_bsn 20410 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83  bsn 84  bsn 85  bsn 86  bsn 87  bsn 88  bsn 89  bsn 90  bsn 91 
+TS 4 CS4 DL DATA TFI 0 BSN 93 FBI 0 
+fn_same_bsn 20414 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83  bsn 84  bsn 85  bsn 86  bsn 87  bsn 88  bsn 89  bsn 90  bsn 91  bsn 92  bsn 93 
+TS 4 CS4 DL DATA TFI 0 BSN 95 FBI 0 
+fn_same_bsn 20418 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83  bsn 84  bsn 85  bsn 86  bsn 87  bsn 88  bsn 89  bsn 90  bsn 91  bsn 92  bsn 93  bsn 94  bsn 95 
+TS 4 CS4 DL DATA TFI 0 BSN 97 FBI 0 
+fn_same_bsn 20423 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83  bsn 84  bsn 85  bsn 86  bsn 87  bsn 88  bsn 89  bsn 90  bsn 91  bsn 92  bsn 93  bsn 94  bsn 95  bsn 96  bsn 97 
+TS 4 CS4 DL DATA TFI 0 BSN 99 FBI 0 
+fn_same_bsn 20427 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61 null
+ bsn 62  bsn 63 null
+ bsn 64 
+lime 0
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83  bsn 84  bsn 85  bsn 86  bsn 87  bsn 88  bsn 89  bsn 90  bsn 91  bsn 92  bsn 93  bsn 94  bsn 95  bsn 96  bsn 97  bsn 98  bsn 99 
+lime 0
+end of message reached
+MSG: 3c0ad90c08e00458bf2e78747618f0e88f09501645cbfa54bcf50d095708925ad30db110f0da2889d04d19fa507faab6f0a90aeee7a5b901cbce6d485454502f312e3120323030204f4b0d0a5365727665723a206e67696e780d0a446174653a204d6f6ea153ea304f5d5cf96d0fceed3644a32c5b3cea051d6484df4a955277248b5abe10d6002c84a1a68718c44b5ae88f6d179dae6c3b20636861727365743d77696e646f77732d313235310d0a5472616e736665722d456e636f64696e673a206368756e6b653239042c683604ac53061c8a08878175ca4c0611e12582750a11facbdc5f7605c0c4800887817502de29dbbb3a97ae8c5cda4947494e0d0a436f6e74656e742d456e636f64696e673a20677a69700d0a0d0a343061640d0a1f8b0800000000000003ed9ddd8958c2bf7364d7a0c57d4116b9becda4bd96c8bb8ee0b27d478e084ea2a9356b5fc71caa4d4b42760cc36108924be137abb779bf5fc055fbc651e28d2ab12ccb99caec9b949b209a6ce2d2c4c514e92123eeef39a71b0d4908017638354cd564c602d135154b0ee31c0d812c95018722ad6190a5329341a4758990a583492b804206a4350cb25407097eab03cbc67bc916dd4211736c7af10f4edb6a379caafabcd3b0dbd6ad4973f9ca95b7b8652d5d4aa9e5d554a1982e2d441e66722bf987c589f854321e51db484008a5a2b6c9a91682b2c883d0a4800e8a884292821fe810b82f77442d051c710a614fcfe2cca47ba7e102e46b82a953981622a5f4a3d2a4fe5e48671722c5d266365d5c4da74bba35afbb5c6a8d5befe60b6ba9d2c44aba945e2e65f2b9885acee75599c820c2b94450d5d88d41518500b01810ce305055d0145a236ba22475d4cafa1a79997f9bbdaf5525d4a54cf67eea4ef66a2d93cbac6dac4d149753d9f4423c1ae352ead1ab97bce19d35d7a57c612a39b1965fca64d332e5db53b17822361d9b1e72750d9943bc0d858dd8343f6834699de203642a6163756aa7e6e617a889cd8e760c3ed36108879c26901e64f5b56b987f3abee2f5476b59168e1e5fe933c7dbf11b9be455a71f4dc6e353fa4dbf259b41bf2e59ef95cc83e84f36f2a5b492bfe4a5aa9f29160f7ca4ca4dbb0e3e0882040ecbe304144ec491ca9f4ee3850323689337c16aac6d14c867fbe08314b8f483ab8404c71529c815cfdb250ddd9af4a720b3592e64d64bbd1bf37eea41ca5c8da86261b9bba13753b216d16269f2fe4f36d285cdc978f4466c74b4fd88b4afbd143ccd114f9163f531afe631cb0fab1157284c8a798e63fd96b9c383f5667285cd3b2003ffc88844297798c9dd7b6dce2127cda6f169e6b53594cd79e5ec8564072bf520555077eea57ea216ccc7cf7faede7b7f9e1fe462747da3b879c2607c3ede57e99de9031d9c19063af8dca4076bab4cc891ad69576ad6b6f856240489d54810734f6d39bb80e275289338c97d0f56240f7834f567ee7d279bcd3ffc2e7c305de0e6526123dda7cd5221b5fcc13fa6eec17bd20f75438c71f4ee464e73c82d4092c5f244f64ba38748fcb25d857cc1d658e523bb4ede9f0c4740051a572310bc564b776440fcfa5600879a3ec1275a8fa9e2666e999664403245254fb0afb9343a22bcba3837a2167a7acae60d8b88ae17f2a5fc723eab6e2bef46b87a313ba2e6b0b4d0a881ee40c661806c3321806c33170064ebd91f3ee5de981ac265c478cf1d6994f186215cfa1a8c6393890cd00ca4fff19b9b3f4add93550e26f65eecfd79558caea70accf77bf9957434932ba60ba56fa61109e9d17ba97155d4afecc3b1513eaf0220b635
+
+TS 4 CS4 DL DATA TFI 0 BSN 101 FBI 0 
+fn_same_bsn 20431 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 99 
+lime 0
+ bsn 100  bsn 101 
+TS 4 CS4 DL DATA TFI 0 BSN 103 FBI 0 
+fn_same_bsn 286 fn_last_bsn 5 delta_bsn 2 old_len 48
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 105 FBI 0 
+fn_same_bsn 286 fn_last_bsn 9 delta_bsn 4 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 107 FBI 0 
+fn_same_bsn 286 fn_last_bsn 13 delta_bsn 6 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 110 FBI 0 
+fn_same_bsn 20453 fn_last_bsn 22 delta_bsn 9 old_len 0
+ bsn 99 
+lime 0
+ bsn 100  bsn 101  bsn 102 null
+ bsn 103 
+lime 0
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106 null
+ bsn 107  bsn 108 null
+ bsn 109  bsn 110 
+TS 4 CS4 DL DATA TFI 0 BSN 112 FBI 0 
+fn_same_bsn 20457 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 103 
+lime 0
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106 null
+ bsn 107  bsn 108 null
+ bsn 109  bsn 110  bsn 111  bsn 112 
+TS 4 CS4 DL DATA TFI 0 BSN 114 FBI 0 
+fn_same_bsn 20462 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 103 
+lime 0
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106 null
+ bsn 107  bsn 108 null
+ bsn 109  bsn 110  bsn 111  bsn 112  bsn 113 
+lime 0
+
+lime error!
+ bsn 114 
+TS 4 CS4 DL DATA TFI 0 BSN 116 FBI 0 
+fn_same_bsn 20466 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116 
+TS 4 CS4 DL DATA TFI 0 BSN 118 FBI 0 
+fn_same_bsn 20470 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118 
+TS 4 CS4 DL DATA TFI 0 BSN 120 FBI 0 
+fn_same_bsn 20475 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120 
+TS 4 CS4 DL DATA TFI 0 BSN 122 FBI 0 
+fn_same_bsn 20479 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122 
+TS 4 CS4 DL DATA TFI 0 BSN 124 FBI 0 
+fn_same_bsn 20483 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124 
+TS 4 CS4 DL DATA TFI 0 BSN 126 FBI 0 
+fn_same_bsn 20488 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126 
+TS 4 CS4 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 1079 fn_last_bsn 4 delta_bsn -126 old_len 28
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0 
+TS 4 CS4 DL DATA TFI 0 BSN 2 FBI 0 
+fn_same_bsn 1079 fn_last_bsn 4 delta_bsn 2 old_len 28
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 4 FBI 0 
+fn_same_bsn 1079 fn_last_bsn 9 delta_bsn 4 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 6 FBI 0 
+fn_same_bsn 1079 fn_last_bsn 13 delta_bsn 6 old_len 35
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 116 FBI 0 
+fn_same_bsn 43 fn_last_bsn 17 delta_bsn 116 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 8 FBI 0 
+fn_same_bsn 1010 fn_last_bsn 22 delta_bsn 8 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 10 FBI 0 
+fn_same_bsn 1010 fn_last_bsn 26 delta_bsn 10 old_len 35
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 12 FBI 0 
+fn_same_bsn 3120 fn_last_bsn 30 delta_bsn 12 old_len 35
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0  bsn 1 
+lime 0
+
+lime error!
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3  bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 
+lime 0
+ bsn 11 
+lime 0
+ bsn 12 
+lime 0
+end of message reached
+MSG: 2f065dd9364c75c3c0a8000401bbb5d384caa284890c21e88010494826ae00000101080a1bdb241001cbce82028236
+
+TS 4 CS4 DL DATA TFI 0 BSN 14 FBI 0 
+fn_same_bsn 3008 fn_last_bsn 5 delta_bsn 2 old_len 35
+ bsn 12 
+lime 0
+ bsn 13 
+lime 0
+
+lime error!
+ bsn 14 
+TS 4 CS4 DL DATA TFI 0 BSN 16 FBI 0 
+fn_same_bsn 984 fn_last_bsn 4 delta_bsn 2 old_len 35
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 18 FBI 0 
+fn_same_bsn 983 fn_last_bsn 8 delta_bsn 4 old_len 48
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 20 FBI 0 
+fn_same_bsn 971 fn_last_bsn 13 delta_bsn 6 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 22 FBI 0 
+fn_same_bsn 914 fn_last_bsn 17 delta_bsn 8 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 25 FBI 0 
+fn_same_bsn 832 fn_last_bsn 26 delta_bsn 11 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 27 FBI 0 
+fn_same_bsn 832 fn_last_bsn 30 delta_bsn 13 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 29 FBI 0 
+fn_same_bsn 832 fn_last_bsn 34 delta_bsn 15 old_len 48
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 31 FBI 0 
+fn_same_bsn 793 fn_last_bsn 39 delta_bsn 17 old_len 48
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 33 FBI 0 
+fn_same_bsn 793 fn_last_bsn 43 delta_bsn 19 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 35 FBI 0 
+fn_same_bsn 775 fn_last_bsn 47 delta_bsn 21 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 37 FBI 0 
+fn_same_bsn 776 fn_last_bsn 52 delta_bsn 23 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 39 FBI 0 
+fn_same_bsn 776 fn_last_bsn 56 delta_bsn 25 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 41 FBI 0 
+fn_same_bsn 745 fn_last_bsn 60 delta_bsn 27 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 43 FBI 0 
+fn_same_bsn 746 fn_last_bsn 65 delta_bsn 29 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 45 FBI 0 
+fn_same_bsn 728 fn_last_bsn 69 delta_bsn 31 old_len 48
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 47 FBI 0 
+fn_same_bsn 728 fn_last_bsn 73 delta_bsn 33 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 711 fn_last_bsn 78 delta_bsn 35 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 51 FBI 0 
+fn_same_bsn 711 fn_last_bsn 82 delta_bsn 37 old_len 48
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 53 FBI 0 
+fn_same_bsn 693 fn_last_bsn 86 delta_bsn 39 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 55 FBI 0 
+fn_same_bsn 694 fn_last_bsn 91 delta_bsn 41 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 57 FBI 0 
+fn_same_bsn 693 fn_last_bsn 95 delta_bsn 43 old_len 48
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 59 FBI 0 
+fn_same_bsn 20626 fn_last_bsn 99 delta_bsn 45 old_len 0
+ bsn 12 
+lime 0
+ bsn 13 
+lime 0
+
+lime error!
+ bsn 14  bsn 15 
+lime 0
+
+lime error!
+ bsn 16 
+lime 0
+ bsn 17 
+lime 0
+ bsn 18 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 19 null
+ bsn 20 
+lime 0
+ bsn 21 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 22 
+lime 0
+ bsn 23 
+lime 0
+ bsn 24 null
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29 
+lime 0
+
+lime 1
+ bsn 30 null
+ bsn 31 
+lime 0
+
+lime 1
+ bsn 32  bsn 33 
+lime 0
+
+lime error!
+ bsn 34 null
+ bsn 35  bsn 36 null
+ bsn 37 
+lime 0
+ bsn 38 null
+ bsn 39  bsn 40  bsn 41 null
+ bsn 42 
+lime 0
+ bsn 43 null
+ bsn 44  bsn 45 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 46  bsn 47 
+lime 0
+
+lime error!
+ bsn 48  bsn 49  bsn 50  bsn 51 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 52  bsn 53 
+lime 0
+
+lime error!
+ bsn 54 null
+ bsn 55  bsn 56  bsn 57 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 58 
+lime 0
+ bsn 59 
+TS 4 CS4 DL DATA TFI 0 BSN 61 FBI 0 
+fn_same_bsn 20631 fn_last_bsn 5 delta_bsn 2 old_len 0
+ bsn 53 
+lime 0
+ bsn 54 null
+ bsn 55  bsn 56  bsn 57 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 58 
+lime 0
+ bsn 59  bsn 60 
+lime 0
+
+lime error!
+ bsn 61 
+TS 4 CS4 DL DATA TFI 0 BSN 63 FBI 0 
+fn_same_bsn 20635 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 60 
+lime 0
+ bsn 61  bsn 62  bsn 63 
+TS 4 CS4 DL DATA TFI 0 BSN 65 FBI 0 
+fn_same_bsn 628 fn_last_bsn 4 delta_bsn 2 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 67 FBI 0 
+fn_same_bsn 629 fn_last_bsn 9 delta_bsn 4 old_len 0
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 70 FBI 0 
+fn_same_bsn 602 fn_last_bsn 17 delta_bsn 7 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 72 FBI 0 
+fn_same_bsn 577 fn_last_bsn 22 delta_bsn 9 old_len 48
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 74 FBI 0 
+fn_same_bsn 576 fn_last_bsn 26 delta_bsn 11 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 76 FBI 0 
+fn_same_bsn 576 fn_last_bsn 30 delta_bsn 13 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 78 FBI 0 
+fn_same_bsn 577 fn_last_bsn 35 delta_bsn 15 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 80 FBI 0 
+fn_same_bsn 576 fn_last_bsn 39 delta_bsn 17 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 82 FBI 0 
+fn_same_bsn 576 fn_last_bsn 43 delta_bsn 19 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 84 FBI 0 
+fn_same_bsn 577 fn_last_bsn 48 delta_bsn 21 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 86 FBI 0 
+fn_same_bsn 576 fn_last_bsn 52 delta_bsn 23 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 88 FBI 0 
+fn_same_bsn 576 fn_last_bsn 56 delta_bsn 25 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 90 FBI 0 
+fn_same_bsn 577 fn_last_bsn 61 delta_bsn 27 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 92 FBI 0 
+fn_same_bsn 576 fn_last_bsn 65 delta_bsn 29 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 94 FBI 0 
+fn_same_bsn 576 fn_last_bsn 69 delta_bsn 31 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 96 FBI 0 
+fn_same_bsn 577 fn_last_bsn 74 delta_bsn 33 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 98 FBI 0 
+fn_same_bsn 576 fn_last_bsn 78 delta_bsn 35 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 100 FBI 0 
+fn_same_bsn 576 fn_last_bsn 82 delta_bsn 37 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 102 FBI 0 
+fn_same_bsn 20722 fn_last_bsn 87 delta_bsn 39 old_len 0
+ bsn 60 
+lime 0
+ bsn 61  bsn 62  bsn 63  bsn 64 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 65 null
+ bsn 66  bsn 67 null
+ bsn 68  bsn 69 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83  bsn 84  bsn 85  bsn 86  bsn 87  bsn 88  bsn 89  bsn 90  bsn 91  bsn 92  bsn 93  bsn 94  bsn 95  bsn 96  bsn 97  bsn 98  bsn 99 
+lime 0
+
+lime error!
+ bsn 100  bsn 101  bsn 102 
+TS 4 CS4 DL DATA TFI 0 BSN 106 FBI 0 
+fn_same_bsn 20735 fn_last_bsn 13 delta_bsn 4 old_len 0
+ bsn 99 
+lime 0
+ bsn 100  bsn 101  bsn 102  bsn 103 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106 
+TS 4 CS4 DL DATA TFI 0 BSN 108 FBI 0 
+fn_same_bsn 20739 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 103 
+lime 0
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106  bsn 107  bsn 108 
+TS 4 CS4 DL DATA TFI 0 BSN 102 FBI 0 
+fn_same_bsn 43 fn_last_bsn 26 delta_bsn -6 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 120 FBI 0 
+fn_same_bsn 316 fn_last_bsn 52 delta_bsn 12 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 121 FBI 0 
+fn_same_bsn 797 fn_last_bsn 247 delta_bsn 13 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 123 FBI 0 
+fn_same_bsn 797 fn_last_bsn 251 delta_bsn 15 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 116 FBI 0 
+fn_same_bsn 529 fn_last_bsn 256 delta_bsn 8 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 0 FBI 0 
+fn_same_bsn 750 fn_last_bsn 503 delta_bsn -108 old_len 50
+ bsn 103 
+lime 0
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106  bsn 107  bsn 108  bsn 109  bsn 110  bsn 111  bsn 112  bsn 113 
+lime 0
+
+lime error!
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0 
+lime 0
+end of message reached
+MSG: 03c05c4dd7f0484f5b179a74015059e2d8c307e8ea1227f0273537767e120a01159cb900a860cf9bf249686a7618053e045450c67aeb7b1716ab6edda9b6fc950a1eb89bfa4964d1fd45cbda6bfb7bfb15e2909df9831ffed05f349f6a3cb65a7a9829a1ba6b6d8fe96c14f24fd9bf02e83b91c8f00bb1609d5d52554ecdaf22ad34517e8a5caea165db2d71b0517915e2a9cf4bf91eb0b6bdaf6fbc5b99dcfa46af9a6b5642348688d78df97b3d9b5a4eafe6b370bf8548dbaeb6dacaa939aae1d6eda6b7a922685bd9511be8f4853aa8d95bc4a1f7ed2a3d6a479cbef3093704084777ab86503b3dd0b4c76024dfde1b5c57d03e232e0ceca33b56d321b551cacf1b112057b834ef898139359594af9a010e90f88bb7ae4e4c4c4eaa5b57df7bf75beffce89df744ab7cebfbefa6ed38180d86d5500a89489a2ec43226bdfdf4a73fa58e1a7a0f8ddcbe8aff4e74200d3706838d5a66ba383f0c7126040c71d061eea50b4aa61d198b2ec1724723de0a8dabaee697f6553f79caff9fe84cf2346a130de9573877178db04843bc03517cfc549a949f514442fce490a84270562b6e3b0a6ade10fc730fef618a7a611c50c0cb6d8ad415314c36afa69bcabe655cf1ec7e3ae2998c236885baf73787e83fea7f16d2a58d42ae4741f57fe8fdfc50a5b3c5b4a71ef7fef0fadf98ef85d268e469670706e5e3b9108412023a357301d0a99ef7e1134a3c111f468c86804ec9804389d161a05332934162f41240a77a29c5f756f47760a6185ff0eb87a294faedbcba0b947e91ef695f8810ddfbbc4dfd567bb6d0cfbacffa6d945633c568119fc772a9f7bd4b3ff21d11a6203dc4fac2fe9c45440800438bb02f0c84107aa0c40b1e64ec45f13e63ef8a778b22b52480e394ae368fe58aee4cda4ddc7cff3a8cc56cc305b66e292d031137cb42045f02be153ed9635d6662be8862a8b5838011f7b820165fd17452056676ad360b6a8edbc53e5af6dd9138
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 125 FBI 0 
+fn_same_bsn 1049 fn_last_bsn 4 delta_bsn 125 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 127 FBI 0 
+fn_same_bsn 1048 fn_last_bsn 8 delta_bsn 127 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 1958 fn_last_bsn 255 delta_bsn 13 old_len 35
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 15 FBI 0 
+fn_same_bsn 1976 fn_last_bsn 260 delta_bsn 15 old_len 35
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 17 FBI 0 
+fn_same_bsn 1976 fn_last_bsn 264 delta_bsn 17 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 10 FBI 0 
+fn_same_bsn 2015 fn_last_bsn 281 delta_bsn 10 old_len 35
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 1 
+lime 0
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3  bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 27 FBI 0 
+fn_same_bsn 1824 fn_last_bsn 26 delta_bsn 17 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1920 fn_last_bsn 291 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1924 fn_last_bsn 295 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1928 fn_last_bsn 299 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1941 fn_last_bsn 312 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1950 fn_last_bsn 321 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1954 fn_last_bsn 325 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1959 fn_last_bsn 330 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1963 fn_last_bsn 334 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1967 fn_last_bsn 338 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1972 fn_last_bsn 343 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1976 fn_last_bsn 347 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1980 fn_last_bsn 351 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1985 fn_last_bsn 356 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1989 fn_last_bsn 360 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1993 fn_last_bsn 364 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1998 fn_last_bsn 369 delta_bsn 39 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 2002 fn_last_bsn 373 delta_bsn 39 old_len 50
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 1 
+lime 0
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3  bsn 4 null
+ bsn 5 
+lime 0
+
+lime 1
+ bsn 6 
+lime 0
+ bsn 7  bsn 8 null
+ bsn 9 
+lime 0
+ bsn 10 old segment
+ bsn 11 
+lime 0
+ bsn 12 
+lime 0
+ bsn 13 
+lime 0
+
+lime error!
+ bsn 14  bsn 15 
+lime 0
+
+lime error!
+ bsn 16 
+lime 0
+ bsn 17 
+lime 0
+ bsn 18 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 19 null
+ bsn 20 
+lime 0
+ bsn 21 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 22 
+lime 0
+ bsn 23 
+lime 0
+ bsn 24 null
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29 
+lime 0
+
+lime 1
+ bsn 30 null
+ bsn 31 
+lime 0
+
+lime 1
+ bsn 32  bsn 33 
+lime 0
+
+lime error!
+ bsn 34 null
+ bsn 35  bsn 36 null
+ bsn 37 
+lime 0
+ bsn 38 null
+ bsn 39  bsn 40  bsn 41 null
+ bsn 42 
+lime 0
+ bsn 43 null
+ bsn 44  bsn 45 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 46  bsn 47 
+lime 0
+
+lime error!
+ bsn 48  bsn 49 
+lime 0
+end of message reached
+MSG: 03c0756500001c450000ca37bd40003206fd5257fafa77c0a8000401bb95e397cdfdee0abb68f450a4af68c4676e0ca16930e0733b6f64c061340dfa1aecbc91990cd034a4ff73691aff91bc3236c04f3b7ba30fafc4fb43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 9 fn_last_bsn 9 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 51 FBI 0 
+fn_same_bsn 2076 fn_last_bsn 4 delta_bsn 2 old_len 48
+ bsn 47 
+lime 0
+ bsn 48  bsn 49 
+lime 0
+
+lime error!
+ bsn 50  bsn 51 
+TS 4 CS4 DL DATA TFI 0 BSN 53 FBI 0 
+fn_same_bsn 2058 fn_last_bsn 4 delta_bsn 2 old_len 49
+ bsn 47 
+lime 0
+ bsn 48  bsn 49 
+lime 0
+
+lime error!
+ bsn 50  bsn 51  bsn 52  bsn 53 
+TS 4 CS4 DL DATA TFI 0 BSN 55 FBI 0 
+fn_same_bsn 2059 fn_last_bsn 5 delta_bsn 2 old_len 50
+ bsn 47 
+lime 0
+ bsn 48  bsn 49 
+lime 0
+
+lime error!
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55 
+TS 4 CS4 DL DATA TFI 0 BSN 57 FBI 0 
+fn_same_bsn 2058 fn_last_bsn 4 delta_bsn 2 old_len 48
+ bsn 47 
+lime 0
+ bsn 48  bsn 49 
+lime 0
+
+lime error!
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55  bsn 56  bsn 57 
+TS 4 CS4 DL DATA TFI 0 BSN 59 FBI 0 
+fn_same_bsn 1365 fn_last_bsn 4 delta_bsn 2 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 61 FBI 0 
+fn_same_bsn 1365 fn_last_bsn 9 delta_bsn 4 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 54 FBI 0 
+fn_same_bsn 2072 fn_last_bsn 22 delta_bsn -3 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 56 FBI 0 
+fn_same_bsn 1681 fn_last_bsn 26 delta_bsn -1 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 2023 fn_last_bsn 30 delta_bsn 1 old_len 49
+ bsn 47 
+lime 0
+ bsn 48  bsn 49 
+lime 0
+
+lime error!
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55  bsn 56  bsn 57  bsn 58 
+TS 4 CS4 DL DATA TFI 0 BSN 62 FBI 0 
+fn_same_bsn 2050 fn_last_bsn 9 delta_bsn 4 old_len 50
+ bsn 47 
+lime 0
+ bsn 48  bsn 49 
+lime 0
+
+lime error!
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55  bsn 56  bsn 57  bsn 58  bsn 59  bsn 60 
+lime 0
+
+lime error!
+ bsn 61  bsn 62 
+TS 4 CS4 DL DATA TFI 0 BSN 64 FBI 0 
+fn_same_bsn 2049 fn_last_bsn 4 delta_bsn 2 old_len 48
+ bsn 60 
+lime 0
+ bsn 61  bsn 62  bsn 63  bsn 64 
+TS 4 CS4 DL DATA TFI 0 BSN 68 FBI 0 
+fn_same_bsn 2032 fn_last_bsn 9 delta_bsn 4 old_len 50
+ bsn 60 
+lime 0
+ bsn 61  bsn 62  bsn 63  bsn 64  bsn 65 null
+ bsn 66 old segment
+ bsn 67 null
+ bsn 68 
+TS 4 CS4 DL DATA TFI 0 BSN 70 FBI 0 
+fn_same_bsn 1993 fn_last_bsn 4 delta_bsn 2 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 72 FBI 0 
+fn_same_bsn 1968 fn_last_bsn 9 delta_bsn 4 old_len 48
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 74 FBI 0 
+fn_same_bsn 1967 fn_last_bsn 13 delta_bsn 6 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 1 FBI 0 
+fn_same_bsn 4169 fn_last_bsn 1560 delta_bsn -67 old_len 29
+ bsn 60 
+lime 0
+ bsn 61  bsn 62  bsn 63  bsn 64  bsn 65 null
+ bsn 66 old segment
+ bsn 67 null
+ bsn 68  bsn 69 old segment
+ bsn 70 
+lime 0
+ bsn 71  bsn 72 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 73  bsn 74  bsn 75  bsn 76  bsn 77  bsn 78  bsn 79  bsn 80  bsn 81  bsn 82  bsn 83  bsn 84  bsn 85  bsn 86  bsn 87  bsn 88  bsn 89  bsn 90  bsn 91  bsn 92  bsn 93  bsn 94  bsn 95  bsn 96  bsn 97  bsn 98  bsn 99 
+lime 0
+
+lime error!
+ bsn 100  bsn 101  bsn 102  bsn 103 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 104 null
+ bsn 105  bsn 106  bsn 107  bsn 108  bsn 109  bsn 110  bsn 111  bsn 112  bsn 113 
+lime 0
+
+lime error!
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 1 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 3 FBI 0 
+fn_same_bsn 3358 fn_last_bsn 4 delta_bsn 2 old_len 50
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 1 old segment
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 5 FBI 0 
+fn_same_bsn 4199 fn_last_bsn 5 delta_bsn 2 old_len 28
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 1 old segment
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3 old segment
+ bsn 4 null
+ bsn 5 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 4117 fn_last_bsn 4 delta_bsn 2 old_len 36
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 1 old segment
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3 old segment
+ bsn 4 null
+ bsn 5 old segment
+ bsn 6 
+lime 0
+ bsn 7 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 9 FBI 0 
+fn_same_bsn 4103 fn_last_bsn 4 delta_bsn 2 old_len 35
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 1 old segment
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3 old segment
+ bsn 4 null
+ bsn 5 old segment
+ bsn 6 
+lime 0
+ bsn 7 old segment
+ bsn 8 null
+ bsn 9 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 4086 fn_last_bsn 9 delta_bsn 4 old_len 35
+ bsn 113 
+lime 0
+ bsn 114  bsn 115  bsn 116  bsn 117  bsn 118  bsn 119  bsn 120  bsn 121  bsn 122  bsn 123  bsn 124  bsn 125  bsn 126  bsn 127  bsn 0 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 1 old segment
+ bsn 2 
+lime 0
+
+lime 1
+ bsn 3 old segment
+ bsn 4 null
+ bsn 5 old segment
+ bsn 6 
+lime 0
+ bsn 7 old segment
+ bsn 8 null
+ bsn 9 old segment
+ bsn 10 old segment
+ bsn 11 
+lime 0
+ bsn 12 
+lime 0
+ bsn 13 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 15 FBI 0 
+fn_same_bsn 4103 fn_last_bsn 4 delta_bsn 2 old_len 35
+ bsn 12 
+lime 0
+ bsn 13 old segment
+ bsn 14  bsn 15 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 19 FBI 0 
+fn_same_bsn 4065 fn_last_bsn 9 delta_bsn 4 old_len 0
+ bsn 12 
+lime 0
+ bsn 13 old segment
+ bsn 14  bsn 15 old segment
+ bsn 16 
+lime 0
+ bsn 17 
+lime 0
+ bsn 18 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 19 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 29 FBI 0 
+fn_same_bsn 3931 fn_last_bsn 22 delta_bsn 10 old_len 48
+ bsn 17 
+lime 0
+ bsn 18 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 19 old segment
+ bsn 20 
+lime 0
+ bsn 21 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 22 
+lime 0
+ bsn 23 
+lime 0
+ bsn 24 null
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 31 FBI 0 
+fn_same_bsn 3891 fn_last_bsn 4 delta_bsn 2 old_len 48
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29 old segment
+ bsn 30 null
+ bsn 31 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 34 FBI 0 
+fn_same_bsn 3861 fn_last_bsn 9 delta_bsn 3 old_len 0
+ bsn 25 
+lime 0
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29 old segment
+ bsn 30 null
+ bsn 31 old segment
+ bsn 32  bsn 33 
+lime 0
+
+lime error!
+ bsn 34 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 24 FBI 0 
+fn_same_bsn 3917 fn_last_bsn 4 delta_bsn -10 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 26 FBI 0 
+fn_same_bsn 3943 fn_last_bsn 8 delta_bsn -8 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 32 FBI 0 
+fn_same_bsn 3414 fn_last_bsn 21 delta_bsn -2 old_len 50
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 34 FBI 0 
+fn_same_bsn 26 fn_last_bsn 26 delta_bsn 0 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 36 FBI 0 
+fn_same_bsn 3887 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 33 
+lime 0
+ bsn 34 old segment
+ bsn 35  bsn 36 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 38 FBI 0 
+fn_same_bsn 3887 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 33 
+lime 0
+ bsn 34 old segment
+ bsn 35  bsn 36 old segment
+ bsn 37 
+lime 0
+ bsn 38 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 40 FBI 0 
+fn_same_bsn 3415 fn_last_bsn 5 delta_bsn 2 old_len 50
+ bsn 37 
+lime 0
+ bsn 38 old segment
+ bsn 39  bsn 40 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 37 FBI 0 
+fn_same_bsn 3917 fn_last_bsn 8 delta_bsn -3 old_len 49
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 39 FBI 0 
+fn_same_bsn 3918 fn_last_bsn 13 delta_bsn -1 old_len 50
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 36 FBI 0 
+fn_same_bsn 26 fn_last_bsn 17 delta_bsn -4 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 38 FBI 0 
+fn_same_bsn 26 fn_last_bsn 21 delta_bsn -2 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 40 FBI 0 
+fn_same_bsn 26 fn_last_bsn 26 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 42 FBI 0 
+fn_same_bsn 3917 fn_last_bsn 4 delta_bsn 2 old_len 49
+ bsn 37 
+lime 0
+ bsn 38  bsn 39  bsn 40 
+lime 0
+end of message reached
+MSG: 03c05d6500001645000038000040002f06df04364c75c3c01f1120abc1965ea60c31f0d55c55ae3cbc43ce8e7f5af9db38514f7b1f3dcaf7a6b839c02b000012ff0100010033740009084500003c0000400034063d045fd3e938c0a800040050e05b19d049c8d8cf3372a012389055cb0000020405b40402080aeee7f73e4bbd717654a3404f0744
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+ bsn 41 null
+ bsn 42 
+TS 4 CS4 DL DATA TFI 0 BSN 44 FBI 0 
+fn_same_bsn 3908 fn_last_bsn 4 delta_bsn 2 old_len 50
+ bsn 40 
+lime 0
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44 
+TS 4 CS4 DL DATA TFI 0 BSN 46 FBI 0 
+fn_same_bsn 3441 fn_last_bsn 5 delta_bsn 2 old_len 50
+ bsn 40 
+lime 0
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+end of message reached
+MSG: 01000436b70e872c7883
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 42 FBI 0 
+fn_same_bsn 13 fn_last_bsn 4 delta_bsn -4 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 44 FBI 0 
+fn_same_bsn 13 fn_last_bsn 8 delta_bsn -2 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 46 FBI 0 
+fn_same_bsn 13 fn_last_bsn 13 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 42 FBI 0 
+fn_same_bsn 13 fn_last_bsn 4 delta_bsn -4 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 44 FBI 0 
+fn_same_bsn 13 fn_last_bsn 8 delta_bsn -2 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 47 FBI 0 
+fn_same_bsn 3905 fn_last_bsn 13 delta_bsn 1 old_len 49
+ bsn 40 
+lime 0
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+
+lime 1
+ bsn 47 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 47 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 47 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 47 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 47 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 47 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 49 FBI 0 
+fn_same_bsn 1846 fn_last_bsn 18 delta_bsn 2 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 50 FBI 0 
+fn_same_bsn 3505 fn_last_bsn 26 delta_bsn 3 old_len 50
+ bsn 40 
+lime 0
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+
+lime 1
+ bsn 47 
+lime 0
+ bsn 48 old segment
+ bsn 49 
+lime 0
+ bsn 50 
+TS 4 CS4 DL DATA TFI 0 BSN 52 FBI 0 
+fn_same_bsn 3506 fn_last_bsn 5 delta_bsn 2 old_len 50
+ bsn 40 
+lime 0
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+
+lime 1
+ bsn 47 
+lime 0
+ bsn 48 old segment
+ bsn 49 
+lime 0
+ bsn 50  bsn 51  bsn 52 
+TS 4 CS4 DL DATA TFI 0 BSN 56 FBI 0 
+fn_same_bsn 1824 fn_last_bsn 8 delta_bsn 4 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 1825 fn_last_bsn 13 delta_bsn 6 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 60 FBI 0 
+fn_same_bsn 3848 fn_last_bsn 17 delta_bsn 8 old_len 49
+ bsn 40 
+lime 0
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+
+lime 1
+ bsn 47 
+lime 0
+ bsn 48 old segment
+ bsn 49 
+lime 0
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55  bsn 56  bsn 57  bsn 58  bsn 59  bsn 60 old segment
+
+TS 4 CS4 DL DATA TFI 0 BSN 53 FBI 0 
+fn_same_bsn 1881 fn_last_bsn 13 delta_bsn -7 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 57 FBI 0 
+fn_same_bsn 1881 fn_last_bsn 22 delta_bsn -3 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 64 FBI 0 
+fn_same_bsn 1842 fn_last_bsn 26 delta_bsn 4 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 66 FBI 0 
+fn_same_bsn 3852 fn_last_bsn 30 delta_bsn 6 old_len 50
+ bsn 40 
+lime 0
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+
+lime 1
+ bsn 47 
+lime 0
+ bsn 48 old segment
+ bsn 49 
+lime 0
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55  bsn 56  bsn 57  bsn 58  bsn 59  bsn 60 old segment
+ bsn 61  bsn 62  bsn 63  bsn 64  bsn 65 null
+ bsn 66 
+lime 0
+end of message reached
+MSG: 840abbd16d8010007b8e8400000101080a1639dcbc01cbd5c461f664
+
+TS 4 CS4 DL DATA TFI 0 BSN 63 FBI 0 
+fn_same_bsn 3246 fn_last_bsn 5 delta_bsn -3 old_len 50
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 65 FBI 0 
+fn_same_bsn 3874 fn_last_bsn 9 delta_bsn -1 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 67 FBI 0 
+fn_same_bsn 3874 fn_last_bsn 13 delta_bsn 1 old_len 0
+ bsn 66 
+lime 0
+ bsn 67 
+lime 0
+end of message reached
+MSG: 03c1c56500004b4500003437bf40003206fde657fafa77c0a8000401bb95e397cdfe840abbd16d8011007b8e8300000101080a1639dcbc01cbd5c4da773a
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 64 FBI 0 
+fn_same_bsn 1864 fn_last_bsn 5 delta_bsn -3 old_len 50
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 68 FBI 0 
+fn_same_bsn 1859 fn_last_bsn 9 delta_bsn 1 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 70 FBI 0 
+fn_same_bsn 3852 fn_last_bsn 13 delta_bsn 3 old_len 49
+ bsn 67 
+lime 0
+
+lime 1
+ bsn 68  bsn 69 old segment
+ bsn 70 
+lime 0
+end of message reached
+MSG: 2d616e616c7974696373016c06676f6f676c65c021c036000100010000005e0004d83ad34e48fecd
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 72 FBI 0 
+fn_same_bsn 3835 fn_last_bsn 13 delta_bsn 2 old_len 48
+ bsn 67 
+lime 0
+
+lime 1
+ bsn 68  bsn 69 old segment
+ bsn 70 
+lime 0
+
+lime 1
+ bsn 71 old segment
+ bsn 72 
+lime 0
+end of message reached
+MSG: 23
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 72 FBI 0 
+fn_same_bsn 9 fn_last_bsn 9 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 72 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 72 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 72 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 73 FBI 0 
+fn_same_bsn 3575 fn_last_bsn 9 delta_bsn 1 old_len 50
+ bsn 67 
+lime 0
+
+lime 1
+ bsn 68  bsn 69 old segment
+ bsn 70 
+lime 0
+
+lime 1
+ bsn 71 old segment
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73 
+TS 4 CS4 DL DATA TFI 0 BSN 74 FBI 0 
+fn_same_bsn 3869 fn_last_bsn 8 delta_bsn 1 old_len 50
+ bsn 67 
+lime 0
+
+lime 1
+ bsn 68  bsn 69 old segment
+ bsn 70 
+lime 0
+
+lime 1
+ bsn 71 old segment
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73  bsn 74 
+lime 0
+end of message reached
+MSG: 03c1d16500004e4500003c0000400034063d055fd3e937c0a800040050e85c23fe0d33dbc2bd33a0123890a0b00000020405b40402080aeee7eb4501cbd62a010303075247e3
+
+TS 4 CS4 DL DATA TFI 0 BSN 74 FBI 0 
+fn_same_bsn 13 fn_last_bsn 13 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 76 FBI 0 
+fn_same_bsn 3883 fn_last_bsn 5 delta_bsn 2 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76 
+TS 4 CS4 DL DATA TFI 0 BSN 77 FBI 0 
+fn_same_bsn 3610 fn_last_bsn 17 delta_bsn 1 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+end of message reached
+MSG: 03c1d9650000504500003c000040002b06d71736b78141c0a800040050a2efb3d3d9ab159e9e3ca01238909dee0000020405b40402080af609464e01cbd60e01030308bff2bd
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 77 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 77 FBI 0 
+fn_same_bsn 9 fn_last_bsn 9 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 77 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 77 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 77 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 77 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 77 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 83 FBI 0 
+fn_same_bsn 3658 fn_last_bsn 26 delta_bsn 6 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79 old segment
+ bsn 80 old segment
+ bsn 81 old segment
+ bsn 82 old segment
+ bsn 83 
+lime 0
+end of message reached
+MSG: 960402080aa3c65a3801cbd64201030307abdf87
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 83 FBI 0 
+fn_same_bsn 13 fn_last_bsn 13 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 81 FBI 0 
+fn_same_bsn 3683 fn_last_bsn 8 delta_bsn -2 old_len 50
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 83 FBI 0 
+fn_same_bsn 13 fn_last_bsn 13 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 79 FBI 0 
+fn_same_bsn 3705 fn_last_bsn 13 delta_bsn -4 old_len 50
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 87 FBI 0 
+fn_same_bsn 3696 fn_last_bsn 21 delta_bsn 4 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+end of message reached
+MSG: 960402080aa3c6607c01cbd65d0103030772f846
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 89 FBI 0 
+fn_same_bsn 3697 fn_last_bsn 5 delta_bsn 2 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+end of message reached
+MSG: 960402080aa43557eb01cbd668010303073b787f
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 87 FBI 0 
+fn_same_bsn 13 fn_last_bsn 8 delta_bsn -2 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 91 FBI 0 
+fn_same_bsn 3709 fn_last_bsn 17 delta_bsn 2 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90 old segment
+ bsn 91 
+lime 0
+end of message reached
+MSG: 960402080aa3c65b6401cbd64201030307b35ba6
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 89 FBI 0 
+fn_same_bsn 21 fn_last_bsn 4 delta_bsn -2 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 92 FBI 0 
+fn_same_bsn 4021 fn_last_bsn 26 delta_bsn 1 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90 old segment
+ bsn 91 
+lime 0
+
+lime 1
+ bsn 92 
+TS 4 CS4 DL DATA TFI 0 BSN 122 FBI 0 
+fn_same_bsn 3731 fn_last_bsn 65 delta_bsn 30 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90 old segment
+ bsn 91 
+lime 0
+
+lime 1
+ bsn 92  bsn 93 old segment
+ bsn 94 old segment
+ bsn 95 old segment
+ bsn 96 old segment
+ bsn 97 old segment
+ bsn 98 old segment
+ bsn 99 old segment
+ bsn 100 old segment
+ bsn 101 old segment
+ bsn 102 old segment
+ bsn 103 old segment
+ bsn 104 null
+ bsn 105 old segment
+ bsn 106 old segment
+ bsn 107 old segment
+ bsn 108 old segment
+ bsn 109 old segment
+ bsn 110 old segment
+ bsn 111 old segment
+ bsn 112 old segment
+ bsn 113 old segment
+ bsn 114 old segment
+ bsn 115 old segment
+ bsn 116 old segment
+ bsn 117 old segment
+ bsn 118 old segment
+ bsn 119 old segment
+ bsn 120 old segment
+ bsn 121 old segment
+ bsn 122 
+TS 4 CS4 DL DATA TFI 0 BSN 124 FBI 0 
+fn_same_bsn 3731 fn_last_bsn 4 delta_bsn 2 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90 old segment
+ bsn 91 
+lime 0
+
+lime 1
+ bsn 92  bsn 93 old segment
+ bsn 94 old segment
+ bsn 95 old segment
+ bsn 96 old segment
+ bsn 97 old segment
+ bsn 98 old segment
+ bsn 99 old segment
+ bsn 100 old segment
+ bsn 101 old segment
+ bsn 102 old segment
+ bsn 103 old segment
+ bsn 104 null
+ bsn 105 old segment
+ bsn 106 old segment
+ bsn 107 old segment
+ bsn 108 old segment
+ bsn 109 old segment
+ bsn 110 old segment
+ bsn 111 old segment
+ bsn 112 old segment
+ bsn 113 old segment
+ bsn 114 old segment
+ bsn 115 old segment
+ bsn 116 old segment
+ bsn 117 old segment
+ bsn 118 old segment
+ bsn 119 old segment
+ bsn 120 old segment
+ bsn 121 old segment
+ bsn 122  bsn 123 old segment
+ bsn 124 
+TS 4 CS4 DL DATA TFI 0 BSN 13 FBI 0 
+fn_same_bsn 628 fn_last_bsn 39 delta_bsn -111 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90 old segment
+ bsn 91 
+lime 0
+
+lime 1
+ bsn 92  bsn 93 old segment
+ bsn 94 old segment
+ bsn 95 old segment
+ bsn 96 old segment
+ bsn 97 old segment
+ bsn 98 old segment
+ bsn 99 old segment
+ bsn 100 old segment
+ bsn 101 old segment
+ bsn 102 old segment
+ bsn 103 old segment
+ bsn 104 null
+ bsn 105 old segment
+ bsn 106 old segment
+ bsn 107 old segment
+ bsn 108 old segment
+ bsn 109 old segment
+ bsn 110 old segment
+ bsn 111 old segment
+ bsn 112 old segment
+ bsn 113 old segment
+ bsn 114 old segment
+ bsn 115 old segment
+ bsn 116 old segment
+ bsn 117 old segment
+ bsn 118 old segment
+ bsn 119 old segment
+ bsn 120 old segment
+ bsn 121 old segment
+ bsn 122  bsn 123 old segment
+ bsn 124  bsn 125 old segment
+ bsn 126 old segment
+ bsn 127 old segment
+ bsn 0 old segment
+ bsn 1  bsn 2 old segment
+ bsn 3  bsn 4 null
+ bsn 5  bsn 6 old segment
+ bsn 7  bsn 8 null
+ bsn 9  bsn 10 old segment
+ bsn 11 old segment
+ bsn 12 old segment
+ bsn 13 
+TS 4 CS4 DL DATA TFI 0 BSN 27 FBI 0 
+fn_same_bsn 4559 fn_last_bsn 31 delta_bsn 14 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90 old segment
+ bsn 91 
+lime 0
+
+lime 1
+ bsn 92  bsn 93 old segment
+ bsn 94 old segment
+ bsn 95 old segment
+ bsn 96 old segment
+ bsn 97 old segment
+ bsn 98 old segment
+ bsn 99 old segment
+ bsn 100 old segment
+ bsn 101 old segment
+ bsn 102 old segment
+ bsn 103 old segment
+ bsn 104 null
+ bsn 105 old segment
+ bsn 106 old segment
+ bsn 107 old segment
+ bsn 108 old segment
+ bsn 109 old segment
+ bsn 110 old segment
+ bsn 111 old segment
+ bsn 112 old segment
+ bsn 113 old segment
+ bsn 114 old segment
+ bsn 115 old segment
+ bsn 116 old segment
+ bsn 117 old segment
+ bsn 118 old segment
+ bsn 119 old segment
+ bsn 120 old segment
+ bsn 121 old segment
+ bsn 122  bsn 123 old segment
+ bsn 124  bsn 125 old segment
+ bsn 126 old segment
+ bsn 127 old segment
+ bsn 0 old segment
+ bsn 1  bsn 2 old segment
+ bsn 3  bsn 4 null
+ bsn 5  bsn 6 old segment
+ bsn 7  bsn 8 null
+ bsn 9  bsn 10 old segment
+ bsn 11 old segment
+ bsn 12 old segment
+ bsn 13  bsn 14 old segment
+ bsn 15  bsn 16 old segment
+ bsn 17 old segment
+ bsn 18 old segment
+ bsn 19 
+lime 0
+end of message reached
+MSG: c9c9
+ bsn 20 old segment
+ bsn 21 old segment
+ bsn 22 old segment
+ bsn 23 old segment
+ bsn 24 null
+ bsn 25 old segment
+ bsn 26 null
+ bsn 27 
+TS 4 CS3 DL DATA TFI 0 BSN 51 FBI 0 
+fn_same_bsn 2392 fn_last_bsn 82 delta_bsn 24 old_len 50
+ bsn 19 
+lime 0
+ bsn 20 old segment
+ bsn 21 old segment
+ bsn 22 old segment
+ bsn 23 old segment
+ bsn 24 null
+ bsn 25 old segment
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29  bsn 30 null
+ bsn 31 
+lime 0
+end of message reached
+MSG: 86028727b54aaec540b87534a56f099c3abd
+ bsn 32  bsn 33 old segment
+ bsn 34  bsn 35 old segment
+ bsn 36  bsn 37 
+lime 0
+
+lime error!
+ bsn 38  bsn 39  bsn 40 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+
+lime 1
+ bsn 47 
+lime 0
+ bsn 48 old segment
+ bsn 49 
+lime 0
+ bsn 50  bsn 51 
+TS 4 CS3 DL DATA TFI 0 BSN 55 FBI 0 
+fn_same_bsn 2392 fn_last_bsn 9 delta_bsn 4 old_len 50
+ bsn 37 
+lime 0
+ bsn 38  bsn 39  bsn 40 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+
+lime 1
+ bsn 47 
+lime 0
+ bsn 48 old segment
+ bsn 49 
+lime 0
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55 
+TS 4 CS3 DL DATA TFI 0 BSN 57 FBI 0 
+fn_same_bsn 511 fn_last_bsn 4 delta_bsn 2 old_len 50
+fucking error d_bsn!
+
+TS 4 CS3 DL DATA TFI 0 BSN 55 FBI 0 
+fn_same_bsn 17 fn_last_bsn 17 delta_bsn 0 old_len 36
+duplicate2
+
+TS 4 CS3 DL DATA TFI 0 BSN 57 FBI 0 
+fn_same_bsn 528 fn_last_bsn 4 delta_bsn 2 old_len 50
+fucking error d_bsn!
+
+TS 4 CS3 DL DATA TFI 0 BSN 54 FBI 0 
+fn_same_bsn 2392 fn_last_bsn 9 delta_bsn -1 old_len 0
+duplicate
+
+TS 4 CS3 DL DATA TFI 0 BSN 56 FBI 0 
+fn_same_bsn 2392 fn_last_bsn 13 delta_bsn 1 old_len 50
+ bsn 37 
+lime 0
+ bsn 38  bsn 39  bsn 40 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+
+lime 1
+ bsn 47 
+lime 0
+ bsn 48 old segment
+ bsn 49 
+lime 0
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55  bsn 56 
+TS 4 CS3 DL DATA TFI 0 BSN 58 FBI 0 
+fn_same_bsn 2392 fn_last_bsn 4 delta_bsn 2 old_len 50
+ bsn 37 
+lime 0
+ bsn 38  bsn 39  bsn 40 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+
+lime 1
+ bsn 47 
+lime 0
+ bsn 48 old segment
+ bsn 49 
+lime 0
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55  bsn 56  bsn 57  bsn 58 
+lime 0
+end of message reached
+MSG: 0e000037116eb308080808c0a8000400357aea005c6e58ce5f8180000100020000000007616e64726f696407636c69656e747306676f6f676c6503636f6d0000010001c00c000500e98e95f24fc0197bdcd2efd3a7c91c164d46fbc132b155951b986dda15244ccbd3cbced0e833245333cb33a8ff9d2c0bed949f7c
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS3 DL DATA TFI 0 BSN 55 FBI 0 
+fn_same_bsn 22 fn_last_bsn 5 delta_bsn -3 old_len 36
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 68 FBI 0 
+fn_same_bsn 2435 fn_last_bsn 65 delta_bsn 10 old_len 50
+ bsn 37 
+lime 0
+ bsn 38  bsn 39  bsn 40 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 old segment
+ bsn 46 
+lime 0
+
+lime 1
+ bsn 47 
+lime 0
+ bsn 48 old segment
+ bsn 49 
+lime 0
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55  bsn 56  bsn 57  bsn 58 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 59 old segment
+ bsn 60  bsn 61 old segment
+ bsn 62  bsn 63  bsn 64  bsn 65 null
+ bsn 66 
+lime 0
+ bsn 67 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 68 
+TS 4 CS4 DL DATA TFI 0 BSN 90 FBI 0 
+fn_same_bsn 4403 fn_last_bsn 48 delta_bsn 22 old_len 50
+ bsn 66 
+lime 0
+ bsn 67 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 68  bsn 69 old segment
+ bsn 70 
+lime 0
+
+lime 1
+ bsn 71 old segment
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73  bsn 74 
+lime 0
+
+lime error!
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90 
+TS 4 CS4 DL DATA TFI 0 BSN 100 FBI 0 
+fn_same_bsn 4446 fn_last_bsn 65 delta_bsn 10 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90  bsn 91 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 92  bsn 93 old segment
+ bsn 94 old segment
+ bsn 95 old segment
+ bsn 96 old segment
+ bsn 97 old segment
+ bsn 98 old segment
+ bsn 99 old segment
+ bsn 100 
+TS 4 CS4 DL DATA TFI 0 BSN 12 FBI 0 
+fn_same_bsn 4117 fn_last_bsn 52 delta_bsn -88 old_len 49
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90  bsn 91 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 92  bsn 93 old segment
+ bsn 94 old segment
+ bsn 95 old segment
+ bsn 96 old segment
+ bsn 97 old segment
+ bsn 98 old segment
+ bsn 99 old segment
+ bsn 100  bsn 101 old segment
+ bsn 102 old segment
+ bsn 103 old segment
+ bsn 104 null
+ bsn 105 old segment
+ bsn 106 old segment
+ bsn 107 old segment
+ bsn 108 old segment
+ bsn 109 old segment
+ bsn 110 old segment
+ bsn 111 old segment
+ bsn 112 old segment
+ bsn 113 old segment
+ bsn 114 old segment
+ bsn 115 old segment
+ bsn 116 old segment
+ bsn 117 old segment
+ bsn 118 old segment
+ bsn 119 old segment
+ bsn 120 old segment
+ bsn 121 old segment
+ bsn 122  bsn 123 old segment
+ bsn 124  bsn 125 old segment
+ bsn 126 old segment
+ bsn 127 old segment
+ bsn 0 old segment
+ bsn 1  bsn 2 old segment
+ bsn 3  bsn 4 null
+ bsn 5  bsn 6 old segment
+ bsn 7  bsn 8 null
+ bsn 9  bsn 10 old segment
+ bsn 11 old segment
+ bsn 12 
+TS 4 CS4 DL DATA TFI 0 BSN 45 FBI 0 
+fn_same_bsn 4845 fn_last_bsn 74 delta_bsn 33 old_len 48
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90  bsn 91 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 92  bsn 93 old segment
+ bsn 94 old segment
+ bsn 95 old segment
+ bsn 96 old segment
+ bsn 97 old segment
+ bsn 98 old segment
+ bsn 99 old segment
+ bsn 100  bsn 101 old segment
+ bsn 102 old segment
+ bsn 103 old segment
+ bsn 104 null
+ bsn 105 old segment
+ bsn 106 old segment
+ bsn 107 old segment
+ bsn 108 old segment
+ bsn 109 old segment
+ bsn 110 old segment
+ bsn 111 old segment
+ bsn 112 old segment
+ bsn 113 old segment
+ bsn 114 old segment
+ bsn 115 old segment
+ bsn 116 old segment
+ bsn 117 old segment
+ bsn 118 old segment
+ bsn 119 old segment
+ bsn 120 old segment
+ bsn 121 old segment
+ bsn 122  bsn 123 old segment
+ bsn 124  bsn 125 old segment
+ bsn 126 old segment
+ bsn 127 old segment
+ bsn 0 old segment
+ bsn 1  bsn 2 old segment
+ bsn 3  bsn 4 null
+ bsn 5  bsn 6 old segment
+ bsn 7  bsn 8 null
+ bsn 9  bsn 10 old segment
+ bsn 11 old segment
+ bsn 12  bsn 13  bsn 14 old segment
+ bsn 15  bsn 16 old segment
+ bsn 17 old segment
+ bsn 18 old segment
+ bsn 19 
+lime 0
+ bsn 20 old segment
+ bsn 21 old segment
+ bsn 22 old segment
+ bsn 23 old segment
+ bsn 24 null
+ bsn 25 old segment
+ bsn 26 null
+ bsn 27  bsn 28 null
+ bsn 29  bsn 30 null
+ bsn 31 
+lime 0
+ bsn 32  bsn 33 old segment
+ bsn 34  bsn 35 old segment
+ bsn 36  bsn 37 
+lime 0
+
+lime error!
+ bsn 38  bsn 39  bsn 40 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45 
+TS 4 CS4 DL DATA TFI 0 BSN 55 FBI 0 
+fn_same_bsn 320 fn_last_bsn 21 delta_bsn 10 old_len 36
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 125 FBI 0 
+fn_same_bsn 4702 fn_last_bsn 186 delta_bsn 80 old_len 50
+ bsn 37 
+lime 0
+ bsn 38  bsn 39  bsn 40 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 41 null
+ bsn 42  bsn 43 null
+ bsn 44  bsn 45  bsn 46 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 47 
+lime 0
+ bsn 48 old segment
+ bsn 49 
+lime 0
+ bsn 50  bsn 51  bsn 52  bsn 53  bsn 54 null
+ bsn 55  bsn 56  bsn 57  bsn 58 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 59 old segment
+ bsn 60  bsn 61 old segment
+ bsn 62  bsn 63  bsn 64  bsn 65 null
+ bsn 66 
+lime 0
+ bsn 67 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 68  bsn 69 old segment
+ bsn 70 
+lime 0
+
+lime 1
+ bsn 71 old segment
+ bsn 72 
+lime 0
+
+lime 1
+ bsn 73  bsn 74 
+lime 0
+
+lime error!
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90  bsn 91 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 92  bsn 93 old segment
+ bsn 94 old segment
+ bsn 95 old segment
+ bsn 96 old segment
+ bsn 97 old segment
+ bsn 98 old segment
+ bsn 99 old segment
+ bsn 100  bsn 101 old segment
+ bsn 102 old segment
+ bsn 103 old segment
+ bsn 104 null
+ bsn 105 old segment
+ bsn 106 old segment
+ bsn 107 old segment
+ bsn 108 old segment
+ bsn 109 old segment
+ bsn 110 old segment
+ bsn 111 old segment
+ bsn 112 old segment
+ bsn 113 old segment
+ bsn 114 old segment
+ bsn 115 old segment
+ bsn 116 old segment
+ bsn 117 old segment
+ bsn 118 old segment
+ bsn 119 old segment
+ bsn 120 old segment
+ bsn 121 old segment
+ bsn 122  bsn 123 old segment
+ bsn 124  bsn 125 
+TS 4 CS4 DL DATA TFI 0 BSN 7 FBI 0 
+fn_same_bsn 1309 fn_last_bsn 22 delta_bsn -118 old_len 50
+ bsn 74 
+lime 0
+ bsn 75 old segment
+ bsn 76  bsn 77 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 78 old segment
+ bsn 79  bsn 80 old segment
+ bsn 81  bsn 82 old segment
+ bsn 83 
+lime 0
+
+lime 1
+ bsn 84 old segment
+ bsn 85 old segment
+ bsn 86 old segment
+ bsn 87 
+lime 0
+
+lime 1
+ bsn 88 old segment
+ bsn 89 
+lime 0
+
+lime 1
+ bsn 90  bsn 91 
+lime 0
+
+lime error!
+
+lime 1
+ bsn 92  bsn 93 old segment
+ bsn 94 old segment
+ bsn 95 old segment
+ bsn 96 old segment
+ bsn 97 old segment
+ bsn 98 old segment
+ bsn 99 old segment
+ bsn 100  bsn 101 old segment
+ bsn 102 old segment
+ bsn 103 old segment
+ bsn 104 null
+ bsn 105 old segment
+ bsn 106 old segment
+ bsn 107 old segment
+ bsn 108 old segment
+ bsn 109 old segment
+ bsn 110 old segment
+ bsn 111 old segment
+ bsn 112 old segment
+ bsn 113 old segment
+ bsn 114 old segment
+ bsn 115 old segment
+ bsn 116 old segment
+ bsn 117 old segment
+ bsn 118 old segment
+ bsn 119 old segment
+ bsn 120 old segment
+ bsn 121 old segment
+ bsn 122  bsn 123 old segment
+ bsn 124  bsn 125  bsn 126 old segment
+ bsn 127 old segment
+ bsn 0 old segment
+ bsn 1  bsn 2 old segment
+ bsn 3  bsn 4 null
+ bsn 5  bsn 6 old segment
+ bsn 7 
+lime 0
+end of message reached
+MSG: 0100000035000436b7cfd882fd7f
+
+TS 4 CS4 DL DATA TFI 0 BSN 4 FBI 0 
+fn_same_bsn 5529 fn_last_bsn 30 delta_bsn -3 old_len 0
+duplicate
+
+TS 4 CS4 DL DATA TFI 0 BSN 23 FBI 0 
+fn_same_bsn 5317 fn_last_bsn 86 delta_bsn 16 old_len 49
+ bsn 7 
+lime 0
+ bsn 8 null
+ bsn 9  bsn 10 old segment
+ bsn 11 old segment
+ bsn 12  bsn 13  bsn 14 old segment
+ bsn 15  bsn 16 old segment
+ bsn 17 old segment
+ bsn 18 old segment
+ bsn 19 
+lime 0
+ bsn 20 old segment
+ bsn 21 old segment
+ bsn 22 old segment
+ bsn 23 
+lime 0
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 23 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 23 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 23 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 25 FBI 0 
+fn_same_bsn 5317 fn_last_bsn 18 delta_bsn 2 old_len 49
+ bsn 19 
+lime 0
+ bsn 20 old segment
+ bsn 21 old segment
+ bsn 22 old segment
+ bsn 23 
+lime 0
+ bsn 24 null
+ bsn 25 
+lime 0
+end of message reached
+MSG: 010402080a1bdb7b6501cbd7ad4c0575
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 27 FBI 0 
+fn_same_bsn 758 fn_last_bsn 4 delta_bsn 2 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 25 FBI 0 
+fn_same_bsn 8 fn_last_bsn 8 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 28 FBI 0 
+fn_same_bsn 5304 fn_last_bsn 13 delta_bsn 3 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 old segment
+ bsn 21 old segment
+ bsn 22 old segment
+ bsn 23 
+lime 0
+ bsn 24 null
+ bsn 25 
+lime 0
+
+lime 1
+ bsn 26 null
+ bsn 27  bsn 28 
+lime 0
+end of message reached
+MSG: 5472616e736665722d456e636f64696e673a206368756e6b65640d0a436f6e6e656374696f6e3a206b6565702d616c69766543c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 28 FBI 0 
+fn_same_bsn 13 fn_last_bsn 13 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 28 FBI 0 
+fn_same_bsn 5 fn_last_bsn 5 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 28 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 28 FBI 0 
+fn_same_bsn 9 fn_last_bsn 9 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 28 FBI 0 
+fn_same_bsn 17 fn_last_bsn 17 delta_bsn 0 old_len 49
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 30 FBI 0 
+fn_same_bsn 5317 fn_last_bsn 4 delta_bsn 2 old_len 0
+ bsn 19 
+lime 0
+ bsn 20 old segment
+ bsn 21 old segment
+ bsn 22 old segment
+ bsn 23 
+lime 0
+ bsn 24 null
+ bsn 25 
+lime 0
+
+lime 1
+ bsn 26 null
+ bsn 27  bsn 28 
+lime 0
+
+lime error!
+ bsn 29  bsn 30 
+lime 0
+end of message reached
+MSG: 40d486f6b93071160dffd2ad4c133ca892764b19c946f823996fb70573d9939ab7e19c9776447e75551957a5f0ffa3e4e75d960402080aa3c66aa701cbd7b1010303076209bb
+
+lime 1
+end of message reached
+MSG: 43c0012b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b
+
+TS 4 CS4 DL DATA TFI 0 BSN 30 FBI 0 
+fn_same_bsn 18 fn_last_bsn 18 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 30 FBI 0 
+fn_same_bsn 4 fn_last_bsn 4 delta_bsn 0 old_len 48
+duplicate2
+
+TS 4 CS4 DL DATA TFI 0 BSN 31 FBI 0 
+fn_same_bsn 1478 fn_last_bsn 9 delta_bsn 1 old_len 49
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 32 FBI 0 
+fn_same_bsn 1456 fn_last_bsn 17 delta_bsn 2 old_len 50
+fucking error d_bsn!
+
+TS 4 CS4 DL DATA TFI 0 BSN 31 FBI 0 
+fn_same_bsn 1491 fn_last_bsn 22 delta_bsn 1 old_len 49
+fucking error d_bsn!
+
diff --git a/src/host/gprsdecode/tests/cs3.sample b/src/host/gprsdecode/tests/cs3.sample
new file mode 100644
index 00000000..08f5f452
--- /dev/null
+++ b/src/host/gprsdecode/tests/cs3.sample
diff --git a/src/host/gprsdecode/tests/testsuite.at b/src/host/gprsdecode/tests/testsuite.at
new file mode 100644
index 00000000..d764590b
--- /dev/null
+++ b/src/host/gprsdecode/tests/testsuite.at
@@ -0,0 +1,20 @@
+AT_INIT
+AT_BANNER([Regression tests.])
+
+AT_SETUP([sample/cs2])
+AT_KEYWORDS([cs2])
+cat $abs_srcdir/cs2.decoded > expout
+AT_CHECK([
+	$abs_top_builddir/gprsdecode \
+		-c $abs_srcdir/cs2.sample
+], [0], [expout], [ignore])
+AT_CLEANUP
+
+AT_SETUP([sample/cs3])
+AT_KEYWORDS([cs3])
+cat $abs_srcdir/cs3.decoded > expout
+AT_CHECK([
+	$abs_top_builddir/gprsdecode \
+		-c $abs_srcdir/cs3.sample
+], [0], [expout], [ignore])
+AT_CLEANUP
diff --git a/src/host/gsmmap/.gitignore b/src/host/gsmmap/.gitignore
new file mode 100644
index 00000000..661fd133
--- /dev/null
+++ b/src/host/gsmmap/.gitignore
@@ -0,0 +1,35 @@
+# autoreconf by-products
+*.in
+
+aclocal.m4
+autom4te.cache/
+configure
+depcomp
+install-sh
+missing
+
+# configure by-products
+.deps/
+Makefile
+
+config.status
+version.h
+
+# build by-products
+*.o
+
+gsmmap
+
+# various
+.version
+.tarball-version
+
+# IDA file
+*.id*
+*.nam
+*.til
+
+# Other test files
+*.dump
+*.bin
+*.log
diff --git a/src/host/gsmmap/Makefile.am b/src/host/gsmmap/Makefile.am
new file mode 100644
index 00000000..29be15c5
--- /dev/null
+++ b/src/host/gsmmap/Makefile.am
@@ -0,0 +1,17 @@
+AUTOMAKE_OPTIONS = foreign dist-bzip2 1.6
+
+# versioning magic
+BUILT_SOURCES = $(top_srcdir)/.version
+$(top_srcdir)/.version:
+	echo $(VERSION) > $@-t && mv $@-t $@
+dist-hook:
+	echo $(VERSION) > $(distdir)/.tarball-version
+
+INCLUDES = $(all_includes) -I../layer23/include -DHOST_BUILD
+AM_CFLAGS=-Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS)
+
+sbin_PROGRAMS = gsmmap 
+
+gsmmap_SOURCES = gsmmap.c geo.c locate.c log.c ../layer23/src/common/sysinfo.c ../layer23/src/common/networks.c ../layer23/src/common/logging.c
+gsmmap_LDADD = $(LIBOSMOGSM_LIBS) $(LIBOSMOCORE_LIBS) -lm
+
diff --git a/src/host/gsmmap/configure.ac b/src/host/gsmmap/configure.ac
new file mode 100644
index 00000000..3a42d4c3
--- /dev/null
+++ b/src/host/gsmmap/configure.ac
@@ -0,0 +1,26 @@
+dnl Process this file with autoconf to produce a configure script
+AC_INIT([gsmmap],
+	m4_esyscmd([./git-version-gen .tarball-version]),
+	[baseband-devel@lists.osmocom.org])
+
+AM_INIT_AUTOMAKE([dist-bzip2])
+
+dnl kernel style compile messages
+m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+
+dnl checks for programs
+AC_PROG_MAKE_SET
+AC_PROG_CC
+AC_PROG_INSTALL
+
+dnl checks for libraries
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore)
+PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm)
+
+dnl checks for header files
+AC_HEADER_STDC
+
+dnl Checks for typedefs, structures and compiler characteristics
+
+AC_OUTPUT(
+    Makefile)
diff --git a/src/host/gsmmap/geo.c b/src/host/gsmmap/geo.c
new file mode 100644
index 00000000..65633d2c
--- /dev/null
+++ b/src/host/gsmmap/geo.c
@@ -0,0 +1,47 @@
+#include <math.h>
+#include "geo.h"
+
+void geo2space(double *x, double *y, double *z, double lon, double lat)
+{
+	*z = sin(lat / 180.0 * PI) * POLE_RADIUS;
+	*x = sin(lon / 180.0 * PI) * cos(lat / 180.0 * PI) * EQUATOR_RADIUS;
+	*y = -cos(lon / 180.0 * PI) * cos(lat / 180.0 * PI) * EQUATOR_RADIUS;
+}
+
+void space2geo(double *lon, double *lat, double x, double y, double z)
+{
+	double r;
+
+	/* bring geoid to 1m radius */
+	z = z / POLE_RADIUS;
+	x = x / EQUATOR_RADIUS;
+	y = y / EQUATOR_RADIUS;
+
+	/* normalize */
+	r = sqrt(x * x + y * y + z * z);
+	z = z / r;
+	x = x / r;
+	y = y / r;
+
+	*lat = asin(z) / PI * 180;
+	*lon = atan2(x, -y) / PI * 180;
+}
+
+double distinspace(double x1, double y1, double z1, double x2, double y2,
+	double z2)
+{
+	double x = x1 - x2;
+	double y = y1 - y2;
+	double z = z1 - z2;
+
+	return sqrt(x * x + y * y + z * z);
+}
+
+double distonplane(double x1, double y1, double x2, double y2)
+{
+	double x = x1 - x2;
+	double y = y1 - y2;
+
+	return sqrt(x * x + y * y);
+}
+
diff --git a/src/host/gsmmap/geo.h b/src/host/gsmmap/geo.h
new file mode 100644
index 00000000..25e26cba
--- /dev/null
+++ b/src/host/gsmmap/geo.h
@@ -0,0 +1,12 @@
+/* WGS 84 */
+#define EQUATOR_RADIUS	6378137.0
+#define POLE_RADIUS	6356752.314
+
+#define PI		3.1415926536
+
+void geo2space(double *x, double *y, double *z, double lat, double lon);
+void space2geo(double *lat, double *lon, double x, double y, double z);
+double distinspace(double x1, double y1, double z1, double x2, double y2,
+	double z2);
+double distonplane(double x1, double y1, double x2, double y2);
+
diff --git a/src/host/gsmmap/git-version-gen b/src/host/gsmmap/git-version-gen
new file mode 100755
index 00000000..652fac68
--- /dev/null
+++ b/src/host/gsmmap/git-version-gen
@@ -0,0 +1,151 @@
+#!/bin/sh
+# Print a version string.
+scriptversion=2010-01-28.01
+
+# Copyright (C) 2007-2010 Free Software Foundation, Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# This script is derived from GIT-VERSION-GEN from GIT: http://git.or.cz/.
+# It may be run two ways:
+# - from a git repository in which the "git describe" command below
+#   produces useful output (thus requiring at least one signed tag)
+# - from a non-git-repo directory containing a .tarball-version file, which
+#   presumes this script is invoked like "./git-version-gen .tarball-version".
+
+# In order to use intra-version strings in your project, you will need two
+# separate generated version string files:
+#
+# .tarball-version - present only in a distribution tarball, and not in
+#   a checked-out repository.  Created with contents that were learned at
+#   the last time autoconf was run, and used by git-version-gen.  Must not
+#   be present in either $(srcdir) or $(builddir) for git-version-gen to
+#   give accurate answers during normal development with a checked out tree,
+#   but must be present in a tarball when there is no version control system.
+#   Therefore, it cannot be used in any dependencies.  GNUmakefile has
+#   hooks to force a reconfigure at distribution time to get the value
+#   correct, without penalizing normal development with extra reconfigures.
+#
+# .version - present in a checked-out repository and in a distribution
+#   tarball.  Usable in dependencies, particularly for files that don't
+#   want to depend on config.h but do want to track version changes.
+#   Delete this file prior to any autoconf run where you want to rebuild
+#   files to pick up a version string change; and leave it stale to
+#   minimize rebuild time after unrelated changes to configure sources.
+#
+# It is probably wise to add these two files to .gitignore, so that you
+# don't accidentally commit either generated file.
+#
+# Use the following line in your configure.ac, so that $(VERSION) will
+# automatically be up-to-date each time configure is run (and note that
+# since configure.ac no longer includes a version string, Makefile rules
+# should not depend on configure.ac for version updates).
+#
+# AC_INIT([GNU project],
+#         m4_esyscmd([build-aux/git-version-gen .tarball-version]),
+#         [bug-project@example])
+#
+# Then use the following lines in your Makefile.am, so that .version
+# will be present for dependencies, and so that .tarball-version will
+# exist in distribution tarballs.
+#
+# BUILT_SOURCES = $(top_srcdir)/.version
+# $(top_srcdir)/.version:
+#	echo $(VERSION) > $@-t && mv $@-t $@
+# dist-hook:
+#	echo $(VERSION) > $(distdir)/.tarball-version
+
+case $# in
+    1) ;;
+    *) echo 1>&2 "Usage: $0 \$srcdir/.tarball-version"; exit 1;;
+esac
+
+tarball_version_file=$1
+nl='
+'
+
+# First see if there is a tarball-only version file.
+# then try "git describe", then default.
+if test -f $tarball_version_file
+then
+    v=`cat $tarball_version_file` || exit 1
+    case $v in
+	*$nl*) v= ;; # reject multi-line output
+	[0-9]*) ;;
+	*) v= ;;
+    esac
+    test -z "$v" \
+	&& echo "$0: WARNING: $tarball_version_file seems to be damaged" 1>&2
+fi
+
+if test -n "$v"
+then
+    : # use $v
+elif
+       v=`git describe --abbrev=4 --match='osmocon_v*' HEAD 2>/dev/null \
+	  || git describe --abbrev=4 HEAD 2>/dev/null` \
+    && case $v in
+	 osmocon_[0-9]*) ;;
+	 osmocon_v[0-9]*) ;;
+	 *) (exit 1) ;;
+       esac
+then
+    # Is this a new git that lists number of commits since the last
+    # tag or the previous older version that did not?
+    #   Newer: v6.10-77-g0f8faeb
+    #   Older: v6.10-g0f8faeb
+    case $v in
+	*-*-*) : git describe is okay three part flavor ;;
+	*-*)
+	    : git describe is older two part flavor
+	    # Recreate the number of commits and rewrite such that the
+	    # result is the same as if we were using the newer version
+	    # of git describe.
+	    vtag=`echo "$v" | sed 's/-.*//'`
+	    numcommits=`git rev-list "$vtag"..HEAD | wc -l`
+	    v=`echo "$v" | sed "s/\(.*\)-\(.*\)/\1-$numcommits-\2/"`;
+	    ;;
+    esac
+
+    # Change the first '-' to a '.', so version-comparing tools work properly.
+    # Remove the "g" in git describe's output string, to save a byte.
+    v=`echo "$v" | sed 's/-/./;s/\(.*\)-g/\1-/;s/^osmocon_//'`;
+else
+    v="UNKNOWN"
+fi
+
+v=`echo "$v" |sed 's/^v//'`
+
+# Don't declare a version "dirty" merely because a time stamp has changed.
+git status > /dev/null 2>&1
+
+dirty=`sh -c 'git diff-index --name-only HEAD' 2>/dev/null` || dirty=
+case "$dirty" in
+    '') ;;
+    *) # Append the suffix only if there isn't one already.
+	case $v in
+	  *-dirty) ;;
+	  *) v="$v-dirty" ;;
+	esac ;;
+esac
+
+# Omit the trailing newline, so that m4_esyscmd can use the result directly.
+echo "$v" | tr -d '\012'
+
+# Local variables:
+# eval: (add-hook 'write-file-hooks 'time-stamp)
+# time-stamp-start: "scriptversion="
+# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-end: "$"
+# End:
diff --git a/src/host/gsmmap/gsmmap.c b/src/host/gsmmap/gsmmap.c
new file mode 100644
index 00000000..83f0d01c
--- /dev/null
+++ b/src/host/gsmmap/gsmmap.c
@@ -0,0 +1,658 @@
+/* Conversion of logged cells to KML file */
+
+/* (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+#warning todo bsic
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <math.h>
+#include <time.h>
+
+#define GSM_TA_M 553.85
+#define PI 3.1415926536
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/networks.h>
+#include <osmocom/bb/common/logging.h>
+
+#include "log.h"
+#include "geo.h"
+#include "locate.h"
+
+/*
+ * structure of power and cell infos
+ */
+
+struct power power;
+struct sysinfo sysinfo;
+static struct node_power *node_power_first = NULL;
+static struct node_power **node_power_last_p = &node_power_first;
+struct node_mcc *node_mcc_first = NULL;
+int log_lines = 0, log_debug = 0;
+
+
+static void nomem(void)
+{
+	fprintf(stderr, "No mem!\n");
+	exit(-ENOMEM);
+}
+
+static void add_power()
+{
+	struct node_power *node_power;
+
+//	printf("New Power\n");
+	/* append or insert to list */
+	node_power = calloc(1, sizeof(struct node_power));
+	if (!node_power)
+		nomem();
+	*node_power_last_p = node_power;
+	node_power_last_p = &node_power->next;
+	memcpy(&node_power->power, &power, sizeof(power));
+}
+
+static void print_si(void *priv, const char *fmt, ...)
+{
+	char buffer[1000];
+	FILE *outfp = (FILE *)priv;
+	va_list args;
+
+	va_start(args, fmt);
+	vsnprintf(buffer, sizeof(buffer) - 1, fmt, args);
+	buffer[sizeof(buffer) - 1] = '\0';
+	va_end(args);
+
+	if (buffer[0])
+		fprintf(outfp, "%s", buffer);
+}
+
+static void add_sysinfo()
+{
+	struct gsm48_sysinfo s;
+	struct node_mcc *mcc;
+	struct node_mnc *mnc;
+	struct node_lac *lac;
+	struct node_cell *cell;
+	struct node_meas *meas;
+
+	memset(&s, 0, sizeof(s));
+
+	/* decode sysinfo */
+	if (sysinfo.si1[2])
+		gsm48_decode_sysinfo1(&s,
+			(struct gsm48_system_information_type_1 *) sysinfo.si1,
+			23);
+	if (sysinfo.si2[2])
+		gsm48_decode_sysinfo2(&s,
+			(struct gsm48_system_information_type_2 *) sysinfo.si2,
+			23);
+	if (sysinfo.si2bis[2])
+		gsm48_decode_sysinfo2bis(&s,
+			(struct gsm48_system_information_type_2bis *)
+				sysinfo.si2bis,
+			23);
+	if (sysinfo.si2ter[2])
+		gsm48_decode_sysinfo2ter(&s,
+			(struct gsm48_system_information_type_2ter *)
+				sysinfo.si2ter,
+			23);
+	if (sysinfo.si3[2])
+		gsm48_decode_sysinfo3(&s,
+			(struct gsm48_system_information_type_3 *) sysinfo.si3,
+			23);
+	if (sysinfo.si4[2])
+		gsm48_decode_sysinfo4(&s,
+			(struct gsm48_system_information_type_4 *) sysinfo.si4,
+			23);
+	printf("--------------------------------------------------------------------------\n");
+	gsm48_sysinfo_dump(&s, sysinfo.arfcn, print_si, stdout, NULL);
+	mcc = get_node_mcc(s.mcc);
+	if (!mcc)
+		nomem();
+	mnc = get_node_mnc(mcc, s.mnc);
+	if (!mnc)
+		nomem();
+	lac = get_node_lac(mnc, s.lac);
+	if (!lac)
+		nomem();
+	cell = get_node_cell(lac, s.cell_id);
+	if (!cell)
+		nomem();
+	meas = add_node_meas(cell);
+	if (!meas)
+		nomem();
+	if (!cell->content) {
+		cell->content = 1;
+		memcpy(&cell->sysinfo, &sysinfo, sizeof(sysinfo));
+		memcpy(&cell->s, &s, sizeof(s));
+	} else {
+		if (memcmp(&cell->sysinfo.si1, sysinfo.si1,
+			sizeof(sysinfo.si1))) {
+new_sysinfo:
+			fprintf(stderr, "FIXME: the cell changed sysinfo\n");
+			return;
+		}
+		if (memcmp(&cell->sysinfo.si2, sysinfo.si2,
+			sizeof(sysinfo.si2)))
+			goto new_sysinfo;
+		if (memcmp(&cell->sysinfo.si2bis, sysinfo.si2bis,
+			sizeof(sysinfo.si2bis)))
+			goto new_sysinfo;
+		if (memcmp(&cell->sysinfo.si2ter, sysinfo.si2ter,
+			sizeof(sysinfo.si2ter)))
+			goto new_sysinfo;
+		if (memcmp(&cell->sysinfo.si3, sysinfo.si3,
+			sizeof(sysinfo.si3)))
+			goto new_sysinfo;
+		if (memcmp(&cell->sysinfo.si4, sysinfo.si4,
+			sizeof(sysinfo.si4)))
+			goto new_sysinfo;
+	}
+}
+
+void kml_header(FILE *outfp, char *name)
+{
+	/* XML header */
+	fprintf(outfp, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
+
+	/* KML open tag */
+	fprintf(outfp, "<kml xmlns=\"http://www.opengis.net/kml/2.2\" "
+		"xmlns:gx=\"http://www.google.com/kml/ext/2.2\" "
+		"xmlns:kml=\"http://www.opengis.net/kml/2.2\" "
+		"xmlns:atom=\"http://www.w3.org/2005/Atom\">\n");
+
+	/* document open tag */
+	fprintf(outfp, "<Document>\n");
+
+	/* pushpin */
+	fprintf(outfp, "\t<Style id=\"sn_placemark_red_pushpin\">\n");
+	fprintf(outfp, "\t\t<IconStyle>\n");
+	fprintf(outfp, "\t\t\t<scale>1.1</scale>\n");
+	fprintf(outfp, "\t\t\t<Icon>\n");
+	fprintf(outfp, "\t\t\t\t<href>http://maps.google.com/mapfiles/kml/"
+		"pushpin/red-pushpin.png</href>\n");
+	fprintf(outfp, "\t\t\t</Icon>\n");
+	fprintf(outfp, "\t\t</IconStyle>\n");
+	fprintf(outfp, "\t\t<ListStyle>\n");
+	fprintf(outfp, "\t\t</ListStyle>\n");
+	fprintf(outfp, "\t</Style>\n");
+	fprintf(outfp, "\t<Style id=\"sh_placemark_red_pushpin_highlight\">\n");
+	fprintf(outfp, "\t\t<IconStyle>\n");
+	fprintf(outfp, "\t\t\t<scale>1.3</scale>\n");
+	fprintf(outfp, "\t\t\t<Icon>\n");
+	fprintf(outfp, "\t\t\t\t<href>http://maps.google.com/mapfiles/kml/"
+		"pushpin/red-pushpin.png</href>\n");
+	fprintf(outfp, "\t\t\t</Icon>\n");
+	fprintf(outfp, "\t\t</IconStyle>\n");
+	fprintf(outfp, "\t\t<ListStyle>\n");
+	fprintf(outfp, "\t\t</ListStyle>\n");
+	fprintf(outfp, "\t</Style>\n");
+	fprintf(outfp, "\t<StyleMap id=\"msn_placemark_red_pushpin\">\n");
+	fprintf(outfp, "\t\t<Pair>\n");
+	fprintf(outfp, "\t\t\t<key>normal</key>\n");
+	fprintf(outfp, "\t\t\t<styleUrl>#sn_placemark_red_pushpin"
+		"</styleUrl>\n");
+	fprintf(outfp, "\t\t</Pair>\n");
+	fprintf(outfp, "\t\t<Pair>\n");
+	fprintf(outfp, "\t\t\t<key>highlight</key>\n");
+	fprintf(outfp, "\t\t\t<styleUrl>#sh_placemark_red_pushpin_highlight"
+		"</styleUrl>\n");
+	fprintf(outfp, "\t\t</Pair>\n");
+	fprintf(outfp, "\t</StyleMap>\n");
+
+	fprintf(outfp, "\t<Style id=\"sn_placemark_grn_pushpin\">\n");
+	fprintf(outfp, "\t\t<IconStyle>\n");
+	fprintf(outfp, "\t\t\t<scale>1.1</scale>\n");
+	fprintf(outfp, "\t\t\t<Icon>\n");
+	fprintf(outfp, "\t\t\t\t<href>http://maps.google.com/mapfiles/kml/"
+		"pushpin/grn-pushpin.png</href>\n");
+	fprintf(outfp, "\t\t\t</Icon>\n");
+	fprintf(outfp, "\t\t</IconStyle>\n");
+	fprintf(outfp, "\t\t<ListStyle>\n");
+	fprintf(outfp, "\t\t</ListStyle>\n");
+	fprintf(outfp, "\t</Style>\n");
+	fprintf(outfp, "\t<Style id=\"sh_placemark_grn_pushpin_highlight\">\n");
+	fprintf(outfp, "\t\t<IconStyle>\n");
+	fprintf(outfp, "\t\t\t<scale>1.3</scale>\n");
+	fprintf(outfp, "\t\t\t<Icon>\n");
+	fprintf(outfp, "\t\t\t\t<href>http://maps.google.com/mapfiles/kml/"
+		"pushpin/grn-pushpin.png</href>\n");
+	fprintf(outfp, "\t\t\t</Icon>\n");
+	fprintf(outfp, "\t\t</IconStyle>\n");
+	fprintf(outfp, "\t\t<ListStyle>\n");
+	fprintf(outfp, "\t\t</ListStyle>\n");
+	fprintf(outfp, "\t</Style>\n");
+	fprintf(outfp, "\t<StyleMap id=\"msn_placemark_grn_pushpin\">\n");
+	fprintf(outfp, "\t\t<Pair>\n");
+	fprintf(outfp, "\t\t\t<key>normal</key>\n");
+	fprintf(outfp, "\t\t\t<styleUrl>#sn_placemark_grn_pushpin"
+		"</styleUrl>\n");
+	fprintf(outfp, "\t\t</Pair>\n");
+	fprintf(outfp, "\t\t<Pair>\n");
+	fprintf(outfp, "\t\t\t<key>highlight</key>\n");
+	fprintf(outfp, "\t\t\t<styleUrl>#sh_placemark_grn_pushpin_highlight"
+		"</styleUrl>\n");
+	fprintf(outfp, "\t\t</Pair>\n");
+	fprintf(outfp, "\t</StyleMap>\n");
+
+	/* circle */
+	fprintf(outfp, "\t<Style id=\"sn_placemark_circle\">\n");
+	fprintf(outfp, "\t\t<IconStyle>\n");
+	fprintf(outfp, "\t\t\t<scale>1.0</scale>\n");
+	fprintf(outfp, "\t\t\t<Icon>\n");
+	fprintf(outfp, "\t\t\t\t<href>http://maps.google.com/mapfiles/kml/"
+		"shapes/placemark_circle.png</href>\n");
+	fprintf(outfp, "\t\t\t</Icon>\n");
+	fprintf(outfp, "\t\t</IconStyle>\n");
+	fprintf(outfp, "\t\t<ListStyle>\n");
+	fprintf(outfp, "\t\t</ListStyle>\n");
+	fprintf(outfp, "\t</Style>\n");
+	fprintf(outfp, "\t<Style id=\"sh_placemark_circle_highlight\">\n");
+	fprintf(outfp, "\t\t<IconStyle>\n");
+	fprintf(outfp, "\t\t\t<scale>1.2</scale>\n");
+	fprintf(outfp, "\t\t\t<Icon>\n");
+	fprintf(outfp, "\t\t\t\t<href>http://maps.google.com/mapfiles/kml/"
+		"shapes/placemark_circle_highlight.png</href>\n");
+	fprintf(outfp, "\t\t\t</Icon>\n");
+	fprintf(outfp, "\t\t</IconStyle>\n");
+	fprintf(outfp, "\t\t<ListStyle>\n");
+	fprintf(outfp, "\t\t</ListStyle>\n");
+	fprintf(outfp, "\t</Style>\n");
+	fprintf(outfp, "\t<StyleMap id=\"msn_placemark_circle\">\n");
+	fprintf(outfp, "\t\t<Pair>\n");
+	fprintf(outfp, "\t\t\t<key>normal</key>\n");
+	fprintf(outfp, "\t\t\t<styleUrl>#sn_placemark_circle</styleUrl>\n");
+	fprintf(outfp, "\t\t</Pair>\n");
+	fprintf(outfp, "\t\t<Pair>\n");
+	fprintf(outfp, "\t\t\t<key>highlight</key>\n");
+	fprintf(outfp, "\t\t\t<styleUrl>#sh_placemark_circle_highlight"
+		"</styleUrl>\n");
+	fprintf(outfp, "\t\t</Pair>\n");
+	fprintf(outfp, "\t</StyleMap>\n");
+}
+
+void kml_footer(FILE *outfp)
+{
+	/* document close tag */
+	fprintf(outfp, "</Document>\n");
+
+	/* KML close tag */
+	fprintf(outfp, "</kml>\n");
+
+}
+
+void kml_meas(FILE *outfp, struct node_meas *meas, int n, uint16_t mcc,
+	uint16_t mnc, uint16_t lac, uint16_t cellid)
+{
+	struct tm *tm = localtime(&meas->gmt);
+
+	fprintf(outfp, "\t\t\t\t\t<Placemark>\n");
+	fprintf(outfp, "\t\t\t\t\t\t<name>%d: %d</name>\n", n, meas->rxlev);
+	fprintf(outfp, "\t\t\t\t\t\t<description>\n");
+	fprintf(outfp, "MCC=%s MNC=%s\nLAC=%04x CELL-ID=%04x\n(%s %s)\n",
+		gsm_print_mcc(mcc), gsm_print_mnc(mnc), lac, cellid,
+		gsm_get_mcc(mcc), gsm_get_mnc(mcc, mnc));
+	fprintf(outfp, "\n%s", asctime(tm));
+	fprintf(outfp, "RX-LEV %d dBm\n", meas->rxlev);
+	if (meas->ta_valid)
+		fprintf(outfp, "TA=%d (%d-%d meter)\n", meas->ta,
+			(int)(GSM_TA_M * meas->ta),
+			(int)(GSM_TA_M * (meas->ta + 1)));
+	fprintf(outfp, "\t\t\t\t\t\t</description>\n");
+	fprintf(outfp, "\t\t\t\t\t\t<LookAt>\n");
+	fprintf(outfp, "\t\t\t\t\t\t\t<longitude>%.8f</longitude>\n",
+		meas->longitude);
+	fprintf(outfp, "\t\t\t\t\t\t\t<latitude>%.8f</latitude>\n",
+		meas->latitude);
+	fprintf(outfp, "\t\t\t\t\t\t\t<altitude>0</altitude>\n");
+	fprintf(outfp, "\t\t\t\t\t\t\t<tilt>0</tilt>\n");
+	fprintf(outfp, "\t\t\t\t\t\t\t<altitudeMode>relativeToGround"
+		"</altitudeMode>\n");
+	fprintf(outfp, "\t\t\t\t\t\t\t<gx:altitudeMode>relativeToSeaFloor"
+		"</gx:altitudeMode>\n");
+	fprintf(outfp, "\t\t\t\t\t\t</LookAt>\n");
+	fprintf(outfp, "\t\t\t\t\t\t<styleUrl>#msn_placemark_circle"
+		"</styleUrl>\n");
+	fprintf(outfp, "\t\t\t\t\t\t<Point>\n");
+	fprintf(outfp, "\t\t\t\t\t\t\t<coordinates>%.8f,%.8f</coordinates>\n",
+		meas->longitude, meas->latitude);
+	fprintf(outfp, "\t\t\t\t\t\t</Point>\n");
+	fprintf(outfp, "\t\t\t\t\t</Placemark>\n");
+}
+
+double debug_long, debug_lat, debug_x_scale;
+FILE *debug_fp;
+
+void kml_cell(FILE *outfp, struct node_cell *cell)
+{
+	struct node_meas *meas;
+	double x, y, z, sum_x = 0, sum_y = 0, sum_z = 0, longitude, latitude;
+	int n, known = 0;
+
+	meas = cell->meas;
+	n = 0;
+	while (meas) {
+		if (meas->gps_valid && meas->ta_valid) {
+			geo2space(&x, &y, &z, meas->longitude, meas->latitude);
+			sum_x += x;
+			sum_y += y;
+			sum_z += z;
+			n++;
+		}
+		meas = meas->next;
+	}
+	if (!n)
+		return;
+	if (n < 3) {
+		x = sum_x / n;
+		y = sum_y / n;
+		z = sum_z / n;
+		space2geo(&longitude, &latitude, x, y, z);
+	} else {
+		struct probe *probe_first = NULL, *probe,
+			     **probe_last_p = &probe_first;
+		double x_scale;
+
+		/* translate to flat surface */
+		meas = cell->meas;
+		x_scale = 1.0 / cos(meas->latitude / 180.0 * PI);
+		longitude = meas->longitude;
+		latitude = meas->latitude;
+		debug_x_scale = x_scale;
+		debug_long = longitude;
+		debug_lat = latitude;
+		debug_fp = outfp;
+		while (meas) {
+			if (meas->gps_valid && meas->ta_valid) {
+				probe = calloc(1, sizeof(struct probe));
+				if (!probe)
+					nomem();
+				probe->x = (meas->longitude - longitude) /
+						x_scale;
+				if (x < -180)
+					x += 360;
+				else if (x > 180)
+					x -= 360;
+				probe->y = meas->latitude - latitude;
+				probe->dist = GSM_TA_M * (0.5 +
+					(double)meas->ta) /
+					(EQUATOR_RADIUS * PI / 180.0);
+				*probe_last_p = probe;
+				probe_last_p = &probe->next;
+			}
+			meas = meas->next;
+		}
+
+		/* locate */
+		locate_cell(probe_first, &x, &y);
+
+		/* translate from flat surface */
+		longitude += x * x_scale;
+		if (longitude < 0)
+			longitude += 360;
+		else if (longitude >= 360)
+			longitude -= 360;
+		latitude += y;
+
+		/* remove probes */
+		while (probe_first) {
+			probe = probe_first;
+			probe_first = probe->next;
+			free(probe);
+		}
+
+		known = 1;
+	}
+
+	if (!known)
+		return;
+
+	fprintf(outfp, "\t\t\t\t\t<Placemark>\n");
+	fprintf(outfp, "\t\t\t\t\t\t<name>MCC=%s MNC=%s\nLAC=%04x "
+		"CELL-ID=%04x\n(%s %s)</name>\n", gsm_print_mcc(cell->s.mcc),
+		gsm_print_mnc(cell->s.mnc), cell->s.lac, cell->s.cell_id,
+		gsm_get_mcc(cell->s.mcc),
+		gsm_get_mnc(cell->s.mcc, cell->s.mnc));
+	fprintf(outfp, "\t\t\t\t\t\t<description>\n");
+	gsm48_sysinfo_dump(&cell->s, cell->sysinfo.arfcn, print_si, outfp,
+		NULL);
+	fprintf(outfp, "\t\t\t\t\t\t</description>\n");
+	fprintf(outfp, "\t\t\t\t\t\t<LookAt>\n");
+	fprintf(outfp, "\t\t\t\t\t\t\t<longitude>%.8f</longitude>\n",
+		longitude);
+	fprintf(outfp, "\t\t\t\t\t\t\t<latitude>%.8f</latitude>\n", latitude);
+	fprintf(outfp, "\t\t\t\t\t\t\t<altitude>0</altitude>\n");
+	fprintf(outfp, "\t\t\t\t\t\t\t<tilt>0</tilt>\n");
+	fprintf(outfp, "\t\t\t\t\t\t\t<altitudeMode>relativeToGround"
+		"</altitudeMode>\n");
+	fprintf(outfp, "\t\t\t\t\t\t\t<gx:altitudeMode>relativeToSeaFloor"
+		"</gx:altitudeMode>\n");
+	fprintf(outfp, "\t\t\t\t\t\t</LookAt>\n");
+	if (known)
+		fprintf(outfp, "\t\t\t\t\t\t<styleUrl>#msn_placemark_grn_"
+			"pushpin</styleUrl>\n");
+	else
+		fprintf(outfp, "\t\t\t\t\t\t<styleUrl>#msn_placemark_red_"
+			"pushpin</styleUrl>\n");
+	fprintf(outfp, "\t\t\t\t\t\t<Point>\n");
+	fprintf(outfp, "\t\t\t\t\t\t\t<coordinates>%.8f,%.8f</coordinates>\n",
+		longitude, latitude);
+	fprintf(outfp, "\t\t\t\t\t\t</Point>\n");
+	fprintf(outfp, "\t\t\t\t\t</Placemark>\n");
+
+	if (!log_lines)
+		return;
+
+	fprintf(outfp, "\t<Folder>\n");
+	fprintf(outfp, "\t\t<name>Lines</name>\n");
+	fprintf(outfp, "\t\t<open>0</open>\n");
+	fprintf(outfp, "\t\t<visibility>0</visibility>\n");
+
+	geo2space(&x, &y, &z, longitude, latitude);
+	meas = cell->meas;
+	n = 0;
+	while (meas) {
+		if (meas->gps_valid) {
+			double mx, my, mz, dist;
+
+			geo2space(&mx, &my, &mz, meas->longitude,
+				meas->latitude);
+			dist = distinspace(x, y, z, mx, my, mz);
+			fprintf(outfp, "\t\t<Placemark>\n");
+			fprintf(outfp, "\t\t\t<name>Range</name>\n");
+			fprintf(outfp, "\t\t\t<description>\n");
+			fprintf(outfp, "Distance: %d\n", (int)dist);
+			fprintf(outfp, "TA=%d (%d-%d meter)\n", meas->ta,
+				(int)(GSM_TA_M * meas->ta),
+				(int)(GSM_TA_M * (meas->ta + 1)));
+			fprintf(outfp, "\t\t\t</description>\n");
+			fprintf(outfp, "\t\t\t<visibility>0</visibility>\n");
+			fprintf(outfp, "\t\t\t<LineString>\n");
+			fprintf(outfp, "\t\t\t\t<tessellate>1</tessellate>\n");
+			fprintf(outfp, "\t\t\t\t<coordinates>\n");
+			fprintf(outfp, "%.8f,%.8f\n", longitude, latitude);
+			fprintf(outfp, "%.8f,%.8f\n", meas->longitude,
+				meas->latitude);
+			fprintf(outfp, "\t\t\t\t</coordinates>\n");
+			fprintf(outfp, "\t\t\t</LineString>\n");
+			fprintf(outfp, "\t\t</Placemark>\n");
+		}
+		meas = meas->next;
+	}
+	fprintf(outfp, "\t</Folder>\n");
+}
+
+struct log_target *stderr_target;
+
+int main(int argc, char *argv[])
+{
+	FILE *infp, *outfp;
+	int type, n, i;
+	char *p;
+	struct node_mcc *mcc;
+	struct node_mnc *mnc;
+	struct node_lac *lac;
+	struct node_cell *cell;
+	struct node_meas *meas;
+
+	log_init(&log_info, NULL);
+	stderr_target = log_target_create_stderr();
+	log_add_target(stderr_target);
+	log_set_all_filter(stderr_target, 1);
+	log_parse_category_mask(stderr_target, "Dxxx");
+	log_set_log_level(stderr_target, LOGL_INFO);
+
+	if (argc <= 2) {
+usage:
+		fprintf(stderr, "Usage: %s <file.log> <file.kml> "
+			"[lines] [debug]\n", argv[0]);
+		fprintf(stderr, "lines: Add lines between cell and "
+			"Measurement point\n");
+		fprintf(stderr, "debug: Add debugging of location algorithm.\n"
+			);
+		return 0;
+	}
+
+	for (i = 3; i < argc; i++) {
+		if (!strcmp(argv[i], "lines"))
+			log_lines = 1;
+		else if (!strcmp(argv[i], "debug"))
+			log_debug = 1;
+		else goto usage;
+	}
+
+	infp = fopen(argv[1], "r");
+	if (!infp) {
+		fprintf(stderr, "Failed to open '%s' for reading\n", argv[1]);
+		return -EIO;
+	}
+
+	while ((type = read_log(infp))) {
+		switch (type) {
+		case LOG_TYPE_SYSINFO:
+			add_sysinfo();
+			break;
+		case LOG_TYPE_POWER:
+			add_power();
+			break;
+		}
+	}
+
+	fclose(infp);
+
+	if (!strcmp(argv[2], "-"))
+		outfp = stdout;
+	else
+		outfp = fopen(argv[2], "w");
+	if (!outfp) {
+		fprintf(stderr, "Failed to open '%s' for writing\n", argv[2]);
+		return -EIO;
+	}
+
+	/* document name */
+	p = argv[2];
+	while (strchr(p, '/'))
+		p = strchr(p, '/') + 1;
+
+	kml_header(outfp, p);
+	mcc = node_mcc_first;
+	while (mcc) {
+	  printf("MCC: %02x\n", mcc->mcc);
+	 /* folder open */
+	  fprintf(outfp, "\t<Folder>\n");
+	  fprintf(outfp, "\t\t<name>MCC %s (%s)</name>\n",
+		gsm_print_mcc(mcc->mcc), gsm_get_mcc(mcc->mcc));
+	  fprintf(outfp, "\t\t<open>0</open>\n");
+	  mnc = mcc->mnc;
+	  while (mnc) {
+	    printf(" MNC: %02x\n", mnc->mnc);
+	    /* folder open */
+	    fprintf(outfp, "\t\t<Folder>\n");
+	    fprintf(outfp, "\t\t\t<name>MNC %s (%s)</name>\n",
+	    	gsm_print_mnc(mnc->mnc), gsm_get_mnc(mcc->mcc, mnc->mnc));
+	    fprintf(outfp, "\t\t\t<open>0</open>\n");
+	    lac = mnc->lac;
+	    while (lac) {
+	      printf("  LAC: %04x\n", lac->lac);
+	      /* folder open */
+	      fprintf(outfp, "\t\t\t<Folder>\n");
+	      fprintf(outfp, "\t\t\t\t<name>LAC %04x</name>\n", lac->lac);
+	      fprintf(outfp, "\t\t\t\t<open>0</open>\n");
+	      cell = lac->cell;
+	      while (cell) {
+		printf("   CELL: %04x\n", cell->cellid);
+		fprintf(outfp, "\t\t\t\t<Folder>\n");
+		fprintf(outfp, "\t\t\t\t\t<name>CELL-ID %04x</name>\n", cell->cellid);
+		fprintf(outfp, "\t\t\t\t\t<open>0</open>\n");
+		meas = cell->meas;
+		n = 0;
+		while (meas) {
+			if (meas->ta_valid)
+				printf("    TA: %d\n", meas->ta);
+			if (meas->gps_valid)
+				kml_meas(outfp, meas, ++n, mcc->mcc, mnc->mnc,
+					lac->lac, cell->cellid);
+			meas = meas->next;
+		}
+		kml_cell(outfp, cell);
+		/* folder close */
+		fprintf(outfp, "\t\t\t\t</Folder>\n");
+		cell = cell->next;
+	      }
+	      /* folder close */
+	      fprintf(outfp, "\t\t\t</Folder>\n");
+	      lac = lac->next;
+	    }
+	    /* folder close */
+	    fprintf(outfp, "\t\t</Folder>\n");
+	    mnc = mnc->next;
+	  }
+	  /* folder close */
+	  fprintf(outfp, "\t</Folder>\n");
+	  mcc = mcc->next;
+	}
+#if 0
+	FIXME: power
+	/* folder open */
+	fprintf(outfp, "\t<Folder>\n");
+	fprintf(outfp, "\t\t<name>Power</name>\n");
+	fprintf(outfp, "\t\t<open>0</open>\n");
+	power = node_power_first;
+	n = 0;
+	while (power) {
+		/* folder open */
+		fprintf(outfp, "\t\t<Folder>\n");
+		fprintf(outfp, "\t\t\t<name>Power %d</name>\n", ++n);
+		fprintf(outfp, "\t\t\t<open>0</open>\n");
+		/* folder close */
+		fprintf(outfp, "\t\t</Folder>\n");
+		power = power->next;
+	}
+	/* folder close */
+	fprintf(outfp, "\t</Folder>\n");
+#endif
+	kml_footer(outfp);
+
+	fclose(outfp);
+
+	return 0;
+}
diff --git a/src/host/gsmmap/locate.c b/src/host/gsmmap/locate.c
new file mode 100644
index 00000000..ed0ac931
--- /dev/null
+++ b/src/host/gsmmap/locate.c
@@ -0,0 +1,182 @@
+/* Algorithm to locate a destination by distance measurement:
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <math.h>
+
+#include "geo.h"
+#include "locate.h"
+
+#define CIRCLE_PROBE	30.0
+#define FINETUNE_RADIUS	5.0
+
+extern double debug_long, debug_lat, debug_x_scale;
+extern FILE *debug_fp;
+extern int log_debug;
+
+static double finetune_x[6], finetune_y[6], finetune_dist[6];
+
+int locate_cell(struct probe *probe_first, double *min_x, double *min_y)
+{
+	struct probe *probe, *min_probe;
+	int i, test_steps, optimized;
+	double min_dist, dist, x, y, rad, temp;
+	double circle_probe, finetune_radius;
+
+	/* convert meters into degrees */
+	circle_probe = CIRCLE_PROBE / (EQUATOR_RADIUS * PI / 180.0);
+	finetune_radius = FINETUNE_RADIUS / (EQUATOR_RADIUS * PI / 180.0);
+
+	if (log_debug) {
+		fprintf(debug_fp, "<Folder>\n");
+		fprintf(debug_fp, "\t<name>Debug Locator</name>\n");
+		fprintf(debug_fp, "\t<open>0</open>\n");
+		fprintf(debug_fp, "\t<visibility>0</visibility>\n");
+	}
+
+	/* get probe of minimum distance */
+	min_probe = NULL;
+	probe = probe_first;
+	min_dist = 42;
+	i = 0;
+	while (probe) {
+		if (log_debug) {
+			fprintf(debug_fp, "\t<Placemark>\n");
+			fprintf(debug_fp, "\t\t<name>MEAS</name>\n");
+			fprintf(debug_fp, "\t\t<visibility>0</visibility>\n");
+			fprintf(debug_fp, "\t\t<LineString>\n");
+			fprintf(debug_fp, "\t\t\t<tessellate>1</tessellate>\n");
+			fprintf(debug_fp, "\t\t\t<coordinates>\n");
+			rad = 2.0 * 3.1415927 / 35;
+			for (i = 0; i < 35; i++) {
+				x = probe->x + probe->dist * sin(rad * i);
+				y = probe->y + probe->dist * cos(rad * i);
+				fprintf(debug_fp, "%.8f,%.8f\n", debug_long +
+					x * debug_x_scale, debug_lat + y);
+			}
+			fprintf(debug_fp, "\t\t\t</coordinates>\n");
+			fprintf(debug_fp, "\t\t</LineString>\n");
+			fprintf(debug_fp, "\t</Placemark>\n");
+		}
+
+		if (!min_probe || probe->dist < min_dist) {
+			min_probe = probe;
+			min_dist = probe->dist;
+		}
+		probe = probe->next;
+		i++;
+	}
+
+	if (i < 3) {
+		fprintf(stderr, "Need at least 3 points\n");
+		return -EINVAL;
+	}
+
+	/* calculate the number of steps to search for destination point */
+	test_steps = 2.0 * 3.1415927 * min_probe->dist / circle_probe;
+	rad = 2.0 * 3.1415927 / test_steps;
+
+	if (log_debug) {
+		fprintf(debug_fp, "\t<Placemark>\n");
+		fprintf(debug_fp, "\t\t<name>Smallest MEAS</name>\n");
+		fprintf(debug_fp, "\t\t<visibility>0</visibility>\n");
+		fprintf(debug_fp, "\t\t<LineString>\n");
+		fprintf(debug_fp, "\t\t\t<tessellate>1</tessellate>\n");
+		fprintf(debug_fp, "\t\t\t<coordinates>\n");
+	}
+
+	/* search on a circle for the location of the lowest distance
+	 * to the radius with the greatest distance */
+	min_dist = 42;
+	*min_x = *min_y = 42;
+	for (i = 0; i < test_steps; i++) {
+		x = min_probe->x + min_probe->dist * sin(rad * i);
+		y = min_probe->y + min_probe->dist * cos(rad * i);
+		if (log_debug)
+			fprintf(debug_fp, "%.8f,%.8f\n", debug_long +
+				x * debug_x_scale, debug_lat + y);
+		/* look for greatest distance */
+		dist = 0;
+		probe = probe_first;
+		while (probe) {
+			if (probe != min_probe) {
+				/* distance to the radius */
+				temp = distonplane(probe->x, probe->y, x, y);
+				temp -= probe->dist;
+				if (temp < 0)
+					temp = -temp;
+				if (temp > dist)
+					dist = temp;
+			}
+			probe = probe->next;
+		}
+		if (i == 0 || dist < min_dist) {
+			min_dist = dist;
+			*min_x = x;
+			*min_y = y;
+		}
+	}
+
+	if (log_debug) {
+		fprintf(debug_fp, "\t\t\t</coordinates>\n");
+		fprintf(debug_fp, "\t\t</LineString>\n");
+		fprintf(debug_fp, "\t</Placemark>\n");
+
+		fprintf(debug_fp, "\t<Placemark>\n");
+		fprintf(debug_fp, "\t\t<name>Finetune</name>\n");
+		fprintf(debug_fp, "\t\t<visibility>0</visibility>\n");
+		fprintf(debug_fp, "\t\t<LineString>\n");
+		fprintf(debug_fp, "\t\t\t<tessellate>1</tessellate>\n");
+		fprintf(debug_fp, "\t\t\t<coordinates>\n");
+	}
+
+	min_dist = 9999999999.0;
+tune_again:
+	if (log_debug)
+		fprintf(debug_fp, "%.8f,%.8f\n", debug_long +
+			*min_x * debug_x_scale, debug_lat + *min_y);
+
+	/* finetune the point */
+	rad = 2.0 * 3.1415927 / 6;
+	for (i = 0; i < 6; i++) {
+		x = *min_x + finetune_radius * sin(rad * i);
+		y = *min_y + finetune_radius * cos(rad * i);
+		/* search for the point with the lowest sum of distances */
+		dist = 0;
+		probe = probe_first;
+		while (probe) {
+			/* distance to the radius */
+			temp = distonplane(probe->x, probe->y, x, y);
+			temp -= probe->dist;
+			if (temp < 0)
+				temp = -temp;
+			dist += temp;
+			probe = probe->next;
+		}
+		finetune_dist[i] = dist;
+		finetune_x[i] = x;
+		finetune_y[i] = y;
+	}
+
+	optimized = 0;
+	for (i = 0; i < 6; i++) {
+		if (finetune_dist[i] < min_dist) {
+			min_dist = finetune_dist[i];
+			*min_x = finetune_x[i];
+			*min_y = finetune_y[i];
+			optimized = 1;
+		}
+	}
+	if (optimized)
+		goto tune_again;
+
+	if (log_debug) {
+		fprintf(debug_fp, "\t\t\t</coordinates>\n");
+		fprintf(debug_fp, "\t\t</LineString>\n");
+		fprintf(debug_fp, "\t</Placemark>\n");
+		fprintf(debug_fp, "</Folder>\n");
+	}
+
+	return 0;
+}
diff --git a/src/host/gsmmap/locate.h b/src/host/gsmmap/locate.h
new file mode 100644
index 00000000..26133452
--- /dev/null
+++ b/src/host/gsmmap/locate.h
@@ -0,0 +1,8 @@
+
+struct probe {
+	struct probe *next;
+	double x, y, dist;
+};
+
+int locate_cell(struct probe *probe_first, double *min_x, double *min_y);
+
diff --git a/src/host/gsmmap/log.c b/src/host/gsmmap/log.c
new file mode 100644
index 00000000..c2db801e
--- /dev/null
+++ b/src/host/gsmmap/log.c
@@ -0,0 +1,377 @@
+/* Conversion of logged cells to KML file */
+
+/* (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+
+#include "log.h"
+
+extern struct power power;
+extern struct sysinfo sysinfo;
+extern struct node_power *node_power_first;
+extern struct node_power **node_power_last_p;
+extern struct node_mcc *node_mcc_first;
+
+struct node_mcc *get_node_mcc(uint16_t mcc)
+{
+	struct node_mcc *node_mcc;
+	struct node_mcc **node_mcc_p = &node_mcc_first;
+
+//printf("add mcc %d\n", mcc);
+	while (*node_mcc_p) {
+		/* found in list */
+		if ((*node_mcc_p)->mcc == mcc)
+			return *node_mcc_p;
+		/* insert into list */
+		if ((*node_mcc_p)->mcc > mcc)
+			break;
+		node_mcc_p = &((*node_mcc_p)->next);
+	}
+
+//printf("new mcc %d\n", mcc);
+	/* append or insert to list */
+	node_mcc = calloc(1, sizeof(struct node_mcc));
+	if (!node_mcc)
+		return NULL;
+	node_mcc->mcc = mcc;
+	node_mcc->next = *node_mcc_p;
+	*node_mcc_p = node_mcc;
+	return node_mcc;
+}
+
+struct node_mnc *get_node_mnc(struct node_mcc *mcc, uint16_t mnc)
+{
+	struct node_mnc *node_mnc;
+	struct node_mnc **node_mnc_p = &mcc->mnc;
+
+	while (*node_mnc_p) {
+		/* found in list */
+		if ((*node_mnc_p)->mnc == mnc)
+			return *node_mnc_p;
+		/* insert into list */
+		if ((*node_mnc_p)->mnc > mnc)
+			break;
+		node_mnc_p = &((*node_mnc_p)->next);
+	}
+
+	/* append or insert to list */
+	node_mnc = calloc(1, sizeof(struct node_mnc));
+	if (!node_mnc)
+		return NULL;
+	node_mnc->mnc = mnc;
+	node_mnc->next = *node_mnc_p;
+	*node_mnc_p = node_mnc;
+	return node_mnc;
+}
+
+struct node_lac *get_node_lac(struct node_mnc *mnc, uint16_t lac)
+{
+	struct node_lac *node_lac;
+	struct node_lac **node_lac_p = &mnc->lac;
+
+	while (*node_lac_p) {
+		/* found in list */
+		if ((*node_lac_p)->lac == lac)
+			return *node_lac_p;
+		/* insert into list */
+		if ((*node_lac_p)->lac > lac)
+			break;
+		node_lac_p = &((*node_lac_p)->next);
+	}
+
+	/* append or insert to list */
+	node_lac = calloc(1, sizeof(struct node_lac));
+	if (!node_lac)
+		return NULL;
+	node_lac->lac = lac;
+	node_lac->next = *node_lac_p;
+	*node_lac_p = node_lac;
+	return node_lac;
+}
+
+struct node_cell *get_node_cell(struct node_lac *lac, uint16_t cellid)
+{
+	struct node_cell *node_cell;
+	struct node_cell **node_cell_p = &lac->cell;
+
+	while (*node_cell_p) {
+		/* found in list */
+		if ((*node_cell_p)->cellid == cellid)
+			return *node_cell_p;
+		/* insert into list */
+		if ((*node_cell_p)->cellid > cellid)
+			break;
+		node_cell_p = &((*node_cell_p)->next);
+	}
+
+	/* append or insert to list */
+	node_cell = calloc(1, sizeof(struct node_cell));
+	if (!node_cell)
+		return NULL;
+	node_cell->meas_last_p = &node_cell->meas;
+	node_cell->cellid = cellid;
+	node_cell->next = *node_cell_p;
+	*node_cell_p = node_cell;
+	return node_cell;
+}
+
+struct node_meas *add_node_meas(struct node_cell *cell)
+{
+	struct node_meas *node_meas;
+
+	/* append to list */
+	node_meas = calloc(1, sizeof(struct node_meas));
+	if (!node_meas)
+		return NULL;
+	node_meas->gmt = sysinfo.gmt;
+	node_meas->rxlev = sysinfo.rxlev;
+	if (sysinfo.ta_valid) {
+		node_meas->ta_valid = 1;
+		node_meas->ta = sysinfo.ta;
+	}
+	if (sysinfo.gps_valid) {
+		node_meas->gps_valid = 1;
+		node_meas->longitude = sysinfo.longitude;
+		node_meas->latitude = sysinfo.latitude;
+	}
+	*cell->meas_last_p = node_meas;
+	cell->meas_last_p = &node_meas->next;
+	return node_meas;
+}
+
+/* read "<ncc>,<bcc>" */
+static void read_log_bsic(char *buffer)
+{
+	char *p;
+	uint8_t bsic;
+
+	/* skip first spaces */
+	while (*buffer == ' ')
+		buffer++;
+
+	/* read ncc */
+	p = buffer;
+	while (*p > ' ' && *p != ',')
+		p++;
+	if (*p == '\0')
+		return; /* no value */
+	*p++ = '\0';
+	bsic = atoi(buffer) << 3;
+	buffer = p;
+
+	/* read latitude */
+	bsic |= atoi(buffer);
+
+	sysinfo.bsic = bsic;
+}
+
+/* read "<longitude> <latitude>" */
+static void read_log_pos(char *buffer, double *longitude, double *latitude,
+	uint8_t *valid)
+{
+	char *p;
+
+	/* skip first spaces */
+	while (*buffer == ' ')
+		buffer++;
+
+	/* read longitude */
+	p = buffer;
+	while (*p > ' ')
+		p++;
+	if (*p == '\0')
+		return; /* no value after longitude */
+	*p++ = '\0';
+	*longitude = atof(buffer);
+	buffer = p;
+
+	/* skip second spaces */
+	while (*buffer == ' ')
+		buffer++;
+
+	/* read latitude */
+	*latitude = atof(buffer);
+
+	*valid = 1;
+}
+
+/* read "<arfcn> <value> <next value> ...." */
+static void read_log_power(char *buffer)
+{
+	char *p;
+	int arfcn;
+
+	/* skip first spaces */
+	while (*buffer == ' ')
+		buffer++;
+
+	/* read arfcn */
+	p = buffer;
+	while (*p > ' ')
+		p++;
+	if (*p == '\0')
+		return; /* no value after arfcn */
+	*p++ = '\0';
+	arfcn = atoi(buffer);
+	buffer = p;
+
+	while (*buffer) {
+		/* wrong arfcn */
+		if (arfcn < 0 || arfcn > 1023)
+			break;
+		/* skip spaces */
+		while (*buffer == ' ')
+			buffer++;
+		/* get value */
+		p = buffer;
+		while (*p > ' ')
+			p++;
+		/* last value */
+		if (*p == '\0') {
+			power.rxlev[arfcn] = atoi(buffer);
+			break;
+		}
+		*p++ = '\0';
+		power.rxlev[arfcn] = atoi(buffer);
+		arfcn++;
+		buffer = p;
+	}
+}
+
+/* read "xx xx xx xx xx...." */
+static void read_log_si(char *buffer, uint8_t *data)
+{
+	uint8_t si[23];
+	int i;
+
+//	printf("%s ", buffer);
+	for (i = 0; i < 23; i++) {
+		while (*buffer == ' ')
+			buffer++;
+		if (*buffer >= '0' && *buffer <= '9')
+			si[i] = (*buffer - '0') << 4;
+		else if (*buffer >= 'a' && *buffer <= 'f')
+			si[i] = (*buffer - 'a' + 10) << 4;
+		else if (*buffer >= 'A' && *buffer <= 'F')
+			si[i] = (*buffer - 'A' + 10) << 4;
+		else
+			break;
+		buffer++;
+		if (*buffer >= '0' && *buffer <= '9')
+			si[i] += *buffer - '0';
+		else if (*buffer >= 'a' && *buffer <= 'f')
+			si[i] += *buffer - 'a' + 10;
+		else if (*buffer >= 'A' && *buffer <= 'F')
+			si[i] += *buffer - 'A' + 10;
+		else
+			break;
+		buffer++;
+//		printf("%02x ", si[i]);
+	}
+//	printf("\n");
+
+	if (i == 23)
+		memcpy(data, si, 23);
+}
+
+/* read next record from log file */
+int read_log(FILE *infp)
+{
+	static int type = LOG_TYPE_NONE, ret;
+	char buffer[256];
+
+	memset(&sysinfo, 0, sizeof(sysinfo));
+	memset(&power, 0, sizeof(power));
+	memset(&power.rxlev, -128, sizeof(power.rxlev));
+
+	if (feof(infp))
+		return LOG_TYPE_NONE;
+
+	while (fgets(buffer, sizeof(buffer), infp)) {
+		buffer[sizeof(buffer) - 1] = 0;
+		if (buffer[0])
+			buffer[strlen(buffer) - 1] = '\0';
+		if (buffer[0] == '[') {
+			if (!strcmp(buffer, "[sysinfo]")) {
+				ret = type;
+				type = LOG_TYPE_SYSINFO;
+				if (ret != LOG_TYPE_NONE)
+					return ret;
+			} else
+			if (!strcmp(buffer, "[power]")) {
+				ret = type;
+				type = LOG_TYPE_POWER;
+				if (ret != LOG_TYPE_NONE)
+					return ret;
+			} else {
+				type = LOG_TYPE_NONE;
+			}
+			continue;
+		}
+		switch (type) {
+		case LOG_TYPE_SYSINFO:
+			if (!strncmp(buffer, "arfcn ", 6))
+				sysinfo.arfcn = atoi(buffer + 6);
+			else if (!strncmp(buffer, "si1 ", 4))
+				read_log_si(buffer + 4, sysinfo.si1);
+			else if (!strncmp(buffer, "si2 ", 4))
+				read_log_si(buffer + 4, sysinfo.si2);
+			else if (!strncmp(buffer, "si2bis ", 7))
+				read_log_si(buffer + 7, sysinfo.si2bis);
+			else if (!strncmp(buffer, "si2ter ", 7))
+				read_log_si(buffer + 7, sysinfo.si2ter);
+			else if (!strncmp(buffer, "si3 ", 4))
+				read_log_si(buffer + 4, sysinfo.si3);
+			else if (!strncmp(buffer, "si4 ", 4))
+				read_log_si(buffer + 4, sysinfo.si4);
+			else if (!strncmp(buffer, "time ", 5))
+				sysinfo.gmt = strtoul(buffer + 5, NULL, 0);
+			else if (!strncmp(buffer, "position ", 9))
+				read_log_pos(buffer + 9, &sysinfo.longitude,
+					&sysinfo.latitude, &sysinfo.gps_valid);
+			else if (!strncmp(buffer, "rxlev ", 5))
+				sysinfo.rxlev =
+					strtoul(buffer + 5, NULL, 0);
+			else if (!strncmp(buffer, "bsic ", 5))
+				read_log_bsic(buffer + 5);
+			else if (!strncmp(buffer, "ta ", 3)) {
+				sysinfo.ta_valid = 1;
+				sysinfo.ta = atoi(buffer + 3);
+			}
+			break;
+		case LOG_TYPE_POWER:
+			if (!strncmp(buffer, "arfcn ", 6))
+				read_log_power(buffer + 6);
+			else if (!strncmp(buffer, "time ", 5))
+				power.gmt = strtoul(buffer + 5, NULL, 0);
+			else if (!strncmp(buffer, "position ", 9))
+				read_log_pos(buffer + 9, &power.longitude,
+					&power.latitude, &sysinfo.gps_valid);
+			break;
+		}
+	}
+
+	return type;
+}
+
diff --git a/src/host/gsmmap/log.h b/src/host/gsmmap/log.h
new file mode 100644
index 00000000..d1520101
--- /dev/null
+++ b/src/host/gsmmap/log.h
@@ -0,0 +1,80 @@
+
+enum {
+	LOG_TYPE_NONE = 0,
+	LOG_TYPE_SYSINFO,
+	LOG_TYPE_POWER,
+};
+
+struct power {
+	uint8_t gps_valid;
+	double longitude, latitude;
+	time_t gmt;
+	int8_t rxlev[1024];
+};
+
+struct node_power {
+	struct node_power *next;
+	struct power power;
+};
+
+struct node_mcc {
+	struct node_mcc *next;
+	uint16_t mcc;
+	struct node_mnc *mnc;
+};
+
+struct node_mnc {
+	struct node_mnc *next;
+	uint16_t mnc;
+	struct node_lac *lac;
+};
+
+struct node_lac {
+	struct node_lac *next;
+	uint16_t lac;
+	struct node_cell *cell;
+};
+
+struct sysinfo {
+	uint16_t arfcn;
+	int8_t rxlev;
+	uint8_t bsic;
+	uint8_t gps_valid;
+	double longitude, latitude;
+	time_t gmt;
+	uint8_t	si1[23];
+	uint8_t	si2[23];
+	uint8_t	si2bis[23];
+	uint8_t	si2ter[23];
+	uint8_t	si3[23];
+	uint8_t	si4[23];
+	uint8_t ta_valid;
+	uint8_t ta;
+};
+
+struct node_cell {
+	struct node_cell *next;
+	uint16_t cellid;
+	uint8_t content; /* indicates, if sysinfo is already applied */
+	struct node_meas *meas, **meas_last_p;
+	struct sysinfo sysinfo;
+	struct gsm48_sysinfo s;
+};
+
+struct node_meas {
+	struct node_meas *next;
+	time_t gmt;
+	int8_t rxlev;
+	uint8_t gps_valid;
+	double longitude, latitude;
+	uint8_t ta_valid;
+	uint8_t ta;
+};
+
+struct node_mcc *get_node_mcc(uint16_t mcc);
+struct node_mnc *get_node_mnc(struct node_mcc *mcc, uint16_t mnc);
+struct node_lac *get_node_lac(struct node_mnc *mnc, uint16_t lac);
+struct node_cell *get_node_cell(struct node_lac *lac, uint16_t cellid);
+struct node_meas *add_node_meas(struct node_cell *cell);
+int read_log(FILE *infp);
+
diff --git a/src/host/layer23/.gitignore b/src/host/layer23/.gitignore
new file mode 100644
index 00000000..8fb93f73
--- /dev/null
+++ b/src/host/layer23/.gitignore
@@ -0,0 +1,36 @@
+# autoreconf by-products
+*.in
+
+aclocal.m4
+autom4te.cache/
+config.h.in
+configure
+depcomp
+install-sh
+missing
+
+# configure by-products
+.deps
+Makefile
+
+config.h
+config.log
+config.status
+
+# build by-products
+*.o
+*.a
+
+# various
+*.sw?
+*.deps
+
+# final executables
+src/misc/bcch_scan
+src/misc/cbch_sniff
+src/misc/cell_log
+src/misc/echo_test
+src/misc/cbch_sniff
+src/misc/ccch_scan
+src/misc/layer23
+src/mobile/mobile
diff --git a/src/host/layer23/COPYING b/src/host/layer23/COPYING
new file mode 100644
index 00000000..d511905c
--- /dev/null
+++ b/src/host/layer23/COPYING
@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
diff --git a/src/host/layer23/Makefile.am b/src/host/layer23/Makefile.am
new file mode 100644
index 00000000..bc3910fa
--- /dev/null
+++ b/src/host/layer23/Makefile.am
@@ -0,0 +1,3 @@
+AUTOMAKE_OPTIONS = foreign dist-bzip2 1.6
+
+SUBDIRS = include src
diff --git a/src/host/layer23/README b/src/host/layer23/README
new file mode 100644
index 00000000..dd598234
--- /dev/null
+++ b/src/host/layer23/README
@@ -0,0 +1,42 @@
+= OsmocomBB layer23 architecture =
+
+layer23 is an (incomplete) MS-side implementation of the L2 and L3 GSM
+protocols as described in GSM TS 04.06, 04.08 and others.
+
+== Interfaces ==
+
+L1 (on the phone) uses the L1CTL protocol to talk with layer23 (on the PC).
+
+L2 (inside layer23) uses the RSLms protocol to talk with the L3 (inside layer23)
+
+
+=== RSLms ===
+
+RSLms is modeled after the GSM TS 08.58 Radio Subsystem Link protocol.  Despite
+being designed for the network side, RSL seems a good match for the L2/L3
+interface inside a MS, too.
+
+At least the RLL (Radio Link Layer) part of RSL is 100% as applicable to the MS
+side as it is for the ntwork side.
+
+==== Lower interface (L2 to RSLms) ====
+
+Layer2 calls rslms_sendmsg() with a msgb that has the msgb->l2h pointing to a
+RSL header (struct abis_rsl_common_hdr).
+
+==== Upper interface (L3 to RSLms) ====
+
+Layer3 calls rslms_recvmsg() with a msgb that has the msgb->l2h pointing to a
+RSL header (struct abis_rsl_common_hdr).
+
+There are utility functions like rslms_tx_rll_req() and rslms_tx_rsll_req_l3()
+for creating msgb's with the apropriate RSL/RLL headers.
+
+
+=== LAPDm ===
+
+LAPDm is the GSM TS 04.06 protocol
+
+The lower interface (to L1) is using L1CTL
+
+The upper interface (to L3) is using RSLms
diff --git a/src/host/layer23/configure.ac b/src/host/layer23/configure.ac
new file mode 100644
index 00000000..3e696103
--- /dev/null
+++ b/src/host/layer23/configure.ac
@@ -0,0 +1,74 @@
+dnl Process this file with autoconf to produce a configure script
+AC_INIT([layer23], [0.0.0])
+AM_INIT_AUTOMAKE
+
+dnl kernel style compile messages
+m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+
+dnl checks for programs
+AC_PROG_MAKE_SET
+AC_PROG_CC
+AC_PROG_INSTALL
+AC_PROG_RANLIB
+
+AC_ARG_ENABLE(sanitize,
+		[AS_HELP_STRING([--enable-sanitize], [Compile with address sanitizer enabled], )],
+		[sanitize=$enableval], [sanitize="no"])
+if test x"$sanitize" = x"yes"
+then
+	CFLAGS="$CFLAGS -fsanitize=address -fsanitize=undefined"
+	CPPFLAGS="$CPPFLAGS -fsanitize=address -fsanitize=undefined"
+fi
+
+AC_ARG_ENABLE(werror,
+	[AS_HELP_STRING(
+		[--enable-werror],
+		[Turn all compiler warnings into errors, with exceptions:
+		 a) deprecation (allow upstream to mark deprecation without breaking builds);
+		 b) "#warning" pragmas (allow to remind ourselves of errors without breaking builds)
+		]
+	)],
+	[werror=$enableval], [werror="no"])
+if test x"$werror" = x"yes"
+then
+	WERROR_FLAGS="-Werror"
+	WERROR_FLAGS+=" -Wno-error=deprecated -Wno-error=deprecated-declarations"
+	WERROR_FLAGS+=" -Wno-error=cpp" # "#warning"
+	CFLAGS="$CFLAGS $WERROR_FLAGS"
+	CPPFLAGS="$CPPFLAGS $WERROR_FLAGS"
+fi
+
+dnl checks for libraries
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore)
+PKG_CHECK_MODULES(LIBOSMOVTY, libosmovty >= 0.10.0)
+PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm)
+PKG_CHECK_MODULES(LIBOSMOCODEC, libosmocodec)
+AC_CHECK_LIB(gps, gps_waiting, LIBGPS_CFLAGS=" -D_HAVE_GPSD" LIBGPS_LIBS=" -lgps ",,)
+AC_SUBST([LIBGPS_CFLAGS])
+AC_SUBST([LIBGPS_LIBS])
+
+
+dnl optional dependencies
+PKG_CHECK_MODULES(LIBLUA, lua53, [
+	WITH_LUA=1], [
+	WITH_LUA=0])
+AC_SUBST([WITH_LUA])
+AM_CONDITIONAL([BUILD_LUA], test "x$WITH_LUA" = "x1")
+
+dnl checks for header files
+AC_HEADER_STDC
+
+dnl Checks for typedefs, structures and compiler characteristics
+
+AC_OUTPUT(
+    src/Makefile
+    src/common/Makefile
+    src/misc/Makefile
+    src/mobile/Makefile
+    include/Makefile
+    include/osmocom/Makefile
+    include/osmocom/bb/Makefile
+    include/osmocom/bb/common/Makefile
+    include/osmocom/bb/misc/Makefile
+    include/osmocom/bb/mobile/Makefile
+    Makefile)
diff --git a/src/host/layer23/include/Makefile.am b/src/host/layer23/include/Makefile.am
new file mode 100644
index 00000000..297ece97
--- /dev/null
+++ b/src/host/layer23/include/Makefile.am
@@ -0,0 +1,2 @@
+noinst_HEADERS = l1ctl_proto.h
+SUBDIRS = osmocom
diff --git a/src/host/layer23/include/l1ctl_proto.h b/src/host/layer23/include/l1ctl_proto.h
new file mode 120000
index 00000000..f12ba71e
--- /dev/null
+++ b/src/host/layer23/include/l1ctl_proto.h
@@ -0,0 +1 @@
+../../../../include/l1ctl_proto.h
\ No newline at end of file
diff --git a/src/host/layer23/include/osmocom/Makefile.am b/src/host/layer23/include/osmocom/Makefile.am
new file mode 100644
index 00000000..5adf9df5
--- /dev/null
+++ b/src/host/layer23/include/osmocom/Makefile.am
@@ -0,0 +1 @@
+SUBDIRS = bb
diff --git a/src/host/layer23/include/osmocom/bb/Makefile.am b/src/host/layer23/include/osmocom/bb/Makefile.am
new file mode 100644
index 00000000..58a5f7fb
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/Makefile.am
@@ -0,0 +1 @@
+SUBDIRS = common misc mobile
diff --git a/src/host/layer23/include/osmocom/bb/common/Makefile.am b/src/host/layer23/include/osmocom/bb/common/Makefile.am
new file mode 100644
index 00000000..cd3437e3
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/Makefile.am
@@ -0,0 +1,2 @@
+noinst_HEADERS = l1ctl.h l1l2_interface.h l23_app.h logging.h \
+		 networks.h gps.h sysinfo.h osmocom_data.h utils.h
diff --git a/src/host/layer23/include/osmocom/bb/common/gps.h b/src/host/layer23/include/osmocom/bb/common/gps.h
new file mode 100644
index 00000000..58c0c536
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/gps.h
@@ -0,0 +1,53 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+enum {
+	GPS_TYPE_UNDEF,
+	GPS_TYPE_GPSD,
+	GPS_TYPE_SERIAL
+};
+
+struct osmo_gps {
+	/* GPS device */
+	uint8_t		enable;
+	uint8_t		gps_type;
+
+#ifdef _HAVE_GPSD
+	char		gpsd_host[32];
+	char		gpsd_port[6];
+#endif
+
+	char		device[32];
+	uint32_t	baud;
+
+	/* current data */
+	uint8_t		valid; /* we have a fix */
+	time_t		gmt; /* GMT time when position was received */
+	double		latitude, longitude;
+};
+
+extern struct osmo_gps g;
+
+int osmo_gps_open(void);
+void osmo_gps_close(void);
+void osmo_gps_init(void);
+
+
diff --git a/src/host/layer23/include/osmocom/bb/common/l1ctl.h b/src/host/layer23/include/osmocom/bb/common/l1ctl.h
new file mode 100644
index 00000000..e4dbdedc
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/l1ctl.h
@@ -0,0 +1,76 @@
+#ifndef osmocom_l1ctl_h
+#define osmocom_l1ctl_h
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/bb/common/osmocom_data.h>
+
+struct osmocom_ms;
+
+/* Receive incoming data from L1 using L1CTL format */
+int l1ctl_recv(struct osmocom_ms *ms, struct msgb *msg);
+
+/* Transmit L1CTL_DATA_REQ */
+int l1ctl_tx_data_req(struct osmocom_ms *ms, struct msgb *msg, uint8_t chan_nr,
+	uint8_t link_id);
+
+/* Transmit L1CTL_PARAM_REQ */
+int l1ctl_tx_param_req(struct osmocom_ms *ms, int8_t ta, uint8_t tx_power);
+
+int l1ctl_tx_crypto_req(struct osmocom_ms *ms, uint8_t chan_nr,
+	uint8_t algo, uint8_t *key, uint8_t len);
+
+/* Transmit L1CTL_RACH_REQ */
+int l1ctl_tx_rach_req(struct osmocom_ms *ms, uint8_t ra, uint16_t offset,
+	uint8_t combined);
+
+/* Transmit L1CTL_DM_EST_REQ */
+int l1ctl_tx_dm_est_req_h0(struct osmocom_ms *ms, uint16_t band_arfcn,
+	uint8_t chan_nr, uint8_t tsc, uint8_t tch_mode, uint8_t audio_mode);
+int l1ctl_tx_dm_est_req_h1(struct osmocom_ms *ms, uint8_t maio, uint8_t hsn,
+	uint16_t *ma, uint8_t ma_len, uint8_t chan_nr, uint8_t tsc,
+	uint8_t tch_mode, uint8_t audio_mode);
+
+/* Transmit L1CTL_DM_FREQ_REQ */
+int l1ctl_tx_dm_freq_req_h0(struct osmocom_ms *ms, uint16_t band_arfcn,
+	uint8_t tsc, uint16_t fn);
+int l1ctl_tx_dm_freq_req_h1(struct osmocom_ms *ms, uint8_t maio, uint8_t hsn,
+	uint16_t *ma, uint8_t ma_len, uint8_t tsc, uint16_t fn);
+
+/* Transmit L1CTL_DM_REL_REQ */
+int l1ctl_tx_dm_rel_req(struct osmocom_ms *ms);
+
+/* Transmit FBSB_REQ */
+int l1ctl_tx_fbsb_req(struct osmocom_ms *ms, uint16_t arfcn,
+		      uint8_t flags, uint16_t timeout, uint8_t sync_info_idx,
+		      uint8_t ccch_mode, uint8_t rxlev_exp);
+
+/* Transmit CCCH_MODE_REQ */
+int l1ctl_tx_ccch_mode_req(struct osmocom_ms *ms, uint8_t ccch_mode);
+
+/* Transmit TCH_MODE_REQ */
+int l1ctl_tx_tch_mode_req(struct osmocom_ms *ms, uint8_t tch_mode,
+	uint8_t audio_mode);
+
+/* Transmit ECHO_REQ */
+int l1ctl_tx_echo_req(struct osmocom_ms *ms, unsigned int len);
+
+/* Transmit L1CTL_RESET_REQ */
+int l1ctl_tx_reset_req(struct osmocom_ms *ms, uint8_t type);
+
+/* Transmit L1CTL_PM_REQ */
+int l1ctl_tx_pm_req_range(struct osmocom_ms *ms, uint16_t arfcn_from,
+			  uint16_t arfcn_to);
+
+int l1ctl_tx_sim_req(struct osmocom_ms *ms, uint8_t *data, uint16_t length);
+
+/* Transmit L1CTL_VOICE_REQ */
+int l1ctl_tx_traffic_req(struct osmocom_ms *ms, struct msgb *msg,
+			uint8_t chan_nr, uint8_t link_id);
+
+/* LAPDm wants to send a PH-* primitive to the physical layer (L1) */
+int l1ctl_ph_prim_cb(struct osmo_prim_hdr *oph, void *ctx);
+
+/* Transmit L1CTL_NEIGH_PM_REQ */
+int l1ctl_tx_neigh_pm_req(struct osmocom_ms *ms, int num, uint16_t *arfcn);
+
+#endif
diff --git a/src/host/layer23/include/osmocom/bb/common/l1l2_interface.h b/src/host/layer23/include/osmocom/bb/common/l1l2_interface.h
new file mode 100644
index 00000000..41403d87
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/l1l2_interface.h
@@ -0,0 +1,8 @@
+#ifndef _L1L2_INTERFACE_H
+#define _L1L2_INTERFACE_H
+
+int layer2_open(struct osmocom_ms *ms, const char *socket_path);
+int layer2_close(struct osmocom_ms *ms);
+int osmo_send_l1(struct osmocom_ms *ms, struct msgb *msg);
+
+#endif /* _L1L2_INTERFACE_H */
diff --git a/src/host/layer23/include/osmocom/bb/common/l23_app.h b/src/host/layer23/include/osmocom/bb/common/l23_app.h
new file mode 100644
index 00000000..0b9994c3
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/l23_app.h
@@ -0,0 +1,36 @@
+#ifndef _L23_APP_H
+#define _L23_APP_H
+
+struct option;
+
+/* Options supported by the l23 app */
+enum {
+	L23_OPT_SAP	= 1,
+	L23_OPT_ARFCN	= 2,
+	L23_OPT_TAP	= 4,
+	L23_OPT_VTY	= 8,
+	L23_OPT_DBG	= 16,
+	L23_OPT_VTYIP	= 32,
+};
+
+/* initialization, called once when starting the app, before entering
+ * select loop */
+extern int l23_app_init(struct osmocom_ms *ms);
+extern int (*l23_app_work) (struct osmocom_ms *ms);
+extern int (*l23_app_exit) (struct osmocom_ms *ms);
+
+/* configuration options */
+struct l23_app_info {
+	const char *copyright;
+	const char *contribution;
+
+	char *getopt_string;
+	int (*cfg_supported)();
+	int (*cfg_print_help)();
+	int (*cfg_getopt_opt)(struct option **options);
+	int (*cfg_handle_opt)(int c,const char *optarg);
+};
+
+extern struct l23_app_info *l23_app_info();
+
+#endif /* _L23_APP_H */
diff --git a/src/host/layer23/include/osmocom/bb/common/logging.h b/src/host/layer23/include/osmocom/bb/common/logging.h
new file mode 100644
index 00000000..bf6e6aa0
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/logging.h
@@ -0,0 +1,32 @@
+#ifndef _LOGGING_H
+#define _LOGGING_H
+
+#define DEBUG
+#include <osmocom/core/logging.h>
+
+enum {
+	DRSL,
+	DRR,
+	DPLMN,
+	DCS,
+	DNB,
+	DMM,
+	DCC,
+	DSS,
+	DSMS,
+	DMNCC,
+	DMEAS,
+	DPAG,
+	DL1C,
+	DSAP,
+	DSUM,
+	DSIM,
+	DGPS,
+	DMOB,
+	DPRIM,
+	DLUA,
+};
+
+extern const struct log_info log_info;
+
+#endif /* _LOGGING_H */
diff --git a/src/host/layer23/include/osmocom/bb/common/networks.h b/src/host/layer23/include/osmocom/bb/common/networks.h
new file mode 100644
index 00000000..d34f3162
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/networks.h
@@ -0,0 +1,24 @@
+#ifndef _NETWORKS_H
+#define _NETWORKS_H
+
+#define GSM_INPUT_INVALID	0xffff
+
+struct gsm_networks {
+	uint16_t	mcc;
+	int16_t		mnc;
+	const char 	*name;
+};
+
+int gsm_match_mcc(uint16_t mcc, char *imsi);
+int gsm_match_mnc(uint16_t mcc, uint16_t mnc, char *imsi);
+const char *gsm_print_mcc(uint16_t mcc);
+const char *gsm_print_mnc(uint16_t mcc);
+const char *gsm_get_mcc(uint16_t mcc);
+const char *gsm_get_mnc(uint16_t mcc, uint16_t mnc);
+const char *gsm_imsi_mcc(char *imsi);
+const char *gsm_imsi_mnc(char *imsi);
+const uint16_t gsm_input_mcc(char *string);
+const uint16_t gsm_input_mnc(char *string);
+
+#endif /* _NETWORKS_H */
+
diff --git a/src/host/layer23/include/osmocom/bb/common/osmocom_data.h b/src/host/layer23/include/osmocom/bb/common/osmocom_data.h
new file mode 100644
index 00000000..486c36d0
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/osmocom_data.h
@@ -0,0 +1,145 @@
+#ifndef osmocom_data_h
+#define osmocom_data_h
+
+#include <osmocom/core/select.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/write_queue.h>
+
+struct osmocom_ms;
+
+	/* FIXME no 'mobile' specific stuff should be here */
+#include <osmocom/bb/mobile/support.h>
+#include <osmocom/bb/mobile/settings.h>
+#include <osmocom/bb/mobile/subscriber.h>
+#include <osmocom/gsm/lapdm.h>
+#include <osmocom/bb/common/sap_interface.h>
+#include <osmocom/bb/mobile/gsm48_rr.h>
+#include <osmocom/bb/common/sysinfo.h>
+#include <osmocom/bb/mobile/gsm322.h>
+#include <osmocom/bb/mobile/gsm48_mm.h>
+#include <osmocom/bb/mobile/gsm48_cc.h>
+#include <osmocom/bb/mobile/mncc_sock.h>
+#include <osmocom/bb/common/sim.h>
+#include <osmocom/bb/common/l1ctl.h>
+
+struct osmosap_entity {
+	osmosap_cb_t msg_handler;
+	uint8_t sap_state;
+	uint16_t max_msg_size;
+};
+
+struct osmol1_entity {
+	int (*l1_traffic_ind)(struct osmocom_ms *ms, struct msgb *msg);
+};
+
+struct osmomncc_entity {
+	int (*mncc_recv)(struct osmocom_ms *ms, int msg_type, void *arg);
+	struct mncc_sock_state *sock_state;
+	uint32_t ref;
+};
+
+
+/* RX measurement statistics */
+struct rx_meas_stat {
+	uint32_t last_fn;
+
+	/* cumulated values of current cell from SACCH dl */
+	uint32_t frames;
+	uint32_t snr;
+	uint32_t berr;
+	uint32_t rxlev;
+
+	/* counters loss criterion */
+	int16_t dsc, ds_fail;
+	int16_t s, rl_fail;
+};
+
+enum {
+	MS_SHUTDOWN_NONE = 0,
+	MS_SHUTDOWN_IMSI_DETACH = 1,
+	MS_SHUTDOWN_WAIT_RESET = 2,
+	MS_SHUTDOWN_COMPL = 3,
+};
+
+/* One Mobilestation for osmocom */
+struct osmocom_ms {
+	struct llist_head entity;
+	char *name;
+	struct osmo_wqueue l2_wq, sap_wq;
+	uint16_t test_arfcn;
+	struct osmol1_entity l1_entity;
+
+	bool started, deleting;
+	uint8_t shutdown;
+	struct gsm_support support;
+	struct gsm_settings settings;
+	struct gsm_subscriber subscr;
+	struct gsm_sim sim;
+	struct lapdm_channel lapdm_channel;
+	struct osmosap_entity sap_entity;
+	struct rx_meas_stat meas;
+	struct gsm48_rrlayer rrlayer;
+	struct gsm322_plmn plmn;
+	struct gsm322_cellsel cellsel;
+	struct gsm48_mmlayer mmlayer;
+	struct gsm48_cclayer cclayer;
+	struct osmomncc_entity mncc_entity;
+	struct llist_head trans_list;
+
+	void *lua_state;
+	int lua_cb_ref;
+	char *lua_script;
+};
+
+enum osmobb_sig_subsys {
+	SS_L1CTL,
+	SS_GLOBAL,
+};
+
+enum osmobb_l1ctl_sig {
+	S_L1CTL_FBSB_ERR,
+	S_L1CTL_FBSB_RESP,
+	S_L1CTL_RESET,
+	S_L1CTL_PM_RES,
+	S_L1CTL_PM_DONE,
+	S_L1CTL_CCCH_MODE_CONF,
+	S_L1CTL_TCH_MODE_CONF,
+	S_L1CTL_LOSS_IND,
+	S_L1CTL_NEIGH_PM_IND,
+};
+
+enum osmobb_global_sig {
+	S_GLOBAL_SHUTDOWN,
+};
+
+struct osmobb_fbsb_res {
+	struct osmocom_ms *ms;
+	int8_t snr;
+	uint8_t bsic;
+	uint16_t band_arfcn;
+};
+
+struct osmobb_meas_res {
+	struct osmocom_ms *ms;
+	uint16_t band_arfcn;
+	uint8_t rx_lev;
+};
+
+struct osmobb_ccch_mode_conf {
+	struct osmocom_ms *ms;
+	uint8_t ccch_mode;
+};
+
+struct osmobb_tch_mode_conf {
+	struct osmocom_ms *ms;
+	uint8_t tch_mode;
+	uint8_t audio_mode;
+};
+
+struct osmobb_neigh_pm_ind {
+	struct osmocom_ms *ms;
+	uint16_t band_arfcn;
+	uint8_t rx_lev;
+};
+
+#endif
diff --git a/src/host/layer23/include/osmocom/bb/common/sap_interface.h b/src/host/layer23/include/osmocom/bb/common/sap_interface.h
new file mode 100644
index 00000000..e4e64cef
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/sap_interface.h
@@ -0,0 +1,75 @@
+#ifndef _SAP_INTERFACE_H
+#define _SAP_INTERFACE_H
+
+typedef int (*osmosap_cb_t)(struct msgb *msg, struct osmocom_ms *ms);
+
+int sap_open(struct osmocom_ms *ms, const char *socket_path);
+int sap_close(struct osmocom_ms *ms);
+int osmosap_send_apdu(struct osmocom_ms *ms, uint8_t *data, uint16_t length);
+int osmosap_register_handler(struct osmocom_ms *ms, osmosap_cb_t cb);
+int osmosap_sapsocket(struct osmocom_ms *ms, const char *path);
+int osmosap_init(struct osmocom_ms *ms);
+
+enum osmosap_state {
+	SAP_SOCKET_ERROR,
+	SAP_NOT_CONNECTED,
+	SAP_IDLE,
+	SAP_CONNECTION_UNDER_NEGOTIATION,
+	SAP_PROCESSING_ATR_REQUEST,
+	SAP_PROCESSING_APDU_REQUEST
+};
+
+/* BTSAP 1.13 */
+enum osmosap_msg_type {
+	SAP_CONNECT_REQ = 0x00,
+	SAP_CONNECT_RESP = 0x01,
+	SAP_DISCONNECT_REQ = 0x02,
+	SAP_DISCONNECT_RESP = 0x03,
+	SAP_DISCONNECT_IND = 0x04,
+	SAP_TRANSFER_APDU_REQ = 0x05,
+	SAP_TRANSFER_APDU_RESP = 0x06,
+	SAP_TRANSFER_ATR_REQ = 0x07,
+	SAP_TRANSFER_ATR_RESP = 0x08,
+	SAP_POWER_SIM_OFF_REQ = 0x09,
+	SAP_POWER_SIM_OFF_RESP = 0x0A,
+	SAP_POWER_SIM_ON_REQ = 0x0B,
+	SAP_POWER_SIM_ON_RESP = 0x0C,
+	SAP_RESET_SIM_REQ = 0x0D,
+	SAP_RESET_SIM_RESP = 0x0E,
+	SAP_TRANSFER_CARD_READER_STATUS_REQ = 0x0F,
+	SAP_TRANSFER_CARD_READER_STATUS_RESP = 0x10,
+	SAP_STATUS_IND = 0x11,
+	SAP_ERROR_RESP = 0x12,
+	SAP_SET_TRANSPORT_PROTOCOL_REQ = 0x13,
+	SAP_SET_TRANSPORT_PROTOCOL_RESP = 0x14
+};
+
+/* BTSAP 5.2 */
+enum osmosap_param_type {
+	SAP_MAX_MSG_SIZE = 0x00,
+	SAP_CONNECTION_STATUS = 0x01,
+	SAP_RESULT_CODE = 0x02,
+	SAP_DISCONNECTION_TYPE = 0x03,
+	SAP_COMMAND_APDU = 0x04,
+	SAP_COMMAND_APDU_7816 = 0x10,
+	SAP_RESPONSE_APDU = 0x05,
+	SAP_ATR = 0x06,
+	SAP_CARD_READER_STATUS = 0x07,
+	SAP_STATUS_CHANGE = 0x08,
+	SAP_TRANSPORT_PROTOCOL = 0x09
+};
+
+struct sap_param {
+	uint8_t id;
+	uint16_t len;
+	uint8_t *value;
+};
+
+struct sap_msg {
+	uint8_t id;
+	uint8_t num_params;
+	struct sap_param *params;
+};
+
+
+#endif /* _SAP_INTERFACE_H */
diff --git a/src/host/layer23/include/osmocom/bb/common/sim.h b/src/host/layer23/include/osmocom/bb/common/sim.h
new file mode 100644
index 00000000..8b1f830c
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/sim.h
@@ -0,0 +1,288 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+
+/* 9.2 commands */
+#define GSM1111_CLASS_GSM		0xa0
+#define	GSM1111_INST_SELECT		0xa4
+#define	GSM1111_INST_STATUS		0xf2
+#define	GSM1111_INST_READ_BINARY	0xb0
+#define	GSM1111_INST_UPDATE_BINARY	0xd6
+#define	GSM1111_INST_READ_RECORD	0xb2
+#define	GSM1111_INST_UPDATE_RECORD	0xdc
+#define	GSM1111_INST_SEEK		0xa2
+#define	GSM1111_INST_INCREASE		0x32
+#define	GSM1111_INST_VERIFY_CHV		0x20
+#define	GSM1111_INST_CHANGE_CHV		0x24
+#define	GSM1111_INST_DISABLE_CHV	0x26
+#define	GSM1111_INST_ENABLE_CHV		0x28
+#define	GSM1111_INST_UNBLOCK_CHV	0x2c
+#define	GSM1111_INST_INVALIDATE		0x04
+#define	GSM1111_INST_REHABLILITATE	0x44
+#define	GSM1111_INST_RUN_GSM_ALGO	0x88
+#define	GSM1111_INST_SLEEP		0xfa
+#define	GSM1111_INST_GET_RESPONSE	0xc0
+#define	GSM1111_INST_TERMINAL_PROFILE	0x10
+#define	GSM1111_INST_ENVELOPE		0xc2
+#define	GSM1111_INST_FETCH		0x12
+#define	GSM1111_INST_TERMINAL_RESPONSE	0x14
+
+/* 9.3 access conditions */
+#define GSM1111_ACC_ALWAYS		0x0
+#define GSM1111_ACC_CHV1		0x1
+#define GSM1111_ACC_CHV2		0x2
+#define GSM1111_ACC_RFU			0x3
+#define GSM1111_ACC_NEW			0xf
+/* others are ADM */
+
+/* 9.3 type of file */
+#define GSM1111_TOF_RFU			0x00
+#define GSM1111_TOF_MF			0x01
+#define GSM1111_TOF_DF			0x02
+#define GSM1111_TOF_EF			0x04
+
+/* 9.3 struct of file */
+#define GSM1111_SOF_TRANSPARENT		0x00
+#define GSM1111_SOF_LINEAR		0x01
+#define GSM1111_SOF_CYCLIC		0x03
+
+/* 9.4 status */
+#define GSM1111_STAT_NORMAL		0x90
+#define GSM1111_STAT_PROACTIVE		0x91
+#define GSM1111_STAT_DL_ERROR		0x9e
+#define GSM1111_STAT_RESPONSE		0x9f
+#define GSM1111_STAT_RESPONSE_TOO	0x61
+#define GSM1111_STAT_APP_TK_BUSY	0x93
+#define GSM1111_STAT_MEM_PROBLEM	0x92
+#define GSM1111_STAT_REFERENCING	0x94
+#define GSM1111_STAT_SECURITY		0x98
+#define GSM1111_STAT_INCORR_P3		0x67
+#define GSM1111_STAT_INCORR_P1_P2	0x6b
+#define GSM1111_STAT_UKN_INST		0x6d
+#define GSM1111_STAT_WRONG_CLASS	0x6e
+#define GSM1111_STAT_TECH_PROBLEM	0x6f
+
+/* 9.4.4 Referencing management SW2 */
+#define GSM1111_REF_NO_EF		0x00
+#define GSM1111_REF_OUT_OF_RANGE	0x02
+#define GSM1111_REF_FILE_NOT_FOUND	0x04
+#define GSM1111_REF_FILE_INCONSI	0x08
+
+/* 9.4.5 Security management SW2 */
+#define GSM1111_SEC_NO_CHV		0x02
+#define GSM1111_SEC_NO_ACCESS		0x04
+#define GSM1111_SEC_CONTRA_CHV		0x08
+#define GSM1111_SEC_CONTRA_INVAL	0x10
+#define GSM1111_SEC_BLOCKED		0x40
+#define GSM1111_SEC_MAX_VALUE		0x50
+
+/* messages from application to sim client */
+enum {
+	/* requests */
+	SIM_JOB_READ_BINARY,
+	SIM_JOB_UPDATE_BINARY,
+	SIM_JOB_READ_RECORD,
+	SIM_JOB_UPDATE_RECORD,
+	SIM_JOB_SEEK_RECORD,
+	SIM_JOB_INCREASE,
+	SIM_JOB_INVALIDATE,
+	SIM_JOB_REHABILITATE,
+	SIM_JOB_RUN_GSM_ALGO,
+	SIM_JOB_PIN1_UNLOCK,
+	SIM_JOB_PIN1_CHANGE,
+	SIM_JOB_PIN1_DISABLE,
+	SIM_JOB_PIN1_ENABLE,
+	SIM_JOB_PIN1_UNBLOCK,
+	SIM_JOB_PIN2_UNLOCK,
+	SIM_JOB_PIN2_CHANGE,
+	SIM_JOB_PIN2_UNBLOCK,
+
+	/* results */
+	SIM_JOB_OK,
+	SIM_JOB_ERROR,
+};
+
+/* messages from sim client to application */
+#define SIM_JOB_OK		0
+#define SIM_JOB_ERROR		1
+
+/* error causes */
+#define SIM_CAUSE_NO_SIM	0	/* no SIM present, if detectable */
+#define SIM_CAUSE_SIM_ERROR	1	/* any error while reading SIM */
+#define SIM_CAUSE_REQUEST_ERROR	2	/* error in request */
+#define SIM_CAUSE_PIN1_REQUIRED	3	/* CHV1 is required for access */
+#define SIM_CAUSE_PIN2_REQUIRED	4	/* CHV2 is required for access */
+#define SIM_CAUSE_PIN1_BLOCKED	5	/* CHV1 was entered too many times */
+#define SIM_CAUSE_PIN2_BLOCKED	6	/* CHV2 was entered too many times */
+#define SIM_CAUSE_PUC_BLOCKED	7	/* unblock entered too many times */
+
+/* job states */
+enum {
+	SIM_JST_IDLE = 0,
+	SIM_JST_SELECT_MFDF,		/* SELECT sent */
+	SIM_JST_SELECT_MFDF_RESP,	/* GET RESPONSE sent */
+	SIM_JST_SELECT_EF,		/* SELECT sent */
+	SIM_JST_SELECT_EF_RESP,		/* GET RESPONSE sent */
+	SIM_JST_WAIT_FILE,		/* file command sent */
+	SIM_JST_RUN_GSM_ALGO,		/* wait for algorithm to process */
+	SIM_JST_RUN_GSM_ALGO_RESP,	/* wait for response */
+	SIM_JST_PIN1_UNLOCK,
+	SIM_JST_PIN1_CHANGE,
+	SIM_JST_PIN1_DISABLE,
+	SIM_JST_PIN1_ENABLE,
+	SIM_JST_PIN1_UNBLOCK,
+	SIM_JST_PIN2_UNLOCK,
+	SIM_JST_PIN2_CHANGE,
+	SIM_JST_PIN2_UNBLOCK,
+};
+
+#define MAX_SIM_PATH_LENGTH	6 + 1 /* one for the termination */
+
+struct gsm_sim_handler {
+	struct llist_head	entry;
+
+	uint32_t		handle;
+	void			(*cb)(struct osmocom_ms *ms, struct msgb *msg);
+};
+
+struct gsm_sim {
+	struct llist_head	handlers; /* gsm_sim_handler */
+	struct llist_head	jobs; /* messages */
+	uint16_t path[MAX_SIM_PATH_LENGTH];
+	uint16_t file;
+
+	struct msgb		*job_msg;
+	uint32_t		job_handle;
+	int			job_state;
+
+	uint8_t			reset;
+	uint8_t			chv1_remain, chv2_remain;
+	uint8_t			unblk1_remain, unblk2_remain;
+
+	/* APDU cache (used by GSMTAP) */
+	uint8_t apdu_data[256 + 7];
+	uint16_t apdu_len;
+};
+
+struct sim_hdr {
+	int handle;
+	uint8_t job_type;
+	uint16_t path[MAX_SIM_PATH_LENGTH];
+	uint16_t file;
+	uint8_t rec_no, rec_mode; /* in case of record */
+	uint8_t seek_type_mode; /* in case of seek command */
+};
+
+#define SIM_ALLOC_SIZE		512
+#define SIM_ALLOC_HEADROOM	64
+
+struct msgb *gsm_sim_msgb_alloc(uint32_t handle, uint8_t job_type);
+uint32_t sim_open(struct osmocom_ms *ms,
+	void (*cb)(struct osmocom_ms *ms, struct msgb *msg));
+void sim_close(struct osmocom_ms *ms, uint32_t handle);
+void sim_job(struct osmocom_ms *ms, struct msgb *msg);
+
+/* Section 9.2.1 (response to selecting DF or MF) */
+struct gsm1111_response_mfdf {
+	uint16_t rfu1;
+	uint16_t free_mem;
+	uint16_t file_id;
+	uint8_t tof;
+	uint8_t	rfu2[5];
+	uint8_t length;
+	uint8_t gsm_data[0];
+} __attribute__ ((packed));
+
+struct gsm1111_response_mfdf_gsm {
+	uint8_t file_char;
+	uint8_t num_df;
+	uint8_t num_ef;
+	uint8_t num_codes;
+	uint8_t rfu1;
+	uint8_t chv1_remain:4,
+		 rfu2:3,
+		 chv1_init:1;
+	uint8_t unblk1_remain:4,
+		 rfu3:3,
+		 unblk1_init:1;
+	uint8_t chv2_remain:4,
+		 rfu4:3,
+		 chv2_init:1;
+	uint8_t unblk2_remain:4,
+		 rfu5:3,
+		 unblk2_init:1;
+	uint8_t more_data[0];
+} __attribute__ ((packed));
+
+/* Section 9.2.1 (response to selecting EF) */
+struct gsm1111_response_ef {
+	uint16_t rfu1;
+	uint16_t file_size;
+	uint16_t file_id;
+	uint8_t tof;
+	uint8_t inc_allowed;
+	uint8_t	acc_update:4,
+		 acc_read:4;
+	uint8_t	rfu2:4,
+		 acc_inc:4;
+	uint8_t	acc_inval:4,
+		 acc_reha:4;
+	uint8_t not_inval:1,
+		 rfu3:1,
+		 ru_inval:1,
+		 rfu4:5;
+	uint8_t length;
+	uint8_t structure;
+} __attribute__ ((packed));
+
+/* Section 10.3.17 */
+struct gsm1111_ef_loci {
+	uint32_t tmsi;
+	struct gsm48_loc_area_id lai;
+	uint8_t tmsi_time;
+	uint8_t lupd_status;
+} __attribute__ ((packed));
+
+/* Section 10.5.1 */
+struct gsm1111_ef_adn {
+	uint8_t len_bcd;
+	uint8_t ton_npi;
+	uint8_t number[10];
+	uint8_t capa_conf;
+	uint8_t ext_id;
+} __attribute__ ((packed));
+
+/* Section 10.5.6 */
+struct gsm1111_ef_smsp {
+	uint8_t par_ind;
+	uint8_t tp_da[12];
+	uint8_t ts_sca[12];
+	uint8_t tp_proto;
+	uint8_t tp_dcs;
+	uint8_t tp_vp;
+} __attribute__ ((packed));
+
+int sim_apdu_resp(struct osmocom_ms *ms, struct msgb *msg);
+int gsm_sim_init(struct osmocom_ms *ms);
+int gsm_sim_exit(struct osmocom_ms *ms);
+int gsm_sim_job_dequeue(struct osmocom_ms *ms);
+
+
diff --git a/src/host/layer23/include/osmocom/bb/common/sysinfo.h b/src/host/layer23/include/osmocom/bb/common/sysinfo.h
new file mode 100644
index 00000000..f843f271
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/sysinfo.h
@@ -0,0 +1,162 @@
+#ifndef _SYSINFO_H
+#define _SYSINFO_H
+
+#include <osmocom/gsm/gsm48_ie.h>
+
+/* collection of system information of the current cell */
+
+/* frequency mask flags of frequency type */
+#define	FREQ_TYPE_SERV		0x01 /* frequency of the serving cell */
+#define	FREQ_TYPE_HOPP		0x02 /* frequency used for channel hopping */
+#define	FREQ_TYPE_NCELL		0x1c /* frequency of the neighbor cell */
+#define	FREQ_TYPE_NCELL_2	0x04 /* sub channel of SI 2 */
+#define	FREQ_TYPE_NCELL_2bis	0x08 /* sub channel of SI 2bis */
+#define	FREQ_TYPE_NCELL_2ter	0x10 /* sub channel of SI 2ter */
+#define	FREQ_TYPE_REP		0xe0 /* frequency to be reported */
+#define	FREQ_TYPE_REP_5		0x20 /* sub channel of SI 5 */
+#define	FREQ_TYPE_REP_5bis	0x40 /* sub channel of SI 5bis */
+#define	FREQ_TYPE_REP_5ter	0x80 /* sub channel of SI 5ter */
+
+/* structure of all received system informations */
+struct gsm48_sysinfo {
+	/* flags of available information */
+	uint8_t				si1, si2, si2bis, si2ter, si3,
+					si4, si5, si5bis, si5ter, si6;
+
+	/* memory maps to simply detect change in system info messages */
+	uint8_t				si1_msg[23];
+	uint8_t				si2_msg[23];
+	uint8_t				si2b_msg[23];
+	uint8_t				si2t_msg[23];
+	uint8_t				si3_msg[23];
+	uint8_t				si4_msg[23];
+	uint8_t				si5_msg[18];
+	uint8_t				si5b_msg[18];
+	uint8_t				si5t_msg[18];
+	uint8_t				si6_msg[18];
+
+	struct	gsm_sysinfo_freq	freq[1024]; /* all frequencies */
+	uint16_t			hopping[64]; /* hopping arfcn */
+	uint8_t				hopp_len;
+
+	/* serving cell */
+	uint8_t				bsic;
+	uint16_t			cell_id;
+	uint16_t			mcc, mnc, lac; /* LAI */
+	uint8_t				max_retrans; /* decoded */
+	uint8_t				tx_integer; /* decoded */
+	uint8_t				reest_denied; /* 1 = denied */
+	uint8_t				cell_barr; /* 1 = barred */
+	uint16_t			class_barr; /* bit 10 is emergency */
+
+	/* si1 rest */
+	uint8_t				nch;
+	uint8_t				nch_position;
+	uint8_t				band_ind; /* set for DCS */
+
+	/* si3 rest */
+	uint8_t				sp;
+	uint8_t				sp_cbq;
+	uint8_t				sp_cro;
+	uint8_t				sp_to;
+	uint8_t				sp_pt;
+	uint8_t				po;
+	uint8_t				po_value;
+	uint8_t				si2ter_ind;
+	uint8_t				ecsm;
+	uint8_t				sched;
+	uint8_t				sched_where;
+	uint8_t				gprs;
+	uint8_t				gprs_ra_colour;
+	uint8_t				gprs_si13_pos;
+
+	/* cell selection */
+	int8_t				ms_txpwr_max_cch;
+	int8_t				cell_resel_hyst_db;
+	int8_t				rxlev_acc_min_db;
+	uint8_t				neci;
+	uint8_t				acs;
+	/* bcch options */
+	uint8_t				bcch_radio_link_timeout;
+	uint8_t				bcch_dtx;
+	uint8_t				bcch_pwrc;
+	/* sacch options */
+	uint8_t				sacch_radio_link_timeout;
+	uint8_t				sacch_dtx;
+	uint8_t				sacch_pwrc;
+	/* control channel */
+	uint8_t				ccch_conf;
+	uint8_t				bs_ag_blks_res;
+	uint8_t				att_allowed;
+	uint8_t				pag_mf_periods;
+	int32_t				t3212; /* real value in seconds */
+	/* channel description */
+	uint8_t				tsc;
+	uint8_t				h; /* using hopping */
+	uint16_t			arfcn;
+	uint8_t				maio;
+	uint8_t				hsn;
+	uint8_t				chan_nr; /* type, slot, sub slot */
+
+	/* neighbor cell */
+	uint8_t				nb_ext_ind_si2;
+	uint8_t				nb_ba_ind_si2;
+	uint8_t				nb_ext_ind_si2bis;
+	uint8_t				nb_ba_ind_si2bis;
+	uint8_t				nb_multi_rep_si2ter; /* see GSM 05.08 8.4.3 */
+	uint8_t				nb_ba_ind_si2ter;
+	uint8_t				nb_ext_ind_si5;
+	uint8_t				nb_ba_ind_si5;
+	uint8_t				nb_ext_ind_si5bis;
+	uint8_t				nb_ba_ind_si5bis;
+	uint8_t				nb_multi_rep_si5ter;
+	uint8_t				nb_ba_ind_si5ter;
+	uint8_t				nb_ncc_permitted_si2;
+	uint8_t				nb_ncc_permitted_si6;
+	uint8_t				nb_max_retrans; /* decoded */
+	uint8_t				nb_tx_integer; /* decoded */
+	uint8_t				nb_reest_denied; /* 1 = denied */
+	uint8_t				nb_cell_barr; /* 1 = barred */
+	uint16_t			nb_class_barr; /* bit 10 is emergency */
+};
+
+char *gsm_print_arfcn(uint16_t arfcn);
+uint8_t gsm_refer_pcs(uint16_t arfcn, struct gsm48_sysinfo *s);
+int gsm48_sysinfo_dump(struct gsm48_sysinfo *s, uint16_t arfcn,
+	void (*print)(void *, const char *, ...), void *priv,
+	uint8_t *freq_map);
+int gsm48_decode_lai(struct gsm48_loc_area_id *lai, uint16_t *mcc,
+	uint16_t *mnc, uint16_t *lac);
+int gsm48_decode_chan_h0(struct gsm48_chan_desc *cd, uint8_t *tsc,
+	uint16_t *arfcn);
+int gsm48_decode_chan_h1(struct gsm48_chan_desc *cd, uint8_t *tsc,
+	uint8_t *maio, uint8_t *hsn);
+int gsm48_decode_sysinfo1(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_1 *si, int len);
+int gsm48_decode_sysinfo2(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_2 *si, int len);
+int gsm48_decode_sysinfo2bis(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_2bis *si, int len);
+int gsm48_decode_sysinfo2ter(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_2ter *si, int len);
+int gsm48_decode_sysinfo3(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_3 *si, int len);
+int gsm48_decode_sysinfo4(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_4 *si, int len);
+int gsm48_decode_sysinfo5(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_5 *si, int len);
+int gsm48_decode_sysinfo5bis(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_5bis *si, int len);
+int gsm48_decode_sysinfo5ter(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_5ter *si, int len);
+int gsm48_decode_sysinfo6(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_6 *si, int len);
+int gsm48_decode_mobile_alloc(struct gsm_sysinfo_freq *freq,
+	uint8_t *ma, uint8_t len, uint16_t *hopping, uint8_t *hopp_len,
+	int si4);
+int gsm48_encode_lai_hex(struct gsm48_loc_area_id *lai, uint16_t mcc,
+	uint16_t mnc, uint16_t lac);
+int gsm48_decode_lai_hex(struct gsm48_loc_area_id *lai, uint16_t *mcc,
+	uint16_t *mnc, uint16_t *lac);
+
+#endif /* _SYSINFO_H */
diff --git a/src/host/layer23/include/osmocom/bb/common/utils.h b/src/host/layer23/include/osmocom/bb/common/utils.h
new file mode 100644
index 00000000..8ca61f82
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/utils.h
@@ -0,0 +1,3 @@
+#pragma once
+
+int layer23_random(void);
diff --git a/src/host/layer23/include/osmocom/bb/misc/Makefile.am b/src/host/layer23/include/osmocom/bb/misc/Makefile.am
new file mode 100644
index 00000000..71c9d389
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/misc/Makefile.am
@@ -0,0 +1 @@
+noinst_HEADERS = layer3.h rslms.h
diff --git a/src/host/layer23/include/osmocom/bb/misc/cell_log.h b/src/host/layer23/include/osmocom/bb/misc/cell_log.h
new file mode 100644
index 00000000..bce066eb
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/misc/cell_log.h
@@ -0,0 +1,25 @@
+/* Cell Scanning code for OsmocomBB */
+
+/* (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+int scan_init(struct osmocom_ms *_ms);
+int scan_exit(void);
+
diff --git a/src/host/layer23/include/osmocom/bb/misc/layer3.h b/src/host/layer23/include/osmocom/bb/misc/layer3.h
new file mode 100644
index 00000000..bbf242d5
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/misc/layer3.h
@@ -0,0 +1,17 @@
+#ifndef _OSMOCOM_L3_H
+#define _OSMOCOM_L3_H
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/bb/common/osmocom_data.h>
+
+int gsm48_rx_ccch(struct msgb *msg, struct osmocom_ms *ms);
+int gsm48_rx_dcch(struct msgb *msg, struct osmocom_ms *ms);
+int gsm48_rx_bcch(struct msgb *msg, struct osmocom_ms *ms);
+
+/* Initialize layer3 for the MS, hook it to L2 */
+int layer3_init(struct osmocom_ms *ms);
+
+/* Reset the 'aplication' state */
+void layer3_app_reset(void);
+
+#endif
diff --git a/src/host/layer23/include/osmocom/bb/misc/rslms.h b/src/host/layer23/include/osmocom/bb/misc/rslms.h
new file mode 100644
index 00000000..94fe99c8
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/misc/rslms.h
@@ -0,0 +1,23 @@
+#ifndef _OSMOCOM_RSLMS_H
+#define _OSMOCOM_RSLMS_H
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/bb/common/osmocom_data.h>
+
+/* From L3 into RSLMS (direction -> L2) */
+
+/* Send a 'simple' RLL request to L2 */
+int rslms_tx_rll_req(struct osmocom_ms *ms, uint8_t msg_type,
+		     uint8_t chan_nr, uint8_t link_id);
+
+/* Send a RLL request (including L3 info) to L2 */
+int rslms_tx_rll_req_l3(struct osmocom_ms *ms, uint8_t msg_type,
+			uint8_t chan_nr, uint8_t link_id, struct msgb *msg);
+
+
+/* From L2 into RSLMS (direction -> L3) */
+
+/* input function that L2 calls when sending messages up to L3 */
+//int rslms_sendmsg(struct msgb *msg, struct osmocom_ms *ms);
+
+#endif /* _OSMOCOM_RSLMS_H */
diff --git a/src/host/layer23/include/osmocom/bb/mobile/Makefile.am b/src/host/layer23/include/osmocom/bb/mobile/Makefile.am
new file mode 100644
index 00000000..8e4be1ac
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/Makefile.am
@@ -0,0 +1,3 @@
+noinst_HEADERS = gsm322.h gsm480_ss.h gsm411_sms.h gsm48_cc.h gsm48_mm.h \
+		 gsm48_rr.h mncc.h settings.h subscriber.h support.h \
+		 transaction.h vty.h mncc_sock.h mncc_ms.h primitives.h
diff --git a/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h b/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h
new file mode 100644
index 00000000..191f4baf
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/app_mobile.h
@@ -0,0 +1,31 @@
+#ifndef APP_MOBILE_H
+#define APP_MOBILE_H
+
+#include <stdbool.h>
+
+extern char *config_dir;
+
+struct osmocom_ms;
+struct vty;
+
+int l23_app_init(int (*mncc_recv)(struct osmocom_ms *ms, int, void *),
+	const char *config_file);
+int l23_app_exit(void);
+int l23_app_work(int *quit);
+int mobile_delete(struct osmocom_ms *ms, int force);
+struct osmocom_ms *mobile_new(char *name);
+int mobile_work(struct osmocom_ms *ms);
+int mobile_start(struct osmocom_ms *ms, char **other_name);
+int mobile_stop(struct osmocom_ms *ms, int force);
+
+void mobile_set_started(struct osmocom_ms *ms, bool state);
+void mobile_set_shutdown(struct osmocom_ms *ms, int state);
+
+int script_lua_load(struct vty *vty, struct osmocom_ms *ms, const char *filename);
+int script_lua_close(struct osmocom_ms *ms);
+
+
+/* Internal code. Don't call directly */
+int mobile_exit(struct osmocom_ms *ms, int force);
+#endif
+
diff --git a/src/host/layer23/include/osmocom/bb/mobile/gsm322.h b/src/host/layer23/include/osmocom/bb/mobile/gsm322.h
new file mode 100644
index 00000000..d4caac99
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/gsm322.h
@@ -0,0 +1,260 @@
+#ifndef _GSM322_H
+#define _GSM322_H
+
+#include <osmocom/bb/common/sysinfo.h>
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/timer.h>
+
+/* 4.3.1.1 List of states for PLMN slection process (automatic mode) */
+#define GSM322_A0_NULL			0
+#define	GSM322_A1_TRYING_RPLMN		1
+#define	GSM322_A2_ON_PLMN		2
+#define	GSM322_A3_TRYING_PLMN		3
+#define	GSM322_A4_WAIT_FOR_PLMN		4
+#define	GSM322_A5_HPLMN_SEARCH		5
+#define	GSM322_A6_NO_SIM		6
+
+/* 4.3.1.2 List of states for PLMN slection process (manual mode) */
+#define GSM322_M0_NULL			0
+#define	GSM322_M1_TRYING_RPLMN		1
+#define	GSM322_M2_ON_PLMN		2
+#define	GSM322_M3_NOT_ON_PLMN		3
+#define	GSM322_M4_TRYING_PLMN		4
+#define	GSM322_M5_NO_SIM		5
+
+/* 4.3.2 List of states for cell selection process */
+#define GSM322_C0_NULL			0
+#define	GSM322_C1_NORMAL_CELL_SEL	1
+#define	GSM322_C2_STORED_CELL_SEL	2
+#define	GSM322_C3_CAMPED_NORMALLY	3
+#define	GSM322_C4_NORMAL_CELL_RESEL	4
+#define	GSM322_C5_CHOOSE_CELL		5
+#define	GSM322_C6_ANY_CELL_SEL		6
+#define	GSM322_C7_CAMPED_ANY_CELL	7
+#define	GSM322_C8_ANY_CELL_RESEL	8
+#define	GSM322_C9_CHOOSE_ANY_CELL	9
+#define GSM322_CONNECTED_MODE_1		10
+#define GSM322_CONNECTED_MODE_2		11
+#define GSM322_PLMN_SEARCH		12
+#define GSM322_HPLMN_SEARCH		13
+#define GSM322_ANY_SEARCH		14
+
+/* GSM 03.22 events */
+#define	GSM322_EVENT_SWITCH_ON		1
+#define	GSM322_EVENT_SWITCH_OFF		2	
+#define	GSM322_EVENT_SIM_INSERT		3
+#define	GSM322_EVENT_SIM_REMOVE		4
+#define	GSM322_EVENT_REG_SUCCESS	5
+#define	GSM322_EVENT_REG_FAILED		6
+#define	GSM322_EVENT_ROAMING_NA		7
+#define	GSM322_EVENT_INVALID_SIM	8
+#define	GSM322_EVENT_NEW_PLMN		9
+#define	GSM322_EVENT_ON_PLMN		10
+#define	GSM322_EVENT_PLMN_SEARCH_START	11
+#define	GSM322_EVENT_PLMN_SEARCH_END	12
+#define	GSM322_EVENT_USER_RESEL		13
+#define	GSM322_EVENT_PLMN_AVAIL		14
+#define	GSM322_EVENT_CHOOSE_PLMN	15
+#define	GSM322_EVENT_SEL_MANUAL		16
+#define	GSM322_EVENT_SEL_AUTO		17
+#define	GSM322_EVENT_CELL_FOUND		18
+#define	GSM322_EVENT_NO_CELL_FOUND	19
+#define	GSM322_EVENT_LEAVE_IDLE		20
+#define	GSM322_EVENT_RET_IDLE		21
+#define	GSM322_EVENT_CELL_RESEL		22
+#define	GSM322_EVENT_SYSINFO		23
+#define	GSM322_EVENT_HPLMN_SEARCH	24
+
+enum {
+	PLMN_MODE_MANUAL,
+	PLMN_MODE_AUTO
+};
+
+/* node for each PLMN */
+struct gsm322_plmn_list {
+	struct llist_head	entry;
+	uint16_t		mcc, mnc;
+	uint8_t			rxlev; /* rx level in range format */
+	uint8_t			cause; /* cause value, if PLMN is not allowed */
+};
+
+/* node for each forbidden LA */
+struct gsm322_la_list {
+	struct llist_head	entry;
+	uint16_t		mcc, mnc, lac;
+	uint8_t			cause;
+};
+
+/* node for each BA-List */
+struct gsm322_ba_list {
+	struct llist_head	entry;
+	uint16_t		mcc, mnc;
+	/* Band allocation for 1024+299 frequencies.
+	 * First bit of first index is frequency 0.
+	 */
+	uint8_t			freq[128+38];
+};
+
+#define GSM322_CS_FLAG_SUPPORT	0x01 /* frequency is supported by radio */
+#define GSM322_CS_FLAG_BA	0x02 /* frequency is part of the current ba */
+#define GSM322_CS_FLAG_POWER	0x04 /* frequency was power scanned */
+#define GSM322_CS_FLAG_SIGNAL	0x08 /* valid signal detected */
+#define GSM322_CS_FLAG_SYSINFO	0x10 /* complete sysinfo received */
+#define GSM322_CS_FLAG_BARRED	0x20 /* cell is barred */
+#define GSM322_CS_FLAG_FORBIDD	0x40 /* cell in list of forbidden LAs */
+#define GSM322_CS_FLAG_TEMP_AA	0x80 /* if temporary available and allowable */
+
+/* Cell selection list */
+struct gsm322_cs_list {
+	uint8_t			flags; /* see GSM322_CS_FLAG_* */
+	uint8_t			rxlev; /* rx level range format */
+	struct gsm48_sysinfo	*sysinfo;
+};
+
+/* PLMN search process */
+struct gsm322_plmn {
+	struct osmocom_ms	*ms;
+	int			state; /* GSM322_Ax_* or GSM322_Mx_* */
+
+	struct llist_head	event_queue; /* event messages */
+	struct llist_head	sorted_plmn; /* list of sorted PLMN */
+	struct llist_head	forbidden_la; /* forbidden LAs */
+
+	struct osmo_timer_list	timer;
+
+	int			plmn_curr; /* current index in sorted_plmn */
+	uint16_t		mcc, mnc; /* current network selected */
+};
+
+/* state of CCCH activation */
+#define GSM322_CCCH_ST_IDLE	0	/* no connection */
+#define GSM322_CCCH_ST_INIT	1	/* initalized */
+#define GSM322_CCCH_ST_SYNC	2	/* got sync */
+#define GSM322_CCCH_ST_DATA	3	/* receiveing data */
+
+/* neighbour cell info list entry */
+struct gsm322_neighbour {
+	struct llist_head	entry;
+	struct gsm322_cellsel	*cs;
+	uint16_t		arfcn; /* ARFCN identity of that neighbour */
+
+	uint8_t			state; /* GSM322_NB_* */
+	time_t			created; /* when was this neighbour created */
+	time_t			when; /* when did we sync / read */
+	int16_t			rxlev_sum_dbm; /* sum of received levels */
+	uint8_t			rxlev_count; /* number of received levels */
+	int8_t			rla_c_dbm; /* average of the reveive level */
+	uint8_t			c12_valid; /* both C1 and C2 are calculated */
+	int16_t			c1, c2, crh;
+	uint8_t			checked_for_resel;
+	uint8_t			suitable_allowable;
+	uint8_t			prio_low;
+};
+
+#define GSM322_NB_NEW		0	/* new NB instance */
+#define GSM322_NB_NOT_SUP	1	/* ARFCN not supported */
+#define GSM322_NB_RLA_C		2	/* valid measurement available */
+#define GSM322_NB_NO_SYNC	3	/* cannot sync to neighbour */
+#define GSM322_NB_NO_BCCH	4	/* sync */
+#define GSM322_NB_SYSINFO	5	/* sysinfo */
+
+struct gsm48_sysinfo;
+/* Cell selection process */
+struct gsm322_cellsel {
+	struct osmocom_ms	*ms;
+	int			state; /* GSM322_Cx_* */
+
+	struct llist_head	event_queue; /* event messages */
+	struct llist_head	ba_list; /* BCCH Allocation per PLMN */
+	struct gsm322_cs_list	list[1024+299];
+					/* cell selection list per frequency. */
+	/* scan and tune state */
+	struct osmo_timer_list	timer; /* cell selection timer */
+	uint16_t		mcc, mnc; /* current network to search for */
+	uint8_t			powerscan; /* currently scanning for power */
+	uint8_t			ccch_state; /* special state of current ccch */
+	uint32_t		scan_state; /* special state of current scan */
+	uint16_t		arfcn; /* current tuned idle mode arfcn */
+	int			arfci; /* list index of frequency above */
+	uint8_t			ccch_mode; /* curren CCCH_MODE_* */
+	uint8_t			sync_retries; /* number retries to sync */
+	uint8_t			sync_pending; /* to prevent double sync req. */
+	struct gsm48_sysinfo	*si; /* current sysinfo of tuned cell */
+	uint8_t			tuned; /* if a cell is selected */
+	struct osmo_timer_list	any_timer; /* restart search 'any cell' */
+
+	/* serving cell */
+	uint8_t			selected; /* if a cell is selected */
+	uint16_t		sel_arfcn; /* current selected serving cell! */
+	struct gsm48_sysinfo	sel_si; /* copy of selected cell, will update */
+	uint16_t		sel_mcc, sel_mnc, sel_lac, sel_id;
+
+	/* cell re-selection */
+	struct llist_head	nb_list; /* list of neighbour cells */
+	uint16_t		last_serving_arfcn; /* the ARFCN of last cell */
+	uint8_t			last_serving_valid; /* there is a last cell */
+	struct gsm322_neighbour	*neighbour; /* when selecting neighbour cell */
+	time_t			resel_when; /* timestamp of last re-selection */
+	int8_t			nb_meas_set;
+	int16_t			rxlev_sum_dbm; /* sum of received levels */
+	uint8_t			rxlev_count; /* number of received levels */
+	int8_t			rla_c_dbm; /* average of received level */
+	uint8_t			c12_valid; /* both C1 and C2 values are
+						calculated */
+	int16_t			c1, c2;
+	uint8_t			prio_low;
+};
+
+/* GSM 03.22 message */
+struct gsm322_msg {
+	int			msg_type;
+	uint16_t		mcc, mnc;
+	uint8_t			sysinfo; /* system information type */
+	uint8_t			same_cell; /* select same cell when RET_IDLE */
+	uint8_t			reject; /* location update reject cause */
+	uint8_t			limited; /* trigger search for limited serv. */
+};
+
+#define	GSM322_ALLOC_SIZE	sizeof(struct gsm322_msg)
+#define GSM322_ALLOC_HEADROOM	0
+
+uint16_t index2arfcn(int index);
+int arfcn2index(uint16_t arfcn);
+int gsm322_init(struct osmocom_ms *ms);
+int gsm322_exit(struct osmocom_ms *ms);
+struct msgb *gsm322_msgb_alloc(int msg_type);
+int gsm322_plmn_sendmsg(struct osmocom_ms *ms, struct msgb *msg);
+int gsm322_cs_sendmsg(struct osmocom_ms *ms, struct msgb *msg);
+int gsm322_c_event(struct osmocom_ms *ms, struct msgb *msg);
+int gsm322_plmn_dequeue(struct osmocom_ms *ms);
+int gsm322_cs_dequeue(struct osmocom_ms *ms);
+int gsm322_add_forbidden_la(struct osmocom_ms *ms, uint16_t mcc,
+	uint16_t mnc, uint16_t lac, uint8_t cause);
+int gsm322_del_forbidden_la(struct osmocom_ms *ms, uint16_t mcc,
+	uint16_t mnc, uint16_t lac);
+int gsm322_is_forbidden_la(struct osmocom_ms *ms, uint16_t mcc, uint16_t mnc,
+	uint16_t lac);
+int gsm322_dump_sorted_plmn(struct osmocom_ms *ms);
+int gsm322_dump_cs_list(struct gsm322_cellsel *cs, uint8_t flags,
+			void (*print)(void *, const char *, ...), void *priv);
+int gsm322_dump_forbidden_la(struct osmocom_ms *ms,
+			void (*print)(void *, const char *, ...), void *priv);
+int gsm322_dump_ba_list(struct gsm322_cellsel *cs, uint16_t mcc, uint16_t mnc,
+			void (*print)(void *, const char *, ...), void *priv);
+int gsm322_dump_nb_list(struct gsm322_cellsel *cs,
+                        void (*print)(void *, const char *, ...), void *priv);
+void start_cs_timer(struct gsm322_cellsel *cs, int sec, int micro);
+void start_loss_timer(struct gsm322_cellsel *cs, int sec, int micro);
+const char *get_a_state_name(int value);
+const char *get_m_state_name(int value);
+const char *get_cs_state_name(int value);
+int gsm322_l1_signal(unsigned int subsys, unsigned int signal,
+		     void *handler_data, void *signal_data);
+
+int gsm322_meas(struct osmocom_ms *ms, uint8_t rx_lev);
+
+char *gsm_print_rxlev(uint8_t rxlev);
+
+
+#endif /* _GSM322_H */
diff --git a/src/host/layer23/include/osmocom/bb/mobile/gsm411_sms.h b/src/host/layer23/include/osmocom/bb/mobile/gsm411_sms.h
new file mode 100644
index 00000000..3ed6710c
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/gsm411_sms.h
@@ -0,0 +1,41 @@
+#ifndef _GSM411_SMS_H
+#define _GSM411_SMS_H
+
+#define SMS_HDR_SIZE	128
+#define SMS_TEXT_SIZE	256
+
+#include <stdint.h>
+#include <time.h>
+
+struct osmocom_ms;
+struct msgb;
+
+struct gsm_sms {
+	unsigned long validity_minutes;
+	uint8_t reply_path_req;
+	uint8_t status_rep_req;
+	uint8_t ud_hdr_ind;
+	uint8_t protocol_id;
+	uint8_t data_coding_scheme;
+	uint8_t msg_ref;
+	char address[20+1];	/* DA LV is 12 bytes max, i.e. 10 bytes
+				 * BCD == 20 bytes string */
+	time_t time;
+	uint8_t user_data_len;
+	uint8_t user_data[SMS_TEXT_SIZE];
+
+	char text[SMS_TEXT_SIZE];
+};
+
+int gsm411_sms_init(struct osmocom_ms *ms);
+int gsm411_sms_exit(struct osmocom_ms *ms);
+struct gsm_sms *sms_alloc(void);
+void sms_free(struct gsm_sms *sms);
+struct gsm_sms *sms_from_text(const char *receiver, int dcs, const char *text);
+int gsm411_rcv_sms(struct osmocom_ms *ms, struct msgb *msg);
+int sms_send(struct osmocom_ms *ms, const char *sms_sca, const char *number,
+	const char *text, uint8_t msg_ref);
+int gsm411_tx_sms_submit(struct osmocom_ms *ms, const char *sms_sca,
+	struct gsm_sms *sms);
+
+#endif /* _GSM411_SMS_H */
diff --git a/src/host/layer23/include/osmocom/bb/mobile/gsm480_ss.h b/src/host/layer23/include/osmocom/bb/mobile/gsm480_ss.h
new file mode 100644
index 00000000..ecd778e4
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/gsm480_ss.h
@@ -0,0 +1,9 @@
+#ifndef _GSM480_SS_H
+#define _GSM480_SS_H
+
+int gsm480_ss_init(struct osmocom_ms *ms);
+int gsm480_ss_exit(struct osmocom_ms *ms);
+int gsm480_rcv_ss(struct osmocom_ms *ms, struct msgb *msg);
+int ss_send(struct osmocom_ms *ms, const char *code, int new_trans);
+
+#endif /* _GSM480_SS_H */
diff --git a/src/host/layer23/include/osmocom/bb/mobile/gsm48_cc.h b/src/host/layer23/include/osmocom/bb/mobile/gsm48_cc.h
new file mode 100644
index 00000000..282ffe5b
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/gsm48_cc.h
@@ -0,0 +1,18 @@
+#ifndef _GSM48_CC_H
+#define _GSM48_CC_H
+
+struct gsm48_cclayer {
+        struct osmocom_ms       *ms;
+
+	struct llist_head	mncc_upqueue;
+};
+
+int gsm48_cc_init(struct osmocom_ms *ms);
+int gsm48_cc_exit(struct osmocom_ms *ms);
+int gsm48_rcv_cc(struct osmocom_ms *ms, struct msgb *msg);
+int mncc_dequeue(struct osmocom_ms *ms);
+int mncc_tx_to_cc(void *inst, int msg_type, void *arg);
+int mncc_clear_trans(void *inst, uint8_t protocol);
+
+#endif /* _GSM48_CC_H */
+
diff --git a/src/host/layer23/include/osmocom/bb/mobile/gsm48_mm.h b/src/host/layer23/include/osmocom/bb/mobile/gsm48_mm.h
new file mode 100644
index 00000000..6e9c197c
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/gsm48_mm.h
@@ -0,0 +1,236 @@
+#ifndef _GSM48_MM_H
+#define _GSM48_MM_H
+
+/* GSM 04.07 9.2.2 */
+#define GSM48_MMXX_MASK			0xf00
+#define GSM48_MMCC_CLASS		0x100
+#define GSM48_MMSS_CLASS		0x200
+#define GSM48_MMSMS_CLASS		0x300
+#define GSM48_MMCC_EST_REQ		0x110
+#define GSM48_MMCC_EST_IND		0x112
+#define GSM48_MMCC_EST_CNF		0x111
+#define GSM48_MMCC_REL_REQ		0x120
+#define GSM48_MMCC_REL_IND		0x122
+#define GSM48_MMCC_DATA_REQ		0x130
+#define GSM48_MMCC_DATA_IND		0x132
+#define GSM48_MMCC_UNIT_DATA_REQ	0x140
+#define GSM48_MMCC_UNIT_DATA_IND	0x142
+#define GSM48_MMCC_SYNC_IND		0x152
+#define GSM48_MMCC_REEST_REQ		0x160
+#define GSM48_MMCC_REEST_CNF		0x161
+#define GSM48_MMCC_ERR_IND		0x172
+#define GSM48_MMCC_PROMPT_IND		0x182
+#define GSM48_MMCC_PROMPT_REJ		0x184
+#define GSM48_MMSS_EST_REQ		0x210
+#define GSM48_MMSS_EST_IND		0x212
+#define GSM48_MMSS_EST_CNF		0x211
+#define GSM48_MMSS_REL_REQ		0x220
+#define GSM48_MMSS_REL_IND		0x222
+#define GSM48_MMSS_DATA_REQ		0x230
+#define GSM48_MMSS_DATA_IND		0x232
+#define GSM48_MMSS_UNIT_DATA_REQ	0x240
+#define GSM48_MMSS_UNIT_DATA_IND	0x242
+#define GSM48_MMSS_REEST_REQ		0x260
+#define GSM48_MMSS_REEST_CNF		0x261
+#define GSM48_MMSS_ERR_IND		0x272
+#define GSM48_MMSS_PROMPT_IND		0x282
+#define GSM48_MMSS_PROMPT_REJ		0x284
+#define GSM48_MMSMS_EST_REQ		0x310
+#define GSM48_MMSMS_EST_IND		0x312
+#define GSM48_MMSMS_EST_CNF		0x311
+#define GSM48_MMSMS_REL_REQ		0x320
+#define GSM48_MMSMS_REL_IND		0x322
+#define GSM48_MMSMS_DATA_REQ		0x330
+#define GSM48_MMSMS_DATA_IND		0x332
+#define GSM48_MMSMS_UNIT_DATA_REQ	0x340
+#define GSM48_MMSMS_UNIT_DATA_IND	0x342
+#define GSM48_MMSMS_REEST_REQ		0x360
+#define GSM48_MMSMS_REEST_CNF		0x361
+#define GSM48_MMSMS_ERR_IND		0x372
+#define GSM48_MMSMS_PROMPT_IND		0x382
+#define GSM48_MMSMS_PROMPT_REJ		0x384
+
+#define MMXX_ALLOC_SIZE			256
+#define MMXX_ALLOC_HEADROOM		64
+
+/* MMxx-SAP header */
+struct gsm48_mmxx_hdr {
+	int		msg_type; /* MMxx_* primitive */
+	uint32_t	ref; /* reference to transaction */
+	uint32_t	transaction_id; /* transaction identifier */
+	uint8_t		sapi; /* sapi */
+	uint8_t		emergency; /* emergency type of call */
+	uint8_t		cause; /* cause used for release */
+};
+
+/* GSM 6.1.2 */
+#define	GSM48_MMR_REG_REQ		0x01
+#define	GSM48_MMR_REG_CNF		0x02
+#define	GSM48_MMR_NREG_REQ		0x03
+#define	GSM48_MMR_NREG_IND		0x04
+
+/* MMR-SAP header */
+struct gsm48_mmr {
+	int		msg_type;
+
+	uint8_t		cause;
+};
+
+/* GSM 04.07 9.2.1 */
+#define GSM48_MMXX_ST_IDLE		0
+#define GSM48_MMXX_ST_CONN_PEND		1
+#define GSM48_MMXX_ST_DEDICATED		2
+#define GSM48_MMXX_ST_CONN_SUSP		3
+#define GSM48_MMXX_ST_REESTPEND		4
+
+/* GSM 04.08 4.1.2.1 */
+#define	GSM48_MM_ST_NULL		0
+#define GSM48_MM_ST_LOC_UPD_INIT	3
+#define GSM48_MM_ST_WAIT_OUT_MM_CONN	5
+#define GSM48_MM_ST_MM_CONN_ACTIVE	6
+#define GSM48_MM_ST_IMSI_DETACH_INIT	7
+#define GSM48_MM_ST_PROCESS_CM_SERV_P	8
+#define GSM48_MM_ST_WAIT_NETWORK_CMD	9
+#define GSM48_MM_ST_LOC_UPD_REJ		10
+#define GSM48_MM_ST_WAIT_RR_CONN_LUPD	13
+#define GSM48_MM_ST_WAIT_RR_CONN_MM_CON	14
+#define GSM48_MM_ST_WAIT_RR_CONN_IMSI_D	15
+#define GSM48_MM_ST_WAIT_REEST		17
+#define GSM48_MM_ST_WAIT_RR_ACTIVE	18
+#define GSM48_MM_ST_MM_IDLE		19
+#define GSM48_MM_ST_WAIT_ADD_OUT_MM_CON	20
+#define GSM48_MM_ST_MM_CONN_ACTIVE_VGCS	21
+#define GSM48_MM_ST_WAIT_RR_CONN_VGCS	22
+#define GSM48_MM_ST_LOC_UPD_PEND	23
+#define GSM48_MM_ST_IMSI_DETACH_PEND	24
+#define GSM48_MM_ST_RR_CONN_RELEASE_NA	25
+
+/* GSM 04.08 4.1.2.1 */
+#define GSM48_MM_SST_NORMAL_SERVICE	1
+#define GSM48_MM_SST_ATTEMPT_UPDATE	2
+#define GSM48_MM_SST_LIMITED_SERVICE	3
+#define GSM48_MM_SST_NO_IMSI		4
+#define GSM48_MM_SST_NO_CELL_AVAIL	5
+#define GSM48_MM_SST_LOC_UPD_NEEDED	6
+#define GSM48_MM_SST_PLMN_SEARCH	7
+#define GSM48_MM_SST_PLMN_SEARCH_NORMAL	8
+#define GSM48_MM_SST_RX_VGCS_NORMAL	9
+#define GSM48_MM_SST_RX_VGCS_LIMITED	10
+
+/* MM events */
+#define GSM48_MM_EVENT_CELL_SELECTED	1
+#define GSM48_MM_EVENT_NO_CELL_FOUND	2
+#define GSM48_MM_EVENT_TIMEOUT_T3210	3
+#define GSM48_MM_EVENT_TIMEOUT_T3211	4
+#define GSM48_MM_EVENT_TIMEOUT_T3212	5
+#define GSM48_MM_EVENT_TIMEOUT_T3213	6
+#define GSM48_MM_EVENT_TIMEOUT_T3220	7
+#define GSM48_MM_EVENT_TIMEOUT_T3230	8
+#define GSM48_MM_EVENT_TIMEOUT_T3240	9
+#define GSM48_MM_EVENT_IMSI_DETACH	10
+#define GSM48_MM_EVENT_POWER_OFF	11
+#define GSM48_MM_EVENT_PAGING		12
+#define GSM48_MM_EVENT_AUTH_RESPONSE	13
+#define GSM48_MM_EVENT_SYSINFO		14
+#define GSM48_MM_EVENT_USER_PLMN_SEL	15
+#define GSM48_MM_EVENT_LOST_COVERAGE	16
+
+/* message for MM events */
+struct gsm48_mm_event {
+	uint32_t	msg_type;
+
+	uint8_t		sres[4];
+};
+
+/* GSM 04.08 MM timers */
+#define GSM_T3210_MS    20, 0
+#define GSM_T3211_MS    15, 0
+/* T3212 is given by SYSTEM INFORMATION */
+#define GSM_T3213_MS    4, 0
+#define GSM_T3220_MS    5, 0
+#define GSM_T3230_MS    15, 0
+#define GSM_T3240_MS    10, 0
+#define GSM_T3241_MS    300, 0
+
+/* MM sublayer instance */
+struct gsm48_mmlayer {
+	struct osmocom_ms	*ms;
+	int			state;
+	int			substate;
+
+	/* queue for RR-SAP, MMxx-SAP, MMR-SAP, events message upwards */
+	struct llist_head       rr_upqueue;
+	struct llist_head       mmxx_upqueue;
+	struct llist_head       mmr_downqueue;
+	struct llist_head       event_queue;
+
+	/* timers */
+	struct osmo_timer_list	t3210, t3211, t3212, t3213;
+	struct osmo_timer_list	t3220, t3230, t3240;
+	int			t3212_value;
+	int			start_t3211; /* remember to start timer */
+
+	/* list of MM connections */
+	struct llist_head	mm_conn;
+
+	/* network name */
+	char			name_short[32];
+	char			name_long[32];
+
+	/* location update */
+	uint8_t			lupd_pending;	/* current pending loc. upd. */
+	uint8_t			lupd_type;	/* current coded type */
+	uint8_t			lupd_attempt;	/* attempt counter */
+	uint8_t			lupd_ra_failure;/* random access failed */
+	uint8_t			lupd_rej_cause;	/* cause of last reject */
+	uint8_t			lupd_periodic;	/* periodic update pending */
+	uint8_t			lupd_retry;	/* pending T3211/T3213 to */
+	uint16_t		lupd_mcc, lupd_mnc, lupd_lac;
+
+	/* imsi detach */
+	uint8_t			delay_detach;	/* do detach when possible */
+
+	/* other */
+	uint8_t			est_cause; /* cause of establishment msg */
+	int			mr_substate;	/* rem most recent substate */
+	uint8_t			power_off_idle; /* waits for IDLE before po */
+
+	/* sapi 3 */
+	int			sapi3_link;
+};
+
+/* MM connection entry */
+struct gsm48_mm_conn {
+	struct llist_head	list;
+	struct gsm48_mmlayer	*mm;
+
+	/* ref and type form a unique tupple */
+	uint32_t		ref; /* reference to trans */
+	uint8_t			protocol;
+	uint8_t			transaction_id;
+	uint8_t			sapi;
+
+	int			state;
+};
+
+uint8_t gsm48_current_pwr_lev(struct gsm_settings *set, uint16_t arfcn);
+int gsm48_mm_init(struct osmocom_ms *ms);
+int gsm48_mm_exit(struct osmocom_ms *ms);
+struct msgb *gsm48_mmr_msgb_alloc(int msg_type);
+struct msgb *gsm48_mmevent_msgb_alloc(int msg_type);
+int gsm48_mmevent_msg(struct osmocom_ms *ms, struct msgb *msg);
+int gsm48_mmr_downmsg(struct osmocom_ms *ms, struct msgb *msg);
+int gsm48_rr_dequeue(struct osmocom_ms *ms);
+int gsm48_mmxx_dequeue(struct osmocom_ms *ms);
+int gsm48_mmr_dequeue(struct osmocom_ms *ms);
+int gsm48_mmevent_dequeue(struct osmocom_ms *ms);
+int gsm48_mmxx_downmsg(struct osmocom_ms *ms, struct msgb *msg);
+struct msgb *gsm48_mmxx_msgb_alloc(int msg_type, uint32_t ref,
+	uint8_t transaction_id, uint8_t sapi);
+const char *get_mmr_name(int value);
+const char *get_mm_name(int value);
+const char *get_mmxx_name(int value);
+extern const char *gsm48_mm_state_names[];
+extern const char *gsm48_mm_substate_names[];
+
+#endif /* _GSM48_MM_H */
diff --git a/src/host/layer23/include/osmocom/bb/mobile/gsm48_rr.h b/src/host/layer23/include/osmocom/bb/mobile/gsm48_rr.h
new file mode 100644
index 00000000..6235bfdb
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/gsm48_rr.h
@@ -0,0 +1,215 @@
+#ifndef _GSM48_RR_H
+#define _GSM48_RR_H
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+#define GSM_TA_CM			55385
+
+#define	T200_DCCH			1	/* SDCCH/FACCH */
+#define	T200_DCCH_SHARED		2	/* SDCCH shares SAPI 0 and 3 */
+#define	T200_ACCH			2	/* SACCH SAPI 3 */
+
+
+/* GSM 04.07 9.1.2 */
+#define	GSM48_RR_EST_REQ		0x10
+#define	GSM48_RR_EST_IND		0x12
+#define	GSM48_RR_EST_CNF		0x11
+#define	GSM48_RR_REL_IND		0x22
+#define	GSM48_RR_SYNC_IND		0x32
+#define	GSM48_RR_DATA_REQ		0x40
+#define	GSM48_RR_DATA_IND		0x42
+#define	GSM48_RR_UNIT_DATA_IND		0x52
+#define	GSM48_RR_ABORT_REQ		0x60
+#define	GSM48_RR_ABORT_IND		0x62
+#define	GSM48_RR_ACT_REQ		0x70
+
+#define RR_EST_CAUSE_EMERGENCY		1
+#define RR_EST_CAUSE_REESTAB_TCH_F	2
+#define RR_EST_CAUSE_REESTAB_TCH_H	3
+#define RR_EST_CAUSE_REESTAB_2_TCH_H	4
+#define RR_EST_CAUSE_ANS_PAG_ANY	5
+#define RR_EST_CAUSE_ANS_PAG_SDCCH	6
+#define RR_EST_CAUSE_ANS_PAG_TCH_F	7
+#define RR_EST_CAUSE_ANS_PAG_TCH_ANY	8
+#define RR_EST_CAUSE_ORIG_TCHF		9
+#define RR_EST_CAUSE_LOC_UPD		12
+#define RR_EST_CAUSE_OTHER_SDCCH	13
+
+#define RR_REL_CAUSE_UNDEFINED		0
+#define RR_REL_CAUSE_NORMAL		1
+#define RR_REL_CAUSE_NOT_AUTHORIZED	2
+#define RR_REL_CAUSE_RA_FAILURE		3
+#define RR_REL_CAUSE_T3122		4
+#define RR_REL_CAUSE_TRY_LATER		5
+#define RR_REL_CAUSE_EMERGENCY_ONLY	6
+#define RR_REL_CAUSE_LOST_SIGNAL	7
+#define RR_REL_CAUSE_LINK_FAILURE	8
+
+#define RR_SYNC_CAUSE_CIPHERING		1
+
+#define L3_ALLOC_SIZE			256
+#define L3_ALLOC_HEADROOM		64
+
+#define RSL_ALLOC_SIZE			256
+#define RSL_ALLOC_HEADROOM		64
+
+#define RR_ALLOC_SIZE			256
+#define RR_ALLOC_HEADROOM		64
+
+/* GSM 04.08 RR-SAP header */
+struct gsm48_rr_hdr {
+	uint32_t		msg_type; /* RR-* primitive */
+	uint8_t			sapi;
+	uint8_t			cause;
+};
+
+/* GSM 04.07 9.1.1 */
+#define GSM48_RR_ST_IDLE		0
+#define GSM48_RR_ST_CONN_PEND		1
+#define GSM48_RR_ST_DEDICATED		2
+#define GSM48_RR_ST_REL_PEND		3
+
+/* special states for SAPI 3 link */
+#define GSM48_RR_SAPI3ST_IDLE		0
+#define GSM48_RR_SAPI3ST_WAIT_EST	1
+#define GSM48_RR_SAPI3ST_ESTAB		2
+#define GSM48_RR_SAPI3ST_WAIT_REL	3
+
+/* modify state */
+#define GSM48_RR_MOD_NONE		0
+#define GSM48_RR_MOD_IMM_ASS		1
+#define GSM48_RR_MOD_ASSIGN		2
+#define GSM48_RR_MOD_HANDO		3
+#define GSM48_RR_MOD_ASSIGN_RESUME	4
+#define GSM48_RR_MOD_HANDO_RESUME	5
+
+/* channel description */
+struct gsm48_rr_cd {
+	uint8_t			tsc;
+	uint8_t			h; /* using hopping */
+	uint16_t		arfcn; /* dedicated mode */
+	uint8_t			maio;
+	uint8_t			hsn;
+	uint8_t			chan_nr; /* type, slot, sub slot */
+	uint8_t			ind_tx_power; /* last indicated power */
+	uint8_t			ind_ta; /* last indicated ta */
+	uint8_t			mob_alloc_lv[9]; /* len + up to 64 bits */
+	uint8_t			freq_list_lv[131]; /* len + 130 octets */
+	uint8_t			freq_seq_lv[10]; /* len + 9 octets */
+	uint8_t			cell_desc_lv[17]; /* len + 16 octets */
+	uint8_t			start; /* start time available */
+	struct gsm_time		start_tm; /* start time */
+	uint8_t			mode; /* mode of channel */
+	uint8_t			cipher; /* ciphering of channel */
+};
+
+struct gsm48_cr_hist {
+	uint8_t			valid;
+	struct gsm48_req_ref	ref;
+};
+
+/* neighbor cell measurements */
+struct gsm48_rr_meas {
+	/* note: must be sorted by arfcn 1..1023,0 according to SI5* */
+	uint8_t nc_num; /* number of measured cells (32 max) */
+	int8_t nc_rxlev_dbm[32]; /* -128 = no value */
+	uint8_t nc_bsic[32];
+	uint16_t nc_arfcn[32];
+};
+
+/* RR sublayer instance */
+struct gsm48_rrlayer {
+	struct osmocom_ms	*ms;
+	int			state;
+
+	/* queue for RSL-SAP message upwards */
+	struct llist_head	rsl_upqueue;
+
+	/* queue for messages while RR connection is built up */
+	struct llist_head       downqueue;
+
+	/* timers */
+	struct osmo_timer_list	t_starting; /* starting time for chan. access */
+	struct osmo_timer_list	t_rel_wait; /* wait for L2 to transmit UA */
+	struct osmo_timer_list	t3110;
+	struct osmo_timer_list	t3122;
+	struct osmo_timer_list	t3124;
+	struct osmo_timer_list	t3126;
+	int			t3126_value;
+#ifndef TODO
+	struct osmo_timer_list	temp_rach_ti; /* temporary timer */
+#endif
+
+	/* states if RR-EST-REQ was used */
+	uint8_t			rr_est_req;
+	struct msgb		*rr_est_msg;
+	uint8_t			est_cause; /* cause used for establishment */
+	uint8_t			paging_mi_type; /* how did we got paged? */
+
+	/* channel request states */
+	uint8_t			wait_assign; /* waiting for assignment state */
+	uint8_t			n_chan_req; /* number left, incl. current */
+	uint8_t			chan_req_val; /* current request value */ 
+	uint8_t			chan_req_mask; /* mask of random bits */
+
+	/* state of dedicated mdoe */
+	uint8_t			dm_est;
+
+	/* cr_hist */
+	uint8_t			cr_ra; /* stores requested ra until confirmed */
+	struct gsm48_cr_hist	cr_hist[3];
+
+	/* V(SD) sequence numbers */
+	uint16_t		v_sd; /* 16 PD 1-bit sequence numbers packed */
+
+	/* current channel descriptions */
+	struct gsm48_rr_cd	cd_now;
+
+	/* current cipering */
+	uint8_t			cipher_on;
+	uint8_t			cipher_type; /* 10.5.2.9 */
+
+	/* special states when assigning channel */
+	uint8_t			modify_state;
+	uint8_t			hando_sync_ind, hando_rot, hando_nci, hando_act;
+	struct gsm48_rr_cd	cd_last; /* store last cd in case of failure */
+	struct gsm48_rr_cd	cd_before; /* before start time */
+	struct gsm48_rr_cd	cd_after; /* after start time */
+
+	/* BA range */
+	uint8_t			ba_ranges;
+	uint32_t		ba_range[16];
+
+	/* measurements */
+	struct osmo_timer_list	t_meas;
+	struct gsm48_rr_meas	meas;
+	uint8_t			monitor;
+
+	/* audio flow */
+	uint8_t                 audio_mode;
+
+	/* sapi 3 */
+	uint8_t			sapi3_state;
+	uint8_t			sapi3_link_id;
+};
+
+const char *get_rr_name(int value);
+extern int gsm48_rr_init(struct osmocom_ms *ms);
+extern int gsm48_rr_exit(struct osmocom_ms *ms);
+int gsm48_rsl_dequeue(struct osmocom_ms *ms);
+int gsm48_rr_downmsg(struct osmocom_ms *ms, struct msgb *msg);
+struct msgb *gsm48_l3_msgb_alloc(void);
+struct msgb *gsm48_rr_msgb_alloc(int msg_type);
+int gsm48_rr_enc_cm2(struct osmocom_ms *ms, struct gsm48_classmark2 *cm,
+	uint16_t arfcn);
+int gsm48_rr_tx_rand_acc(struct osmocom_ms *ms, struct msgb *msg);
+int gsm48_rr_los(struct osmocom_ms *ms);
+int gsm48_rr_rach_conf(struct osmocom_ms *ms, uint32_t fn);
+extern const char *gsm48_rr_state_names[];
+int gsm48_rr_start_monitor(struct osmocom_ms *ms);
+int gsm48_rr_stop_monitor(struct osmocom_ms *ms);
+int gsm48_rr_alter_delay(struct osmocom_ms *ms);
+int gsm48_rr_tx_voice(struct osmocom_ms *ms, struct msgb *msg);
+int gsm48_rr_audio_mode(struct osmocom_ms *ms, uint8_t mode);
+
+#endif /* _GSM48_RR_H */
diff --git a/src/host/layer23/include/osmocom/bb/mobile/mncc.h b/src/host/layer23/include/osmocom/bb/mobile/mncc.h
new file mode 100644
index 00000000..8ec9358d
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/mncc.h
@@ -0,0 +1,179 @@
+/* GSM Mobile Radio Interface Layer 3 messages on the A-bis interface 
+ * 3GPP TS 04.08 version 7.21.0 Release 1998 / ETSI TS 100 940 V7.21.0 */
+
+/* (C) 2008-2009 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2008, 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef _MNCC_H
+#define _MNCC_H
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/gsm/mncc.h>
+
+struct gsm_call {
+	struct llist_head	entry;
+
+	struct osmocom_ms	*ms;
+
+	uint32_t		callref;
+
+	bool			init; /* call initiated, no response yet */
+	bool			hold; /* call on hold */
+	bool			ring; /* call ringing/knocking */
+
+	struct osmo_timer_list	dtmf_timer;
+	uint8_t			dtmf_state;
+	uint8_t			dtmf_index;
+	char			dtmf[32]; /* dtmf sequence */
+};
+
+#define DTMF_ST_IDLE		0	/* no DTMF active */
+#define DTMF_ST_START		1	/* DTMF started, waiting for resp. */
+#define DTMF_ST_MARK		2	/* wait tone duration */
+#define DTMF_ST_STOP		3	/* DTMF stopped, waiting for resp. */
+#define DTMF_ST_SPACE		4	/* wait space between tones */
+
+#define MNCC_SETUP_REQ		0x0101
+#define MNCC_SETUP_IND		0x0102
+#define MNCC_SETUP_RSP		0x0103
+#define MNCC_SETUP_CNF		0x0104
+#define MNCC_SETUP_COMPL_REQ	0x0105
+#define MNCC_SETUP_COMPL_IND	0x0106
+/* MNCC_REJ_* is perfomed via MNCC_REL_* */
+#define MNCC_CALL_CONF_IND	0x0107
+#define MNCC_CALL_PROC_REQ	0x0108
+#define MNCC_PROGRESS_REQ	0x0109
+#define MNCC_ALERT_REQ		0x010a
+#define MNCC_ALERT_IND		0x010b
+#define MNCC_NOTIFY_REQ		0x010c
+#define MNCC_NOTIFY_IND		0x010d
+#define MNCC_DISC_REQ		0x010e
+#define MNCC_DISC_IND		0x010f
+#define MNCC_REL_REQ		0x0110
+#define MNCC_REL_IND		0x0111
+#define MNCC_REL_CNF		0x0112
+#define MNCC_FACILITY_REQ	0x0113
+#define MNCC_FACILITY_IND	0x0114
+#define MNCC_START_DTMF_IND	0x0115
+#define MNCC_START_DTMF_RSP	0x0116
+#define MNCC_START_DTMF_REJ	0x0117
+#define MNCC_STOP_DTMF_IND	0x0118
+#define MNCC_STOP_DTMF_RSP	0x0119
+#define MNCC_MODIFY_REQ		0x011a
+#define MNCC_MODIFY_IND		0x011b
+#define MNCC_MODIFY_RSP		0x011c
+#define MNCC_MODIFY_CNF		0x011d
+#define MNCC_MODIFY_REJ		0x011e
+#define MNCC_HOLD_IND		0x011f
+#define MNCC_HOLD_CNF		0x0120
+#define MNCC_HOLD_REJ		0x0121
+#define MNCC_RETRIEVE_IND	0x0122
+#define MNCC_RETRIEVE_CNF	0x0123
+#define MNCC_RETRIEVE_REJ	0x0124
+#define MNCC_USERINFO_REQ	0x0125
+#define MNCC_USERINFO_IND	0x0126
+#define MNCC_REJ_REQ		0x0127
+#define MNCC_REJ_IND		0x0128
+#define MNCC_PROGRESS_IND	0x0129
+#define MNCC_CALL_PROC_IND	0x012a
+#define MNCC_CALL_CONF_REQ	0x012b
+#define MNCC_START_DTMF_REQ	0x012c
+#define MNCC_STOP_DTMF_REQ	0x012d
+#define MNCC_HOLD_REQ		0x012e
+#define MNCC_RETRIEVE_REQ	0x012f
+
+#define MNCC_BRIDGE		0x0200
+#define MNCC_FRAME_RECV		0x0201
+#define MNCC_FRAME_DROP		0x0202
+#define MNCC_LCHAN_MODIFY	0x0203
+
+#define GSM_TCHF_FRAME		0x0300
+#define GSM_TCHF_FRAME_EFR	0x0301
+
+#define GSM_MAX_FACILITY	128
+#define GSM_MAX_SSVERSION	128
+#define GSM_MAX_USERUSER	128
+
+#define	MNCC_F_BEARER_CAP	0x0001
+#define MNCC_F_CALLED		0x0002
+#define MNCC_F_CALLING		0x0004
+#define MNCC_F_REDIRECTING	0x0008
+#define MNCC_F_CONNECTED	0x0010
+#define MNCC_F_CAUSE		0x0020
+#define MNCC_F_USERUSER		0x0040
+#define MNCC_F_PROGRESS		0x0080
+#define MNCC_F_EMERGENCY	0x0100
+#define MNCC_F_FACILITY		0x0200
+#define MNCC_F_SSVERSION	0x0400
+#define MNCC_F_CCCAP		0x0800
+#define MNCC_F_KEYPAD		0x1000
+#define MNCC_F_SIGNAL		0x2000
+
+struct gsm_mncc {
+	/* context based information */
+	uint32_t	msg_type;
+	uint32_t	callref;
+
+	/* which fields are present */
+	uint32_t	fields;
+
+	/* data derived informations (MNCC_F_ based) */
+	struct gsm_mncc_bearer_cap	bearer_cap;
+	struct gsm_mncc_number		called;
+	struct gsm_mncc_number		calling;
+	struct gsm_mncc_number		redirecting;
+	struct gsm_mncc_number		connected;
+	struct gsm_mncc_cause		cause;
+	struct gsm_mncc_progress	progress;
+	struct gsm_mncc_useruser	useruser;
+	struct gsm_mncc_facility	facility;
+	struct gsm_mncc_cccap		cccap;
+	struct gsm_mncc_ssversion	ssversion;
+	struct	{
+		int		sup;
+		int		inv;
+	} clir;
+	int		signal;
+
+	/* data derived information, not MNCC_F based */
+	int		keypad;
+	int		more;
+	int		notify; /* 0..127 */
+	int		emergency;
+	char		imsi[16];
+
+	unsigned char	lchan_type;
+	unsigned char	lchan_mode;
+};
+
+struct gsm_data_frame {
+	uint32_t	msg_type;
+	uint32_t	callref;
+	unsigned char	data[0];
+};
+
+const char *get_mncc_name(int value);
+int mncc_recv(struct osmocom_ms *ms, int msg_type, void *arg);
+void mncc_set_cause(struct gsm_mncc *data, int loc, int val);
+
+#endif
+
diff --git a/src/host/layer23/include/osmocom/bb/mobile/mncc_ms.h b/src/host/layer23/include/osmocom/bb/mobile/mncc_ms.h
new file mode 100644
index 00000000..49ce1a42
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/mncc_ms.h
@@ -0,0 +1,9 @@
+#pragma once
+
+int mncc_call(struct osmocom_ms *ms, char *number);
+int mncc_hangup(struct osmocom_ms *ms);
+int mncc_answer(struct osmocom_ms *ms);
+int mncc_hold(struct osmocom_ms *ms);
+int mncc_retrieve(struct osmocom_ms *ms, int number);
+int mncc_dtmf(struct osmocom_ms *ms, char *dtmf);
+
diff --git a/src/host/layer23/include/osmocom/bb/mobile/mncc_sock.h b/src/host/layer23/include/osmocom/bb/mobile/mncc_sock.h
new file mode 100644
index 00000000..9116ea3f
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/mncc_sock.h
@@ -0,0 +1,16 @@
+#ifndef _MNCC_SOCK_H
+#define _MNCC_SOCK_H
+
+struct mncc_sock_state {
+	void *inst;
+	struct osmo_fd listen_bfd;	/* fd for listen socket */
+	struct osmo_fd conn_bfd;		/* fd for connection to lcr */
+	struct llist_head upqueue;
+};
+
+int mncc_sock_from_cc(struct mncc_sock_state *state, struct msgb *msg);
+void mncc_sock_write_pending(struct mncc_sock_state *state);
+struct mncc_sock_state *mncc_sock_init(void *inst, const char *name);
+void mncc_sock_exit(struct mncc_sock_state *state);
+
+#endif /* _MNCC_SOCK_H */
diff --git a/src/host/layer23/include/osmocom/bb/mobile/primitives.h b/src/host/layer23/include/osmocom/bb/mobile/primitives.h
new file mode 100644
index 00000000..f07ae244
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/primitives.h
@@ -0,0 +1,103 @@
+#pragma once
+
+#include <osmocom/bb/mobile/gsm411_sms.h>
+
+#include <osmocom/core/prim.h>
+
+struct mobile_prim;
+
+/**
+ * Mobile Script<->App primitives. Application script will receive
+ * indications and will send primitives to the lower layers. Here
+ * we will convert from internal state/events to the primitives. In
+ * the future the indications might be generated at lower levels
+ * directly.
+ */
+enum mobile_prims {
+	PRIM_MOB_TIMER,
+	PRIM_MOB_TIMER_CANCEL,
+	PRIM_MOB_STARTED,
+	PRIM_MOB_SHUTDOWN,
+	PRIM_MOB_SMS,
+	PRIM_MOB_MM,
+	PRIM_MOB_NETWORK_RESELECT,
+};
+
+struct mobile_prim_intf {
+	struct osmocom_ms *ms;
+	void (*indication)(struct mobile_prim_intf *, struct mobile_prim *prim);
+
+	/* Internal state */
+	struct llist_head entry;
+	struct llist_head timers;
+};
+
+/**
+ * Primitive to create timers and get indication once they have
+ * expired. Currently there is no way to cancel timers.
+ */
+struct mobile_timer_param {
+	uint64_t timer_id;	  	/*!< Unique Id identifying the timer */
+	int seconds;			/*!< Seconds the timer should fire in */
+};
+
+/**
+ * Primitive to indicate starting of the mobile.
+ */
+struct mobile_started_param {
+	bool started;
+};
+
+/**
+ * Primitive to indicate shutdown of the mobile. It will go through
+ * various states.
+ */
+struct mobile_shutdown_param {
+	int old_state;
+	int new_state;
+};
+
+/**
+ * SMS related configs.
+ */
+struct mobile_sms_param {
+	struct gsm_sms sms;
+
+	char sca[20+1]; /*<! Service Centre Address. For SubmitMS */
+
+	bool cause_valid;
+	int cause;
+};
+
+/**
+ * Mobility Management (MM) state changes.
+ */
+struct mobile_mm_param {
+	int state;			/*!< The new MM state */
+	int substate;			/*!< The current substate */
+	int prev_substate;		/*!< The previous substate */
+};
+
+struct mobile_prim {
+	struct osmo_prim_hdr hdr;	/*!< Primitive base class */
+	union {
+		struct mobile_timer_param timer;
+		struct mobile_started_param started;
+		struct mobile_shutdown_param shutdown;
+		struct mobile_sms_param sms;
+		struct mobile_mm_param mm;
+	} u;
+};
+
+
+struct mobile_prim_intf *mobile_prim_intf_alloc(struct osmocom_ms *ms);
+int mobile_prim_intf_req(struct mobile_prim_intf *intf, struct mobile_prim *hdr);
+void mobile_prim_intf_free(struct mobile_prim_intf *intf);
+
+struct mobile_prim *mobile_prim_alloc(unsigned int primitive, enum osmo_prim_operation op);
+
+void mobile_prim_ntfy_started(struct osmocom_ms *ms, bool started);
+void mobile_prim_ntfy_shutdown(struct osmocom_ms *ms, int old_state, int new_state);
+void mobile_prim_ntfy_sms_new(struct osmocom_ms *ms, struct gsm_sms *sms);
+void mobile_prim_ntfy_sms_status(struct osmocom_ms *ms, struct gsm_sms *sms, uint8_t cause);
+void mobile_prim_ntfy_mm_status(struct osmocom_ms *ms, int state, int subs, int old_subs);
diff --git a/src/host/layer23/include/osmocom/bb/mobile/settings.h b/src/host/layer23/include/osmocom/bb/mobile/settings.h
new file mode 100644
index 00000000..4e5d5a19
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/settings.h
@@ -0,0 +1,125 @@
+#ifndef _settings_h
+#define _settings_h
+
+#define MOB_C7_DEFLT_ANY_TIMEOUT	30
+
+struct gsm_settings {
+	char			layer2_socket_path[128];
+	char			sap_socket_path[128];
+
+	/* IMEI */
+	char			imei[16];
+	char			imeisv[17];
+	char			imei_random;
+
+	/* network search */
+	int			plmn_mode; /* PLMN_MODE_* */
+
+	/* SIM */
+	int			sim_type; /* selects card on power on */
+	char 			emergency_imsi[16];
+
+	/* SMS */
+	char			sms_sca[22];
+	bool			store_sms;
+
+	/* test card simulator settings */
+	char 			test_imsi[16];
+	uint32_t		test_tmsi;
+	uint8_t			test_ki_type;
+	uint8_t			test_ki[16]; /* 128 bit max */
+	uint8_t			test_barr;
+	uint8_t			test_rplmn_valid;
+	uint16_t		test_rplmn_mcc, test_rplmn_mnc;
+	uint16_t		test_lac;
+	uint8_t			test_imsi_attached;
+	uint8_t			test_always; /* ...search hplmn... */
+
+	/* call related settings */
+	uint8_t			cw; /* set if call-waiting is allowed */
+	uint8_t			auto_answer;
+	uint8_t			clip, clir;
+	uint8_t			half, half_prefer;
+
+	/* changing default behavior */
+	uint8_t			alter_tx_power;
+	uint8_t			alter_tx_power_value;
+	int8_t			alter_delay;
+	uint8_t			stick;
+	uint16_t		stick_arfcn;
+	uint8_t			skip_max_per_band;
+	uint8_t			no_lupd;
+	uint8_t			no_neighbour;
+
+	/* supported by configuration */
+	uint8_t			cc_dtmf;
+	uint8_t			sms_ptp;
+	uint8_t			a5_1;
+	uint8_t			a5_2;
+	uint8_t			a5_3;
+	uint8_t			a5_4;
+	uint8_t			a5_5;
+	uint8_t			a5_6;
+	uint8_t			a5_7;
+	uint8_t			p_gsm;
+	uint8_t			e_gsm;
+	uint8_t			r_gsm;
+	uint8_t			dcs;
+	uint8_t			gsm_850;
+	uint8_t			pcs;
+	uint8_t			gsm_480;
+	uint8_t			gsm_450;
+	uint8_t			class_900;
+	uint8_t			class_dcs;
+	uint8_t			class_850;
+	uint8_t			class_pcs;
+	uint8_t			class_400;
+	uint8_t			freq_map[128+38];
+	uint8_t			full_v1;
+	uint8_t			full_v2;
+	uint8_t			full_v3;
+	uint8_t			half_v1;
+	uint8_t			half_v3;
+	uint8_t			ch_cap; /* channel capability */
+	int8_t			min_rxlev_dbm; /* min dBm to access */
+
+	/* radio */
+	uint16_t		dsc_max;
+	uint8_t			force_rekey;
+
+	/* dialing */
+	struct llist_head	abbrev;
+
+	/* EDGE / UMTS / CDMA */
+	uint8_t			edge_ms_sup;
+	uint8_t			edge_psk_sup;
+	uint8_t			edge_psk_uplink;
+	uint8_t			class_900_edge;
+	uint8_t			class_dcs_pcs_edge;
+	uint8_t			umts_fdd;
+	uint8_t			umts_tdd;
+	uint8_t			cdma_2000;
+	uint8_t			dtm;
+	uint8_t			class_dtm;
+	uint8_t			dtm_mac;
+	uint8_t			dtm_egprs;
+
+	/* Timeout for GSM 03.22 C7 state */
+	uint8_t			any_timeout;
+};
+
+struct gsm_settings_abbrev {
+	struct llist_head	list;
+	char			abbrev[4];
+	char			number[32];
+	char			name[32];
+};
+
+int gsm_settings_arfcn(struct osmocom_ms *ms);
+int gsm_settings_init(struct osmocom_ms *ms);
+int gsm_settings_exit(struct osmocom_ms *ms);
+char *gsm_check_imei(const char *imei, const char *sv);
+int gsm_random_imei(struct gsm_settings *set);
+
+#endif /* _settings_h */
+
diff --git a/src/host/layer23/include/osmocom/bb/mobile/subscriber.h b/src/host/layer23/include/osmocom/bb/mobile/subscriber.h
new file mode 100644
index 00000000..ac785d4a
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/subscriber.h
@@ -0,0 +1,114 @@
+#ifndef _SUBSCRIBER_H
+#define _SUBSCRIBER_H
+
+/* GSM 04.08 4.1.2.2 SIM update status */
+#define GSM_SIM_U0_NULL		0
+#define GSM_SIM_U1_UPDATED	1
+#define GSM_SIM_U2_NOT_UPDATED	2
+#define GSM_SIM_U3_ROAMING_NA	3
+
+struct gsm_sub_plmn_list {
+	struct llist_head	entry;
+	uint16_t		mcc, mnc;
+};
+
+struct gsm_sub_plmn_na {
+	struct llist_head	entry;
+	uint16_t		mcc, mnc;
+	uint8_t			cause;
+};
+
+#define GSM_IMSI_LENGTH		16
+
+enum {
+	GSM_SIM_TYPE_NONE = 0,
+	GSM_SIM_TYPE_READER,
+	GSM_SIM_TYPE_TEST,
+	GSM_SIM_TYPE_SAP
+};
+
+struct gsm_subscriber {
+	struct osmocom_ms	*ms;
+
+	/* status */
+	uint8_t			sim_type; /* type of sim */
+	uint8_t			sim_valid; /* sim inserted and valid */
+	uint8_t			ustate; /* update status */
+	uint8_t			imsi_attached; /* attached state */
+
+	/* IMSI & co */
+	char 			imsi[GSM_IMSI_LENGTH];
+	char 			msisdn[31]; /* may include access codes */
+	char 			iccid[21]; /* 20 + termination */
+
+	/* TMSI / LAI */
+	uint32_t		tmsi; /* invalid tmsi: 0xffffffff */
+	uint16_t		mcc, mnc, lac; /* invalid lac: 0x0000 */
+
+
+	/* key */
+	uint8_t			key_seq; /* ciphering key sequence number */
+	uint8_t			key[8]; /* 64 bit */
+
+	/* other */
+	struct llist_head	plmn_list; /* PLMN Selector field */
+	struct llist_head	plmn_na; /* not allowed PLMNs */
+	uint8_t			t6m_hplmn; /* timer for hplmn search */
+
+	/* special things */
+	uint8_t			always_search_hplmn;
+		/* search hplmn in other countries also (for test cards) */
+	uint8_t			any_timeout;
+		/* timer to restart 'any cell selection' */
+	char			sim_name[31]; /* name to load/save sim */
+	char			sim_spn[17]; /* name of service privider */
+
+	/* PLMN last registered */
+	uint8_t			plmn_valid;
+	uint16_t		plmn_mcc, plmn_mnc;
+
+	/* our access */
+	uint8_t			acc_barr; /* if we may access, if cell barred */
+	uint16_t		acc_class; /* bitmask of what we may access */
+
+	/* talk to SIM */
+	uint8_t			sim_state;
+	uint8_t			sim_pin_required; /* state: wait for PIN */
+	uint8_t			sim_file_index;
+	uint32_t		sim_handle_query;
+	uint32_t		sim_handle_update;
+	uint32_t		sim_handle_key;
+
+	/* SMS */
+	char			sms_sca[22];
+};
+
+int gsm_subscr_init(struct osmocom_ms *ms);
+int gsm_subscr_exit(struct osmocom_ms *ms);
+int gsm_subscr_testcard(struct osmocom_ms *ms, uint16_t mcc, uint16_t mnc,
+	uint16_t lac, uint32_t tmsi, uint8_t imsi_attached);
+int gsm_subscr_sapcard(struct osmocom_ms *ms);
+int gsm_subscr_remove_sapcard(struct osmocom_ms *ms);
+int gsm_subscr_simcard(struct osmocom_ms *ms);
+void gsm_subscr_sim_pin(struct osmocom_ms *ms, char *pin1, char *pin2,
+	int8_t mode);
+int gsm_subscr_write_loci(struct osmocom_ms *ms);
+int gsm_subscr_generate_kc(struct osmocom_ms *ms, uint8_t key_seq,
+	uint8_t *rand, uint8_t no_sim);
+int gsm_subscr_remove(struct osmocom_ms *ms);
+void new_sim_ustate(struct gsm_subscriber *subscr, int state);
+int gsm_subscr_del_forbidden_plmn(struct gsm_subscriber *subscr, uint16_t mcc,
+	uint16_t mnc);
+int gsm_subscr_add_forbidden_plmn(struct gsm_subscriber *subscr, uint16_t mcc,
+					uint16_t mnc, uint8_t cause);
+int gsm_subscr_is_forbidden_plmn(struct gsm_subscriber *subscr, uint16_t mcc,
+					uint16_t mnc);
+int gsm_subscr_dump_forbidden_plmn(struct osmocom_ms *ms,
+			void (*print)(void *, const char *, ...), void *priv);
+void gsm_subscr_dump(struct gsm_subscriber *subscr,
+			void (*print)(void *, const char *, ...), void *priv);
+char *gsm_check_imsi(const char *imsi);
+int gsm_subscr_get_key_seq(struct osmocom_ms *ms, struct gsm_subscriber *subscr);
+
+#endif /* _SUBSCRIBER_H */
+
diff --git a/src/host/layer23/include/osmocom/bb/mobile/support.h b/src/host/layer23/include/osmocom/bb/mobile/support.h
new file mode 100644
index 00000000..c56c78e8
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/support.h
@@ -0,0 +1,122 @@
+#ifndef _SUPPORT_H
+#define _SUPPORT_H
+
+#define GSM_CIPHER_A5_1		0
+#define GSM_CIPHER_A5_2		1
+#define GSM_CIPHER_A5_3		2
+#define GSM_CIPHER_A5_4		3
+#define GSM_CIPHER_A5_5		4
+#define GSM_CIPHER_A5_6		5
+#define GSM_CIPHER_A5_7		6
+#define GSM_CIPHER_RESERVED	7
+
+#define GSM_CAP_SDCCH		0
+#define GSM_CAP_SDCCH_TCHF	1
+#define GSM_CAP_SDCCH_TCHF_TCHH	2
+
+struct gsm_support {
+	struct osmocom_ms *ms;
+
+	/* controlled early classmark sending */
+	uint8_t es_ind;
+	/* revision level */
+	uint8_t rev_lev;
+	/* support of VGCS */
+	uint8_t vgcs;
+	/* support of VBS */
+	uint8_t vbs;
+	/* support of SMS */
+	uint8_t sms_ptp;
+	/* screening indicator */
+	uint8_t ss_ind;
+	/* pseudo synchronised capability */
+	uint8_t ps_cap;
+	/* CM service prompt */
+	uint8_t cmsp;
+	/* solsa support */
+	uint8_t solsa;
+	/* location service support */
+	uint8_t lcsva;
+	/* codec support */
+	uint8_t a5_1;
+	uint8_t a5_2;
+	uint8_t a5_3;
+	uint8_t a5_4;
+	uint8_t a5_5;
+	uint8_t a5_6;
+	uint8_t a5_7;
+	/* radio support */
+	uint8_t p_gsm;
+	uint8_t e_gsm;
+	uint8_t r_gsm;
+	uint8_t dcs;
+	uint8_t gsm_850;
+	uint8_t pcs;
+	uint8_t gsm_480;
+	uint8_t gsm_450;
+	uint8_t class_900;
+	uint8_t class_dcs;
+	uint8_t class_850;
+	uint8_t class_pcs;
+	uint8_t class_400;
+	/* multi slot support */
+	uint8_t ms_sup;
+	/* ucs2 treatment */
+	uint8_t ucs2_treat;
+	/* support extended measurements */
+	uint8_t ext_meas;
+	/* support switched measurement capability */
+	uint8_t meas_cap;
+	uint8_t sms_val;
+	uint8_t sm_val;
+	/* positioning method capability */
+	uint8_t loc_serv;
+	uint8_t e_otd_ass;
+	uint8_t e_otd_based;
+	uint8_t gps_ass;
+	uint8_t gps_based;
+	uint8_t gps_conv;
+
+	/* radio */
+	uint8_t ch_cap; /* channel capability */
+	int8_t min_rxlev_dbm;
+	uint8_t scan_to;
+	uint8_t sync_to;
+	uint16_t dsc_max; /* maximum dl signal failure counter */
+
+	/* codecs */
+	uint8_t full_v1;
+	uint8_t full_v2;
+	uint8_t full_v3;
+	uint8_t half_v1;
+	uint8_t half_v3;
+
+	/* EDGE / UMTS / CDMA */
+	uint8_t edge_ms_sup;
+	uint8_t edge_psk_sup;
+	uint8_t edge_psk_uplink;
+	uint8_t class_900_edge;
+	uint8_t class_dcs_pcs_edge;
+	uint8_t umts_fdd;
+	uint8_t umts_tdd;
+	uint8_t cdma_2000;
+	uint8_t dtm;
+	uint8_t class_dtm;
+	uint8_t dtm_mac;
+	uint8_t dtm_egprs;
+};
+
+struct gsm_support_scan_max {
+	uint16_t	start;
+	uint16_t	end;
+	uint16_t	max;
+	uint16_t	temp;	
+};
+extern struct gsm_support_scan_max gsm_sup_smax[];
+
+void gsm_support_init(struct osmocom_ms *ms);
+void gsm_support_dump(struct osmocom_ms *ms,
+			void (*print)(void *, const char *, ...), void *priv);
+
+#endif /* _SUPPORT_H */
+
diff --git a/src/host/layer23/include/osmocom/bb/mobile/transaction.h b/src/host/layer23/include/osmocom/bb/mobile/transaction.h
new file mode 100644
index 00000000..8c06d5d9
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/transaction.h
@@ -0,0 +1,76 @@
+#ifndef _TRANSACT_H
+#define _TRANSACT_H
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/gsm/gsm0411_smc.h>
+#include <osmocom/gsm/gsm0411_smr.h>
+
+/* One transaction */
+struct gsm_trans {
+	/* Entry in list of all transactions */
+	struct llist_head entry;
+
+	/* The protocol within which we live */
+	uint8_t protocol;
+
+	/* The current transaction ID */
+	uint8_t transaction_id;
+	
+	/* To whom we belong */
+	struct osmocom_ms *ms;
+
+	/* reference from MNCC or other application */
+	uint32_t callref;
+
+	/* if traffic channel receive was requested */
+	int tch_recv;
+
+	union {
+		struct {
+
+			/* current call state */
+			int state;
+
+			/* most recent progress indicator */
+			uint8_t prog_ind;
+
+			/* current timer and message queue */
+			int Tcurrent;		/* current CC timer */
+			int T308_second;	/* used to send release again */
+			struct osmo_timer_list timer;
+			struct gsm_mncc msg;	/* stores setup/disconnect/release message */
+		} cc;
+		struct {
+			/* current supp.serv. state */
+			int state;
+
+			uint8_t invoke_id;
+			struct msgb *msg;
+		} ss;
+		struct {
+			uint8_t sapi;	/* SAPI to be used for this trans */
+
+			struct gsm411_smc_inst smc_inst;
+			struct gsm411_smr_inst smr_inst;
+
+			struct gsm_sms *sms;
+		} sms;
+	};
+};
+
+
+
+struct gsm_trans *trans_find_by_id(struct osmocom_ms *ms,
+				   uint8_t proto, uint8_t trans_id);
+struct gsm_trans *trans_find_by_callref(struct osmocom_ms *ms,
+					uint32_t callref);
+
+struct gsm_trans *trans_alloc(struct osmocom_ms *ms,
+			      uint8_t protocol, uint8_t trans_id,
+			      uint32_t callref);
+void trans_free(struct gsm_trans *trans);
+
+int trans_assign_trans_id(struct osmocom_ms *ms,
+			  uint8_t protocol, uint8_t ti_flag);
+
+#endif
diff --git a/src/host/layer23/include/osmocom/bb/mobile/voice.h b/src/host/layer23/include/osmocom/bb/mobile/voice.h
new file mode 100644
index 00000000..a0524183
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/voice.h
@@ -0,0 +1,7 @@
+#ifndef _voice_h
+#define _voice_h
+
+int gsm_voice_init(struct osmocom_ms *ms);
+int gsm_send_voice(struct osmocom_ms *ms, struct gsm_data_frame *data);
+
+#endif /* _voice_h */
diff --git a/src/host/layer23/include/osmocom/bb/mobile/vty.h b/src/host/layer23/include/osmocom/bb/mobile/vty.h
new file mode 100644
index 00000000..3bec1139
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/vty.h
@@ -0,0 +1,20 @@
+#ifndef OSMOCOM_VTY_H
+#define OSMOCOM_VTY_H
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/vty/vty.h>
+#include <osmocom/vty/buffer.h>
+#include <osmocom/vty/command.h>
+
+enum ms_vty_node {
+	MS_NODE = _LAST_OSMOVTY_NODE + 1,
+	TESTSIM_NODE,
+	SUPPORT_NODE,
+};
+
+int ms_vty_go_parent(struct vty *vty);
+int ms_vty_init(void);
+extern void vty_notify(struct osmocom_ms *ms, const char *fmt, ...) __attribute__ ((format (printf, 2, 3)));
+
+#endif
+
diff --git a/src/host/layer23/src/Makefile.am b/src/host/layer23/src/Makefile.am
new file mode 100644
index 00000000..58a5f7fb
--- /dev/null
+++ b/src/host/layer23/src/Makefile.am
@@ -0,0 +1 @@
+SUBDIRS = common misc mobile
diff --git a/src/host/layer23/src/common/Makefile.am b/src/host/layer23/src/common/Makefile.am
new file mode 100644
index 00000000..b76094c6
--- /dev/null
+++ b/src/host/layer23/src/common/Makefile.am
@@ -0,0 +1,6 @@
+AM_CPPFLAGS = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) $(LIBGPS_CFLAGS)
+
+noinst_LIBRARIES = liblayer23.a
+liblayer23_a_SOURCES = l1ctl.c l1l2_interface.c sap_interface.c \
+	logging.c networks.c sim.c sysinfo.c gps.c l1ctl_lapdm_glue.c utils.c
diff --git a/src/host/layer23/src/common/gps.c b/src/host/layer23/src/common/gps.c
new file mode 100644
index 00000000..35ee4167
--- /dev/null
+++ b/src/host/layer23/src/common/gps.c
@@ -0,0 +1,412 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <sys/file.h>
+#include <termios.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <time.h>
+#include <stdbool.h>
+
+#ifdef _HAVE_GPSD
+#include <gps.h>
+#endif
+
+#include <osmocom/core/utils.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/gps.h>
+
+struct osmo_gps g = {
+	0,
+	GPS_TYPE_UNDEF,
+#ifdef _HAVE_GPSD
+    "localhost",
+	"2947",
+#endif
+	"/dev/ttyACM0",
+	0,
+	0,
+	0,
+	0,0
+};
+
+static struct osmo_fd gps_bfd;
+
+#ifdef _HAVE_GPSD
+
+static struct gps_data_t* gdata = NULL;
+
+#if GPSD_API_MAJOR_VERSION >= 5
+static struct gps_data_t _gdata;
+#endif
+
+static inline int compat_gps_read(struct gps_data_t *data)
+{
+/* API break in gpsd 6bba8b329fc7687b15863d30471d5af402467802 */
+#if GPSD_API_MAJOR_VERSION >= 7 && GPSD_API_MINOR_VERSION >= 0
+	return gps_read(data, NULL, 0);
+#elif GPSD_API_MAJOR_VERSION >= 5
+	return gps_read(data);
+#else
+	return gps_poll(data);
+#endif
+}
+
+int osmo_gpsd_cb(struct osmo_fd *bfd, unsigned int what)
+{
+	struct tm *tm;
+	unsigned diff = 0;
+
+	g.valid = 0;
+
+	/* gps is offline */
+	if (gdata->online)
+	    goto gps_not_ready;
+
+#if GPSD_API_MAJOR_VERSION >= 5
+	/* gps has no data */
+	if (gps_waiting(gdata, 500))
+	    goto gps_not_ready;
+#else
+	/* gps has no data */
+	if (gps_waiting(gdata))
+	    goto gps_not_ready;
+#endif
+
+	/* polling returned an error */
+	if (compat_gps_read(gdata))
+	    goto gps_not_ready;
+
+	/* data are valid */
+	if (gdata->set & LATLON_SET) {
+		g.valid = 1;
+		g.gmt = gdata->fix.time;
+		tm = localtime(&g.gmt);
+		diff = time(NULL) - g.gmt;
+		g.latitude = gdata->fix.latitude;
+		g.longitude = gdata->fix.longitude;
+
+		LOGP(DGPS, LOGL_INFO, " time=%02d:%02d:%02d %04d-%02d-%02d, "
+			"diff-to-host=%d, latitude=%do%.4f, longitude=%do%.4f\n",
+			tm->tm_hour, tm->tm_min, tm->tm_sec, tm->tm_year + 1900,
+			tm->tm_mday, tm->tm_mon + 1, diff,
+			(int)g.latitude,
+			(g.latitude - ((int)g.latitude)) * 60.0,
+			(int)g.longitude,
+			(g.longitude - ((int)g.longitude)) * 60.0);
+	}
+
+	return 0;
+
+gps_not_ready:
+	LOGP(DGPS, LOGL_DEBUG, "gps is offline");
+	return -1;
+}
+
+int osmo_gpsd_open(void)
+{
+	LOGP(DGPS, LOGL_INFO, "Connecting to gpsd at '%s:%s'\n", g.gpsd_host, g.gpsd_port);
+
+	gps_bfd.data = NULL;
+	gps_bfd.when = BSC_FD_READ;
+	gps_bfd.cb = osmo_gpsd_cb;
+
+#if GPSD_API_MAJOR_VERSION >= 5
+	if (gps_open(g.gpsd_host, g.gpsd_port, &_gdata) == -1)
+		gdata = NULL;
+	else
+		gdata = &_gdata;
+#else
+	gdata = gps_open(g.gpsd_host, g.gpsd_port);
+#endif
+	if (gdata == NULL) {
+		LOGP(DGPS, LOGL_ERROR, "Can't connect to gpsd\n");
+		return -1;
+	}
+	gps_bfd.fd = gdata->gps_fd;
+	if (gps_bfd.fd < 0)
+		return gps_bfd.fd;
+
+	if (gps_stream(gdata, WATCH_ENABLE, NULL) == -1) {
+		LOGP(DGPS, LOGL_ERROR, "Error in gps_stream()\n");
+		return -1;
+	}
+
+	osmo_fd_register(&gps_bfd);
+
+	return 0;
+}
+
+void osmo_gpsd_close(void)
+{
+	if (gps_bfd.fd <= 0)
+		return;
+
+	LOGP(DGPS, LOGL_INFO, "Disconnecting from gpsd\n");
+
+	osmo_fd_unregister(&gps_bfd);
+
+#if GPSD_API_MAJOR_VERSION >= 5
+	gps_stream(gdata, WATCH_DISABLE, NULL);
+#endif
+	gps_close(gdata);
+	gps_bfd.fd = -1; /* -1 or 0 indicates: 'close' */
+}
+
+#endif
+
+static struct termios gps_termios, gps_old_termios;
+
+static int osmo_serialgps_line(char *line)
+{
+	time_t gps_now, host_now;
+	struct tm *tm;
+	int32_t diff;
+	double latitude, longitude;
+
+	if (!!strncmp(line, "$GPGLL", 6))
+		return 0;
+	line += 7;
+	if (strlen(line) < 37)
+		return 0;
+	line[37] = '\0';
+	/* ddmm.mmmm,N,dddmm.mmmm,E,hhmmss.mmm,A */
+
+	/* valid position */
+	if (line[36] != 'A') {
+		LOGP(DGPS, LOGL_INFO, "%s (invalid)\n", line);
+		g.valid = 0;
+		return 0;
+	}
+	g.valid = 1;
+
+	/* time stamp */
+	gps_now = line[30] - '0';
+	gps_now += (line[29] - '0') * 10;
+	gps_now += (line[28] - '0') * 60;
+	gps_now += (line[27] - '0') * 600;
+	gps_now += (line[26] - '0') * 3600;
+	gps_now += (line[25] - '0') * 36000;
+	time(&host_now);
+	/* calculate the number of seconds the host differs from GPS */
+	diff = host_now % 86400 - gps_now;
+	if (diff < 0)
+		diff += 86400;
+	if (diff >= 43200)
+		diff -= 86400;
+	/* apply the "date" part to the GPS time */
+	gps_now = host_now - diff;
+	g.gmt = gps_now;
+	tm = localtime(&gps_now);
+
+	/* position */
+	latitude = (double)(line[0] - '0') * 10.0;
+	latitude += (double)(line[1] - '0');
+	latitude += (double)(line[2] - '0') / 6.0;
+	latitude += (double)(line[3] - '0') / 60.0;
+	latitude += (double)(line[5] - '0') / 600.0;
+	latitude += (double)(line[6] - '0') / 6000.0;
+	latitude += (double)(line[7] - '0') / 60000.0;
+	latitude += (double)(line[8] - '0') / 600000.0;
+	if (line[10] == 'S')
+		latitude = 0.0 - latitude;
+	g.latitude = latitude;
+	longitude = (double)(line[12] - '0') * 100.0;
+	longitude += (double)(line[13] - '0') * 10.0;
+	longitude += (double)(line[14] - '0');
+	longitude += (double)(line[15] - '0') / 6.0;
+	longitude += (double)(line[16] - '0') / 60.0;
+	longitude += (double)(line[18] - '0') / 600.0;
+	longitude += (double)(line[19] - '0') / 6000.0;
+	longitude += (double)(line[20] - '0') / 60000.0;
+	longitude += (double)(line[21] - '0') / 600000.0;
+	if (line[23] == 'W')
+		longitude = 360.0 - longitude;
+	g.longitude = longitude;
+
+	LOGP(DGPS, LOGL_DEBUG, "%s\n", line);
+	LOGP(DGPS, LOGL_INFO, " time=%02d:%02d:%02d %04d-%02d-%02d, "
+		"diff-to-host=%d, latitude=%do%.4f, longitude=%do%.4f\n",
+		tm->tm_hour, tm->tm_min, tm->tm_sec, tm->tm_year + 1900,
+		tm->tm_mday, tm->tm_mon + 1, diff,
+		(int)g.latitude,
+		(g.latitude - ((int)g.latitude)) * 60.0,
+		(int)g.longitude,
+		(g.longitude - ((int)g.longitude)) * 60.0);
+	return 0;
+}
+
+static int nmea_checksum(char *line)
+{
+	uint8_t checksum = 0;
+
+	while (*line) {
+		if (*line == '$') {
+			line++;
+			continue;
+		}
+		if (*line == '*')
+			break;
+		checksum ^= *line++;
+	}
+	return (strtoul(line+1, NULL, 16) == checksum);
+}
+
+int osmo_serialgps_cb(struct osmo_fd *bfd, unsigned int what)
+{
+	char buff[128];
+	static char line[128];
+	static int lpos = 0;
+	int i = 0, len;
+
+	len = read(bfd->fd, buff, sizeof(buff));
+	if (len <= 0) {
+		fprintf(stderr, "error reading GPS device (errno=%d)\n", errno);
+		return len;
+	}
+	while(i < len) {
+		if (buff[i] == 13) {
+			i++;
+			continue;
+		}
+		if (buff[i] == 10) {
+			line[lpos] = '\0';
+			lpos = 0;
+			i++;
+			if (!nmea_checksum(line))
+				fprintf(stderr, "NMEA checksum error\n");
+			else
+				osmo_serialgps_line(line);
+			continue;
+		}
+		line[lpos++] = buff[i++];
+		if (lpos == sizeof(line))
+			lpos--;
+	}
+
+	return 0;
+}
+
+int osmo_serialgps_open(void)
+{
+	int baud = 0;
+
+	if (gps_bfd.fd > 0)
+		return 0;
+
+	LOGP(DGPS, LOGL_INFO, "Open GPS device '%s'\n", g.device);
+
+	gps_bfd.data = NULL;
+	gps_bfd.when = BSC_FD_READ;
+	gps_bfd.cb = osmo_serialgps_cb;
+	gps_bfd.fd = open(g.device, O_RDONLY);
+	if (gps_bfd.fd < 0)
+		return gps_bfd.fd;
+
+	switch (g.baud) {
+	case   4800:
+		baud = B4800;      break;
+	case   9600:
+		baud = B9600;      break;
+	case  19200:
+		baud = B19200;     break;
+	case  38400:
+		baud = B38400;     break;
+	case  57600:
+		baud = B57600;     break;
+	case 115200:
+		baud = B115200;    break;
+	}
+
+	if (isatty(gps_bfd.fd))
+	{
+		/* get termios */
+		tcgetattr(gps_bfd.fd, &gps_old_termios);
+		tcgetattr(gps_bfd.fd, &gps_termios);
+		/* set baud */
+		if (baud) {
+			gps_termios.c_cflag |= baud;
+			cfsetispeed(&gps_termios, baud);
+			cfsetospeed(&gps_termios, baud);
+		}
+		if (tcsetattr(gps_bfd.fd, TCSANOW, &gps_termios))
+			printf("Failed to set termios for GPS\n");
+	}
+
+	osmo_fd_register(&gps_bfd);
+
+	return 0;
+}
+
+void osmo_serialgps_close(void)
+{
+	if (gps_bfd.fd <= 0)
+		return;
+
+	LOGP(DGPS, LOGL_INFO, "Close GPS device\n");
+
+	osmo_fd_unregister(&gps_bfd);
+
+	if (isatty(gps_bfd.fd))
+		tcsetattr(gps_bfd.fd, TCSANOW, &gps_old_termios);
+
+	close(gps_bfd.fd);
+	gps_bfd.fd = -1; /* -1 or 0 indicates: 'close' */
+}
+
+void osmo_gps_init(void)
+{
+	memset(&gps_bfd, 0, sizeof(gps_bfd));
+}
+
+int osmo_gps_open(void)
+{
+	switch (g.gps_type) {
+#ifdef _HAVE_GPSD
+		case GPS_TYPE_GPSD:
+			return osmo_gpsd_open();
+#endif
+		case GPS_TYPE_SERIAL:
+			return osmo_serialgps_open();
+
+		default:
+			return 0;
+	}
+}
+
+void osmo_gps_close(void)
+{
+	switch (g.gps_type) {
+#ifdef _HAVE_GPSD
+		case GPS_TYPE_GPSD:
+			return osmo_gpsd_close();
+#endif
+		case GPS_TYPE_SERIAL:
+			return osmo_serialgps_close();
+
+		default:
+			return;
+	}
+}
diff --git a/src/host/layer23/src/common/l1ctl.c b/src/host/layer23/src/common/l1ctl.c
new file mode 100644
index 00000000..5d6d9c0c
--- /dev/null
+++ b/src/host/layer23/src/common/l1ctl.c
@@ -0,0 +1,962 @@
+/* Layer1 control code, talking L1CTL protocol with L1 on the phone */
+
+/* (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+
+#include <arpa/inet.h>
+
+#include <l1ctl_proto.h>
+
+#include <osmocom/core/signal.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/gsmtap_util.h>
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+#include <osmocom/gsm/rsl.h>
+
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1l2_interface.h>
+#include <osmocom/gsm/lapdm.h>
+#include <osmocom/bb/common/logging.h>
+
+extern struct gsmtap_inst *gsmtap_inst;
+
+static struct msgb *osmo_l1_alloc(uint8_t msg_type)
+{
+	struct l1ctl_hdr *l1h;
+	struct msgb *msg = msgb_alloc_headroom(256, 4, "osmo_l1");
+
+	if (!msg) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to allocate memory.\n");
+		return NULL;
+	}
+
+	msg->l1h = msgb_put(msg, sizeof(*l1h));
+	l1h = (struct l1ctl_hdr *) msg->l1h;
+	l1h->msg_type = msg_type;
+	
+	return msg;
+}
+
+static int osmo_make_band_arfcn(struct osmocom_ms *ms, uint16_t arfcn)
+{
+	/* TODO: Include the band */
+	return arfcn;
+}
+
+static int rx_l1_fbsb_conf(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_info_dl *dl;
+	struct l1ctl_fbsb_conf *sb;
+	struct gsm_time tm;
+	struct osmobb_fbsb_res fr;
+
+	if (msgb_l1len(msg) < (sizeof(*dl) + sizeof(*sb))) {
+		LOGP(DL1C, LOGL_ERROR, "FBSB RESP: MSG too short (len=%u), "
+			"missing UL info header and/or payload\n", msgb_l1len(msg));
+		return -1;
+	}
+
+	dl = (struct l1ctl_info_dl *) msg->l1h;
+	sb = (struct l1ctl_fbsb_conf *) dl->payload;
+
+	LOGP(DL1C, LOGL_INFO, "snr=%04x, arfcn=%u result=%u\n", dl->snr,
+		ntohs(dl->band_arfcn), sb->result);
+
+	if (sb->result != 0) {
+		LOGP(DL1C, LOGL_ERROR, "FBSB RESP: result=%u\n", sb->result);
+		fr.ms = ms;
+		fr.band_arfcn = ntohs(dl->band_arfcn);
+		osmo_signal_dispatch(SS_L1CTL, S_L1CTL_FBSB_ERR, &fr);
+		return 0;
+	}
+
+	gsm_fn2gsmtime(&tm, ntohl(dl->frame_nr));
+	DEBUGP(DL1C, "SCH: SNR: %u TDMA: (%.4u/%.2u/%.2u) bsic: %d\n",
+		dl->snr, tm.t1, tm.t2, tm.t3, sb->bsic);
+	fr.ms = ms;
+	fr.snr = dl->snr;
+	fr.bsic = sb->bsic;
+	fr.band_arfcn = ntohs(dl->band_arfcn);
+	osmo_signal_dispatch(SS_L1CTL, S_L1CTL_FBSB_RESP, &fr);
+
+	return 0;
+}
+
+static int rx_l1_rach_conf(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct lapdm_entity *le = &ms->lapdm_channel.lapdm_dcch;
+	struct osmo_phsap_prim pp;
+	struct l1ctl_info_dl *dl;
+
+	if (msgb_l1len(msg) < sizeof(*dl)) {
+		LOGP(DL1C, LOGL_ERROR, "RACH CONF MSG too short "
+			"(len=%u), missing DL info header\n", msgb_l1len(msg));
+		msgb_free(msg);
+		return -1;
+	}
+
+	dl = (struct l1ctl_info_dl *) msg->l1h;
+	msg->l2h = msg->l3h = dl->payload;
+
+	osmo_prim_init(&pp.oph, SAP_GSM_PH, PRIM_PH_RACH,
+			PRIM_OP_CONFIRM, msg);
+	pp.u.rach_ind.fn = ntohl(dl->frame_nr);
+
+	return lapdm_phsap_up(&pp.oph, le);
+}
+
+/* Receive L1CTL_DATA_IND (Data Indication from L1) */
+static int rx_ph_data_ind(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct osmo_phsap_prim pp;
+	struct l1ctl_info_dl *dl;
+	struct l1ctl_data_ind *ccch;
+	struct lapdm_entity *le;
+	struct rx_meas_stat *meas = &ms->meas;
+	uint8_t chan_type, chan_ts, chan_ss;
+	uint8_t gsmtap_chan_type;
+	struct gsm_time tm;
+
+	if (msgb_l1len(msg) < sizeof(*dl)) {
+		LOGP(DL1C, LOGL_ERROR, "DATA IND MSG too short (len=%u), "
+			"missing UL info header\n", msgb_l1len(msg));
+		msgb_free(msg);
+		return -1;
+	}
+
+	dl = (struct l1ctl_info_dl *) msg->l1h;
+	msg->l2h = dl->payload;
+	ccch = (struct l1ctl_data_ind *) msg->l2h;
+
+	gsm_fn2gsmtime(&tm, ntohl(dl->frame_nr));
+	rsl_dec_chan_nr(dl->chan_nr, &chan_type, &chan_ss, &chan_ts);
+	DEBUGP(DL1C, "%s (%.4u/%.2u/%.2u) %d dBm: %s\n",
+		rsl_chan_nr_str(dl->chan_nr), tm.t1, tm.t2, tm.t3,
+		(int)dl->rx_level-110,
+		osmo_hexdump(ccch->data, sizeof(ccch->data)));
+
+	meas->last_fn = ntohl(dl->frame_nr);
+	meas->frames++;
+	meas->snr += dl->snr;
+	meas->berr += dl->num_biterr;
+	meas->rxlev += dl->rx_level;
+
+	/* counting loss criteria */
+	if (!(dl->link_id & 0x40)) {
+		switch (chan_type) {
+		case RSL_CHAN_PCH_AGCH:
+			/* only look at one CCCH frame in each 51 multiframe.
+			 * FIXME: implement DRX
+			 * - select correct paging block that is for us.
+			 * - initialize ds_fail according to BS_PA_MFRMS.
+			 */
+			if ((meas->last_fn % 51) != 6)
+				break;
+			if (!meas->ds_fail)
+				break;
+			if (dl->fire_crc >= 2)
+				meas->dsc -= 4;
+			else
+				meas->dsc += 1;
+			if (meas->dsc > meas->ds_fail)
+				meas->dsc = meas->ds_fail;
+			if (meas->dsc < meas->ds_fail)
+				LOGP(DL1C, LOGL_INFO, "LOSS counter for CCCH %d\n", meas->dsc);
+			if (meas->dsc > 0)
+				break;
+			meas->ds_fail = 0;
+			osmo_signal_dispatch(SS_L1CTL, S_L1CTL_LOSS_IND, ms);
+			break;
+		}
+	} else {
+		switch (chan_type) {
+		case RSL_CHAN_Bm_ACCHs:
+		case RSL_CHAN_Lm_ACCHs:
+		case RSL_CHAN_SDCCH4_ACCH:
+		case RSL_CHAN_SDCCH8_ACCH:
+			if (!meas->rl_fail)
+				break;
+			if (dl->fire_crc >= 2)
+				meas->s -= 1;
+			else
+				meas->s += 2;
+			if (meas->s > meas->rl_fail)
+				meas->s = meas->rl_fail;
+			if (meas->s < meas->rl_fail)
+				LOGP(DL1C, LOGL_NOTICE, "LOSS counter for ACCH %d\n", meas->s);
+			if (meas->s > 0)
+				break;
+			meas->rl_fail = 0;
+			osmo_signal_dispatch(SS_L1CTL, S_L1CTL_LOSS_IND, ms);
+			break;
+		}
+	}
+
+	if (dl->fire_crc >= 2) {
+		LOGP(DL1C, LOGL_NOTICE, "Dropping frame with %u bit errors\n",
+			dl->num_biterr);
+		msgb_free(msg);
+		return 0;
+	}
+
+	/* send CCCH data via GSMTAP */
+	gsmtap_chan_type = chantype_rsl2gsmtap(chan_type, dl->link_id);
+	gsmtap_send(gsmtap_inst, ntohs(dl->band_arfcn), chan_ts,
+		    gsmtap_chan_type, chan_ss, tm.fn, dl->rx_level-110,
+		    dl->snr, ccch->data, sizeof(ccch->data));
+
+	/* determine LAPDm entity based on SACCH or not */
+	if (dl->link_id & 0x40)
+		le = &ms->lapdm_channel.lapdm_acch;
+	else
+		le = &ms->lapdm_channel.lapdm_dcch;
+
+	osmo_prim_init(&pp.oph, SAP_GSM_PH, PRIM_PH_DATA,
+			PRIM_OP_INDICATION, msg);
+	pp.u.data.chan_nr = dl->chan_nr;
+	pp.u.data.link_id = dl->link_id;
+
+	/* send it up into LAPDm */
+	return lapdm_phsap_up(&pp.oph, le);
+}
+
+/* Receive L1CTL_DATA_CONF (Data Confirm from L1) */
+static int rx_ph_data_conf(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct osmo_phsap_prim pp;
+	struct l1ctl_info_dl *dl = (struct l1ctl_info_dl *) msg->l1h;
+	struct lapdm_entity *le;
+
+	if (msgb_l1len(msg) < sizeof(*dl)) {
+		LOGP(DL1C, LOGL_ERROR, "DATA CONF MSG too short (len=%u), "
+			"missing UL info header\n", msgb_l1len(msg));
+		msgb_free(msg);
+		return -1;
+	}
+
+	osmo_prim_init(&pp.oph, SAP_GSM_PH, PRIM_PH_RTS,
+			PRIM_OP_INDICATION, msg);
+
+	/* determine LAPDm entity based on SACCH or not */
+	if (dl->link_id & 0x40)
+		le = &ms->lapdm_channel.lapdm_acch;
+	else
+		le = &ms->lapdm_channel.lapdm_dcch;
+
+	/* send it up into LAPDm */
+	return lapdm_phsap_up(&pp.oph, le);
+}
+
+/* Transmit L1CTL_DATA_REQ */
+int l1ctl_tx_data_req(struct osmocom_ms *ms, struct msgb *msg,
+                      uint8_t chan_nr, uint8_t link_id)
+{
+	struct l1ctl_hdr *l1h;
+	struct l1ctl_info_ul *l1i_ul;
+	uint8_t chan_type, chan_ts, chan_ss;
+	uint8_t gsmtap_chan_type;
+
+	DEBUGP(DL1C, "(%s)\n", osmo_hexdump(msg->l2h, msgb_l2len(msg)));
+
+	if (msgb_l2len(msg) != 23) {
+		LOGP(DL1C, LOGL_ERROR, "Wrong message length (len=%u), "
+			"DATA REQ ignored, please fix!\n", msgb_l2len(msg));
+		msgb_free(msg);
+		return -EINVAL;
+	}
+
+	/* send copy via GSMTAP */
+	rsl_dec_chan_nr(chan_nr, &chan_type, &chan_ss, &chan_ts);
+	gsmtap_chan_type = chantype_rsl2gsmtap(chan_type, link_id);
+	gsmtap_send(gsmtap_inst, 0|0x4000, chan_ts, gsmtap_chan_type,
+		    chan_ss, 0, 127, 255, msg->l2h, msgb_l2len(msg));
+
+	/* prepend uplink info header */
+	l1i_ul = (struct l1ctl_info_ul *) msgb_push(msg, sizeof(*l1i_ul));
+
+	l1i_ul->chan_nr = chan_nr;
+	l1i_ul->link_id = link_id;
+
+	/* prepend l1 header */
+	msg->l1h = msgb_push(msg, sizeof(*l1h));
+	l1h = (struct l1ctl_hdr *) msg->l1h;
+	l1h->msg_type = L1CTL_DATA_REQ;
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit FBSB_REQ */
+int l1ctl_tx_fbsb_req(struct osmocom_ms *ms, uint16_t arfcn,
+		      uint8_t flags, uint16_t timeout, uint8_t sync_info_idx,
+		      uint8_t ccch_mode, uint8_t rxlev_exp)
+{
+	struct msgb *msg;
+	struct l1ctl_fbsb_req *req;
+
+	LOGP(DL1C, LOGL_INFO, "Sync Req\n");
+
+	msg = osmo_l1_alloc(L1CTL_FBSB_REQ);
+	if (!msg)
+		return -1;
+
+	req = (struct l1ctl_fbsb_req *) msgb_put(msg, sizeof(*req));
+	req->band_arfcn = htons(osmo_make_band_arfcn(ms, arfcn));
+	req->timeout = htons(timeout);
+	/* Threshold when to consider FB_MODE1: 4kHz - 1kHz */
+	req->freq_err_thresh1 = htons(11000 - 1000);
+	/* Threshold when to consider SCH: 1kHz - 200Hz */
+	req->freq_err_thresh2 = htons(1000 - 200);
+	/* not used yet! */
+	req->num_freqerr_avg = 3;
+	req->flags = flags;
+	req->sync_info_idx = sync_info_idx;
+	req->ccch_mode = ccch_mode;
+	req->rxlev_exp = rxlev_exp;
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit L1CTL_CCCH_MODE_REQ */
+int l1ctl_tx_ccch_mode_req(struct osmocom_ms *ms, uint8_t ccch_mode)
+{
+	struct msgb *msg;
+	struct l1ctl_ccch_mode_req *req;
+
+	LOGP(DL1C, LOGL_INFO, "CCCH Mode Req\n");
+
+	msg = osmo_l1_alloc(L1CTL_CCCH_MODE_REQ);
+	if (!msg)
+		return -1;
+
+	req = (struct l1ctl_ccch_mode_req *) msgb_put(msg, sizeof(*req));
+	req->ccch_mode = ccch_mode;
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit L1CTL_TCH_MODE_REQ */
+int l1ctl_tx_tch_mode_req(struct osmocom_ms *ms, uint8_t tch_mode,
+	uint8_t audio_mode)
+{
+	struct msgb *msg;
+	struct l1ctl_tch_mode_req *req;
+
+	LOGP(DL1C, LOGL_INFO, "TCH Mode Req\n");
+
+	msg = osmo_l1_alloc(L1CTL_TCH_MODE_REQ);
+	if (!msg)
+		return -1;
+
+	req = (struct l1ctl_tch_mode_req *) msgb_put(msg, sizeof(*req));
+	req->tch_mode = tch_mode;
+	req->audio_mode = audio_mode;
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit L1CTL_PARAM_REQ */
+int l1ctl_tx_param_req(struct osmocom_ms *ms, int8_t ta, uint8_t tx_power)
+{
+	struct msgb *msg;
+	struct l1ctl_info_ul *ul;
+	struct l1ctl_par_req *req;
+
+	msg = osmo_l1_alloc(L1CTL_PARAM_REQ);
+	if (!msg)
+		return -1;
+
+	DEBUGP(DL1C, "PARAM Req. ta=%d, tx_power=%d\n", ta, tx_power);
+	ul = (struct l1ctl_info_ul *) msgb_put(msg, sizeof(*ul));
+	req = (struct l1ctl_par_req *) msgb_put(msg, sizeof(*req));
+	req->tx_power = tx_power;
+	req->ta = ta;
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit L1CTL_CRYPTO_REQ */
+int l1ctl_tx_crypto_req(struct osmocom_ms *ms, uint8_t chan_nr,
+	uint8_t algo, uint8_t *key, uint8_t len)
+{
+	struct msgb *msg;
+	struct l1ctl_info_ul *ul;
+	struct l1ctl_crypto_req *req;
+
+	msg = osmo_l1_alloc(L1CTL_CRYPTO_REQ);
+	if (!msg)
+		return -1;
+
+	DEBUGP(DL1C, "CRYPTO Req. algo=%d, len=%d\n", algo, len);
+	ul = (struct l1ctl_info_ul *) msgb_put(msg, sizeof(*ul));
+	req = (struct l1ctl_crypto_req *) msgb_put(msg, sizeof(*req) + len);
+
+	ul->chan_nr = chan_nr;
+	req->key_len = len;
+	req->algo = algo;
+
+	if (len)
+		memcpy(req->key, key, len);
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit L1CTL_RACH_REQ */
+int l1ctl_tx_rach_req(struct osmocom_ms *ms, uint8_t ra, uint16_t offset,
+	uint8_t combined)
+{
+	struct msgb *msg;
+	struct l1ctl_info_ul *ul;
+	struct l1ctl_rach_req *req;
+
+	msg = osmo_l1_alloc(L1CTL_RACH_REQ);
+	if (!msg)
+		return -1;
+
+	DEBUGP(DL1C, "RACH Req. offset=%d combined=%d\n", offset, combined);
+	ul = (struct l1ctl_info_ul *) msgb_put(msg, sizeof(*ul));
+	req = (struct l1ctl_rach_req *) msgb_put(msg, sizeof(*req));
+	req->ra = ra;
+	req->offset = htons(offset);
+	req->combined = combined;
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit L1CTL_DM_EST_REQ */
+int l1ctl_tx_dm_est_req_h0(struct osmocom_ms *ms, uint16_t band_arfcn,
+                           uint8_t chan_nr, uint8_t tsc, uint8_t tch_mode,
+			   uint8_t audio_mode)
+{
+	struct msgb *msg;
+	struct l1ctl_info_ul *ul;
+	struct l1ctl_dm_est_req *req;
+
+	msg = osmo_l1_alloc(L1CTL_DM_EST_REQ);
+	if (!msg)
+		return -1;
+
+	LOGP(DL1C, LOGL_INFO, "Tx Dedic.Mode Est Req (arfcn=%u, "
+		"chan_nr=0x%02x)\n", band_arfcn, chan_nr);
+
+	ul = (struct l1ctl_info_ul *) msgb_put(msg, sizeof(*ul));
+	ul->chan_nr = chan_nr;
+	ul->link_id = 0;
+
+	req = (struct l1ctl_dm_est_req *) msgb_put(msg, sizeof(*req));
+	req->tsc = tsc;
+	req->h = 0;
+	req->h0.band_arfcn = htons(band_arfcn);
+	req->tch_mode = tch_mode;
+	req->audio_mode = audio_mode;
+
+	return osmo_send_l1(ms, msg);
+}
+
+int l1ctl_tx_dm_est_req_h1(struct osmocom_ms *ms, uint8_t maio, uint8_t hsn,
+                           uint16_t *ma, uint8_t ma_len,
+                           uint8_t chan_nr, uint8_t tsc, uint8_t tch_mode,
+			   uint8_t audio_mode)
+{
+	struct msgb *msg;
+	struct l1ctl_info_ul *ul;
+	struct l1ctl_dm_est_req *req;
+	int i;
+
+	msg = osmo_l1_alloc(L1CTL_DM_EST_REQ);
+	if (!msg)
+		return -1;
+
+	LOGP(DL1C, LOGL_INFO, "Tx Dedic.Mode Est Req (maio=%u, hsn=%u, "
+		"chan_nr=0x%02x)\n", maio, hsn, chan_nr);
+
+	ul = (struct l1ctl_info_ul *) msgb_put(msg, sizeof(*ul));
+	ul->chan_nr = chan_nr;
+	ul->link_id = 0;
+
+	req = (struct l1ctl_dm_est_req *) msgb_put(msg, sizeof(*req));
+	req->tsc = tsc;
+	req->h = 1;
+	req->h1.maio = maio;
+	req->h1.hsn = hsn;
+	req->h1.n = ma_len;
+	for (i = 0; i < ma_len; i++)
+		req->h1.ma[i] = htons(ma[i]);
+	req->tch_mode = tch_mode;
+	req->audio_mode = audio_mode;
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit L1CTL_DM_FREQ_REQ */
+int l1ctl_tx_dm_freq_req_h0(struct osmocom_ms *ms, uint16_t band_arfcn,
+                            uint8_t tsc, uint16_t fn)
+{
+	struct msgb *msg;
+	struct l1ctl_info_ul *ul;
+	struct l1ctl_dm_freq_req *req;
+
+	msg = osmo_l1_alloc(L1CTL_DM_FREQ_REQ);
+	if (!msg)
+		return -1;
+
+	LOGP(DL1C, LOGL_INFO, "Tx Dedic.Mode Freq Req (arfcn=%u, fn=%d)\n",
+		band_arfcn, fn);
+
+	ul = (struct l1ctl_info_ul *) msgb_put(msg, sizeof(*ul));
+	ul->chan_nr = 0;
+	ul->link_id = 0;
+
+	req = (struct l1ctl_dm_freq_req *) msgb_put(msg, sizeof(*req));
+	req->fn = htons(fn);
+	req->tsc = tsc;
+	req->h = 0;
+	req->h0.band_arfcn = htons(band_arfcn);
+
+	return osmo_send_l1(ms, msg);
+}
+
+int l1ctl_tx_dm_freq_req_h1(struct osmocom_ms *ms, uint8_t maio, uint8_t hsn,
+                            uint16_t *ma, uint8_t ma_len,
+                            uint8_t tsc, uint16_t fn)
+{
+	struct msgb *msg;
+	struct l1ctl_info_ul *ul;
+	struct l1ctl_dm_freq_req *req;
+	int i;
+
+	msg = osmo_l1_alloc(L1CTL_DM_FREQ_REQ);
+	if (!msg)
+		return -1;
+
+	LOGP(DL1C, LOGL_INFO, "Tx Dedic.Mode Freq Req (maio=%u, hsn=%u, "
+		"fn=%d)\n", maio, hsn, fn);
+
+	ul = (struct l1ctl_info_ul *) msgb_put(msg, sizeof(*ul));
+	ul->chan_nr = 0;
+	ul->link_id = 0;
+
+	req = (struct l1ctl_dm_freq_req *) msgb_put(msg, sizeof(*req));
+	req->fn = htons(fn);
+	req->tsc = tsc;
+	req->h = 1;
+	req->h1.maio = maio;
+	req->h1.hsn = hsn;
+	req->h1.n = ma_len;
+	for (i = 0; i < ma_len; i++)
+		req->h1.ma[i] = htons(ma[i]);
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit L1CTL_DM_REL_REQ */
+int l1ctl_tx_dm_rel_req(struct osmocom_ms *ms)
+{
+	struct msgb *msg;
+	struct l1ctl_info_ul *ul;
+
+	msg = osmo_l1_alloc(L1CTL_DM_REL_REQ);
+	if (!msg)
+		return -1;
+
+	LOGP(DL1C, LOGL_INFO, "Tx Dedic.Mode Rel Req\n");
+
+	ul = (struct l1ctl_info_ul *) msgb_put(msg, sizeof(*ul));
+
+	return osmo_send_l1(ms, msg);
+}
+
+int l1ctl_tx_echo_req(struct osmocom_ms *ms, unsigned int len)
+{
+	struct msgb *msg;
+	uint8_t *data;
+	unsigned int i;
+
+	msg = osmo_l1_alloc(L1CTL_ECHO_REQ);
+	if (!msg)
+		return -1;
+
+	data = msgb_put(msg, len);
+	for (i = 0; i < len; i++)
+		data[i] = i % 8;
+
+	return osmo_send_l1(ms, msg);
+}
+
+int l1ctl_tx_sim_req(struct osmocom_ms *ms, uint8_t *data, uint16_t length)
+{
+	struct msgb *msg;
+	uint8_t *dat;
+
+	msg = osmo_l1_alloc(L1CTL_SIM_REQ);
+	if (!msg)
+		return -1;
+
+	dat = msgb_put(msg, length);
+	memcpy(dat, data, length);
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* just forward the SIM response to the SIM handler */
+static int rx_l1_sim_conf(struct osmocom_ms *ms, struct msgb *msg)
+{
+	uint16_t len = msgb_l2len(msg);
+	uint8_t *data = msg->data;
+
+	LOGP(DL1C, LOGL_INFO, "SIM %s\n", osmo_hexdump(data, len));
+
+	sim_apdu_resp(ms, msg);
+	
+	return 0;
+}
+
+/* Transmit L1CTL_PM_REQ */
+int l1ctl_tx_pm_req_range(struct osmocom_ms *ms, uint16_t arfcn_from,
+			  uint16_t arfcn_to)
+{
+	struct msgb *msg;
+	struct l1ctl_pm_req *pm;
+
+	msg = osmo_l1_alloc(L1CTL_PM_REQ);
+	if (!msg)
+		return -1;
+
+	LOGP(DL1C, LOGL_INFO, "Tx PM Req (%u-%u)\n", arfcn_from, arfcn_to);
+	pm = (struct l1ctl_pm_req *) msgb_put(msg, sizeof(*pm));
+	pm->type = 1;
+	pm->range.band_arfcn_from = htons(arfcn_from);
+	pm->range.band_arfcn_to = htons(arfcn_to);
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit L1CTL_RESET_REQ */
+int l1ctl_tx_reset_req(struct osmocom_ms *ms, uint8_t type)
+{
+	struct msgb *msg;
+	struct l1ctl_reset *res;
+
+	msg = osmo_l1_alloc(L1CTL_RESET_REQ);
+	if (!msg)
+		return -1;
+
+	LOGP(DL1C, LOGL_INFO, "Tx Reset Req (%u)\n", type);
+	res = (struct l1ctl_reset *) msgb_put(msg, sizeof(*res));
+	res->type = type;
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Receive L1CTL_RESET_IND */
+static int rx_l1_reset(struct osmocom_ms *ms)
+{
+	LOGP(DL1C, LOGL_INFO, "Layer1 Reset indication\n");
+	osmo_signal_dispatch(SS_L1CTL, S_L1CTL_RESET, ms);
+
+	return 0;
+}
+
+/* Receive L1CTL_PM_CONF */
+static int rx_l1_pm_conf(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_pm_conf *pmr;
+
+	if (msgb_l1len(msg) < sizeof(*pmr)) {
+		LOGP(DL1C, LOGL_ERROR, "PM CONF MSG too short (len=%u), "
+			"missing measurement results\n", msgb_l1len(msg));
+		return -1;
+	}
+
+	for (pmr = (struct l1ctl_pm_conf *) msg->l1h;
+	     (uint8_t *) pmr < msg->tail; pmr++) {
+		struct osmobb_meas_res mr;
+		DEBUGP(DL1C, "PM MEAS: ARFCN: %4u RxLev: %3d %3d\n",
+			ntohs(pmr->band_arfcn), pmr->pm[0], pmr->pm[1]);
+		mr.band_arfcn = ntohs(pmr->band_arfcn);
+		mr.rx_lev = pmr->pm[0];
+		mr.ms = ms;
+		osmo_signal_dispatch(SS_L1CTL, S_L1CTL_PM_RES, &mr);
+	}
+	return 0;
+}
+
+/* Receive L1CTL_CCCH_MODE_CONF */
+static int rx_l1_ccch_mode_conf(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct osmobb_ccch_mode_conf mc;
+	struct l1ctl_ccch_mode_conf *conf;
+
+	if (msgb_l1len(msg) < sizeof(*conf)) {
+		LOGP(DL1C, LOGL_ERROR, "CCCH MODE CONF: MSG too short "
+			"(len=%u), missing CCCH mode info\n", msgb_l1len(msg));
+		return -1;
+	}
+
+	conf = (struct l1ctl_ccch_mode_conf *) msg->l1h;
+
+	LOGP(DL1C, LOGL_INFO, "CCCH MODE CONF: mode=%u\n", conf->ccch_mode);
+
+	mc.ccch_mode = conf->ccch_mode;
+	mc.ms = ms;
+	osmo_signal_dispatch(SS_L1CTL, S_L1CTL_CCCH_MODE_CONF, &mc);
+
+	return 0;
+}
+
+/* Receive L1CTL_TCH_MODE_CONF */
+static int rx_l1_tch_mode_conf(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct osmobb_tch_mode_conf mc;
+	struct l1ctl_tch_mode_conf *conf;
+
+	if (msgb_l1len(msg) < sizeof(*conf)) {
+		LOGP(DL1C, LOGL_ERROR, "TCH MODE CONF: MSG too short "
+			"(len=%u), missing TCH mode info\n", msgb_l1len(msg));
+		return -1;
+	}
+
+	conf = (struct l1ctl_tch_mode_conf *) msg->l1h;
+
+	LOGP(DL1C, LOGL_INFO, "TCH MODE CONF: mode=%u\n", conf->tch_mode);
+
+	mc.tch_mode = conf->tch_mode;
+	mc.audio_mode = conf->audio_mode;
+	mc.ms = ms;
+	osmo_signal_dispatch(SS_L1CTL, S_L1CTL_TCH_MODE_CONF, &mc);
+
+	return 0;
+}
+
+/* Receive L1CTL_TRAFFIC_IND (Traffic Indication from L1) */
+static int rx_l1_traffic_ind(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_info_dl *dl;
+	struct l1ctl_traffic_ind *ti;
+	size_t frame_len;
+	uint8_t *frame;
+
+	if (msgb_l1len(msg) < sizeof(*dl)) {
+		LOGP(DL1C, LOGL_ERROR, "TRAFFIC IND MSG too short "
+			"(len=%u), missing DL info header\n", msgb_l1len(msg));
+		return -1;
+	}
+
+	/* Header handling */
+	dl = (struct l1ctl_info_dl *) msg->l1h;
+	ti = (struct l1ctl_traffic_ind *) dl->payload;
+	frame = (uint8_t *) ti->data;
+
+	msg->l2h = dl->payload;
+	msg->l3h = frame;
+
+	/* Calculate the frame length */
+	frame_len = msgb_l3len(msg);
+
+	DEBUGP(DL1C, "TRAFFIC IND len=%zu (%s)\n", frame_len,
+		osmo_hexdump(frame, frame_len));
+
+	/* distribute or drop */
+	if (ms->l1_entity.l1_traffic_ind)
+		return ms->l1_entity.l1_traffic_ind(ms, msg);
+
+	msgb_free(msg);
+	return 0;
+}
+
+/* Transmit L1CTL_TRAFFIC_REQ (Traffic Request to L1) */
+int l1ctl_tx_traffic_req(struct osmocom_ms *ms, struct msgb *msg,
+                       uint8_t chan_nr, uint8_t link_id)
+{
+	struct l1ctl_hdr *l1h;
+	struct l1ctl_info_ul *l1i_ul;
+	struct l1ctl_traffic_req *tr;
+	size_t frame_len;
+	uint8_t *frame;
+
+	/* Header handling */
+	tr = (struct l1ctl_traffic_req *) msg->l2h;
+	frame = (uint8_t *) tr->data;
+	msg->l3h = frame;
+
+	/* Calculate the frame length */
+	frame_len = msgb_l3len(msg);
+
+	DEBUGP(DL1C, "TRAFFIC REQ len=%zu (%s)\n", frame_len,
+		osmo_hexdump(frame, frame_len));
+
+	if ((frame[0] >> 4) != 0xd) {
+		LOGP(DL1C, LOGL_ERROR, "Traffic Request has incorrect magic "
+			"(%u != 0xd)\n", frame[0] >> 4);
+		msgb_free(msg);
+		return -EINVAL;
+	}
+
+//	printf("TX %s\n", osmo_hexdump(frame, frame_len));
+
+	/* prepend uplink info header */
+	l1i_ul = (struct l1ctl_info_ul *) msgb_push(msg, sizeof(*l1i_ul));
+
+	l1i_ul->chan_nr = chan_nr;
+	l1i_ul->link_id = link_id;
+
+	/* prepend l1 header */
+	msg->l1h = msgb_push(msg, sizeof(*l1h));
+	l1h = (struct l1ctl_hdr *) msg->l1h;
+	l1h->msg_type = L1CTL_TRAFFIC_REQ;
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Transmit L1CTL_NEIGH_PM_REQ */
+int l1ctl_tx_neigh_pm_req(struct osmocom_ms *ms, int num, uint16_t *arfcn)
+{
+	struct msgb *msg;
+	struct l1ctl_neigh_pm_req *pm_req;
+	int i;
+
+	msg = osmo_l1_alloc(L1CTL_NEIGH_PM_REQ);
+	if (!msg)
+		return -1;
+
+	LOGP(DL1C, LOGL_INFO, "Tx NEIGH PM Req (num %u)\n", num);
+	pm_req = (struct l1ctl_neigh_pm_req *) msgb_put(msg, sizeof(*pm_req));
+	pm_req->n = num;
+	for (i = 0; i < num; i++) {
+		pm_req->band_arfcn[i] = htons(*arfcn++);
+		pm_req->tn[i] = 0;
+	}
+
+	return osmo_send_l1(ms, msg);
+}
+
+/* Receive L1CTL_NEIGH_PM_IND */
+static int rx_l1_neigh_pm_ind(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_neigh_pm_ind *pm_ind;
+
+	if (msgb_l1len(msg) < sizeof(*pm_ind)) {
+		LOGP(DL1C, LOGL_ERROR, "NEIGH PH IND MSG too short "
+			"(len=%u), missing measurement results\n", msgb_l1len(msg));
+		return -1;
+	}
+
+	for (pm_ind = (struct l1ctl_neigh_pm_ind *) msg->l1h;
+	     (uint8_t *) pm_ind < msg->tail; pm_ind++) {
+		struct osmobb_neigh_pm_ind mi;
+		DEBUGP(DL1C, "NEIGH_PM IND: ARFCN: %4u RxLev: %3d %3d\n",
+			ntohs(pm_ind->band_arfcn), pm_ind->pm[0],
+			pm_ind->pm[1]);
+		mi.band_arfcn = ntohs(pm_ind->band_arfcn);
+		mi.rx_lev = pm_ind->pm[0];
+		mi.ms = ms;
+		osmo_signal_dispatch(SS_L1CTL, S_L1CTL_NEIGH_PM_IND, &mi);
+	}
+	return 0;
+}
+
+/* Receive incoming data from L1 using L1CTL format */
+int l1ctl_recv(struct osmocom_ms *ms, struct msgb *msg)
+{
+	int rc = 0;
+	struct l1ctl_hdr *hdr;
+
+	/* Make sure a message has L1CTL header (pointed by msg->l1h) */
+	if (msgb_l1len(msg) < sizeof(*hdr)) {
+		LOGP(DL1C, LOGL_ERROR, "Short L1CTL message, "
+			"missing the header (len=%u)\n", msgb_l1len(msg));
+		msgb_free(msg);
+		return -1;
+	}
+
+	/* Pull the L1CTL header from the msgb */
+	hdr = (struct l1ctl_hdr *) msg->l1h;
+	msgb_pull(msg, sizeof(struct l1ctl_hdr));
+
+	/* move the l1 header pointer to point _BEHIND_ l1ctl_hdr,
+	   as the l1ctl header is of no interest to subsequent code */
+	msg->l1h = hdr->data;
+
+	switch (hdr->msg_type) {
+	case L1CTL_FBSB_CONF:
+		rc = rx_l1_fbsb_conf(ms, msg);
+		msgb_free(msg);
+		break;
+	case L1CTL_DATA_IND:
+		rc = rx_ph_data_ind(ms, msg);
+		break;
+	case L1CTL_DATA_CONF:
+		rc = rx_ph_data_conf(ms, msg);
+		break;
+	case L1CTL_RESET_IND:
+	case L1CTL_RESET_CONF:
+		rc = rx_l1_reset(ms);
+		msgb_free(msg);
+		break;
+	case L1CTL_PM_CONF:
+		rc = rx_l1_pm_conf(ms, msg);
+		if (hdr->flags & L1CTL_F_DONE)
+			osmo_signal_dispatch(SS_L1CTL, S_L1CTL_PM_DONE, ms);
+		msgb_free(msg);
+		break;
+	case L1CTL_RACH_CONF:
+		rc = rx_l1_rach_conf(ms, msg);
+		break;
+	case L1CTL_CCCH_MODE_CONF:
+		rc = rx_l1_ccch_mode_conf(ms, msg);
+		msgb_free(msg);
+		break;
+	case L1CTL_TCH_MODE_CONF:
+		rc = rx_l1_tch_mode_conf(ms, msg);
+		msgb_free(msg);
+		break;
+	case L1CTL_SIM_CONF:
+		rc = rx_l1_sim_conf(ms, msg);
+		break;
+	case L1CTL_NEIGH_PM_IND:
+		rc = rx_l1_neigh_pm_ind(ms, msg);
+		msgb_free(msg);
+		break;
+	case L1CTL_TRAFFIC_IND:
+		rc = rx_l1_traffic_ind(ms, msg);
+		break;
+	case L1CTL_TRAFFIC_CONF:
+		msgb_free(msg);
+		break;
+	default:
+		LOGP(DL1C, LOGL_ERROR, "Unknown MSG: %u\n", hdr->msg_type);
+		msgb_free(msg);
+		break;
+	}
+
+	return rc;
+}
diff --git a/src/host/layer23/src/common/l1ctl_lapdm_glue.c b/src/host/layer23/src/common/l1ctl_lapdm_glue.c
new file mode 100644
index 00000000..0b2a8ed5
--- /dev/null
+++ b/src/host/layer23/src/common/l1ctl_lapdm_glue.c
@@ -0,0 +1,62 @@
+/* Glue code between L1CTL and LAPDm */
+
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+#include <l1ctl_proto.h>
+
+#include <osmocom/gsm/prim.h>
+
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/gsm/lapdm.h>
+
+/* LAPDm wants to send a PH-* primitive to the physical layer (L1) */
+int l1ctl_ph_prim_cb(struct osmo_prim_hdr *oph, void *ctx)
+{
+	struct osmocom_ms *ms = ctx;
+	struct osmo_phsap_prim *pp = (struct osmo_phsap_prim *) oph;
+	int rc = 0;
+
+	if (oph->sap != SAP_GSM_PH)
+		return -ENODEV;
+
+	if (oph->operation != PRIM_OP_REQUEST)
+		return -EINVAL;
+
+	switch (oph->primitive) {
+	case PRIM_PH_DATA:
+		rc = l1ctl_tx_data_req(ms, oph->msg, pp->u.data.chan_nr,
+					pp->u.data.link_id);
+		break;
+	case PRIM_PH_RACH:
+		l1ctl_tx_param_req(ms, pp->u.rach_req.ta,
+				   pp->u.rach_req.tx_power);
+		rc = l1ctl_tx_rach_req(ms, pp->u.rach_req.ra,
+				       pp->u.rach_req.offset,
+				       pp->u.rach_req.is_combined_ccch);
+		break;
+	default:
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
diff --git a/src/host/layer23/src/common/l1l2_interface.c b/src/host/layer23/src/common/l1l2_interface.c
new file mode 100644
index 00000000..c07b0a1d
--- /dev/null
+++ b/src/host/layer23/src/common/l1l2_interface.c
@@ -0,0 +1,157 @@
+/* Layer 1 socket interface of layer2/3 stack */
+
+/* (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010,2018 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/l1l2_interface.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/socket.h>
+
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <arpa/inet.h>
+
+#define _GNU_SOURCE
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+
+#define GSM_L2_LENGTH 256
+#define GSM_L2_HEADROOM 32
+
+static int layer2_read(struct osmo_fd *fd)
+{
+	struct msgb *msg;
+	uint16_t len;
+	int rc;
+
+	msg = msgb_alloc_headroom(GSM_L2_LENGTH+GSM_L2_HEADROOM, GSM_L2_HEADROOM, "Layer2");
+	if (!msg) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to allocate msg.\n");
+		return -ENOMEM;
+	}
+
+	rc = read(fd->fd, &len, sizeof(len));
+	if (rc < sizeof(len)) {
+		fprintf(stderr, "Layer2 socket failed\n");
+		msgb_free(msg);
+		if (rc >= 0)
+			rc = -EIO;
+		layer2_close((struct osmocom_ms *) fd->data);
+		return rc;
+	}
+
+	len = ntohs(len);
+	if (len > GSM_L2_LENGTH) {
+		LOGP(DL1C, LOGL_ERROR, "Length is too big: %u\n", len);
+		msgb_free(msg);
+		return -EINVAL;
+	}
+
+
+	msg->l1h = msgb_put(msg, len);
+	rc = read(fd->fd, msg->l1h, msgb_l1len(msg));
+	if (rc != msgb_l1len(msg)) {
+		LOGP(DL1C, LOGL_ERROR, "Can not read data: len=%d rc=%d "
+		     "errno=%d\n", len, rc, errno);
+		msgb_free(msg);
+		return rc;
+	}
+
+	l1ctl_recv((struct osmocom_ms *) fd->data, msg);
+
+	return 0;
+}
+
+static int layer2_write(struct osmo_fd *fd, struct msgb *msg)
+{
+	int rc;
+
+	if (fd->fd <= 0)
+		return -EINVAL;
+
+	rc = write(fd->fd, msg->data, msg->len);
+	if (rc != msg->len) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to write data: rc: %d\n", rc);
+		return rc;
+	}
+
+	return 0;
+}
+
+int layer2_open(struct osmocom_ms *ms, const char *socket_path)
+{
+	int rc;
+
+	rc = osmo_sock_unix_init_ofd(&ms->l2_wq.bfd, SOCK_STREAM, 0, socket_path, OSMO_SOCK_F_CONNECT);
+	if (rc < 0) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to create unix domain socket %s: %s\n",
+		     socket_path, strerror(-rc));
+		return rc;
+	}
+
+	osmo_wqueue_init(&ms->l2_wq, 100);
+	ms->l2_wq.bfd.data = ms;
+	ms->l2_wq.read_cb = layer2_read;
+	ms->l2_wq.write_cb = layer2_write;
+
+	return 0;
+}
+
+int layer2_close(struct osmocom_ms *ms)
+{
+	if (ms->l2_wq.bfd.fd <= 0)
+		return -EINVAL;
+
+	close(ms->l2_wq.bfd.fd);
+	ms->l2_wq.bfd.fd = -1;
+	osmo_fd_unregister(&ms->l2_wq.bfd);
+	osmo_wqueue_clear(&ms->l2_wq);
+
+	return 0;
+}
+
+int osmo_send_l1(struct osmocom_ms *ms, struct msgb *msg)
+{
+	DEBUGP(DL1C, "Sending: '%s'\n", osmo_hexdump(msg->data, msg->len));
+
+	if (msg->l1h != msg->data)
+		LOGP(DL1C, LOGL_ERROR, "Message L1 header != Message Data\n");
+
+	/* prepend 16bit length before sending */
+	msgb_push_u16(msg, msg->len);
+
+	if (osmo_wqueue_enqueue(&ms->l2_wq, msg) != 0) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to enqueue msg.\n");
+		msgb_free(msg);
+		return -1;
+	}
+
+	return 0;
+}
+
+
diff --git a/src/host/layer23/src/common/logging.c b/src/host/layer23/src/common/logging.c
new file mode 100644
index 00000000..ed799913
--- /dev/null
+++ b/src/host/layer23/src/common/logging.c
@@ -0,0 +1,155 @@
+/* Logging/Debug support of the layer2/3 stack */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/bb/common/logging.h>
+
+static const struct log_info_cat default_categories[] = {
+	[DRSL] = {
+		.name = "DRSL",
+		.description = "Radio Signalling Link (MS)",
+		.color = "\033[1;35m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DCS] = {
+		.name = "DCS",
+		.description = "Cell selection",
+		.color = "\033[34m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DNB] = {
+		.name = "DNB",
+		.description = "Neighbour cell measurement",
+		.color = "\033[0;31m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DPLMN] = {
+		.name = "DPLMN",
+		.description = "PLMN selection",
+		.color = "\033[32m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DRR] = {
+		.name = "DRR",
+		.description = "Radio Resource",
+		.color = "\033[1;34m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DMM] = {
+		.name = "DMM",
+		.description = "Mobility Management",
+		.color = "\033[1;32m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DCC] = {
+		.name = "DCC",
+		.description = "Call Control",
+		.color = "\033[1;33m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DSS] = {
+		.name = "DSS",
+		.description = "Supplenmentary Services",
+		.color = "\033[1;35m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DSMS] = {
+		.name = "DSMS",
+		.description = "Short Message Service",
+		.color = "\033[1;37m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DMNCC] = {
+		.name = "DMNCC",
+		.description = "Mobile Network Call Control",
+		.color = "\033[1;37m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DMEAS] = {
+		.name = "DMEAS",
+		.description = "MEasurement Reporting",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DPAG] = {
+		.name = "DPAG",
+		.description = "Paging",
+		.color = "\033[33m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DL1C]	= {
+		.name = "DL1C",
+		.description = "Layer 1 Control",
+		.color = "\033[1;31m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DSAP]	= {
+		.name = "DSAP",
+		.description = "SAP Control",
+		.color = "\033[1;31m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DSUM] = {
+		.name = "DSUM",
+		.description = "Summary of Process",
+		.color = "\033[1;37m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DSIM] = {
+		.name = "DSIM",
+		.description = "SIM client",
+		.color = "\033[0;35m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DGPS] = {
+		.name = "DGPS",
+		.description = "GPS",
+		.color = "\033[1;35m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DMOB] = {
+		.name = "DMOB",
+		.description = "Mobile",
+		.color = "\033[1;35m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DPRIM] = {
+		.name = "DPRIM",
+		.description = "PRIM",
+		.color = "\033[1;32m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+	[DLUA] = {
+		.name = "DLUA",
+		.description = "LUA",
+		.color = "\033[1;32m",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+};
+
+const struct log_info log_info = {
+	.filter_fn = NULL,
+	.cat = default_categories,
+	.num_cat = ARRAY_SIZE(default_categories),
+};
+
diff --git a/src/host/layer23/src/common/main.c b/src/host/layer23/src/common/main.c
new file mode 100644
index 00000000..2920cd9e
--- /dev/null
+++ b/src/host/layer23/src/common/main.c
@@ -0,0 +1,297 @@
+/* Main method of the layer2/3 stack */
+
+/* (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/l1l2_interface.h>
+#include <osmocom/bb/common/sap_interface.h>
+#include <osmocom/bb/misc/layer3.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/l23_app.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/gsmtap_util.h>
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/core/utils.h>
+
+#include <arpa/inet.h>
+
+#define _GNU_SOURCE
+#include <getopt.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+
+struct log_target *stderr_target;
+
+void *l23_ctx = NULL;
+
+static char *layer2_socket_path = "/tmp/osmocom_l2";
+static char *sap_socket_path = "/tmp/osmocom_sap";
+struct llist_head ms_list;
+static struct osmocom_ms *ms = NULL;
+static char *gsmtap_ip = NULL;
+static char *vty_ip = "127.0.0.1";
+
+unsigned short vty_port = 4247;
+int (*l23_app_work) (struct osmocom_ms *ms) = NULL;
+int (*l23_app_exit) (struct osmocom_ms *ms) = NULL;
+int quit = 0;
+struct gsmtap_inst *gsmtap_inst;
+
+const char *openbsc_copyright =
+	"%s"
+	"%s\n"
+	"License GPLv2+: GNU GPL version 2 or later "
+		"<http://gnu.org/licenses/gpl.html>\n"
+	"This is free software: you are free to change and redistribute it.\n"
+	"There is NO WARRANTY, to the extent permitted by law.\n\n";
+
+static void print_usage(const char *app)
+{
+	printf("Usage: %s\n", app);
+}
+
+static void print_help()
+{
+	int options = 0xff;
+	struct l23_app_info *app = l23_app_info();
+
+	if (app && app->cfg_supported != 0)
+		options = app->cfg_supported();
+
+	printf(" Some help...\n");
+	printf("  -h --help		this text\n");
+	printf("  -s --socket		/tmp/osmocom_l2. Path to the unix "
+		"domain socket (l2)\n");
+
+	if (options & L23_OPT_SAP)
+		printf("  -S --sap		/tmp/osmocom_sap. Path to the "
+			"unix domain socket (BTSAP)\n");
+
+	if (options & L23_OPT_ARFCN)
+		printf("  -a --arfcn NR		The ARFCN to be used for layer2.\n");
+
+	if (options & L23_OPT_TAP)
+		printf("  -i --gsmtap-ip	The destination IP used for GSMTAP.\n");
+
+	if (options & L23_OPT_VTY)
+		printf("  -v --vty-port		The VTY port number to telnet "
+			"to. (default %u)\n", vty_port);
+
+	if (options & L23_OPT_DBG)
+		printf("  -d --debug		Change debug flags.\n");
+
+	if (options & L23_OPT_VTYIP)
+		printf("  -u --vty-ip		The VTY IP to bind telnet to. "
+			"(default %s)\n", vty_ip);
+
+	if (app && app->cfg_print_help)
+		app->cfg_print_help();
+}
+
+static void build_config(char **opt, struct option **option)
+{
+	struct l23_app_info *app;
+	struct option *app_opp = NULL;
+	int app_len = 0, len;
+
+	static struct option long_options[] = {
+		{"help", 0, 0, 'h'},
+		{"socket", 1, 0, 's'},
+		{"sap", 1, 0, 'S'},
+		{"arfcn", 1, 0, 'a'},
+		{"gsmtap-ip", 1, 0, 'i'},
+		{"vty-ip", 1, 0, 'u'},
+		{"vty-port", 1, 0, 'v'},
+		{"debug", 1, 0, 'd'},
+	};
+
+
+	app = l23_app_info();
+	*opt = talloc_asprintf(l23_ctx, "hs:S:a:i:v:d:u:%s",
+			       app && app->getopt_string ? app->getopt_string : "");
+
+	len = ARRAY_SIZE(long_options);
+	if (app && app->cfg_getopt_opt)
+		app_len = app->cfg_getopt_opt(&app_opp);
+
+	*option = talloc_zero_array(l23_ctx, struct option, len + app_len + 1);
+	memcpy(*option, long_options, sizeof(long_options));
+	if (app_opp)
+		memcpy(*option + len, app_opp, app_len * sizeof(struct option));
+}
+
+static void handle_options(int argc, char **argv)
+{
+	struct l23_app_info *app = l23_app_info();
+	struct option *long_options;
+	char *opt;
+
+	build_config(&opt, &long_options);
+
+	while (1) {
+		int option_index = 0, c;
+
+		c = getopt_long(argc, argv, opt,
+				long_options, &option_index);
+		if (c == -1)
+			break;
+
+		switch (c) {
+		case 'h':
+			print_usage(argv[0]);
+			print_help();
+			exit(0);
+			break;
+		case 's':
+			layer2_socket_path = talloc_strdup(l23_ctx, optarg);
+			break;
+		case 'S':
+			sap_socket_path = talloc_strdup(l23_ctx, optarg);
+			break;
+		case 'a':
+			ms->test_arfcn = atoi(optarg);
+			break;
+		case 'i':
+			gsmtap_ip = optarg;
+			break;
+		case 'u':
+			vty_ip = optarg;
+			break;
+		case 'v':
+			vty_port = atoi(optarg);
+			break;
+		case 'd':
+			log_parse_category_mask(stderr_target, optarg);
+			break;
+		default:
+			if (app && app->cfg_handle_opt)
+				app->cfg_handle_opt(c, optarg);
+			break;
+		}
+	}
+
+	talloc_free(opt);
+	talloc_free(long_options);
+}
+
+void sighandler(int sigset)
+{
+	int rc = 0;
+
+	if (sigset == SIGHUP || sigset == SIGPIPE)
+		return;
+
+	fprintf(stderr, "Signal %d recevied.\n", sigset);
+	if (l23_app_exit)
+		rc = l23_app_exit(ms);
+
+	if (rc != -EBUSY)
+		exit (0);
+}
+
+static void print_copyright()
+{
+	struct l23_app_info *app;
+	app = l23_app_info();
+	printf(openbsc_copyright,
+	       app && app->copyright ? app->copyright : "",
+	       app && app->contribution ? app->contribution : "");
+}
+
+int main(int argc, char **argv)
+{
+	int rc;
+
+	INIT_LLIST_HEAD(&ms_list);
+	log_init(&log_info, NULL);
+	stderr_target = log_target_create_stderr();
+	log_add_target(stderr_target);
+	log_set_all_filter(stderr_target, 1);
+
+	l23_ctx = talloc_named_const(NULL, 1, "layer2 context");
+
+	ms = talloc_zero(l23_ctx, struct osmocom_ms);
+	if (!ms) {
+		fprintf(stderr, "Failed to allocate MS\n");
+		exit(1);
+	}
+
+	print_copyright();
+
+	llist_add_tail(&ms->entity, &ms_list);
+
+	ms->name = talloc_strdup(ms, "1");
+	ms->test_arfcn = 871;
+
+	handle_options(argc, argv);
+
+	rc = layer2_open(ms, layer2_socket_path);
+	if (rc < 0) {
+		fprintf(stderr, "Failed during layer2_open()\n");
+		exit(1);
+	}
+
+	rc = sap_open(ms, sap_socket_path);
+	if (rc < 0)
+		fprintf(stderr, "Failed during sap_open(), no SIM reader\n");
+
+	ms->lapdm_channel.lapdm_dcch.l1_ctx = ms;
+	ms->lapdm_channel.lapdm_dcch.l3_ctx = ms;
+	ms->lapdm_channel.lapdm_acch.l1_ctx = ms;
+	ms->lapdm_channel.lapdm_acch.l3_ctx = ms;
+	lapdm_channel_init(&ms->lapdm_channel, LAPDM_MODE_MS);
+	lapdm_channel_set_l1(&ms->lapdm_channel, l1ctl_ph_prim_cb, ms);
+
+	rc = l23_app_init(ms);
+	if (rc < 0)
+		exit(1);
+
+	if (gsmtap_ip) {
+		gsmtap_inst = gsmtap_source_init(gsmtap_ip, GSMTAP_UDP_PORT, 1);
+		if (!gsmtap_inst) {
+			fprintf(stderr, "Failed during gsmtap_init()\n");
+			exit(1);
+		}
+		gsmtap_source_add_sink(gsmtap_inst);
+	}
+
+	signal(SIGINT, sighandler);
+	signal(SIGHUP, sighandler);
+	signal(SIGTERM, sighandler);
+	signal(SIGPIPE, sighandler);
+
+	while (!quit) {
+		if (l23_app_work)
+			l23_app_work(ms);
+		osmo_select_main(0);
+	}
+
+	return 0;
+}
diff --git a/src/host/layer23/src/common/networks.c b/src/host/layer23/src/common/networks.c
new file mode 100644
index 00000000..40b70a10
--- /dev/null
+++ b/src/host/layer23/src/common/networks.c
@@ -0,0 +1,1986 @@
+#include <string.h>
+#include <stdint.h>
+#include <stdio.h>
+
+#include <osmocom/bb/common/networks.h>
+
+/* list of networks */
+
+struct gsm_networks gsm_networks[] = {
+	{ 0x001, -1,	"Test" },
+	{ 0x001, 0x01f,		"Test" },
+	{ 0x412, -1,	"Afghanistan" },
+	{ 0x412, 0x01f,		"AWCC" },
+	{ 0x412, 0x20f,		"Roshan" },
+	{ 0x412, 0x30f,		"New1" },
+	{ 0x412, 0x40f,		"Areeba" },
+	{ 0x412, 0x50f,		"Etisalat" }, /* ? */
+	{ 0x412, 0x88f,		"Afghan Telecom" },
+	{ 0x276, -1,	"Albania" },
+	{ 0x276, 0x01f,		"AMC" },
+	{ 0x276, 0x02f,		"Vodafone" },
+	{ 0x276, 0x03f,		"Eagle Mobile" },
+	{ 0x276, 0x04f,		"Mobile 4 AL" },
+	{ 0x603, -1,	"Algeria" },
+	{ 0x603, 0x01f,		"Algerie Telecom" },
+	{ 0x603, 0x02f,		"Orascom Telecom Algerie" },
+	{ 0x603, 0x03f,		"Nedjma" }, /* ? */
+	{ 0x213, -1,	"Andorra" },
+	{ 0x213, 0x03f,		"Mobiland" },
+	{ 0x631, -1,	"Angola" },
+	{ 0x631, 0x02f,		"UNITEL" },
+	{ 0x365, -1,	"Anguilla" },
+	{ 0x365, 0x010,		"Weblinks Limited" },
+	{ 0x365, 0x840,		"Cable & Wireless" }, /* ? */
+	{ 0x344, -1,	"Antigua and Barbuda" },
+	{ 0x344, 0x030,		"APUA PCS" },
+	{ 0x338, 0x050,		"Digicel" }, /* ? */
+	{ 0x344, 0x920,		"Cable & Wireless (Antigua)" },
+	{ 0x344, 0x930,		"AT&T Wireless (Antigua)" },
+	{ 0x722, -1,	"Argentina" },
+	{ 0x722, 0x010,		"Companie de Radiocomunicatciones Moviles S.A." },
+	{ 0x722, 0x020,		"Nextel Argentina srl" },
+	{ 0x722, 0x070,		"Telefonica Communicationes Personales S.A." },
+	{ 0x722, 0x310,		"CTI PCS S.A" },
+	{ 0x722, 0x320,		"Compania de Telefonos del Interior Norte S.A." },
+	{ 0x722, 0x330,		"Companie de Telefonos del Interior S.A." },
+	{ 0x722, 0x340,		"Personal" }, /* ? */
+	{ 0x722, 0x341,		"Telecom Personal S.A." },
+	{ 0x722, 0x350,		"Hutchinson (PORT HABLE)" }, /* ? */
+	{ 0x283, -1,	"Armenia" },
+	{ 0x283, 0x01f,		"Beeline" },
+	{ 0x283, 0x05f,		"VivaCell-MTS" },
+	{ 0x283, 0x10f,		"Orange" },
+	{ 0x363, -1,	"Aruba" },
+	{ 0x363, 0x01f,		"SETAR" },
+	{ 0x363, 0x02f,		"Digicel" }, /* ? */
+	{ 0x505, -1,	"Australia" },
+	{ 0x505, 0x01f,		"Telstra" },
+	{ 0x505, 0x02f,		"Optus" },
+	{ 0x505, 0x03f,		"Vodafone" },
+	{ 0x505, 0x04f,		"Department of Defence" },
+	{ 0x505, 0x05f,		"Ozitel" },
+	{ 0x505, 0x06f,		"Hutchison 3G"},
+	{ 0x505, 0x07f,		"Vodafone" },
+	{ 0x505, 0x08f,		"One.Tel" },
+	{ 0x505, 0x09f,		"Airnet" },
+	{ 0x505, 0x10f,		"Norfolk Telecom" },
+	{ 0x505, 0x11f,		"Telstra" },
+	{ 0x505, 0x12f,		"3" },
+	{ 0x505, 0x13f,		"Railcorp" },
+	{ 0x505, 0x14f,		"AAPT" },
+	{ 0x505, 0x15f,		"3GIS" },
+	{ 0x505, 0x16f,		"Victorian Rail Track" },
+	{ 0x505, 0x17f,		"Vivid Wireless Pty Ltd" },
+	{ 0x505, 0x18f,		"Pactel International Pty Ltd" },
+	{ 0x505, 0x19f,		"Lycamobile Pty Ltd" },
+	{ 0x505, 0x21f,		"SOUL" }, /* ? */
+	{ 0x505, 0x24f,		"Advanced Communications Technologies Pty. Ltd." },
+	{ 0x505, 0x38f,		"Crazy John's" }, /* ? */
+	{ 0x505, 0x71f,		"Telstra" },
+	{ 0x505, 0x72f,		"Telstra" },
+	{ 0x505, 0x88f,		"Localstar Holding Pty. Ltd." },
+	{ 0x505, 0x90f,		"Optus" },
+	{ 0x505, 0x99f,		"One.Tel" },
+	{ 0x232, -1,	"Austria" },
+	{ 0x232, 0x01f,		"A1" },
+	{ 0x232, 0x02f,		"A1" },
+	{ 0x232, 0x03f,		"T-Mobile" },
+	{ 0x232, 0x04f,		"T-Mobile" },
+	{ 0x232, 0x05f,		"Orange" },
+	{ 0x232, 0x06f,		"Orange" },
+	{ 0x232, 0x07f,		"T-Mobile (tele.ring)" },
+	{ 0x232, 0x09f,		"Mobilkom Austria" },
+	{ 0x232, 0x10f,		"Hutchison 3G Austria" },
+	{ 0x232, 0x11f,		"Mobilkom Austria" },
+	{ 0x232, 0x12f,		"Orange Austria" },
+	{ 0x232, 0x14f,		"Hutchison 3G Austria" },
+	{ 0x232, 0x15f,		"Barablu Mobile Austria" },
+	{ 0x232, 0x16f,		"3" }, /* ? */
+	{ 0x232, 0x91f,		"OBB - Infrastruktur Bau AG" },
+	{ 0x400, -1,	"Azerbaijan" },
+	{ 0x400, 0x01f,		"Azercell" },
+	{ 0x400, 0x02f,		"Bakcell" },
+	{ 0x400, 0x03f,		"Catel JV" },
+	{ 0x400, 0x04f,		"Azerphone LLC" },
+	{ 0x364, -1,	"Bahamas" },
+	{ 0x364, 0x390,		"BaTelCo" },
+	{ 0x426, -1,	"Bahrain" },
+	{ 0x426, 0x01f,		"BHR Mobile Plus" },
+	{ 0x426, 0x02f,		"zain BH" }, /* ? */
+	{ 0x426, 0x04f,		"VIVA" }, /* ? */
+	{ 0x470, -1,	"Bangladesh" },
+	{ 0x470, 0x01f,		"Grameenphone" },
+	{ 0x470, 0x02f,		"Aktel" },
+	{ 0x470, 0x03f,		"Mobile 2000" },
+	{ 0x470, 0x04f,		"TeleTalk" }, /* ? */
+	{ 0x470, 0x05f,		"Citycell" }, /* ? */
+	{ 0x470, 0x06f,		"Warid" }, /* ? */
+	{ 0x470, 0x07f,		"WTBL" }, /* ? */
+	{ 0x342, -1,	"Barbados" },
+	{ 0x342, 0x600,		"Cable & Wireless (Barbados) Ltd." },
+	{ 0x342, 0x750,		"Digicel" }, /* ? */
+	{ 0x342, 0x820,		"Sunbeach Communications" },
+	{ 0x257, -1,	"Belarus" },
+	{ 0x257, 0x01f,		"MCD Velcom" },
+	{ 0x257, 0x02f,		"MTS" },
+	{ 0x257, 0x04f,		"life:)" }, /* ? */
+	{ 0x257, 0x03f,		"DIALLOG" }, /* ? */
+	{ 0x206, -1,	"Belgium" },
+	{ 0x206, 0x01f,		"Proximus" },
+	{ 0x206, 0x02f,		"SNCB GSM-R" }, /* ? */
+	{ 0x206, 0x10f,		"Mobistar" },
+	{ 0x206, 0x20f,		"BASE" },
+	{ 0x702, -1,	"Belize" },
+	{ 0x702, 0x67f,		"Belize Telemedia" },
+	{ 0x702, 0x68f,		"International Telecommunications Ltd." },
+	{ 0x702, 0x00f,		"Smart" }, /* ? */
+	{ 0x616, -1,	"Benin" },
+	{ 0x616, 0x01f,		"Libercom" },
+	{ 0x616, 0x02f,		"Telecel" },
+	{ 0x616, 0x03f,		"Spacetel Benin" },
+	{ 0x616, 0x04f,		"BBCOM" }, /* ? */
+	{ 0x616, 0x05f,		"Glo" }, /* ? */
+	{ 0x350, -1,	"Bermuda" },
+	{ 0x350, 0x01f,		"Digicel Bermuda" }, /* ? */
+	{ 0x350, 0x02f,		"Mobility" }, /* ? */
+	{ 0x338, 0x050,		"Digicel Bermuda" }, /* ? */
+	{ 0x310, 0x00f,		"Cellular One" }, /* ? */
+	{ 0x402, -1,	"Bhutan" },
+	{ 0x402, 0x11f,		"Bhutan Telecom Ltd" },
+	{ 0x402, 0x77f,		"B-Mobile" },
+	{ 0x736, -1,	"Bolivia" },
+	{ 0x736, 0x01f,		"Nuevatel" },
+	{ 0x736, 0x02f,		"Entel" },
+	{ 0x736, 0x03f,		"Telecel" },
+	{ 0x218, -1,	"Bosnia and Herzegovina" },
+	{ 0x218, 0x03f,		"HT-ERONET" },
+	{ 0x218, 0x05f,		"MOBI'S" },
+	{ 0x218, 0x90f,		"GSMBIH" },
+	{ 0x652, -1,	"Botswana" },
+	{ 0x652, 0x01f,		"Mascom" },
+	{ 0x652, 0x02f,		"Orange" },
+	{ 0x652, 0x04f,		"BTC Mobile" },
+	{ 0x724, -1,	"Brazil" },
+	{ 0x724, 0x00f,		"Telet" },
+	{ 0x724, 0x01f,		"CRT Cellular" },
+	{ 0x724, 0x02f,		"TIM" },
+	{ 0x724, 0x03f,		"TIM" },
+	{ 0x724, 0x04f,		"TIM" },
+	{ 0x724, 0x05f,		"Claro" },
+	{ 0x724, 0x06f,		"Vivo" },
+	{ 0x724, 0x07f,		"CTBC Celular" },
+	{ 0x724, 0x08f,		"TIM" },
+	{ 0x724, 0x10f,		"Vivo" },
+	{ 0x724, 0x11f,		"Vivo" },
+	{ 0x724, 0x15f,		"Sercomtel" },
+	{ 0x724, 0x16f,		"Oi / Brasil Telecom" },
+	{ 0x724, 0x23f,		"Vivo" },
+	{ 0x724, 0x24f,		"Oi / Amazonia Celular" },
+	{ 0x724, 0x31f,		"Oi" },
+	{ 0x724, 0x32f,		"CTBC Celular" },
+	{ 0x724, 0x33f,		"CTBC Celular" },
+	{ 0x724, 0x34f,		"CTBC Celular" },
+	{ 0x724, 0x35f,		"TIM" },
+	{ 0x724, 0x37f,		"aeiou" },
+	{ 0x724, 0x39f,		"TIM" },
+	{ 0x724, 0x41f,		"TIM" },
+	{ 0x724, 0x43f,		"TIM" },
+	{ 0x724, 0x45f,		"TIM" },
+	{ 0x724, 0x47f,		"TIM" },
+	{ 0x724, 0x48f,		"TIM" },
+	{ 0x724, 0x51f,		"TIM" },
+	{ 0x724, 0x53f,		"TIM" },
+	{ 0x724, 0x55f,		"TIM" },
+	{ 0x724, 0x57f,		"TIM" },
+	{ 0x724, 0x59f,		"TIM" },
+	{ 0x724, 0x00f,		"Nextel" },
+	{ 0x348, -1,	"British Virgin Islands" },
+	{ 0x348, 0x170,		"Cable & Wireless" },
+	{ 0x348, 0x370,		"BVI Cable TV Ltd" },
+	{ 0x348, 0x570,		"CCT Boatphone" },
+	{ 0x348, 0x770,		"Digicel (BVI) Ltd" },
+	{ 0x528, -1,	"Brunei" },
+	{ 0x528, 0x01f,		"Jabatan Telekom" }, /* ? */
+	{ 0x528, 0x02f,		"B-Mobile" }, /* ? */
+	{ 0x528, 0x11f,		"DSTCom" },
+	{ 0x284, -1,	"Bulgaria" },
+	{ 0x284, 0x01f,		"M-Tel" },
+	{ 0x284, 0x03f,		"Vivacom" }, /* ? */
+	{ 0x284, 0x05f,		"GLOBUL" },
+	{ 0x613, -1,	"Burkina Faso" },
+	{ 0x613, 0x01f,		"Onatel" }, /* ? */
+	{ 0x613, 0x02f,		"Celtel / Zain" },
+	{ 0x613, 0x03f,		"Telecel Faso" },
+	{ 0x642, -1,	"Burundi" },
+	{ 0x642, 0x01f,		"Econet / Spacetel" },
+	{ 0x642, 0x02f,		"Africell" },
+	{ 0x642, 0x03f,		"Onamob" },
+	{ 0x642, 0x07f,		"Lacell" },
+	{ 0x642, 0x08f,		"Hits" },
+	{ 0x642, 0x82f,		"U.COM / Onatel" },
+	{ 0x456, -1,	"Cambodia" },
+	{ 0x456, 0x01f,		"Mobitel" },
+	{ 0x456, 0x02f,		"hello" },
+	{ 0x456, 0x03f,		"S Telecom" },
+	{ 0x456, 0x04f,		"Cadcomms / qb" },
+	{ 0x456, 0x05f,		"Star-Cell" },
+	{ 0x456, 0x06f,		"Smart" },
+	{ 0x456, 0x08f,		"Viettel" },
+	{ 0x456, 0x18f,		"Mfone" },
+//	{ 0x456, ?,		"Excell" }, /* ? */
+	{ 0x456, 0x09f,		"Beeline" }, /* ? */
+	{ 0x456, 0x08f,		"Metfone" }, /* ? */
+	{ 0x624, -1,	"Cameroon" },
+	{ 0x624, 0x01f,		"MTN Cameroon" },
+	{ 0x624, 0x02f,		"Orange" },
+	{ 0x302, -1,	"Canada" },
+	{ 0x302, 0x220,		"Telus" },
+	{ 0x302, 0x221,		"Telus" },
+	{ 0x302, 0x290,		"Airtel Wireless" },
+	{ 0x302, 0x350,		"FIRST" },
+	{ 0x302, 0x360,		"MiKe" },
+	{ 0x302, 0x361,		"Telus" },
+	{ 0x302, 0x370,		"Fido" },
+	{ 0x302, 0x380,		"DMTS" },
+	{ 0x302, 0x490,		"WIND Mobile" },
+	{ 0x302, 0x500,		"Videotron" },
+	{ 0x302, 0x510,		"Videotron" },
+	{ 0x302, 0x610,		"Bell" },
+	{ 0x302, 0x620,		"ICE Wireless" },
+	{ 0x302, 0x640,		"Bell" },
+	{ 0x302, 0x651,		"Bell" },
+	{ 0x302, 0x652,		"BC Tel Mobility (Telus)" },
+	{ 0x302, 0x653,		"Telus" },
+	{ 0x302, 0x655,		"MTS" },
+	{ 0x302, 0x656,		"TBay" },
+	{ 0x302, 0x657,		"Telus" },
+	{ 0x302, 0x680,		"SaskTel" },
+	{ 0x302, 0x701,		"MB Tel Mobility" },
+	{ 0x302, 0x702,		"MT&T Mobility (Aliant)" },
+	{ 0x302, 0x703,		"New Tel Mobility (Aliant)" },
+	{ 0x302, 0x710,		"Globalstar" },
+	{ 0x302, 0x720,		"Rogers Wireless" },
+	{ 0x302, 0x780,		"SaskTel" },
+	{ 0x302, 0x880,		"Bell / Telus" },
+	{ 0x625, -1,	"Cape Verde" },
+	{ 0x625, 0x01f,		"CVMOVEL" },
+	{ 0x625, 0x02f,		"T+" },
+	{ 0x346, -1,	"Cayman Islands" },
+	{ 0x346, 0x140,		"Cable & Wireless" },
+	{ 0x338, 0x050,		"Digicel" }, /* ? */
+	{ 0x623, -1,	"Central African Republic" },
+	{ 0x623, 0x01f,		"CTP" },
+	{ 0x623, 0x02f,		"TC" },
+	{ 0x623, 0x03f,		"Celca / Socatel / Orange" },
+	{ 0x623, 0x04f,		"Nationlink" }, /* ? */
+	{ 0x622, -1,	"Chad" },
+	{ 0x622, 0x01f,		"Celtel / Zain" },
+	{ 0x622, 0x02f,		"Tchad Mobile" },
+	{ 0x622, 0x03f,		"TIGO - Millicom" }, /* ? */
+	{ 0x622, 0x02f,		"TAWALI" }, /* ? */
+	{ 0x622, 0x04f,		"Salam" }, /* ? */
+	{ 0x730, -1,	"Chile" },
+	{ 0x730, 0x01f,		"Entel" },
+	{ 0x730, 0x02f,		"movistar" },
+	{ 0x730, 0x03f,		"Smartcom / Claro" },
+	{ 0x730, 0x04f,		"Centennial Cayman Corp / Nextel" },
+	{ 0x730, 0x05f,		"Multikom S.A." },
+	{ 0x730, 0x06f,		"Blue Two Chile S.A." },
+	{ 0x730, 0x07f,		"Telefonica" },
+	{ 0x730, 0x10f,		"Entel" },
+	{ 0x730, 0x99f,		"WILL" }, /* ? */
+	{ 0x460, -1,	"China" },
+	{ 0x460, 0x00f,		"China Mobile" },
+	{ 0x460, 0x01f,		"China Unicom" },
+	{ 0x460, 0x02f,		"China Mobile" },
+	{ 0x460, 0x03f,		"China Unicom CMDA" },
+	{ 0x460, 0x04f,		"China Satellite Global Star Network" },
+	{ 0x460, 0x05f,		"China Telecom" }, /* ? */
+	{ 0x460, 0x06f,		"China Unicom" }, /* ? */
+	{ 0x460, 0x20f,		"China TIETONG" }, /* ? */
+	{ 0x732, -1,	"Colombia" },
+	{ 0x732, 0x001,		"Colombia Telecomunicaciones S.A." },
+	{ 0x732, 0x002,		"Edatel" },
+	{ 0x732, 0x020,		"Emtelsa" },
+	{ 0x732, 0x099,		"Emcali" },
+	{ 0x732, 0x101,		"Comcel" },
+	{ 0x732, 0x102,		"Bellsouth / movistar" },
+	{ 0x732, 0x103,		"Colombia Movil / Tigo" },
+	{ 0x732, 0x111,		"Colombia Movil / Tigo" },
+	{ 0x732, 0x123,		"movistar" },
+	{ 0x732, 0x12f,		"movistar" }, /* ? */
+	{ 0x732, 0x130,		"Avantel" },
+	{ 0x654, -1,	"Comoros" },
+	{ 0x654, 0x01f,		"HURI - SNPT" },
+	{ 0x629, -1,	"Republic of the Congo" },
+	{ 0x629, 0x01f,		"Celtel / Zain" },
+	{ 0x629, 0x10f,		"Libertis Telecom" },
+//	{ 0x629, ?,		"Warid Telecom" },
+	{ 0x548, -1,	"Cook Islands" },
+	{ 0x548, 0x01f,		"Telecom Cook" },
+	{ 0x712, -1,	"Costa Rica" },
+	{ 0x712, 0x01f,		"ICE" },
+	{ 0x712, 0x02f,		"ICE" }, /* ? */
+	{ 0x712, 0x03f,		"ICE" }, /* ? */
+	{ 0x219, -1,	"Croatia" },
+	{ 0x219, 0x01f,		"T-Mobile" },
+	{ 0x219, 0x02f,		"Tele2" },
+	{ 0x219, 0x10f,		"VIPnet" },
+	{ 0x368, -1,	"Cuba" },
+	{ 0x368, 0x01f,		"ETECSA" },
+	{ 0x280, -1,	"Cyprus" },
+	{ 0x280, 0x01f,		"Cytamobile-Vodafone" },
+	{ 0x280, 0x10f,		"Scanacom / MTN" },
+	{ 0x230, -1,	"Czech Republic" },
+	{ 0x230, 0x01f,		"T-Mobile" },
+	{ 0x230, 0x02f,		"O2" },
+	{ 0x230, 0x03f,		"Vodafone" },
+	{ 0x230, 0x04f,		"Mobilkom / U:fon" },
+	{ 0x230, 0x98f,		"SZDC s.o." },
+	{ 0x230, 0x99f,		"Vodafone" },
+	{ 0x630, -1,	"Democratic Republic of the Congo" },
+	{ 0x630, 0x01f,		"Vodacom" },
+	{ 0x630, 0x02f,		"Zain" }, /* ? */
+	{ 0x630, 0x04f,		"Cellco" }, /* ? */
+	{ 0x630, 0x05f,		"Supercell" },
+	{ 0x630, 0x86f,		"CCT" },
+	{ 0x630, 0x89f,		"SAIT Telecom" }, /* ? */
+//	{ 0x630, ?,		"Africell" },
+	{ 0x238, -1,	"Denmark" },
+	{ 0x238, 0x01f,		"TDC" },
+	{ 0x238, 0x02f,		"Sonofon / Telenor" },
+	{ 0x238, 0x03f,		"MIGway A/S" },
+	{ 0x238, 0x05f,		"ApS KBUS" },
+	{ 0x238, 0x06f,		"Hi3G" },
+	{ 0x238, 0x07f,		"Lycamobile / Barablu Mobile" },
+	{ 0x238, 0x09f,		"Dansk Beredskabskommunikation A/S" }, /* ? */
+	{ 0x238, 0x10f,		"TDC" },
+	{ 0x238, 0x11f,		"Dansk Beredskabskommunikation A/S" }, /* ? */
+	{ 0x238, 0x12f,		"Lycamobile Denmark Ltd" },
+	{ 0x238, 0x20f,		"Telia" },
+	{ 0x238, 0x30f,		"Telia" },
+	{ 0x238, 0x40f,		"Ericsson Danmark A/S" }, /* ? */
+	{ 0x238, 0x77f,		"Tele2 / Telenor" },
+	{ 0x638, -1,	"Djibouti" },
+	{ 0x638, 0x01f,		"Evatis" },
+	{ 0x366, -1,	"Dominica" },
+	{ 0x366, 0x020,		"Digicel" }, /* ? */
+	{ 0x366, 0x110,		"Cable &  Wireless" }, /* ? */
+	{ 0x370, -1,	"Dominican Republic" },
+	{ 0x370, 0x01f,		"Orange" },
+	{ 0x370, 0x02f,		"Verizon / Claro" },
+	{ 0x370, 0x03f,		"Tricom" },
+	{ 0x370, 0x04f,		"CentennialDominicana / Viva" },
+	{ 0x514, -1,	"East Timor" },
+	{ 0x514, 0x02f,		"Timor Telecom" }, /* ? */
+	{ 0x740, -1,	"Ecuador" },
+	{ 0x740, 0x00f,		"Otecel / Bellsouth / Movistar" },
+	{ 0x740, 0x01f,		"Porta GSM" },
+	{ 0x740, 0x02f,		"Telecsa / Alegro" },
+	{ 0x602, -1,	"Egypt" },
+	{ 0x602, 0x01f,		"Mobinil" },
+	{ 0x602, 0x02f,		"Vodafone" },
+	{ 0x602, 0x03f,		"Etisalat" },
+	{ 0x706, -1,	"El Salvador" },
+	{ 0x706, 0x01f,		"CTE Telecom Personal" },
+	{ 0x706, 0x02f,		"digicel" },
+	{ 0x706, 0x03f,		"Telemovil EL Salvador" },
+	{ 0x706, 0x04f,		"movistar" }, /* ? */
+	{ 0x706, 0x10f,		"Claro" }, /* ? */
+	{ 0x627, -1,	"Equatorial Guinea" },
+	{ 0x627, 0x01f,		"Orange GQ" },
+	{ 0x627, 0x03f,		"Hits GQ" },
+	{ 0x657, -1,	"Eritrea" },
+	{ 0x657, 0x01f,		"Eritel" }, /* ? */
+	{ 0x248, -1,	"Estonia" },
+	{ 0x248, 0x01f,		"EMT" },
+	{ 0x248, 0x02f,		"RLE / Elisa" },
+	{ 0x248, 0x03f,		"Tele 2" },
+	{ 0x248, 0x04f,		"OY Top Connect" },
+	{ 0x248, 0x05f,		"AS Bravocom Mobiil" },
+	{ 0x248, 0x06f,		"Pro Group Holding / ViaTel" },
+	{ 0x248, 0x07f,		"Televorgu AS" },
+	{ 0x248, 0x71f,		"Siseministeerium" },
+	{ 0x636, -1,	"Ethiopia" },
+	{ 0x636, 0x01f,		"ETMTN" },
+	{ 0x750, -1,	"Falkland Islands (Malvinas)" },
+	{ 0x750, 0x001,		"Touch" },
+	{ 0x288, -1,	"Faroe Islands" },
+	{ 0x288, 0x01f,		"Faroese Telecom" },
+	{ 0x288, 0x02f,		"Kall / Vodafone" },
+	{ 0x274, 0x02f,		"P/F Kall" },
+	{ 0x542, -1,	"Fiji" },
+	{ 0x542, 0x01f,		"Vodafone" },
+	{ 0x542, 0x02f,		"Digicel" },
+	{ 0x542, 0x03f,		"Telecom Fiji" },
+	{ 0x244, -1,	"Finland" },
+	{ 0x244, 0x03f,		"DNA" }, /* ? */
+	{ 0x244, 0x04f,		"Finnet" },
+	{ 0x244, 0x05f,		"Elisa" },
+	{ 0x244, 0x07f,		"Nokia" },
+	{ 0x244, 0x08f,		"Unknown" },
+	{ 0x244, 0x09f,		"Finnet Group" },
+	{ 0x244, 0x10f,		"TDC Oy" },
+	{ 0x244, 0x12f,		"Finnet Networks / DNA" },
+	{ 0x244, 0x14f,		"AMT" },
+	{ 0x244, 0x16f,		"Oy Finland Tele2" },
+	{ 0x244, 0x21f,		"Saunalahti" },
+	{ 0x244, 0x29f,		"Scnl Truphone" }, /* ? */
+	{ 0x244, 0x91f,		"Sonera" },
+	{ 0x208, -1,	"France" },
+	{ 0x208, 0x00f,		"Orange" }, /* ? */
+	{ 0x208, 0x01f,		"Orange" },
+	{ 0x208, 0x02f,		"Orange" },
+	{ 0x208, 0x05f,		"Globalstar Europe" },
+	{ 0x208, 0x06f,		"Globalstar Europe" },
+	{ 0x208, 0x07f,		"Globalstar Europe" },
+	{ 0x208, 0x10f,		"SFR" },
+	{ 0x208, 0x11f,		"SFR" },
+	{ 0x208, 0x13f,		"SFR" }, /* ? */
+	{ 0x208, 0x20f,		"Bouygues" },
+	{ 0x208, 0x21f,		"Bouygues" },
+	{ 0x208, 0x22f,		"Transatel Mobile" },
+	{ 0x208, 0x88f,		"Bouygues" },
+	{ 0x628, -1,	"Gabon" },
+	{ 0x628, 0x01f,		"Libertis" },
+	{ 0x628, 0x02f,		"Moov (Telecel) Gabon S.A." },
+	{ 0x628, 0x03f,		"Celtel / Zain" },
+	{ 0x628, 0x04f,		"USAN Gabon" },
+	{ 0x607, -1,	"Gambia" },
+	{ 0x607, 0x01f,		"Gamcel" },
+	{ 0x607, 0x02f,		"Africel" },
+	{ 0x607, 0x03f,		"Comium" },
+	{ 0x607, 0x04f,		"QCell" }, /* ? */
+	{ 0x282, -1,	"Georgia" },
+	{ 0x282, 0x01f,		"Geocell" },
+	{ 0x282, 0x02f,		"MagtiCom" },
+	{ 0x282, 0x03f,		"Iberiatel" },
+	{ 0x282, 0x04f,		"Beeline" },
+	{ 0x282, 0x05f,		"Silknet JSC" },
+	{ 0x289, 0x67f,		"Aquafon" }, /* ? */
+	{ 0x289, 0x88f,		"A-Mobile" }, /* ? */
+	{ 0x262, -1,	"Germany" },
+	{ 0x262, 0x01f,		"T-Mobile" },
+	{ 0x262, 0x02f,		"Vodafone" },
+	{ 0x262, 0x03f,		"E-Plus" },
+	{ 0x262, 0x04f,		"Vodafone" },
+	{ 0x262, 0x05f,		"E-Plus" },
+	{ 0x262, 0x06f,		"T-Mobile" },
+	{ 0x262, 0x07f,		"O2" },
+	{ 0x262, 0x08f,		"O2" },
+	{ 0x262, 0x09f,		"Vodafone" },
+	{ 0x262, 0x10f,		"DB Systel GSM-R" },
+	{ 0x262, 0x11f,		"O2" },
+	{ 0x262, 0x12f,		"Dolphin Telecom" },
+	{ 0x262, 0x13f,		"Mobilcom Multimedia" },
+	{ 0x262, 0x14f,		"Group 3G UMTS" },
+	{ 0x262, 0x15f,		"Airdata" },
+	{ 0x262, 0x16f,		"Vistream" }, /* ? */
+	{ 0x262, 0x42f,		"OpenBSC" }, /* ? */
+	{ 0x262, 0x60f,		"DB Telematik" },
+	{ 0x262, 0x76f,		"Siemens AG" },
+	{ 0x262, 0x77f,		"E-Plus" },
+	{ 0x262, 0x901,		"Debitel" }, /* ? */
+	{ 0x620, -1,	"Ghana" },
+	{ 0x620, 0x01f,		"Spacefon / MTN" },
+	{ 0x620, 0x02f,		"Ghana Telecom Mobile / Vodafone" },
+	{ 0x620, 0x03f,		"Mobiltel / tiGO" },
+	{ 0x620, 0x04f,		"Kasapa / Hutchison Telecom" },
+	{ 0x620, 0x06f,		"Zain" }, /* ? */
+	{ 0x620, 0x10f,		"Netafriques" }, /* ? */
+	{ 0x266, -1,	"Gibraltar" },
+	{ 0x266, 0x01f,		"GibTel" },
+	{ 0x266, 0x06f,		"CTS Mobile" },
+	{ 0x266, 0x09f,		"Cloud9 Mobile Communications" },
+	{ 0x202, -1,	"Greece" },
+	{ 0x202, 0x01f,		"Cosmote" },
+	{ 0x202, 0x05f,		"Vodafone" },
+	{ 0x202, 0x09f,		"Infoquest / Wind" },
+	{ 0x202, 0x10f,		"Wind" },
+	{ 0x290, -1,	"Greenland" },
+	{ 0x290, 0x01f,		"TELE Greenland A/S" },
+	{ 0x352, -1,	"Grenada" },
+	{ 0x352, 0x030,		"Digicel" },
+	{ 0x352, 0x110,		"Cable &  Wireless" },
+	{ 0x340, -1,	"Guadeloupe" },
+	{ 0x340, 0x01f,		"Orange" },
+	{ 0x340, 0x02f,		"Outremer" },
+	{ 0x340, 0x03f,		"Telcell" },
+	{ 0x340, 0x08f,		"MIO GSM" },
+	{ 0x340, 0x10f,		"Guadeloupe Telephone Mobile" },
+	{ 0x340, 0x20f,		"Digicel" },
+	{ 0x310, -1,	"United States of America" },
+	{ 0x310, 0x010,		"Verizon Wireless" },
+	{ 0x310, 0x012,		"Verizon Wireless" },
+	{ 0x310, 0x013,		"Verizon Wireless" },
+	{ 0x310, 0x016,		"Cricket Communications" },
+	{ 0x310, 0x017,		"North Sight Communications Inc." },
+	{ 0x310, 0x020,		"Union Telephone Company" },
+	{ 0x310, 0x030,		"Centennial Communications" },
+	{ 0x310, 0x035,		"ETEX Communications dba ETEX Wireless" },
+	{ 0x310, 0x040,		"MTA Communications dba MTA Wireless" },
+	{ 0x310, 0x050,		"ACS Wireless Inc." },
+	{ 0x310, 0x060,		"Consolidated Telecom" },
+	{ 0x310, 0x070,		"Cingular Wireless" },
+	{ 0x310, 0x080,		"Corr Wireless Communications LLC" },
+	{ 0x310, 0x090,		"Cingular Wireless" },
+	{ 0x310, 0x100,		"New Mexicu RSA 4 East Ltd. Partnership" },
+	{ 0x310, 0x110,		"Pacific Telecom Inc." },
+	{ 0x310, 0x130,		"Carolina West Wireless" },
+	{ 0x310, 0x140,		"GTA Wireless LLC" },
+	{ 0x310, 0x150,		"Cingular Wireless" },
+	{ 0x310, 0x160,		"T-Mobile USA" },
+	{ 0x310, 0x170,		"Cingular Wireless" },
+	{ 0x310, 0x180,		"West Central Wireless" },
+	{ 0x310, 0x190,		"Alaska Wireless Communications LLC" },
+	{ 0x310, 0x200,		"T-Mobile USA" },
+	{ 0x310, 0x210,		"T-Mobile USA" },
+	{ 0x310, 0x220,		"T-Mobile USA" },
+	{ 0x310, 0x230,		"T-Mobile USA" },
+	{ 0x310, 0x240,		"T-Mobile USA" },
+	{ 0x310, 0x250,		"T-Mobile USA" },
+	{ 0x310, 0x260,		"T-Mobile USA" },
+	{ 0x310, 0x270,		"T-Mobile USA" },
+	{ 0x310, 0x280,		"Contennial Puerto Rio License Corp." },
+	{ 0x310, 0x290,		"Nep Cellcorp Inc." },
+	{ 0x310, 0x300,		"Blanca Telephone Company" },
+	{ 0x310, 0x310,		"T-Mobile USA" },
+	{ 0x310, 0x320,		"Simth Bagley Inc, dba Cellular One" },
+	{ 0x310, 0x340,		"High Plains Midwest LLC, dba Wetlink Communications" },
+	{ 0x310, 0x350, 	"Mohave Cellular L.P." },
+	{ 0x310, 0x360,		"Cellular Network Partnership dba Pioneer Cellular" },
+	{ 0x310, 0x370,		"Guamcell Cellular and Paging" },
+	{ 0x310, 0x380, 	"New Cingular Wireless PCS, LLC" },
+	{ 0x310, 0x390,		"TX-11 Acquisition LLC" },
+	{ 0x310, 0x400,		"Wave Runner LLC" },
+	{ 0x310, 0x410,		"Cingular Wireless" },
+	{ 0x310, 0x420,		"Cincinnati Bell Wireless LLC" },
+	{ 0x310, 0x430,		"Alaska Digital LLC" },
+	{ 0x310, 0x440,		"Numerex Corp" },
+	{ 0x310, 0x450,		"North East Cellular Inc" },
+	{ 0x310, 0x460,		"TMP Corporation" },
+	{ 0x310, 0x470,		"nTELOS Communications Inc" },
+	{ 0x310, 0x480,		"Choice Phone LLC" },
+	{ 0x310, 0x490,		"T-Mobile USA" },
+	{ 0x310, 0x500,		"Public Service Cellular, Inc." },
+	{ 0x310, 0x520,		"Transactions Network Services" },
+	{ 0x310, 0x530,		"Iowa Wireless Services LLC" },
+	{ 0x310, 0x540,		"Oklahoma Western Telephone Company" },
+	{ 0x310, 0x550,		"Wireless Solutions International" },
+	{ 0x310, 0x560,		"Cingular Wireless" },
+	{ 0x310, 0x570,		"MTPCS LLC" },
+	{ 0x310, 0x580,		"Inland Celluar Telephone Company" },
+	{ 0x310, 0x590,		"Western Wireless Corporation" },
+	{ 0x310, 0x600,		"New Cell Inc. dba Cellcom" },
+	{ 0x310, 0x610,		"Elkhart Telephone Co. Inc. dba Epic Touch Co." },
+	{ 0x310, 0x620,		"Coleman County Telecommunications Inc. (Trans Texas PCS)" },
+	{ 0x310, 0x640,		"Airadigm Communications" },
+	{ 0x310, 0x650,		"Jasper Wireless Inc." },
+	{ 0x310, 0x660,		"T-Mobile USA" },
+	{ 0x310, 0x670,		"AT&T Mobility Vanguard Services" },
+	{ 0x310, 0x680,		"Cingular Wireless" },
+	{ 0x310, 0x690,		"Keystane Wireless LLC" },
+	{ 0x310, 0x700,		"Cross Valiant Cellular Partnership" },
+	{ 0x310, 0x710,		"Arctic Slope Telephone Association Cooperative" },
+	{ 0x310, 0x720,		"Wireless Solutions International Inc." },
+	{ 0x310, 0x730,		"US Cellular" },
+	{ 0x310, 0x740,		"Convey Communications Inc" },
+	{ 0x310, 0x750,		"East Kentucky Network LLC dba Appalachian Wireless" },
+	{ 0x310, 0x760,		"Lynch 3G Communcations Corporation" },
+	{ 0x310, 0x770,		"Iowa Wireless Services LLC dba I Wireless" },
+	{ 0x310, 0x780,		"Connect Net Inc" },
+	{ 0x310, 0x790,		"PinPoint Communications Inc."},
+	{ 0x310, 0x800,		"T-Mobile USA" },
+	{ 0x310, 0x810,		"LCFR LLC" },
+	{ 0x310, 0x820,		"South Canaan Cellular Communications Co. LP" },
+	{ 0x310, 0x830,		"Caprock Cellular Ltd. Partnership" },
+	{ 0x310, 0x840,		"Telecom North America Mobile Inc" },
+	{ 0x310, 0x850,		"Aeris Communications Inc." },
+	{ 0x310, 0x860,		"TX RSA 15B2, LP dba Five Star Wireless" },
+	{ 0x310, 0x870,		"Kaplan Telephone Company, Inc" },
+	{ 0x310, 0x890,		"Rural Cellular Corporation" },
+	{ 0x310, 0x900,		"Cable & Communications Corporation dba Mid-Rivers Wireless" },
+	{ 0x310, 0x910,		"Verizon Wireless" },
+	{ 0x310, 0x930,		"Copper Valley Wireless" },
+	{ 0x310, 0x940,		"Iris Wireless LLC" },
+	{ 0x310, 0x950,		"Texas RSA 1 dba XIT Wireless" },
+	{ 0x310, 0x960,		"UBET Wireless" },
+	{ 0x310, 0x970,		"Globalstar USA" },
+	{ 0x310, 0x980,		"Texas RSA 7B3 dba Peoples Wireless Services" },
+	{ 0x310, 0x99,		"Worldcall Interconnect" },
+
+	{ 0x704, -1,	"Guatemala" },
+	{ 0x704, 0x01f,		"Claro" },
+	{ 0x704, 0x02f,		"Comcel / Tigo" },
+	{ 0x704, 0x03f,		"movistar" },
+//	{ 0x704, ?,		"digicel" },
+	{ 0x234, -1,	"Guernsey" },
+	{ 0x234, 0x55f,		"Sure Mobile" },
+	{ 0x234, 0x50f,		"Wave Telecom" },
+	{ 0x234, 0x03f,		"Airtel Vodafone" },
+	{ 0x611, -1,	"Guinea" },
+	{ 0x611, 0x01f,		"Orange / Spacetel" },
+	{ 0x611, 0x02f,		"Sotelgui / Lagui" },
+	{ 0x611, 0x03f,		"Telecel Guinee" }, /* ? */
+	{ 0x611, 0x04f,		"MTN" }, /* ? */
+	{ 0x611, 0x05f,		"Cellcom Guinee" },
+	{ 0x632, -1,	"Guinea-Bissau" },
+	{ 0x632, 0x01f,		"Guinetel" },
+	{ 0x632, 0x02f,		"Spacetel / Areeba" },
+	{ 0x632, 0x03f,		"Orange" },
+	{ 0x738, -1,	"Guyana" },
+	{ 0x738, 0x01f,		"Digicel" },
+	{ 0x738, 0x02f,		"GT&T Cellink Plus" }, /* ? */
+	{ 0x372, -1,	"Haiti" },
+	{ 0x372, 0x01f,		"Comcel / Voila" },
+	{ 0x338, 0x050,		"Digicel" },
+	{ 0x338, 0x03f,		"Rectel" },
+	{ 0x708, -1,	"Honduras" },
+	{ 0x708, 0x01f,		"Claro" },
+	{ 0x708, 0x02f,		"Celtel / Tigo" },
+	{ 0x708, 0x30f,		"Hondutel" }, /* ? */
+	{ 0x708, 0x40f,		"DIGICEL" },
+	{ 0x454, -1,	"Hong Kong" },
+	{ 0x454, 0x00f,		"1O1O and One2Free" },
+	{ 0x454, 0x01f,		"CITIC Telecom 1616" },
+	{ 0x454, 0x02f,		"CSL Limited" },
+	{ 0x454, 0x03f,		"3 (3G)" },
+	{ 0x454, 0x04f,		"3 DualBand (2G)" },
+	{ 0x454, 0x05f,		"3 CDMA" },
+	{ 0x454, 0x06f,		"SmarTone-Vodafone" },
+	{ 0x454, 0x07f,		"China Unicom (Hong Kong) Limited" },
+	{ 0x454, 0x08f,		"Trident" },
+	{ 0x454, 0x09f,		"China Motion Telecom" },
+	{ 0x454, 0x10f,		"New World Mobility" },
+	{ 0x454, 0x11f,		"China-Hongkong Telecom" },
+	{ 0x454, 0x12f,		"CMCC HK" },
+	{ 0x454, 0x14f,		"Hutchison Telecom" },
+	{ 0x454, 0x15f,		"SmarTone Mobile Communications Limited" },
+	{ 0x454, 0x16f,		"PCCW Mobile (2G)" },
+	{ 0x454, 0x17f,		"SmarTone Mobile Communications Limited" },
+	{ 0x454, 0x18f,		"CSL Limited" },
+	{ 0x454, 0x19f,		"Sunday3G" },
+	{ 0x454, 0x19f,		"PCCW Mobile (3G)" },
+	{ 0x454, 0x29f,		"PCCW Mobile (CDMA)" },
+	{ 0x216, -1,	"Hungary" },
+	{ 0x216, 0x01f,		"Pannon GSM" },
+	{ 0x216, 0x30f,		"Westel 900" },
+	{ 0x216, 0x70f,		"Vodafone" },
+	{ 0x274, -1,	"Iceland" },
+	{ 0x274, 0x01f,		"Siminn" },
+	{ 0x274, 0x02f,		"Vodafone" },
+	{ 0x274, 0x03f,		"Vodafone" },
+	{ 0x274, 0x04f,		"IMC Viking" },
+	{ 0x274, 0x06f,		"N?ll n?u ehf" }, /* ? */
+	{ 0x274, 0x07f,		"IceCell" },
+	{ 0x274, 0x08f,		"On-waves" },
+	{ 0x274, 0x11f,		"Nova" },
+	/* FIXME: update the list from here below */
+	{ 0x404, -1,	"India" },
+	{ 0x404, 0x01f,		"Vodafone IN" },
+	{ 0x404, 0x02f,		"AirTel" },
+	{ 0x404, 0x04f,		"IDEA" },
+	{ 0x404, 0x05f,		"Vodafone IN" },
+	{ 0x404, 0x07f,		"IDEA" },
+	{ 0x404, 0x09f,		"Reliance" },
+	{ 0x404, 0x10f,		"AirTel" },
+	{ 0x404, 0x11f,		"Vodafone IN" },
+	{ 0x404, 0x12f,		"IDEA" },
+	{ 0x404, 0x13f,		"Vodafone IN" },
+	{ 0x404, 0x14f,		"IDEA" },
+	{ 0x404, 0x15f,		"Vodafone IN" },
+	{ 0x404, 0x17f,		"AIRCEL" },
+	{ 0x404, 0x19f,		"IDEA" },
+	{ 0x404, 0x20f,		"Vodafone IN" },
+	{ 0x404, 0x21f,		"Loop Mobile" },
+	{ 0x404, 0x22f,		"IDEA" },
+	{ 0x404, 0x24f,		"IDEA" },
+	{ 0x404, 0x27f,		"Vodafone IN" },
+	{ 0x404, 0x28f,		"AIRCEL" },
+	{ 0x404, 0x29f,		"AIRCEL" },
+	{ 0x404, 0x30f,		"Vodafone IN" },
+	{ 0x404, 0x31f,		"AirTel" },
+	{ 0x404, 0x34f,		"CellOne" },
+	{ 0x404, 0x36f,		"Reliance" },
+	{ 0x404, 0x37f,		"Aircel" },
+	{ 0x404, 0x38f,		"CellOne" },
+	{ 0x404, 0x41f,		"Aircel" },
+	{ 0x404, 0x42f,		"Aircel" },
+	{ 0x404, 0x44f,		"IDEA" },
+	{ 0x404, 0x45f,		"Airtel" },
+	{ 0x404, 0x51f,		"CellOne" },
+	{ 0x404, 0x52f,		"Reliance" },
+	{ 0x404, 0x53f,		"CellOne" },
+	{ 0x404, 0x54f,		"CellOne" },
+	{ 0x404, 0x55f,		"CellOne" },
+	{ 0x404, 0x56f,		"IDEA" },
+	{ 0x404, 0x57f,		"CellOne" },
+	{ 0x404, 0x58f,		"CellOne" },
+	{ 0x404, 0x59f,		"CellOne" },
+	{ 0x404, 0x60f,		"Vodafone IN" },
+	{ 0x404, 0x62f,		"CellOne" },
+	{ 0x404, 0x64f,		"CellOne" },
+	{ 0x404, 0x66f,		"CellOne" },
+	{ 0x404, 0x67f,		"Reliance GSM" },
+	{ 0x404, 0x68f,		"DOLPHIN" },
+	{ 0x404, 0x69f,		"DOLPHIN" },
+	{ 0x404, 0x72f,		"CellOne" },
+	{ 0x404, 0x74f,		"CellOne" },
+	{ 0x404, 0x76f,		"CellOne" },
+	{ 0x404, 0x78f,		"Idea Cellular Ltd" },
+	{ 0x404, 0x80f,		"BSNL MOBILE" },
+	{ 0x404, 0x81f,		"CellOne" },
+	{ 0x404, 0x82f,		"Idea" },
+	{ 0x404, 0x83f,		"Reliance Smart GSM" },
+	{ 0x404, 0x84f,		"Vodafone IN" },
+	{ 0x404, 0x85f,		"Reliance" },
+	{ 0x404, 0x86f,		"Vodafone IN" },
+	{ 0x404, 0x90f,		"AirTel" },
+	{ 0x404, 0x91f,		"AIRCEL" },
+	{ 0x404, 0x92f,		"AirTel" },
+	{ 0x404, 0x93f,		"AirTel" },
+	{ 0x404, 0x96f,		"AirTel" },
+	{ 0x405, 0x05f,		"Reliance" },
+	{ 0x405, 0x10f,		"Reliance" },
+	{ 0x405, 0x13f,		"Reliance" },
+	{ 0x405, 0x025,		"TATA DOCOMO" },
+	{ 0x405, 0x026,		"TATA DOCOMO" },
+	{ 0x405, 0x027,		"TATA DOCOMO" },
+	{ 0x405, 0x029,		"TATA DOCOMO" },
+	{ 0x405, 0x030,		"TATA DOCOMO" },
+	{ 0x405, 0x031,		"TATA DOCOMO" },
+	{ 0x405, 0x032,		"TATA DOCOMO" },
+	{ 0x405, 0x034,		"TATA DOCOMO" },
+	{ 0x405, 0x035,		"TATA DOCOMO" },
+	{ 0x405, 0x036,		"TATA DOCOMO" },
+	{ 0x405, 0x037,		"TATA DOCOMO" },
+	{ 0x405, 0x038,		"TATA DOCOMO" },
+	{ 0x405, 0x039,		"TATA DOCOMO" },
+	{ 0x405, 0x041,		"TATA DOCOMO" },
+	{ 0x405, 0x042,		"TATA DOCOMO" },
+	{ 0x405, 0x043,		"TATA DOCOMO" },
+	{ 0x405, 0x044,		"TATA DOCOMO" },
+	{ 0x405, 0x045,		"TATA DOCOMO" },
+	{ 0x405, 0x046,		"TATA DOCOMO" },
+	{ 0x405, 0x047,		"TATA DOCOMO" },
+	{ 0x405, 0x51f,		"AirTel" },
+	{ 0x405, 0x52f,		"AirTel" },
+	{ 0x405, 0x54f,		"AirTel" },
+	{ 0x405, 0x56f,		"AirTel" },
+	{ 0x405, 0x66f,		"Vodafone IN" },
+	{ 0x405, 0x70f,		"IDEA" },
+	{ 0x405, 0x750,		"Vodafone IN" },
+	{ 0x405, 0x751,		"Vodafone IN" },
+	{ 0x405, 0x752,		"Vodafone IN" },
+	{ 0x405, 0x753,		"Vodafone IN" },
+	{ 0x405, 0x754,		"Vodafone IN" },
+	{ 0x405, 0x755,		"Vodafone IN" },
+	{ 0x405, 0x756,		"Vodafone IN" },
+	{ 0x405, 0x799,		"IDEA" },
+	{ 0x405, 0x800,		"AIRCEL" },
+	{ 0x405, 0x801,		"AIRCEL" },
+	{ 0x405, 0x802,		"AIRCEL" },
+	{ 0x405, 0x803,		"AIRCEL" },
+	{ 0x405, 0x804,		"AIRCEL" },
+	{ 0x405, 0x805,		"AIRCEL" },
+	{ 0x405, 0x806,		"AIRCEL" },
+	{ 0x405, 0x807,		"AIRCEL" },
+	{ 0x405, 0x808,		"AIRCEL" },
+	{ 0x405, 0x809,		"AIRCEL" },
+	{ 0x405, 0x810,		"AIRCEL" },
+	{ 0x405, 0x811,		"AIRCEL" },
+	{ 0x405, 0x812,		"AIRCEL" },
+	{ 0x405, 0x819,		"Uninor" },
+	{ 0x405, 0x818,		"[Uninor]" },
+	{ 0x405, 0x820,		"Uninor" },
+	{ 0x405, 0x821,		"Uninor" },
+	{ 0x405, 0x822,		"Uninor" },
+	{ 0x405, 0x880,		"Uninor" },
+	{ 0x405, 0x824,		"Videocon Datacom" },
+	{ 0x405, 0x834,		"Videocon Datacom" },
+	{ 0x405, 0x844,		"Uninor" },
+	{ 0x405, 0x845,		"IDEA" },
+	{ 0x405, 0x848,		"IDEA" },
+	{ 0x405, 0x850,		"IDEA" },
+	{ 0x405, 0x855,		"Loop Mobile" },
+	{ 0x405, 0x864,		"Loop Mobile" },
+	{ 0x405, 0x865,		"Loop Mobile" },
+	{ 0x405, 0x875,		"Uninor" },
+	{ 0x405, 0x881,		"S Tel" },
+	{ 0x405, 0x912,		"Etisalat DB" },
+	{ 0x405, 0x913,		"Etisalat DB" },
+	{ 0x405, 0x917,		"Etisalat DB" },
+	{ 0x405, 0x929,		"Uninor" },
+	{ 0x510, -1,	"Indonesia" },
+	{ 0x510, 0x00f,		"PSN" },
+	{ 0x510, 0x01f,		"INDOSAT" },
+	{ 0x510, 0x03f,		"StarOne" },
+	{ 0x510, 0x07f,		"TelkomFlexi" },
+	{ 0x510, 0x08f,		"AXIS" },
+	{ 0x510, 0x09f,		"SMART" },
+	{ 0x510, 0x10f,		"Telkomsel" },
+	{ 0x510, 0x11f,		"XL" },
+	{ 0x510, 0x20f,		"TELKOMMobile" },
+	{ 0x510, 0x21f,		"IM3" },
+	{ 0x510, 0x27f,		"Ceria" },
+	{ 0x510, 0x28f,		"Fren/Hepi" },
+	{ 0x510, 0x89f,		"3" },
+	{ 0x510, 0x99f,		"Esia " },
+	{ 0x432, -1,	"Iran" },
+	{ 0x432, 0x11f,		"MCI" },
+	{ 0x432, 0x14f,		"TKC" },
+	{ 0x432, 0x19f,		"MTCE" },
+	{ 0x432, 0x32f,		"Taliya" },
+	{ 0x432, 0x35f,		"Irancell" },
+	{ 0x418, -1,	"Iraq" },
+	{ 0x418, 0x20f,		"Zain IQ" },
+	{ 0x418, 0x30f,		"Zain IQ" },
+	{ 0x418, 0x05f,		"Asia Cell" },
+	{ 0x418, 0x40f,		"Korek" },
+	{ 0x418, 0x08f,		"SanaTel" },
+//	{ 0x418, ?,		"IRAQNA" },
+	{ 0x272, -1,	"Ireland" },
+	{ 0x272, 0x01f,		"Vodafone" },
+	{ 0x272, 0x02f,		"O2" },
+	{ 0x272, 0x03f,		"Meteor" },
+	{ 0x272, 0x04f,		"Access Telecom" },
+	{ 0x272, 0x05f,		"3" },
+	{ 0x272, 0x07f,		"Eircom" },
+	{ 0x272, 0x09f,		"Clever Communications" },
+	{ 0x234, -1,	"Isle of Man" },
+	{ 0x234, 0x58f,		"Pronto GSM" },
+	{ 0x425, -1,	"Israel" },
+	{ 0x425, 0x01f,		"Orange" },
+	{ 0x425, 0x02f,		"Cellcom" },
+	{ 0x425, 0x03f,		"Pelephone" },
+	{ 0x425, 0x77f,		"Mirs" },
+	{ 0x222, -1,	"Italy" },
+	{ 0x222, 0x01f,		"TIM" },
+	{ 0x222, 0x02f,		"Elsacom" },
+	{ 0x222, 0x10f,		"Vodafone" },
+	{ 0x222, 0x30f,		"RFI" },
+	{ 0x222, 0x77f,		"IPSE 2000" },
+	{ 0x222, 0x88f,		"Wind" },
+	{ 0x222, 0x98f,		"Blu" },
+	{ 0x222, 0x99f,		"3 Italia" },
+	{ 0x612, -1,	"Ivory Coast" },
+	{ 0x612, 0x01f,		"Cora de Comstar" },
+	{ 0x612, 0x02f,		"Moov" },
+	{ 0x612, 0x03f,		"Orange" },
+	{ 0x612, 0x04f,		"KoZ" },
+	{ 0x612, 0x05f,		"MTN" },
+	{ 0x612, 0x06f,		"ORICEL" },
+	{ 0x338, -1,	"Jamaica" },
+	{ 0x338, 0x020,		"LIME (formerly known as Cable & Wireless)" },
+	{ 0x338, 0x050,		"Digicel" },
+	{ 0x338, 0x070,		"Claro" },
+	{ 0x338, 0x180,		"LIME (formerly known as Cable & Wireless)" },
+	{ 0x440, -1,	"Japan" },
+	{ 0x440, 0x00f,		"eMobile" },
+	{ 0x440, 0x01f,		"NTT docomo" },
+	{ 0x440, 0x02f,		"NTT docomo" },
+	{ 0x440, 0x03f,		"NTT docomo" },
+	{ 0x440, 0x04f,		"SoftBank" },
+	{ 0x440, 0x06f,		"SoftBank" },
+	{ 0x440, 0x07f,		"KDDI" },
+	{ 0x440, 0x08f,		"KDDI" },
+	{ 0x440, 0x09f,		"NTT docomo" },
+	{ 0x440, 0x10f,		"NTT docomo" },
+	{ 0x440, 0x11f,		"NTT docomo" },
+	{ 0x440, 0x12f,		"NTT docomo" },
+	{ 0x440, 0x13f,		"NTT docomo" },
+	{ 0x440, 0x14f,		"NTT docomo" },
+	{ 0x440, 0x15f,		"NTT docomo" },
+	{ 0x440, 0x16f,		"NTT docomo" },
+	{ 0x440, 0x17f,		"NTT docomo" },
+	{ 0x440, 0x18f,		"NTT docomo" },
+	{ 0x440, 0x19f,		"NTT docomo" },
+	{ 0x440, 0x20f,		"SoftBank" },
+	{ 0x440, 0x21f,		"NTT docomo" },
+	{ 0x440, 0x22f,		"NTT docomo" },
+	{ 0x440, 0x23f,		"DoCoMo" },
+	{ 0x440, 0x24f,		"DoCoMo" },
+	{ 0x440, 0x25f,		"DoCoMo" },
+	{ 0x440, 0x26f,		"DoCoMo" },
+	{ 0x440, 0x27f,		"DoCoMo" },
+	{ 0x440, 0x28f,		"DoCoMo" },
+	{ 0x440, 0x29f,		"DoCoMo" },
+	{ 0x440, 0x30f,		"DoCoMo" },
+	{ 0x440, 0x31f,		"DoCoMo" },
+	{ 0x440, 0x32f,		"DoCoMo" },
+	{ 0x440, 0x33f,		"DoCoMo" },
+	{ 0x440, 0x34f,		"DoCoMo" },
+	{ 0x440, 0x35f,		"DoCoMo" },
+	{ 0x440, 0x36f,		"DoCoMo" },
+	{ 0x440, 0x37f,		"DoCoMo" },
+	{ 0x440, 0x38f,		"DoCoMo" },
+	{ 0x440, 0x39f,		"DoCoMo" },
+	{ 0x440, 0x40f,		"SoftBank" },
+	{ 0x440, 0x41f,		"SoftBank" },
+	{ 0x440, 0x42f,		"SoftBank" },
+	{ 0x440, 0x43f,		"SoftBank" },
+	{ 0x440, 0x44f,		"SoftBank" },
+	{ 0x440, 0x45f,		"SoftBank" },
+	{ 0x440, 0x46f,		"SoftBank" },
+	{ 0x440, 0x47f,		"SoftBank" },
+	{ 0x440, 0x48f,		"SoftBank" },
+	{ 0x440, 0x49f,		"DoCoMo" },
+	{ 0x440, 0x50f,		"KDDI" },
+	{ 0x440, 0x51f,		"KDDI" },
+	{ 0x440, 0x52f,		"KDDI" },
+	{ 0x440, 0x53f,		"KDDI" },
+	{ 0x440, 0x54f,		"KDDI" },
+	{ 0x440, 0x55f,		"KDDI" },
+	{ 0x440, 0x56f,		"KDDI" },
+	{ 0x440, 0x58f,		"DoCoMo" },
+	{ 0x440, 0x60f,		"DoCoMo" },
+	{ 0x440, 0x61f,		"DoCoMo" },
+	{ 0x440, 0x62f,		"DoCoMo" },
+	{ 0x440, 0x63f,		"DoCoMo" },
+	{ 0x440, 0x64f,		"DoCoMo" },
+	{ 0x440, 0x65f,		"DoCoMo" },
+	{ 0x440, 0x66f,		"DoCoMo" },
+	{ 0x440, 0x67f,		"DoCoMo" },
+	{ 0x440, 0x68f,		"DoCoMo" },
+	{ 0x440, 0x69f,		"DoCoMo" },
+	{ 0x440, 0x70f,		"au" },
+	{ 0x440, 0x71f,		"KDDI" },
+	{ 0x440, 0x72f,		"KDDI" },
+	{ 0x440, 0x73f,		"KDDI" },
+	{ 0x440, 0x74f,		"KDDI" },
+	{ 0x440, 0x75f,		"KDDI" },
+	{ 0x440, 0x76f,		"KDDI" },
+	{ 0x440, 0x77f,		"KDDI" },
+	{ 0x440, 0x78f,		"Okinawa Cellular Telephone" },
+	{ 0x440, 0x79f,		"KDDI" },
+	{ 0x440, 0x80f,		"TU-KA" },
+	{ 0x440, 0x81f,		"TU-KA" },
+	{ 0x440, 0x82f,		"TU-KA" },
+	{ 0x440, 0x83f,		"TU-KA" },
+	{ 0x440, 0x84f,		"TU-KA" },
+	{ 0x440, 0x85f,		"TU-KA" },
+	{ 0x440, 0x86f,		"TU-KA" },
+	{ 0x440, 0x87f,		"DoCoMo" },
+	{ 0x440, 0x88f,		"KDDI" },
+	{ 0x440, 0x89f,		"KDDI" },
+	{ 0x440, 0x90f,		"SoftBank" },
+	{ 0x440, 0x92f,		"SoftBank" },
+	{ 0x440, 0x93f,		"SoftBank" },
+	{ 0x440, 0x94f,		"SoftBank" },
+	{ 0x440, 0x95f,		"SoftBank" },
+	{ 0x440, 0x96f,		"SoftBank" },
+	{ 0x440, 0x97f,		"SoftBank" },
+	{ 0x440, 0x98f,		"SoftBank" },
+	{ 0x440, 0x99f,		"DoCoMo" },
+	{ 0x234, -1,	"Jersey" },
+	{ 0x234, 0x50f,		"JT-Wave" },
+	{ 0x234, 0x55f,		"Sure Mobile" },
+	{ 0x234, 0x03f,		"Airtel Vodafone" },
+	{ 0x416, -1,	"Jordan" },
+	{ 0x416, 0x01f,		"zain JO" },
+	{ 0x416, 0x02f,		"XPress Telecom" },
+	{ 0x416, 0x03f,		"Umniah" },
+	{ 0x416, 0x77f,		"Orange" },
+	{ 0x401, -1,	"Kazakhstan" },
+	{ 0x401, 0x01f,		"Beeline" },
+	{ 0x401, 0x02f,		"Kcell" },
+	{ 0x401, 0x07f,		"Dalacom" },
+	{ 0x401, 0x77f,		"Mobile Telecom Service" },
+	{ 0x639, -1,	"Kenya" },
+	{ 0x639, 0x02f,		"Safaricom" },
+	{ 0x639, 0x03f,		"Zain" },
+	{ 0x639, 0x07f,		"Orange Kenya" },
+	{ 0x545, -1,	"Kiribati" },
+	{ 0x545, 0x09f,		"Kiribati Frigate" },
+	{ 0x467, -1,	"North Korea" },
+	{ 0x467, 0x193,		"SUN NET" },
+	{ 0x450, -1,	"South Korea" },
+	{ 0x450, 0x02f,		"KT" },
+	{ 0x450, 0x03f,		"Power 017" },
+	{ 0x450, 0x04f,		"KT" },
+	{ 0x450, 0x05f,		"SKT" },
+	{ 0x450, 0x06f,		"LGT" },
+	{ 0x450, 0x08f,		"KT SHOW" },
+	{ 0x212, -1,	"Kosovo" },
+	{ 0x212, 0x01f,		"Vala" },
+	{ 0x293, 0x41f,		"iPKO" },
+	{ 0x293, 0x41f,		"D3 Mobile" },
+	{ 0x212, 0x01f,		"Z Mobile" },
+	{ 0x419, -1,	"Kuwait" },
+	{ 0x419, 0x02f,		"zain KW" },
+	{ 0x419, 0x03f,		"Wataniya" },
+	{ 0x419, 0x04f,		"Viva" },
+	{ 0x437, -1,	"Kyrgyzstan" },
+	{ 0x437, 0x01f,		"Beeline" },
+	{ 0x437, 0x05f,		"MegaCom" },
+	{ 0x437, 0x09f,		"O!" },
+	{ 0x457, -1,	"Laos" },
+	{ 0x457, 0x01f,		"LaoTel" },
+	{ 0x457, 0x02f,		"ETL" },
+	{ 0x457, 0x03f,		"Unitel" },
+	{ 0x457, 0x08f,		"Tigo" },
+	{ 0x247, -1,	"Latvia" },
+	{ 0x247, 0x01f,		"LMT" },
+	{ 0x247, 0x02f,		"Tele2" },
+	{ 0x247, 0x03f,		"TRIATEL" },
+	{ 0x247, 0x05f,		"Bite" },
+	{ 0x247, 0x06f,		"Rigatta" },
+	{ 0x247, 0x07f,		"MTS" },
+	{ 0x247, 0x08f,		"IZZI" },
+	{ 0x247, 0x09f,		"Camel Mobile" },
+	{ 0x415, -1,	"Lebanon" },
+	{ 0x415, 0x01f,		"Alfa" },
+	{ 0x415, 0x03f,		"MTC-Touch" },
+	{ 0x651, -1,	"Lesotho" },
+	{ 0x651, 0x01f,		"Vodacom" },
+	{ 0x651, 0x02f,		"Econet Ezin-cel" },
+	{ 0x618, -1,	"Liberia" },
+	{ 0x618, 0x01f,		"Lonestar Cell" },
+	{ 0x618, 0x04f,		"Comium" },
+	{ 0x618, 0x20f,		"LIBTELCO" },
+	{ 0x606, -1,	"Libya" },
+	{ 0x606, 0x00f,		"Libyana" },
+	{ 0x606, 0x01f,		"Madar" },
+	{ 0x295, -1,	"Liechtenstein" },
+	{ 0x295, 0x01f,		"Swisscom" },
+	{ 0x295, 0x02f,		"Orange" },
+	{ 0x295, 0x05f,		"FL1" },
+	{ 0x295, 0x77f,		"Tele 2" },
+	{ 0x246, -1,	"Lithuania" },
+	{ 0x246, 0x01f,		"Omnitel" },
+	{ 0x246, 0x02f,		"BITE" },
+	{ 0x246, 0x03f,		"Tele 2" },
+	{ 0x270, -1,	"Luxembourg" },
+	{ 0x270, 0x01f,		"LuxGSM" },
+	{ 0x270, 0x77f,		"Tango" },
+	{ 0x270, 0x99f,		"Orange" },
+	{ 0x455, -1,	"Macau" },
+	{ 0x455, 0x00f,		"SmarTone" },
+	{ 0x455, 0x01f,		"CTM" },
+	{ 0x455, 0x02f,		"China Telecom" },
+	{ 0x455, 0x03f,		"3" },
+	{ 0x455, 0x04f,		"CTM" },
+	{ 0x455, 0x05f,		"3" },
+	{ 0x294, -1,	"Republic of Macedonia" },
+	{ 0x294, 0x01f,		"T-Mobile MK" },
+	{ 0x294, 0x02f,		"ONE" },
+	{ 0x294, 0x03f,		"Vip MK" },
+	{ 0x646, -1,	"Madagascar" },
+	{ 0x646, 0x01f,		"Zain" },
+	{ 0x646, 0x02f,		"Orange" },
+	{ 0x646, 0x03f,		"Sacel" },
+	{ 0x646, 0x04f,		"Telma" },
+	{ 0x650, -1,	"Malawi" },
+	{ 0x650, 0x01f,		"TNM" },
+	{ 0x650, 0x10f,		"Zain" },
+	{ 0x502, -1,	"Malaysia" },
+	{ 0x502, 0x12f,		"Maxis" },
+	{ 0x502, 0x13f,		"Celcom" },
+	{ 0x502, 0x16f,		"DiGi" },
+	{ 0x502, 0x17f,		"Maxis" },
+	{ 0x502, 0x18f,		"U Mobile" },
+	{ 0x502, 0x19f,		"Celcom" },
+	{ 0x472, -1,	"Maldives" },
+	{ 0x472, 0x01f,		"Dhiraagu" },
+	{ 0x472, 0x02f,		"Wataniya" },
+	{ 0x610, -1,	"Mali" },
+	{ 0x610, 0x01f,		"Malitel" },
+	{ 0x610, 0x02f,		"Orange" },
+	{ 0x278, -1,	"Malta" },
+	{ 0x278, 0x01f,		"Vodafone" },
+	{ 0x278, 0x21f,		"GO" },
+	{ 0x278, 0x77f,		"Melita" },
+	{ 0x000, -1,	"Marshall Islands" },
+//	{ 0x000, ?,		"?" },
+	{ 0x340, -1,	"Martinique" },
+	{ 0x340, 0x01f,		"Orange" },
+	{ 0x340, 0x02f,		"Outremer" },
+	{ 0x340, 0x20f,		"Digicel" },
+	{ 0x609, -1,	"Mauritania" },
+	{ 0x609, 0x01f,		"Mattel" },
+	{ 0x609, 0x10f,		"Mauritel" },
+	{ 0x617, -1,	"Mauritius" },
+	{ 0x617, 0x01f,		"Orange" },
+	{ 0x617, 0x02f,		"MTML" },
+	{ 0x617, 0x10f,		"Emtel" },
+	{ 0x334, -1,	"Mexico" },
+	{ 0x334, 0x01f,		"Nextel" },
+	{ 0x334, 0x02f,		"Telcel" },
+	{ 0x334, 0x03f,		"movistar" },
+	{ 0x334, 0x04f,		"Iusacell / Unefon" },
+	{ 0x550, -1,	"Federated States of Micronesia" },
+	{ 0x550, 0x01f,		"FSM Telecom" },
+	{ 0x259, -1,	"Moldova" },
+	{ 0x259, 0x01f,		"Orange" },
+	{ 0x259, 0x02f,		"Moldcell" },
+	{ 0x259, 0x03f,		"IDC" },
+	{ 0x259, 0x03f,		"Unit?" },
+	{ 0x259, 0x04f,		"Eventis" },
+	{ 0x259, 0x05f,		"Unit?" },
+	{ 0x212, -1,	"Monaco" },
+	{ 0x212, 0x01f,		"Office des Telephones" },
+	{ 0x428, -1,	"Mongolia" },
+	{ 0x428, 0x99f,		"MobiCom" },
+	{ 0x428, 0x88f,		"Unitel" },
+	{ 0x428, 0x91f,		"Skytel" },
+	{ 0x428, 0x98f,		"G.Mobile" },
+	{ 0x297, -1,	"Montenegro" },
+	{ 0x297, 0x01f,		"Telenor" },
+	{ 0x297, 0x02f,		"T-Mobile" },
+	{ 0x297, 0x03f,		"m:tel CG" },
+	{ 0x604, -1,	"Morocco" },
+	{ 0x604, 0x00f,		"Moditel" },
+	{ 0x604, 0x01f,		"IAM" },
+	{ 0x604, 0x02f,		"INWI" },
+	{ 0x605, 0x03f,		"yassine" },
+	{ 0x643, -1,	"Mozambique" },
+	{ 0x643, 0x01f,		"mCel" },
+	{ 0x643, 0x04f,		"Vodacom" },
+	{ 0x414, -1,	"Myanmar" },
+	{ 0x414, 0x01f,		"MPT" },
+	{ 0x649, -1,	"Namibia" },
+	{ 0x649, 0x01f,		"MTC" },
+	{ 0x649, 0x02f,		"switch" },
+	{ 0x649, 0x03f,		"Leo" },
+	{ 0x536, -1,	"Nauru" },
+	{ 0x429, -1,	"Nepal" },
+	{ 0x429, 0x01f,		"Namaste / NT Mobile" },
+	{ 0x429, 0x02f,		"Ncell" },
+	{ 0x429, 0x03f,		"Sky/C-Phone" },
+	{ 0x204, -1,	"Netherlands" },
+	{ 0x204, 0x01f,		"OneFoon" },
+	{ 0x204, 0x02f,		"Tele2" },
+	{ 0x204, 0x03f,		"Blyk" },
+	{ 0x204, 0x04f,		"Vodafone" },
+	{ 0x204, 0x05f,		"Elephant Talk" },
+	{ 0x204, 0x06f,		"Barablu Mobile" },
+	{ 0x204, 0x07f,		"Teleena" },
+	{ 0x204, 0x08f,		"KPN" },
+	{ 0x204, 0x09f,		"Lycamobile" },
+	{ 0x204, 0x10f,		"KPN" },
+	{ 0x204, 0x12f,		"Telfort" },
+	{ 0x204, 0x14f,		"6Gmobile" },
+	{ 0x204, 0x16f,		"T-Mobile" },
+	{ 0x204, 0x18f,		"Telfort" },
+	{ 0x204, 0x20f,		"Orange Nederland" },
+	{ 0x204, 0x21f,		"NS Railinfrabeheer B.V." },
+	{ 0x204, 0x67f,		"RadioAccess" },
+	{ 0x204, 0x69f,		"KPN Mobile" },
+	{ 0x362, -1,	"Netherlands Antilles" },
+	{ 0x362, 0x51f,		"Telcell" },
+	{ 0x362, 0x69f,		"Digicel" },
+	{ 0x362, 0x91f,		"UTS" },
+	{ 0x362, 0x00f,		"East Caribbean Cellular" },
+	{ 0x362, 0x00f,		"Antiliano Por N.V." },
+	{ 0x362, 0x95f,		"MIO" },
+	{ 0x362, 0x94f,		"Bay?s" },
+	{ 0x546, -1,	"New Caledonia" },
+	{ 0x546, 0x01f,		"Mobilis" },
+	{ 0x530, -1,	"New Zealand" },
+	{ 0x530, 0x00f,		"Telecom" },
+	{ 0x530, 0x01f,		"Vodafone" },
+	{ 0x530, 0x02f,		"Telecom" },
+	{ 0x530, 0x03f,		"Woosh" },
+	{ 0x530, 0x04f,		"TelstraClear" },
+	{ 0x530, 0x05f,		"XT Mobile Network" },
+	{ 0x530, 0x12f,		"360" },
+	{ 0x530, 0x24f,		"2degrees" },
+	{ 0x710, -1,	"Nicaragua" },
+	{ 0x710, 0x21f,		"Claro" },
+	{ 0x710, 0x30f,		"movistar" },
+	{ 0x710, 0x73f,		"SERCOM" },
+	{ 0x614, -1,	"Niger" },
+	{ 0x614, 0x01f,		"SahelCom" },
+	{ 0x614, 0x02f,		"Zain" },
+	{ 0x614, 0x03f,		"Telecel" },
+	{ 0x614, 0x04f,		"Orange" },
+	{ 0x621, -1,	"Nigeria" },
+	{ 0x621, 0x20f,		"Zain" },
+	{ 0x621, 0x30f,		"MTN" },
+	{ 0x621, 0x40f,		"M-Tel" },
+	{ 0x621, 0x50f,		"Glo" },
+	{ 0x621, 0x60f,		"Etisalat" },
+	{ 0x242, -1,	"Norway" },
+	{ 0x242, 0x01f,		"Telenor" },
+	{ 0x242, 0x02f,		"NetCom" },
+	{ 0x242, 0x03f,		"Teletopia" },
+	{ 0x242, 0x04f,		"Tele2" },
+	{ 0x242, 0x05f,		"Network Norway" },
+	{ 0x242, 0x06f,		"Ice" },
+	{ 0x242, 0x07f,		"Ventelo" },
+	{ 0x242, 0x08f,		"TDC Mobil AS" },
+	{ 0x242, 0x09f,		"Barablu Mobile Norway Ltd" },
+	{ 0x242, 0x20f,		"Jernbaneverket AS" },
+	{ 0x422, -1,	"Oman" },
+	{ 0x422, 0x02f,		"Oman Mobile" },
+	{ 0x422, 0x03f,		"Nawras" },
+	{ 0x410, -1,	"Pakistan" },
+	{ 0x410, 0x01f,		"Mobilink" },
+	{ 0x410, 0x03f,		"Ufone" },
+	{ 0x410, 0x04f,		"Zong" },
+	{ 0x410, 0x06f,		"Telenor" },
+	{ 0x410, 0x07f,		"Warid" },
+	{ 0x552, -1,	"Palau" },
+	{ 0x552, 0x01f,		"PNCC" },
+	{ 0x552, 0x80f,		"Palau Mobile" },
+	{ 0x423, -1,	"Palestinian Authority" },
+	{ 0x423, 0x05f,		"Jawwal" },
+	{ 0x423, 0x06f,		"Wataniya" },
+	{ 0x714, -1,	"Panama" },
+	{ 0x714, 0x01f,		"Cable & Wireless" },
+	{ 0x714, 0x02f,		"movistar" },
+	{ 0x714, 0x04f,		"Digicel" },
+	{ 0x714, 0x03f,		"Claro" },
+	{ 0x537, -1,	"Papua New Guinea" },
+	{ 0x537, 0x01f,		"B-Mobile" },
+	{ 0x537, 0x03f,		"Digicel" },
+	{ 0x744, -1,	"Paraguay" },
+	{ 0x744, 0x01f,		"VOX" },
+	{ 0x744, 0x02f,		"Claro" },
+	{ 0x744, 0x04f,		"Tigo" },
+	{ 0x744, 0x05f,		"Personal" },
+	{ 0x716, -1,	"Peru" },
+	{ 0x716, 0x06f,		"movistar" },
+	{ 0x716, 0x10f,		"Claro" },
+	{ 0x716, 0x17f,		"NEXTEL" },
+	{ 0x515, -1,	"Philippines" },
+	{ 0x515, 0x01f,		"Islacom" },
+	{ 0x515, 0x02f,		"Globe" },
+	{ 0x515, 0x03f,		"Smart" },
+	{ 0x515, 0x05f,		"Sun" },
+	{ 0x515, 0x11f,		"PLDT via ACeS Philippines" },
+	{ 0x515, 0x18f,		"Cure" },
+	{ 0x515, 0x88f,		"Nextel" },
+	{ 0x260, -1,	"Poland" },
+	{ 0x260, 0x01f,		"Plus" },
+	{ 0x260, 0x02f,		"Era" },
+	{ 0x260, 0x03f,		"Orange" },
+	{ 0x260, 0x04f,		"Netia S.A." },
+	{ 0x260, 0x05f,		"Polska Telefonia Kom?rkowa Centertel Sp. z o.o." },
+	{ 0x260, 0x06f,		"Play" },
+	{ 0x260, 0x07f,		"Netia" },
+	{ 0x260, 0x08f,		"E-Telko Sp. z o.o." },
+	{ 0x260, 0x09f,		"Telekomunikacja Kolejowa Sp. z o.o." },
+	{ 0x260, 0x10f,		"Sferia" },
+	{ 0x260, 0x11f,		"Nordisk Polska" },
+	{ 0x260, 0x12f,		"Cyfrowy Polsat" },
+	{ 0x260, 0x13f,		"Sferia" },
+	{ 0x260, 0x14f,		"Sferia" },
+	{ 0x260, 0x15f,		"CenterNet" },
+	{ 0x260, 0x16f,		"Mobyland" },
+	{ 0x260, 0x17f,		"Aero2" },
+	{ 0x268, -1,	"Portugal" },
+	{ 0x268, 0x01f,		"Vodafone" },
+	{ 0x268, 0x03f,		"Optimus" },
+	{ 0x268, 0x06f,		"TMN" },
+	{ 0x268, 0x21f,		"Zapp" },
+	{ 0x330, -1,	"Puerto Rico" },
+	{ 0x330, 0x11f,		"Claro" },
+	{ 0x427, -1,	"Qatar" },
+	{ 0x427, 0x01f,		"Qatarnet" },
+	{ 0x427, 0x02f,		"Vodafone Qatar" },
+	{ 0x647, -1,	"R&?union" },
+	{ 0x647, 0x00f,		"Orange" },
+	{ 0x647, 0x02f,		"Outremer" },
+	{ 0x647, 0x10f,		"SFR Reunion" },
+	{ 0x226, -1,	"Romania" },
+	{ 0x226, 0x01f,		"Vodafone" },
+	{ 0x226, 0x02f,		"Romtelecom" },
+	{ 0x226, 0x03f,		"Cosmote" },
+	{ 0x226, 0x04f,		"Cosmote" },
+	{ 0x226, 0x05f,		"Digi.Mobil" },
+	{ 0x226, 0x06f,		"Cosmote" },
+	{ 0x226, 0x10f,		"Orange" },
+	{ 0x250, -1,	"Russian Federation" },
+	{ 0x250, 0x01f,		"MTS" },
+	{ 0x250, 0x02f,		"MegaFon" },
+	{ 0x250, 0x03f,		"NCC" },
+	{ 0x250, 0x04f,		"Sibchallenge" },
+	{ 0x250, 0x05f,		"ETK" },
+	{ 0x250, 0x06f,		"Skylink" },
+	{ 0x250, 0x07f,		"SMARTS" },
+	{ 0x250, 0x09f,		"Skylink" },
+	{ 0x250, 0x10f,		"DTC" },
+	{ 0x250, 0x11f,		"Orensot" },
+	{ 0x250, 0x12f,		"Baykalwestcom" },
+	{ 0x250, 0x12f,		"Akos" },
+	{ 0x250, 0x13f,		"KUGSM" },
+	{ 0x250, 0x15f,		"SMARTS" },
+	{ 0x250, 0x16f,		"NTC" },
+	{ 0x250, 0x17f,		"Utel" },
+	{ 0x250, 0x19f,		"INDIGO" },
+	{ 0x250, 0x20f,		"Tele2" },
+	{ 0x250, 0x23f,		"Mobicom - Novosibirsk" },
+	{ 0x250, 0x28f,		"Beeline" },
+	{ 0x250, 0x35f,		"MOTIV" },
+	{ 0x250, 0x38f,		"Tambov GSM" },
+	{ 0x250, 0x39f,		"Utel" },
+	{ 0x250, 0x44f,		"Stavtelesot / North Caucasian GSM" },
+	{ 0x250, 0x92f,		"Primtelefon" },
+	{ 0x250, 0x93f,		"Telecom XXI" },
+	{ 0x250, 0x99f,		"Beeline" },
+//	{ 0x250, ?,		"SkyLink/MTS/the Moscow Cellular communication" },
+	{ 0x635, -1,	"Rwanda" },
+	{ 0x635, 0x10f,		"MTN" },
+	{ 0x635, 0x13f,		"Tigo" },
+	{ 0x356, -1,	"Saint Kitts and Nevis" },
+	{ 0x356, 0x050,		"Digicel" },
+	{ 0x356, 0x110,		"Cable &  Wireless" },
+	{ 0x358, -1,	"Saint Lucia" },
+	{ 0x358, 0x050,		"Digicel" },
+	{ 0x358, 0x110,		"Cable &  Wireless" },
+	{ 0x308, -1,	"Saint Pierre and Miquelon" },
+	{ 0x308, 0x01f,		"Ameris" },
+	{ 0x360, -1,	"Saint Vincent and the Grenadines" },
+	{ 0x360, 0x070,		"Digicel" },
+	{ 0x360, 0x100,		"Cingular Wireless" },
+	{ 0x360, 0x110,		"Cable & Wireless" },
+	{ 0x549, -1,	"Samoa" },
+	{ 0x549, 0x01f,		"Digicel" },
+	{ 0x549, 0x27f,		"SamoaTel" },
+	{ 0x292, -1,	"San Marino" },
+	{ 0x292, 0x01f,		"PRIMA" },
+	{ 0x626, -1,	"Sao Tome and Principe" },
+	{ 0x626, 0x01f,		"CSTmovel" },
+	{ 0x420, -1,	"Saudi Arabia" },
+	{ 0x420, 0x01f,		"Al Jawal" },
+	{ 0x420, 0x03f,		"Mobily" },
+	{ 0x420, 0x07f,		"EAE" },
+	{ 0x420, 0x04f,		"Zain SA" },
+	{ 0x608, -1,	"Senegal" },
+	{ 0x608, 0x01f,		"Orange (telecommunications)" },
+	{ 0x608, 0x02f,		"Tigo" },
+	{ 0x608, 0x03f,		"Expresso" },
+	{ 0x220, -1,	"Serbia" },
+	{ 0x220, 0x01f,		"Telenor" },
+	{ 0x220, 0x03f,		"mt:s" },
+	{ 0x220, 0x05f,		"VIP" },
+	{ 0x633, -1,	"Seychelles" },
+	{ 0x633, 0x01f,		"Cable & Wireless" },
+	{ 0x633, 0x02f,		"Mediatech International" },
+	{ 0x633, 0x10f,		"Airtel" },
+	{ 0x619, -1,	"Sierra Leone" },
+	{ 0x619, 0x01f,		"Zain" },
+	{ 0x619, 0x02f,		"Millicom" },
+	{ 0x619, 0x03f,		"Datatel" },
+	{ 0x619, 0x04f,		"Comium" },
+	{ 0x619, 0x05f,		"Africell" },
+	{ 0x619, 0x25f,		"Mobitel" },
+//	{ 0x619, ?,		"LeoneCel" },
+	{ 0x525, -1,	"Singapore" },
+	{ 0x525, 0x01f,		"SingTel" },
+	{ 0x525, 0x02f,		"SingTel-G18" },
+	{ 0x525, 0x03f,		"M1" },
+	{ 0x525, 0x05f,		"StarHub" },
+	{ 0x525, 0x12f,		"Digital Trunked Radio Network" },
+	{ 0x231, -1,	"Slovakia" },
+	{ 0x231, 0x01f,		"Orange" },
+	{ 0x231, 0x02f,		"T-Mobile" },
+	{ 0x231, 0x03f,		"Unient Communications" },
+	{ 0x231, 0x04f,		"T-Mobile" },
+	{ 0x231, 0x05f,		"Mobile Entertainment Company" },
+	{ 0x231, 0x06f,		"O2" },
+	{ 0x231, 0x99f,		"?SR" },
+	{ 0x293, -1,	"Slovenia" },
+	{ 0x293, 0x40f,		"Si.mobil" },
+	{ 0x293, 0x41f,		"Mobitel" },
+	{ 0x293, 0x64f,		"T-2" },
+	{ 0x293, 0x70f,		"Tu?mobil" },
+	{ 0x540, -1,	"Solomon Islands" },
+	{ 0x637, -1,	"Somalia" },
+	{ 0x637, 0x01f,		"Telesom" },
+	{ 0x637, 0x04f,		"Somafone" },
+	{ 0x637, 0x10f,		"Nationlink" },
+	{ 0x637, 0x25f,		"Hormuud" },
+	{ 0x637, 0x30f,		"Golis" },
+	{ 0x637, 0x82f,		"Telcom" },
+	{ 0x655, -1,	"South Africa" },
+	{ 0x655, 0x01f,		"Vodacom" },
+	{ 0x655, 0x06f,		"Sentech" },
+	{ 0x655, 0x07f,		"Cell C" },
+	{ 0x655, 0x10f,		"MTN" },
+	{ 0x655, 0x11f,		"SAPS Gauteng" },
+	{ 0x655, 0x13f,		"Neotel" },
+	{ 0x655, 0x21f,		"Cape Town Metropolitan Council" },
+	{ 0x655, 0x30f,		"Bokamoso Consortium" },
+	{ 0x655, 0x31f,		"Karabo Telecoms (Pty) Ltd." },
+	{ 0x655, 0x32f,		"Ilizwi Telecommunications" },
+	{ 0x655, 0x33f,		"Thinta Thinta Telecommunications" },
+	{ 0x655, 0x02f,		"Telkom" },
+	{ 0x214, -1,	"Spain" },
+	{ 0x214, 0x01f,		"Vodafone" },
+	{ 0x214, 0x03f,		"Orange" },
+	{ 0x214, 0x04f,		"Yoigo" },
+	{ 0x214, 0x05f,		"TME" },
+	{ 0x214, 0x06f,		"Vodafone" },
+	{ 0x214, 0x07f,		"movistar" },
+	{ 0x214, 0x08f,		"Euskaltel" },
+	{ 0x214, 0x09f,		"Orange" },
+	{ 0x214, 0x15f,		"BT" },
+	{ 0x214, 0x16f,		"TeleCable" },
+	{ 0x214, 0x17f,		"M?bil R" },
+	{ 0x214, 0x18f,		"ONO" },
+	{ 0x214, 0x19f,		"Simyo" },
+	{ 0x214, 0x21f,		"Jazztel" },
+	{ 0x214, 0x22f,		"DigiMobil" },
+	{ 0x214, 0x23f,		"Barablu" },
+	{ 0x413, -1,	"Sri Lanka" },
+	{ 0x413, 0x01f,		"Mobitel" },
+	{ 0x413, 0x02f,		"Dialog" },
+	{ 0x413, 0x03f,		"Etisalat" },
+	{ 0x413, 0x05f,		"Airtel" },
+	{ 0x413, 0x08f,		"Hutch" },
+	{ 0x413, 0x00f,		"RTEC Mobile" },
+	{ 0x634, -1,	"Sudan" },
+	{ 0x634, 0x01f,		"Zain SD" },
+	{ 0x634, 0x02f,		"MTN" },
+	{ 0x634, 0x05f,		"Vivacell" },
+	{ 0x746, -1,	"Suriname" },
+	{ 0x746, 0x05f,		"Telesur" },
+	{ 0x653, -1,	"Swaziland" },
+	{ 0x653, 0x10f,		"Swazi MTN" },
+	{ 0x240, -1,	"Sweden" },
+	{ 0x240, 0x01f,		"Telia" },
+	{ 0x240, 0x02f,		"3" },
+	{ 0x240, 0x03f,		"Ice.net" },
+	{ 0x240, 0x04f,		"3G Infrastructure Services" },
+	{ 0x240, 0x05f,		"Sweden 3G" },
+	{ 0x240, 0x06f,		"Telenor" },
+	{ 0x240, 0x07f,		"Tele2" },
+	{ 0x240, 0x08f,		"Telenor" },
+	{ 0x240, 0x09f,		"djuice" },
+	{ 0x240, 0x10f,		"Spring Mobil" },
+	{ 0x240, 0x11f,		"Lindholmen Science Park" },
+	{ 0x240, 0x12f,		"Barablu Mobile Scandinavia" },
+	{ 0x240, 0x13f,		"Ventelo Sverige" },
+	{ 0x240, 0x14f,		"TDC Mobil" },
+	{ 0x240, 0x15f,		"Wireless Maingate Nordic" },
+	{ 0x240, 0x16f,		"42IT" },
+	{ 0x240, 0x17f,		"G?talandsn?tet" },
+	{ 0x240, 0x20f,		"Wireless Maingate Message Services" },
+	{ 0x240, 0x21f,		"MobiSir" },
+	{ 0x240, 0x25f,		"DigiTelMobile" },
+	{ 0x228, -1,	"Switzerland" },
+	{ 0x228, 0x01f,		"Swisscom" },
+	{ 0x228, 0x02f,		"Sunrise" },
+	{ 0x228, 0x03f,		"Orange" },
+	{ 0x228, 0x05f,		"Togewanet AG (Comfone)" },
+	{ 0x228, 0x06f,		"SBB AG" },
+	{ 0x228, 0x07f,		"IN&Phone" },
+	{ 0x228, 0x08f,		"Tele2" },
+	{ 0x228, 0x50f,		"3G Mobile AG" },
+	{ 0x228, 0x51f,		"BebbiCell AG" },
+	{ 0x417, -1,	"Syria" },
+	{ 0x417, 0x01f,		"Syriatel" },
+	{ 0x417, 0x02f,		"MTN" },
+	{ 0x466, -1,	"Taiwan" },
+	{ 0x466, 0x01f,		"FarEasTone" },
+	{ 0x466, 0x02f,		"APTG" },
+	{ 0x466, 0x06f,		"Tuntex" },
+	{ 0x466, 0x11f,		"Chunghwa LDM" },
+	{ 0x466, 0x88f,		"KG Telecom" },
+	{ 0x466, 0x89f,		"VIBO" },
+	{ 0x466, 0x92f,		"Chungwa" },
+	{ 0x466, 0x93f,		"MobiTai" },
+	{ 0x466, 0x97f,		"Taiwan Mobile" },
+	{ 0x466, 0x99f,		"TransAsia" },
+	{ 0x436, -1,	"Tajikistan" },
+	{ 0x436, 0x01f,		"Tcell" },
+	{ 0x436, 0x02f,		"Indigo" },
+	{ 0x436, 0x03f,		"MLT" },
+	{ 0x436, 0x04f,		"Babilon-M" },
+	{ 0x436, 0x05f,		"Beeline" },
+	{ 0x640, -1,	"Tanzania" },
+	{ 0x640, 0x06f,		"SasaTel" },
+	{ 0x640, 0x02f,		"tiGO" },
+	{ 0x640, 0x03f,		"Zantel" },
+	{ 0x640, 0x04f,		"Vodacom" },
+	{ 0x640, 0x05f,		"Zain" },
+	{ 0x520, -1,	"Thailand" },
+	{ 0x520, 0x00f,		"Hutch" },
+	{ 0x520, 0x01f,		"AIS" },
+	{ 0x520, 0x02f,		"CAT CDMA" },
+	{ 0x520, 0x10f,		"?" },
+	{ 0x520, 0x15f,		"Thai Mobile" },
+	{ 0x520, 0x15f,		"TOT 3G" },
+	{ 0x520, 0x18f,		"dtac" },
+	{ 0x520, 0x23f,		"AIS GSM 1800" },
+	{ 0x520, 0x99f,		"True Move" },
+	{ 0x520, 0x00f,		"WE PCT" },
+	{ 0x615, -1,	"Togo" },
+	{ 0x615, 0x01f,		"Togo Cell" },
+	{ 0x615, 0x03f,		"Moov" },
+	{ 0x539, -1,	"Tonga" },
+	{ 0x539, 0x01f,		"Tonga Communications Corporation" },
+	{ 0x539, 0x43f,		"Shoreline Communication" },
+	{ 0x539, 0x88f,		"Digicel" },
+	{ 0x374, -1,	"Trinidad and Tobago" },
+	{ 0x374, 0x12f,		"bmobile" },
+	{ 0x374, 0x13f,		"Digicel" },
+	{ 0x605, -1,	"Tunisia" },
+	{ 0x605, 0x01f,		"Orange" },
+	{ 0x605, 0x02f,		"Tunicell" },
+	{ 0x605, 0x03f,		"Tunisiana" },
+	{ 0x286, -1,	"Turkey" },
+	{ 0x286, 0x01f,		"Turkcell" },
+	{ 0x286, 0x02f,		"Vodafone" },
+	{ 0x286, 0x03f,		"Avea" },
+	{ 0x286, 0x04f,		"Aycell" },
+	{ 0x438, -1,	"Turkmenistan" },
+	{ 0x438, 0x01f,		"MTS" },
+	{ 0x438, 0x02f,		"TM-Cell" },
+	{ 0x376, -1,	"Turks and Caicos Islands" },
+	{ 0x376, 0x350,		"C&W" },
+	{ 0x376, 0x352,		"Islandcom" },
+	{ 0x338, 0x05f,		"Digicel" },
+	{ 0x553, -1,	"Tuvalu" },
+	{ 0x553, 0x01f,		"TTC" },
+	{ 0x641, -1,	"Uganda" },
+	{ 0x641, 0x01f,		"Zain" },
+	{ 0x641, 0x10f,		"MTN" },
+	{ 0x641, 0x11f,		"Uganda Telecom Ltd." },
+	{ 0x641, 0x22f,		"Warid Telecom" },
+	{ 0x641, 0x14f,		"Orange" },
+	{ 0x255, -1,	"Ukraine" },
+	{ 0x255, 0x01f,		"MTS" },
+	{ 0x255, 0x02f,		"Beeline" },
+	{ 0x255, 0x03f,		"Kyivstar" },
+	{ 0x255, 0x04f,		"IT" },
+	{ 0x255, 0x05f,		"Golden Telecom" },
+	{ 0x255, 0x06f,		"life:)" },
+	{ 0x255, 0x07f,		"Ukrtelecom" },
+	{ 0x255, 0x21f,		"PEOPLEnet" },
+	{ 0x255, 0x23f,		"CDMA Ukraine" },
+	{ 0x424, -1,	"United Arab Emirates" },
+	{ 0x424, 0x02f,		"Etisalat" },
+	{ 0x424, 0x03f,		"du" },
+	{ 0x234, -1,	"United Kingdom" },
+	{ 0x234, 0x00f,		"BT" },
+	{ 0x234, 0x01f,		"UK01" },
+	{ 0x234, 0x02f,		"O2" },
+	{ 0x234, 0x03f,		"Airtel-Vodafone" },
+	{ 0x234, 0x04f,		"FMS Solutions Ltd" },
+	{ 0x234, 0x07f,		"Cable and Wireless UK" },
+	{ 0x234, 0x08f,		"OnePhone Ltd" },
+	{ 0x234, 0x10f,		"O2" },
+	{ 0x234, 0x11f,		"O2" },
+	{ 0x234, 0x12f,		"Railtrack" },
+	{ 0x234, 0x14f,		"Hay Systems Ltd" },
+	{ 0x234, 0x15f,		"Vodafone" },
+	{ 0x234, 0x16f,		"Opal Telecom Ltd" },
+	{ 0x234, 0x18f,		"Cloud9" },
+	{ 0x234, 0x19f,		"Teleware" },
+	{ 0x234, 0x20f,		"3" },
+	{ 0x234, 0x22f,		"RoutoMessaging" },
+	{ 0x234, 0x25f,		"Truphone" },
+	{ 0x234, 0x30f,		"T-Mobile" },
+	{ 0x234, 0x31f,		"Virgin" },
+	{ 0x234, 0x32f,		"Virgin" },
+	{ 0x234, 0x33f,		"Orange" },
+	{ 0x234, 0x34f,		"Orange" },
+	{ 0x234, 0x50f,		"JT-Wave" },
+	{ 0x234, 0x55f,		"Cable & Wireless Guernsey / Sure Mobile (Jersey)" },
+	{ 0x234, 0x58f,		"Manx Telecom" },
+	{ 0x234, 0x75f,		"Inquam" },
+	{ 0x234, 0x77f,		"BT" },
+	{ 0x200, -1,	"United States of America" },
+	{ 0x200, 0x053,		"Virgin Mobile US" },
+	{ 0x200, 0x054,		"Alltel US" },
+	{ 0x200, 0x066,		"U.S. Cellular" },
+	/* 0x310 taken from Annex to ITU Operational Bulletin No. 958 – 15.VI.2010 */
+	{ 0x310, 0x00f,		"nTelos" },
+	{ 0x310, 0x000,		"Mid-Tex Cellular" },
+	{ 0x310, 0x004,		"Verizon" },
+	{ 0x310, 0x010,		"MCI" },
+	{ 0x310, 0x012,		"Verizon" },
+	{ 0x310, 0x013,		"MobileTel" },
+	{ 0x310, 0x014,		"Testing" },
+	{ 0x310, 0x016,		"Cricket Communications" },
+	{ 0x310, 0x017,		"North Sight Communications Inc." },
+	{ 0x310, 0x020,		"Union Telephone Company" },
+	{ 0x310, 0x026,		"T-Mobile" },
+	{ 0x310, 0x030,		"Centennial" },
+	{ 0x310, 0x034,		"Airpeak" },
+	{ 0x310, 0x038,		"AT&T" },
+	{ 0x310, 0x040,		"Concho" },
+	{ 0x310, 0x046,		"SIMMETRY" },
+	{ 0x310, 0x060,		"Consolidated Telcom" },
+	{ 0x310, 0x070,		"Highland Cellular" },
+	{ 0x310, 0x080,		"Corr" },
+	{ 0x310, 0x090,		"AT&T" },
+	{ 0x310, 0x100,		"Plateau Wireless" },
+	{ 0x310, 0x110,		"PTI Pacifica" },
+	{ 0x310, 0x120,		"Sprint" },
+	{ 0x310, 0x150,		"AT&T" },
+	{ 0x310, 0x160,		"T-Mobile" },
+	{ 0x310, 0x170,		"T-Mobile" },
+	{ 0x310, 0x180,		"West Central" },
+	{ 0x310, 0x190,		"Dutch Harbor" },
+	{ 0x310, 0x200,		"T-Mobile" },
+	{ 0x310, 0x210,		"T-Mobile" },
+	{ 0x310, 0x220,		"T-Mobile" },
+	{ 0x310, 0x230,		"T-Mobile" },
+	{ 0x310, 0x240,		"T-Mobile" },
+	{ 0x310, 0x250,		"T-Mobile" },
+	{ 0x310, 0x260,		"T-Mobile" },
+	{ 0x310, 0x270,		"T-Mobile" },
+	{ 0x310, 0x280,		"T-Mobile" },
+	{ 0x310, 0x290,		"T-Mobile" },
+	{ 0x310, 0x300,		"iSmart Mobile" },
+	{ 0x310, 0x310,		"T-Mobile" },
+	{ 0x310, 0x311,		"Farmers Wireless" },
+	{ 0x310, 0x320,		"Cellular One" },
+	{ 0x310, 0x330,		"T-Mobile" },
+	{ 0x310, 0x340,		"Westlink" },
+	{ 0x310, 0x350,		"Carolina Phone" },
+	{ 0x310, 0x380,		"AT&T Mobility" },
+	{ 0x310, 0x390,		"Cellular One of East Texas" },
+	{ 0x310, 0x400,		"i CAN_GSM" },
+	{ 0x310, 0x410,		"AT&T" },
+	{ 0x310, 0x420,		"Cincinnati Bell" },
+	{ 0x310, 0x430,		"Alaska Digitel" },
+	{ 0x310, 0x440,		"Cellular One" },
+	{ 0x310, 0x450,		"Viaero" },
+	{ 0x310, 0x460,		"Simmetry" },
+	{ 0x310, 0x480,		"Choice Phone" },
+	{ 0x310, 0x490,		"T-Mobile" },
+	{ 0x310, 0x500,		"Alltel" },
+	{ 0x310, 0x510,		"Airtel" },
+	{ 0x310, 0x520,		"VeriSign" },
+	{ 0x310, 0x530,		"West Virginia Wireless" },
+	{ 0x310, 0x540,		"Oklahoma Western" },
+	{ 0x310, 0x560,		"AT&T" },
+	{ 0x310, 0x570,		"Cellular One" },
+	{ 0x310, 0x580,		"T-Mobile" },
+	{ 0x310, 0x590,		"Alltel" },
+	{ 0x310, 0x610,		"Epic Touch" },
+	{ 0x310, 0x620,		"Coleman County Telecom" },
+	{ 0x310, 0x630,		"AmeriLink PCS" },
+	{ 0x310, 0x640,		"Airadigm" },
+	{ 0x310, 0x650,		"Jasper" },
+	{ 0x310, 0x660,		"T-Mobile" },
+	{ 0x310, 0x670,		"Northstar" },
+	{ 0x310, 0x680,		"AT&T" },
+	{ 0x310, 0x690,		"Conestoga" },
+	{ 0x310, 0x730,		"SeaMobile" },
+	{ 0x310, 0x740,		"Convey" },
+	{ 0x310, 0x760,		"Panhandle" },
+	{ 0x310, 0x770,		"i wireless" },
+	{ 0x310, 0x780,		"Airlink PCS" },
+	{ 0x310, 0x790,		"PinPoint" },
+	{ 0x310, 0x800,		"T-Mobile" },
+	{ 0x310, 0x830,		"Caprock" },
+	{ 0x310, 0x850,		"Aeris" },
+	{ 0x310, 0x870,		"PACE" },
+	{ 0x310, 0x880,		"Advantage" },
+	{ 0x310, 0x890,		"Unicel" },
+	{ 0x310, 0x900,		"Mid-Rivers Wireless" },
+	{ 0x310, 0x910,		"First Cellular" },
+	{ 0x310, 0x940,		"Iris Wireless LLC" },
+	{ 0x310, 0x950,		"XIT Wireless" },
+	{ 0x310, 0x960,		"Plateau Wireless" },
+	{ 0x310, 0x970,		"Globalstar" },
+	{ 0x310, 0x980,		"AT&T Mobility" },
+	{ 0x310, 0x990,		"AT&T Mobility" },
+	{ 0x311, 0x000,		"Mid-Tex Cellular" },
+	{ 0x311, 0x010,		"Chariton Valley" },
+	{ 0x311, 0x020,		"Missouri RSA 5 Partnership" },
+	{ 0x311, 0x030,		"Indigo Wireless" },
+	{ 0x311, 0x040,		"Commnet Wireless" },
+	{ 0x311, 0x050,		"Wikes Cellular" },
+	{ 0x311, 0x060,		"Farmers Cellular" },
+	{ 0x311, 0x070,		"Easterbrooke" },
+	{ 0x311, 0x080,		"Pine Cellular" },
+	{ 0x311, 0x090,		"Long Lines Wireless" },
+	{ 0x311, 0x100,		"High Plains Wireless" },
+	{ 0x311, 0x110,		"High Plains Wireless" },
+	{ 0x311, 0x120,		"Choice Phone" },
+	{ 0x311, 0x130,		"Cell One Amarillo" },
+	{ 0x311, 0x140,		"Sprocket" },
+	{ 0x311, 0x150,		"Wilkes Cellular" },
+	{ 0x311, 0x160,		"Endless Mountains Wireless" },
+	{ 0x311, 0x170,		"PetroCom" },
+	{ 0x311, 0x180,		"Cingular Wireless" },
+	{ 0x311, 0x190,		"Cellular Properties" },
+	{ 0x311, 0x210,		"Farmers Cellular" },
+	{ 0x316, 0x010,		"Nextel" },
+	{ 0x316, 0x011,		"Southern Communications Services" },
+	{ 0x748, -1,	"Uruguay" },
+	{ 0x748, 0x00f,		"Ancel" },
+	{ 0x748, 0x01f,		"Ancel" },
+	{ 0x748, 0x07f,		"Movistar" },
+	{ 0x748, 0x10f,		"Claro" },
+	{ 0x434, -1,	"Uzbekistan" },
+	{ 0x434, 0x01f,		"Buztel" },
+	{ 0x434, 0x02f,		"Uzmacom" },
+	{ 0x434, 0x04f,		"Beeline" },
+	{ 0x434, 0x05f,		"Ucell" },
+	{ 0x434, 0x06f,		"Perfectum Mobile" },
+	{ 0x434, 0x07f,		"MTS" },
+	{ 0x541, -1,	"Vanuatu" },
+	{ 0x541, 0x01f,		"SMILE" },
+	{ 0x225, -1,	"Vatican" },
+	{ 0x734, -1,	"Venezuela" },
+	{ 0x734, 0x01f,		"Digitel" },
+	{ 0x734, 0x02f,		"Digitel" },
+	{ 0x734, 0x03f,		"Digitel" },
+	{ 0x734, 0x04f,		"movistar" },
+	{ 0x734, 0x06f,		"Movilnet" },
+	{ 0x452, -1,	"Vietnam" },
+	{ 0x452, 0x01f,		"MobiFone" },
+	{ 0x452, 0x02f,		"Vinaphone" },
+	{ 0x452, 0x03f,		"S-Fone" },
+	{ 0x452, 0x04f,		"Viettel Mobile" },
+	{ 0x452, 0x05f,		"Vietnamobile" },
+	{ 0x452, 0x06f,		"E-Mobile" },
+	{ 0x452, 0x07f,		"Beeline VN" },
+	{ 0x421, -1,	"Yemen" },
+	{ 0x421, 0x01f,		"SabaFon" },
+	{ 0x421, 0x02f,		"MTN" },
+	{ 0x421, 0x03f,		"Yemen Mobile" },
+	{ 0x421, 0x04f,		"HiTS-UNITEL" },
+	{ 0x645, -1,	"Zambia" },
+	{ 0x645, 0x01f,		"Zain" },
+	{ 0x645, 0x02f,		"MTN" },
+	{ 0x645, 0x03f,		"ZAMTEL" },
+	{ 0x648, -1,	"Zimbabwe" },
+	{ 0x648, 0x01f,		"Net*One" },
+	{ 0x648, 0x03f,		"Telecel" },
+	{ 0x648, 0x04f,		"Econet" },
+	{ 0x901, -1,	"International" },
+	{ 0x901, 0x01f,		"ICO" },
+	{ 0x901, 0x02f,		"Sense Communications International" },
+	{ 0x901, 0x03f,		"Iridium" },
+	{ 0x901, 0x04f,		"Globalstar" },
+	{ 0x901, 0x05f,		"Thuraya RMSS Network" },
+	{ 0x901, 0x06f,		"Thuraya Satellite Telecommunications Company" },
+	{ 0x901, 0x07f,		"Ellipso" },
+	{ 0x901, 0x08f,		"" },
+	{ 0x901, 0x09f,		"Tele1 Europe" },
+	{ 0x901, 0x10f,		"ACeS" },
+	{ 0x901, 0x11f,		"Inmarsat" },
+	{ 0x901, 0x12f,		"MCP" },
+	{ 0x901, 0x13f,		"GSM.AQ" },
+	{ 0x901, 0x14f,		"AeroMobile AS" },
+	{ 0x901, 0x15f,		"OnAir Switzerland Sarl" },
+	{ 0x901, 0x16f,		"Jasper Systems" },
+	{ 0x901, 0x17f,		"Navitas" },
+	{ 0x901, 0x18f,		"Cellular @Sea" },
+	{ 0x901, 0x19f,		"Vodafone Malta Maritime" },
+	{ 0x901, 0x21f,		"Seanet" },
+	{ 0x901, 0x24f,		"iNum" },
+	{ 0x901, 0x29f,		"Telenor" },
+	{ 0, 0, NULL }
+};
+
+/* GSM 03.22 Annex A */
+int gsm_match_mcc(uint16_t mcc, char *imsi)
+{
+	uint16_t sim_mcc;
+
+	sim_mcc = ((imsi[0] - '0') << 8)
+		 + ((imsi[1] - '0') << 4)
+		 + imsi[2] - '0';
+
+	return (mcc == sim_mcc);
+}
+
+/* GSM 03.22 Annex A */
+int gsm_match_mnc(uint16_t mcc, uint16_t mnc, char *imsi)
+{
+	uint16_t sim_mnc;
+
+	/* 1. SIM-MCC = BCCH-MCC */
+	if (!gsm_match_mcc(mcc, imsi))
+		return 0;
+
+	/* 2. 3rd digit of BCCH-MNC is not 0xf */
+	if ((mnc & 0x00f) != 0x00f) {
+		/* 3. 3 digit SIM-MNC = BCCH-MNC */
+		sim_mnc = ((imsi[3] - '0') << 8)
+			 + ((imsi[4] - '0') << 4)
+			 + imsi[5] - '0';
+
+		return (mnc == sim_mnc);
+	}
+
+	/* 4. BCCH-MCC in the range 310-316 */
+	if (mcc >= 310 && mcc <= 316) {
+		/* 5. 3rd diit of SIM-MNC is 0 */
+		if (imsi[5] != 0)
+			return 0;
+	}
+
+	/* 6. 1st 2 digits of SIM-MNC and BCCH-MNC match */
+	sim_mnc = ((imsi[3] - '0') << 8)
+		 + ((imsi[4] - '0') << 4)
+		 + 0x00f;
+
+	return (mnc == sim_mnc);
+}
+
+const char *gsm_print_mcc(uint16_t mcc)
+{
+	static char string[5] = "000";
+
+	snprintf(string, 4, "%03x", mcc);
+	return string;
+}
+
+const char *gsm_print_mnc(uint16_t mnc)
+{
+	static char string[7];
+
+	/* invalid format: return hex value */
+	if ((mnc & 0xf000)
+	 || (mnc & 0x0f00) > 0x0900
+	 || (mnc & 0x00f0) > 0x0090
+	 || ((mnc & 0x000f) > 0x0009 && (mnc & 0x000f) < 0x000f)) {
+		snprintf(string, 6, "0x%03x", mnc);
+		return string;
+	}
+
+	/* two digits */
+	if ((mnc & 0x000f) == 0x000f) {
+		snprintf(string, 6, "%02x", mnc >> 4);
+		return string;
+	}
+
+	/* three digits */
+	snprintf(string, 6, "%03x", mnc);
+	return string;
+}
+
+const uint16_t gsm_input_mcc(char *string)
+{
+	uint16_t mcc;
+
+	if (strlen(string) != 3)
+		return GSM_INPUT_INVALID;
+	if (string[0] < '0' || string [0] > '9'
+	 || string[1] < '0' || string [1] > '9'
+	 || string[2] < '0' || string [2] > '9')
+		return GSM_INPUT_INVALID;
+
+	mcc = ((string[0] - '0') << 8)
+	    | ((string[1] - '0') << 4)
+	    | ((string[2] - '0'));
+
+	if (mcc == 0x000)
+		return GSM_INPUT_INVALID;
+
+	return mcc;
+}
+
+const uint16_t gsm_input_mnc(char *string)
+{
+	uint16_t mnc = 0;
+
+	if (strlen(string) == 2) {
+		if (string[0] < '0' || string [0] > '9'
+		 || string[1] < '0' || string [1] > '9')
+			return GSM_INPUT_INVALID;
+
+		mnc = ((string[0] - '0') << 8)
+		    | ((string[1] - '0') << 4)
+		    | 0x00f;
+	} else
+	if (strlen(string) == 3) {
+		if (string[0] < '0' || string [0] > '9'
+		 || string[1] < '0' || string [1] > '9'
+		 || string[2] < '0' || string [2] > '9')
+			return GSM_INPUT_INVALID;
+
+		mnc = ((string[0] - '0') << 8)
+		    | ((string[1] - '0') << 4)
+		    | ((string[2] - '0'));
+	}
+
+	return mnc;
+}
+
+const char *gsm_get_mcc(uint16_t mcc)
+{
+	int i;
+
+	for (i = 0; gsm_networks[i].name; i++)
+		if (gsm_networks[i].mnc < 0 && gsm_networks[i].mcc == mcc)
+			return gsm_networks[i].name;
+
+	return gsm_print_mcc(mcc);
+}
+
+const char *gsm_get_mnc(uint16_t mcc, uint16_t mnc)
+{
+	int i;
+
+	for (i = 0; gsm_networks[i].name; i++)
+		if (gsm_networks[i].mcc == mcc && gsm_networks[i].mnc == mnc)
+			return gsm_networks[i].name;
+
+	return gsm_print_mnc(mnc);
+}
+
+/* get MCC from IMSI */
+const char *gsm_imsi_mcc(char *imsi)
+{
+	int i, found = 0;
+	uint16_t mcc;
+
+	mcc = ((imsi[0] - '0') << 8)
+	    | ((imsi[1] - '0') << 4)
+	    | ((imsi[2] - '0'));
+
+	for (i = 0; gsm_networks[i].name; i++) {
+		if (gsm_networks[i].mcc == mcc) {
+			found = 1;
+			break;
+		}
+	}
+	if (found == 0)
+		return "Unknown";
+
+	return gsm_networks[i].name;
+}
+
+/* get MNC from IMSI */
+const char *gsm_imsi_mnc(char *imsi)
+{
+	int i, found = 0, position = 0;
+	uint16_t mcc, mnc2, mnc3;
+
+	mcc = ((imsi[0] - '0') << 8)
+	    | ((imsi[1] - '0') << 4)
+	    | ((imsi[2] - '0'));
+	mnc2 = ((imsi[3] - '0') << 8)
+	     + ((imsi[4] - '0') << 4)
+	     + 0x00f;
+	mnc3 = ((imsi[3] - '0') << 8)
+	     + ((imsi[4] - '0') << 4)
+	     + imsi[5] - '0';
+
+	for (i = 0; gsm_networks[i].name; i++) {
+		if (gsm_networks[i].mcc != mcc)
+			continue;
+		if ((gsm_networks[i].mnc & 0x00f) == 0x00f) {
+			if (mnc2 == gsm_networks[i].mnc) {
+				found++;
+				position = i;
+			}
+		} else {
+			if (mnc3 == gsm_networks[i].mnc) {
+				found++;
+				position = i;
+			}
+		}
+	}
+
+	if (found == 0)
+		return "Unknown";
+	if (found > 1)
+		return "Ambiguous";
+	return gsm_networks[position].name;
+}
+
+
diff --git a/src/host/layer23/src/common/sap_interface.c b/src/host/layer23/src/common/sap_interface.c
new file mode 100644
index 00000000..936beb34
--- /dev/null
+++ b/src/host/layer23/src/common/sap_interface.c
@@ -0,0 +1,574 @@
+/* BTSAP socket interface of layer2/3 stack */
+
+/* (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010,2018 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ * (C) 2011 by Nico Golde <nico@ngolde.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/sap_interface.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/socket.h>
+
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <arpa/inet.h>
+
+#define _GNU_SOURCE
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+
+#define GSM_SAP_LENGTH 300
+#define GSM_SAP_HEADROOM 32
+
+static void sap_connect(struct osmocom_ms *ms);
+
+static const struct value_string sap_param_names[] = {
+	{SAP_MAX_MSG_SIZE,			"MaxMsgSize"},
+	{SAP_CONNECTION_STATUS, 	"ConnectionStatus"},
+	{SAP_RESULT_CODE,			"ResultCode"},
+	{SAP_DISCONNECTION_TYPE,	"DisconnectionType"},
+	{SAP_COMMAND_APDU,			"CommandAPDU"},
+	{SAP_COMMAND_APDU_7816,		"CommandAPDU7816"},
+	{SAP_RESPONSE_APDU,			"ResponseAPDU"},
+	{SAP_ATR,					"ATR"},
+	{SAP_CARD_READER_STATUS,	"CardReaderStatus"},
+	{SAP_STATUS_CHANGE,			"StatusChange"},
+	{SAP_TRANSPORT_PROTOCOL,	"TransportProtocol"}
+};
+
+static const struct value_string sap_msg_names[] = {
+	{SAP_CONNECT_REQ,						"CONNECT_REQ"},
+	{SAP_CONNECT_RESP,						"CONNECT_RESP"},
+	{SAP_DISCONNECT_REQ,					"DISCONNECT_REQ"},
+	{SAP_DISCONNECT_RESP,					"DISCONNECT_RESP"},
+	{SAP_DISCONNECT_IND,					"DISCONNECT_IND"},
+	{SAP_TRANSFER_APDU_REQ,					"TRANSFER_APDU_REQ"},
+	{SAP_TRANSFER_APDU_RESP,				"TRANSFER_APDU_RESP"},
+	{SAP_TRANSFER_ATR_REQ,					"TRANSFER_ATR_REQ"},
+	{SAP_TRANSFER_ATR_RESP,					"TRANSFER_ATR_RESP"},
+	{SAP_POWER_SIM_OFF_REQ,					"POWER_SIM_OFF_REQ"},
+	{SAP_POWER_SIM_OFF_RESP,				"POWER_SIM_OFF_RESP"},
+	{SAP_POWER_SIM_ON_REQ,					"POWER_SIM_ON_REQ"},
+	{SAP_POWER_SIM_ON_RESP,					"POWER_SIM_ON_RESP"},
+	{SAP_RESET_SIM_REQ,						"RESET_SIM_REQ"},
+	{SAP_RESET_SIM_RESP,					"RESET_SIM_RESP"},
+	{SAP_TRANSFER_CARD_READER_STATUS_REQ,	"TRANSFER_CARD_READER_STATUS_REQ"},
+	{SAP_TRANSFER_CARD_READER_STATUS_RESP,	"TRANSFER_CARD_READER_STATUS_RESP"},
+	{SAP_STATUS_IND,						"STATUS_IND"},
+	{SAP_ERROR_RESP,						"ERROR_RESP"},
+	{SAP_SET_TRANSPORT_PROTOCOL_REQ,		"SET_TRANSPORT_PROTOCOL_REQ"},
+	{SAP_SET_TRANSPORT_PROTOCOL_RESP,		"SET_TRANSPORT_PROTOCOL_RESP"}
+};
+
+/* BTSAP table 5.18 */
+static const struct value_string sap_result_names[] = {
+	{0, "OK, request processed correctly"},
+	{1, "Error, no reason defined"},
+	{2, "Error, card not accessible"},
+	{3, "Error, card (already) powered off"},
+	{4, "Error, card removed"},
+	{5, "Error, card already powered on"},
+	{6, "Error, data not available"},
+	{7, "Error, not supported"}
+};
+
+static const struct value_string sap_status_change_names[] = {
+	{0, "Unknown Error"},
+	{1, "Card reset"},
+	{2, "Card not accessible"},
+	{3, "Card removed"},
+	{4, "Card inserted"},
+	{5, "Card recovered"},
+};
+
+static const struct value_string sap_status_names[] = {
+	{0, "OK, Server can fulfill requirements"},
+	{1, "Error, Server unable to establish connection"},
+	{2, "Error, Server does not support maximum message size"},
+	{3, "Error, maximum message size by Client is too small"},
+	{4, "OK, ongoing call"}
+};
+
+static struct msgb *sap_create_msg(uint8_t id, uint8_t num_params, struct sap_param *params)
+{
+	struct msgb *msg;
+	uint8_t *msgp;
+	uint8_t i, plen, padding = 0;
+
+	msg = msgb_alloc(GSM_SAP_LENGTH, "osmosap");
+	if (!msg) {
+		LOGP(DSAP, LOGL_ERROR, "Failed to allocate msg.\n");
+		return NULL;
+	}
+
+	/* BTSAP 5.1 */
+	msgb_put_u8(msg, id);
+	msgb_put_u8(msg, num_params);
+	msgb_put_u16(msg, 0);
+
+	for(i=0; i<num_params; i++){
+		plen = params[i].len;
+		msgb_put_u8(msg, params[i].id);
+		msgb_put_u8(msg, 0);
+		msgb_put_u16(msg, plen);
+		if(plen % 4){
+			padding = 4 - (plen % 4);
+		}
+		msgp = msgb_put(msg, plen + padding);
+		memcpy(msgp, params[i].value, plen);
+
+		if(padding){
+			memset(msgp + plen, 0, padding);
+		}
+	}
+
+	return msg;
+}
+
+static int osmosap_send(struct osmocom_ms *ms, struct msgb *msg)
+{
+	if(ms->sap_entity.sap_state == SAP_NOT_CONNECTED)
+		sap_connect(ms);
+
+	if (ms->sap_wq.bfd.fd <= 0)
+		return -EINVAL;
+
+	if (osmo_wqueue_enqueue(&ms->sap_wq, msg) != 0) {
+		LOGP(DSAP, LOGL_ERROR, "Failed to enqueue msg.\n");
+		msgb_free(msg);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int sap_parse_result(struct sap_param *param)
+{
+	if(param->id != SAP_RESULT_CODE){
+		LOGP(DSAP, LOGL_INFO, "> Parameter id: %u no valid result type\n", param->id);
+		return -1;
+	} else {
+		LOGP(DSAP, LOGL_INFO, "> RESULT CODE: %s\n",
+				get_value_string(sap_result_names, param->value[0]));
+	}
+
+	if(param->value[0] > sizeof(sap_result_names)/sizeof(struct value_string)){
+		return -1;
+	}
+
+	return 0;
+}
+
+static uint8_t *sap_get_param(uint8_t *data, struct sap_param *param)
+{
+	uint8_t *dptr = data;
+	uint8_t padlen;
+
+	param->id = *dptr++;
+	/* skip reserved byte */
+	dptr++;
+	param->len = *dptr << 8;
+	dptr++;
+	param->len |= *dptr++;
+	param->value = talloc_zero_size(NULL, param->len);
+	memcpy(param->value, dptr, param->len);
+
+	/* skip parameter and padding and return pointer to next parameter */
+	dptr += param->len;
+	if(param->len % 4){
+		padlen = (4 - param->len % 4);
+	} else {
+		padlen = 0;
+	}
+	dptr += padlen;
+
+	return dptr;
+}
+
+static void sap_msg_free(struct sap_msg *msg)
+{
+	uint8_t i;
+	for(i=0; i<msg->num_params; i++){
+		talloc_free(msg->params[i].value);
+		talloc_free(msg->params);
+	}
+	talloc_free(msg);
+}
+
+static struct sap_msg *sap_parse_msg(uint8_t *data)
+{
+	struct sap_msg *msg = talloc_zero(NULL, struct sap_msg);
+	uint8_t *ptr = data;
+	uint8_t i;
+
+	if(!msg){
+		return NULL;
+	}
+
+	msg->id = *ptr++;
+	LOGP(DSAP, LOGL_INFO, "> %s \n", get_value_string(sap_msg_names, msg->id));
+
+	msg->num_params = *ptr++;
+	/* skip two reserved null bytes, BTSAP 5.1 */
+	ptr += 2;
+
+	msg->params = talloc_zero_size(NULL, sizeof(struct sap_param) * msg->num_params);
+
+	for(i=0; i<msg->num_params; i++){
+		ptr = sap_get_param(ptr, &msg->params[i]);
+		LOGP(DSAP, LOGL_INFO, "> %s %s\n",
+				get_value_string(sap_param_names, msg->params[i].id),
+				osmo_hexdump(msg->params[i].value, msg->params[i].len));
+	}
+
+	return msg;
+}
+
+static void sap_apdu_resp(struct osmocom_ms *ms, uint8_t *data, uint16_t len)
+{
+	struct msgb *msg;
+	uint8_t *apdu;
+	msg = msgb_alloc(GSM_SAP_LENGTH, "osmosap");
+	if(!msg){
+		LOGP(DSAP, LOGL_ERROR, "Failed to allocate memory.\n");
+		return;
+	}
+
+	apdu = msgb_put(msg, len);
+	memcpy(apdu, data, len);
+
+	LOGP(DSAP, LOGL_DEBUG, "Forwarding APDU to SIM handler.\n");
+	sim_apdu_resp(ms, msg);
+}
+
+static int sap_adapt_msg_size(struct osmocom_ms *ms, struct sap_param *param)
+{
+	uint16_t size;
+	size = (param->value[0] << 8) | param->value[1];
+	if(size != ms->sap_entity.max_msg_size && size > 0){
+		LOGP(DSAP, LOGL_NOTICE, "Server can not handle max_msg_size, adapting.\n");
+		ms->sap_entity.max_msg_size = size;
+		return -1;
+	}
+	return 0;
+}
+
+static void sap_atr(struct osmocom_ms *ms)
+{
+	struct msgb *msg;
+	if(ms->sap_entity.sap_state != SAP_IDLE){
+		LOGP(DSAP, LOGL_ERROR, "Attempting to send ATR request while not being idle.\n");
+		return;
+	}
+
+	msg = sap_create_msg(SAP_TRANSFER_ATR_REQ, 0, NULL);
+	if(!msg)
+		return;
+
+	osmosap_send(ms, msg);
+	ms->sap_entity.sap_state = SAP_PROCESSING_ATR_REQUEST;
+}
+
+static void sap_parse_resp(struct osmocom_ms *ms, uint8_t *data, uint16_t len)
+{
+	struct sap_msg *msg = NULL;
+	if(len > ms->sap_entity.max_msg_size){
+		LOGP(DSAP, LOGL_ERROR, "Read more data than allowed by max_msg_size, ignoring.\n");
+		return;
+	}
+
+	msg = sap_parse_msg(data);
+	if(!msg){
+		sap_msg_free(msg);
+		return;
+	}
+
+	switch(msg->id){
+	case SAP_CONNECT_RESP:
+		LOGP(DSAP, LOGL_INFO, "Status: %s\n", get_value_string(sap_status_names, msg->params[0].value[0]));
+		if(msg->params[0].value[0] == 0){
+			ms->sap_entity.sap_state = SAP_IDLE;
+		}
+		if(msg->num_params == 2 && msg->params[1].len == 2){
+			if(sap_adapt_msg_size(ms, &msg->params[1]) < 0) {
+				ms->sap_entity.sap_state = SAP_NOT_CONNECTED;
+			} else {
+				sap_atr(ms);
+			}
+		}
+		break;
+	case SAP_DISCONNECT_RESP:
+		ms->sap_entity.sap_state = SAP_NOT_CONNECTED;
+		break;
+	case SAP_STATUS_IND:
+		LOGP(DSAP, LOGL_INFO, "New card state: %s\n", get_value_string(sap_status_change_names,
+					msg->params[0].value[0]));
+		if(msg->params[0].value[0] != 1){
+			/* TODO: handle case in which the card is not ready yet */
+		}
+		break;
+	case SAP_TRANSFER_ATR_RESP:
+		if(ms->sap_entity.sap_state != SAP_PROCESSING_ATR_REQUEST){
+			LOGP(DSAP, LOGL_ERROR, "got ATR resp in state: %u\n", ms->sap_entity.sap_state);
+			return;
+		}
+		if(msg->num_params >= 2){
+			LOGP(DSAP, LOGL_INFO, "ATR: %s\n", osmo_hexdump(msg->params[1].value, msg->params[1].len));
+		}
+		ms->sap_entity.sap_state = SAP_IDLE;
+		break;
+	case SAP_TRANSFER_APDU_RESP:
+		if(ms->sap_entity.sap_state != SAP_PROCESSING_APDU_REQUEST){
+			LOGP(DSAP, LOGL_ERROR, "got APDU resp in state: %u\n", ms->sap_entity.sap_state);
+			return;
+		}
+		if(msg->num_params != 2){
+			LOGP(DSAP, LOGL_ERROR, "wrong number of parameters %u in APDU response\n", msg->num_params);
+			return;
+		}
+		ms->sap_entity.sap_state = SAP_IDLE;
+		if(sap_parse_result(&msg->params[0]) == 0){
+			/* back apdu resp to layer23 */
+			sap_apdu_resp(ms, msg->params[1].value, msg->params[1].len);
+			LOGP(DSAP, LOGL_INFO, "sap_apdu_resp called, sending data back to layer23\n");
+		}
+		break;
+	case SAP_ERROR_RESP:
+		if(ms->sap_entity.sap_state == SAP_CONNECTION_UNDER_NEGOTIATION){
+			ms->sap_entity.sap_state = SAP_NOT_CONNECTED;
+		} else {
+			ms->sap_entity.sap_state = SAP_IDLE;
+		}
+		break;
+	default:
+		LOGP(DSAP, LOGL_ERROR, "got unknown or not implemented SAP msgid: %u\n", msg->id);
+		break;
+	}
+}
+
+static int sap_read(struct osmo_fd *fd)
+{
+	struct msgb *msg = NULL;
+	struct osmocom_ms *ms = (struct osmocom_ms *) fd->data;
+	uint8_t *sap_buffer;
+	ssize_t rc;
+
+	sap_buffer = talloc_zero_size(NULL, ms->sap_entity.max_msg_size);
+	if(!sap_buffer){
+		fprintf(stderr, "Failed to allocate memory\n");
+		return -ENOMEM;
+	}
+
+	rc = read(fd->fd, sap_buffer, ms->sap_entity.max_msg_size - 1);
+	if (rc < 0) {
+		fprintf(stderr, "SAP socket failed\n");
+		msgb_free(msg);
+		sap_close(ms);
+		return rc;
+	}
+	if(rc == 0) {
+		fprintf(stderr, "SAP socket closed by server\n");
+		msgb_free(msg);
+		sap_close(ms);
+		return -ECONNREFUSED;
+	}
+
+	sap_buffer[rc] = 0;
+	LOGP(DSAP, LOGL_INFO, "Received %zd bytes: %s\n", rc, osmo_hexdump(sap_buffer, rc));
+
+	sap_parse_resp(ms, sap_buffer, rc);
+
+	talloc_free(sap_buffer);
+
+	if (ms->sap_entity.msg_handler){
+		ms->sap_entity.msg_handler(msg, ms);
+	}
+	return 0;
+}
+
+static int sap_write(struct osmo_fd *fd, struct msgb *msg)
+{
+	ssize_t rc;
+
+	if (fd->fd <= 0)
+		return -EINVAL;
+
+	LOGP(DSAP, LOGL_INFO, "< %s\n", osmo_hexdump(msg->data, msg->len));
+	rc = write(fd->fd, msg->data, msg->len);
+	if (rc != msg->len) {
+		LOGP(DSAP, LOGL_ERROR, "Failed to write data: rc: %zd\n", rc);
+		return rc;
+	}
+
+	return 0;
+}
+
+static void sap_connect(struct osmocom_ms *ms)
+{
+	uint8_t buffer[3];
+	struct msgb *msg;
+	uint16_t size = ms->sap_entity.max_msg_size;
+	struct sap_param params[1];
+
+	params[0].id = SAP_MAX_MSG_SIZE;
+	params[0].len = 2;
+
+	if(ms->sap_entity.sap_state != SAP_NOT_CONNECTED) {
+		LOGP(DSAP, LOGL_ERROR, "Attempting to connect while there is an active connection.\n");
+		return;
+	}
+
+	buffer[0] = (size >> 8) & 0xFF;
+	buffer[1] = size & 0xFF;
+	buffer[2] = 0;
+	params[0].value = buffer;
+
+	msg = sap_create_msg(SAP_CONNECT_REQ, 1, params);
+	if(!msg)
+		return;
+
+	osmosap_send(ms, msg);
+
+	ms->sap_entity.sap_state = SAP_CONNECTION_UNDER_NEGOTIATION;
+}
+
+static void sap_disconnect(struct osmocom_ms *ms)
+{
+	struct msgb *msg;
+	if(ms->sap_entity.sap_state != SAP_NOT_CONNECTED && ms->sap_entity.sap_state != SAP_CONNECTION_UNDER_NEGOTIATION){
+		LOGP(DSAP, LOGL_ERROR, "Attempting to disconnect while no active connection.\n");
+		return;
+	}
+
+	msg = sap_create_msg(SAP_DISCONNECT_REQ, 0, NULL);
+	if(!msg)
+		return;
+
+	osmosap_send(ms, msg);
+
+	ms->sap_entity.sap_state = SAP_NOT_CONNECTED;
+}
+
+static void sap_apdu(struct osmocom_ms *ms, uint8_t *data, uint16_t len)
+{
+	struct msgb *msg;
+	struct sap_param params[1];
+
+	params[0].id = SAP_COMMAND_APDU;
+	params[0].len = len;
+	params[0].value = data;
+
+	if(ms->sap_entity.sap_state != SAP_IDLE){
+		LOGP(DSAP, LOGL_ERROR, "Attempting to send APDU request while not being idle.\n");
+		return;
+	}
+
+	msg = sap_create_msg(SAP_TRANSFER_APDU_REQ, 1, params);
+	if(!msg)
+		return;
+
+	osmosap_send(ms, msg);
+
+	ms->sap_entity.sap_state = SAP_PROCESSING_APDU_REQUEST;
+}
+
+int sap_open(struct osmocom_ms *ms, const char *socket_path)
+{
+	ssize_t rc;
+
+	rc = osmo_sock_unix_init_ofd(&ms->sap_wq.bfd, SOCK_STREAM, 0, socket_path, OSMO_SOCK_F_CONNECT);
+	if (rc < 0) {
+		LOGP(DSAP, LOGL_ERROR, "Failed to create unix domain socket %s: %s\n",
+		     socket_path, strerror(-rc));
+		ms->sap_entity.sap_state = SAP_SOCKET_ERROR;
+		return rc;
+	}
+
+	osmo_wqueue_init(&ms->sap_wq, 100);
+	ms->sap_wq.bfd.data = ms;
+	ms->sap_wq.read_cb = sap_read;
+	ms->sap_wq.write_cb = sap_write;
+
+	sap_connect(ms);
+
+	return 0;
+}
+
+int sap_close(struct osmocom_ms *ms)
+{
+	if (ms->sap_wq.bfd.fd <= 0)
+		return -EINVAL;
+
+	sap_disconnect(ms);
+	close(ms->sap_wq.bfd.fd);
+	ms->sap_wq.bfd.fd = -1;
+	osmo_fd_unregister(&ms->sap_wq.bfd);
+	osmo_wqueue_clear(&ms->sap_wq);
+
+	return 0;
+}
+
+/* same signature as in L1CTL, so it can be called from sim.c */
+int osmosap_send_apdu(struct osmocom_ms *ms, uint8_t *data, uint16_t length)
+{
+	//LOGP(DSAP, LOGL_ERROR, "Received the following APDU from sim.c: %s\n" ,
+	//     osmo_hexdump(data, length));
+	sap_apdu(ms, data, length);
+
+	return 0;
+}
+
+/* register message handler for messages that are sent from L2->L3 */
+int osmosap_register_handler(struct osmocom_ms *ms, osmosap_cb_t cb)
+{
+	ms->sap_entity.msg_handler = cb;
+
+	return 0;
+}
+
+int osmosap_sapsocket(struct osmocom_ms *ms, const char *path)
+{
+	struct gsm_settings *set = &ms->settings;
+	memset(set->sap_socket_path, 0, sizeof(set->sap_socket_path));
+	osmo_strlcpy(set->sap_socket_path, path, sizeof(set->sap_socket_path) - 1);
+
+	return 0;
+}
+
+/* init */
+int osmosap_init(struct osmocom_ms *ms)
+{
+	struct osmosap_entity *sap = &ms->sap_entity;
+
+	LOGP(DSAP, LOGL_INFO, "init SAP client\n");
+	sap->sap_state = SAP_NOT_CONNECTED;
+	sap->max_msg_size = GSM_SAP_LENGTH;
+
+	return 0;
+}
+
diff --git a/src/host/layer23/src/common/sim.c b/src/host/layer23/src/common/sim.c
new file mode 100644
index 00000000..7f5240dd
--- /dev/null
+++ b/src/host/layer23/src/common/sim.c
@@ -0,0 +1,1287 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <arpa/inet.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/gsmtap_util.h>
+#include <osmocom/core/gsmtap.h>
+
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1ctl.h>
+
+extern struct gsmtap_inst *gsmtap_inst;
+
+static int sim_process_job(struct osmocom_ms *ms);
+
+/*
+ * support
+ */
+
+uint32_t new_handle = 1;
+
+static struct gsm1111_df_name {
+	uint16_t file;
+	const char *name;
+} gsm1111_df_name[] = {
+	{ 0x3f00, "MF" },
+	{ 0x7f20, "DFgsm" },
+	{ 0x7f10, "DFtelecom" },
+	{ 0x7f22, "DFis-41" },
+	{ 0x7f23, "DFfp-cts" },
+	{ 0x5f50, "DFgraphics" },
+	{ 0x5f30, "DFiridium" },
+	{ 0x5f31, "DFglobst" },
+	{ 0x5f32, "DFico" },
+	{ 0x5f33, "DFaces" },
+	{ 0x5f40, "DFeia/tia-553" },
+	{ 0x5f60, "DFcts" },
+	{ 0x5f70, "DFsolsa" },
+	{ 0x5f3c, "DFmexe" },
+	{ 0, NULL }
+};
+
+static const char *get_df_name(uint16_t fid)
+{
+	int i;
+	static char text[7];
+
+	for (i = 0; gsm1111_df_name[i].file; i++)
+		if (gsm1111_df_name[i].file == fid)
+			break;
+	if (gsm1111_df_name[i].file)
+		return gsm1111_df_name[i].name;
+
+	sprintf(text, "0x%04x", fid);
+	return text;
+}
+
+static struct gsm_sim_handler *sim_get_handler(struct gsm_sim *sim,
+	uint32_t handle)
+{
+	struct gsm_sim_handler *handler;
+
+	llist_for_each_entry(handler, &sim->handlers, entry)
+		if (handler->handle == handle)
+			return handler;
+
+	return NULL;
+}
+
+/*
+ * messages
+ */
+
+static const struct value_string sim_job_names[] = {
+	{ SIM_JOB_READ_BINARY,		"SIM_JOB_READ_BINARY" },
+	{ SIM_JOB_UPDATE_BINARY,	"SIM_JOB_UPDATE_BINARY" },
+	{ SIM_JOB_READ_RECORD,		"SIM_JOB_READ_RECORD" },
+	{ SIM_JOB_UPDATE_RECORD,	"SIM_JOB_UPDATE_RECORD" },
+	{ SIM_JOB_SEEK_RECORD,		"SIM_JOB_SEEK_RECORD" },
+	{ SIM_JOB_INCREASE,		"SIM_JOB_INCREASE" },
+	{ SIM_JOB_INVALIDATE,		"SIM_JOB_INVALIDATE" },
+	{ SIM_JOB_REHABILITATE,		"SIM_JOB_REHABILITATE" },
+	{ SIM_JOB_RUN_GSM_ALGO,		"SIM_JOB_RUN_GSM_ALGO" },
+	{ SIM_JOB_PIN1_UNLOCK,		"SIM_JOB_PIN1_UNLOCK" },
+	{ SIM_JOB_PIN1_CHANGE,		"SIM_JOB_PIN1_CHANGE" },
+	{ SIM_JOB_PIN1_DISABLE,		"SIM_JOB_PIN1_DISABLE" },
+	{ SIM_JOB_PIN1_ENABLE,		"SIM_JOB_PIN1_ENABLE" },
+	{ SIM_JOB_PIN1_UNBLOCK,		"SIM_JOB_PIN1_UNBLOCK" },
+	{ SIM_JOB_PIN2_UNLOCK,		"SIM_JOB_PIN2_UNLOCK" },
+	{ SIM_JOB_PIN2_CHANGE,		"SIM_JOB_PIN2_CHANGE" },
+	{ SIM_JOB_PIN2_UNBLOCK,		"SIM_JOB_PIN2_UNBLOCK" },
+	{ SIM_JOB_OK,			"SIM_JOB_OK" },
+	{ SIM_JOB_ERROR,		"SIM_JOB_ERROR" },
+	{ 0,				NULL }
+};
+
+static const char *get_job_name(int value)
+{
+	return get_value_string(sim_job_names, value);
+}
+
+/* allocate sim client message (upper layer) */
+struct msgb *gsm_sim_msgb_alloc(uint32_t handle, uint8_t job_type)
+{
+	struct msgb *msg;
+	struct sim_hdr *nsh;
+
+	msg = msgb_alloc_headroom(SIM_ALLOC_SIZE+SIM_ALLOC_HEADROOM,
+		SIM_ALLOC_HEADROOM, "SIM");
+	if (!msg)
+		return NULL;
+
+	nsh = (struct sim_hdr *) msgb_put(msg, sizeof(*nsh));
+	nsh->handle = handle;
+	nsh->job_type = job_type;
+
+	return msg;
+}
+
+/* reply to job, after it is done. reuse the msgb in the job */
+void gsm_sim_reply(struct osmocom_ms *ms, uint8_t result_type, uint8_t *result,
+	uint16_t result_len)
+{
+	struct gsm_sim *sim = &ms->sim;
+	struct msgb *msg = sim->job_msg;
+	struct sim_hdr *sh;
+	uint8_t *payload;
+	uint16_t payload_len;
+	struct gsm_sim_handler *handler;
+
+	LOGP(DSIM, LOGL_INFO, "sending result to callback function "
+		"(type=%d)\n", result_type);
+
+	/* if no handler, or no callback, just free the job */
+	sh = (struct sim_hdr *)msg->data;
+	handler = sim_get_handler(sim, sh->handle);
+	if (!handler || !handler->cb) {
+		LOGP(DSIM, LOGL_INFO, "no callback or no handler, "
+			"dropping result\n");
+		msgb_free(sim->job_msg);
+		sim->job_msg = NULL;
+		sim->job_state = SIM_JST_IDLE;
+		return;
+	}
+
+	payload = msg->data + sizeof(*sh);
+	payload_len = msg->len - sizeof(*sh);
+
+	/* remove data */
+	msg->tail -= payload_len;
+	msg->len -= payload_len;
+
+	/* add reply data */
+	sh->job_type = result_type;
+	if (result_len)
+		memcpy(msgb_put(msg, result_len), result, result_len);
+
+	/* callback */
+	sim->job_state = SIM_JST_IDLE;
+	sim->job_msg = NULL;
+	handler->cb(ms, msg);
+}
+
+/* send APDU to card reader */
+static int sim_apdu_send(struct osmocom_ms *ms, uint8_t *data, uint16_t length)
+{
+	LOGP(DSIM, LOGL_INFO, "sending APDU (class 0x%02x, ins 0x%02x)\n",
+		data[0], data[1]);
+
+	/* Cache this APDU, so it can be sent to GSMTAP on response */
+	if (length <= sizeof(ms->sim.apdu_data)) {
+		memcpy(ms->sim.apdu_data, data, length);
+		ms->sim.apdu_len = length;
+	} else {
+		LOGP(DSIM, LOGL_NOTICE, "Cannot cache SIM APDU "
+			"(len=%u), so it won't be sent to GSMTAP\n", length);
+		ms->sim.apdu_len = 0;
+	}
+
+	/* adding SAP client support
+	 * it makes more sense to do it here then in L1CTL */
+	if (ms->subscr.sim_type == GSM_SIM_TYPE_SAP) {
+		LOGP(DSIM, LOGL_INFO, "Using SAP backend\n");
+		osmosap_send_apdu(ms, data, length);
+	} else {
+		LOGP(DSIM, LOGL_INFO, "Using built-in SIM reader\n");
+		l1ctl_tx_sim_req(ms, data, length);
+	}
+
+	return 0;
+}
+
+/* dequeue messages (RSL-SAP) */
+int gsm_sim_job_dequeue(struct osmocom_ms *ms)
+{
+	struct gsm_sim *sim = &ms->sim;
+	struct sim_hdr *sh;
+	struct msgb *msg;
+	struct gsm_sim_handler *handler;
+
+	/* already have a job */
+	if (sim->job_msg)
+		return 0;
+
+	/* get next job */
+	while ((msg = msgb_dequeue(&sim->jobs))) {
+		/* resolve handler */
+		sh = (struct sim_hdr *) msg->data;
+		LOGP(DSIM, LOGL_INFO, "got new job: %s (handle=%08x)\n",
+			get_job_name(sh->job_type), sh->handle);
+		handler = sim_get_handler(sim, sh->handle);
+		if (!handler) {
+			LOGP(DSIM, LOGL_INFO, "no handler, ignoring job\n");
+			/* does not exist anymore */
+			msgb_free(msg);
+			continue;
+		}
+
+		/* init job */
+		sim->job_state = SIM_JST_IDLE;
+		sim->job_msg = msg;
+		sim->job_handle = sh->handle;
+
+		/* process current job, message is freed there */
+		sim_process_job(ms);
+		return 1; /* work done */
+	}
+	
+	return 0;
+}
+
+
+/*
+ * SIM commands
+ */
+
+/* 9.2.1 */
+static int gsm1111_tx_select(struct osmocom_ms *ms, uint16_t fid)
+{
+	uint8_t buffer[5 + 2];
+
+	LOGP(DSIM, LOGL_INFO, "SELECT (file=0x%04x)\n", fid);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_SELECT;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = 2;
+	buffer[5] = fid >> 8;
+	buffer[6] = fid;
+
+	return sim_apdu_send(ms, buffer, 5 + 2);
+}
+
+#if 0
+/* 9.2.2 */
+static int gsm1111_tx_status(struct osmocom_ms *ms)
+{
+	uint8_t buffer[5];
+
+	LOGP(DSIM, LOGL_INFO, "STATUS\n");
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_STATUS;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = 0;
+
+	return sim_apdu_send(ms, buffer, 5);
+}
+#endif
+
+/* 9.2.3 */
+static int gsm1111_tx_read_binary(struct osmocom_ms *ms, uint16_t offset,
+	uint8_t length)
+{
+	uint8_t buffer[5];
+
+	LOGP(DSIM, LOGL_INFO, "READ BINARY (offset=%d len=%d)\n", offset,
+		length);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_READ_BINARY;
+	buffer[2] = offset >> 8;
+	buffer[3] = offset;
+	buffer[4] = length;
+
+	return sim_apdu_send(ms, buffer, 5);
+}
+
+/* 9.2.4 */
+static int gsm1111_tx_update_binary(struct osmocom_ms *ms, uint16_t offset,
+	uint8_t *data, uint8_t length)
+{
+	uint8_t buffer[5 + length];
+
+	LOGP(DSIM, LOGL_INFO, "UPDATE BINARY (offset=%d len=%d)\n", offset,
+		length);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_UPDATE_BINARY;
+	buffer[2] = offset >> 8;
+	buffer[3] = offset;
+	buffer[4] = length;
+	memcpy(buffer + 5, data, length);
+
+	return sim_apdu_send(ms, buffer, 5 + length);
+}
+
+/* 9.2.5 */
+static int gsm1111_tx_read_record(struct osmocom_ms *ms, uint8_t rec_no,
+	uint8_t mode, uint8_t length)
+{
+	uint8_t buffer[5];
+
+	LOGP(DSIM, LOGL_INFO, "READ RECORD (rec_no=%d mode=%d len=%d)\n",
+		rec_no, mode, length);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_READ_RECORD;
+	buffer[2] = rec_no;
+	buffer[3] = mode;
+	buffer[4] = length;
+
+	return sim_apdu_send(ms, buffer, 5);
+}
+
+/* 9.2.6 */
+static int gsm1111_tx_update_record(struct osmocom_ms *ms, uint8_t rec_no,
+	uint8_t mode, uint8_t *data, uint8_t length)
+{
+	uint8_t buffer[5 + length];
+
+	LOGP(DSIM, LOGL_INFO, "UPDATE RECORD (rec_no=%d mode=%d len=%d)\n",
+		rec_no, mode, length);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_UPDATE_RECORD;
+	buffer[2] = rec_no;
+	buffer[3] = mode;
+	buffer[4] = length;
+	memcpy(buffer + 5, data, length);
+
+	return sim_apdu_send(ms, buffer, 5 + length);
+}
+
+/* 9.2.7 */
+static int gsm1111_tx_seek(struct osmocom_ms *ms, uint8_t type_mode,
+	uint8_t *pattern, uint8_t length)
+{
+	uint8_t buffer[5 + length];
+	uint8_t type = type_mode >> 4;
+	uint8_t mode = type_mode & 0x0f;
+
+	LOGP(DSIM, LOGL_INFO, "SEEK (type=%d mode=%d len=%d)\n", type, mode,
+		length);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_SEEK;
+	buffer[2] = 0x00;
+	buffer[3] = type_mode;
+	buffer[4] = length;
+	memcpy(buffer + 5, pattern, length);
+
+	return sim_apdu_send(ms, buffer, 5 + length);
+}
+
+/* 9.2.8 */
+static int gsm1111_tx_increase(struct osmocom_ms *ms, uint32_t value)
+{
+	uint8_t buffer[5 + 3];
+
+	LOGP(DSIM, LOGL_INFO, "INCREASE (value=%d)\n", value);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_INCREASE;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = 3;
+	buffer[5] = value >> 16;
+	buffer[6] = value >> 8;
+	buffer[7] = value;
+
+	return sim_apdu_send(ms, buffer, 5 + 3);
+}
+
+/* 9.2.9 */
+static int gsm1111_tx_verify_chv(struct osmocom_ms *ms, uint8_t chv_no,
+	uint8_t *chv, uint8_t length)
+{
+	uint8_t buffer[5 + 8];
+	int i;
+
+	LOGP(DSIM, LOGL_INFO, "VERIFY CHV (CHV%d)\n", chv_no);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_VERIFY_CHV;
+	buffer[2] = 0x00;
+	buffer[3] = chv_no;
+	buffer[4] = 8;
+	for (i = 0; i < 8; i++) {
+		if (i < length)
+			buffer[5 + i] = chv[i];
+		else
+			buffer[5 + i] = 0xff;
+	}
+
+	return sim_apdu_send(ms, buffer, 5 + 8);
+}
+
+/* 9.2.10 */
+static int gsm1111_tx_change_chv(struct osmocom_ms *ms, uint8_t chv_no,
+	uint8_t *chv_old, uint8_t length_old, uint8_t *chv_new,
+	uint8_t length_new)
+{
+	uint8_t buffer[5 + 16];
+	int i;
+
+	LOGP(DSIM, LOGL_INFO, "CHANGE CHV (CHV%d)\n", chv_no);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_CHANGE_CHV;
+	buffer[2] = 0x00;
+	buffer[3] = chv_no;
+	buffer[4] = 16;
+	for (i = 0; i < 8; i++) {
+		if (i < length_old)
+			buffer[5 + i] = chv_old[i];
+		else
+			buffer[5 + i] = 0xff;
+		if (i < length_new)
+			buffer[13 + i] = chv_new[i];
+		else
+			buffer[13 + i] = 0xff;
+	}
+
+	return sim_apdu_send(ms, buffer, 5 + 16);
+}
+
+/* 9.2.11 */
+static int gsm1111_tx_disable_chv(struct osmocom_ms *ms, uint8_t *chv,
+	uint8_t length)
+{
+	uint8_t buffer[5 + 8];
+	int i;
+
+	LOGP(DSIM, LOGL_INFO, "DISABLE CHV (CHV1)\n");
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_DISABLE_CHV;
+	buffer[2] = 0x00;
+	buffer[3] = 0x01;
+	buffer[4] = 8;
+	for (i = 0; i < 8; i++) {
+		if (i < length)
+			buffer[5 + i] = chv[i];
+		else
+			buffer[5 + i] = 0xff;
+	}
+
+	return sim_apdu_send(ms, buffer, 5 + 8);
+}
+
+/* 9.2.12 */
+static int gsm1111_tx_enable_chv(struct osmocom_ms *ms, uint8_t *chv,
+	uint8_t length)
+{
+	uint8_t buffer[5 + 8];
+	int i;
+
+	LOGP(DSIM, LOGL_INFO, "ENABLE CHV (CHV1)\n");
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_ENABLE_CHV;
+	buffer[2] = 0x00;
+	buffer[3] = 0x01;
+	buffer[4] = 8;
+	for (i = 0; i < 8; i++) {
+		if (i < length)
+			buffer[5 + i] = chv[i];
+		else
+			buffer[5 + i] = 0xff;
+	}
+
+	return sim_apdu_send(ms, buffer, 5 + 8);
+}
+
+/* 9.2.13 */
+static int gsm1111_tx_unblock_chv(struct osmocom_ms *ms, uint8_t chv_no,
+	uint8_t *chv_unblk, uint8_t length_unblk, uint8_t *chv_new,
+	uint8_t length_new)
+{
+	uint8_t buffer[5 + 16];
+	int i;
+
+	LOGP(DSIM, LOGL_INFO, "UNBLOCK CHV (CHV%d)\n", (chv_no == 2) ? 2 : 1);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_UNBLOCK_CHV;
+	buffer[2] = 0x00;
+	buffer[3] = (chv_no == 1) ? 0 : chv_no;
+	buffer[4] = 16;
+	for (i = 0; i < 8; i++) {
+		if (i < length_unblk)
+			buffer[5 + i] = chv_unblk[i];
+		else
+			buffer[5 + i] = 0xff;
+		if (i < length_new)
+			buffer[13 + i] = chv_new[i];
+		else
+			buffer[13 + i] = 0xff;
+	}
+
+	return sim_apdu_send(ms, buffer, 5 + 16);
+}
+
+/* 9.2.14 */
+static int gsm1111_tx_invalidate(struct osmocom_ms *ms)
+{
+	uint8_t buffer[5];
+
+	LOGP(DSIM, LOGL_INFO, "INVALIDATE\n");
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_INVALIDATE;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = 0;
+
+	return sim_apdu_send(ms, buffer, 5);
+}
+
+/* 9.2.15 */
+static int gsm1111_tx_rehabilitate(struct osmocom_ms *ms)
+{
+	uint8_t buffer[5];
+
+	LOGP(DSIM, LOGL_INFO, "REHABILITATE\n");
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_REHABLILITATE;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = 0;
+
+	return sim_apdu_send(ms, buffer, 5);
+}
+
+/* 9.2.16 */
+static int gsm1111_tx_run_gsm_algo(struct osmocom_ms *ms, uint8_t *rand)
+{
+	uint8_t buffer[5 + 16];
+
+	LOGP(DSIM, LOGL_INFO, "RUN GSM ALGORITHM\n");
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_RUN_GSM_ALGO;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = 16;
+	memcpy(buffer + 5, rand, 16);
+
+	return sim_apdu_send(ms, buffer, 5 + 16);
+}
+
+#if 0
+/* 9.2.17 */
+static int gsm1111_tx_sleep(struct osmocom_ms *ms)
+{
+	uint8_t buffer[5];
+
+	LOGP(DSIM, LOGL_INFO, "\n");
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_SLEEP;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = 0;
+
+	return sim_apdu_send(ms, buffer, 5);
+}
+#endif
+
+/* 9.2.18 */
+static int gsm1111_tx_get_response(struct osmocom_ms *ms, uint8_t length)
+{
+	uint8_t buffer[5];
+
+	LOGP(DSIM, LOGL_INFO, "GET RESPONSE (len=%d)\n", length);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_GET_RESPONSE;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = length;
+
+	return sim_apdu_send(ms, buffer, 5);
+}
+
+#if 0
+/* 9.2.19 */
+static int gsm1111_tx_terminal_profile(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	uint8_t buffer[5 + length];
+
+	LOGP(DSIM, LOGL_INFO, "TERMINAL PROFILE (len=%d)\n", length);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_TERMINAL_PROFILE;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = length;
+	memcpy(buffer + 5, data, length);
+
+	return sim_apdu_send(ms, buffer, 5 + length);
+}
+
+/* 9.2.20 */
+static int gsm1111_tx_envelope(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	uint8_t buffer[5 + length];
+
+	LOGP(DSIM, LOGL_INFO, "ENVELOPE (len=%d)\n", length);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_ENVELOPE;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = length;
+	memcpy(buffer + 5, data, length);
+
+	return sim_apdu_send(ms, buffer, 5 + length);
+}
+
+/* 9.2.21 */
+static int gsm1111_tx_fetch(struct osmocom_ms *ms, uint8_t length)
+{
+	uint8_t buffer[5];
+
+	LOGP(DSIM, LOGL_INFO, "FETCH (len=%d)\n", length);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_FETCH;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = length;
+
+	return sim_apdu_send(ms, buffer, 5);
+}
+
+/* 9.2.22 */
+static int gsm1111_tx_terminal_response(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	uint8_t buffer[5 + length];
+
+	LOGP(DSIM, LOGL_INFO, "TERMINAL RESPONSE (len=%d)\n", length);
+	buffer[0] = GSM1111_CLASS_GSM;
+	buffer[1] = GSM1111_INST_TERMINAL_RESPONSE;
+	buffer[2] = 0x00;
+	buffer[3] = 0x00;
+	buffer[4] = length;
+	memcpy(buffer + 5, data, length);
+
+	return sim_apdu_send(ms, buffer, 5 + length);
+}
+#endif
+
+/*
+ * SIM state machine
+ */
+
+/* process job */
+static int sim_process_job(struct osmocom_ms *ms)
+{
+	struct gsm_sim *sim = &ms->sim;
+	uint8_t *payload, *payload2;
+	uint16_t payload_len, payload_len2;
+	struct sim_hdr *sh;
+	uint8_t cause;
+	int i;
+
+	/* no current */
+	if (!sim->job_msg)
+		return 0;
+
+	sh = (struct sim_hdr *)sim->job_msg->data;
+	payload = sim->job_msg->data + sizeof(*sh);
+	payload_len = sim->job_msg->len - sizeof(*sh);
+
+	/* do reset before sim reading */
+	if (!sim->reset) {
+		sim->reset = 1;
+		// FIXME: send reset command to L1
+	}
+
+	/* navigate to right DF */
+	switch (sh->job_type) {
+	case SIM_JOB_READ_BINARY:
+	case SIM_JOB_UPDATE_BINARY:
+	case SIM_JOB_READ_RECORD:
+	case SIM_JOB_UPDATE_RECORD:
+	case SIM_JOB_SEEK_RECORD:
+	case SIM_JOB_INCREASE:
+	case SIM_JOB_INVALIDATE:
+	case SIM_JOB_REHABILITATE:
+	case SIM_JOB_RUN_GSM_ALGO:
+		/* check MF / DF */
+		i = 0;
+		while (sh->path[i] && sim->path[i]) {
+			if (sh->path[i] != sim->path[i])
+				break;
+			i++;
+		}
+		/* if path in message is shorter or if paths are different */
+		if (sim->path[i]) {
+			LOGP(DSIM, LOGL_INFO, "go MF\n");
+			sim->job_state = SIM_JST_SELECT_MFDF;
+			/* go MF */
+			sim->path[0] = 0;
+			return gsm1111_tx_select(ms, 0x3f00);
+		}
+		/* if path in message is longer */
+		if (sh->path[i]) {
+			LOGP(DSIM, LOGL_INFO, "requested path is longer, go "
+				"child %s\n", get_df_name(sh->path[i]));
+			sim->job_state = SIM_JST_SELECT_MFDF;
+			/* select child */
+			sim->path[i] = sh->path[i];
+			sim->path[i + 1] = 0;
+			return gsm1111_tx_select(ms, sh->path[i]);
+		}
+		/* if paths are equal, continue */
+	}
+
+	/* set state and trigger SIM process */
+	switch (sh->job_type) {
+	case SIM_JOB_READ_BINARY:
+	case SIM_JOB_UPDATE_BINARY:
+	case SIM_JOB_READ_RECORD:
+	case SIM_JOB_UPDATE_RECORD:
+	case SIM_JOB_SEEK_RECORD:
+	case SIM_JOB_INCREASE:
+	case SIM_JOB_INVALIDATE:
+	case SIM_JOB_REHABILITATE:
+		sim->job_state = SIM_JST_SELECT_EF;
+		sim->file = sh->file;
+		return gsm1111_tx_select(ms, sh->file);
+	case SIM_JOB_RUN_GSM_ALGO:
+		if (payload_len != 16) {
+			LOGP(DSIM, LOGL_ERROR, "random not 16 bytes\n");
+			break;
+		}
+		sim->job_state = SIM_JST_RUN_GSM_ALGO;
+		return gsm1111_tx_run_gsm_algo(ms, payload);
+	case SIM_JOB_PIN1_UNLOCK:
+		payload_len = strlen((char *)payload);
+		if (payload_len < 4 || payload_len > 8) {
+			LOGP(DSIM, LOGL_ERROR, "key not in range 4..8\n");
+			break;
+		}
+		sim->job_state = SIM_JST_PIN1_UNLOCK;
+		return gsm1111_tx_verify_chv(ms, 0x01, payload, payload_len);
+	case SIM_JOB_PIN2_UNLOCK:
+		payload_len = strlen((char *)payload);
+		if (payload_len < 4 || payload_len > 8) {
+			LOGP(DSIM, LOGL_ERROR, "key not in range 4..8\n");
+			break;
+		}
+		sim->job_state = SIM_JST_PIN2_UNLOCK;
+		return gsm1111_tx_verify_chv(ms, 0x02, payload, payload_len);
+	case SIM_JOB_PIN1_CHANGE:
+		payload_len = strlen((char *)payload);
+		payload2 = payload + payload_len + 1;
+		payload_len2 = strlen((char *)payload2);
+		if (payload_len < 4 || payload_len > 8) {
+			LOGP(DSIM, LOGL_ERROR, "key1 not in range 4..8\n");
+			break;
+		}
+		if (payload_len2 < 4 || payload_len2 > 8) {
+			LOGP(DSIM, LOGL_ERROR, "key2 not in range 4..8\n");
+			break;
+		}
+		sim->job_state = SIM_JST_PIN1_CHANGE;
+		return gsm1111_tx_change_chv(ms, 0x01, payload, payload_len,
+			payload2, payload_len2);
+	case SIM_JOB_PIN2_CHANGE:
+		payload_len = strlen((char *)payload);
+		payload2 = payload + payload_len + 1;
+		payload_len2 = strlen((char *)payload2);
+		if (payload_len < 4 || payload_len > 8) {
+			LOGP(DSIM, LOGL_ERROR, "key1 not in range 4..8\n");
+			break;
+		}
+		if (payload_len2 < 4 || payload_len2 > 8) {
+			LOGP(DSIM, LOGL_ERROR, "key2 not in range 4..8\n");
+			break;
+		}
+		sim->job_state = SIM_JST_PIN2_CHANGE;
+		return gsm1111_tx_change_chv(ms, 0x02, payload, payload_len,
+			payload2, payload_len2);
+	case SIM_JOB_PIN1_DISABLE:
+		payload_len = strlen((char *)payload);
+		if (payload_len < 4 || payload_len > 8) {
+			LOGP(DSIM, LOGL_ERROR, "key not in range 4..8\n");
+			break;
+		}
+		sim->job_state = SIM_JST_PIN1_DISABLE;
+		return gsm1111_tx_disable_chv(ms, payload, payload_len);
+	case SIM_JOB_PIN1_ENABLE:
+		payload_len = strlen((char *)payload);
+		if (payload_len < 4 || payload_len > 8) {
+			LOGP(DSIM, LOGL_ERROR, "key not in range 4..8\n");
+			break;
+		}
+		sim->job_state = SIM_JST_PIN1_ENABLE;
+		return gsm1111_tx_enable_chv(ms, payload, payload_len);
+	case SIM_JOB_PIN1_UNBLOCK:
+		payload_len = strlen((char *)payload);
+		payload2 = payload + payload_len + 1;
+		payload_len2 = strlen((char *)payload2);
+		if (payload_len !=  8) {
+			LOGP(DSIM, LOGL_ERROR, "key1 not 8 digits\n");
+			break;
+		}
+		if (payload_len2 < 4 || payload_len2 > 8) {
+			LOGP(DSIM, LOGL_ERROR, "key2 not in range 4..8\n");
+			break;
+		}
+		sim->job_state = SIM_JST_PIN1_UNBLOCK;
+		/* NOTE: CHV1 is coded 0x00 here */
+		return gsm1111_tx_unblock_chv(ms, 0x00, payload, payload_len,
+			payload2, payload_len2);
+	case SIM_JOB_PIN2_UNBLOCK:
+		payload_len = strlen((char *)payload);
+		payload2 = payload + payload_len + 1;
+		payload_len2 = strlen((char *)payload2);
+		if (payload_len !=  8) {
+			LOGP(DSIM, LOGL_ERROR, "key1 not 8 digits\n");
+			break;
+		}
+		if (payload_len2 < 4 || payload_len2 > 8) {
+			LOGP(DSIM, LOGL_ERROR, "key2 not in range 4..8\n");
+			break;
+		}
+		sim->job_state = SIM_JST_PIN2_UNBLOCK;
+		return gsm1111_tx_unblock_chv(ms, 0x02, payload, payload_len,
+			payload2, payload_len2);
+	}
+
+	LOGP(DSIM, LOGL_ERROR, "unknown job %x, please fix\n", sh->job_type);
+	cause = SIM_CAUSE_REQUEST_ERROR;
+	gsm_sim_reply(ms, SIM_JOB_ERROR, &cause, 1);
+
+	return 0;
+}
+
+/* receive SIM response */
+int sim_apdu_resp(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_sim *sim = &ms->sim;
+	uint8_t *payload;
+	uint16_t payload_len;
+	uint8_t *data = msg->data;
+	int length = msg->len, ef_len;
+	uint8_t sw1, sw2;
+	uint8_t cause;
+	uint8_t pin_cause[2];
+	struct sim_hdr *sh;
+	struct gsm1111_response_ef *ef;
+	struct gsm1111_response_mfdf *mfdf;
+	struct gsm1111_response_mfdf_gsm *mfdf_gsm;
+	int i;
+
+	/* If there is cached APDU */
+	if (ms->sim.apdu_len) {
+		/* ... and APDU buffer has enough space, send it to GSMTAP */
+		if ((ms->sim.apdu_len + length) <= sizeof(ms->sim.apdu_data)) {
+			memcpy(ms->sim.apdu_data + ms->sim.apdu_len, data, length);
+			ms->sim.apdu_len += length;
+			gsmtap_send_ex(gsmtap_inst, GSMTAP_TYPE_SIM,
+				0, 0, 0, 0, 0, 0, 0, ms->sim.apdu_data, ms->sim.apdu_len);
+		}
+	}
+
+	/* ignore, if current job already gone */
+	if (!sim->job_msg) {
+		LOGP(DSIM, LOGL_ERROR, "received APDU but no job, "
+			"please fix!\n");
+		msgb_free(msg);
+		return 0;
+	}
+
+	sh = (struct sim_hdr *)sim->job_msg->data;
+	payload = sim->job_msg->data + sizeof(*sh);
+	payload_len = sim->job_msg->len - sizeof(*sh);
+
+	/* process status */
+	if (length < 2) {
+		msgb_free(msg);
+		return 0;
+	}
+	sw1 = data[length - 2];
+	sw2 = data[length - 1];
+	length -= 2;
+	LOGP(DSIM, LOGL_INFO, "received APDU (len=%d sw1=0x%02x sw2=0x%02x)\n",
+		length, sw1, sw2);
+
+	switch (sw1) {
+	case GSM1111_STAT_SECURITY:
+		LOGP(DSIM, LOGL_NOTICE, "SIM Security\n");
+		/* error */
+		if (sw2 != GSM1111_SEC_NO_ACCESS && sw2 != GSM1111_SEC_BLOCKED)
+			goto sim_error;
+
+		/* select the right remaining counter an cause */
+		// FIXME: read status to replace "*_remain"-counters
+		switch (sim->job_state) {
+		case SIM_JST_PIN1_UNBLOCK:
+			if (sw2 == GSM1111_SEC_NO_ACCESS) {
+				pin_cause[0] = SIM_CAUSE_PIN1_BLOCKED;
+				pin_cause[1] = --sim->unblk1_remain;
+			} else {
+				pin_cause[0] = SIM_CAUSE_PUC_BLOCKED;
+				pin_cause[1] = 0;
+			}
+			break;
+		case SIM_JST_PIN2_UNLOCK:
+		case SIM_JST_PIN2_CHANGE:
+			if (sw2 == GSM1111_SEC_NO_ACCESS && sim->chv2_remain) {
+				pin_cause[0] = SIM_CAUSE_PIN2_REQUIRED;
+				pin_cause[1] = sim->chv2_remain--;
+			} else {
+				pin_cause[0] = SIM_CAUSE_PIN2_BLOCKED;
+				pin_cause[1] = sim->unblk2_remain;
+			}
+			break;
+		case SIM_JST_PIN2_UNBLOCK:
+			if (sw2 == GSM1111_SEC_NO_ACCESS) {
+				pin_cause[0] = SIM_CAUSE_PIN2_BLOCKED;
+				pin_cause[1] = --sim->unblk2_remain;
+			} else {
+				pin_cause[0] = SIM_CAUSE_PUC_BLOCKED;
+				pin_cause[1] = 0;
+			}
+		case SIM_JST_PIN1_UNLOCK:
+		case SIM_JST_PIN1_CHANGE:
+		case SIM_JST_PIN1_DISABLE:
+		case SIM_JST_PIN1_ENABLE:
+		default:
+			if (sw2 == GSM1111_SEC_NO_ACCESS && sim->chv1_remain) {
+				pin_cause[0] = SIM_CAUSE_PIN1_REQUIRED;
+				pin_cause[1] = sim->chv1_remain--;
+			} else {
+				pin_cause[0] = SIM_CAUSE_PIN1_BLOCKED;
+				pin_cause[1] = sim->unblk1_remain;
+			}
+			break;
+		}
+		gsm_sim_reply(ms, SIM_JOB_ERROR, pin_cause, 2);
+		msgb_free(msg);
+		return 0;
+	case GSM1111_STAT_MEM_PROBLEM:
+		if (sw2 >= 0x40) {
+			LOGP(DSIM, LOGL_NOTICE, "memory of SIM failed\n");
+			sim_error:
+			cause = SIM_CAUSE_SIM_ERROR;
+			gsm_sim_reply(ms, SIM_JOB_ERROR, &cause, 1);
+			msgb_free(msg);
+			return 0;
+		}
+		LOGP(DSIM, LOGL_NOTICE, "memory of SIM is bad (write took %d "
+			"times to succeed)\n", sw2);
+		/* fall through */
+	case GSM1111_STAT_NORMAL:
+	case GSM1111_STAT_PROACTIVE:
+	case GSM1111_STAT_DL_ERROR:
+	case GSM1111_STAT_RESPONSE:
+	case GSM1111_STAT_RESPONSE_TOO:
+		LOGP(DSIM, LOGL_INFO, "command successful\n");
+		break;
+	default:
+		LOGP(DSIM, LOGL_INFO, "command failed\n");
+		request_error:
+		cause = SIM_CAUSE_REQUEST_ERROR;
+		gsm_sim_reply(ms, SIM_JOB_ERROR, &cause, 1);
+		msgb_free(msg);
+		return 0;
+	}
+
+
+	switch (sim->job_state) {
+	/* step 1: after selecting MF / DF, request the response */
+	case SIM_JST_SELECT_MFDF:
+		/* not enough data */
+		if (sw2 < 22) {
+			LOGP(DSIM, LOGL_NOTICE, "expecting minimum 22 bytes\n");
+			goto sim_error;
+		}
+		/* request response */
+		sim->job_state = SIM_JST_SELECT_MFDF_RESP;
+		gsm1111_tx_get_response(ms, sw2);
+		msgb_free(msg);
+		return 0;
+	/* step 2: after getting response of selecting MF / DF, continue
+	 * to "process_job".
+	 */
+	case SIM_JST_SELECT_MFDF_RESP:
+		if (length < 22) {
+			LOGP(DSIM, LOGL_NOTICE, "expecting minimum 22 bytes\n");
+			goto sim_error;
+		}
+		mfdf = (struct gsm1111_response_mfdf *)data;
+		mfdf_gsm = (struct gsm1111_response_mfdf_gsm *)(data + 13);
+		sim->chv1_remain = mfdf_gsm->chv1_remain;
+		sim->chv2_remain = mfdf_gsm->chv2_remain;
+		sim->unblk1_remain = mfdf_gsm->unblk1_remain;
+		sim->unblk2_remain = mfdf_gsm->unblk2_remain;
+		/* if MF was selected */
+		if (sim->path[0] == 0) {
+			/* if MF was selected, but MF is not indicated */
+			if (ntohs(mfdf->file_id) != 0x3f00) {
+				LOGP(DSIM, LOGL_NOTICE, "Not MF\n");
+				goto sim_error;
+			}
+			/* if MF was selected, but type is not indicated */
+			if (mfdf->tof != GSM1111_TOF_MF) {
+				LOGP(DSIM, LOGL_NOTICE, "MF %02x != %02x "
+					"%04x\n", mfdf->tof, GSM1111_TOF_MF,
+					sim->path[0]);
+				goto sim_error;
+			}
+			/* now continue */
+			msgb_free(msg);
+			return sim_process_job(ms);
+		}
+		/* if DF was selected, but this DF is not indicated */
+		i = 0;
+		while (sim->path[i + 1])
+			i++;
+		if (ntohs(mfdf->file_id) != sim->path[i]) {
+			LOGP(DSIM, LOGL_NOTICE, "Path %04x != %04x\n",
+				ntohs(mfdf->file_id), sim->path[i]);
+			goto sim_error;
+		}
+		/* if DF was selected, but type is not indicated */
+		if (mfdf->tof != GSM1111_TOF_DF) {
+			LOGP(DSIM, LOGL_NOTICE, "TOF error\n");
+			goto sim_error;
+		}
+		/* now continue */
+		msgb_free(msg);
+		return sim_process_job(ms);
+	/* step 1: after selecting EF, request response of SELECT */
+	case SIM_JST_SELECT_EF:
+		/* not enough data */
+		if (sw2 < 14) {
+			LOGP(DSIM, LOGL_NOTICE, "expecting minimum 14 bytes\n");
+			goto sim_error;
+		}
+		/* request response */
+		sim->job_state = SIM_JST_SELECT_EF_RESP;
+		gsm1111_tx_get_response(ms, sw2);
+		msgb_free(msg);
+		return 0;
+	/* step 2: after getting response of selecting EF, do file command */
+	case SIM_JST_SELECT_EF_RESP:
+		if (length < 14) {
+			LOGP(DSIM, LOGL_NOTICE, "expecting minimum 14 bytes\n");
+			goto sim_error;
+		}
+		ef = (struct gsm1111_response_ef *)data;
+		/* if EF was selected, but type is not indicated */
+		if (ntohs(ef->file_id) != sim->file) {
+			LOGP(DSIM, LOGL_NOTICE, "EF ID %04x != %04x\n",
+				ntohs(ef->file_id), sim->file);
+			goto sim_error;
+		}
+		/* check for record */
+		if (length >= 15 && ef->length >= 2 && ef->structure != 0x00) {
+			/* get length of record */
+			ef_len = ntohs(ef->file_size);
+			if (ef_len < data[14]) {
+				LOGP(DSIM, LOGL_NOTICE, "total length is "
+					"smaller (%d) than record size (%d)\n",
+					ef_len, data[14]);
+				goto request_error;
+			}
+			ef_len = data[14];
+			LOGP(DSIM, LOGL_NOTICE, "selected record (len %d "
+				"structure %d)\n", ef_len, ef->structure);
+		} else {
+			/* get length of file */
+			ef_len = ntohs(ef->file_size);
+			LOGP(DSIM, LOGL_NOTICE, "selected file (len %d)\n",
+				ef_len);
+		}
+		/* do file command */
+		sim->job_state = SIM_JST_WAIT_FILE;
+		switch (sh->job_type) {
+		case SIM_JOB_READ_BINARY:
+			// FIXME: do chunks when greater or equal 256 bytes */
+			gsm1111_tx_read_binary(ms, 0, ef_len);
+			break;
+		case SIM_JOB_UPDATE_BINARY:
+			// FIXME: do chunks when greater or equal 256 bytes */
+			if (ef_len < payload_len) {
+				LOGP(DSIM, LOGL_NOTICE, "selected file is "
+					"smaller (%d) than data to update "
+					"(%d)\n", ef_len, payload_len);
+				goto request_error;
+			}
+			gsm1111_tx_update_binary(ms, 0, payload, payload_len);
+			break;
+		case SIM_JOB_READ_RECORD:
+			gsm1111_tx_read_record(ms, sh->rec_no, sh->rec_mode,
+				ef_len);
+			break;
+		case SIM_JOB_UPDATE_RECORD:
+			if (ef_len != payload_len) {
+				LOGP(DSIM, LOGL_NOTICE, "selected file length "
+					"(%d) does not equal record to update "
+					"(%d)\n", ef_len, payload_len);
+				goto request_error;
+			}
+			gsm1111_tx_update_record(ms, sh->rec_no, sh->rec_mode,
+				payload, payload_len);
+			break;
+		case SIM_JOB_SEEK_RECORD:
+			gsm1111_tx_seek(ms, sh->seek_type_mode, data, length);
+			break;
+		case SIM_JOB_INCREASE:
+			if (length != 4) {
+				LOGP(DSIM, LOGL_ERROR, "expecting uint32_t as "
+					"value lenght, but got %d bytes\n",
+					length);
+				goto request_error;
+			}
+			gsm1111_tx_increase(ms, *((uint32_t *)data));
+			break;
+		case SIM_JOB_INVALIDATE:
+			gsm1111_tx_invalidate(ms);
+			break;
+		case SIM_JOB_REHABILITATE:
+			gsm1111_tx_rehabilitate(ms);
+			break;
+		}
+		msgb_free(msg);
+		return 0;
+	/* step 3: after processing file command, job is done */
+	case SIM_JST_WAIT_FILE:
+		/* reply job with data */
+		gsm_sim_reply(ms, SIM_JOB_OK, data, length);
+		msgb_free(msg);
+		return 0;
+	/* step 1: after running GSM algorithm, request response */
+	case SIM_JST_RUN_GSM_ALGO:
+		/* not enough data */
+		if (sw2 < 12) {
+			LOGP(DSIM, LOGL_NOTICE, "expecting minimum 12 bytes\n");
+			goto sim_error;
+		}
+		/* request response */
+		sim->job_state = SIM_JST_RUN_GSM_ALGO_RESP;
+		gsm1111_tx_get_response(ms, sw2);
+		msgb_free(msg);
+		return 0;
+	/* step 2: after processing GSM command, job is done */
+	case SIM_JST_RUN_GSM_ALGO_RESP:
+		/* reply job with data */
+		gsm_sim_reply(ms, SIM_JOB_OK, data, length);
+		msgb_free(msg);
+		return 0;
+	case SIM_JST_PIN1_UNLOCK:
+	case SIM_JST_PIN1_CHANGE:
+	case SIM_JST_PIN1_DISABLE:
+	case SIM_JST_PIN1_ENABLE:
+	case SIM_JST_PIN1_UNBLOCK:
+	case SIM_JST_PIN2_UNLOCK:
+	case SIM_JST_PIN2_CHANGE:
+	case SIM_JST_PIN2_UNBLOCK:
+		/* reply job with data */
+		gsm_sim_reply(ms, SIM_JOB_OK, data, length);
+		msgb_free(msg);
+		return 0;
+	}
+
+	LOGP(DSIM, LOGL_ERROR, "unknown state %u, please fix!\n",
+		sim->job_state);
+	goto request_error;
+}
+
+/*
+ * API
+ */
+
+/* open access to sim */
+uint32_t sim_open(struct osmocom_ms *ms,
+	void (*cb)(struct osmocom_ms *ms, struct msgb *msg))
+{
+	struct gsm_sim *sim = &ms->sim;
+	struct gsm_sim_handler *handler;
+
+	/* create handler and attach */
+	handler = talloc_zero(ms, struct gsm_sim_handler);
+	if (!handler)
+		return 0;
+	handler->handle = new_handle++;
+	handler->cb = cb;
+	llist_add_tail(&handler->entry, &sim->handlers);
+
+	return handler->handle;
+}
+
+/* close access to sim */
+void sim_close(struct osmocom_ms *ms, uint32_t handle)
+{
+	struct gsm_sim *sim = &ms->sim;
+	struct gsm_sim_handler *handler;
+
+	handler = sim_get_handler(sim, handle);
+	if (!handle)
+		return;
+
+	/* kill ourself */
+	llist_del(&handler->entry);
+	talloc_free(handler);
+}
+
+/* send job */
+void sim_job(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_sim *sim = &ms->sim;
+
+	msgb_enqueue(&sim->jobs, msg);
+}
+
+/*
+ * init
+ */
+
+int gsm_sim_init(struct osmocom_ms *ms)
+{
+	struct gsm_sim *sim = &ms->sim;
+
+	/* current path is undefined, forching MF */
+	sim->path[0] = 0x0bad;
+	sim->path[1] = 0;
+	sim->file = 0;
+
+	INIT_LLIST_HEAD(&sim->handlers);
+	INIT_LLIST_HEAD(&sim->jobs);
+
+	LOGP(DSIM, LOGL_INFO, "init SIM client\n");
+
+	return 0;
+}
+
+int gsm_sim_exit(struct osmocom_ms *ms)
+{
+	struct gsm_sim *sim = &ms->sim;
+	struct gsm_sim_handler *handler, *handler2;
+	struct msgb *msg;
+
+	LOGP(DSIM, LOGL_INFO, "exit SIM client\n");
+
+	/* remove pending job msg */
+	if (sim->job_msg) {
+		msgb_free(sim->job_msg);
+		sim->job_msg = NULL;
+	}
+	/* flush handlers */
+	llist_for_each_entry_safe(handler, handler2, &sim->handlers, entry)
+		sim_close(ms, handler->handle);
+	/* flush jobs */
+	while ((msg = msgb_dequeue(&sim->jobs)))
+		msgb_free(msg);
+
+	return 0;
+}
+
+
+
+
diff --git a/src/host/layer23/src/common/sysinfo.c b/src/host/layer23/src/common/sysinfo.c
new file mode 100644
index 00000000..b42bd653
--- /dev/null
+++ b/src/host/layer23/src/common/sysinfo.c
@@ -0,0 +1,871 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/bitvec.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/networks.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/sysinfo.h>
+
+#define MIN(a, b) ((a < b) ? a : b)
+
+/*
+ * dumping
+ */
+
+// FIXME: move to libosmocore
+char *gsm_print_arfcn(uint16_t arfcn)
+{
+	static char text[10];
+
+	sprintf(text, "%d", arfcn & 1023);
+	if ((arfcn & ARFCN_PCS))
+		strcat(text, "(PCS)");
+	else if (arfcn >= 512 && arfcn <= 885)
+		strcat(text, "(DCS)");
+
+	return text;
+}
+
+/* check if the cell 'talks' about DCS (0) or PCS (1) */
+uint8_t gsm_refer_pcs(uint16_t arfcn, struct gsm48_sysinfo *s)
+{
+	/* If ARFCN is PCS band, the cell refers to PCS */
+	if ((arfcn & ARFCN_PCS))
+		return 1;
+
+	/* If no SI1 is available, we assume DCS. Be sure to call this
+	 * function only if SI 1 is available. */
+	if (!s->si1)
+		return 0;
+
+	/* If band indicator indicates PCS band, the cell refers to PCSThe  */
+	return s->band_ind;
+}
+
+int gsm48_sysinfo_dump(struct gsm48_sysinfo *s, uint16_t arfcn,
+	void (*print)(void *, const char *, ...), void *priv, uint8_t *freq_map)
+{
+	char buffer[81];
+	int i, j, k, index;
+	int refer_pcs = gsm_refer_pcs(arfcn, s);
+
+	/* available sysinfos */
+	print(priv, "ARFCN = %s  channels 512+ refer to %s\n",
+		gsm_print_arfcn(arfcn),
+		(refer_pcs) ? "PCS (1900)" : "DCS (1800)");
+	print(priv, "Available SYSTEM INFORMATIONS =");
+	if (s->si1)
+		print(priv, " 1");
+	if (s->si2)
+		print(priv, " 2");
+	if (s->si2bis)
+		print(priv, " 2bis");
+	if (s->si2ter)
+		print(priv, " 2ter");
+	if (s->si3)
+		print(priv, " 3");
+	if (s->si4)
+		print(priv, " 4");
+	if (s->si5)
+		print(priv, " 5");
+	if (s->si5bis)
+		print(priv, " 5bis");
+	if (s->si5ter)
+		print(priv, " 5ter");
+	if (s->si6)
+		print(priv, " 6");
+	print(priv, "\n");
+	print(priv, "\n");
+
+	/* frequency list */
+	j = 0; k = 0;
+	for (i = 0; i < 1024; i++) {
+		if ((s->freq[i].mask & FREQ_TYPE_SERV)) {
+			if (!k) {
+				sprintf(buffer, "serv. cell  : ");
+				j = strlen(buffer);
+			}
+			if (j >= 75) {
+				buffer[j - 1] = '\0';
+				print(priv, "%s\n", buffer);
+				sprintf(buffer, "              ");
+				j = strlen(buffer);
+			}
+			sprintf(buffer + j, "%d,", i);
+			j = strlen(buffer);
+			k++;
+		}
+	}
+	if (j) {
+		buffer[j - 1] = '\0';
+		print(priv, "%s\n", buffer);
+	}
+	j = 0; k = 0;
+	for (i = 0; i < 1024; i++) {
+		if ((s->freq[i].mask & FREQ_TYPE_NCELL)) {
+			if (!k) {
+				sprintf(buffer, "SI2 (neigh.) BA=%d: ",
+					s->nb_ba_ind_si2);
+				j = strlen(buffer);
+			}
+			if (j >= 70) {
+				buffer[j - 1] = '\0';
+				print(priv, "%s\n", buffer);
+				sprintf(buffer, "                   ");
+				j = strlen(buffer);
+			}
+			sprintf(buffer + j, "%d,", i);
+			j = strlen(buffer);
+			k++;
+		}
+	}
+	if (j) {
+		buffer[j - 1] = '\0';
+		print(priv, "%s\n", buffer);
+	}
+	j = 0; k = 0;
+	for (i = 0; i < 1024; i++) {
+		if ((s->freq[i].mask & FREQ_TYPE_REP)) {
+			if (!k) {
+				sprintf(buffer, "SI5 (report) BA=%d: ",
+					s->nb_ba_ind_si5);
+				j = strlen(buffer);
+			}
+			if (j >= 70) {
+				buffer[j - 1] = '\0';
+				print(priv, "%s\n", buffer);
+				sprintf(buffer, "                   ");
+				j = strlen(buffer);
+			}
+			sprintf(buffer + j, "%d,", i);
+			j = strlen(buffer);
+			k++;
+		}
+	}
+	if (j) {
+		buffer[j - 1] = '\0';
+		print(priv, "%s\n", buffer);
+	}
+	print(priv, "\n");
+
+	/* frequency map */
+	for (i = 0; i < 1024; i += 64) {
+		sprintf(buffer, " %3d ", i);
+		for (j = 0; j < 64; j++) {
+			index = i+j;
+			if (refer_pcs && index >= 512 && index <= 885)
+				index = index-512+1024;
+			if ((s->freq[i+j].mask & FREQ_TYPE_SERV))
+				buffer[j + 5] = 'S';
+			else if ((s->freq[i+j].mask & FREQ_TYPE_NCELL)
+			      && (s->freq[i+j].mask & FREQ_TYPE_REP))
+				buffer[j + 5] = 'b';
+			else if ((s->freq[i+j].mask & FREQ_TYPE_NCELL))
+				buffer[j + 5] = 'n';
+			else if ((s->freq[i+j].mask & FREQ_TYPE_REP))
+				buffer[j + 5] = 'r';
+			else if (!freq_map || (freq_map[index >> 3]
+						& (1 << (index & 7))))
+				buffer[j + 5] = '.';
+			else
+				buffer[j + 5] = ' ';
+		}
+		for (; j < 64; j++)
+			buffer[j + 5] = ' ';
+		sprintf(buffer + 69, " %d", i + 63);
+		print(priv, "%s\n", buffer);
+	}
+	print(priv, " 'S' = serv. cell  'n' = SI2 (neigh.)  'r' = SI5 (rep.)  "
+		"'b' = SI2+SI5\n\n");
+
+	/* serving cell */
+	print(priv, "Serving Cell:\n");
+	print(priv, " BSIC = %d,%d  MCC = %s  MNC = %s  LAC = 0x%04x  Cell ID "
+		"= 0x%04x\n", s->bsic >> 3, s->bsic & 0x7,
+		gsm_print_mcc(s->mcc), gsm_print_mnc(s->mnc), s->lac,
+		s->cell_id);
+	print(priv, " Country = %s  Network Name = %s\n", gsm_get_mcc(s->mcc),
+		gsm_get_mnc(s->mcc, s->mnc));
+	print(priv, " MAX_RETRANS = %d  TX_INTEGER = %d  re-establish = %s\n",
+		s->max_retrans, s->tx_integer,
+		(s->reest_denied) ? "denied" : "allowed");
+	print(priv, " Cell barred = %s  barred classes =",
+		(s->cell_barr ? "yes" : "no"));
+	for (i = 0; i < 16; i++) {
+		if ((s->class_barr & (1 << i)))
+			print(priv, " C%d", i);
+	}
+	print(priv, "\n");
+	if (s->sp)
+		print(priv, " CBQ = %d  CRO = %d  TEMP_OFFSET = %d  "
+			"PENALTY_TIME = %d\n", s->sp_cbq, s->sp_cro, s->sp_to,
+			s->sp_pt);
+	if (s->nb_ncc_permitted_si2) {
+		print(priv, "NCC Permitted BCCH =");
+		for (i = 0; i < 8; i++)
+			if ((s->nb_ncc_permitted_si2 & (1 << i)))
+				print(priv, " %d", i);
+		print(priv, "\n");
+	}
+	if (s->nb_ncc_permitted_si6) {
+		print(priv, "NCC Permitted SACCH/TCH =");
+		for (i = 0; i < 8; i++)
+			if ((s->nb_ncc_permitted_si6 & (1 << i)))
+				print(priv, " %d", i);
+		print(priv, "\n");
+	}
+	print(priv, "\n");
+
+	/* neighbor cell */
+	print(priv, "Neighbor Cell:\n");
+	print(priv, " MAX_RETRANS = %d  TX_INTEGER = %d  re-establish = %s\n",
+		s->nb_max_retrans, s->nb_tx_integer,
+		(s->nb_reest_denied) ? "denied" : "allowed");
+	print(priv, " Cell barred = %s  barred classes =",
+		(s->nb_cell_barr ? "yes" : "no"));
+	for (i = 0; i < 16; i++) {
+		if ((s->nb_class_barr & (1 << i)))
+			print(priv, " C%d", i);
+	}
+	print(priv, "\n");
+	print(priv, "\n");
+
+	/* cell selection */
+	print(priv, "MX_TXPWR_MAX_CCCH = %d  CRH = %d  RXLEV_MIN = %d  "
+		"NECI = %d  ACS = %d\n", s->ms_txpwr_max_cch,
+		s->cell_resel_hyst_db, s->rxlev_acc_min_db, s->neci, s->acs);
+
+	/* bcch options */
+	print(priv, "BCCH link timeout = %d  DTX = %d  PWRC = %d\n",
+		s->bcch_radio_link_timeout, s->bcch_dtx, s->bcch_pwrc);
+
+	/* sacch options */
+	print(priv, "SACCH link timeout = %d  DTX = %d  PWRC = %d\n",
+		s->sacch_radio_link_timeout, s->sacch_dtx, s->sacch_pwrc);
+
+	/* control channel */
+	switch(s->ccch_conf) {
+	case 0:
+	case 2:
+	case 4:
+	case 6:
+		print(priv, "CCCH Config = %d CCCH", (s->ccch_conf >> 1) + 1);
+		break;
+	case 1:
+		print(priv, "CCCH Config = 1 CCCH + SDCCH");
+		break;
+	default:
+		print(priv, "CCCH Config = reserved");
+	}
+	print(priv, "  BS-PA-MFMS = %d  Attachment = %s\n",
+		s->pag_mf_periods, (s->att_allowed) ? "allowed" : "denied");
+	print(priv, "BS-AG_BLKS_RES = %d  ", s->bs_ag_blks_res);
+	if (s->t3212)
+		print(priv, "T3212 = %d sec.\n", s->t3212);
+	else
+		print(priv, "T3212 = disabled\n", s->t3212);
+
+	/* channel description */
+	if (s->h)
+		print(priv, "chan_nr = 0x%02x TSC = %d  MAIO = %d  HSN = %d\n",
+			s->chan_nr, s->tsc, s->maio, s->hsn);
+	else
+		print(priv, "chan_nr = 0x%02x TSC = %d  ARFCN = %d\n",
+			s->chan_nr, s->tsc, s->arfcn);
+	print(priv, "\n");
+
+	return 0;
+}
+
+/*
+ * decoding
+ */
+
+int gsm48_decode_chan_h0(struct gsm48_chan_desc *cd, uint8_t *tsc, 
+	uint16_t *arfcn)
+{
+	*tsc = cd->h0.tsc;
+	*arfcn = cd->h0.arfcn_low | (cd->h0.arfcn_high << 8);
+
+	return 0;
+}
+
+int gsm48_decode_chan_h1(struct gsm48_chan_desc *cd, uint8_t *tsc,
+	uint8_t *maio, uint8_t *hsn)
+{
+	*tsc = cd->h1.tsc;
+	*maio = cd->h1.maio_low | (cd->h1.maio_high << 2);
+	*hsn = cd->h1.hsn;
+
+	return 0;
+}
+
+/* decode "Cell Channel Description" (10.5.2.1b) and other frequency lists */
+static int decode_freq_list(struct gsm_sysinfo_freq *f, uint8_t *cd,
+	uint8_t len, uint8_t mask, uint8_t frqt)
+{
+#if 0
+	/* only Bit map 0 format for P-GSM */
+	if ((cd[0] & 0xc0 & mask) != 0x00 &&
+	    (set->p_gsm && !set->e_gsm && !set->r_gsm && !set->dcs))
+		return 0;
+#endif
+
+	return gsm48_decode_freq_list(f, cd, len, mask, frqt);
+}
+
+/* decode "Cell Selection Parameters" (10.5.2.4) */
+static int gsm48_decode_cell_sel_param(struct gsm48_sysinfo *s,
+	struct gsm48_cell_sel_par *cs)
+{
+	s->ms_txpwr_max_cch = cs->ms_txpwr_max_ccch;
+	s->cell_resel_hyst_db = cs->cell_resel_hyst * 2;
+	s->rxlev_acc_min_db = cs->rxlev_acc_min - 110;
+	s->neci = cs->neci;
+	s->acs = cs->acs;
+
+	return 0;
+}
+
+/* decode "Cell Options (BCCH)" (10.5.2.3) */
+static int gsm48_decode_cellopt_bcch(struct gsm48_sysinfo *s,
+	struct gsm48_cell_options *co)
+{
+	s->bcch_radio_link_timeout = (co->radio_link_timeout + 1) * 4;
+	s->bcch_dtx = co->dtx;
+	s->bcch_pwrc = co->pwrc;
+
+	return 0;
+}
+
+/* decode "Cell Options (SACCH)" (10.5.2.3a) */
+static int gsm48_decode_cellopt_sacch(struct gsm48_sysinfo *s,
+	struct gsm48_cell_options *co)
+{
+	s->sacch_radio_link_timeout = (co->radio_link_timeout + 1) * 4;
+	s->sacch_dtx = co->dtx;
+	s->sacch_pwrc = co->pwrc;
+
+	return 0;
+}
+
+/* decode "Control Channel Description" (10.5.2.11) */
+static int gsm48_decode_ccd(struct gsm48_sysinfo *s,
+	struct gsm48_control_channel_descr *cc)
+{
+	s->ccch_conf = cc->ccch_conf;
+	s->bs_ag_blks_res = cc->bs_ag_blks_res;
+	s->att_allowed = cc->att;
+	s->pag_mf_periods = cc->bs_pa_mfrms + 2;
+	s->t3212 = cc->t3212 * 360; /* convert deci-hours to seconds */
+
+	return 0;
+}
+
+/* decode "Mobile Allocation" (10.5.2.21) */
+int gsm48_decode_mobile_alloc(struct gsm_sysinfo_freq *freq,
+	uint8_t *ma, uint8_t len, uint16_t *hopping, uint8_t *hopp_len, int si4)
+{
+	int i, j = 0;
+	uint16_t f[len << 3];
+
+	/* not more than 64 hopping indexes allowed in IE */
+	if (len > 8)
+		return -EINVAL;
+
+	/* tabula rasa */
+	*hopp_len = 0;
+	if (si4) {
+		for (i = 0; i < 1024; i++)
+			freq[i].mask &= ~FREQ_TYPE_HOPP;
+	}
+
+	/* generating list of all frequencies (1..1023,0) */
+	for (i = 1; i <= 1024; i++) {
+		if ((freq[i & 1023].mask & FREQ_TYPE_SERV)) {
+			LOGP(DRR, LOGL_INFO, "Serving cell ARFCN #%d: %d\n",
+				j, i & 1023);
+			f[j++] = i & 1023;
+			if (j == (len << 3))
+				break;
+		}
+	}
+
+	/* fill hopping table with frequency index given by IE
+	 * and set hopping type bits
+	 */
+	for (i = 0; i < (len << 3); i++) {
+		/* if bit is set, this frequency index is used for hopping */
+		if ((ma[len - 1 - (i >> 3)] & (1 << (i & 7)))) {
+			LOGP(DRR, LOGL_INFO, "Hopping ARFCN: %d (bit %d)\n",
+				i, f[i]);
+			/* index higher than entries in list ? */
+			if (i >= j) {
+				LOGP(DRR, LOGL_NOTICE, "Mobile Allocation "
+					"hopping index %d exceeds maximum "
+					"number of cell frequencies. (%d)\n",
+					i + 1, j);
+				break;
+			}
+			hopping[(*hopp_len)++] = f[i];
+			if (si4)
+				freq[f[i]].mask |= FREQ_TYPE_HOPP;
+		}
+	}
+
+	return 0;
+}
+
+/* Rach Control decode tables */
+static uint8_t gsm48_max_retrans[4] = {
+	1, 2, 4, 7
+};
+static uint8_t gsm48_tx_integer[16] = {
+	3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 14, 16, 20, 25, 32, 50
+};
+
+/* decode "RACH Control Parameter" (10.5.2.29) */
+static int gsm48_decode_rach_ctl_param(struct gsm48_sysinfo *s,
+	struct gsm48_rach_control *rc)
+{
+	s->reest_denied = rc->re;
+	s->cell_barr = rc->cell_bar;
+	s->tx_integer = gsm48_tx_integer[rc->tx_integer];
+	s->max_retrans = gsm48_max_retrans[rc->max_trans];
+	s->class_barr = (rc->t2 << 8) | rc->t3;
+
+	return 0;
+}
+static int gsm48_decode_rach_ctl_neigh(struct gsm48_sysinfo *s,
+	struct gsm48_rach_control *rc)
+{
+	s->nb_reest_denied = rc->re;
+	s->nb_cell_barr = rc->cell_bar;
+	s->nb_tx_integer = gsm48_tx_integer[rc->tx_integer];
+	s->nb_max_retrans = gsm48_max_retrans[rc->max_trans];
+	s->nb_class_barr = (rc->t2 << 8) | rc->t3;
+
+	return 0;
+}
+
+/* decode "SI 1 Rest Octets" (10.5.2.32) */
+static int gsm48_decode_si1_rest(struct gsm48_sysinfo *s, uint8_t *si,
+	uint8_t len)
+{
+	struct bitvec bv;
+
+	memset(&bv, 0, sizeof(bv));
+	bv.data_len = len;
+	bv.data = si;
+
+	/* Optional Selection Parameters */
+	if (bitvec_get_bit_high(&bv) == H) {
+		s->nch = 1;
+		s->nch_position = bitvec_get_uint(&bv, 5);
+	} else
+		s->nch = 0;
+	if (bitvec_get_bit_high(&bv) == H)
+		s->band_ind = 1;
+	else
+		s->band_ind = 0;
+
+	return 0;
+}
+
+/* decode "SI 3 Rest Octets" (10.5.2.34) */
+static int gsm48_decode_si3_rest(struct gsm48_sysinfo *s, uint8_t *si,
+	uint8_t len)
+{
+	struct bitvec bv;
+
+	memset(&bv, 0, sizeof(bv));
+	bv.data_len = len;
+	bv.data = si;
+
+	/* Optional Selection Parameters */
+	if (bitvec_get_bit_high(&bv) == H) {
+		s->sp = 1;
+		s->sp_cbq = bitvec_get_uint(&bv, 1);
+		s->sp_cro = bitvec_get_uint(&bv, 6);
+		s->sp_to = bitvec_get_uint(&bv, 3);
+		s->sp_pt = bitvec_get_uint(&bv, 5);
+	} else
+		s->sp = 0;
+	/* Optional Power Offset */
+	if (bitvec_get_bit_high(&bv) == H) {
+		s->po = 1;
+		s->po_value = bitvec_get_uint(&bv, 2);
+	} else
+		s->po = 0;
+	/* System Onformation 2ter Indicator */
+	if (bitvec_get_bit_high(&bv) == H)
+		s->si2ter_ind = 1;
+	else
+		s->si2ter_ind = 0;
+	/* Early Classark Sending Control */
+	if (bitvec_get_bit_high(&bv) == H)
+		s->ecsm = 1;
+	else
+		s->ecsm = 0;
+	/* Scheduling if and where */
+	if (bitvec_get_bit_high(&bv) == H) {
+		s->sched = 1;
+		s->sched_where = bitvec_get_uint(&bv, 3);
+	} else
+		s->sched = 0;
+	/* GPRS Indicator */
+	if (bitvec_get_bit_high(&bv) == H) {
+		s->gprs = 1;
+		s->gprs_ra_colour = bitvec_get_uint(&bv, 3);
+		s->gprs_si13_pos = bitvec_get_uint(&bv, 1);
+	} else
+		s->gprs = 0;
+
+	return 0;
+}
+
+/* decode "SI 4 Rest Octets" (10.5.2.35) */
+static int gsm48_decode_si4_rest(struct gsm48_sysinfo *s, uint8_t *si,
+	uint8_t len)
+{
+	struct bitvec bv;
+
+	memset(&bv, 0, sizeof(bv));
+	bv.data_len = len;
+	bv.data = si;
+
+	/* Optional Selection Parameters */
+	if (bitvec_get_bit_high(&bv) == H) {
+		s->sp = 1;
+		s->sp_cbq = bitvec_get_uint(&bv, 1);
+		s->sp_cro = bitvec_get_uint(&bv, 6);
+		s->sp_to = bitvec_get_uint(&bv, 3);
+		s->sp_pt = bitvec_get_uint(&bv, 5);
+	} else
+		s->sp = 0;
+	/* Optional Power Offset */
+	if (bitvec_get_bit_high(&bv) == H) {
+		s->po = 1;
+		s->po_value = bitvec_get_uint(&bv, 3);
+	} else
+		s->po = 0;
+	/* GPRS Indicator */
+	if (bitvec_get_bit_high(&bv) == H) {
+		s->gprs = 1;
+		s->gprs_ra_colour = bitvec_get_uint(&bv, 3);
+		s->gprs_si13_pos = bitvec_get_uint(&bv, 1);
+	} else
+		s->gprs = 0;
+	// todo: more rest octet bits
+
+	return 0;
+}
+
+/* decode "SI 6 Rest Octets" (10.5.2.35a) */
+static int gsm48_decode_si6_rest(struct gsm48_sysinfo *s, uint8_t *si,
+	uint8_t len)
+{
+	return 0;
+}
+
+int gsm48_decode_sysinfo1(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_1 *si, int len)
+{
+	int payload_len = len - sizeof(*si);
+
+	memcpy(s->si1_msg, si, MIN(len, sizeof(s->si1_msg)));
+
+	/* Cell Channel Description */
+	decode_freq_list(s->freq, si->cell_channel_description,
+		sizeof(si->cell_channel_description), 0xce, FREQ_TYPE_SERV);
+	/* RACH Control Parameter */
+	gsm48_decode_rach_ctl_param(s, &si->rach_control);
+	/* SI 1 Rest Octets */
+	if (payload_len)
+		gsm48_decode_si1_rest(s, si->rest_octets, payload_len);
+
+	s->si1 = 1;
+
+	if (s->si4) {
+		LOGP(DRR, LOGL_NOTICE, "Now updating previously received "
+			"SYSTEM INFORMATION 4\n");
+		gsm48_decode_sysinfo4(s,
+			(struct gsm48_system_information_type_4 *) s->si4_msg,
+			sizeof(s->si4_msg));
+	}
+
+	return 0;
+}
+
+int gsm48_decode_sysinfo2(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_2 *si, int len)
+{
+	memcpy(s->si2_msg, si, MIN(len, sizeof(s->si2_msg)));
+
+	/* Neighbor Cell Description */
+	s->nb_ext_ind_si2 = (si->bcch_frequency_list[0] >> 6) & 1;
+	s->nb_ba_ind_si2 = (si->bcch_frequency_list[0] >> 5) & 1;
+	decode_freq_list(s->freq, si->bcch_frequency_list,
+		sizeof(si->bcch_frequency_list), 0xce, FREQ_TYPE_NCELL_2);
+	/* NCC Permitted */
+	s->nb_ncc_permitted_si2 = si->ncc_permitted;
+	/* RACH Control Parameter */
+	gsm48_decode_rach_ctl_neigh(s, &si->rach_control);
+
+	s->si2 = 1;
+
+	return 0;
+}
+
+int gsm48_decode_sysinfo2bis(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_2bis *si, int len)
+{
+	memcpy(s->si2b_msg, si, MIN(len, sizeof(s->si2b_msg)));
+
+	/* Neighbor Cell Description */
+	s->nb_ext_ind_si2bis = (si->bcch_frequency_list[0] >> 6) & 1;
+	s->nb_ba_ind_si2bis = (si->bcch_frequency_list[0] >> 5) & 1;
+	decode_freq_list(s->freq, si->bcch_frequency_list,
+		sizeof(si->bcch_frequency_list), 0xce, FREQ_TYPE_NCELL_2bis);
+	/* RACH Control Parameter */
+	gsm48_decode_rach_ctl_neigh(s, &si->rach_control);
+
+	s->si2bis = 1;
+
+	return 0;
+}
+
+int gsm48_decode_sysinfo2ter(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_2ter *si, int len)
+{
+	memcpy(s->si2t_msg, si, MIN(len, sizeof(s->si2t_msg)));
+
+	/* Neighbor Cell Description 2 */
+	s->nb_multi_rep_si2ter = (si->ext_bcch_frequency_list[0] >> 6) & 3;
+	s->nb_ba_ind_si2ter = (si->ext_bcch_frequency_list[0] >> 5) & 1;
+	decode_freq_list(s->freq, si->ext_bcch_frequency_list,
+		sizeof(si->ext_bcch_frequency_list), 0x8e,
+			FREQ_TYPE_NCELL_2ter);
+
+	s->si2ter = 1;
+
+	return 0;
+}
+
+int gsm48_decode_sysinfo3(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_3 *si, int len)
+{
+	int payload_len = len - sizeof(*si);
+
+	memcpy(s->si3_msg, si, MIN(len, sizeof(s->si3_msg)));
+
+	/* Cell Identity */
+	s->cell_id = ntohs(si->cell_identity);
+	/* LAI */
+	gsm48_decode_lai_hex(&si->lai, &s->mcc, &s->mnc, &s->lac);
+	/* Control Channel Description */
+	gsm48_decode_ccd(s, &si->control_channel_desc);
+	/* Cell Options (BCCH) */
+	gsm48_decode_cellopt_bcch(s, &si->cell_options);
+	/* Cell Selection Parameters */
+	gsm48_decode_cell_sel_param(s, &si->cell_sel_par);
+	/* RACH Control Parameter */
+	gsm48_decode_rach_ctl_param(s, &si->rach_control);
+	/* SI 3 Rest Octets */
+	if (payload_len >= 4)
+		gsm48_decode_si3_rest(s, si->rest_octets, payload_len);
+
+	LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 3 (mcc %s mnc %s "
+		"lac 0x%04x)\n", gsm_print_mcc(s->mcc),
+		gsm_print_mnc(s->mnc), s->lac);
+
+	s->si3 = 1;
+
+	return 0;
+}
+
+int gsm48_decode_sysinfo4(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_4 *si, int len)
+{
+	int payload_len = len - sizeof(*si);
+
+	uint8_t *data = si->data;
+	struct gsm48_chan_desc *cd;
+
+	memcpy(s->si4_msg, si, MIN(len, sizeof(s->si4_msg)));
+
+	/* LAI */
+	gsm48_decode_lai_hex(&si->lai, &s->mcc, &s->mnc, &s->lac);
+	/* Cell Selection Parameters */
+	gsm48_decode_cell_sel_param(s, &si->cell_sel_par);
+	/* RACH Control Parameter */
+	gsm48_decode_rach_ctl_param(s, &si->rach_control);
+
+	/* CBCH Channel Description */
+	if (payload_len >= 1 && data[0] == GSM48_IE_CBCH_CHAN_DESC) {
+		if (payload_len < 4) {
+short_read:
+			LOGP(DRR, LOGL_NOTICE, "Short read!\n");
+			return -EIO;
+		}
+		cd = (struct gsm48_chan_desc *) (data + 1);
+		s->chan_nr = cd->chan_nr;
+		if (cd->h0.h) {
+			s->h = 1;
+			gsm48_decode_chan_h1(cd, &s->tsc, &s->maio, &s->hsn);
+		} else {
+			s->h = 0;
+			gsm48_decode_chan_h0(cd, &s->tsc, &s->arfcn);
+		}
+		payload_len -= 4;
+		data += 4;
+	}
+	/* CBCH Mobile Allocation */
+	if (payload_len >= 1 && data[0] == GSM48_IE_CBCH_MOB_AL) {
+		if (payload_len < 1 || payload_len < 2 + data[1])
+			goto short_read;
+		if (!s->si1) {
+			LOGP(DRR, LOGL_NOTICE, "Ignoring CBCH allocation of "
+				"SYSTEM INFORMATION 4 until SI 1 is "
+				"received.\n");
+		} else {
+			gsm48_decode_mobile_alloc(s->freq, data + 2, data[1],
+				s->hopping, &s->hopp_len, 1);
+		}
+		payload_len -= 2 + data[1];
+		data += 2 + data[1];
+	}
+	/* SI 4 Rest Octets */
+	if (payload_len > 0)
+		gsm48_decode_si4_rest(s, data, payload_len);
+
+	s->si4 = 1;
+
+	return 0;
+}
+
+int gsm48_decode_sysinfo5(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_5 *si, int len)
+{
+	memcpy(s->si5_msg, si, MIN(len, sizeof(s->si5_msg)));
+
+	/* Neighbor Cell Description */
+	s->nb_ext_ind_si5 = (si->bcch_frequency_list[0] >> 6) & 1;
+	s->nb_ba_ind_si5 = (si->bcch_frequency_list[0] >> 5) & 1;
+	decode_freq_list(s->freq, si->bcch_frequency_list,
+		sizeof(si->bcch_frequency_list), 0xce, FREQ_TYPE_REP_5);
+
+	s->si5 = 1;
+
+	return 0;
+}
+
+int gsm48_decode_sysinfo5bis(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_5bis *si, int len)
+{
+	memcpy(s->si5b_msg, si, MIN(len, sizeof(s->si5b_msg)));
+
+	/* Neighbor Cell Description */
+	s->nb_ext_ind_si5bis = (si->bcch_frequency_list[0] >> 6) & 1;
+	s->nb_ba_ind_si5bis = (si->bcch_frequency_list[0] >> 5) & 1;
+	decode_freq_list(s->freq, si->bcch_frequency_list,
+		sizeof(si->bcch_frequency_list), 0xce, FREQ_TYPE_REP_5bis);
+
+	s->si5bis = 1;
+
+	return 0;
+}
+
+int gsm48_decode_sysinfo5ter(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_5ter *si, int len)
+{
+	memcpy(s->si5t_msg, si, MIN(len, sizeof(s->si5t_msg)));
+
+	/* Neighbor Cell Description */
+	s->nb_multi_rep_si5ter = (si->bcch_frequency_list[0] >> 6) & 3;
+	s->nb_ba_ind_si5ter = (si->bcch_frequency_list[0] >> 5) & 1;
+	decode_freq_list(s->freq, si->bcch_frequency_list,
+		sizeof(si->bcch_frequency_list), 0x8e, FREQ_TYPE_REP_5ter);
+
+	s->si5ter = 1;
+
+	return 0;
+}
+
+int gsm48_decode_sysinfo6(struct gsm48_sysinfo *s,
+		struct gsm48_system_information_type_6 *si, int len)
+{
+	int payload_len = len - sizeof(*si);
+
+	memcpy(s->si6_msg, si, MIN(len, sizeof(s->si6_msg)));
+
+	/* Cell Identity */
+	if (s->si6 && s->cell_id != ntohs(si->cell_identity))
+		LOGP(DRR, LOGL_INFO, "Cell ID on SI 6 differs from previous "
+			"read.\n");
+	s->cell_id = ntohs(si->cell_identity);
+	/* LAI */
+	gsm48_decode_lai_hex(&si->lai, &s->mcc, &s->mnc, &s->lac);
+	/* Cell Options (SACCH) */
+	gsm48_decode_cellopt_sacch(s, &si->cell_options);
+	/* NCC Permitted */
+	s->nb_ncc_permitted_si6 = si->ncc_permitted;
+	/* SI 6 Rest Octets */
+	if (payload_len >= 4)
+		gsm48_decode_si6_rest(s, si->rest_octets, payload_len);
+
+	s->si6 = 1;
+
+	return 0;
+}
+
+int gsm48_encode_lai_hex(struct gsm48_loc_area_id *lai, uint16_t mcc,
+	uint16_t mnc, uint16_t lac)
+{
+	lai->digits[0] = (mcc >> 8) | (mcc & 0xf0);
+	lai->digits[1] = (mcc & 0x0f) | (mnc << 4);
+	lai->digits[2] = (mnc >> 8) | (mnc & 0xf0);
+	lai->lac = htons(lac);
+
+	return 0;
+}
+
+ int gsm48_decode_lai_hex(struct gsm48_loc_area_id *lai, uint16_t *mcc,
+       	uint16_t *mnc, uint16_t *lac)
+{
+	*mcc = ((lai->digits[0] & 0x0f) << 8)
+		| (lai->digits[0] & 0xf0)
+		| (lai->digits[1] & 0x0f);
+	*mnc = ((lai->digits[2] & 0x0f) << 8)
+		| (lai->digits[2] & 0xf0)
+		| ((lai->digits[1] & 0xf0) >> 4);
+	*lac = ntohs(lai->lac);
+			        
+	return 0;
+}
+
diff --git a/src/host/layer23/src/common/utils.c b/src/host/layer23/src/common/utils.c
new file mode 100644
index 00000000..4ecb134b
--- /dev/null
+++ b/src/host/layer23/src/common/utils.c
@@ -0,0 +1,47 @@
+/* Utilities used by mobile */
+
+/* (C) 2018 by Holger Hans Peter Freyther
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/bb/common/utils.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <stdlib.h>
+#include <stdint.h>
+
+
+/**
+ * A secure replacement for random(3).
+ *
+ * \return a secure random number using osmo_get_rand_id between
+ * 0 and RAND_MAX.
+ */
+int layer23_random(void)
+{
+	unsigned int r;
+
+	if (osmo_get_rand_id((uint8_t *) &r, sizeof(r)) != 0)
+		return random();
+
+	r &= ~(1U << 31);
+	r %= RAND_MAX;
+	return (int) r;
+}
diff --git a/src/host/layer23/src/misc/Makefile.am b/src/host/layer23/src/misc/Makefile.am
new file mode 100644
index 00000000..9c2bc4d4
--- /dev/null
+++ b/src/host/layer23/src/misc/Makefile.am
@@ -0,0 +1,13 @@
+AM_CPPFLAGS = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) $(LIBGPS_CFLAGS)
+LDADD = ../common/liblayer23.a $(LIBOSMOCORE_LIBS) $(LIBOSMOGSM_LIBS) $(LIBOSMOCODEC_LIBS) $(LIBGPS_LIBS)
+
+bin_PROGRAMS = bcch_scan ccch_scan echo_test cell_log cbch_sniff
+
+bcch_scan_SOURCES = ../common/main.c app_bcch_scan.c bcch_scan.c
+ccch_scan_SOURCES   = ../common/main.c app_ccch_scan.c rslms.c
+echo_test_SOURCES = ../common/main.c app_echo_test.c
+cell_log_LDADD = $(LDADD) -lm
+cell_log_SOURCES = ../common/main.c app_cell_log.c cell_log.c \
+			../../../gsmmap/geo.c
+cbch_sniff_SOURCES = ../common/main.c app_cbch_sniff.c
diff --git a/src/host/layer23/src/misc/app_bcch_scan.c b/src/host/layer23/src/misc/app_bcch_scan.c
new file mode 100644
index 00000000..7b21ed79
--- /dev/null
+++ b/src/host/layer23/src/misc/app_bcch_scan.c
@@ -0,0 +1,69 @@
+/* "Application" code of the layer2/3 stack */
+
+/* (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/l23_app.h>
+#include <osmocom/bb/misc/layer3.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/signal.h>
+
+#include <l1ctl_proto.h>
+
+static int signal_cb(unsigned int subsys, unsigned int signal,
+		     void *handler_data, void *signal_data)
+{
+	struct osmocom_ms *ms;
+
+	if (subsys != SS_L1CTL)
+		return 0;
+
+	switch (signal) {
+	case S_L1CTL_RESET:
+		ms = signal_data;
+		return fps_start(ms);
+	}
+	return 0;
+}
+
+int l23_app_init(struct osmocom_ms *ms)
+{
+	/* don't do layer3_init() as we don't want an actualy L3 */
+	fps_init(ms);
+	l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
+	return osmo_signal_register_handler(SS_L1CTL, &signal_cb, NULL);
+}
+
+static struct l23_app_info info = {
+	.copyright	= "Copyright (C) 2010 Harald Welte <laforge@gnumonks.org>\n",
+	.contribution	= "Contributions by Holger Hans Peter Freyther\n",
+};
+
+struct l23_app_info *l23_app_info()
+{
+	return &info;
+}
diff --git a/src/host/layer23/src/misc/app_cbch_sniff.c b/src/host/layer23/src/misc/app_cbch_sniff.c
new file mode 100644
index 00000000..8256eaf6
--- /dev/null
+++ b/src/host/layer23/src/misc/app_cbch_sniff.c
@@ -0,0 +1,202 @@
+/* CBCH passive sniffer */
+
+/* (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Alex Badea <vamposdecampos@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/l23_app.h>
+#include <osmocom/bb/misc/layer3.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/gsm/rsl.h>
+
+#include <l1ctl_proto.h>
+
+struct osmocom_ms *g_ms;
+struct gsm48_sysinfo g_sysinfo = {};
+
+static int try_cbch(struct osmocom_ms *ms, struct gsm48_sysinfo *s)
+{
+	if (!s->si1 || !s->si4)
+		return 0;
+	if (!s->chan_nr) {
+		LOGP(DRR, LOGL_INFO, "no CBCH chan_nr found\n");
+		return 0;
+	}
+
+	if (s->h) {
+		LOGP(DRR, LOGL_INFO, "chan_nr = 0x%02x TSC = %d  MAIO = %d  "
+			"HSN = %d  hseq (%d): %s\n",
+			s->chan_nr, s->tsc, s->maio, s->hsn,
+			s->hopp_len,
+			osmo_hexdump((unsigned char *) s->hopping, s->hopp_len * 2));
+		return l1ctl_tx_dm_est_req_h1(ms,
+			s->maio, s->hsn, s->hopping, s->hopp_len,
+			s->chan_nr, s->tsc,
+			GSM48_CMODE_SIGN, 0);
+	} else {
+		LOGP(DRR, LOGL_INFO, "chan_nr = 0x%02x TSC = %d  ARFCN = %d\n",
+			s->chan_nr, s->tsc, s->arfcn);
+		return l1ctl_tx_dm_est_req_h0(ms, s->arfcn,
+			s->chan_nr, s->tsc, GSM48_CMODE_SIGN, 0);
+	}
+}
+
+
+/* receive BCCH at RR layer */
+static int bcch(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_header *sih = msgb_l3(msg);
+	struct gsm48_sysinfo *s = &g_sysinfo;
+
+	if (msgb_l3len(msg) != 23) {
+		LOGP(DRR, LOGL_NOTICE, "Invalid BCCH message length\n");
+		return -EINVAL;
+	}
+	switch (sih->system_information) {
+	case GSM48_MT_RR_SYSINFO_1:
+		LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 1\n");
+		gsm48_decode_sysinfo1(s,
+			(struct gsm48_system_information_type_1 *) sih,
+			msgb_l3len(msg));
+		return try_cbch(ms, s);
+	case GSM48_MT_RR_SYSINFO_4:
+		LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 4\n");
+		gsm48_decode_sysinfo4(s,
+			(struct gsm48_system_information_type_4 *) sih,
+			msgb_l3len(msg));
+		return try_cbch(ms, s);
+	default:
+		return 0;
+	}
+}
+
+static int unit_data_ind(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	struct tlv_parsed tv;
+	uint8_t ch_type, ch_subch, ch_ts;
+
+	DEBUGP(DRSL, "RSLms UNIT DATA IND chan_nr=0x%02x link_id=0x%02x\n",
+		rllh->chan_nr, rllh->link_id);
+
+	rsl_tlv_parse(&tv, rllh->data, msgb_l2len(msg)-sizeof(*rllh));
+	if (!TLVP_PRESENT(&tv, RSL_IE_L3_INFO)) {
+		DEBUGP(DRSL, "UNIT_DATA_IND without L3 INFO ?!?\n");
+		return -EIO;
+	}
+	msg->l3h = (uint8_t *) TLVP_VAL(&tv, RSL_IE_L3_INFO);
+
+	rsl_dec_chan_nr(rllh->chan_nr, &ch_type, &ch_subch, &ch_ts);
+	switch (ch_type) {
+	case RSL_CHAN_BCCH:
+		return bcch(ms, msg);
+	default:
+		return 0;
+	}
+}
+
+static int rcv_rll(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	int msg_type = rllh->c.msg_type;
+
+	if (msg_type == RSL_MT_UNIT_DATA_IND) {
+		unit_data_ind(ms, msg);
+	} else
+		LOGP(DRSL, LOGL_NOTICE, "RSLms message unhandled\n");
+
+	msgb_free(msg);
+
+	return 0;
+}
+
+static int rcv_rsl(struct msgb *msg, struct lapdm_entity *le, void *l3ctx)
+{
+	struct osmocom_ms *ms = l3ctx;
+	struct abis_rsl_common_hdr *rslh = msgb_l2(msg);
+	int rc = 0;
+
+	switch (rslh->msg_discr & 0xfe) {
+	case ABIS_RSL_MDISC_RLL:
+		rc = rcv_rll(ms, msg);
+		break;
+	default:
+		LOGP(DRSL, LOGL_NOTICE, "unknown RSLms msg_discr 0x%02x\n",
+			rslh->msg_discr);
+		msgb_free(msg);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int signal_cb(unsigned int subsys, unsigned int signal,
+		     void *handler_data, void *signal_data)
+{
+	struct osmocom_ms *ms;
+
+	if (subsys != SS_L1CTL)
+		return 0;
+
+	switch (signal) {
+	case S_L1CTL_RESET:
+	case S_L1CTL_FBSB_ERR:
+		ms = g_ms;
+		return l1ctl_tx_fbsb_req(ms, ms->test_arfcn,
+			L1CTL_FBSB_F_FB01SB, 100, 0, CCCH_MODE_COMBINED,
+			dbm2rxlev(-85));
+	case S_L1CTL_FBSB_RESP:
+		return 0;
+	}
+	return 0;
+}
+
+int l23_app_init(struct osmocom_ms *ms)
+{
+	/* don't do layer3_init() as we don't want an actualy L3 */
+
+	g_ms = ms;
+	lapdm_channel_set_l3(&ms->lapdm_channel, &rcv_rsl, ms);
+
+	l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
+	/* FIXME: L1CTL_RES_T_FULL doesn't reset dedicated mode
+	 * (if previously set), so we release it here. */
+	l1ctl_tx_dm_rel_req(ms);
+	return osmo_signal_register_handler(SS_L1CTL, &signal_cb, NULL);
+}
+
+static struct l23_app_info info = {
+	.copyright	= "Copyright (C) 2010 Harald Welte <laforge@gnumonks.org>\n",
+	.contribution	= "Contributions by Holger Hans Peter Freyther\n",
+};
+
+struct l23_app_info *l23_app_info()
+{
+	return &info;
+}
diff --git a/src/host/layer23/src/misc/app_ccch_scan.c b/src/host/layer23/src/misc/app_ccch_scan.c
new file mode 100644
index 00000000..88a2bef3
--- /dev/null
+++ b/src/host/layer23/src/misc/app_ccch_scan.c
@@ -0,0 +1,501 @@
+/* CCCH passive sniffer */
+/* (C) 2010-2011 by Holger Hans Peter Freyther
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/gsm48_ie.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/misc/rslms.h>
+#include <osmocom/bb/misc/layer3.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/l23_app.h>
+
+#include <l1ctl_proto.h>
+
+static struct {
+	int ccch_mode;
+} app_state;
+
+static int bcch_check_tc(uint8_t si_type, uint8_t tc)
+{
+	/* FIXME: there is no tc information (always 0) */
+	return 0;
+
+	switch (si_type) {
+	case GSM48_MT_RR_SYSINFO_1:
+		if (tc != 0)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_2:
+		if (tc != 1)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_3:
+		if (tc != 2 && tc != 6)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_4:
+		if (tc != 3 && tc != 7)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_7:
+		if (tc != 7)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_8:
+		if (tc != 3)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_9:
+		if (tc != 4)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_13:
+		if (tc != 4 && tc != 0)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_16:
+		if (tc != 6)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_17:
+		if (tc != 2)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_2bis:
+		if (tc != 5)
+			return -EINVAL;
+		break;
+	case GSM48_MT_RR_SYSINFO_2ter:
+		if (tc != 5 && tc != 4)
+			return -EINVAL;
+		break;
+
+	/* The following types are used on SACCH only */
+	case GSM48_MT_RR_SYSINFO_5:
+	case GSM48_MT_RR_SYSINFO_6:
+	case GSM48_MT_RR_SYSINFO_5bis:
+	case GSM48_MT_RR_SYSINFO_5ter:
+		break;
+
+	/* Unknown SI type */
+	default:
+		LOGP(DRR, LOGL_INFO, "Unknown SI (type=0x%02x)\n", si_type);
+		return -ENOTSUP;
+	};
+
+	return 0;
+}
+
+static void handle_si3(struct osmocom_ms *ms,
+	struct gsm48_system_information_type_3 *si)
+{
+	if (app_state.ccch_mode != CCCH_MODE_NONE)
+		return;
+
+	if (si->control_channel_desc.ccch_conf == RSL_BCCH_CCCH_CONF_1_C)
+		app_state.ccch_mode = CCCH_MODE_COMBINED;
+	else
+		app_state.ccch_mode = CCCH_MODE_NON_COMBINED;
+
+	l1ctl_tx_ccch_mode_req(ms, app_state.ccch_mode);
+}
+
+static void dump_bcch(struct osmocom_ms *ms, uint8_t tc, const uint8_t *data)
+{
+	struct gsm48_system_information_type_header *si_hdr;
+	si_hdr = (struct gsm48_system_information_type_header *) data;
+	uint8_t si_type = si_hdr->system_information;
+
+	LOGP(DRR, LOGL_INFO, "BCCH message (type=0x%02x): %s\n",
+		si_type, gsm48_rr_msg_name(si_type));
+
+	if (bcch_check_tc(si_type, tc) == -EINVAL)
+		LOGP(DRR, LOGL_INFO, "SI on wrong tc=%u\n", tc);
+
+	/* GSM 05.02 §6.3.1.3 Mapping of BCCH data */
+	switch (si_type) {
+	case GSM48_MT_RR_SYSINFO_3:
+		handle_si3(ms,
+			(struct gsm48_system_information_type_3 *) data);
+		break;
+
+	default:
+		/* We don't care about other types of SI */
+		break; /* thus there is nothing to do */
+	};
+}
+
+
+/**
+ * This method used to send a l1ctl_tx_dm_est_req_h0 or
+ * a l1ctl_tx_dm_est_req_h1 to the layer1 to follow this
+ * assignment. The code has been removed.
+ */
+static int gsm48_rx_imm_ass(struct msgb *msg, struct osmocom_ms *ms)
+{
+	struct gsm48_imm_ass *ia = msgb_l3(msg);
+	uint8_t ch_type, ch_subch, ch_ts;
+
+	/* Discard packet TBF assignement */
+	if (ia->page_mode & 0xf0)
+		return 0;
+
+	rsl_dec_chan_nr(ia->chan_desc.chan_nr, &ch_type, &ch_subch, &ch_ts);
+
+	if (!ia->chan_desc.h0.h) {
+		/* Non-hopping */
+		uint16_t arfcn;
+
+		arfcn = ia->chan_desc.h0.arfcn_low | (ia->chan_desc.h0.arfcn_high << 8);
+
+		LOGP(DRR, LOGL_NOTICE, "GSM48 IMM ASS (ra=0x%02x, chan_nr=0x%02x, "
+			"ARFCN=%u, TS=%u, SS=%u, TSC=%u)\n", ia->req_ref.ra,
+			ia->chan_desc.chan_nr, arfcn, ch_ts, ch_subch,
+			ia->chan_desc.h0.tsc);
+
+	} else {
+		/* Hopping */
+		uint8_t maio, hsn;
+
+		hsn = ia->chan_desc.h1.hsn;
+		maio = ia->chan_desc.h1.maio_low | (ia->chan_desc.h1.maio_high << 2);
+
+		LOGP(DRR, LOGL_NOTICE, "GSM48 IMM ASS (ra=0x%02x, chan_nr=0x%02x, "
+			"HSN=%u, MAIO=%u, TS=%u, SS=%u, TSC=%u)\n", ia->req_ref.ra,
+			ia->chan_desc.chan_nr, hsn, maio, ch_ts, ch_subch,
+			ia->chan_desc.h1.tsc);
+	}
+
+	return 0;
+}
+
+static const char *pag_print_mode(int mode)
+{
+	switch (mode) {
+	case 0:
+		return "Normal paging";
+	case 1:
+		return "Extended paging";
+	case 2:
+		return "Paging reorganization";
+	case 3:
+		return "Same as before";
+	default:
+		return "invalid";
+	}
+}
+
+static char *chan_need(int need)
+{
+	switch (need) {
+	case 0:
+		return "any";
+	case 1:
+		return "sdch";
+	case 2:
+		return "tch/f";
+	case 3:
+		return "tch/h";
+	default:
+		return "invalid";
+	}
+}
+
+static char *mi_type_to_string(int type)
+{
+	switch (type) {
+	case GSM_MI_TYPE_NONE:
+		return "none";
+	case GSM_MI_TYPE_IMSI:
+		return "imsi";
+	case GSM_MI_TYPE_IMEI:
+		return "imei";
+	case GSM_MI_TYPE_IMEISV:
+		return "imeisv";
+	case GSM_MI_TYPE_TMSI:
+		return "tmsi";
+	default:
+		return "invalid";
+	}
+}
+
+/**
+ * This can contain two MIs. The size checking is a bit of a mess.
+ */
+static int gsm48_rx_paging_p1(struct msgb *msg, struct osmocom_ms *ms)
+{
+	struct gsm48_paging1 *pag;
+	int len1, len2, mi_type, tag;
+	char mi_string[GSM48_MI_SIZE];
+
+	/* is there enough room for the header + LV? */
+	if (msgb_l3len(msg) < sizeof(*pag) + 2) {
+		LOGP(DRR, LOGL_ERROR, "PagingRequest is too short.\n");
+		return -1;
+	}
+
+	pag = msgb_l3(msg);
+	len1 = pag->data[0];
+	mi_type = pag->data[1] & GSM_MI_TYPE_MASK;
+
+	if (msgb_l3len(msg) < sizeof(*pag) + 2 + len1) {
+		LOGP(DRR, LOGL_ERROR, "PagingRequest with wrong MI\n");
+		return -1;
+	}
+
+	if (mi_type != GSM_MI_TYPE_NONE) {
+		gsm48_mi_to_string(mi_string, sizeof(mi_string), &pag->data[1], len1);
+		LOGP(DRR, LOGL_NOTICE, "Paging1: %s chan %s to %s M(%s) \n",
+		     pag_print_mode(pag->pag_mode),
+		     chan_need(pag->cneed1),
+		     mi_type_to_string(mi_type),
+		     mi_string);
+	}
+
+	/* check if we have a MI type in here */
+	if (msgb_l3len(msg) < sizeof(*pag) + 2 + len1 + 3)
+		return 0;
+
+	tag = pag->data[2 + len1 + 0];
+	len2 = pag->data[2 + len1 + 1];
+	mi_type = pag->data[2 + len1 + 2] & GSM_MI_TYPE_MASK;
+	if (tag == GSM48_IE_MOBILE_ID && mi_type != GSM_MI_TYPE_NONE) {
+		if (msgb_l3len(msg) < sizeof(*pag) + 2 + len1 + 3 + len2) {
+			LOGP(DRR, LOGL_ERROR, "Optional MI does not fit here.\n");
+			return -1;
+		}
+
+		gsm48_mi_to_string(mi_string, sizeof(mi_string), &pag->data[2 + len1 + 2], len2);
+		LOGP(DRR, LOGL_NOTICE, "Paging2: %s chan %s to %s M(%s) \n",
+		     pag_print_mode(pag->pag_mode),
+		     chan_need(pag->cneed2),
+		     mi_type_to_string(mi_type),
+		     mi_string);
+	}
+	return 0;
+}
+
+static int gsm48_rx_paging_p2(struct msgb *msg, struct osmocom_ms *ms)
+{
+	struct gsm48_paging2 *pag;
+	int tag, len, mi_type;
+	char mi_string[GSM48_MI_SIZE];
+
+	if (msgb_l3len(msg) < sizeof(*pag)) {
+		LOGP(DRR, LOGL_ERROR, "Paging2 message is too small.\n");
+		return -1;
+	}
+
+	pag = msgb_l3(msg);
+	LOGP(DRR, LOGL_NOTICE, "Paging1: %s chan %s to TMSI M(0x%x) \n",
+		     pag_print_mode(pag->pag_mode),
+		     chan_need(pag->cneed1), pag->tmsi1);
+	LOGP(DRR, LOGL_NOTICE, "Paging2: %s chan %s to TMSI M(0x%x) \n",
+		     pag_print_mode(pag->pag_mode),
+		     chan_need(pag->cneed2), pag->tmsi2);
+
+	/* no optional element */
+	if (msgb_l3len(msg) < sizeof(*pag) + 3)
+		return 0;
+
+	tag = pag->data[0];
+	len = pag->data[1];
+	mi_type = pag->data[2] & GSM_MI_TYPE_MASK;
+
+	if (tag != GSM48_IE_MOBILE_ID)
+		return 0;
+
+	if (msgb_l3len(msg) < sizeof(*pag) + 3 + len) {
+		LOGP(DRR, LOGL_ERROR, "Optional MI does not fit in here\n");
+		return -1;
+	}
+
+	gsm48_mi_to_string(mi_string, sizeof(mi_string), &pag->data[2], len);
+	LOGP(DRR, LOGL_NOTICE, "Paging3: %s chan %s to %s M(%s) \n",
+	     pag_print_mode(pag->pag_mode),
+	     "n/a ",
+	     mi_type_to_string(mi_type),
+	     mi_string);
+
+	return 0;
+}
+
+static int gsm48_rx_paging_p3(struct msgb *msg, struct osmocom_ms *ms)
+{
+	struct gsm48_paging3 *pag;
+
+	if (msgb_l3len(msg) < sizeof(*pag)) {
+		LOGP(DRR, LOGL_ERROR, "Paging3 message is too small.\n");
+		return -1;
+	}
+
+	pag = msgb_l3(msg);
+	LOGP(DRR, LOGL_NOTICE, "Paging1: %s chan %s to TMSI M(0x%x) \n",
+		     pag_print_mode(pag->pag_mode),
+		     chan_need(pag->cneed1), pag->tmsi1);
+	LOGP(DRR, LOGL_NOTICE, "Paging2: %s chan %s to TMSI M(0x%x) \n",
+		     pag_print_mode(pag->pag_mode),
+		     chan_need(pag->cneed2), pag->tmsi2);
+	LOGP(DRR, LOGL_NOTICE, "Paging3: %s chan %s to TMSI M(0x%x) \n",
+		     pag_print_mode(pag->pag_mode),
+		     "n/a ", pag->tmsi3);
+	LOGP(DRR, LOGL_NOTICE, "Paging4: %s chan %s to TMSI M(0x%x) \n",
+		     pag_print_mode(pag->pag_mode),
+		     "n/a ", pag->tmsi4);
+
+	return 0;
+}
+
+/* Dummy Paging Request 1 with "no identity" */
+static const uint8_t paging_fill[] = {
+	0x15, 0x06, 0x21, 0x00, 0x01, 0xf0, 0x2b,
+	/* The rest part may be randomized */
+};
+
+/* LAPDm func=UI fill frame (for the BTS side) */
+static const uint8_t lapdm_fill[] = {
+	0x03, 0x03, 0x01, 0x2b,
+	/* The rest part may be randomized */
+};
+
+/* TODO: share / generalize this code */
+static bool is_fill_frame(struct msgb *msg)
+{
+	size_t l2_len = msgb_l3len(msg);
+	uint8_t *l2 = msgb_l3(msg);
+
+	OSMO_ASSERT(l2_len == GSM_MACBLOCK_LEN);
+
+	if (!memcmp(l2, paging_fill, sizeof(paging_fill)))
+		return true;
+	if (!memcmp(l2, lapdm_fill, sizeof(lapdm_fill)))
+		return true;
+
+	return false;
+}
+
+int gsm48_rx_ccch(struct msgb *msg, struct osmocom_ms *ms)
+{
+	struct gsm48_system_information_type_header *sih = msgb_l3(msg);
+	int rc = 0;
+
+	/* Skip dummy (fill) frames */
+	if (is_fill_frame(msg))
+		return 0;
+
+	if (sih->rr_protocol_discriminator != GSM48_PDISC_RR)
+		LOGP(DRR, LOGL_ERROR, "PCH pdisc (%s) != RR\n",
+			gsm48_pdisc_name(sih->rr_protocol_discriminator));
+
+	switch (sih->system_information) {
+	case GSM48_MT_RR_PAG_REQ_1:
+		gsm48_rx_paging_p1(msg, ms);
+		break;
+	case GSM48_MT_RR_PAG_REQ_2:
+		gsm48_rx_paging_p2(msg, ms);
+		break;
+	case GSM48_MT_RR_PAG_REQ_3:
+		gsm48_rx_paging_p3(msg, ms);
+		break;
+	case GSM48_MT_RR_IMM_ASS:
+		gsm48_rx_imm_ass(msg, ms);
+		break;
+	case GSM48_MT_RR_NOTIF_NCH:
+		/* notification for voice call groups and such */
+		break;
+	case 0x07:
+		/* wireshark know that this is SI2 quater and for 3G interop */
+		break;
+	default:
+		LOGP(DRR, LOGL_NOTICE, "Unknown PCH/AGCH message "
+			"(type 0x%02x): %s\n", sih->system_information,
+			msgb_hexdump_l3(msg));
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int gsm48_rx_bcch(struct msgb *msg, struct osmocom_ms *ms)
+{
+	/* FIXME: we have lost the gsm frame time until here, need to store it
+	 * in some msgb context */
+	//dump_bcch(dl->time.tc, ccch->data);
+	dump_bcch(ms, 0, msg->l3h);
+
+	return 0;
+}
+
+void layer3_app_reset(void)
+{
+	/* Reset state */
+	app_state.ccch_mode = CCCH_MODE_NONE;
+}
+
+static int signal_cb(unsigned int subsys, unsigned int signal,
+		     void *handler_data, void *signal_data)
+{
+	struct osmocom_ms *ms;
+
+	if (subsys != SS_L1CTL)
+		return 0;
+
+	switch (signal) {
+	case S_L1CTL_RESET:
+		ms = signal_data;
+		layer3_app_reset();
+		return l1ctl_tx_fbsb_req(ms, ms->test_arfcn,
+		                         L1CTL_FBSB_F_FB01SB, 100, 0,
+		                         CCCH_MODE_NONE, dbm2rxlev(-85));
+		break;
+	}
+	return 0;
+}
+
+
+int l23_app_init(struct osmocom_ms *ms)
+{
+	osmo_signal_register_handler(SS_L1CTL, &signal_cb, NULL);
+	l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
+	return layer3_init(ms);
+}
+
+static struct l23_app_info info = {
+	.copyright	= "Copyright (C) 2010 Harald Welte <laforge@gnumonks.org>\n",
+	.contribution	= "Contributions by Holger Hans Peter Freyther\n",
+};
+
+struct l23_app_info *l23_app_info()
+{
+	return &info;
+}
diff --git a/src/host/layer23/src/misc/app_cell_log.c b/src/host/layer23/src/misc/app_cell_log.c
new file mode 100644
index 00000000..5b7f7b40
--- /dev/null
+++ b/src/host/layer23/src/misc/app_cell_log.c
@@ -0,0 +1,247 @@
+/* "Application" code of the layer2/3 stack */
+
+/* (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <signal.h>
+#include <stdlib.h>
+#include <time.h>
+#include <getopt.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/l23_app.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/gps.h>
+#include <osmocom/bb/misc/cell_log.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+
+#include <l1ctl_proto.h>
+
+extern struct log_target *stderr_target;
+extern void *l23_ctx;
+
+extern uint16_t basic_band_range[][2];
+extern uint16_t (*band_range)[][2];
+
+char *logname = "/dev/null";
+int RACH_MAX = 2;
+
+int _scan_work(struct osmocom_ms *ms)
+{
+	return 0;
+}
+
+int _scan_exit(struct osmocom_ms *ms)
+{
+	/* in case there is a lockup during exit */
+	signal(SIGINT, SIG_DFL);
+	signal(SIGHUP, SIG_DFL);
+	signal(SIGTERM, SIG_DFL);
+	signal(SIGPIPE, SIG_DFL);
+
+	scan_exit();
+
+	return 0;
+}
+
+int l23_app_init(struct osmocom_ms *ms)
+{
+	int rc;
+
+	srand(time(NULL));
+
+//	log_parse_category_mask(stderr_target, "DL1C:DRSL:DRR:DGPS:DSUM");
+	log_parse_category_mask(stderr_target, "DSUM");
+	log_set_log_level(stderr_target, LOGL_INFO);
+
+	l23_app_work = _scan_work;
+	l23_app_exit = _scan_exit;
+
+	rc = scan_init(ms);
+	if (rc)
+		return rc;
+
+	l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
+	printf("Mobile initialized, please start phone now!\n");
+	return 0;
+}
+
+static int l23_cfg_supported()
+{
+	return L23_OPT_TAP | L23_OPT_DBG;
+}
+
+static int l23_getopt_options(struct option **options)
+{
+	static struct option opts [] = {
+		{"logfile", 1, 0, 'l'},
+		{"rach", 1, 0, 'r'},
+		{"no-rach", 1, 0, 'n'},
+#ifdef _HAVE_GPSD
+		{"gpsd-host", 1, 0, 'g'},
+		{"gpsd-port", 1, 0, 'p'},
+#endif
+		{"gps", 1, 0, 'g'},
+		{"baud", 1, 0, 'b'},
+		{"arfcns", 1, 0, 'A'}
+	};
+
+	*options = opts;
+	return ARRAY_SIZE(opts);
+}
+
+static char* print_band_range(uint16_t range[][2], char* buf, size_t buf_len)
+{
+	int i = 0;
+	int idx = 0;
+	while (idx < buf_len && (range[i][0] != 0 || range[i][1] != 0)) {
+		idx += snprintf(&buf[idx], buf_len - idx, "%u-%u,", range[i][0], range[i][1]);
+		i++;
+	}
+	buf[idx-1] = '\0';
+	return buf;
+}
+
+static void parse_band_range(char* s)
+{
+	unsigned i = 0;
+	char* idx = strtok(s, ",");
+	unsigned single_range_size = sizeof(uint16_t) * 2;
+	unsigned start;
+	unsigned end;
+
+	band_range = (uint16_t(*)[][2])calloc(single_range_size, i + 1);
+	while (idx != NULL) {
+		start = 0;
+		end = 0;
+		sscanf(idx, "%u-%u", &start, &end);
+		if (end == 0)
+			end = start;
+		if (end < start) {
+			fprintf(stderr, "Starting frequency must me lower than ending.\n\n");
+			exit(1);
+		}
+		(*band_range)[i][0] = start;
+		(*band_range)[i][1] = end;
+		idx = strtok(NULL, ",");
+		i++;
+		band_range = realloc(band_range, (i+1) * single_range_size);
+	}
+	(*band_range)[i][0] = 0;
+	(*band_range)[i][1] = 0;
+}
+
+static int l23_cfg_print_help()
+{
+	printf("\nApplication specific\n");
+	printf("  -l --logfile LOGFILE	Logfile for the cell log.\n");
+	printf("  -r --rach RACH	Nr. of RACH bursts to send.\n");
+	printf("  -n --no-rach		Send no rach bursts.\n");
+	printf("  -g --gpsd-host HOST	127.0.0.1. gpsd host.\n");
+	printf("  -p --port PORT	2947. gpsd port\n");
+	printf("  -f --gps DEVICE	/dev/ttyACM0. GPS serial device.\n");
+	printf("  -b --baud BAUDRAT	The baud rate of the GPS device\n");
+	printf("  -A --arfcns ARFCNS    The list of arfcns to be monitored\n");
+
+	return 0;
+}
+
+static int l23_cfg_handle(int c, const char *optarg)
+{
+	char buf[1000];
+
+	switch (c) {
+	case 'l':
+		logname = talloc_strdup(l23_ctx, optarg);
+		break;
+	case 'r':
+		RACH_MAX = atoi(optarg);
+		break;
+	case 'n':
+		RACH_MAX = 0;
+		break;
+	case 'g':
+#ifdef _HAVE_GPSD
+		snprintf(g.gpsd_host, ARRAY_SIZE(g.gpsd_host), "%s", optarg);
+		/* force string terminator */
+		g.gpsd_host[ARRAY_SIZE(g.gpsd_host) - 1] = '\0';
+		if (g.gps_type != GPS_TYPE_UNDEF)
+			goto cmd_line_error;
+		g.gps_type = GPS_TYPE_GPSD;
+		LOGP(DGPS, LOGL_INFO, "Using gpsd host %s\n", g.gpsd_host);
+#else
+		printf("Gpsd support not compiled.\n");
+		exit(1);
+#endif
+		break;
+	case 'p':
+#ifdef _HAVE_GPSD
+		snprintf(g.gpsd_port, ARRAY_SIZE(g.gpsd_port), "%s", optarg);
+		/* force string terminator */
+		g.gpsd_port[ARRAY_SIZE(g.gpsd_port) - 1] = '\0';
+		g.gps_type = GPS_TYPE_GPSD;
+		LOGP(DGPS, LOGL_INFO, "Using gpsd port %s\n", g.gpsd_port);
+#else
+		printf("Gpsd support not compiled.\n");
+		exit(1);
+#endif
+		break;
+	case 'f':
+		snprintf(g.device, ARRAY_SIZE(g.device), "%s", optarg);
+		/* force string terminator */
+		g.device[ARRAY_SIZE(g.device) - 1] = '\0';
+		if (g.gps_type != GPS_TYPE_UNDEF)
+			goto cmd_line_error;
+		g.gps_type = GPS_TYPE_SERIAL;
+		LOGP(DGPS, LOGL_INFO, "Using GPS serial device %s\n", g.device);
+		break;
+	case 'b':
+		g.baud = atoi(optarg);
+		g.gps_type = GPS_TYPE_SERIAL;
+		LOGP(DGPS, LOGL_INFO, "Setting GPS baudrate to %u\n", g.baud);
+		break;
+	case 'A':
+		parse_band_range((char*)optarg);
+		printf("New frequencies range: %s\n", print_band_range(*band_range, buf, sizeof(buf)));
+		break;
+	}
+	return 0;
+
+cmd_line_error:
+	printf("\nYou can't specify both gpsd and serial gps!!\n\n");
+	exit(1);
+}
+
+static struct l23_app_info info = {
+	.copyright	= "Copyright (C) 2010 Andreas Eversberg\n",
+	.getopt_string	= "g:p:l:r:nf:b:A:",
+	.cfg_supported	= l23_cfg_supported,
+	.cfg_getopt_opt = l23_getopt_options,
+	.cfg_handle_opt	= l23_cfg_handle,
+	.cfg_print_help	= l23_cfg_print_help,
+};
+
+struct l23_app_info *l23_app_info()
+{
+	return &info;
+}
diff --git a/src/host/layer23/src/misc/app_echo_test.c b/src/host/layer23/src/misc/app_echo_test.c
new file mode 100644
index 00000000..3a0ee0f4
--- /dev/null
+++ b/src/host/layer23/src/misc/app_echo_test.c
@@ -0,0 +1,65 @@
+/* TEST code, regularly transmit ECHO REQ packet to L1 */
+
+/* (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/l23_app.h>
+#include <osmocom/bb/misc/layer3.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+
+
+static struct {
+	struct osmo_timer_list timer;
+} test_data;
+
+static void test_tmr_cb(void *data)
+{
+	struct osmocom_ms *ms = data;
+
+	l1ctl_tx_echo_req(ms, 62);
+	osmo_timer_schedule(&test_data.timer, 1, 0);
+}
+
+int l23_app_init(struct osmocom_ms *ms)
+{
+	test_data.timer.cb = &test_tmr_cb;
+	test_data.timer.data = ms;
+
+	osmo_timer_schedule(&test_data.timer, 1, 0);
+
+	return 0;
+}
+
+static struct l23_app_info info = {
+	.copyright	= "Copyright (C) 2010 Harald Welte <laforge@gnumonks.org>\n",
+	.contribution	= "Contributions by Holger Hans Peter Freyther\n",
+};
+
+struct l23_app_info *l23_app_info()
+{
+	return &info;
+}
diff --git a/src/host/layer23/src/misc/bcch_scan.c b/src/host/layer23/src/misc/bcch_scan.c
new file mode 100644
index 00000000..3ba3a1cd
--- /dev/null
+++ b/src/host/layer23/src/misc/bcch_scan.c
@@ -0,0 +1,318 @@
+/* BCCH Scanning code for OsmocomBB */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+
+#include <l1ctl_proto.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+#include <osmocom/gsm/rsl.h>
+
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/logging.h>
+
+/* somewhere in 05.08 */
+#define MAX_CELLS_IN_BA	32
+
+/* Information about a single cell / BCCH */
+struct cell_info {
+	struct llist_head list;
+
+	uint16_t band_arfcn;
+	uint8_t bsic;
+	uint8_t rxlev;
+
+	struct {
+		uint16_t mcc;	/* Mobile Country Code */
+		uint16_t mnc;	/* Mobile Network Code */
+		uint16_t lac;	/* Location Area Code */
+		uint16_t rac;	/* Routing Area Code */
+		uint16_t cid;	/* Cell ID */
+	} id;
+	uint16_t ba_arfcn[MAX_CELLS_IN_BA];
+	uint8_t ba_arfcn_num;
+
+	struct {
+		int32_t fn_delta;	/* delta to current L1 fn */
+		int16_t qbit_delta;
+		int16_t afc_delta;
+	} l1_sync;
+};
+
+#define AFS_F_PM_DONE	0x01
+#define AFS_F_TESTED	0x02
+#define AFS_F_BCCH	0x04
+struct arfcn_state {
+	uint8_t rxlev;
+	uint8_t flags;
+};
+
+enum bscan_state {
+	BSCAN_S_NONE,
+	BSCAN_S_WAIT_DATA,
+	BSCAN_S_DONE,
+};
+
+enum fps_state {
+	FPS_S_NONE,
+	FPS_S_PM_GSM900,
+	FPS_S_PM_EGSM900,
+	FPS_S_PM_GSM1800,
+	FPS_S_BINFO,
+};
+
+struct full_power_scan {
+	/* Full Power Scan */
+	enum fps_state fps_state;
+	struct arfcn_state arfcn_state[1024];
+
+	struct osmocom_ms *ms;
+
+	/* BCCH info part */
+	enum bscan_state state;
+	struct llist_head cell_list;
+	struct cell_info *cur_cell;
+	uint16_t cur_arfcn;
+	struct osmo_timer_list timer;
+};
+
+static struct full_power_scan fps;
+
+static int get_next_arfcn(struct full_power_scan *fps)
+{
+	unsigned int i;
+	uint8_t best_rxlev = 0;
+	int best_arfcn = -1;
+
+	for (i = 0; i < ARRAY_SIZE(fps->arfcn_state); i++) {
+		struct arfcn_state *af = &fps->arfcn_state[i];
+		/* skip ARFCN's where we don't have a PM */
+		if (!(af->flags & AFS_F_PM_DONE))
+			continue;
+		/* skip ARFCN's that we already tested */
+		if (af->flags & AFS_F_TESTED)
+			continue;
+		/* if current arfcn_state is better than best so far,
+		 * select it */
+		if (af->rxlev > best_rxlev) {
+			best_rxlev = af->rxlev;
+			best_arfcn = i;
+		}
+	}
+	printf("arfcn=%d rxlev=%u\n", best_arfcn, best_rxlev);
+	return best_arfcn;
+}
+
+static struct cell_info *cell_info_alloc(void)
+{
+	struct cell_info *ci = talloc_zero(NULL, struct cell_info);
+	return ci;
+}
+
+static void cell_info_free(struct cell_info *ci)
+{
+	talloc_free(ci);
+}
+
+/* start to scan for one ARFCN */
+static int _cinfo_start_arfcn(unsigned int band_arfcn)
+{
+	int rc;
+
+	/* ask L1 to try to tune to new ARFCN */
+	/* FIXME: decode band */
+	rc = l1ctl_tx_fbsb_req(fps.ms, band_arfcn,
+	                       L1CTL_FBSB_F_FB01SB, 100, 0, CCCH_MODE_COMBINED,
+			       fps.arfcn_state[band_arfcn].rxlev);
+	if (rc < 0)
+		return rc;
+
+	/* allocate new cell info structure */
+	fps.cur_cell = cell_info_alloc();
+	fps.cur_arfcn = band_arfcn;
+	fps.cur_cell->band_arfcn = band_arfcn;
+	/* FIXME: start timer in case we never get a sync */
+	fps.state = BSCAN_S_WAIT_DATA;
+	osmo_timer_schedule(&fps.timer, 2, 0);
+
+	return 0;
+}
+
+
+static void cinfo_next_cell(void *data)
+{
+	int rc;
+
+	/* we've been waiting for BCCH info */
+	fps.arfcn_state[fps.cur_arfcn].flags |= AFS_F_TESTED;
+	/* if there is a BCCH, we need to add the collected BCCH
+	 * information to our list */
+
+	if (fps.arfcn_state[fps.cur_arfcn].flags & AFS_F_BCCH)
+		llist_add(&fps.cur_cell->list, &fps.cell_list);
+	else
+		cell_info_free(fps.cur_cell);
+
+	rc = get_next_arfcn(&fps);
+	if (rc < 0) {
+		fps.state = BSCAN_S_DONE;
+		return;
+	}
+	/* start syncing to the next ARFCN */
+	_cinfo_start_arfcn(rc);
+}
+
+static void cinfo_timer_cb(void *data)
+{
+	switch (fps.state) {
+	case BSCAN_S_WAIT_DATA:
+		cinfo_next_cell(data);
+		break;
+	}
+}
+
+/* Update cell_info for current cell with received BCCH info */
+static int rx_bcch_info(const uint8_t *data)
+{
+	struct cell_info *ci = fps.cur_cell;
+	struct gsm48_system_information_type_header *si_hdr;
+	si_hdr = (struct gsm48_system_information_type_header *) data;;
+
+	/* we definitely have a BCCH on this channel */
+	fps.arfcn_state[ci->band_arfcn].flags |= AFS_F_BCCH;
+
+	switch (si_hdr->system_information) {
+	case GSM48_MT_RR_SYSINFO_1:
+		/* FIXME: CA, RACH control */
+		break;
+	case GSM48_MT_RR_SYSINFO_2:
+		/* FIXME: BA, NCC, RACH control */
+		break;
+	case GSM48_MT_RR_SYSINFO_3:
+		/* FIXME: cell_id, LAI */
+		break;
+	case GSM48_MT_RR_SYSINFO_4:
+		/* FIXME: LAI */
+		break;
+	}
+	return 0;
+}
+
+/* Update L1/SCH information (AFC/QBIT/FN offset, BSIC) */
+static int rx_sch_info()
+{
+	/* FIXME */
+}
+
+static int bscan_sig_cb(unsigned int subsys, unsigned int signal,
+		     void *handler_data, void *signal_data)
+{
+	struct cell_info *ci = fps.cur_cell;
+	struct osmocom_ms *ms;
+	struct osmobb_meas_res *mr;
+	uint16_t arfcn;
+	int rc;
+
+	if (subsys != SS_L1CTL)
+		return 0;
+
+	switch (signal) {
+	case S_L1CTL_PM_RES:
+		mr = signal_data;
+		/* check if PM result is for same MS */
+		if (fps.ms != mr->ms)
+			return 0;
+		arfcn = mr->band_arfcn & 0x3ff;
+		/* update RxLev and notice that PM was done */
+		fps.arfcn_state[arfcn].rxlev = mr->rx_lev;
+		fps.arfcn_state[arfcn].flags |= AFS_F_PM_DONE;
+		break;
+	case S_L1CTL_PM_DONE:
+		ms = signal_data;
+		switch (fps.fps_state) {
+		case FPS_S_PM_GSM900:
+			fps.fps_state = FPS_S_PM_EGSM900;
+			return l1ctl_tx_pm_req_range(ms, 955, 1023);
+		case FPS_S_PM_EGSM900:
+			fps.fps_state = FPS_S_PM_GSM1800;
+			return l1ctl_tx_pm_req_range(ms, 512, 885);
+		case FPS_S_PM_GSM1800:
+			/* power measurement has finished, we can start
+			 * to actually iterate over the ARFCN's and try
+			 * to sync to BCCHs */
+			fps.fps_state = FPS_S_BINFO;
+			rc = get_next_arfcn(&fps);
+			if (rc < 0) {
+				fps.state = BSCAN_S_DONE;
+				return 0;
+			}
+			_cinfo_start_arfcn(rc);
+			break;
+		}
+		break;
+	case S_L1CTL_FBSB_RESP:
+		/* We actually got a FCCH/SCH burst */
+#if 0
+		fps.arfcn_state[ci->band_arfcn].flags |= AFS_F_BCCH;
+		/* fallthrough */
+#else
+		break;
+#endif
+	case S_L1CTL_FBSB_ERR:
+		/* We timed out, move on */
+		if (fps.state == BSCAN_S_WAIT_DATA)
+			cinfo_next_cell(NULL);
+		break;
+	}
+	return 0;
+}
+
+/* start the full power scan */
+int fps_start(struct osmocom_ms *ms)
+{
+	memset(&fps, 0, sizeof(fps));
+	fps.ms = ms;
+
+	fps.timer.cb = cinfo_timer_cb;
+	fps.timer.data = &fps;
+
+	/* Start by scanning the good old GSM900 band */
+	fps.fps_state = FPS_S_PM_GSM900;
+	return l1ctl_tx_pm_req_range(ms, 0, 124);
+}
+
+int fps_init(void)
+{
+	return osmo_signal_register_handler(SS_L1CTL, &bscan_sig_cb, NULL);
+}
diff --git a/src/host/layer23/src/misc/cell_log.c b/src/host/layer23/src/misc/cell_log.c
new file mode 100644
index 00000000..7340dcb9
--- /dev/null
+++ b/src/host/layer23/src/misc/cell_log.c
@@ -0,0 +1,820 @@
+/* Cell Scanning code for OsmocomBB */
+
+/* (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdlib.h>
+#include <time.h>
+#include <errno.h>
+
+#include <l1ctl_proto.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/rsl.h>
+
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/networks.h>
+#include <osmocom/bb/common/gps.h>
+#include <osmocom/bb/misc/cell_log.h>
+#include "../../../gsmmap/geo.h"
+
+#define READ_WAIT	2, 0
+#define RACH_WAIT	0, 900000
+#define MIN_RXLEV_DBM	-106
+#define MAX_DIST	2000
+
+enum {
+	SCAN_STATE_PM,
+	SCAN_STATE_SYNC,
+	SCAN_STATE_READ,
+	SCAN_STATE_RACH,
+};
+
+/* ranges of bands */
+static uint16_t basic_band_range[][2] = {{0, 124}, {512, 885}, {955, 1023}, {0, 0}};
+uint16_t (*band_range)[][2] = &basic_band_range;
+
+#define INFO_FLG_PM	1
+#define INFO_FLG_SYNC	2
+#define INFO_FLG_SI1	4
+#define INFO_FLG_SI2	8
+#define INFO_FLG_SI2bis	16
+#define INFO_FLG_SI2ter	32
+#define INFO_FLG_SI3	64
+#define INFO_FLG_SI4	128
+
+static struct osmocom_ms *ms;
+static struct osmo_timer_list timer;
+
+static struct pm_info {
+	uint16_t flags;
+	int8_t rxlev_dbm;
+} pm[1024];
+
+static int started = 0;
+static int state;
+static int8_t min_rxlev_dbm = MIN_RXLEV_DBM;
+static int sync_count;
+static int pm_index, pm_gps_valid;
+static double pm_gps_x, pm_gps_y, pm_gps_z;
+static int arfcn;
+static int rach_count;
+static FILE *logfp = NULL;
+extern char *logname;
+extern int RACH_MAX;
+
+
+static struct gsm48_sysinfo sysinfo;
+
+static struct log_si {
+	uint16_t flags;
+	uint8_t bsic;
+	int8_t rxlev_dbm;
+	uint16_t mcc, mnc, lac, cellid;
+	uint8_t ta;
+	double latitude, longitude;
+} log_si;
+
+struct rach_ref {
+	uint8_t valid;
+	uint8_t cr;
+	uint8_t t1, t2, t3;
+} rach_ref;
+
+#define LOGFILE(fmt, args...) \
+	fprintf(logfp, fmt, ## args);
+#define LOGFLUSH() \
+	fflush(logfp);
+
+static void start_sync(void);
+static void start_rach(void);
+static void start_pm(void);
+
+static void log_gps(void)
+{
+	if (!g.enable || !g.valid)
+		return;
+	LOGFILE("position %.8f %.8f\n", g.longitude, g.latitude);
+}
+
+static void log_time(void)
+{
+	time_t now;
+
+	if (g.enable && g.valid)
+		now = g.gmt;
+	else
+		time(&now);
+	LOGFILE("time %lu\n", now);
+}
+
+static void log_frame(char *tag, uint8_t *data)
+{
+	int i;
+
+	LOGFILE("%s", tag);
+	for (i = 0; i < 23; i++)
+		LOGFILE(" %02x", *data++);
+	LOGFILE("\n");
+}
+
+static void log_pm(void)
+{
+	int count = 0, i;
+
+	LOGFILE("[power]\n");
+	log_time();
+	log_gps();
+	for (i = 0; i <= 1023; i++) {
+		if ((pm[i].flags & INFO_FLG_PM)) {
+			if (!count)
+				LOGFILE("arfcn %d", i);
+			LOGFILE(" %d", pm[i].rxlev_dbm);
+			count++;
+			if (count == 12) {
+				LOGFILE("\n");
+				count = 0;
+			}
+		} else {
+			if (count) {
+				LOGFILE("\n");
+				count = 0;
+			}
+		}
+	}
+	if (count)
+		LOGFILE("\n");
+
+	LOGFILE("\n");
+	LOGFLUSH();
+}
+
+static void log_sysinfo(void)
+{
+	struct rx_meas_stat *meas = &ms->meas;
+	struct gsm48_sysinfo *s = &sysinfo;
+	int8_t rxlev_dbm;
+	char ta_str[32] = "";
+
+	if (log_si.ta != 0xff)
+		sprintf(ta_str, " TA=%d", log_si.ta);
+
+	LOGP(DSUM, LOGL_INFO, "Cell: ARFCN=%d MCC=%s MNC=%s (%s, %s)%s\n",
+		arfcn, gsm_print_mcc(s->mcc), gsm_print_mnc(s->mnc),
+		gsm_get_mcc(s->mcc), gsm_get_mnc(s->mcc, s->mnc), ta_str);
+
+	LOGFILE("[sysinfo]\n");
+	LOGFILE("arfcn %d\n", s->arfcn);
+	log_time();
+	log_gps();
+	LOGFILE("bsic %d,%d\n", s->bsic >> 3, s->bsic & 7);
+	rxlev_dbm = meas->rxlev / meas->frames - 110;
+	LOGFILE("rxlev %d\n", rxlev_dbm);
+	if (s->si1)
+		log_frame("si1", s->si1_msg);
+	if (s->si2)
+		log_frame("si2", s->si2_msg);
+	if (s->si2bis)
+		log_frame("si2bis", s->si2b_msg);
+	if (s->si2ter)
+		log_frame("si2ter", s->si2t_msg);
+	if (s->si3)
+		log_frame("si3", s->si3_msg);
+	if (s->si4)
+		log_frame("si4", s->si4_msg);
+	if (log_si.ta != 0xff)
+		LOGFILE("ta %d\n", log_si.ta);
+
+	LOGFILE("\n");
+	LOGFLUSH();
+}
+
+static void timeout_cb(void *arg)
+{
+	switch (state) {
+	case SCAN_STATE_READ:
+		LOGP(DRR, LOGL_INFO, "Timeout reading BCCH\n");
+		start_sync();
+		break;
+	case SCAN_STATE_RACH:
+		LOGP(DRR, LOGL_INFO, "Timeout on RACH\n");
+		rach_count++;
+		start_rach();
+		break;
+	}
+}
+
+static void stop_timer(void)
+{
+	if (osmo_timer_pending(&timer))
+		osmo_timer_del(&timer);
+}
+
+static void start_timer(int sec, int micro)
+{
+	stop_timer();
+	timer.cb = timeout_cb;
+	timer.data = ms;
+	osmo_timer_schedule(&timer, sec, micro);
+}
+
+static void start_rach(void)
+{
+	struct gsm48_sysinfo *s = &sysinfo;
+	uint8_t chan_req_val, chan_req_mask;
+	struct msgb *nmsg;
+	struct abis_rsl_cchan_hdr *ncch;
+
+	if (rach_count == RACH_MAX) {
+		log_sysinfo();
+		start_sync();
+		return;
+	}
+
+	state = SCAN_STATE_RACH;
+
+	if (s->neci) {
+		chan_req_mask = 0x0f;
+		chan_req_val = 0x01;
+		LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x "
+			"(OTHER with NECI)\n", chan_req_val);
+	} else {
+		chan_req_mask = 0x1f;
+		chan_req_val = 0xe0;
+		LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (OTHER no NECI)\n",
+			chan_req_val);
+	}
+
+	rach_ref.valid = 0;
+	rach_ref.cr = random();
+	rach_ref.cr &= chan_req_mask;
+	rach_ref.cr |= chan_req_val;
+
+	nmsg = msgb_alloc_headroom(RSL_ALLOC_SIZE+RSL_ALLOC_HEADROOM,
+		RSL_ALLOC_HEADROOM, "GSM 04.06 RSL");
+	if (!nmsg)
+		return;
+	nmsg->l2h = nmsg->data;
+	ncch = (struct abis_rsl_cchan_hdr *) msgb_put(nmsg, sizeof(*ncch)
+							+ 4 + 2 + 2);
+	rsl_init_cchan_hdr(ncch, RSL_MT_CHAN_RQD);
+	ncch->chan_nr = RSL_CHAN_RACH;
+	ncch->data[0] = RSL_IE_REQ_REFERENCE;
+	ncch->data[1] = rach_ref.cr;
+	ncch->data[2] = (s->ccch_conf == 1) << 7;
+	ncch->data[3] = 0;
+	ncch->data[4] = RSL_IE_ACCESS_DELAY;
+	ncch->data[5] = 0; /* no delay */ 
+	ncch->data[6] = RSL_IE_MS_POWER;
+	ncch->data[7] = 0; /* full power */
+
+	start_timer(RACH_WAIT);
+
+	lapdm_rslms_recvmsg(nmsg, &ms->lapdm_channel);
+}
+
+static void start_sync(void)
+{
+	int rxlev_dbm = -128;
+	int i, dist = 0;
+	char dist_str[32] = "";
+
+	arfcn = 0xffff;
+	for (i = 0; i <= 1023; i++) {
+		if ((pm[i].flags & INFO_FLG_PM)
+		 && !(pm[i].flags & INFO_FLG_SYNC)) {
+			if (pm[i].rxlev_dbm > rxlev_dbm) {
+				rxlev_dbm = pm[i].rxlev_dbm;
+				arfcn = i;
+			}
+		}
+	}
+	/* if GPS becomes valid, like after exitting a tunnel */
+	if (!pm_gps_valid && g.valid) {
+		pm_gps_valid = 1;
+		geo2space(&pm_gps_x, &pm_gps_y, &pm_gps_z, g.longitude,
+			g.latitude);
+	}
+	if (pm_gps_valid && g.valid) {
+		double x, y, z;
+
+		geo2space(&x, &y, &z, g.longitude, g.latitude);
+		dist = distinspace(pm_gps_x, pm_gps_y, pm_gps_z, x, y, z);
+		sprintf(dist_str, "  dist %d", (int)dist);
+	}
+	if (dist > MAX_DIST || arfcn == 0xffff || rxlev_dbm < min_rxlev_dbm) {
+		memset(pm, 0, sizeof(pm));
+		pm_index = 0;
+		sync_count = 0;
+		start_pm();
+		return;
+	}
+	pm[arfcn].flags |= INFO_FLG_SYNC;
+	LOGP(DSUM, LOGL_INFO, "Sync ARFCN %d (rxlev %d, %d syncs left)%s\n",
+		arfcn, pm[arfcn].rxlev_dbm, sync_count--, dist_str);
+	memset(&sysinfo, 0, sizeof(sysinfo));
+	sysinfo.arfcn = arfcn;
+	state = SCAN_STATE_SYNC;
+	l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
+	l1ctl_tx_fbsb_req(ms, arfcn, L1CTL_FBSB_F_FB01SB, 100, 0,
+		CCCH_MODE_NONE, dbm2rxlev(pm[arfcn].rxlev_dbm));
+}
+
+static void start_pm(void)
+{
+	uint16_t from, to;
+
+	state = SCAN_STATE_PM;
+	from = (*band_range)[pm_index][0];
+	to = (*band_range)[pm_index][1];
+
+	if (from == 0 && to == 0) {
+		LOGP(DSUM, LOGL_INFO, "Measurement done\n");
+		pm_gps_valid = g.enable && g.valid;
+		if (pm_gps_valid)
+			geo2space(&pm_gps_x, &pm_gps_y, &pm_gps_z,
+				g.longitude, g.latitude);
+		log_pm();
+		start_sync();
+		return;
+	}
+	LOGP(DSUM, LOGL_INFO, "Measure from %d to %d\n", from, to);
+	l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
+	l1ctl_tx_pm_req_range(ms, from, to);
+}
+
+static int signal_cb(unsigned int subsys, unsigned int signal,
+		     void *handler_data, void *signal_data)
+{
+	struct osmobb_meas_res *mr;
+	struct osmobb_fbsb_res *fr;
+	uint16_t index;
+
+	if (subsys != SS_L1CTL)
+		return 0;
+
+	switch (signal) {
+	case S_L1CTL_PM_RES:
+		mr = signal_data;
+		index = mr->band_arfcn & 0x3ff;
+		pm[index].flags |= INFO_FLG_PM;
+		pm[index].rxlev_dbm = mr->rx_lev - 110;
+		if (pm[index].rxlev_dbm >= min_rxlev_dbm)
+			sync_count++;
+//		printf("rxlev %d = %d (sync_count %d)\n", index, pm[index].rxlev_dbm, sync_count);
+		break;
+	case S_L1CTL_PM_DONE:
+		pm_index++;
+		start_pm();
+		break;
+	case S_L1CTL_FBSB_RESP:
+		fr = signal_data;
+		sysinfo.bsic = fr->bsic;
+		state = SCAN_STATE_READ;
+		memset(&ms->meas, 0, sizeof(ms->meas));
+		memset(&log_si, 0, sizeof(log_si));
+		log_si.flags |= INFO_FLG_SYNC;
+		log_si.ta = 0xff; /* invalid */
+		start_timer(READ_WAIT);
+		LOGP(DRR, LOGL_INFO, "Synchronized, start reading\n");
+		break;
+	case S_L1CTL_FBSB_ERR:
+		LOGP(DRR, LOGL_INFO, "Sync failed\n");
+		start_sync();
+		break;
+	case S_L1CTL_RESET:
+		if (started)
+			break;
+		started = 1;
+		memset(pm, 0, sizeof(pm));
+		pm_index = 0;
+		sync_count = 0;
+		start_pm();
+	}
+	return 0;
+}
+
+static int ta_result(uint8_t ta)
+{
+	stop_timer();
+
+	if (ta == 0xff)
+		LOGP(DSUM, LOGL_INFO, "Got assignment reject\n");
+	else {
+		LOGP(DSUM, LOGL_DEBUG, "Got assignment TA = %d\n", ta);
+		log_si.ta = ta;
+	}
+
+	log_sysinfo();
+	start_sync();
+
+	return 0;
+}
+
+/* match request reference agains request */
+static int match_ra(struct osmocom_ms *ms, struct gsm48_req_ref *ref)
+{
+	uint8_t ia_t1, ia_t2, ia_t3;
+
+	/* filter confirmed RACH requests only */
+	if (rach_ref.valid && ref->ra == rach_ref.cr) {
+	 	ia_t1 = ref->t1;
+	 	ia_t2 = ref->t2;
+	 	ia_t3 = (ref->t3_high << 3) | ref->t3_low;
+		if (ia_t1 == rach_ref.t1 && ia_t2 == rach_ref.t2
+			 && ia_t3 == rach_ref.t3) {
+	 		LOGP(DRR, LOGL_INFO, "request %02x matches "
+				"(fn=%d,%d,%d)\n", ref->ra, ia_t1, ia_t2,
+					ia_t3);
+			return 1;
+		} else
+	 		LOGP(DRR, LOGL_INFO, "request %02x matches but not "
+				"frame number (IMM.ASS fn=%d,%d,%d != RACH "
+				"fn=%d,%d,%d)\n", ref->ra, ia_t1, ia_t2, ia_t3,
+				rach_ref.t1, rach_ref.t2, rach_ref.t3);
+	}
+
+	return 0;
+}
+
+/* 9.1.18 IMMEDIATE ASSIGNMENT is received */
+static int imm_ass(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_imm_ass *ia = msgb_l3(msg);
+
+	LOGP(DRR, LOGL_INFO, "IMMEDIATE ASSIGNMENT:\n");
+
+	if (state != SCAN_STATE_RACH) {
+		LOGP(DRR, LOGL_INFO, "Not for us, no request.\n");
+		return 0;
+	}
+
+	/* request ref */
+	if (match_ra(ms, &ia->req_ref)) {
+		return ta_result(ia->timing_advance);
+	}
+	LOGP(DRR, LOGL_INFO, "Request, but not for us.\n");
+
+	return 0;
+}
+
+/* 9.1.19 IMMEDIATE ASSIGNMENT EXTENDED is received */
+static int imm_ass_ext(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_imm_ass_ext *ia = msgb_l3(msg);
+
+	LOGP(DRR, LOGL_INFO, "IMMEDIATE ASSIGNMENT EXTENDED:\n");
+
+	if (state != SCAN_STATE_RACH) {
+		LOGP(DRR, LOGL_INFO, "Not for us, no request.\n");
+		return 0;
+	}
+
+	/* request ref 1 */
+	if (match_ra(ms, &ia->req_ref1)) {
+		return ta_result(ia->timing_advance1);
+	}
+	/* request ref 2 */
+	if (match_ra(ms, &ia->req_ref2)) {
+		return ta_result(ia->timing_advance2);
+	}
+	LOGP(DRR, LOGL_INFO, "Request, but not for us.\n");
+
+	return 0;
+}
+
+/* 9.1.20 IMMEDIATE ASSIGNMENT REJECT is received */
+static int imm_ass_rej(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_imm_ass_rej *ia = msgb_l3(msg);
+	int i;
+	struct gsm48_req_ref *req_ref;
+
+	LOGP(DRR, LOGL_INFO, "IMMEDIATE ASSIGNMENT REJECT:\n");
+
+	if (state != SCAN_STATE_RACH) {
+		LOGP(DRR, LOGL_INFO, "Not for us, no request.\n");
+		return 0;
+	}
+
+	for (i = 0; i < 4; i++) {
+		/* request reference */
+		req_ref = (struct gsm48_req_ref *)
+				(((uint8_t *)&ia->req_ref1) + i * 4);
+		LOGP(DRR, LOGL_INFO, "IMMEDIATE ASSIGNMENT REJECT "
+			"(ref 0x%02x)\n", req_ref->ra);
+		if (match_ra(ms, req_ref)) {
+			return ta_result(0xff);
+		}
+	}
+
+	return 0;
+}
+
+/* receive CCCH at RR layer */
+static int pch_agch(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_header *sih = msgb_l3(msg);
+
+	switch (sih->system_information) {
+	case GSM48_MT_RR_PAG_REQ_1:
+	case GSM48_MT_RR_PAG_REQ_2:
+	case GSM48_MT_RR_PAG_REQ_3:
+		return 0;
+	case GSM48_MT_RR_IMM_ASS:
+		return imm_ass(ms, msg);
+	case GSM48_MT_RR_IMM_ASS_EXT:
+		return imm_ass_ext(ms, msg);
+	case GSM48_MT_RR_IMM_ASS_REJ:
+		return imm_ass_rej(ms, msg);
+	default:
+		return -EINVAL;
+	}
+}
+
+/* check if sysinfo is complete, change to RACH state */
+static int new_sysinfo(void)
+{
+	struct gsm48_sysinfo *s = &sysinfo;
+
+	/* restart timer */
+	start_timer(READ_WAIT);
+
+	/* mandatory */
+	if (!s->si1 || !s->si2 || !s->si3 || !s->si4) {
+		LOGP(DRR, LOGL_INFO, "not all mandatory SI received\n");
+		return 0;
+	}
+
+	/* extended band */
+	if (s->nb_ext_ind_si2 && !s->si2bis) {
+		LOGP(DRR, LOGL_INFO, "extended ba, but si2bis not received\n");
+		return 0;
+	}
+
+	/* 2ter */
+	if (s->si2ter_ind && !s->si2ter) {
+		LOGP(DRR, LOGL_INFO, "si2ter_ind, but si2ter not received\n");
+		return 0;
+	}
+
+	LOGP(DRR, LOGL_INFO, "Sysinfo complete\n");
+
+	stop_timer();
+
+	rach_count = 0;
+	start_rach();
+
+	return 0;
+}
+
+/* receive BCCH at RR layer */
+static int bcch(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_sysinfo *s = &sysinfo;
+	struct gsm48_system_information_type_header *sih = msgb_l3(msg);
+	uint8_t ccch_mode;
+
+	if (msgb_l3len(msg) != 23) {
+		LOGP(DRR, LOGL_NOTICE, "Invalid BCCH message length\n");
+		return -EINVAL;
+	}
+	switch (sih->system_information) {
+	case GSM48_MT_RR_SYSINFO_1:
+		if (!memcmp(sih, s->si1_msg, sizeof(s->si1_msg)))
+			return 0;
+		LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 1\n");
+		gsm48_decode_sysinfo1(s,
+			(struct gsm48_system_information_type_1 *) sih,
+			msgb_l3len(msg));
+		return new_sysinfo();
+	case GSM48_MT_RR_SYSINFO_2:
+		if (!memcmp(sih, s->si2_msg, sizeof(s->si2_msg)))
+			return 0;
+		LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 2\n");
+		gsm48_decode_sysinfo2(s,
+			(struct gsm48_system_information_type_2 *) sih,
+			msgb_l3len(msg));
+		return new_sysinfo();
+	case GSM48_MT_RR_SYSINFO_2bis:
+		if (!memcmp(sih, s->si2b_msg, sizeof(s->si2b_msg)))
+			return 0;
+		LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 2bis\n");
+		gsm48_decode_sysinfo2bis(s,
+			(struct gsm48_system_information_type_2bis *) sih,
+			msgb_l3len(msg));
+		return new_sysinfo();
+	case GSM48_MT_RR_SYSINFO_2ter:
+		if (!memcmp(sih, s->si2t_msg, sizeof(s->si2t_msg)))
+			return 0;
+		LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 2ter\n");
+		gsm48_decode_sysinfo2ter(s,
+			(struct gsm48_system_information_type_2ter *) sih,
+			msgb_l3len(msg));
+		return new_sysinfo();
+	case GSM48_MT_RR_SYSINFO_3:
+		if (!memcmp(sih, s->si3_msg, sizeof(s->si3_msg)))
+			return 0;
+		LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 3\n");
+		gsm48_decode_sysinfo3(s,
+			(struct gsm48_system_information_type_3 *) sih,
+			msgb_l3len(msg));
+		ccch_mode = (s->ccch_conf == 1) ? CCCH_MODE_COMBINED :
+			CCCH_MODE_NON_COMBINED;
+		LOGP(DRR, LOGL_INFO, "Changing CCCH_MODE to %d\n", ccch_mode);
+		l1ctl_tx_ccch_mode_req(ms, ccch_mode);
+		return new_sysinfo();
+	case GSM48_MT_RR_SYSINFO_4:
+		if (!memcmp(sih, s->si4_msg, sizeof(s->si4_msg)))
+			return 0;
+		LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 4\n");
+		gsm48_decode_sysinfo4(s,
+			(struct gsm48_system_information_type_4 *) sih,
+			msgb_l3len(msg));
+		return new_sysinfo();
+	default:
+		return -EINVAL;
+	}
+}
+
+static int unit_data_ind(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	struct tlv_parsed tv;
+	uint8_t ch_type, ch_subch, ch_ts;
+	
+	DEBUGP(DRSL, "RSLms UNIT DATA IND chan_nr=0x%02x link_id=0x%02x\n",
+		rllh->chan_nr, rllh->link_id);
+
+	rsl_tlv_parse(&tv, rllh->data, msgb_l2len(msg)-sizeof(*rllh));
+	if (!TLVP_PRESENT(&tv, RSL_IE_L3_INFO)) {
+		DEBUGP(DRSL, "UNIT_DATA_IND without L3 INFO ?!?\n");
+		return -EIO;
+	}
+	msg->l3h = (uint8_t *) TLVP_VAL(&tv, RSL_IE_L3_INFO);
+
+	if (state != SCAN_STATE_READ && state != SCAN_STATE_RACH) {
+	 	return -EINVAL;
+	}
+
+	rsl_dec_chan_nr(rllh->chan_nr, &ch_type, &ch_subch, &ch_ts);
+	switch (ch_type) {
+	case RSL_CHAN_PCH_AGCH:
+		return pch_agch(ms, msg);
+	case RSL_CHAN_BCCH:
+		return bcch(ms, msg);
+#if 0
+	case RSL_CHAN_Bm_ACCHs:
+	case RSL_CHAN_Lm_ACCHs:
+	case RSL_CHAN_SDCCH4_ACCH:
+	case RSL_CHAN_SDCCH8_ACCH:
+		return rx_acch(ms, msg);
+#endif
+	default:
+		LOGP(DRSL, LOGL_NOTICE, "RSL with chan_nr 0x%02x unknown.\n",
+			rllh->chan_nr);
+		return -EINVAL;
+	}
+}
+
+static int rcv_rll(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	int msg_type = rllh->c.msg_type;
+
+	if (msg_type == RSL_MT_UNIT_DATA_IND) {
+		unit_data_ind(ms, msg);
+	} else
+		LOGP(DRSL, LOGL_NOTICE, "RSLms message unhandled\n");
+
+	msgb_free(msg);
+
+	return 0;
+}
+
+int chan_conf(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct abis_rsl_cchan_hdr *ch = msgb_l2(msg);
+	struct gsm48_req_ref *ref = (struct gsm48_req_ref *) (ch->data + 1);
+
+	if (msgb_l2len(msg) < sizeof(*ch) + sizeof(*ref)) {
+		LOGP(DRR, LOGL_ERROR, "CHAN_CNF too slort\n");
+		return -EINVAL;
+	}
+
+	rach_ref.valid = 1;
+	rach_ref.t1 = ref->t1;
+	rach_ref.t2 = ref->t2;
+	rach_ref.t3 = ref->t3_low | (ref->t3_high << 3);
+
+	return 0;
+}
+
+static int rcv_cch(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct abis_rsl_cchan_hdr *ch = msgb_l2(msg);
+	int msg_type = ch->c.msg_type;
+	int rc;
+
+	LOGP(DRSL, LOGL_INFO, "Received '%s' from layer1\n",
+		rsl_msg_name(msg_type));
+
+	if (state == SCAN_STATE_RACH && msg_type == RSL_MT_CHAN_CONF) {
+	 	rc = chan_conf(ms, msg);
+		msgb_free(msg);
+		return rc;
+	}
+
+	LOGP(DRSL, LOGL_NOTICE, "RSLms message unhandled\n");
+	msgb_free(msg);
+	return 0;
+}
+
+static int rcv_rsl(struct msgb *msg, struct lapdm_entity *le, void *l3ctx)
+{
+	struct osmocom_ms *ms = l3ctx;
+	struct abis_rsl_common_hdr *rslh = msgb_l2(msg);
+	int rc = 0;
+
+	switch (rslh->msg_discr & 0xfe) {
+	case ABIS_RSL_MDISC_RLL:
+		rc = rcv_rll(ms, msg);
+		break;
+	case ABIS_RSL_MDISC_COM_CHAN:
+		rc = rcv_cch(ms, msg);
+		break;
+	default:
+		LOGP(DRSL, LOGL_NOTICE, "unknown RSLms msg_discr 0x%02x\n",
+			rslh->msg_discr);
+		msgb_free(msg);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+int scan_init(struct osmocom_ms *_ms)
+{
+	ms = _ms;
+	osmo_signal_register_handler(SS_L1CTL, &signal_cb, NULL);
+	memset(&timer, 0, sizeof(timer));
+	lapdm_channel_set_l3(&ms->lapdm_channel, &rcv_rsl, ms);
+	g.enable = 1;
+	osmo_gps_init();
+	if (osmo_gps_open())
+		g.enable = 0;
+
+	if (!strcmp(logname, "-"))
+		logfp = stdout;
+	else
+		logfp = fopen(logname, "a");
+	if (!logfp) {
+		fprintf(stderr, "Failed to open logfile '%s'\n", logname);
+		scan_exit();
+		return -errno;
+	}
+	LOGP(DSUM, LOGL_INFO, "Scanner initialized\n");
+
+	return 0;
+}
+
+int scan_exit(void)
+{
+	LOGP(DSUM, LOGL_INFO, "Scanner exit\n");
+	if (g.valid)
+		osmo_gps_close();
+	if (logfp)
+		fclose(logfp);
+	osmo_signal_unregister_handler(SS_L1CTL, &signal_cb, NULL);
+	stop_timer();
+
+	return 0;
+}
diff --git a/src/host/layer23/src/misc/rslms.c b/src/host/layer23/src/misc/rslms.c
new file mode 100644
index 00000000..455e6631
--- /dev/null
+++ b/src/host/layer23/src/misc/rslms.c
@@ -0,0 +1,151 @@
+/* RSLms - GSM 08.58 like protocol between L2 and L3 of GSM Um interface */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/gsm/lapdm.h>
+#include <osmocom/bb/misc/rslms.h>
+#include <osmocom/bb/misc/layer3.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1ctl.h>
+
+/* Send a 'simple' RLL request to L2 */
+int rslms_tx_rll_req(struct osmocom_ms *ms, uint8_t msg_type,
+		     uint8_t chan_nr, uint8_t link_id)
+{
+	struct msgb *msg;
+
+	msg = rsl_rll_simple(msg_type, chan_nr, link_id, 1);
+
+	return lapdm_rslms_recvmsg(msg, &ms->lapdm_channel);
+}
+
+/* Send a RLL request (including L3 info) to L2 */
+int rslms_tx_rll_req_l3(struct osmocom_ms *ms, uint8_t msg_type,
+			uint8_t chan_nr, uint8_t link_id, struct msgb *msg)
+{
+	rsl_rll_push_l3(msg, msg_type, chan_nr, link_id, 1);
+
+	return lapdm_rslms_recvmsg(msg, &ms->lapdm_channel);
+}
+
+static int rslms_rx_udata_ind(struct msgb *msg, struct osmocom_ms *ms)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	struct tlv_parsed tv;
+	int rc = 0;
+	
+	DEBUGP(DRSL, "RSLms UNIT DATA IND chan_nr=0x%02x link_id=0x%02x\n",
+		rllh->chan_nr, rllh->link_id);
+
+	rsl_tlv_parse(&tv, rllh->data, msgb_l2len(msg)-sizeof(*rllh));
+	if (!TLVP_PRESENT(&tv, RSL_IE_L3_INFO)) {
+		DEBUGP(DRSL, "UNIT_DATA_IND without L3 INFO ?!?\n");
+		return -EIO;
+	}
+	msg->l3h = (uint8_t *) TLVP_VAL(&tv, RSL_IE_L3_INFO);
+
+	if (rllh->chan_nr == RSL_CHAN_PCH_AGCH) {
+		rc = gsm48_rx_ccch(msg, ms);
+	} else if (rllh->chan_nr == RSL_CHAN_BCCH) {
+		rc = gsm48_rx_bcch(msg, ms);
+	}
+
+	return rc;
+}
+
+static int rslms_rx_rll(struct msgb *msg, struct osmocom_ms *ms)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	int rc = 0;
+
+	switch (rllh->c.msg_type) {
+	case RSL_MT_DATA_IND:
+		DEBUGP(DRSL, "RSLms DATA IND\n");
+		/* FIXME: implement this */
+		break;
+	case RSL_MT_UNIT_DATA_IND:
+		rc = rslms_rx_udata_ind(msg, ms);
+		break;
+	case RSL_MT_EST_IND:
+		DEBUGP(DRSL, "RSLms EST IND\n");
+		/* FIXME: implement this */
+		break;
+	case RSL_MT_EST_CONF:
+		DEBUGP(DRSL, "RSLms EST CONF\n");
+		/* FIXME: implement this */
+		break;
+	case RSL_MT_REL_CONF:
+		DEBUGP(DRSL, "RSLms REL CONF\n");
+		/* FIXME: implement this */
+		break;
+	case RSL_MT_ERROR_IND:
+		DEBUGP(DRSL, "RSLms ERR IND\n");
+		/* FIXME: implement this */
+		break;
+	default:
+		LOGP(DRSL, LOGL_NOTICE, "unknown RSLms message type "
+			"0x%02x\n", rllh->c.msg_type);
+		rc = -EINVAL;
+		break;
+	}
+	msgb_free(msg);
+	return rc;
+}
+
+/* input function that L2 calls when sending messages up to L3 */
+static int layer3_from_layer2(struct msgb *msg, struct lapdm_entity *le, void *ctx)
+{
+	struct osmocom_ms *ms = ctx;
+	struct abis_rsl_common_hdr *rslh = msgb_l2(msg);
+	int rc = 0;
+
+	switch (rslh->msg_discr & 0xfe) {
+	case ABIS_RSL_MDISC_RLL:
+		rc = rslms_rx_rll(msg, ms);
+		break;
+	default:
+		/* FIXME: implement this */
+		LOGP(DRSL, LOGL_NOTICE, "unknown RSLms msg_discr 0x%02x\n",
+			rslh->msg_discr);
+		msgb_free(msg);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+int layer3_init(struct osmocom_ms *ms)
+{
+	lapdm_channel_set_l3(&ms->lapdm_channel, &layer3_from_layer2, ms);
+
+	return 0;
+}
diff --git a/src/host/layer23/src/mobile/Makefile.am b/src/host/layer23/src/mobile/Makefile.am
new file mode 100644
index 00000000..4e80e4ea
--- /dev/null
+++ b/src/host/layer23/src/mobile/Makefile.am
@@ -0,0 +1,21 @@
+AM_CPPFLAGS = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) $(LIBGPS_CFLAGS) $(LIBLUA_CFLAGS)
+LDADD = ../common/liblayer23.a $(LIBOSMOCORE_LIBS) $(LIBOSMOVTY_LIBS) $(LIBOSMOGSM_LIBS) $(LIBOSMOCODEC_LIBS) $(LIBGPS_LIBS) $(LIBLUA_LIBS)
+
+noinst_LIBRARIES = libmobile.a
+libmobile_a_SOURCES = gsm322.c gsm480_ss.c gsm411_sms.c gsm48_cc.c gsm48_mm.c \
+	gsm48_rr.c mnccms.c settings.c subscriber.c support.c \
+	transaction.c vty_interface.c voice.c mncc_sock.c primitives.c
+
+bin_PROGRAMS = mobile
+
+mobile_SOURCES = main.c app_mobile.c
+mobile_LDADD = libmobile.a $(LDADD)
+
+# lua support
+if BUILD_LUA
+AM_CPPFLAGS += -DWITH_LUA=1
+libmobile_a_SOURCES += script_lua.c
+else
+libmobile_a_SOURCES += script_nolua.c
+endif
diff --git a/src/host/layer23/src/mobile/app_mobile.c b/src/host/layer23/src/mobile/app_mobile.c
new file mode 100644
index 00000000..a051fbaa
--- /dev/null
+++ b/src/host/layer23/src/mobile/app_mobile.c
@@ -0,0 +1,510 @@
+/* "Application" code of the layer2/3 stack */
+
+/* (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <signal.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1l2_interface.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/gps.h>
+#include <osmocom/bb/mobile/gsm48_rr.h>
+#include <osmocom/bb/mobile/gsm480_ss.h>
+#include <osmocom/bb/mobile/gsm411_sms.h>
+#include <osmocom/bb/mobile/vty.h>
+#include <osmocom/bb/mobile/app_mobile.h>
+#include <osmocom/bb/mobile/mncc.h>
+#include <osmocom/bb/mobile/voice.h>
+#include <osmocom/bb/mobile/primitives.h>
+#include <osmocom/bb/common/sap_interface.h>
+
+#include <osmocom/vty/ports.h>
+#include <osmocom/vty/logging.h>
+#include <osmocom/vty/telnet_interface.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/signal.h>
+
+#include <l1ctl_proto.h>
+
+extern void *l23_ctx;
+extern struct llist_head ms_list;
+extern int vty_reading;
+
+int mncc_recv_mobile(struct osmocom_ms *ms, int msg_type, void *arg);
+int mncc_recv_dummy(struct osmocom_ms *ms, int msg_type, void *arg);
+int (*mncc_recv_app)(struct osmocom_ms *ms, int, void *);
+static int quit;
+
+/* handle ms instance */
+int mobile_work(struct osmocom_ms *ms)
+{
+	int work = 0, w;
+
+	do {
+		w = 0;
+		w |= gsm48_rsl_dequeue(ms);
+		w |= gsm48_rr_dequeue(ms);
+		w |= gsm48_mmxx_dequeue(ms);
+		w |= gsm48_mmr_dequeue(ms);
+		w |= gsm48_mmevent_dequeue(ms);
+		w |= gsm322_plmn_dequeue(ms);
+		w |= gsm322_cs_dequeue(ms);
+		w |= gsm_sim_job_dequeue(ms);
+		w |= mncc_dequeue(ms);
+		if (w)
+			work = 1;
+	} while (w);
+	return work;
+}
+
+/* run ms instance, if layer1 is available */
+int mobile_signal_cb(unsigned int subsys, unsigned int signal,
+		     void *handler_data, void *signal_data)
+{
+	struct osmocom_ms *ms;
+	struct gsm_settings *set;
+	struct msgb *nmsg;
+
+	if (subsys != SS_L1CTL)
+		return 0;
+
+	switch (signal) {
+	case S_L1CTL_RESET:
+		ms = signal_data;
+		set = &ms->settings;
+
+		/* waiting for reset after shutdown */
+		if (ms->shutdown == MS_SHUTDOWN_WAIT_RESET) {
+			LOGP(DMOB, LOGL_NOTICE, "MS '%s' has been resetted\n", ms->name);
+			ms->shutdown = MS_SHUTDOWN_COMPL;
+			break;
+		}
+
+		if (ms->started)
+			break;
+
+		/* insert test card, if enabled */
+		switch (set->sim_type) {
+		case GSM_SIM_TYPE_READER:
+			/* trigger sim card reader process */
+			gsm_subscr_simcard(ms);
+			break;
+		case GSM_SIM_TYPE_TEST:
+			gsm_subscr_testcard(ms, set->test_rplmn_mcc,
+				set->test_rplmn_mnc, set->test_lac,
+				set->test_tmsi, set->test_imsi_attached);
+			break;
+		case GSM_SIM_TYPE_SAP:
+			gsm_subscr_sapcard(ms);
+			break;
+		default:
+			/* no SIM, trigger PLMN selection process */
+			nmsg = gsm322_msgb_alloc(GSM322_EVENT_SWITCH_ON);
+			if (!nmsg)
+				return -ENOMEM;
+			gsm322_plmn_sendmsg(ms, nmsg);
+			nmsg = gsm322_msgb_alloc(GSM322_EVENT_SWITCH_ON);
+			if (!nmsg)
+				return -ENOMEM;
+			gsm322_cs_sendmsg(ms, nmsg);
+		}
+
+		mobile_set_started(ms, true);
+	}
+	return 0;
+}
+
+/* power-off ms instance */
+int mobile_exit(struct osmocom_ms *ms, int force)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	/* if shutdown is already performed */
+	if (ms->shutdown >= MS_SHUTDOWN_WAIT_RESET)
+		return 0;
+
+	if (!force && ms->started) {
+		struct msgb *nmsg;
+
+		mobile_set_shutdown(ms, MS_SHUTDOWN_IMSI_DETACH);
+		nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_IMSI_DETACH);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm48_mmevent_msg(mm->ms, nmsg);
+
+		return -EBUSY;
+	}
+
+	gsm322_exit(ms);
+	gsm48_mm_exit(ms);
+	gsm48_rr_exit(ms);
+	gsm_subscr_exit(ms);
+	gsm48_cc_exit(ms);
+	gsm480_ss_exit(ms);
+	gsm411_sms_exit(ms);
+	gsm_sim_exit(ms);
+	lapdm_channel_exit(&ms->lapdm_channel);
+
+	if (ms->started) {
+		mobile_set_shutdown(ms, MS_SHUTDOWN_WAIT_RESET); /* being down, wait for reset */
+		l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
+	} else {
+		mobile_set_shutdown(ms, MS_SHUTDOWN_COMPL); /* being down */
+	}
+	vty_notify(ms, NULL);
+	vty_notify(ms, "Power off!\n");
+	LOGP(DMOB, LOGL_NOTICE, "Power off! (MS %s)\n", ms->name);
+
+	return 0;
+}
+
+/* power-on ms instance */
+static int mobile_init(struct osmocom_ms *ms)
+{
+	int rc;
+
+	gsm_settings_arfcn(ms);
+
+	lapdm_channel_init(&ms->lapdm_channel, LAPDM_MODE_MS);
+	ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI3].dl.t200_sec =
+		T200_DCCH_SHARED;
+	ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI3].dl.t200_usec = 0;
+	ms->lapdm_channel.lapdm_acch.datalink[DL_SAPI3].dl.t200_sec =
+		T200_ACCH;
+	ms->lapdm_channel.lapdm_acch.datalink[DL_SAPI3].dl.t200_usec = 0;
+	lapdm_channel_set_l1(&ms->lapdm_channel, l1ctl_ph_prim_cb, ms);
+
+	/* init SAP client before SIM card starts up */
+	osmosap_init(ms);
+
+	gsm_sim_init(ms);
+	gsm48_cc_init(ms);
+	gsm480_ss_init(ms);
+	gsm411_sms_init(ms);
+	gsm_voice_init(ms);
+	gsm_subscr_init(ms);
+	gsm48_rr_init(ms);
+	gsm48_mm_init(ms);
+	INIT_LLIST_HEAD(&ms->trans_list);
+	gsm322_init(ms);
+
+	rc = layer2_open(ms, ms->settings.layer2_socket_path);
+	if (rc < 0) {
+		LOGP(DMOB, LOGL_ERROR, "Failed during layer2_open(%s)\n", ms->settings.layer2_socket_path);
+		ms->l2_wq.bfd.fd = -1;
+		mobile_exit(ms, 1);
+		return rc;
+	}
+
+#if 0
+	rc = sap_open(ms, ms->settings.sap_socket_path);
+	if (rc < 0) {
+		fprintf(stderr, "Failed during sap_open(), no SIM reader\n");
+		ms->sap_wq.bfd.fd = -1;
+		mobile_exit(ms, 1);
+		return rc;
+	}
+#endif
+
+	gsm_random_imei(&ms->settings);
+
+	mobile_set_shutdown(ms, MS_SHUTDOWN_NONE);
+	mobile_set_started(ms, false);
+
+	if (!strcmp(ms->settings.imei, "000000000000000")) {
+		LOGP(DMOB, LOGL_NOTICE, "***\nWarning: Mobile '%s' has default IMEI: %s\n",
+			ms->name, ms->settings.imei);
+		LOGP(DMOB, LOGL_NOTICE, "This could relate your identitiy to other users with "
+			"default IMEI.\n***\n");
+	}
+
+	l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
+	LOGP(DMOB, LOGL_NOTICE, "Mobile '%s' initialized, please start phone now!\n", ms->name);
+	return 0;
+}
+
+int mobile_start(struct osmocom_ms *ms, char **other_name)
+{
+	struct osmocom_ms *tmp;
+	int rc;
+
+	if (ms->shutdown != MS_SHUTDOWN_COMPL)
+		return 0;
+
+	llist_for_each_entry(tmp, &ms_list, entity) {
+		if (tmp->shutdown == MS_SHUTDOWN_COMPL)
+			continue;
+		if (!strcmp(ms->settings.layer2_socket_path,
+				tmp->settings.layer2_socket_path)) {
+			LOGP(DMOB, LOGL_ERROR, "Cannot start MS '%s', because MS '%s' "
+				"use the same layer2-socket.\nPlease shutdown "
+				"MS '%s' first.\n", ms->name, tmp->name, tmp->name);
+			*other_name = tmp->name;
+			return -1;
+		}
+		if (!strcmp(ms->settings.sap_socket_path,
+				tmp->settings.sap_socket_path)) {
+			LOGP(DMOB, LOGL_ERROR, "Cannot start MS '%s', because MS '%s' "
+				"use the same sap-socket.\nPlease shutdown "
+				"MS '%s' first.\n", ms->name, tmp->name, tmp->name);
+			*other_name = tmp->name;
+			return -2;
+		}
+	}
+
+	rc = mobile_init(ms);
+	if (rc < 0)
+		return -3;
+	return 0;
+}
+
+int mobile_stop(struct osmocom_ms *ms, int force)
+{
+	if (force && ms->shutdown <= MS_SHUTDOWN_IMSI_DETACH)
+		return mobile_exit(ms, 1);
+	if (!force && ms->shutdown == MS_SHUTDOWN_NONE)
+		return mobile_exit(ms, 0);
+	return 0;
+}
+
+
+/* create ms instance */
+struct osmocom_ms *mobile_new(char *name)
+{
+	static struct osmocom_ms *ms;
+	char *mncc_name;
+
+	ms = talloc_zero(l23_ctx, struct osmocom_ms);
+	if (!ms) {
+		LOGP(DMOB, LOGL_ERROR, "Failed to allocate MS: %s\n", name);
+		return NULL;
+	}
+
+	talloc_set_name(ms, "ms_%s", name);
+	ms->name = talloc_strdup(ms, name);
+	ms->l2_wq.bfd.fd = -1;
+	ms->sap_wq.bfd.fd = -1;
+
+	/* Register a new MS */
+	llist_add_tail(&ms->entity, &ms_list);
+
+	gsm_support_init(ms);
+	gsm_settings_init(ms);
+
+	mobile_set_shutdown(ms, MS_SHUTDOWN_COMPL);
+
+	if (mncc_recv_app) {
+		mncc_name = talloc_asprintf(ms, "/tmp/ms_mncc_%s", ms->name);
+
+		ms->mncc_entity.mncc_recv = mncc_recv_app;
+		ms->mncc_entity.sock_state = mncc_sock_init(ms, mncc_name);
+
+		talloc_free(mncc_name);
+	} else if (ms->settings.ch_cap == GSM_CAP_SDCCH)
+		ms->mncc_entity.mncc_recv = mncc_recv_dummy;
+	else
+		ms->mncc_entity.mncc_recv = mncc_recv_mobile;
+
+
+	return ms;
+}
+
+/* destroy ms instance */
+int mobile_delete(struct osmocom_ms *ms, int force)
+{
+	int rc;
+
+	ms->deleting = true;
+
+	if (mncc_recv_app) {
+		mncc_sock_exit(ms->mncc_entity.sock_state);
+		ms->mncc_entity.sock_state = NULL;
+	}
+
+	if (ms->shutdown == MS_SHUTDOWN_NONE || (ms->shutdown == MS_SHUTDOWN_IMSI_DETACH && force)) {
+		rc = mobile_exit(ms, force);
+		if (rc < 0)
+			return rc;
+	}
+
+	return 0;
+}
+
+/* handle global shutdown */
+int global_signal_cb(unsigned int subsys, unsigned int signal,
+		     void *handler_data, void *signal_data)
+{
+	struct osmocom_ms *ms, *ms2;
+
+	if (subsys != SS_GLOBAL)
+		return 0;
+
+	switch (signal) {
+	case S_GLOBAL_SHUTDOWN:
+		/* force to exit, if signalled */
+		if (signal_data && *((uint8_t *)signal_data))
+			quit = 1;
+
+		llist_for_each_entry_safe(ms, ms2, &ms_list, entity)
+			mobile_delete(ms, quit);
+
+		/* quit, after all MS processes are gone */
+		quit = 1;
+		break;
+	}
+	return 0;
+}
+
+/* global work handler */
+int l23_app_work(int *_quit)
+{
+	struct osmocom_ms *ms, *ms2;
+	int work = 0;
+
+	llist_for_each_entry_safe(ms, ms2, &ms_list, entity) {
+		if (ms->shutdown != MS_SHUTDOWN_COMPL)
+			work |= mobile_work(ms);
+		if (ms->shutdown == MS_SHUTDOWN_COMPL) {
+			if (ms->l2_wq.bfd.fd > -1) {
+				layer2_close(ms);
+				ms->l2_wq.bfd.fd = -1;
+			}
+
+			if (ms->sap_wq.bfd.fd > -1) {
+				sap_close(ms);
+				ms->sap_wq.bfd.fd = -1;
+			}
+
+			if (ms->deleting) {
+				gsm_settings_exit(ms);
+				llist_del(&ms->entity);
+				talloc_free(ms);
+				work = 1;
+			}
+		}
+	}
+
+	/* return, if a shutdown was scheduled (quit = 1) */
+	*_quit = quit;
+	return work;
+}
+
+/* global exit */
+int l23_app_exit(void)
+{
+	osmo_signal_unregister_handler(SS_L1CTL, &gsm322_l1_signal, NULL);
+	osmo_signal_unregister_handler(SS_L1CTL, &mobile_signal_cb, NULL);
+	osmo_signal_unregister_handler(SS_GLOBAL, &global_signal_cb, NULL);
+
+	osmo_gps_close();
+
+	telnet_exit();
+
+	return 0;
+}
+
+static struct vty_app_info vty_info = {
+	.name = "OsmocomBB",
+	.version = PACKAGE_VERSION,
+	.go_parent_cb = ms_vty_go_parent,
+};
+
+/* global init */
+int l23_app_init(int (*mncc_recv)(struct osmocom_ms *ms, int, void *),
+	const char *config_file)
+{
+	struct telnet_connection dummy_conn;
+	int rc = 0;
+
+	mncc_recv_app = mncc_recv;
+
+	osmo_gps_init();
+
+	vty_info.tall_ctx = l23_ctx;
+	vty_init(&vty_info);
+	logging_vty_add_cmds(NULL);
+	ms_vty_init();
+	dummy_conn.priv = NULL;
+	vty_reading = 1;
+	if (config_file != NULL) {
+		rc = vty_read_config_file(config_file, &dummy_conn);
+		if (rc < 0) {
+			LOGP(DMOB, LOGL_FATAL, "Failed to parse the configuration "
+				"file '%s'\n", config_file);
+			LOGP(DMOB, LOGL_FATAL, "Please make sure the file "
+				"'%s' exists, or use an example from "
+				"'doc/examples/mobile/'\n", config_file);
+			return rc;
+		}
+		LOGP(DMOB, LOGL_INFO, "Using configuration from '%s'\n", config_file);
+	}
+	vty_reading = 0;
+	rc = telnet_init_dynif(l23_ctx, NULL,
+		vty_get_bind_addr(), OSMO_VTY_PORT_BB);
+	if (rc < 0) {
+		LOGP(DMOB, LOGL_FATAL, "Cannot init VTY on %s port %u: %s\n",
+			vty_get_bind_addr(), OSMO_VTY_PORT_BB, strerror(errno));
+		return rc;
+	}
+
+	osmo_signal_register_handler(SS_GLOBAL, &global_signal_cb, NULL);
+	osmo_signal_register_handler(SS_L1CTL, &mobile_signal_cb, NULL);
+	osmo_signal_register_handler(SS_L1CTL, &gsm322_l1_signal, NULL);
+
+	if (llist_empty(&ms_list)) {
+		struct osmocom_ms *ms;
+
+		LOGP(DMOB, LOGL_NOTICE, "No Mobile Station defined, creating: MS '1'\n");
+		ms = mobile_new("1");
+		if (!ms)
+			return -1;
+
+		rc = mobile_init(ms);
+		if (rc < 0)
+			return rc;
+	}
+
+	quit = 0;
+
+	return 0;
+}
+
+void mobile_set_started(struct osmocom_ms *ms, bool state)
+{
+	ms->started = state;
+
+	mobile_prim_ntfy_started(ms, state);
+}
+
+void mobile_set_shutdown(struct osmocom_ms *ms, int state)
+{
+	int old_state = ms->shutdown;
+	ms->shutdown = state;
+
+	mobile_prim_ntfy_shutdown(ms, old_state, state);
+}
diff --git a/src/host/layer23/src/mobile/gsm322.c b/src/host/layer23/src/mobile/gsm322.c
new file mode 100644
index 00000000..f2b51df0
--- /dev/null
+++ b/src/host/layer23/src/mobile/gsm322.c
@@ -0,0 +1,5195 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <time.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/core/signal.h>
+
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/networks.h>
+#include <osmocom/bb/mobile/vty.h>
+#include <osmocom/bb/mobile/app_mobile.h>
+#include <osmocom/bb/common/utils.h>
+
+#include <l1ctl_proto.h>
+
+const char *ba_version = "osmocom BA V1\n";
+
+static void gsm322_cs_timeout(void *arg);
+static int gsm322_cs_select(struct osmocom_ms *ms, int index, uint16_t mcc,
+	uint16_t mnc, int any);
+static int gsm322_m_switch_on(struct osmocom_ms *ms, struct msgb *msg);
+static void gsm322_any_timeout(void *arg);
+static int gsm322_nb_scan(struct osmocom_ms *ms);
+static int gsm322_nb_synced(struct gsm322_cellsel *cs, int yes);
+static int gsm322_nb_read(struct gsm322_cellsel *cs, int yes);
+static int gsm322_c_camp_any_cell(struct osmocom_ms *ms, struct msgb *msg);
+static int gsm322_nb_start(struct osmocom_ms *ms, int synced);
+static void gsm322_cs_loss(void *arg);
+static int gsm322_nb_meas_ind(struct osmocom_ms *ms, uint16_t arfcn,
+	uint8_t rx_lev);
+
+#define SYNC_RETRIES		1
+#define SYNC_RETRIES_SERVING	2
+
+/* time for trying to sync and read BCCH of neighbour cell again
+ * NOTE: This value is not defined by TS, i think. */
+#define GSM58_TRY_AGAIN		30
+
+/* time for reading BCCH of neighbour cell again */
+#define GSM58_READ_AGAIN	300
+
+/* number of neighbour cells to monitor */
+#define GSM58_NB_NUMBER		6
+
+/* Timeout for reading BCCH of neighbour cells */
+#define GSM322_NB_TIMEOUT	2
+
+/* number of neighbour cells to measure for average */
+#define RLA_C_NUM		4
+
+/* wait before doing neighbour cell reselecton due to a better cell again */
+#define GSM58_RESEL_THRESHOLD	15
+
+#define ARFCN_TEXT_LEN	10
+
+//#define TEST_INCLUDE_SERV
+
+/*
+ * notes
+ */
+
+/* Cell selection process
+ *
+ * The process depends on states and events (finites state machine).
+ *
+ * During states of cell selection or cell re-selection, the search for a cell
+ * is performed in two steps:
+ *
+ *  1. Measurement of received level of all relevant frequencies (rx-lev)
+ *
+ *  2. Receive system information messages of all relevant frequencies
+ *
+ * During this process, the results are stored in a list of all frequencies.
+ * This list is checked whenever a cell is selected. It depends on the results
+ * if the cell is 'suitable' and 'allowable' to 'camp' on.
+ *
+ * This list is also used to generate a list of available networks.
+ *
+ * The states are:
+ *
+ * - cs->list[0..(1023+299)].xxx for each cell, where
+ *  - flags and rxlev are used to store outcome of cell scanning process
+ *  - sysinfo pointing to sysinfo memory, allocated temporarily
+ * - cs->selected and cs->sel_* states of the current / last selected cell.
+ *
+ *
+ * There are special states: GSM322_HPLMN_SEARCH, GSM322_PLMN_SEARCH
+ * and GSM322_ANY_SEARCH:
+ *
+ * GSM322_HPLMN_SEARCH is used to find a HPLMN. This is triggered
+ * by automatic cell selection.
+ *
+ * GSM322_PLMN_SEARCH is triggered when network search process is started.
+ * It will do a complete search. Also it is used before selecting PLMN from list.
+ *
+ * GSM322_ANY_SEARCH is similar to GSM322_PLMN_SEARCH, but it is done while
+ * camping on any cell. If there is a suitable and allowable cell found,
+ * it is indicated to the PLMN search process.
+ *
+ */
+
+/* PLMN selection process
+ *
+ * The PLMN (Public Land Mobile Network = Operator's Network) has two different
+ * search processes:
+ *
+ *  1. Automatic search
+ *
+ *  2. Manual search
+ *
+ * The process depends on states and events (finites state machine).
+ *
+ */
+
+/* File format of BA list:
+ *
+ * uint16_t	mcc
+ * uint16_t	mcc
+ * uint8_t	freq[128+38];
+ * where frequency 0 is bit 0 of first byte
+ *
+ * If not end-of-file, the next BA list is stored.
+ */
+
+/* List of lists:
+ *
+ * * subscr->plmn_list
+ *
+ * The "PLMN Selector list" stores prefered networks to select during PLMN
+ * search process. This list is also stored in the SIM.
+ *
+ * * subscr->plmn_na
+ *
+ * The "forbidden PLMNs" list stores all networks that rejected us. The stored
+ * network will not be used when searching PLMN automatically. This list is
+ * also stored din the SIM.
+ *
+ * * plmn->forbidden_la
+ *
+ * The "forbidden LAs for roaming" list stores all location areas where roaming
+ * was not allowed.
+ *
+ * * cs->list[1024+299]
+ *
+ * This list stores measurements and cell informations during cell selection
+ * process. It can be used to speed up repeated cell selection.
+ *
+ * * cs->ba_list
+ *
+ * This list stores a map of frequencies used for a PLMN. If this lists exists
+ * for a PLMN, it helps to speedup cell scan process.
+ *
+ * * plmn->sorted_plmn
+ *
+ * This list is generated whenever a PLMN search is started and a list of PLMNs
+ * is required. It consists of home PLMN, PLMN Selector list, and PLMNs found
+ * during scan process.
+ *
+ *
+ * Cell re-selection process
+ *
+ * The cell re-selection process takes place when a "serving cell" is selected.
+ * The neighbour cells to be monitored for re-selection are given via SI2* of
+ * the serving cell.
+ *
+ * Therefore a list of neighbour cells is created or updated, when the cell
+ * allocation is received or changed by the network.
+ *
+ * All neighbour cells are monitored, but only up to 6 of the strongest cells
+ * are synced to, in order to read the BCCH data. A timer is used to re-read
+ * the BCCH data after 5 minutes. This timer is also used if sync or read
+ * fails.
+ *
+ * The C1 and C2 criterion is calculated for the currently monitored neigbour
+ * cells. During this process, a better neighbour cell will trigger cell
+ * re-selection.
+ *
+ * The cell re-selection is similar to the cell selection process, except that
+ * only neighbour cells are searched in order of their quality criterion C2.
+ *
+ * During camping, and monitoring neighbour cells, it is possible to enter
+ * dedicated mode at any time.
+ *
+ */
+
+/*
+ * event messages
+ */
+
+static const struct value_string gsm322_event_names[] = {
+	{ GSM322_EVENT_SWITCH_ON,	"EVENT_SWITCH_ON" },
+	{ GSM322_EVENT_SWITCH_OFF,	"EVENT_SWITCH_OFF" },
+	{ GSM322_EVENT_SIM_INSERT,	"EVENT_SIM_INSERT" },
+	{ GSM322_EVENT_SIM_REMOVE,	"EVENT_SIM_REMOVE" },
+	{ GSM322_EVENT_REG_FAILED,	"EVENT_REG_FAILED" },
+	{ GSM322_EVENT_ROAMING_NA,	"EVENT_ROAMING_NA" },
+	{ GSM322_EVENT_INVALID_SIM,	"EVENT_INVALID_SIM" },
+	{ GSM322_EVENT_REG_SUCCESS,	"EVENT_REG_SUCCESS" },
+	{ GSM322_EVENT_NEW_PLMN,	"EVENT_NEW_PLMN" },
+	{ GSM322_EVENT_ON_PLMN,		"EVENT_ON_PLMN" },
+	{ GSM322_EVENT_PLMN_SEARCH_START,"EVENT_PLMN_SEARCH_START" },
+	{ GSM322_EVENT_PLMN_SEARCH_END,	"EVENT_PLMN_SEARCH_END" },
+	{ GSM322_EVENT_USER_RESEL,	"EVENT_USER_RESEL" },
+	{ GSM322_EVENT_PLMN_AVAIL,	"EVENT_PLMN_AVAIL" },
+	{ GSM322_EVENT_CHOOSE_PLMN,	"EVENT_CHOOSE_PLMN" },
+	{ GSM322_EVENT_SEL_MANUAL,	"EVENT_SEL_MANUAL" },
+	{ GSM322_EVENT_SEL_AUTO,	"EVENT_SEL_AUTO" },
+	{ GSM322_EVENT_CELL_FOUND,	"EVENT_CELL_FOUND" },
+	{ GSM322_EVENT_NO_CELL_FOUND,	"EVENT_NO_CELL_FOUND" },
+	{ GSM322_EVENT_LEAVE_IDLE,	"EVENT_LEAVE_IDLE" },
+	{ GSM322_EVENT_RET_IDLE,	"EVENT_RET_IDLE" },
+	{ GSM322_EVENT_CELL_RESEL,	"EVENT_CELL_RESEL" },
+	{ GSM322_EVENT_SYSINFO,		"EVENT_SYSINFO" },
+	{ GSM322_EVENT_HPLMN_SEARCH,	"EVENT_HPLMN_SEARCH" },
+	{ 0,				NULL }
+};
+
+const char *get_event_name(int value)
+{
+	return get_value_string(gsm322_event_names, value);
+}
+
+
+/* allocate a 03.22 event message */
+struct msgb *gsm322_msgb_alloc(int msg_type)
+{
+	struct msgb *msg;
+	struct gsm322_msg *gm;
+
+	msg = msgb_alloc_headroom(sizeof(*gm), 0, "GSM 03.22 event");
+	if (!msg)
+		return NULL;
+
+	gm = (struct gsm322_msg *)msgb_put(msg, sizeof(*gm));
+	gm->msg_type = msg_type;
+
+	return msg;
+}
+
+/* queue PLMN selection message */
+int gsm322_plmn_sendmsg(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+
+	msgb_enqueue(&plmn->event_queue, msg);
+
+	return 0;
+}
+
+/* queue cell selection message */
+int gsm322_cs_sendmsg(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+
+	msgb_enqueue(&cs->event_queue, msg);
+
+	return 0;
+}
+
+/*
+ * support
+ */
+
+uint16_t index2arfcn(int index)
+{
+	if (index >= 1024)
+		return (index-1024+512) | ARFCN_PCS;
+	return index;
+}
+
+int arfcn2index(uint16_t arfcn)
+{
+	int is_pcs = arfcn & ARFCN_PCS;
+	arfcn &= ~ARFCN_FLAG_MASK;
+	if ((is_pcs) && (arfcn >= 512) && (arfcn <= 810))
+		return (arfcn & 1023)-512+1024;
+	return arfcn & 1023;
+}
+
+
+static char *bargraph(int value, int min, int max)
+{
+	static char bar[128];
+
+	/* shift value to the range of min..max */
+	if (value < min)
+		value = 0;
+	else if (value > max)
+		value = max - min;
+	else
+		value -= min;
+
+	/* Prevent 'bar' buffer over-/under-run */
+	OSMO_ASSERT(value >= 0 && value < 128);
+
+	/* Prevent calling memset() with zero length */
+	if (value == 0)
+		return "";
+
+	memset(bar, '=', value);
+	bar[value] = '\0';
+
+	return bar;
+}
+
+static int class_of_band(struct osmocom_ms *ms, int band)
+{
+	struct gsm_settings *set = &ms->settings;
+
+	switch (band) {
+	case GSM_BAND_450:
+	case GSM_BAND_480:
+		return set->class_400;
+		break;
+	case GSM_BAND_850:
+		return set->class_850;
+		break;
+	case GSM_BAND_1800:
+		return set->class_dcs;
+		break;
+	case GSM_BAND_1900:
+		return set->class_pcs;
+		break;
+	}
+
+	return set->class_900;
+}
+
+char *gsm_print_rxlev(uint8_t rxlev)
+{
+	static char string[6];
+	if (rxlev == 0)
+		return "<=-110";
+	if (rxlev >= 63)
+		return ">=-47";
+	sprintf(string, "-%d", 110 - rxlev);
+	return string;
+}
+
+/* GSM 05.08 6.4 (special class 3 DCS 1800 MS case is omitted ) */
+static int16_t calculate_c1(int log, int8_t rla_c, int8_t rxlev_acc_min,
+	int8_t ms_txpwr_max_cch, int8_t p)
+{
+	int16_t a, b, c1, max_b_0;
+
+	a = rla_c - rxlev_acc_min;
+	b = ms_txpwr_max_cch - p;
+
+	max_b_0 = (b > 0) ? b : 0;
+
+	c1 = a - max_b_0;
+
+	LOGP(log, LOGL_INFO, "A (RLA_C (%d) - RXLEV_ACC_MIN (%d)) = %d\n",
+		rla_c, rxlev_acc_min, a);
+	LOGP(log, LOGL_INFO, "B (MS_TXPWR_MAX_CCH (%d) - p (%d)) = %d\n",
+		ms_txpwr_max_cch, p, b);
+	LOGP(log, LOGL_INFO, "C1 (A - MAX(B,0)) = %d\n", c1);
+
+	return c1;
+}
+
+static int16_t calculate_c2(int16_t c1, int serving, int last_serving,
+	int cell_resel_param_ind, uint8_t cell_resel_off, int t,
+	uint8_t penalty_time, uint8_t temp_offset) {
+	int16_t c2;
+
+	c2 = c1;
+
+	/* no reselect parameters. same process for serving and neighbour cells */
+	if (!cell_resel_param_ind) {
+		LOGP(DNB, LOGL_INFO, "C2 = C1 = %d (because no extended "
+			"re-selection parameters available)\n", c2);
+		return c2;
+	}
+
+	/* special case, if PENALTY_TIME is '11111' */
+	if (penalty_time == 31) {
+		c2 -= (cell_resel_off << 1);
+		LOGP(DNB, LOGL_INFO, "C2 = C1 - CELL_RESELECT_OFFSET (%d) = %d "
+			"(special case)\n", cell_resel_off, c2);
+		return c2;
+	}
+
+	c2 += (cell_resel_off << 1);
+
+	/* parameters for serving cell */
+	if (serving) {
+		LOGP(DNB, LOGL_INFO, "C2 = C1 + CELL_RESELECT_OFFSET (%d) = %d "
+			"(serving cell)\n", cell_resel_off, c2);
+		return c2;
+	}
+
+	/*  the cell is the last serving cell */
+	if (last_serving) {
+		LOGP(DNB, LOGL_INFO, "C2 = C1 + CELL_RESELECT_OFFSET (%d) = %d "
+			"(last serving cell)\n", cell_resel_off, c2);
+		return c2;
+	}
+
+	/*  penatly time reached */
+	if (t >= (penalty_time + 1) * 20) {
+		LOGP(DNB, LOGL_INFO, "C2 = C1 + CELL_RESELECT_OFFSET (%d) = %d "
+			"(PENALTY_TIME reached)\n", cell_resel_off, c2);
+		return c2;
+	}
+
+	/* penalty time not reached, substract temporary offset */
+	if (temp_offset < 7)
+		c2 -= temp_offset * 10;
+	else
+		c2 = -1000; /* infinite  */
+	LOGP(DNB, LOGL_INFO, "C2 = C1 + CELL_RESELECT_OFFSET (%d) = %d "
+		"(PENALTY_TIME not reached, %d seconds left)\n", cell_resel_off,
+		c2, (penalty_time + 1) * 20 - t);
+	return c2;
+}
+
+static int gsm322_sync_to_cell(struct gsm322_cellsel *cs,
+	struct gsm322_neighbour * neighbour, int camping)
+{
+	struct osmocom_ms *ms = cs->ms;
+	struct gsm48_sysinfo *s = cs->si;
+	struct rx_meas_stat *meas = &ms->meas;
+
+	if (cs->sync_pending) {
+		LOGP(DCS, LOGL_INFO, "Sync to ARFCN=%s, but there is a sync "
+			"already pending\n",gsm_print_arfcn(cs->arfcn));
+		return 0;
+	}
+
+	cs->ccch_state = GSM322_CCCH_ST_INIT;
+	if (s && s->si3) {
+		if (s->ccch_conf == 1) {
+			LOGP(DCS, LOGL_INFO, "Sync to ARFCN=%s rxlev=%s "
+				"(Sysinfo, ccch mode COMB)\n",
+				gsm_print_arfcn(cs->arfcn),
+				gsm_print_rxlev(cs->list[cs->arfci].rxlev));
+			cs->ccch_mode = CCCH_MODE_COMBINED;
+		} else {
+			LOGP(DCS, LOGL_INFO, "Sync to ARFCN=%s rxlev=%s "
+				"(Sysinfo, ccch mode NON-COMB)\n",
+				gsm_print_arfcn(cs->arfcn),
+				gsm_print_rxlev(cs->list[cs->arfci].rxlev));
+			cs->ccch_mode = CCCH_MODE_NON_COMBINED;
+		}
+	} else {
+		LOGP(DCS, LOGL_INFO, "Sync to ARFCN=%s rxlev=%s (No sysinfo "
+			"yet, ccch mode NONE)\n", gsm_print_arfcn(cs->arfcn),
+			gsm_print_rxlev(cs->list[cs->arfci].rxlev));
+		cs->ccch_mode = CCCH_MODE_NONE;
+	}
+
+	meas->frames = meas->snr = meas->berr = meas->rxlev = 0;
+	cs->rxlev_sum_dbm = cs->rxlev_count = 0;
+
+	cs->neighbour = neighbour;
+
+	if (camping) {
+		cs->rla_c_dbm = -128;
+		cs->c12_valid = 0;
+		/* keep neighbour cells! if they are old, they are re-read
+		 * anyway, because re-read timer has expired. */
+	}
+
+	cs->sync_pending = 1;
+	l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
+	return l1ctl_tx_fbsb_req(ms, cs->arfcn,
+			L1CTL_FBSB_F_FB01SB, 100, 0,
+			cs->ccch_mode,
+			cs->list[cs->arfci].rxlev);
+}
+
+/* this is called whenever the serving cell is unselectied */
+static void gsm322_unselect_cell(struct gsm322_cellsel *cs)
+{
+	if (!cs->selected)
+		return;
+
+	LOGP(DCS, LOGL_INFO, "Unselecting serving cell.\n");
+
+	cs->selected = 0;
+	if (cs->si)
+		cs->si->si5 = 0; /* unset SI5* */
+	cs->si = NULL;
+	memset(&cs->sel_si, 0, sizeof(cs->sel_si));
+	cs->sel_mcc = cs->sel_mnc = cs->sel_lac = cs->sel_id = 0;
+}
+
+/* print to DCS logging */
+static void print_dcs(void *priv, const char *fmt, ...)
+{
+	static char buffer[256] = "";
+	int in = strlen(buffer);
+	va_list args;
+
+	va_start(args, fmt);
+	vsnprintf(buffer + in, sizeof(buffer) - in - 1, fmt, args);
+	buffer[sizeof(buffer) - in - 1] = '\0';
+	va_end(args);
+
+	if (buffer[0] && buffer[strlen(buffer) - 1] == '\n') {
+		LOGP(DCS, LOGL_INFO, "%s", buffer);
+		buffer[0] = '\0';
+	}
+}
+
+/* del forbidden LA */
+int gsm322_del_forbidden_la(struct osmocom_ms *ms, uint16_t mcc,
+	uint16_t mnc, uint16_t lac)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_la_list *la;
+
+	llist_for_each_entry(la, &plmn->forbidden_la, entry) {
+		if (la->mcc == mcc && la->mnc == mnc && la->lac == lac) {
+			LOGP(DPLMN, LOGL_INFO, "Delete from list of forbidden "
+				"LAs (mcc=%s, mnc=%s, lac=%04x)\n",
+				gsm_print_mcc(mcc), gsm_print_mnc(mnc), lac);
+			llist_del(&la->entry);
+			talloc_free(la);
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+/* add forbidden LA */
+int gsm322_add_forbidden_la(struct osmocom_ms *ms, uint16_t mcc,
+	uint16_t mnc, uint16_t lac, uint8_t cause)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_la_list *la;
+
+	LOGP(DPLMN, LOGL_INFO, "Add to list of forbidden LAs "
+		"(mcc=%s, mnc=%s, lac=%04x)\n", gsm_print_mcc(mcc),
+		gsm_print_mnc(mnc), lac);
+	la = talloc_zero(ms, struct gsm322_la_list);
+	if (!la)
+		return -ENOMEM;
+	la->mcc = mcc;
+	la->mnc = mnc;
+	la->lac = lac;
+	la->cause = cause;
+	llist_add_tail(&la->entry, &plmn->forbidden_la);
+
+	return 0;
+}
+
+/* search forbidden LA */
+int gsm322_is_forbidden_la(struct osmocom_ms *ms, uint16_t mcc, uint16_t mnc,
+	uint16_t lac)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_la_list *la;
+
+	llist_for_each_entry(la, &plmn->forbidden_la, entry) {
+		if (la->mcc == mcc && la->mnc == mnc && la->lac == lac)
+			return 1;
+	}
+
+	return 0;
+}
+
+/* search for PLMN in all BA lists */
+static struct gsm322_ba_list *gsm322_find_ba_list(struct gsm322_cellsel *cs,
+	uint16_t mcc, uint16_t mnc)
+{
+	struct gsm322_ba_list *ba, *ba_found = NULL;
+
+	/* search for BA list */
+	llist_for_each_entry(ba, &cs->ba_list, entry) {
+		if (ba->mcc == mcc
+		 && ba->mnc == mnc) {
+			ba_found = ba;
+			break;
+		}
+	}
+
+	return ba_found;
+}
+
+/* search available PLMN */
+int gsm322_is_plmn_avail_and_allow(struct gsm322_cellsel *cs, uint16_t mcc,
+	uint16_t mnc)
+{
+	int i;
+
+	for (i = 0; i <= 1023+299; i++) {
+		if ((cs->list[i].flags & GSM322_CS_FLAG_TEMP_AA)
+		 && cs->list[i].sysinfo
+		 && cs->list[i].sysinfo->mcc == mcc
+		 && cs->list[i].sysinfo->mnc == mnc)
+			return 1;
+	}
+
+	return 0;
+}
+
+/* search available HPLMN */
+int gsm322_is_hplmn_avail(struct gsm322_cellsel *cs, char *imsi)
+{
+	int i;
+
+	for (i = 0; i <= 1023+299; i++) {
+		if ((cs->list[i].flags & GSM322_CS_FLAG_SYSINFO)
+		 && cs->list[i].sysinfo
+		 && gsm_match_mnc(cs->list[i].sysinfo->mcc,
+			cs->list[i].sysinfo->mnc, imsi))
+			return 1;
+	}
+
+	return 0;
+}
+
+static const struct value_string gsm322_nb_state_names[] = {
+	{ GSM322_NB_NEW,	"new" },
+	{ GSM322_NB_NOT_SUP,	"not sup" },
+	{ GSM322_NB_RLA_C,	"RLA_C" },
+	{ GSM322_NB_NO_SYNC,	"no sync" },
+	{ GSM322_NB_NO_BCCH,	"no BCCH" },
+	{ GSM322_NB_SYSINFO,	"SYSINFO" },
+	{ 0,			NULL }
+};
+
+const char *get_nb_state_name(int value)
+{
+	return get_value_string(gsm322_nb_state_names, value);
+}
+
+
+/*
+ * timer
+ */
+
+/*plmn search timer event */
+static void plmn_timer_timeout(void *arg)
+{
+	struct gsm322_plmn *plmn = arg;
+	struct msgb *nmsg;
+
+	LOGP(DPLMN, LOGL_INFO, "HPLMN search timer has fired.\n");
+
+	/* indicate PLMN selection T timeout */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_HPLMN_SEARCH);
+	if (!nmsg)
+		return;
+	gsm322_plmn_sendmsg(plmn->ms, nmsg);
+}
+
+/* start plmn search timer */
+static void start_plmn_timer(struct gsm322_plmn *plmn, int secs)
+{
+	LOGP(DPLMN, LOGL_INFO, "Starting HPLMN search timer with %d minutes.\n",
+		secs / 60);
+	plmn->timer.cb = plmn_timer_timeout;
+	plmn->timer.data = plmn;
+	osmo_timer_schedule(&plmn->timer, secs, 0);
+}
+
+/* stop plmn search timer */
+static void stop_plmn_timer(struct gsm322_plmn *plmn)
+{
+	if (osmo_timer_pending(&plmn->timer)) {
+		LOGP(DPLMN, LOGL_INFO, "Stopping pending timer.\n");
+		osmo_timer_del(&plmn->timer);
+	}
+}
+
+/* start cell selection timer */
+void start_cs_timer(struct gsm322_cellsel *cs, int sec, int micro)
+{
+	LOGP(DCS, LOGL_DEBUG, "Starting CS timer with %d seconds.\n", sec);
+	cs->timer.cb = gsm322_cs_timeout;
+	cs->timer.data = cs;
+	osmo_timer_schedule(&cs->timer, sec, micro);
+}
+
+/* stop cell selection timer */
+static void stop_cs_timer(struct gsm322_cellsel *cs)
+{
+	if (osmo_timer_pending(&cs->timer)) {
+		LOGP(DCS, LOGL_DEBUG, "stopping pending CS timer.\n");
+		osmo_timer_del(&cs->timer);
+	}
+}
+
+/* the following timer is used to search again for allowable cell, after
+ * loss of coverage. (loss of any allowed PLMN) */
+
+/* start any cell selection timer */
+void start_any_timer(struct gsm322_cellsel *cs, int sec, int micro)
+{
+	LOGP(DCS, LOGL_DEBUG, "Starting 'any cell selection' timer with %d "
+		"seconds.\n", sec);
+	cs->any_timer.cb = gsm322_any_timeout;
+	cs->any_timer.data = cs;
+	osmo_timer_schedule(&cs->any_timer, sec, micro);
+}
+
+/* stop cell selection timer */
+static void stop_any_timer(struct gsm322_cellsel *cs)
+{
+	if (osmo_timer_pending(&cs->any_timer)) {
+		LOGP(DCS, LOGL_DEBUG, "stopping pending 'any cell selection' "
+			"timer.\n");
+		osmo_timer_del(&cs->any_timer);
+	}
+}
+
+/*
+ * state change
+ */
+
+static const struct value_string gsm322_a_state_names[] = {
+	{ GSM322_A0_NULL,		"A0 null"},
+	{ GSM322_A1_TRYING_RPLMN,	"A1 trying RPLMN"},
+	{ GSM322_A2_ON_PLMN,		"A2 on PLMN"},
+	{ GSM322_A3_TRYING_PLMN,	"A3 trying PLMN"},
+	{ GSM322_A4_WAIT_FOR_PLMN,	"A4 wait for PLMN to appear"},
+	{ GSM322_A5_HPLMN_SEARCH,	"A5 HPLMN search"},
+	{ GSM322_A6_NO_SIM,		"A6 no SIM inserted"},
+	{ 0,				NULL }
+};
+
+const char *get_a_state_name(int value)
+{
+	return get_value_string(gsm322_a_state_names, value);
+}
+
+static const struct value_string gsm322_m_state_names[] = {
+	{ GSM322_M0_NULL,		"M0 null"},
+	{ GSM322_M1_TRYING_RPLMN,	"M1 trying RPLMN"},
+	{ GSM322_M2_ON_PLMN,		"M2 on PLMN"},
+	{ GSM322_M3_NOT_ON_PLMN,	"M3 not on PLMN"},
+	{ GSM322_M4_TRYING_PLMN,	"M4 trying PLMN"},
+	{ GSM322_M5_NO_SIM,		"M5 no SIM inserted"},
+	{ 0,				NULL }
+};
+
+const char *get_m_state_name(int value)
+{
+	return get_value_string(gsm322_m_state_names, value);
+}
+
+static const struct value_string gsm322_cs_state_names[] = {
+	{ GSM322_C0_NULL,		"C0 null"},
+	{ GSM322_C1_NORMAL_CELL_SEL,	"C1 normal cell selection"},
+	{ GSM322_C2_STORED_CELL_SEL,	"C2 stored cell selection"},
+	{ GSM322_C3_CAMPED_NORMALLY,	"C3 camped normally"},
+	{ GSM322_C4_NORMAL_CELL_RESEL,	"C4 normal cell re-selection"},
+	{ GSM322_C5_CHOOSE_CELL,	"C5 choose cell"},
+	{ GSM322_C6_ANY_CELL_SEL,	"C6 any cell selection"},
+	{ GSM322_C7_CAMPED_ANY_CELL,	"C7 camped on any cell"},
+	{ GSM322_C8_ANY_CELL_RESEL,	"C8 any cell re-selection"},
+	{ GSM322_C9_CHOOSE_ANY_CELL,	"C9 choose any cell"},
+	{ GSM322_CONNECTED_MODE_1,	"connected mode 1"},
+	{ GSM322_CONNECTED_MODE_2,	"connected mode 2"},
+	{ GSM322_PLMN_SEARCH,		"PLMN search"},
+	{ GSM322_HPLMN_SEARCH,		"HPLMN search"},
+	{ GSM322_ANY_SEARCH,		"ANY search"},
+	{ 0,				NULL }
+};
+
+const char *get_cs_state_name(int value)
+{
+	return get_value_string(gsm322_cs_state_names, value);
+}
+
+/* new automatic PLMN search state */
+static void new_a_state(struct gsm322_plmn *plmn, int state)
+{
+	if (plmn->ms->settings.plmn_mode != PLMN_MODE_AUTO) {
+		LOGP(DPLMN, LOGL_FATAL, "not in auto mode, please fix!\n");
+		return;
+	}
+
+	stop_plmn_timer(plmn);
+
+	LOGP(DPLMN, LOGL_INFO, "new state '%s' -> '%s'\n",
+		get_a_state_name(plmn->state), get_a_state_name(state));
+
+	plmn->state = state;
+}
+
+/* new manual PLMN search state */
+static void new_m_state(struct gsm322_plmn *plmn, int state)
+{
+	if (plmn->ms->settings.plmn_mode != PLMN_MODE_MANUAL) {
+		LOGP(DPLMN, LOGL_FATAL, "not in manual mode, please fix!\n");
+		return;
+	}
+
+	LOGP(DPLMN, LOGL_INFO, "new state '%s' -> '%s'\n",
+		get_m_state_name(plmn->state), get_m_state_name(state));
+
+	plmn->state = state;
+}
+
+/* new Cell selection state */
+static void new_c_state(struct gsm322_cellsel *cs, int state)
+{
+	LOGP(DCS, LOGL_INFO, "new state '%s' -> '%s'\n",
+		get_cs_state_name(cs->state), get_cs_state_name(state));
+
+	/* stop cell selection timer, if running */
+	stop_cs_timer(cs);
+
+	/* stop scanning of power measurement */
+	if (cs->powerscan) {
+		LOGP(DCS, LOGL_INFO, "changing state while power scanning\n");
+		l1ctl_tx_reset_req(cs->ms, L1CTL_RES_T_FULL);
+		cs->powerscan = 0;
+	}
+
+	cs->state = state;
+}
+
+/*
+ * list of PLMNs
+ */
+
+/* 4.4.3 create sorted list of PLMN
+ *
+ * the source of entries are
+ *
+ * - HPLMN
+ * - entries found in the SIM's PLMN Selector list
+ * - scanned PLMNs above -85 dB (random order)
+ * - scanned PLMNs below or equal -85 (by received level)
+ *
+ * NOTE:
+ *
+ * The list only includes networks found at last scan.
+ *
+ * The list always contains HPLMN if available, even if not used by PLMN
+ * search process at some conditions.
+ *
+ * The list contains all PLMNs even if not allowed, so entries have to be
+ * removed when selecting from the list. (In case we use manual cell selection,
+ * we need to provide non-allowed networks also.)
+ */
+static int gsm322_sort_list(struct osmocom_ms *ms)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm_sub_plmn_list *sim_entry;
+	struct gsm_sub_plmn_na *na_entry;
+	struct llist_head temp_list;
+	struct gsm322_plmn_list *temp, *found;
+	struct llist_head *lh, *lh2;
+	int i, entries, move;
+	uint8_t search = 0;
+
+	/* flush list */
+	llist_for_each_safe(lh, lh2, &plmn->sorted_plmn) {
+		llist_del(lh);
+		talloc_free(lh);
+	}
+
+	/* Create a temporary list of all networks */
+	INIT_LLIST_HEAD(&temp_list);
+	for (i = 0; i <= 1023+299; i++) {
+		if (!(cs->list[i].flags & GSM322_CS_FLAG_TEMP_AA)
+		 || !cs->list[i].sysinfo)
+			continue;
+
+		/* search if network has multiple cells */
+		found = NULL;
+		llist_for_each_entry(temp, &temp_list, entry) {
+			if (temp->mcc == cs->list[i].sysinfo->mcc
+			 && temp->mnc == cs->list[i].sysinfo->mnc) {
+				found = temp;
+				break;
+			}
+		}
+		/* update or create */
+		if (found) {
+			if (cs->list[i].rxlev > found->rxlev)
+				found->rxlev = cs->list[i].rxlev;
+		} else {
+			temp = talloc_zero(ms, struct gsm322_plmn_list);
+			if (!temp)
+				return -ENOMEM;
+			temp->mcc = cs->list[i].sysinfo->mcc;
+			temp->mnc = cs->list[i].sysinfo->mnc;
+			temp->rxlev = cs->list[i].rxlev;
+			llist_add_tail(&temp->entry, &temp_list);
+		}
+	}
+
+	/* move Home PLMN, if in list, else add it */
+	if (subscr->sim_valid) {
+		found = NULL;
+		llist_for_each_entry(temp, &temp_list, entry) {
+			if (gsm_match_mnc(temp->mcc, temp->mnc, subscr->imsi)) {
+				found = temp;
+				break;
+			}
+		}
+		if (found) {
+			/* move */
+			llist_del(&found->entry);
+			llist_add_tail(&found->entry, &plmn->sorted_plmn);
+		}
+	}
+
+	/* move entries if in SIM's PLMN Selector list */
+	llist_for_each_entry(sim_entry, &subscr->plmn_list, entry) {
+		found = NULL;
+		llist_for_each_entry(temp, &temp_list, entry) {
+			if (temp->mcc == sim_entry->mcc
+			 && temp->mnc == sim_entry->mnc) {
+				found = temp;
+				break;
+			}
+		}
+		if (found) {
+			llist_del(&found->entry);
+			llist_add_tail(&found->entry, &plmn->sorted_plmn);
+		}
+	}
+
+	/* move PLMN above -85 dBm in random order */
+	entries = 0;
+	llist_for_each_entry(temp, &temp_list, entry) {
+		if (rxlev2dbm(temp->rxlev) > -85)
+			entries++;
+	}
+	while(entries) {
+		move = layer23_random() % entries;
+		i = 0;
+		llist_for_each_entry(temp, &temp_list, entry) {
+			if (rxlev2dbm(temp->rxlev) > -85) {
+				if (i == move) {
+					llist_del(&temp->entry);
+					llist_add_tail(&temp->entry,
+						&plmn->sorted_plmn);
+					break;
+				}
+				i++;
+			}
+		}
+		entries--;
+	}
+
+	/* move ohter PLMN in decreasing order */
+	while(1) {
+		found = NULL;
+		llist_for_each_entry(temp, &temp_list, entry) {
+			if (!found
+			 || temp->rxlev > search) {
+				search = temp->rxlev;
+				found = temp;
+			}
+		}
+		if (!found)
+			break;
+		llist_del(&found->entry);
+		llist_add_tail(&found->entry, &plmn->sorted_plmn);
+	}
+
+	/* mark forbidden PLMNs, if in list of forbidden networks */
+	i = 0;
+	llist_for_each_entry(temp, &plmn->sorted_plmn, entry) {
+		llist_for_each_entry(na_entry, &subscr->plmn_na, entry) {
+			if (temp->mcc == na_entry->mcc
+			 && temp->mnc == na_entry->mnc) {
+				temp->cause = na_entry->cause;
+				break;
+			}
+		}
+		LOGP(DPLMN, LOGL_INFO, "Creating Sorted PLMN list. "
+			"(%02d: mcc %s mnc %s allowed %s rx-lev %s)\n",
+			i, gsm_print_mcc(temp->mcc),
+			gsm_print_mnc(temp->mnc), (temp->cause) ? "no ":"yes",
+			gsm_print_rxlev(temp->rxlev));
+		i++;
+	}
+
+	gsm322_dump_sorted_plmn(ms);
+
+	return 0;
+}
+
+/*
+ * handler for automatic search
+ */
+
+/* go On PLMN state */
+static int gsm322_a_go_on_plmn(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm_subscriber *subscr = &ms->subscr;
+
+	new_a_state(plmn, GSM322_A2_ON_PLMN);
+
+	/* start timer, if on VPLMN of home country OR special case */
+	if (!gsm_match_mnc(plmn->mcc, plmn->mnc, subscr->imsi)
+	 && (subscr->always_search_hplmn
+	  || gsm_match_mcc(plmn->mcc, subscr->imsi))
+	 && subscr->sim_valid && subscr->t6m_hplmn)
+		start_plmn_timer(plmn, subscr->t6m_hplmn * 360);
+	else
+		stop_plmn_timer(plmn);
+
+	return 0;
+}
+
+/* go to Wait for PLMNs to appear state */
+static int gsm322_a_go_wait_for_plmns(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct msgb *nmsg;
+	struct gsm322_msg *ngm;
+
+	new_a_state(plmn, GSM322_A4_WAIT_FOR_PLMN);
+
+	/* we must forward this, otherwhise "Any cell selection"
+	 * will not start automatically.
+	 */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_NEW_PLMN);
+	if (!nmsg)
+		return -ENOMEM;
+	ngm = (struct gsm322_msg *) nmsg->data;
+	ngm->limited = 1;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* no (more) PLMN in list */
+static int gsm322_a_no_more_plmn(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct msgb *nmsg;
+	int found;
+
+	/* any allowable PLMN available? */
+	found = gsm322_cs_select(ms, -1, 0, 0, 0);
+
+	/* if no PLMN in list:
+	 * this means that we are at a point where we camp on any cell or
+	 * no cell ist available. */
+	if (found < 0) {
+		if (subscr->plmn_valid) {
+			LOGP(DPLMN, LOGL_INFO, "Not any PLMN allowable. "
+				"Do limited search with RPLMN.\n");
+			plmn->mcc = subscr->plmn_mcc;
+			plmn->mnc = subscr->plmn_mnc;
+		} else
+		if (subscr->sim_valid) {
+			LOGP(DPLMN, LOGL_INFO, "Not any PLMN allowable. "
+				"Do limited search with HPLMN.\n");
+			plmn->mcc = subscr->mcc;
+			plmn->mnc = subscr->mnc;
+		} else {
+			LOGP(DPLMN, LOGL_INFO, "Not any PLMN allowable. "
+				"Do limited search with no PLMN.\n");
+			plmn->mcc = 0;
+			plmn->mnc = 0;
+		}
+
+		return gsm322_a_go_wait_for_plmns(ms, msg);
+	}
+
+	/* select first PLMN in list */
+	plmn->mcc = cs->list[found].sysinfo->mcc;
+	plmn->mnc = cs->list[found].sysinfo->mnc;
+
+	LOGP(DPLMN, LOGL_INFO, "PLMN available after searching PLMN list "
+		"(mcc=%s mnc=%s  %s, %s)\n",
+		gsm_print_mcc(plmn->mcc), gsm_print_mnc(plmn->mnc),
+		gsm_get_mcc(plmn->mcc), gsm_get_mnc(plmn->mcc, plmn->mnc));
+
+	/* indicate New PLMN */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_NEW_PLMN);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	/* go On PLMN */
+	return gsm322_a_go_on_plmn(ms, msg);
+}
+
+/* select first PLMN in list */
+static int gsm322_a_sel_first_plmn(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+	struct gsm322_plmn_list *plmn_entry;
+	struct gsm322_plmn_list *plmn_first = NULL;
+	int i;
+
+	/* generate list */
+	gsm322_sort_list(ms);
+
+	/* select first entry */
+	i = 0;
+	llist_for_each_entry(plmn_entry, &plmn->sorted_plmn, entry) {
+		/* if last selected PLMN was HPLMN, we skip that */
+		if (gsm_match_mnc(plmn_entry->mcc, plmn_entry->mnc,
+					subscr->imsi)
+		 && plmn_entry->mcc == plmn->mcc
+		 && plmn_entry->mnc == plmn->mnc) {
+			LOGP(DPLMN, LOGL_INFO, "Skip HPLMN, because it was "
+				"previously selected.\n");
+			i++;
+			continue;
+		}
+		/* select first allowed network */
+		if (!plmn_entry->cause) {
+			plmn_first = plmn_entry;
+			break;
+		}
+		LOGP(DPLMN, LOGL_INFO, "Skip PLMN (%02d: mcc=%s, mnc=%s), "
+			"because it is not allowed (cause %d).\n", i,
+			gsm_print_mcc(plmn_entry->mcc),
+			gsm_print_mnc(plmn_entry->mnc),
+			plmn_entry->cause);
+		i++;
+	}
+	plmn->plmn_curr = i;
+
+	/* if no PLMN in list */
+	if (!plmn_first) {
+		LOGP(DPLMN, LOGL_INFO, "No PLMN in list.\n");
+		gsm322_a_no_more_plmn(ms, msg);
+
+		return 0;
+	}
+
+	LOGP(DPLMN, LOGL_INFO, "Selecting PLMN from list. (%02d: mcc=%s "
+		"mnc=%s  %s, %s)\n", plmn->plmn_curr,
+		gsm_print_mcc(plmn_first->mcc), gsm_print_mnc(plmn_first->mnc),
+		gsm_get_mcc(plmn_first->mcc),
+		gsm_get_mnc(plmn_first->mcc, plmn_first->mnc));
+
+	/* set current network */
+	plmn->mcc = plmn_first->mcc;
+	plmn->mnc = plmn_first->mnc;
+
+	new_a_state(plmn, GSM322_A3_TRYING_PLMN);
+
+	/* indicate New PLMN */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_NEW_PLMN);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* select next PLMN in list */
+static int gsm322_a_sel_next_plmn(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct msgb *nmsg;
+	struct gsm322_plmn_list *plmn_entry;
+	struct gsm322_plmn_list *plmn_next = NULL;
+	int i, ii;
+
+	/* select next entry from list */
+	i = 0;
+	ii = plmn->plmn_curr + 1;
+	llist_for_each_entry(plmn_entry, &plmn->sorted_plmn, entry) {
+		/* skip previously selected networks */
+		if (i < ii) {
+			i++;
+			continue;
+		}
+		/* select next allowed network */
+		if (!plmn_entry->cause) {
+			plmn_next = plmn_entry;
+			break;
+		}
+		LOGP(DPLMN, LOGL_INFO, "Skip PLMN (%02d: mcc=%s, mnc=%s), "
+			"because it is not allowed (cause %d).\n", i,
+			gsm_print_mcc(plmn_entry->mcc),
+			gsm_print_mnc(plmn_entry->mnc),
+			plmn_entry->cause);
+		i++;
+	}
+	plmn->plmn_curr = i;
+
+	/* if no more PLMN in list */
+	if (!plmn_next) {
+		LOGP(DPLMN, LOGL_INFO, "No more PLMN in list.\n");
+		gsm322_a_no_more_plmn(ms, msg);
+		return 0;
+	}
+
+	/* set next network */
+	plmn->mcc = plmn_next->mcc;
+	plmn->mnc = plmn_next->mnc;
+
+	LOGP(DPLMN, LOGL_INFO, "Selecting PLMN from list. (%02d: mcc=%s "
+		"mnc=%s  %s, %s)\n", plmn->plmn_curr,
+		gsm_print_mcc(plmn->mcc), gsm_print_mnc(plmn->mnc),
+		gsm_get_mcc(plmn->mcc), gsm_get_mnc(plmn->mcc, plmn->mnc));
+
+	new_a_state(plmn, GSM322_A3_TRYING_PLMN);
+
+	/* indicate New PLMN */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_NEW_PLMN);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* User re-selection event */
+static int gsm322_a_user_resel(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm322_plmn_list *plmn_entry;
+	struct gsm322_plmn_list *plmn_found = NULL;
+	struct msgb *nmsg;
+
+	if (!subscr->sim_valid) {
+		return 0;
+	}
+
+	/* try again later, if not idle */
+	if (cs->state == GSM322_CONNECTED_MODE_1
+	 || cs->state == GSM322_CONNECTED_MODE_2) {
+		LOGP(DPLMN, LOGL_INFO, "Not idle, rejecting.\n");
+
+		return 0;
+	}
+
+	/* search current PLMN in list */
+	llist_for_each_entry(plmn_entry, &plmn->sorted_plmn, entry) {
+		if (plmn_entry->mcc == plmn->mcc
+		 && plmn_entry->mnc == plmn->mnc) {
+			plmn_found = plmn_entry;
+			break;
+		}
+	}
+
+	/* abort if list is empty */
+	if (!plmn_found) {
+		LOGP(DPLMN, LOGL_INFO, "Selected PLMN not in list, strange!\n");
+		return 0;
+	}
+
+	LOGP(DPLMN, LOGL_INFO, "Movin selected PLMN to the bottom of the list "
+		"and restarting PLMN search process.\n");
+
+	/* move entry to end of list */
+	llist_del(&plmn_found->entry);
+	llist_add_tail(&plmn_found->entry, &plmn->sorted_plmn);
+
+	/* tell MM that we selected a PLMN */
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_USER_PLMN_SEL);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmevent_msg(ms, nmsg);
+
+	/* select first PLMN in list */
+	return gsm322_a_sel_first_plmn(ms, msg);
+}
+
+/* PLMN becomes available */
+static int gsm322_a_plmn_avail(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+
+	if (subscr->plmn_valid && plmn->mcc == gm->mcc
+	 && plmn->mnc == gm->mnc) {
+		struct msgb *nmsg;
+
+		new_m_state(plmn, GSM322_A1_TRYING_RPLMN);
+
+		LOGP(DPLMN, LOGL_INFO, "Last selected PLMN becomes available "
+			"again.\n");
+
+		/* indicate New PLMN */
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_NEW_PLMN);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_cs_sendmsg(ms, nmsg);
+
+		return 0;
+
+	} else {
+		/* select first PLMN in list */
+		LOGP(DPLMN, LOGL_INFO, "Some PLMN became available, start PLMN "
+			"search process.\n");
+		return gsm322_a_sel_first_plmn(ms, msg);
+	}
+}
+
+/* loss of radio coverage */
+static int gsm322_a_loss_of_radio(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	int found;
+
+	/* any allowable PLMN available */
+	found = gsm322_cs_select(ms, -1, 0, 0, 0);
+
+	/* if PLMN in list */
+	if (found >= 0) {
+		LOGP(DPLMN, LOGL_INFO, "PLMN available (mcc=%s mnc=%s  "
+			"%s, %s)\n", gsm_print_mcc(
+			cs->list[found].sysinfo->mcc),
+			gsm_print_mnc(cs->list[found].sysinfo->mnc),
+			gsm_get_mcc(cs->list[found].sysinfo->mcc),
+			gsm_get_mnc(cs->list[found].sysinfo->mcc,
+				cs->list[found].sysinfo->mnc));
+		return gsm322_a_sel_first_plmn(ms, msg);
+	}
+
+	LOGP(DPLMN, LOGL_INFO, "PLMN not available after loss of coverage.\n");
+
+	return gsm322_a_go_wait_for_plmns(ms, msg);
+}
+
+/* MS is switched on OR SIM is inserted OR removed */
+static int gsm322_a_switch_on(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct msgb *nmsg;
+
+	if (!subscr->sim_valid) {
+		LOGP(DSUM, LOGL_INFO, "SIM is removed\n");
+		LOGP(DPLMN, LOGL_INFO, "SIM is removed\n");
+		new_a_state(plmn, GSM322_A6_NO_SIM);
+
+		return 0;
+	}
+
+	/* if there is a registered PLMN */
+	if (subscr->plmn_valid) {
+		/* select the registered PLMN */
+		plmn->mcc = subscr->plmn_mcc;
+		plmn->mnc = subscr->plmn_mnc;
+
+		LOGP(DSUM, LOGL_INFO, "Start search of last registered PLMN "
+			"(mcc=%s mnc=%s  %s, %s)\n", gsm_print_mcc(plmn->mcc),
+			gsm_print_mnc(plmn->mnc), gsm_get_mcc(plmn->mcc),
+			gsm_get_mnc(plmn->mcc, plmn->mnc));
+		LOGP(DPLMN, LOGL_INFO, "Use RPLMN (mcc=%s mnc=%s  "
+			"%s, %s)\n", gsm_print_mcc(plmn->mcc),
+			gsm_print_mnc(plmn->mnc), gsm_get_mcc(plmn->mcc),
+			gsm_get_mnc(plmn->mcc, plmn->mnc));
+
+		new_a_state(plmn, GSM322_A1_TRYING_RPLMN);
+
+		/* indicate New PLMN */
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_NEW_PLMN);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_cs_sendmsg(ms, nmsg);
+
+		return 0;
+	}
+
+	plmn->mcc = plmn->mnc = 0;
+
+	/* initiate search at cell selection */
+	LOGP(DSUM, LOGL_INFO, "Search for network\n");
+	LOGP(DPLMN, LOGL_INFO, "Switch on, no RPLMN, start PLMN search "
+		"first.\n");
+
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_PLMN_SEARCH_START);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* MS is switched off */
+static int gsm322_a_switch_off(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+
+	new_a_state(plmn, GSM322_A0_NULL);
+
+	return 0;
+}
+
+static int gsm322_a_sim_insert(struct osmocom_ms *ms, struct msgb *msg)
+{
+	LOGP(DPLMN, LOGL_INFO, "SIM already inserted when switched on.\n");
+	return 0;
+}
+
+/* SIM is removed */
+static int gsm322_a_sim_removed(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct msgb *nmsg;
+
+	/* indicate SIM remove to cell selection process */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_SIM_REMOVE);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	/* flush list of PLMNs */
+	gsm_subscr_del_forbidden_plmn(&ms->subscr, 0, 0);
+
+	return gsm322_a_switch_on(ms, msg);
+}
+
+/* location update response: "Roaming not allowed" */
+static int gsm322_a_roaming_na(struct osmocom_ms *ms, struct msgb *msg)
+{
+	/* store in list of forbidden LAs is done in gsm48* */
+
+	return gsm322_a_sel_first_plmn(ms, msg);
+}
+
+/* On VPLMN of home country and timeout occurs */
+static int gsm322_a_hplmn_search_start(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct msgb *nmsg;
+
+	/* try again later, if not idle and not camping */
+	if (cs->state != GSM322_C3_CAMPED_NORMALLY) {
+		LOGP(DPLMN, LOGL_INFO, "Not camping normally, wait some more."
+			"\n");
+		start_plmn_timer(plmn, 60);
+
+		return 0;
+	}
+
+	new_a_state(plmn, GSM322_A5_HPLMN_SEARCH);
+
+	/* initiate search at cell selection */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_HPLMN_SEARCH);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* manual mode selected */
+static int gsm322_a_sel_manual(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct msgb *nmsg;
+
+	/* restart state machine */
+	gsm322_a_switch_off(ms, msg);
+	ms->settings.plmn_mode = PLMN_MODE_MANUAL;
+	gsm322_m_switch_on(ms, msg);
+
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_USER_PLMN_SEL);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmevent_msg(ms, nmsg);
+
+	return 0;
+}
+
+/*
+ * handler for manual search
+ */
+
+/* display PLMNs and to Not on PLMN */
+static int gsm322_m_display_plmns(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+	int msg_type = gm->msg_type;
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm_sub_plmn_list *temp;
+	struct msgb *nmsg;
+	struct gsm322_msg *ngm;
+
+	/* generate list */
+	gsm322_sort_list(ms);
+
+	vty_notify(ms, NULL);
+	switch (msg_type) {
+	case GSM322_EVENT_REG_FAILED:
+		vty_notify(ms, "Failed to register to network %s, %s "
+			"(%s, %s)\n",
+			gsm_print_mcc(plmn->mcc), gsm_print_mnc(plmn->mnc),
+			gsm_get_mcc(plmn->mcc),
+			gsm_get_mnc(plmn->mcc, plmn->mnc));
+		break;
+	case GSM322_EVENT_NO_CELL_FOUND:
+		vty_notify(ms, "No cell found for network %s, %s "
+			"(%s, %s)\n",
+			gsm_print_mcc(plmn->mcc), gsm_print_mnc(plmn->mnc),
+			gsm_get_mcc(plmn->mcc),
+			gsm_get_mnc(plmn->mcc, plmn->mnc));
+		break;
+	case GSM322_EVENT_ROAMING_NA:
+		vty_notify(ms, "Roaming not allowed to network %s, %s "
+			"(%s, %s)\n",
+			gsm_print_mcc(plmn->mcc), gsm_print_mnc(plmn->mnc),
+			gsm_get_mcc(plmn->mcc),
+			gsm_get_mnc(plmn->mcc, plmn->mnc));
+		break;
+	}
+
+	if (llist_empty(&plmn->sorted_plmn))
+		vty_notify(ms, "Search network!\n");
+	else {
+		vty_notify(ms, "Search or select from network:\n");
+		llist_for_each_entry(temp, &plmn->sorted_plmn, entry)
+			vty_notify(ms, " Network %s, %s (%s, %s)\n",
+				gsm_print_mcc(temp->mcc),
+				gsm_print_mnc(temp->mnc),
+				gsm_get_mcc(temp->mcc),
+				gsm_get_mnc(temp->mcc, temp->mnc));
+	}
+
+	/* go Not on PLMN state */
+	new_m_state(plmn, GSM322_M3_NOT_ON_PLMN);
+
+	/* we must forward this, otherwhise "Any cell selection"
+	 * will not start automatically.
+	 * this way we get back to the last PLMN, in case we gained
+	 * our coverage back.
+	 */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_NEW_PLMN);
+	if (!nmsg)
+		return -ENOMEM;
+	ngm = (struct gsm322_msg *) nmsg->data;
+	ngm->limited = 1;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* user starts reselection */
+static int gsm322_m_user_resel(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+
+	/* unselect PLMN. after search, the process will wait until a PLMN is
+	 * selected by the user. this prevents from switching back to the
+	 * last selected PLMN and destroying the list of scanned networks.
+	 */
+	plmn->mcc = plmn->mnc = 0;
+
+	if (!subscr->sim_valid) {
+		return 0;
+	}
+
+	/* try again later, if not idle */
+	if (cs->state == GSM322_CONNECTED_MODE_1
+	 || cs->state == GSM322_CONNECTED_MODE_2) {
+		LOGP(DPLMN, LOGL_INFO, "Not idle, rejecting.\n");
+
+		return 0;
+	}
+
+	/* initiate search at cell selection */
+	LOGP(DPLMN, LOGL_INFO, "User re-select, start PLMN search first.\n");
+
+	/* tell MM that we selected a PLMN */
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_USER_PLMN_SEL);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmevent_msg(ms, nmsg);
+
+	/* triffer PLMN search */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_PLMN_SEARCH_START);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* MS is switched on OR SIM is inserted OR removed */
+static int gsm322_m_switch_on(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct msgb *nmsg;
+
+	if (!subscr->sim_valid) {
+		LOGP(DSUM, LOGL_INFO, "SIM is removed\n");
+		LOGP(DPLMN, LOGL_INFO, "Switch on without SIM.\n");
+		new_m_state(plmn, GSM322_M5_NO_SIM);
+
+		return 0;
+	}
+
+	/* if there is a registered PLMN */
+	if (subscr->plmn_valid) {
+		struct msgb *nmsg;
+
+		/* select the registered PLMN */
+		plmn->mcc = subscr->plmn_mcc;
+		plmn->mnc = subscr->plmn_mnc;
+
+		LOGP(DSUM, LOGL_INFO, "Start search of last registered PLMN "
+			"(mcc=%s mnc=%s  %s, %s)\n", gsm_print_mcc(plmn->mcc),
+			gsm_print_mnc(plmn->mnc), gsm_get_mcc(plmn->mcc),
+			gsm_get_mnc(plmn->mcc, plmn->mnc));
+		LOGP(DPLMN, LOGL_INFO, "Use RPLMN (mcc=%s mnc=%s  "
+			"%s, %s)\n", gsm_print_mcc(plmn->mcc),
+			gsm_print_mnc(plmn->mnc), gsm_get_mcc(plmn->mcc),
+			gsm_get_mnc(plmn->mcc, plmn->mnc));
+
+		new_m_state(plmn, GSM322_M1_TRYING_RPLMN);
+
+		/* indicate New PLMN */
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_NEW_PLMN);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_cs_sendmsg(ms, nmsg);
+
+		return 0;
+	}
+
+	plmn->mcc = plmn->mnc = 0;
+
+	/* initiate search at cell selection */
+	LOGP(DSUM, LOGL_INFO, "Search for network\n");
+	LOGP(DPLMN, LOGL_INFO, "Switch on, start PLMN search first.\n");
+
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_PLMN_SEARCH_START);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* MS is switched off */
+static int gsm322_m_switch_off(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+
+	stop_plmn_timer(plmn);
+
+	new_m_state(plmn, GSM322_M0_NULL);
+
+	return 0;
+}
+
+static int gsm322_m_sim_insert(struct osmocom_ms *ms, struct msgb *msg)
+{
+	LOGP(DPLMN, LOGL_INFO, "SIM already inserted when switched on.\n");
+	return 0;
+}
+
+/* SIM is removed */
+static int gsm322_m_sim_removed(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct msgb *nmsg;
+
+	stop_plmn_timer(plmn);
+
+	/* indicate SIM remove to cell selection process */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_SIM_REMOVE);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	/* flush list of PLMNs */
+	gsm_subscr_del_forbidden_plmn(&ms->subscr, 0, 0);
+
+	return gsm322_m_switch_on(ms, msg);
+}
+
+/* go to On PLMN state */
+static int gsm322_m_go_on_plmn(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm_subscriber *subscr = &ms->subscr;
+
+	/* set last registered PLMN */
+	subscr->plmn_valid = 1;
+	subscr->plmn_mcc = plmn->mcc;
+	subscr->plmn_mnc = plmn->mnc;
+
+	new_m_state(plmn, GSM322_M2_ON_PLMN);
+
+	return 0;
+}
+
+/* previously selected PLMN becomes available again */
+static int gsm322_m_plmn_avail(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct msgb *nmsg;
+
+	new_m_state(plmn, GSM322_M1_TRYING_RPLMN);
+
+	LOGP(DPLMN, LOGL_INFO, "Last selected PLMN becomes available again.\n");
+
+	/* indicate New PLMN */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_NEW_PLMN);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* the user has selected given PLMN */
+static int gsm322_m_choose_plmn(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+	struct msgb *nmsg;
+
+	/* use user selection */
+	plmn->mcc = gm->mcc;
+	plmn->mnc = gm->mnc;
+
+	LOGP(DPLMN, LOGL_INFO, "User selects PLMN. (mcc=%s mnc=%s  "
+		"%s, %s)\n", gsm_print_mcc(plmn->mcc), gsm_print_mnc(plmn->mnc),
+		gsm_get_mcc(plmn->mcc), gsm_get_mnc(plmn->mcc, plmn->mnc));
+
+	/* if selected PLMN is in list of forbidden PLMNs */
+	gsm_subscr_del_forbidden_plmn(subscr, plmn->mcc, plmn->mnc);
+
+	new_m_state(plmn, GSM322_M4_TRYING_PLMN);
+
+	/* tell MM that we selected a PLMN */
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_USER_PLMN_SEL);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmevent_msg(ms, nmsg);
+
+	/* indicate New PLMN */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_NEW_PLMN);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* auto mode selected */
+static int gsm322_m_sel_auto(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct msgb *nmsg;
+
+	/* restart state machine */
+	gsm322_m_switch_off(ms, msg);
+	ms->settings.plmn_mode = PLMN_MODE_AUTO;
+	gsm322_a_switch_on(ms, msg);
+
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_USER_PLMN_SEL);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmevent_msg(ms, nmsg);
+
+	return 0;
+}
+
+/* if no cell is found in other states than in *_TRYING_* states */
+static int gsm322_am_no_cell_found(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct msgb *nmsg;
+
+	/* Tell cell selection process to handle "no cell found". */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_NO_CELL_FOUND);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	return 0;
+}
+
+/*
+ * cell scanning process
+ */
+
+/* select a suitable and allowable cell */
+static int gsm322_cs_select(struct osmocom_ms *ms, int index, uint16_t mcc,
+	uint16_t mnc, int any)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_sysinfo *s;
+	int start, end, i, found = -1, power = 0;
+	uint8_t flags, mask;
+	uint16_t acc_class;
+	int16_t c1;
+	enum gsm_band band;
+	int class;
+
+	/* set our access class depending on the cell selection type */
+	if (any) {
+		acc_class = subscr->acc_class | 0x0400; /* add emergency */
+		LOGP(DCS, LOGL_DEBUG, "Select using access class with "
+			"Emergency class.\n");
+	} else {
+		acc_class = subscr->acc_class;
+		LOGP(DCS, LOGL_DEBUG, "Select using access class \n");
+	}
+
+	/* flags to match */
+	mask = GSM322_CS_FLAG_SUPPORT | GSM322_CS_FLAG_POWER
+		| GSM322_CS_FLAG_SIGNAL | GSM322_CS_FLAG_SYSINFO;
+	if (cs->state == GSM322_C2_STORED_CELL_SEL
+	 || cs->state == GSM322_C5_CHOOSE_CELL)
+		mask |= GSM322_CS_FLAG_BA;
+	flags = mask; /* all masked flags are requied */
+
+	/* loop through all scanned frequencies and select cell.
+	 * if an index is given (arfci), we just check this cell only */
+	if (index >= 0) {
+		start = end = index;
+	} else {
+		start = 0; end = 1023+299;
+	}
+	for (i = start; i <= end; i++) {
+		cs->list[i].flags &= ~GSM322_CS_FLAG_TEMP_AA;
+		s = cs->list[i].sysinfo;
+
+		/* channel has no informations for us */
+		if (!s || (cs->list[i].flags & mask) != flags) {
+			continue;
+		}
+
+		/* check C1 criteria not fullfilled */
+		// TODO: class 3 DCS mobile
+		band = gsm_arfcn2band(index2arfcn(i));
+		class = class_of_band(ms, band);
+		c1 = calculate_c1(DCS, rxlev2dbm(cs->list[i].rxlev),
+			s->rxlev_acc_min_db,
+			ms_pwr_dbm(band, s->ms_txpwr_max_cch),
+			ms_class_gmsk_dbm(band, class));
+		if (!set->stick && c1 < 0) {
+			LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: C1 criterion "
+				"not met. (C1 = %d)\n",
+				gsm_print_arfcn(index2arfcn(i)), c1);
+			continue;
+		}
+
+		/* if cell is barred and we don't override */
+		if (!subscr->acc_barr
+		 && (cs->list[i].flags & GSM322_CS_FLAG_BARRED)) {
+			LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: Cell is "
+				"barred.\n", gsm_print_arfcn(index2arfcn(i)));
+			continue;
+		}
+
+		/* if we have no access to the cell and we don't override */
+		if (!subscr->acc_barr
+		 && !(acc_class & (s->class_barr ^ 0xffff))) {
+			LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: Class is "
+				"barred for our access. (access=%04x "
+				"barred=%04x)\n",
+				gsm_print_arfcn(index2arfcn(i)),
+				acc_class, s->class_barr);
+			continue;
+		}
+
+		/* store temporary available and allowable flag */
+		cs->list[i].flags |= GSM322_CS_FLAG_TEMP_AA;
+
+		/* if cell is in list of forbidden LAs */
+		if ((cs->list[i].flags & GSM322_CS_FLAG_FORBIDD)) {
+			if (!any) {
+				LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: Cell is "
+					"in list of forbidden LAs. (mcc=%s "
+					"mnc=%s lai=%04x)\n",
+					gsm_print_arfcn(index2arfcn(i)),
+					gsm_print_mcc(s->mcc),
+					gsm_print_mnc(s->mnc), s->lac);
+				continue;
+			}
+			LOGP(DCS, LOGL_INFO, "Accept ARFCN %s: Cell is in "
+				"list of forbidden LAs, but we search for any "
+				"cell. (mcc=%s mnc=%s lai=%04x)\n",
+				gsm_print_arfcn(index2arfcn(i)),
+				gsm_print_mcc(s->mcc),
+				gsm_print_mnc(s->mnc), s->lac);
+			cs->list[i].flags &= ~GSM322_CS_FLAG_TEMP_AA;
+		}
+
+		/* if cell is in list of forbidden PLMNs */
+		if (gsm_subscr_is_forbidden_plmn(subscr, s->mcc, s->mnc)) {
+			if (!any) {
+				LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: Cell is "
+					"in list of forbidden PLMNs. (mcc=%s "
+					"mnc=%s)\n",
+					gsm_print_arfcn(index2arfcn(i)),
+					gsm_print_mcc(s->mcc),
+					gsm_print_mnc(s->mnc));
+				continue;
+			}
+			LOGP(DCS, LOGL_INFO, "Accept ARFCN %s: Cell is in list "
+				"of forbidden PLMNs, but we search for any "
+				"cell. (mcc=%s mnc=%s)\n",
+				gsm_print_arfcn(index2arfcn(i)),
+				gsm_print_mcc(s->mcc), gsm_print_mnc(s->mnc));
+			cs->list[i].flags &= ~GSM322_CS_FLAG_TEMP_AA;
+		}
+
+		/* if we search a specific PLMN, but it does not match */
+		if (!any && mcc && (mcc != s->mcc
+				|| mnc != s->mnc)) {
+			LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: PLMN of cell "
+				"does not match target PLMN. (mcc=%s "
+				"mnc=%s)\n", gsm_print_arfcn(index2arfcn(i)),
+				gsm_print_mcc(s->mcc),
+				gsm_print_mnc(s->mnc));
+			continue;
+		}
+
+		LOGP(DCS, LOGL_INFO, "Cell ARFCN %s: Cell found, (rxlev=%s "
+			"mcc=%s mnc=%s lac=%04x  %s, %s)\n",
+				gsm_print_arfcn(index2arfcn(i)),
+			gsm_print_rxlev(cs->list[i].rxlev),
+			gsm_print_mcc(s->mcc), gsm_print_mnc(s->mnc), s->lac,
+			gsm_get_mcc(s->mcc), gsm_get_mnc(s->mcc, s->mnc));
+
+		/* find highest power cell */
+		if (found < 0 || cs->list[i].rxlev > power) {
+			power = cs->list[i].rxlev;
+			found = i;
+		}
+	}
+
+	if (found >= 0)
+		LOGP(DCS, LOGL_INFO, "Cell ARFCN %s selected.\n",
+			gsm_print_arfcn(index2arfcn(found)));
+
+	return found;
+}
+
+/* re-select a suitable and allowable cell */
+static int gsm322_cs_reselect(struct osmocom_ms *ms, uint16_t mcc,
+	uint16_t mnc, int any)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_sysinfo *s = cs->si;
+	int i = cs->arfci;
+	uint16_t acc_class;
+
+	/* set our access class depending on the cell selection type */
+	if (any) {
+		acc_class = subscr->acc_class | 0x0400; /* add emergency */
+		LOGP(DCS, LOGL_DEBUG, "Select using access class with "
+			"Emergency class.\n");
+	} else {
+		acc_class = subscr->acc_class;
+		LOGP(DCS, LOGL_DEBUG, "Select using access class \n");
+	}
+
+	/* if cell is barred and we don't override */
+	if (!subscr->acc_barr
+	 && (cs->list[i].flags & GSM322_CS_FLAG_BARRED)) {
+		LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: Cell is barred.\n",
+			gsm_print_arfcn(index2arfcn(i)));
+		return -1;
+	}
+
+	/* if cell is in list of forbidden LAs */
+	if (!any && (cs->list[i].flags & GSM322_CS_FLAG_FORBIDD)) {
+		LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: Cell is in list of "
+			"forbidden LAs. (mcc=%s mnc=%s lai=%04x)\n",
+			gsm_print_arfcn(index2arfcn(i)), gsm_print_mcc(s->mcc),
+			gsm_print_mnc(s->mnc), s->lac);
+		return -1;
+	}
+
+	/* if cell is in list of forbidden PLMNs */
+	if (!any && gsm_subscr_is_forbidden_plmn(subscr, s->mcc, s->mnc)) {
+		LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: Cell is in "
+			"list of forbidden PLMNs. (mcc=%s mnc=%s)\n",
+			gsm_print_arfcn(index2arfcn(i)),
+			gsm_print_mcc(s->mcc), gsm_print_mnc(s->mnc));
+		return -1;
+	}
+
+	/* if we have no access to the cell and we don't override */
+	if (!subscr->acc_barr
+	 && !(acc_class & (s->class_barr ^ 0xffff))) {
+		LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: Class is barred for our "
+			"access. (access=%04x barred=%04x)\n",
+			gsm_print_arfcn(index2arfcn(i)), acc_class,
+			s->class_barr);
+		return -1;
+	}
+
+	/* if we search a specific PLMN, but it does not match */
+	if (!any && mcc && (mcc != s->mcc
+			|| mnc != s->mnc)) {
+		LOGP(DCS, LOGL_INFO, "Skip ARFCN %s: PLMN of cell "
+			"does not match target PLMN. (mcc=%s mnc=%s)\n",
+			gsm_print_arfcn(index2arfcn(i)), gsm_print_mcc(s->mcc),
+			gsm_print_mnc(s->mnc));
+		return -1;
+	}
+
+	LOGP(DCS, LOGL_INFO, "Cell ARFCN %s: Neighbour cell accepted, "
+		"(rxlev=%s mcc=%s mnc=%s lac=%04x  %s, %s)\n",
+		gsm_print_arfcn(index2arfcn(i)),
+		gsm_print_rxlev(cs->list[i].rxlev),
+		gsm_print_mcc(s->mcc), gsm_print_mnc(s->mnc), s->lac,
+		gsm_get_mcc(s->mcc), gsm_get_mnc(s->mcc, s->mnc));
+
+	return i;
+}
+
+/* this processes the end of frequency scanning or cell searches */
+static int gsm322_search_end(struct osmocom_ms *ms)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct msgb *nmsg;
+	struct gsm322_msg *ngm;
+	int msg_type = -1; /* no message to be sent */
+	int tune_back = 0, mcc = 0, mnc = 0;
+	int found;
+
+	switch (cs->state) {
+	case GSM322_ANY_SEARCH:
+		/* special case for 'any cell' search */
+		LOGP(DCS, LOGL_INFO, "Any cell search finished.\n");
+
+		/* create AA flag */
+		found = gsm322_cs_select(ms, -1, 0, 0, 0);
+
+		/* if no cell is found, or if we don't wait for any available
+		 * and allowable PLMN to appear, we just continue to camp */
+		if (ms->settings.plmn_mode != PLMN_MODE_AUTO
+		 || plmn->state != GSM322_A4_WAIT_FOR_PLMN
+		 || found < 0) {
+			tune_back = 1;
+			gsm322_c_camp_any_cell(ms, NULL);
+			break;
+		}
+
+		/* indicate available PLMN, include selected PLMN, if found */
+		msg_type = GSM322_EVENT_PLMN_AVAIL;
+		if (gsm322_is_plmn_avail_and_allow(cs, plmn->mcc, plmn->mnc)) {
+			/* set what PLMN becomes available */
+			mcc = plmn->mcc;
+			mnc = plmn->mnc;
+		}
+
+		new_c_state(cs, GSM322_C0_NULL);
+
+		break;
+
+	case GSM322_PLMN_SEARCH:
+		/* special case for PLMN search */
+		msg_type = GSM322_EVENT_PLMN_SEARCH_END;
+		LOGP(DCS, LOGL_INFO, "PLMN search finished.\n");
+
+		/* create AA flag */
+		gsm322_cs_select(ms, -1, 0, 0, 0);
+
+		new_c_state(cs, GSM322_C0_NULL);
+
+		break;
+
+	case GSM322_HPLMN_SEARCH:
+		/* special case for HPLMN search */
+		msg_type = GSM322_EVENT_NO_CELL_FOUND;
+		LOGP(DCS, LOGL_INFO, "HPLMN search finished, no cell.\n");
+
+		new_c_state(cs, GSM322_C3_CAMPED_NORMALLY);
+
+		tune_back = 1;
+
+		break;
+
+	default:
+		/* we start normal cell selection if this fails */
+		if (cs->state == GSM322_C2_STORED_CELL_SEL
+		 || cs->state == GSM322_C5_CHOOSE_CELL) {
+			/* tell CS to start over */
+			nmsg = gsm322_msgb_alloc(GSM322_EVENT_NO_CELL_FOUND);
+			if (!nmsg)
+				return -ENOMEM;
+			gsm322_c_event(ms, nmsg);
+			msgb_free(nmsg);
+
+			break;
+		}
+
+		/* on other cell selection, indicate "no cell found" */
+		/* NOTE: PLMN search process handles it.
+		 * If not handled there, CS process gets indicated.
+		 * If we would continue to process CS, then we might get
+		 * our list of scanned cells disturbed.
+		 */
+		LOGP(DCS, LOGL_INFO, "Cell search finished without result.\n");
+		msg_type = GSM322_EVENT_NO_CELL_FOUND;
+
+		/* stay in null-state until any cell selectio is triggered or
+		 * new plmn is indicated.
+		 */
+		new_c_state(cs, GSM322_C0_NULL);
+	}
+
+	if (msg_type > -1) {
+		/* send result to PLMN process, to trigger next CS event */
+		nmsg = gsm322_msgb_alloc(msg_type);
+		if (!nmsg)
+			return -ENOMEM;
+		ngm = (struct gsm322_msg *) nmsg->data;
+		ngm->mcc = mcc;
+		ngm->mnc = mnc;
+		gsm322_plmn_sendmsg(ms, nmsg);
+	}
+
+	if (cs->selected && tune_back) {
+		/* tuning back */
+		cs->arfcn = cs->sel_arfcn;
+		cs->arfci = arfcn2index(cs->arfcn);
+		if (!cs->list[cs->arfci].sysinfo)
+			cs->list[cs->arfci].sysinfo = talloc_zero(ms,
+							struct gsm48_sysinfo);
+		if (!cs->list[cs->arfci].sysinfo)
+			exit(-ENOMEM);
+		cs->list[cs->arfci].flags |= GSM322_CS_FLAG_SYSINFO;
+		memcpy(cs->list[cs->arfci].sysinfo, &cs->sel_si,
+			sizeof(struct gsm48_sysinfo));
+		cs->si = cs->list[cs->arfci].sysinfo;
+		cs->sel_mcc = cs->si->mcc;
+		cs->sel_mnc = cs->si->mnc;
+		cs->sel_lac = cs->si->lac;
+		cs->sel_id = cs->si->cell_id;
+		LOGP(DCS, LOGL_INFO, "Tuning back to frequency %s after full "
+			"search.\n", gsm_print_arfcn(cs->arfcn));
+		cs->sync_retries = SYNC_RETRIES;
+		gsm322_sync_to_cell(cs, NULL, 0);
+	}
+
+	return 0;
+}
+
+
+/* tune to first/next unscanned frequency and search for PLMN */
+static int gsm322_cs_scan(struct osmocom_ms *ms)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	int i;
+	int j, band = 0;
+	uint8_t mask, flags;
+	uint32_t weight = 0, test = cs->scan_state;
+
+	/* search for strongest unscanned cell */
+	mask = GSM322_CS_FLAG_SUPPORT | GSM322_CS_FLAG_POWER
+		| GSM322_CS_FLAG_SIGNAL;
+	if (cs->state == GSM322_C2_STORED_CELL_SEL
+	 || cs->state == GSM322_C5_CHOOSE_CELL)
+		mask |= GSM322_CS_FLAG_BA;
+	flags = mask; /* all masked flags are requied */
+	for (i = 0; i <= 1023+299; i++) {
+		j = 0; /* make gcc happy */
+		if (!ms->settings.skip_max_per_band) {
+			/* skip if band has enough freqs. scanned (3.2.1) */
+			for (j = 0; gsm_sup_smax[j].max; j++) {
+				if (gsm_sup_smax[j].end >
+						gsm_sup_smax[j].start) {
+					if (gsm_sup_smax[j].start <= i
+					 && gsm_sup_smax[j].end >= i)
+						break;
+				} else {
+					if (gsm_sup_smax[j].start <= i
+					 && 1023 >= i)
+						break;
+					if (0 <= i
+					 && gsm_sup_smax[j].end >= i)
+						break;
+				}
+			}
+			if (gsm_sup_smax[j].max) {
+				if (gsm_sup_smax[j].temp == gsm_sup_smax[j].max)
+					continue;
+			}
+		}
+
+		/* search for unscanned frequency */
+		if ((cs->list[i].flags & mask) == flags) {
+			/* weight depends on the power level
+			 * if it is the same, it depends on arfcn
+			 */
+			test = cs->list[i].rxlev + 1;
+			test = (test << 16) | i;
+			if (test >= cs->scan_state)
+				continue;
+			if (test > weight) {
+				weight = test;
+				band = j;
+			}
+
+		}
+	}
+	cs->scan_state = weight;
+
+	/* if all frequencies have been searched */
+	if (!weight) {
+		gsm322_dump_cs_list(cs, GSM322_CS_FLAG_SYSINFO, print_dcs,
+			NULL);
+
+		/* selection process done, process (negative) result */
+		return gsm322_search_end(ms);
+	}
+
+	/* NOTE: We might already have system information from previous
+	 * scan. But we need recent informations, so we scan again!
+	 */
+
+	/* Tune to frequency for a while, to receive broadcasts. */
+	cs->arfci = weight & 0xffff;
+	cs->arfcn = index2arfcn(cs->arfci);
+	LOGP(DCS, LOGL_DEBUG, "Scanning frequency %s (rxlev %s).\n",
+		gsm_print_arfcn(cs->arfcn),
+		gsm_print_rxlev(cs->list[cs->arfci].rxlev));
+
+	/* Allocate/clean system information. */
+	cs->list[cs->arfci].flags &= ~GSM322_CS_FLAG_SYSINFO;
+	if (cs->list[cs->arfci].sysinfo)
+		memset(cs->list[cs->arfci].sysinfo, 0,
+			sizeof(struct gsm48_sysinfo));
+	else
+		cs->list[cs->arfci].sysinfo = talloc_zero(ms,
+						struct gsm48_sysinfo);
+	if (!cs->list[cs->arfci].sysinfo)
+		exit(-ENOMEM);
+	cs->si = cs->list[cs->arfci].sysinfo;
+	cs->sync_retries = 0;
+	gsm322_sync_to_cell(cs, NULL, 0);
+
+	/* increase scan counter for each maximum scan range */
+	if (!ms->settings.skip_max_per_band && gsm_sup_smax[band].max) {
+		LOGP(DCS, LOGL_DEBUG, "%d frequencies left in band %d..%d\n",
+			gsm_sup_smax[band].max - gsm_sup_smax[band].temp,
+			gsm_sup_smax[band].start, gsm_sup_smax[band].end);
+		gsm_sup_smax[band].temp++;
+	}
+
+	return 0;
+}
+
+/* check if cell is now suitable and allowable */
+static int gsm322_cs_store(struct osmocom_ms *ms)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct msgb *nmsg;
+	struct gsm322_msg *ngm;
+	int found, any = 0;
+
+	if (cs->state != GSM322_C2_STORED_CELL_SEL
+	 && cs->state != GSM322_C1_NORMAL_CELL_SEL
+	 && cs->state != GSM322_C6_ANY_CELL_SEL
+	 && cs->state != GSM322_C4_NORMAL_CELL_RESEL
+	 && cs->state != GSM322_C8_ANY_CELL_RESEL
+	 && cs->state != GSM322_C5_CHOOSE_CELL
+	 && cs->state != GSM322_C9_CHOOSE_ANY_CELL
+	 && cs->state != GSM322_ANY_SEARCH
+	 && cs->state != GSM322_PLMN_SEARCH
+	 && cs->state != GSM322_HPLMN_SEARCH) {
+		LOGP(DCS, LOGL_FATAL, "This must only happen during cell "
+			"(re-)selection, please fix!\n");
+		return -EINVAL;
+	}
+
+	/* store sysinfo */
+	cs->list[cs->arfci].flags |= GSM322_CS_FLAG_SYSINFO;
+	if (s->cell_barr && !(s->sp && s->sp_cbq))
+		cs->list[cs->arfci].flags |= GSM322_CS_FLAG_BARRED;
+	else
+		cs->list[cs->arfci].flags &= ~GSM322_CS_FLAG_BARRED;
+
+	/* store selected network */
+	if (s->mcc) {
+		if (gsm322_is_forbidden_la(ms, s->mcc, s->mnc, s->lac))
+			cs->list[cs->arfci].flags |= GSM322_CS_FLAG_FORBIDD;
+		else
+			cs->list[cs->arfci].flags &= ~GSM322_CS_FLAG_FORBIDD;
+	}
+
+	LOGP(DCS, LOGL_DEBUG, "Scan frequency %s: Cell found. (rxlev %s "
+		"mcc %s mnc %s lac %04x)\n", gsm_print_arfcn(cs->arfcn),
+		gsm_print_rxlev(cs->list[cs->arfci].rxlev),
+		gsm_print_mcc(s->mcc), gsm_print_mnc(s->mnc), s->lac);
+
+	/* selected PLMN (auto) becomes available during "any search" */
+	if (ms->settings.plmn_mode == PLMN_MODE_AUTO
+	 && (cs->state == GSM322_ANY_SEARCH
+	  || cs->state == GSM322_C6_ANY_CELL_SEL
+	  || cs->state == GSM322_C8_ANY_CELL_RESEL
+	  || cs->state == GSM322_C9_CHOOSE_ANY_CELL)
+	 && plmn->state == GSM322_A4_WAIT_FOR_PLMN
+	 && s->mcc == plmn->mcc && s->mnc == plmn->mnc) {
+		LOGP(DCS, LOGL_INFO, "Candidate network to become available "
+			"again\n");
+		found = gsm322_cs_select(ms, cs->arfci, s->mcc, s->mnc, 0);
+		if (found >= 0) {
+			LOGP(DCS, LOGL_INFO, "Selected PLMN in \"A4_WAIT_F"
+				"OR_PLMN\" state becomes available.\n");
+indicate_plmn_avail:
+			/* PLMN becomes available */
+			nmsg = gsm322_msgb_alloc(GSM322_EVENT_PLMN_AVAIL);
+			if (!nmsg)
+				return -ENOMEM;
+			/* set what PLMN becomes available */
+			ngm = (struct gsm322_msg *) nmsg->data;
+			ngm->mcc = plmn->mcc;
+			ngm->mnc = plmn->mcc;
+			gsm322_plmn_sendmsg(ms, nmsg);
+
+			new_c_state(cs, GSM322_C0_NULL);
+
+			return 0;
+		}
+	}
+
+	/* selected PLMN (manual) becomes available during "any search" */
+	if (ms->settings.plmn_mode == PLMN_MODE_MANUAL
+	 && (cs->state == GSM322_ANY_SEARCH
+	  || cs->state == GSM322_C6_ANY_CELL_SEL
+	  || cs->state == GSM322_C8_ANY_CELL_RESEL
+	  || cs->state == GSM322_C9_CHOOSE_ANY_CELL)
+	 && plmn->state == GSM322_M3_NOT_ON_PLMN
+	 && s->mcc == plmn->mcc && s->mnc == plmn->mnc) {
+		LOGP(DCS, LOGL_INFO, "Candidate network to become available "
+			"again\n");
+		found = gsm322_cs_select(ms, cs->arfci, s->mcc, s->mnc, 0);
+		if (found >= 0) {
+			LOGP(DCS, LOGL_INFO, "Current selected PLMN in \"M3_N"
+				"OT_ON_PLMN\" state becomes available.\n");
+			goto indicate_plmn_avail;
+		}
+	}
+
+	/* special case for PLMN search */
+	if (cs->state == GSM322_PLMN_SEARCH
+	 || cs->state == GSM322_ANY_SEARCH)
+		/* tune to next cell */
+		return gsm322_cs_scan(ms);
+
+	/* special case for HPLMN search */
+	if (cs->state == GSM322_HPLMN_SEARCH) {
+		struct gsm_subscriber *subscr = &ms->subscr;
+		struct msgb *nmsg;
+
+		if (!gsm322_is_hplmn_avail(cs, subscr->imsi))
+			/* tune to next cell */
+			return gsm322_cs_scan(ms);
+
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_CELL_FOUND);
+		LOGP(DCS, LOGL_INFO, "HPLMN search finished, cell found.\n");
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_plmn_sendmsg(ms, nmsg);
+
+		return 0;
+	}
+
+	/* just see, if we search for any cell */
+	if (cs->state == GSM322_C6_ANY_CELL_SEL
+	 || cs->state == GSM322_C8_ANY_CELL_RESEL
+	 || cs->state == GSM322_C9_CHOOSE_ANY_CELL)
+		any = 1;
+
+	if (cs->state == GSM322_C4_NORMAL_CELL_RESEL
+	 || cs->state == GSM322_C8_ANY_CELL_RESEL)
+		found = gsm322_cs_reselect(ms, cs->mcc, cs->mnc, any);
+	else
+		found = gsm322_cs_select(ms, -1, cs->mcc, cs->mnc, any);
+
+	/* if not found */
+	if (found < 0) {
+		LOGP(DCS, LOGL_INFO, "Cell not suitable and allowable.\n");
+		/* tune to next cell */
+		if (cs->state == GSM322_C4_NORMAL_CELL_RESEL
+		 || cs->state == GSM322_C8_ANY_CELL_RESEL)
+			return gsm322_nb_scan(ms);
+		else
+			return gsm322_cs_scan(ms);
+	}
+
+	LOGP(DCS, LOGL_INFO, "Tune to frequency %d.\n", found);
+	/* tune */
+	cs->arfci = found;
+	cs->arfcn = index2arfcn(cs->arfci);
+	cs->si = cs->list[cs->arfci].sysinfo;
+	cs->sync_retries = SYNC_RETRIES;
+	gsm322_sync_to_cell(cs, NULL, 0);
+
+	/* set selected cell */
+	cs->selected = 1;
+	cs->sel_arfcn = cs->arfcn;
+	memcpy(&cs->sel_si, cs->si, sizeof(cs->sel_si));
+	cs->sel_mcc = cs->si->mcc;
+	cs->sel_mnc = cs->si->mnc;
+	cs->sel_lac = cs->si->lac;
+	cs->sel_id = cs->si->cell_id;
+	if (ms->rrlayer.monitor) {
+		vty_notify(ms, "MON: %scell selected ARFCN=%s MCC=%s MNC=%s "
+			"LAC=0x%04x cellid=0x%04x (%s %s)\n",
+			(any) ? "any " : "", gsm_print_arfcn(cs->sel_arfcn),
+			gsm_print_mcc(cs->sel_mcc), gsm_print_mnc(cs->sel_mnc),
+			cs->sel_lac, cs->sel_id,
+			gsm_get_mcc(cs->sel_mcc),
+				gsm_get_mnc(cs->sel_mcc, cs->sel_mnc));
+	}
+
+	/* tell CS process about available cell */
+	LOGP(DCS, LOGL_INFO, "Cell available.\n");
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_CELL_FOUND);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_c_event(ms, nmsg);
+	msgb_free(nmsg);
+
+	return 0;
+}
+
+/* process system information when returing to idle mode */
+struct gsm322_ba_list *gsm322_cs_sysinfo_sacch(struct osmocom_ms *ms)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s;
+	struct gsm322_ba_list *ba = NULL;
+	int i, refer_pcs;
+	uint8_t freq[128+38];
+
+	if (!cs) {
+		LOGP(DCS, LOGL_INFO, "No BA, because no cell selected\n");
+		return ba;
+	}
+	s = cs->si;
+	if (!s) {
+		LOGP(DCS, LOGL_INFO, "No BA, because no sysinfo\n");
+		return ba;
+	}
+
+	/* collect system information received during dedicated mode */
+	if (s->si5 && (!s->nb_ext_ind_si5 || s->si5bis)) {
+		/* find or create ba list */
+		ba = gsm322_find_ba_list(cs, s->mcc, s->mnc);
+		if (!ba) {
+			ba = talloc_zero(ms, struct gsm322_ba_list);
+			if (!ba)
+				return NULL;
+			ba->mcc = s->mcc;
+			ba->mnc = s->mnc;
+			llist_add_tail(&ba->entry, &cs->ba_list);
+		}
+		/* update (add) ba list */
+		refer_pcs = gsm_refer_pcs(cs->arfcn, s);
+		memset(freq, 0, sizeof(freq));
+		for (i = 0; i <= 1023; i++) {
+			if ((s->freq[i].mask & (FREQ_TYPE_SERV
+				| FREQ_TYPE_NCELL | FREQ_TYPE_REP))) {
+				if (refer_pcs && i >= 512 && i <= 810)
+					freq[(i-512+1024) >> 3] |= (1 << (i&7));
+				else
+					freq[i >> 3] |= (1 << (i & 7));
+			}
+		}
+		if (!!memcmp(freq, ba->freq, sizeof(freq))) {
+			LOGP(DCS, LOGL_INFO, "New BA list (mcc=%s mnc=%s  "
+				"%s, %s).\n", gsm_print_mcc(ba->mcc),
+				gsm_print_mnc(ba->mnc), gsm_get_mcc(ba->mcc),
+				gsm_get_mnc(ba->mcc, ba->mnc));
+			memcpy(ba->freq, freq, sizeof(freq));
+		}
+	}
+
+	return ba;
+}
+
+/* store BA whenever a system informations changes */
+static int gsm322_store_ba_list(struct gsm322_cellsel *cs,
+	struct gsm48_sysinfo *s)
+{
+	struct gsm322_ba_list *ba;
+	int i, refer_pcs;
+	uint8_t freq[128+38];
+
+	/* find or create ba list */
+	ba = gsm322_find_ba_list(cs, s->mcc, s->mnc);
+	if (!ba) {
+		ba = talloc_zero(cs->ms, struct gsm322_ba_list);
+		if (!ba)
+			return -ENOMEM;
+		ba->mcc = s->mcc;
+		ba->mnc = s->mnc;
+		llist_add_tail(&ba->entry, &cs->ba_list);
+	}
+	/* update ba list */
+	refer_pcs = gsm_refer_pcs(cs->arfcn, s);
+	memset(freq, 0, sizeof(freq));
+	freq[(cs->arfci) >> 3] |= (1 << (cs->arfci & 7));
+	for (i = 0; i <= 1023; i++) {
+		if ((s->freq[i].mask &
+		    (FREQ_TYPE_SERV | FREQ_TYPE_NCELL | FREQ_TYPE_REP))) {
+			if (refer_pcs && i >= 512 && i <= 810)
+				freq[(i-512+1024) >> 3] |= (1 << (i & 7));
+			else
+				freq[i >> 3] |= (1 << (i & 7));
+		}
+	}
+	if (!!memcmp(freq, ba->freq, sizeof(freq))) {
+		LOGP(DCS, LOGL_INFO, "New BA list (mcc=%s mnc=%s  "
+			"%s, %s).\n", gsm_print_mcc(ba->mcc),
+			gsm_print_mnc(ba->mnc), gsm_get_mcc(ba->mcc),
+			gsm_get_mnc(ba->mcc, ba->mnc));
+		memcpy(ba->freq, freq, sizeof(freq));
+	}
+
+	return 0;
+}
+
+/* process system information during camping on a cell */
+static int gsm322_c_camp_sysinfo_bcch(struct osmocom_ms *ms, struct msgb *msg)
+{
+//	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+	struct msgb *nmsg;
+
+	/* start in case we are camping on neighbour cell */
+	if ((cs->state == GSM322_C3_CAMPED_NORMALLY
+	  || cs->state == GSM322_C7_CAMPED_ANY_CELL)
+	 && (cs->neighbour)) {
+		if (s->si3 || s->si4) {
+			stop_cs_timer(cs);
+			LOGP(DCS, LOGL_INFO, "Relevant sysinfo of neighbour "
+				"cell is now received or updated.\n");
+			return gsm322_nb_read(cs, 1);
+		}
+		return 0;
+	}
+
+	/* Store BA if we have full system info about cells and neigbor cells.
+	 * Depending on the extended bit in the channel description,
+	 * we require more or less system informations about neighbor cells
+	 */
+	if (s->mcc
+	 && s->mnc
+	 && (gm->sysinfo == GSM48_MT_RR_SYSINFO_1
+	  || gm->sysinfo == GSM48_MT_RR_SYSINFO_2
+	  || gm->sysinfo == GSM48_MT_RR_SYSINFO_2bis
+	  || gm->sysinfo == GSM48_MT_RR_SYSINFO_2ter)
+	 && s->si1
+	 && s->si2
+	 && (!s->nb_ext_ind_si2
+	  || (s->si2bis && s->nb_ext_ind_si2 && !s->nb_ext_ind_si2bis)
+	  || (s->si2bis && s->si2ter && s->nb_ext_ind_si2
+		&& s->nb_ext_ind_si2bis)))
+		gsm322_store_ba_list(cs, s);
+
+	/* update sel_si, if all relevant system informations received */
+	if (s->si1 && s->si2 && s->si3
+	 && (!s->nb_ext_ind_si2
+	  || (s->si2bis && s->nb_ext_ind_si2 && !s->nb_ext_ind_si2bis)
+	  || (s->si2bis && s->si2ter && s->nb_ext_ind_si2
+		&& s->nb_ext_ind_si2bis))) {
+		if (cs->selected) {
+			LOGP(DCS, LOGL_INFO, "Sysinfo of selected cell is "
+				"now received or updated.\n");
+			memcpy(&cs->sel_si, s, sizeof(cs->sel_si));
+
+			/* start in case we are camping on serving cell */
+			if (cs->state == GSM322_C3_CAMPED_NORMALLY
+			 || cs->state == GSM322_C7_CAMPED_ANY_CELL)
+				gsm322_nb_start(ms, 0);
+		}
+	}
+
+	/* check for barred cell */
+	if (gm->sysinfo == GSM48_MT_RR_SYSINFO_1) {
+		/* check if cell becomes barred */
+		if (!subscr->acc_barr && s->cell_barr
+		 && !(cs->list[cs->arfci].sysinfo
+		   && cs->list[cs->arfci].sysinfo->sp
+		   && cs->list[cs->arfci].sysinfo->sp_cbq)) {
+			LOGP(DCS, LOGL_INFO, "Cell becomes barred.\n");
+			if (ms->rrlayer.monitor)
+				vty_notify(ms, "MON: trigger cell re-selection"
+					": cell becomes barred\n");
+			trigger_resel:
+			/* mark cell as unscanned */
+			cs->list[cs->arfci].flags &= ~GSM322_CS_FLAG_SYSINFO;
+			if (cs->list[cs->arfci].sysinfo) {
+				LOGP(DCS, LOGL_DEBUG, "free sysinfo arfcn=%s\n",
+					gsm_print_arfcn(cs->arfcn));
+				talloc_free(cs->list[cs->arfci].sysinfo);
+				cs->list[cs->arfci].sysinfo = NULL;
+			}
+			/* trigger reselection without queueing,
+			 * because other sysinfo message may be queued
+			 * before
+			 */
+			nmsg = gsm322_msgb_alloc(GSM322_EVENT_CELL_RESEL);
+			if (!nmsg)
+				return -ENOMEM;
+			gsm322_c_event(ms, nmsg);
+			msgb_free(nmsg);
+
+			return 0;
+		}
+		/* check if cell access becomes barred */
+		if (!((subscr->acc_class & 0xfbff)
+			& (s->class_barr ^ 0xffff))) {
+			LOGP(DCS, LOGL_INFO, "Cell access becomes barred.\n");
+			if (ms->rrlayer.monitor)
+				vty_notify(ms, "MON: trigger cell re-selection"
+					": access to cell becomes barred\n");
+			goto trigger_resel;
+		}
+	}
+
+	/* check if MCC, MNC, LAC, cell ID changes */
+	if (cs->sel_mcc != s->mcc || cs->sel_mnc != s->mnc
+	 || cs->sel_lac != s->lac) {
+		LOGP(DCS, LOGL_NOTICE, "Cell changes location area. "
+			"This is not good!\n");
+		if (ms->rrlayer.monitor)
+			vty_notify(ms, "MON: trigger cell re-selection: "
+				"cell changes LAI\n");
+		goto trigger_resel;
+	}
+	if (cs->sel_id != s->cell_id) {
+		LOGP(DCS, LOGL_NOTICE, "Cell changes cell ID. "
+			"This is not good!\n");
+		if (ms->rrlayer.monitor)
+			vty_notify(ms, "MON: trigger cell re-selection: "
+				"cell changes cell ID\n");
+		goto trigger_resel;
+	}
+
+	return 0;
+}
+
+/* process system information during channel scanning */
+static int gsm322_c_scan_sysinfo_bcch(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+
+	/* no sysinfo if we are not done with power scan */
+	if (cs->powerscan) {
+		LOGP(DCS, LOGL_INFO, "Ignoring sysinfo during power scan.\n");
+		return -EINVAL;
+	}
+
+	/* Store BA if we have full system info about cells and neigbor cells.
+	 * Depending on the extended bit in the channel description,
+	 * we require more or less system informations about neighbor cells
+	 */
+	if (s->mcc
+	 && s->mnc
+	 && (gm->sysinfo == GSM48_MT_RR_SYSINFO_1
+	  || gm->sysinfo == GSM48_MT_RR_SYSINFO_2
+	  || gm->sysinfo == GSM48_MT_RR_SYSINFO_2bis
+	  || gm->sysinfo == GSM48_MT_RR_SYSINFO_2ter)
+	 && s->si1
+	 && s->si2
+	 && (!s->nb_ext_ind_si2 || s->si2bis)
+	 && (!s->si2ter_ind || s->si2ter))
+		gsm322_store_ba_list(cs, s);
+
+	/* all relevant system informations received */
+	if (s->si1 && s->si2 && s->si3
+	 && (!s->nb_ext_ind_si2 || s->si2bis)
+	 && (!s->si2ter_ind || s->si2ter)) {
+		LOGP(DCS, LOGL_DEBUG, "Received relevant sysinfo.\n");
+		/* stop timer */
+		stop_cs_timer(cs);
+
+		//gsm48_sysinfo_dump(s, print_dcs, NULL);
+
+		/* store sysinfo and continue scan */
+		return gsm322_cs_store(ms);
+	}
+
+	/* wait for more sysinfo or timeout */
+	return 0;
+}
+
+static void gsm322_cs_timeout(void *arg)
+{
+	struct gsm322_cellsel *cs = arg;
+	struct osmocom_ms *ms = cs->ms;
+
+	if (cs->neighbour) {
+		LOGP(DCS, LOGL_INFO, "Neighbour cell read failed.\n");
+		gsm322_nb_read(cs, 0);
+		return;
+	}
+
+	/* if we have no lock, we retry */
+	if (cs->ccch_state != GSM322_CCCH_ST_SYNC)
+		LOGP(DCS, LOGL_INFO, "Cell selection failed, sync timeout.\n");
+	else
+		LOGP(DCS, LOGL_INFO, "Cell selection failed, read timeout.\n");
+
+	/* remove system information */
+	cs->list[cs->arfci].flags &= ~GSM322_CS_FLAG_SYSINFO;
+	if (cs->list[cs->arfci].sysinfo) {
+		LOGP(DCS, LOGL_DEBUG, "free sysinfo arfcn=%s\n",
+			gsm_print_arfcn(cs->arfcn));
+		talloc_free(cs->list[cs->arfci].sysinfo);
+		cs->list[cs->arfci].sysinfo = NULL;
+	}
+
+	/* tune to next cell */
+	if (cs->state == GSM322_C4_NORMAL_CELL_RESEL
+	 || cs->state == GSM322_C8_ANY_CELL_RESEL)
+		gsm322_nb_scan(ms);
+	else
+		gsm322_cs_scan(ms);
+
+	return;
+}
+
+/*
+ * power scan process
+ */
+
+/* search for block of unscanned frequencies and start scanning */
+static int gsm322_cs_powerscan(struct osmocom_ms *ms)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm_settings *set = &ms->settings;
+	int i, s = -1, e;
+	char s_text[ARFCN_TEXT_LEN], e_text[ARFCN_TEXT_LEN];
+	uint8_t mask, flags;
+
+	again:
+
+	mask = GSM322_CS_FLAG_SUPPORT | GSM322_CS_FLAG_POWER;
+	flags = GSM322_CS_FLAG_SUPPORT;
+
+	/* in case of sticking to a cell, we only select it */
+	if (set->stick) {
+		LOGP(DCS, LOGL_DEBUG, "Scanning power for sticked cell.\n");
+		i = arfcn2index(set->stick_arfcn);
+		if ((cs->list[i].flags & mask) == flags)
+			s = e = i;
+	} else {
+		/* search for first frequency to scan */
+		if (cs->state == GSM322_C2_STORED_CELL_SEL
+		 || cs->state == GSM322_C5_CHOOSE_CELL) {
+			LOGP(DCS, LOGL_DEBUG, "Scanning power for stored BA "
+				"list.\n");
+			mask |= GSM322_CS_FLAG_BA;
+			flags |= GSM322_CS_FLAG_BA;
+		} else
+			LOGP(DCS, LOGL_DEBUG, "Scanning power for all "
+				"frequencies.\n");
+		for (i = 0; i <= 1023+299; i++) {
+			if ((cs->list[i].flags & mask) == flags) {
+				s = e = i;
+				break;
+			}
+		}
+	}
+
+	/* if there is no more frequency, we can tune to that cell */
+	if (s < 0) {
+		int found = 0;
+
+		/* stop power level scanning */
+		cs->powerscan = 0;
+
+		/* check if no signal is found */
+		for (i = 0; i <= 1023+299; i++) {
+			if ((cs->list[i].flags & GSM322_CS_FLAG_SIGNAL))
+				found++;
+		}
+		if (!found) {
+			LOGP(DCS, LOGL_INFO, "Found no frequency.\n");
+			/* on normal cell selection, start over */
+			if (cs->state == GSM322_C1_NORMAL_CELL_SEL) {
+				for (i = 0; i <= 1023+299; i++) {
+					/* clear flag that this was scanned */
+					cs->list[i].flags &=
+						~(GSM322_CS_FLAG_POWER
+						| GSM322_CS_FLAG_SIGNAL
+						| GSM322_CS_FLAG_SYSINFO);
+				}
+				goto again;
+			}
+
+			/* freq. scan process done, process (negative) result */
+			return gsm322_search_end(ms);
+		}
+		LOGP(DCS, LOGL_INFO, "Found %d frequencies.\n", found);
+		cs->scan_state = 0xffffffff; /* higher than high */
+		/* clear counter of scanned frequencies of each range */
+		for (i = 0; gsm_sup_smax[i].max; i++)
+			gsm_sup_smax[i].temp = 0;
+		return gsm322_cs_scan(ms);
+	}
+
+	/* search last frequency to scan (en block) */
+	e = i;
+	if (!set->stick) {
+		for (i = s + 1; i <= 1023+299; i++) {
+			if (i == 1024)
+				break;
+			if ((cs->list[i].flags & mask) == flags)
+				e = i;
+			else
+				break;
+		}
+	}
+
+	osmo_strlcpy(s_text, gsm_print_arfcn(index2arfcn(s)), ARFCN_TEXT_LEN);
+	osmo_strlcpy(e_text, gsm_print_arfcn(index2arfcn(e)), ARFCN_TEXT_LEN);
+	LOGP(DCS, LOGL_DEBUG, "Scanning frequencies. (%s..%s)\n",
+		s_text,
+		e_text);
+
+	/* start scan on radio interface */
+	if (!cs->powerscan) {
+		l1ctl_tx_reset_req(ms, L1CTL_RES_T_FULL);
+		cs->powerscan = 1;
+	}
+	cs->sync_pending = 0;
+	return l1ctl_tx_pm_req_range(ms, index2arfcn(s), index2arfcn(e));
+}
+
+int gsm322_l1_signal(unsigned int subsys, unsigned int signal,
+		     void *handler_data, void *signal_data)
+{
+	struct osmocom_ms *ms;
+	struct gsm322_cellsel *cs;
+	struct osmobb_meas_res *mr;
+	struct osmobb_fbsb_res *fr;
+	struct osmobb_neigh_pm_ind *ni;
+	int i;
+	int8_t rxlev;
+
+	if (subsys != SS_L1CTL)
+		return 0;
+
+	switch (signal) {
+	case S_L1CTL_PM_RES:
+		mr = signal_data;
+		ms = mr->ms;
+		cs = &ms->cellsel;
+		if (!cs->powerscan)
+			return -EINVAL;
+		i = arfcn2index(mr->band_arfcn);
+		rxlev = mr->rx_lev;
+		if ((cs->list[i].flags & GSM322_CS_FLAG_POWER)) {
+			LOGP(DCS, LOGL_ERROR, "Getting PM for ARFCN %s "
+				"twice. Overwriting the first! Please fix "
+				"prim_pm.c\n", gsm_print_arfcn(index2arfcn(i)));
+		}
+		cs->list[i].rxlev = rxlev;
+		cs->list[i].flags |= GSM322_CS_FLAG_POWER;
+		cs->list[i].flags &= ~GSM322_CS_FLAG_SIGNAL;
+		/* if minimum level is reached or if we stick to a cell */
+		if (rxlev2dbm(rxlev) >= ms->settings.min_rxlev_dbm
+		 || ms->settings.stick) {
+			cs->list[i].flags |= GSM322_CS_FLAG_SIGNAL;
+			LOGP(DCS, LOGL_INFO, "Found signal (ARFCN %s "
+				"rxlev %s (%d))\n",
+				gsm_print_arfcn(index2arfcn(i)),
+				gsm_print_rxlev(rxlev), rxlev);
+		} else
+		/* no signal found, free sysinfo, if allocated */
+		if (cs->list[i].sysinfo) {
+			cs->list[i].flags &= ~GSM322_CS_FLAG_SYSINFO;
+			LOGP(DCS, LOGL_DEBUG, "free sysinfo ARFCN=%s\n",
+				gsm_print_arfcn(index2arfcn(i)));
+			talloc_free(cs->list[i].sysinfo);
+			cs->list[i].sysinfo = NULL;
+		}
+		break;
+	case S_L1CTL_PM_DONE:
+		LOGP(DCS, LOGL_DEBUG, "Done with power scanning range.\n");
+		ms = signal_data;
+		cs = &ms->cellsel;
+		if (!cs->powerscan)
+			return -EINVAL;
+		gsm322_cs_powerscan(ms);
+		break;
+	case S_L1CTL_FBSB_RESP:
+		fr = signal_data;
+		ms = fr->ms;
+		cs = &ms->cellsel;
+		if (cs->powerscan)
+			return -EINVAL;
+		cs->sync_pending = 0;
+		if (cs->arfcn != fr->band_arfcn) {
+			LOGP(DCS, LOGL_NOTICE, "Channel synched on "
+				"wrong ARFCN=%d, syncing on right ARFCN again"
+				"...\n", fr->band_arfcn);
+			cs->sync_retries = SYNC_RETRIES;
+			gsm322_sync_to_cell(cs, cs->neighbour, 0);
+			break;
+		}
+		if (cs->ccch_state == GSM322_CCCH_ST_INIT) {
+			LOGP(DCS, LOGL_INFO, "Channel synched. (ARFCN=%s, "
+				"snr=%u, BSIC=%u)\n",
+				gsm_print_arfcn(cs->arfcn), fr->snr, fr->bsic);
+			cs->ccch_state = GSM322_CCCH_ST_SYNC;
+			if (cs->si)
+				cs->si->bsic = fr->bsic;
+
+			/* set timer for reading BCCH */
+			if (cs->state == GSM322_C2_STORED_CELL_SEL
+			 || cs->state == GSM322_C1_NORMAL_CELL_SEL
+			 || cs->state == GSM322_C6_ANY_CELL_SEL
+			 || cs->state == GSM322_C4_NORMAL_CELL_RESEL
+			 || cs->state == GSM322_C8_ANY_CELL_RESEL
+			 || cs->state == GSM322_C5_CHOOSE_CELL
+			 || cs->state == GSM322_C9_CHOOSE_ANY_CELL
+			 || cs->state == GSM322_ANY_SEARCH
+			 || cs->state == GSM322_PLMN_SEARCH
+			 || cs->state == GSM322_HPLMN_SEARCH)
+				start_cs_timer(cs, ms->support.scan_to, 0);
+					// TODO: timer depends on BCCH config
+
+			/* set downlink signalling failure criterion */
+			ms->meas.ds_fail = ms->meas.dsc = ms->settings.dsc_max;
+			LOGP(DRR, LOGL_INFO, "using DSC of %d\n", ms->meas.dsc);
+
+			/* start in case we are camping on serving/neighbour
+			 * cell */
+			if (cs->state == GSM322_C3_CAMPED_NORMALLY
+			 || cs->state == GSM322_C7_CAMPED_ANY_CELL) {
+				if (cs->neighbour)
+					gsm322_nb_synced(cs, 1);
+				else
+					gsm322_nb_start(ms, 1);
+			}
+		}
+		break;
+	case S_L1CTL_FBSB_ERR:
+		fr = signal_data;
+		ms = fr->ms;
+		cs = &ms->cellsel;
+		if (cs->powerscan)
+			return -EINVAL;
+		cs->sync_pending = 0;
+		/* retry */
+		if (cs->sync_retries) {
+			LOGP(DCS, LOGL_INFO, "Channel sync error, try again\n");
+			cs->sync_retries--;
+			gsm322_sync_to_cell(cs, cs->neighbour, 0);
+			break;
+		}
+		if (cs->arfcn != fr->band_arfcn) {
+			LOGP(DCS, LOGL_NOTICE, "Channel synched failed on "
+				"wrong ARFCN=%d, syncing on right ARFCN again"
+				"...\n", fr->band_arfcn);
+			cs->sync_retries = SYNC_RETRIES;
+			gsm322_sync_to_cell(cs, cs->neighbour, 0);
+			break;
+		}
+		LOGP(DCS, LOGL_INFO, "Channel sync error.\n");
+		/* no sync, free sysinfo, if allocated */
+		if (cs->list[cs->arfci].sysinfo) {
+			cs->list[cs->arfci].flags &= ~GSM322_CS_FLAG_SYSINFO;
+			LOGP(DCS, LOGL_DEBUG, "free sysinfo ARFCN=%s\n",
+				gsm_print_arfcn(index2arfcn(cs->arfci)));
+			talloc_free(cs->list[cs->arfci].sysinfo);
+			cs->list[cs->arfci].sysinfo = NULL;
+
+		}
+		if (cs->selected && cs->sel_arfcn == cs->arfcn) {
+			LOGP(DCS, LOGL_INFO, "Unselect cell due to sync "
+				"error!\n");
+			/* unset selected cell */
+			gsm322_unselect_cell(cs);
+		}
+		stop_cs_timer(cs);
+
+		/* start in case we are camping on neighbour * cell */
+		if (cs->state == GSM322_C3_CAMPED_NORMALLY
+		 || cs->state == GSM322_C7_CAMPED_ANY_CELL) {
+			if (cs->neighbour) {
+				gsm322_nb_synced(cs, 0);
+				break;
+			}
+		}
+
+		gsm322_cs_loss(cs);
+		break;
+	case S_L1CTL_LOSS_IND:
+		ms = signal_data;
+		cs = &ms->cellsel;
+		LOGP(DCS, LOGL_INFO, "Loss of CCCH.\n");
+		if (cs->selected && cs->sel_arfcn == cs->arfcn) {
+			/* do not unselect cell */
+			LOGP(DCS, LOGL_INFO, "Keep cell selected after loss, "
+				"so we can use the Neighbour cell information "
+				"for cell re-selection.\n");
+		}
+		stop_cs_timer(cs);
+		gsm322_cs_loss(cs);
+		break;
+	case S_L1CTL_RESET:
+		ms = signal_data;
+		if (ms->mmlayer.power_off_idle) {
+			mobile_exit(ms, 1);
+			return 0;
+		}
+		break;
+	case S_L1CTL_NEIGH_PM_IND:
+		ni = signal_data;
+		ms = ni->ms;
+#ifdef COMMING_LATE_R
+		/* in dedicated mode */
+		if (ms->rrlayer.dm_est)
+			gsm48_rr_meas_ind(ms, ni->band_arfcn, ni->rx_lev);
+		else
+#endif
+		/* in camping mode */
+		if ((ms->cellsel.state == GSM322_C3_CAMPED_NORMALLY
+		  || ms->cellsel.state == GSM322_C7_CAMPED_ANY_CELL)
+		 && !ms->cellsel.neighbour)
+			gsm322_nb_meas_ind(ms, ni->band_arfcn, ni->rx_lev);
+		break;
+	}
+
+	return 0;
+}
+
+static void gsm322_cs_loss(void *arg)
+{
+	struct gsm322_cellsel *cs = arg;
+	struct osmocom_ms *ms = cs->ms;
+
+	if ((cs->state == GSM322_C3_CAMPED_NORMALLY
+	  || cs->state == GSM322_C7_CAMPED_ANY_CELL)
+	 && !cs->neighbour) {
+			struct msgb *nmsg;
+
+			LOGP(DCS, LOGL_INFO, "Loss of CCCH, Trigger "
+				"re-selection.\n");
+			if (ms->rrlayer.monitor)
+				vty_notify(ms, "MON: trigger cell "
+					"re-selection: loss of signal\n");
+
+			nmsg = gsm322_msgb_alloc(GSM322_EVENT_CELL_RESEL);
+			if (!nmsg)
+				return;
+			gsm322_c_event(ms, nmsg);
+			msgb_free(nmsg);
+
+			return;
+	} else
+	if (cs->state == GSM322_CONNECTED_MODE_1
+	 || cs->state == GSM322_CONNECTED_MODE_2) {
+			LOGP(DCS, LOGL_INFO, "Loss of SACCH, Trigger RR "
+				"abort.\n");
+
+			/* keep cell info for re-selection */
+
+			gsm48_rr_los(ms);
+			/* be shure that nothing else is done after here
+			 * because the function call above may cause
+			 * to return from idle state and trigger cell re-sel.
+			 */
+
+			return;
+	}
+
+	gsm322_cs_timeout(cs);
+
+	return;
+}
+
+/*
+ * handler for cell selection process
+ */
+
+/* start any cell search */
+static int gsm322_c_any_search(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	int i;
+
+	new_c_state(cs, GSM322_ANY_SEARCH);
+
+	/* mark all frequencies as scanned */
+	for (i = 0; i <= 1023+299; i++) {
+		cs->list[i].flags &= ~(GSM322_CS_FLAG_POWER
+					| GSM322_CS_FLAG_SIGNAL
+					| GSM322_CS_FLAG_SYSINFO);
+	}
+
+	/* start power scan */
+	return gsm322_cs_powerscan(ms);
+}
+
+/* start PLMN search */
+static int gsm322_c_plmn_search(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	int i;
+
+	new_c_state(cs, GSM322_PLMN_SEARCH);
+
+	/* mark all frequencies as scanned */
+	for (i = 0; i <= 1023+299; i++) {
+		cs->list[i].flags &= ~(GSM322_CS_FLAG_POWER
+					| GSM322_CS_FLAG_SIGNAL
+					| GSM322_CS_FLAG_SYSINFO);
+	}
+
+	/* unset selected cell */
+	gsm322_unselect_cell(cs);
+
+	/* start power scan */
+	return gsm322_cs_powerscan(ms);
+}
+
+/* start HPLMN search */
+static int gsm322_c_hplmn_search(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	int i, sel_i = arfcn2index(cs->sel_arfcn);
+
+	new_c_state(cs, GSM322_HPLMN_SEARCH);
+
+	/* mark all frequencies except our own BA as unscanned */
+	for (i = 0; i <= 1023+299; i++) {
+		if (i != sel_i
+		 && (cs->list[i].flags & GSM322_CS_FLAG_SYSINFO)
+		 && !(cs->list[i].flags & GSM322_CS_FLAG_BA)) {
+			cs->list[i].flags &= ~(GSM322_CS_FLAG_POWER
+						| GSM322_CS_FLAG_SIGNAL
+						| GSM322_CS_FLAG_SYSINFO);
+		}
+	}
+
+	/* start power scan */
+	return gsm322_cs_powerscan(ms);
+}
+
+/* start stored cell selection */
+static int gsm322_c_stored_cell_sel(struct osmocom_ms *ms,
+	struct gsm322_ba_list *ba)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	int i;
+
+	/* we weed to rescan */
+	for (i = 0; i <= 1023+299; i++) {
+		cs->list[i].flags &= ~(GSM322_CS_FLAG_POWER
+					| GSM322_CS_FLAG_SIGNAL
+					| GSM322_CS_FLAG_SYSINFO);
+	}
+
+	new_c_state(cs, GSM322_C2_STORED_CELL_SEL);
+
+	/* flag all frequencies that are in current band allocation */
+	for (i = 0; i <= 1023+299; i++) {
+		if ((ba->freq[i >> 3] & (1 << (i & 7))))
+			cs->list[i].flags |= GSM322_CS_FLAG_BA;
+		else
+			cs->list[i].flags &= ~GSM322_CS_FLAG_BA;
+	}
+
+	/* unset selected cell */
+	gsm322_unselect_cell(cs);
+
+	/* start power scan */
+	return gsm322_cs_powerscan(ms);
+}
+
+/* start noraml cell selection */
+static int gsm322_c_normal_cell_sel(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	int i;
+
+	/* except for stored cell selection state, we weed to rescan */
+	if (cs->state != GSM322_C2_STORED_CELL_SEL) {
+		for (i = 0; i <= 1023+299; i++) {
+			cs->list[i].flags &= ~(GSM322_CS_FLAG_POWER
+						| GSM322_CS_FLAG_SIGNAL
+						| GSM322_CS_FLAG_SYSINFO);
+		}
+	}
+
+	new_c_state(cs, GSM322_C1_NORMAL_CELL_SEL);
+
+	/* unset selected cell */
+	gsm322_unselect_cell(cs);
+
+	/* start power scan */
+	return gsm322_cs_powerscan(ms);
+}
+
+/* start any cell selection */
+static int gsm322_c_any_cell_sel(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+	int msg_type = gm->msg_type;
+
+	/* in case we already tried any cell (re-)selection, power scan again */
+	if (cs->state == GSM322_C0_NULL
+	 || cs->state == GSM322_C6_ANY_CELL_SEL
+	 || cs->state == GSM322_C8_ANY_CELL_RESEL) {
+		int i;
+
+		for (i = 0; i <= 1023+299; i++) {
+			cs->list[i].flags &= ~(GSM322_CS_FLAG_POWER
+						| GSM322_CS_FLAG_SIGNAL
+						| GSM322_CS_FLAG_SYSINFO);
+		}
+
+		/* indicate to MM that we lost coverage.
+		 * this is the only case where we really have no coverage.
+		 * we tell MM, so it will enter the "No Cell Avaiable" state. */
+		if (msg_type == GSM322_EVENT_NO_CELL_FOUND) {
+			struct msgb *nmsg;
+
+			/* tell that we have no cell found
+			 * (not any cell at all) */
+			nmsg = gsm48_mmevent_msgb_alloc(
+						GSM48_MM_EVENT_NO_CELL_FOUND);
+			if (!nmsg)
+				return -ENOMEM;
+			gsm48_mmevent_msg(ms, nmsg);
+		}
+	}
+
+	new_c_state(cs, GSM322_C6_ANY_CELL_SEL);
+
+	cs->mcc = cs->mnc = 0;
+
+	/* unset selected cell */
+	gsm322_unselect_cell(cs);
+
+	/* start power scan */
+	return gsm322_cs_powerscan(ms);
+}
+
+static void gsm322_any_timeout(void *arg)
+{
+	struct gsm322_cellsel *cs = arg;
+	struct osmocom_ms *ms = cs->ms;
+
+	/* the timer may still run when not camping, so we ignore it.
+	 * it will be restarted whenever the 'camped on any cell' state
+	 * is reached. */
+	if (cs->state != GSM322_C7_CAMPED_ANY_CELL)
+		return;
+
+	/* in case the time has been started before SIM was removed */
+	if (!ms->subscr.sim_valid)
+		return;
+
+	LOGP(DCS, LOGL_INFO, "'Any cell selection timer' timed out. "
+		"Starting special search to find allowed PLMNs.\n");
+
+	gsm322_c_any_search(ms, NULL);
+}
+
+/* sim is removed, proceed with any cell selection */
+static int gsm322_c_sim_remove(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct llist_head *lh, *lh2;
+
+	/* flush list of forbidden LAs */
+	llist_for_each_safe(lh, lh2, &plmn->forbidden_la) {
+		llist_del(lh);
+		talloc_free(lh);
+	}
+	return gsm322_c_any_cell_sel(ms, msg);
+}
+
+/* start noraml cell re-selection */
+static int gsm322_c_normal_cell_resel(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct msgb *nmsg;
+
+	/* store last camped cell. this is required for next cell
+	 * monitoring reselection criterion */
+	cs->last_serving_arfcn = cs->sel_arfcn;
+	cs->last_serving_valid = 1;
+
+	/* unset selected cell */
+	gsm322_unselect_cell(cs);
+
+	/* tell MM that we lost coverage */
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_LOST_COVERAGE);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmevent_msg(ms, nmsg);
+
+	new_c_state(cs, GSM322_C4_NORMAL_CELL_RESEL);
+
+	/* start scanning neighbour cells for reselection */
+	return gsm322_nb_scan(ms);
+}
+
+/* start any cell re-selection */
+static int gsm322_c_any_cell_resel(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct msgb *nmsg;
+
+	/* store last camped cell. this is required for next cell
+	 * monitoring reselection criterion */
+	cs->last_serving_arfcn = cs->sel_arfcn;
+	cs->last_serving_valid = 1;
+
+	/* unset selected cell */
+	gsm322_unselect_cell(cs);
+
+	/* tell MM that we lost coverage */
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_LOST_COVERAGE);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmevent_msg(ms, nmsg);
+
+	new_c_state(cs, GSM322_C8_ANY_CELL_RESEL);
+
+	/* start scanning neighbour cells for reselection */
+	return gsm322_nb_scan(ms);
+}
+
+/* a suitable cell was found, so we camp normally */
+static int gsm322_c_camp_normally(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct msgb *nmsg;
+
+	LOGP(DSUM, LOGL_INFO, "Camping normally on cell (ARFCN=%s mcc=%s "
+		"mnc=%s  %s, %s)\n", gsm_print_arfcn(cs->sel_arfcn),
+		gsm_print_mcc(cs->sel_mcc),
+		gsm_print_mnc(cs->sel_mnc), gsm_get_mcc(cs->sel_mcc),
+		gsm_get_mnc(cs->sel_mcc, cs->sel_mnc));
+
+	/* if we did cell reselection, we have a valid last serving cell */
+	if (cs->state != GSM322_C4_NORMAL_CELL_RESEL)
+		cs->last_serving_valid = 0;
+
+	/* tell that we have selected a (new) cell */
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_CELL_SELECTED);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmevent_msg(ms, nmsg);
+
+	new_c_state(cs, GSM322_C3_CAMPED_NORMALLY);
+
+	return 0;
+}
+
+/* any cell was found, so we camp on any cell */
+static int gsm322_c_camp_any_cell(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct msgb *nmsg;
+
+	LOGP(DSUM, LOGL_INFO, "Camping on any cell (ARFCN=%s mcc=%s "
+		"mnc=%s  %s, %s)\n", gsm_print_arfcn(cs->sel_arfcn),
+		gsm_print_mcc(cs->sel_mcc),
+		gsm_print_mnc(cs->sel_mnc), gsm_get_mcc(cs->sel_mcc),
+		gsm_get_mnc(cs->sel_mcc, cs->sel_mnc));
+
+	/* (re-)starting 'any cell selection' timer to look for coverage of
+	 * allowed PLMNs.
+	 * start timer, if not running.
+	 * restart timer, if we just entered the 'camped any cell' state */
+	if (ms->subscr.sim_valid
+	 && (cs->state != GSM322_C8_ANY_CELL_RESEL
+	  || !osmo_timer_pending(&cs->any_timer))) {
+		struct gsm322_plmn *plmn = &ms->plmn;
+
+		stop_any_timer(cs);
+		if (ms->settings.plmn_mode == PLMN_MODE_MANUAL
+		 && (!plmn->mcc
+		  || gsm_subscr_is_forbidden_plmn(&ms->subscr, plmn->mcc,
+							plmn->mnc))) {
+			LOGP(DCS, LOGL_INFO, "Not starting 'any search' timer, "
+				"because no selected PLMN or forbidden\n");
+		} else
+			start_any_timer(cs, ms->subscr.any_timeout, 0);
+	}
+
+	/* if we did cell reselection, we have a valid last serving cell */
+	if (cs->state != GSM322_C8_ANY_CELL_RESEL)
+		cs->last_serving_valid = 0;
+
+	/* tell that we have selected a (new) cell.
+	 * this cell iss not allowable, so the MM state will enter limited
+	 * service */
+	if (cs->state != GSM322_C7_CAMPED_ANY_CELL) {
+		nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_CELL_SELECTED);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm48_mmevent_msg(ms, nmsg);
+	}
+
+	new_c_state(cs, GSM322_C7_CAMPED_ANY_CELL);
+
+	return 0;
+}
+
+/* create temporary ba range with given frequency ranges */
+struct gsm322_ba_list *gsm322_cs_ba_range(struct osmocom_ms *ms,
+	uint32_t *range, uint8_t ranges, uint8_t refer_pcs)
+{
+	static struct gsm322_ba_list ba;
+	int lower, higher;
+	char lower_text[ARFCN_TEXT_LEN], higher_text[ARFCN_TEXT_LEN];
+
+	memset(&ba, 0, sizeof(ba));
+
+	while(ranges--) {
+		lower = *range & 1023;
+		higher = (*range >> 16) & 1023;
+		if (refer_pcs && lower >= 512 && lower <= 810) {
+			if (higher < 512 || higher > 810 || higher < lower) {
+				LOGP(DCS, LOGL_NOTICE, "Illegal PCS range: "
+					"%d..%d\n", lower, higher);
+				range++;
+				continue;
+			}
+			lower += 1024-512;
+			higher += 1024-512;
+		}
+		range++;
+		osmo_strlcpy(lower_text,  gsm_print_arfcn(index2arfcn(lower)),  ARFCN_TEXT_LEN);
+		osmo_strlcpy(higher_text, gsm_print_arfcn(index2arfcn(higher)), ARFCN_TEXT_LEN);
+		LOGP(DCS, LOGL_INFO, "Use BA range: %s..%s\n",
+			lower_text,
+			higher_text);
+		/* GSM 05.08 6.3 */
+		while (1) {
+			ba.freq[lower >> 3] |= 1 << (lower & 7);
+			if (lower == higher)
+				break;
+			lower++;
+			/* wrap arround, only if not PCS */
+			if (lower == 1024)
+				lower = 0;
+		}
+	}
+
+	return &ba;
+}
+
+/* common part of gsm322_c_choose_cell and gsm322_c_choose_any_cell */
+static int gsm322_cs_choose(struct osmocom_ms *ms)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_ba_list *ba = NULL;
+	int i;
+
+	/* NOTE: The call to this function is synchron to RR layer, so
+	 * we may access the BA range there.
+	 */
+	if (rr->ba_ranges)
+		ba = gsm322_cs_ba_range(ms, rr->ba_range, rr->ba_ranges,
+			gsm_refer_pcs(cs->sel_arfcn, &cs->sel_si));
+	else {
+		LOGP(DCS, LOGL_INFO, "No BA range(s), try sysinfo.\n");
+		/* get and update BA of last received sysinfo 5* */
+		ba = gsm322_cs_sysinfo_sacch(ms);
+		if (!ba) {
+			LOGP(DCS, LOGL_INFO, "No BA on sysinfo, try stored "
+				"BA list.\n");
+			ba = gsm322_find_ba_list(cs, cs->sel_si.mcc,
+				cs->sel_si.mnc);
+		}
+	}
+
+	if (!ba) {
+		struct msgb *nmsg;
+
+		LOGP(DCS, LOGL_INFO, "No BA list to use.\n");
+
+		/* tell CS to start over */
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_NO_CELL_FOUND);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_c_event(ms, nmsg);
+		msgb_free(nmsg);
+
+		return 0;
+	}
+
+	/* flag all frequencies that are in current band allocation */
+	for (i = 0; i <= 1023+299; i++) {
+		if (cs->state == GSM322_C5_CHOOSE_CELL) {
+			if ((ba->freq[i >> 3] & (1 << (i & 7)))) {
+				cs->list[i].flags |= GSM322_CS_FLAG_BA;
+			} else {
+				cs->list[i].flags &= ~GSM322_CS_FLAG_BA;
+			}
+		}
+		cs->list[i].flags &= ~(GSM322_CS_FLAG_POWER
+					| GSM322_CS_FLAG_SIGNAL
+					| GSM322_CS_FLAG_SYSINFO);
+	}
+
+	/* unset selected cell */
+	gsm322_unselect_cell(cs);
+
+	/* start power scan */
+	return gsm322_cs_powerscan(ms);
+}
+
+/* start 'Choose cell' after returning to idle mode */
+static int gsm322_c_choose_cell(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+
+	/* After location updating, we choose the last cell */
+	if (gm->same_cell) {
+		struct msgb *nmsg;
+
+		if (!cs->selected) {
+			LOGP(DCS, LOGL_INFO, "Cell not selected anymore, "
+				"choose cell!\n");
+			goto choose;
+		}
+		cs->arfcn = cs->sel_arfcn;
+		cs->arfci = arfcn2index(cs->arfcn);
+
+		/* be sure to go to current camping frequency on return */
+		LOGP(DCS, LOGL_INFO, "Selecting ARFCN %s. after LOC.UPD.\n",
+			gsm_print_arfcn(cs->arfcn));
+		cs->sync_retries = SYNC_RETRIES;
+		gsm322_sync_to_cell(cs, NULL, 0);
+		cs->si = cs->list[cs->arfci].sysinfo;
+		if (!cs->si) {
+			LOGP(DCS, LOGL_FATAL, "No SI when ret.idle, please fix!\n");
+			exit(0L);
+		}
+
+		new_c_state(cs, GSM322_C3_CAMPED_NORMALLY);
+
+		/* tell that we have selected the cell, so RR returns IDLE */
+		nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_CELL_SELECTED);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm48_mmevent_msg(ms, nmsg);
+
+		return 0;
+	}
+
+choose:
+	new_c_state(cs, GSM322_C5_CHOOSE_CELL);
+
+	return gsm322_cs_choose(ms);
+}
+
+/* start 'Choose any cell' after returning to idle mode */
+static int gsm322_c_choose_any_cell(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+
+	new_c_state(cs, GSM322_C9_CHOOSE_ANY_CELL);
+
+	return gsm322_cs_choose(ms);
+}
+
+/* a new PLMN is selected by PLMN search process */
+static int gsm322_c_new_plmn(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_ba_list *ba;
+
+	cs->mcc = plmn->mcc;
+	cs->mnc = plmn->mnc;
+
+	if (gm->limited) {
+		LOGP(DCS, LOGL_INFO, "Selected PLMN with limited service.\n");
+		return gsm322_c_any_cell_sel(ms, msg);
+	}
+
+	LOGP(DSUM, LOGL_INFO, "Selecting PLMN (mcc=%s mnc=%s  %s, %s)\n",
+		gsm_print_mcc(cs->mcc), gsm_print_mnc(cs->mnc),
+		gsm_get_mcc(cs->mcc), gsm_get_mnc(cs->mcc, cs->mnc));
+
+	/* search for BA list */
+	ba = gsm322_find_ba_list(cs, plmn->mcc, plmn->mnc);
+
+	if (ba) {
+		LOGP(DCS, LOGL_INFO, "Start stored cell selection.\n");
+		return gsm322_c_stored_cell_sel(ms, ba);
+	} else {
+		LOGP(DCS, LOGL_INFO, "Start normal cell selection.\n");
+		return gsm322_c_normal_cell_sel(ms, msg);
+	}
+}
+
+/* go connected mode */
+static int gsm322_c_conn_mode_1(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+
+	/* check for error */
+	if (!cs->selected) {
+		LOGP(DCS, LOGL_INFO, "No cell selected, please fix!\n");
+		exit(0L);
+	}
+	cs->arfcn = cs->sel_arfcn;
+	cs->arfci = arfcn2index(cs->arfcn);
+
+	/* maybe we are currently syncing to neighbours */
+	stop_cs_timer(cs);
+
+	new_c_state(cs, GSM322_CONNECTED_MODE_1);
+
+	/* be sure to go to current camping frequency on return */
+	LOGP(DCS, LOGL_INFO, "Going to camping (normal) ARFCN %s.\n",
+		gsm_print_arfcn(cs->arfcn));
+	cs->si = cs->list[cs->arfci].sysinfo;
+	if (!cs->si) {
+		LOGP(DCS, LOGL_FATAL, "No SI when leaving idle, please fix!\n");
+		exit(0L);
+	}
+	cs->sync_retries = SYNC_RETRIES;
+	gsm322_sync_to_cell(cs, NULL, 1);
+
+	return 0;
+}
+
+static int gsm322_c_conn_mode_2(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+
+	/* check for error */
+	if (!cs->selected) {
+		LOGP(DCS, LOGL_INFO, "No cell selected, please fix!\n");
+		exit(0L);
+	}
+	cs->arfcn = cs->sel_arfcn;
+	cs->arfci = arfcn2index(cs->arfcn);
+
+	stop_cs_timer(cs);
+
+	new_c_state(cs, GSM322_CONNECTED_MODE_2);
+
+	/* be sure to go to current camping frequency on return */
+	LOGP(DCS, LOGL_INFO, "Going to camping (any cell) ARFCN %s.\n",
+		gsm_print_arfcn(cs->arfcn));
+	cs->si = cs->list[cs->arfci].sysinfo;
+	if (!cs->si) {
+		LOGP(DCS, LOGL_FATAL, "No SI when leaving idle, please fix!\n");
+		exit(0L);
+	}
+	cs->sync_retries = SYNC_RETRIES;
+	gsm322_sync_to_cell(cs, NULL, 1);
+
+	return 0;
+}
+
+/* switch on */
+static int gsm322_c_switch_on(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+
+	/* if no SIM is is MS */
+	if (!subscr->sim_valid) {
+		LOGP(DCS, LOGL_INFO, "Switch on without SIM.\n");
+		return gsm322_c_any_cell_sel(ms, msg);
+	}
+	LOGP(DCS, LOGL_INFO, "Switch on with SIM inserted.\n");
+
+	/* stay in NULL state until PLMN is selected */
+
+	return 0;
+}
+
+/*
+ * state machines
+ */
+
+/* state machine for automatic PLMN selection events */
+static struct plmnastatelist {
+	uint32_t	states;
+	int		type;
+	int		(*rout) (struct osmocom_ms *ms, struct msgb *msg);
+} plmnastatelist[] = {
+	{SBIT(GSM322_A0_NULL),
+	 GSM322_EVENT_SWITCH_ON, gsm322_a_switch_on},
+
+	/* special case for full search */
+	{SBIT(GSM322_A0_NULL),
+	 GSM322_EVENT_PLMN_SEARCH_END, gsm322_a_sel_first_plmn},
+
+	{ALL_STATES,
+	 GSM322_EVENT_SWITCH_OFF, gsm322_a_switch_off},
+
+	{SBIT(GSM322_A0_NULL) | SBIT(GSM322_A6_NO_SIM),
+	 GSM322_EVENT_SIM_INSERT, gsm322_a_switch_on},
+
+	{ALL_STATES,
+	 GSM322_EVENT_SIM_INSERT, gsm322_a_sim_insert},
+
+	{ALL_STATES,
+	 GSM322_EVENT_SIM_REMOVE, gsm322_a_sim_removed},
+
+	{ALL_STATES,
+	 GSM322_EVENT_INVALID_SIM, gsm322_a_sim_removed},
+
+	{SBIT(GSM322_A1_TRYING_RPLMN),
+	 GSM322_EVENT_REG_FAILED, gsm322_a_sel_first_plmn},
+
+	{SBIT(GSM322_A1_TRYING_RPLMN),
+	 GSM322_EVENT_ROAMING_NA, gsm322_a_sel_first_plmn},
+
+	{SBIT(GSM322_A1_TRYING_RPLMN),
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_a_sel_first_plmn},
+
+	{SBIT(GSM322_A1_TRYING_RPLMN) | SBIT(GSM322_A3_TRYING_PLMN),
+	 GSM322_EVENT_REG_SUCCESS, gsm322_a_go_on_plmn},
+
+	{SBIT(GSM322_A2_ON_PLMN),
+	 GSM322_EVENT_ROAMING_NA, gsm322_a_roaming_na},
+
+	{SBIT(GSM322_A2_ON_PLMN),
+	 GSM322_EVENT_HPLMN_SEARCH, gsm322_a_hplmn_search_start},
+
+	{SBIT(GSM322_A2_ON_PLMN),
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_a_loss_of_radio},
+
+	{SBIT(GSM322_A2_ON_PLMN),
+	 GSM322_EVENT_USER_RESEL, gsm322_a_user_resel},
+
+	{SBIT(GSM322_A3_TRYING_PLMN),
+	 GSM322_EVENT_REG_FAILED, gsm322_a_sel_next_plmn},
+
+	{SBIT(GSM322_A3_TRYING_PLMN),
+	 GSM322_EVENT_ROAMING_NA, gsm322_a_sel_next_plmn},
+
+	{SBIT(GSM322_A3_TRYING_PLMN),
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_a_sel_next_plmn},
+
+	{SBIT(GSM322_A5_HPLMN_SEARCH),
+	 GSM322_EVENT_CELL_FOUND, gsm322_a_sel_first_plmn},
+
+	{SBIT(GSM322_A5_HPLMN_SEARCH),
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_a_go_on_plmn},
+
+	{SBIT(GSM322_A4_WAIT_FOR_PLMN),
+	 GSM322_EVENT_PLMN_AVAIL, gsm322_a_plmn_avail},
+
+	{ALL_STATES,
+	 GSM322_EVENT_SEL_MANUAL, gsm322_a_sel_manual},
+
+	{ALL_STATES,
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_am_no_cell_found},
+};
+
+#define PLMNASLLEN \
+	(sizeof(plmnastatelist) / sizeof(struct plmnastatelist))
+
+static int gsm322_a_event(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+	int msg_type = gm->msg_type;
+	int rc;
+	int i;
+
+	LOGP(DPLMN, LOGL_INFO, "(ms %s) Event '%s' for automatic PLMN "
+		"selection in state '%s'\n", ms->name, get_event_name(msg_type),
+		get_a_state_name(plmn->state));
+	/* find function for current state and message */
+	for (i = 0; i < PLMNASLLEN; i++)
+		if ((msg_type == plmnastatelist[i].type)
+		 && ((1 << plmn->state) & plmnastatelist[i].states))
+			break;
+	if (i == PLMNASLLEN) {
+		LOGP(DPLMN, LOGL_NOTICE, "Event unhandled at this state.\n");
+		return 0;
+	}
+
+	rc = plmnastatelist[i].rout(ms, msg);
+
+	return rc;
+}
+
+/* state machine for manual PLMN selection events */
+static struct plmnmstatelist {
+	uint32_t	states;
+	int		type;
+	int		(*rout) (struct osmocom_ms *ms, struct msgb *msg);
+} plmnmstatelist[] = {
+	{SBIT(GSM322_M0_NULL),
+	 GSM322_EVENT_SWITCH_ON, gsm322_m_switch_on},
+
+	{SBIT(GSM322_M0_NULL) | SBIT(GSM322_M3_NOT_ON_PLMN) |
+	 SBIT(GSM322_M2_ON_PLMN),
+	 GSM322_EVENT_PLMN_SEARCH_END, gsm322_m_display_plmns},
+
+	{ALL_STATES,
+	 GSM322_EVENT_SWITCH_OFF, gsm322_m_switch_off},
+
+	{SBIT(GSM322_M0_NULL) | SBIT(GSM322_M5_NO_SIM),
+	 GSM322_EVENT_SIM_INSERT, gsm322_m_switch_on},
+
+	{ALL_STATES,
+	 GSM322_EVENT_SIM_INSERT, gsm322_m_sim_insert},
+
+	{ALL_STATES,
+	 GSM322_EVENT_SIM_REMOVE, gsm322_m_sim_removed},
+
+	{SBIT(GSM322_M1_TRYING_RPLMN),
+	 GSM322_EVENT_REG_FAILED, gsm322_m_display_plmns},
+
+	{SBIT(GSM322_M1_TRYING_RPLMN),
+	 GSM322_EVENT_ROAMING_NA, gsm322_m_display_plmns},
+
+	{SBIT(GSM322_M1_TRYING_RPLMN),
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_m_display_plmns},
+
+	{SBIT(GSM322_M1_TRYING_RPLMN),
+	 GSM322_EVENT_REG_SUCCESS, gsm322_m_go_on_plmn},
+
+	{SBIT(GSM322_M2_ON_PLMN),
+	 GSM322_EVENT_ROAMING_NA, gsm322_m_display_plmns},
+
+	/* undocumented case, where we loose coverage */
+	{SBIT(GSM322_M2_ON_PLMN),
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_m_display_plmns},
+
+	{SBIT(GSM322_M1_TRYING_RPLMN) | SBIT(GSM322_M2_ON_PLMN) |
+	 SBIT(GSM322_M4_TRYING_PLMN),
+	 GSM322_EVENT_INVALID_SIM, gsm322_m_sim_removed},
+
+	{SBIT(GSM322_M3_NOT_ON_PLMN) | SBIT(GSM322_M2_ON_PLMN),
+	 GSM322_EVENT_USER_RESEL, gsm322_m_user_resel},
+
+	{SBIT(GSM322_M3_NOT_ON_PLMN),
+	 GSM322_EVENT_PLMN_AVAIL, gsm322_m_plmn_avail},
+
+	/* choose plmn is only specified when 'not on PLMN', but it makes
+	 * sense to select cell from other states too. */
+	{SBIT(GSM322_M3_NOT_ON_PLMN) | SBIT(GSM322_M2_ON_PLMN) |
+	 SBIT(GSM322_M1_TRYING_RPLMN) | SBIT(GSM322_M4_TRYING_PLMN),
+	 GSM322_EVENT_CHOOSE_PLMN, gsm322_m_choose_plmn},
+
+	{SBIT(GSM322_M4_TRYING_PLMN),
+	 GSM322_EVENT_REG_SUCCESS, gsm322_m_go_on_plmn},
+
+	/* we also display available PLMNs after trying to register.
+	 * this is not standard. we need that so the user knows
+	 * that registration failed, and the user can select a new network. */
+	{SBIT(GSM322_M4_TRYING_PLMN),
+	 GSM322_EVENT_REG_FAILED, gsm322_m_display_plmns},
+
+	{SBIT(GSM322_M4_TRYING_PLMN),
+	 GSM322_EVENT_ROAMING_NA, gsm322_m_display_plmns},
+
+	{SBIT(GSM322_M4_TRYING_PLMN),
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_m_display_plmns},
+
+	{ALL_STATES,
+	 GSM322_EVENT_SEL_AUTO, gsm322_m_sel_auto},
+
+	{ALL_STATES,
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_am_no_cell_found},
+};
+
+#define PLMNMSLLEN \
+	(sizeof(plmnmstatelist) / sizeof(struct plmnmstatelist))
+
+static int gsm322_m_event(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+	int msg_type = gm->msg_type;
+	int rc;
+	int i;
+
+	LOGP(DPLMN, LOGL_INFO, "(ms %s) Event '%s' for manual PLMN selection "
+		"in state '%s'\n", ms->name, get_event_name(msg_type),
+		get_m_state_name(plmn->state));
+	/* find function for current state and message */
+	for (i = 0; i < PLMNMSLLEN; i++)
+		if ((msg_type == plmnmstatelist[i].type)
+		 && ((1 << plmn->state) & plmnmstatelist[i].states))
+			break;
+	if (i == PLMNMSLLEN) {
+		LOGP(DPLMN, LOGL_NOTICE, "Event unhandled at this state.\n");
+		return 0;
+	}
+
+	rc = plmnmstatelist[i].rout(ms, msg);
+
+	return rc;
+}
+
+/* dequeue GSM 03.22 PLMN events */
+int gsm322_plmn_dequeue(struct osmocom_ms *ms)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct msgb *msg;
+	int work = 0;
+
+	while ((msg = msgb_dequeue(&plmn->event_queue))) {
+		/* send event to PLMN select process */
+		if (ms->settings.plmn_mode == PLMN_MODE_AUTO)
+			gsm322_a_event(ms, msg);
+		else
+			gsm322_m_event(ms, msg);
+		msgb_free(msg);
+		work = 1; /* work done */
+	}
+
+	return work;
+}
+
+/* state machine for channel selection events */
+static struct cellselstatelist {
+	uint32_t	states;
+	int		type;
+	int		(*rout) (struct osmocom_ms *ms, struct msgb *msg);
+} cellselstatelist[] = {
+	{ALL_STATES,
+	 GSM322_EVENT_SWITCH_ON, gsm322_c_switch_on},
+
+	{ALL_STATES,
+	 GSM322_EVENT_SIM_REMOVE, gsm322_c_sim_remove},
+
+	{ALL_STATES,
+	 GSM322_EVENT_NEW_PLMN, gsm322_c_new_plmn},
+
+	{ALL_STATES,
+	 GSM322_EVENT_PLMN_SEARCH_START, gsm322_c_plmn_search},
+
+	{SBIT(GSM322_C1_NORMAL_CELL_SEL) | SBIT(GSM322_C2_STORED_CELL_SEL) |
+	 SBIT(GSM322_C4_NORMAL_CELL_RESEL) | SBIT(GSM322_C5_CHOOSE_CELL),
+	 GSM322_EVENT_CELL_FOUND, gsm322_c_camp_normally},
+
+	{SBIT(GSM322_C9_CHOOSE_ANY_CELL) | SBIT(GSM322_C6_ANY_CELL_SEL) |
+	 SBIT(GSM322_C8_ANY_CELL_RESEL),
+	 GSM322_EVENT_CELL_FOUND, gsm322_c_camp_any_cell},
+
+	{SBIT(GSM322_C1_NORMAL_CELL_SEL) | SBIT(GSM322_C6_ANY_CELL_SEL) |
+	 SBIT(GSM322_C9_CHOOSE_ANY_CELL) | SBIT(GSM322_C8_ANY_CELL_RESEL) |
+	 SBIT(GSM322_C0_NULL) /* after search */,
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_c_any_cell_sel},
+
+	{SBIT(GSM322_C2_STORED_CELL_SEL) | SBIT(GSM322_C5_CHOOSE_CELL) |
+	 SBIT(GSM322_C4_NORMAL_CELL_RESEL),
+	 GSM322_EVENT_NO_CELL_FOUND, gsm322_c_normal_cell_sel},
+
+	{SBIT(GSM322_C3_CAMPED_NORMALLY),
+	 GSM322_EVENT_LEAVE_IDLE, gsm322_c_conn_mode_1},
+
+	{SBIT(GSM322_C7_CAMPED_ANY_CELL),
+	 GSM322_EVENT_LEAVE_IDLE, gsm322_c_conn_mode_2},
+
+	{SBIT(GSM322_CONNECTED_MODE_1),
+	 GSM322_EVENT_RET_IDLE, gsm322_c_choose_cell},
+
+	{SBIT(GSM322_CONNECTED_MODE_2),
+	 GSM322_EVENT_RET_IDLE, gsm322_c_choose_any_cell},
+
+	{SBIT(GSM322_C3_CAMPED_NORMALLY),
+	 GSM322_EVENT_CELL_RESEL, gsm322_c_normal_cell_resel},
+
+	{SBIT(GSM322_C7_CAMPED_ANY_CELL),
+	 GSM322_EVENT_CELL_RESEL, gsm322_c_any_cell_resel},
+
+	{SBIT(GSM322_C7_CAMPED_ANY_CELL),
+	 GSM322_EVENT_CELL_FOUND, gsm322_c_normal_cell_sel},
+
+	{SBIT(GSM322_C1_NORMAL_CELL_SEL) | SBIT(GSM322_C2_STORED_CELL_SEL) |
+	 SBIT(GSM322_C4_NORMAL_CELL_RESEL) | SBIT(GSM322_C5_CHOOSE_CELL) |
+	 SBIT(GSM322_C9_CHOOSE_ANY_CELL) | SBIT(GSM322_C8_ANY_CELL_RESEL) |
+	 SBIT(GSM322_C6_ANY_CELL_SEL) | SBIT(GSM322_ANY_SEARCH) |
+	 SBIT(GSM322_PLMN_SEARCH) | SBIT(GSM322_HPLMN_SEARCH) ,
+	 GSM322_EVENT_SYSINFO, gsm322_c_scan_sysinfo_bcch},
+
+	{SBIT(GSM322_C3_CAMPED_NORMALLY) | SBIT(GSM322_C7_CAMPED_ANY_CELL),
+	 GSM322_EVENT_SYSINFO, gsm322_c_camp_sysinfo_bcch},
+
+	{SBIT(GSM322_C3_CAMPED_NORMALLY),
+	 GSM322_EVENT_HPLMN_SEARCH, gsm322_c_hplmn_search},
+};
+
+#define CELLSELSLLEN \
+	(sizeof(cellselstatelist) / sizeof(struct cellselstatelist))
+
+int gsm322_c_event(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm322_msg *gm = (struct gsm322_msg *) msg->data;
+	int msg_type = gm->msg_type;
+	int rc;
+	int i;
+
+	if (msg_type != GSM322_EVENT_SYSINFO)
+		LOGP(DCS, LOGL_INFO, "(ms %s) Event '%s' for Cell selection "
+			"in state '%s'\n", ms->name, get_event_name(msg_type),
+			get_cs_state_name(cs->state));
+	/* find function for current state and message */
+	for (i = 0; i < CELLSELSLLEN; i++)
+		if ((msg_type == cellselstatelist[i].type)
+		 && ((1 << cs->state) & cellselstatelist[i].states))
+			break;
+	if (i == CELLSELSLLEN) {
+		if (msg_type != GSM322_EVENT_SYSINFO)
+			LOGP(DCS, LOGL_NOTICE, "Event unhandled at this state."
+				"\n");
+		return 0;
+	}
+
+	rc = cellselstatelist[i].rout(ms, msg);
+
+	return rc;
+}
+
+/* dequeue GSM 03.22 cell selection events */
+int gsm322_cs_dequeue(struct osmocom_ms *ms)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct msgb *msg;
+	int work = 0;
+
+	while ((msg = msgb_dequeue(&cs->event_queue))) {
+		/* send event to cell selection process */
+		gsm322_c_event(ms, msg);
+		msgb_free(msg);
+		work = 1; /* work done */
+	}
+
+	return work;
+}
+
+/*
+ * neighbour cell measurement process in idle mode
+ */
+
+static struct gsm322_neighbour *gsm322_nb_alloc(struct gsm322_cellsel *cs,
+	uint16_t arfcn)
+{
+	struct gsm322_neighbour *nb;
+	time_t now;
+
+	time(&now);
+
+	nb = talloc_zero(cs->ms, struct gsm322_neighbour);
+	if (!nb)
+		return 0;
+
+	nb->cs = cs;
+	nb->arfcn = arfcn;
+	nb->rla_c_dbm = -128;
+	nb->created = now;
+	llist_add_tail(&nb->entry, &cs->nb_list);
+
+	return nb;
+}
+
+static void gsm322_nb_free(struct gsm322_neighbour *nb)
+{
+	llist_del(&nb->entry);
+	talloc_free(nb);
+}
+
+/* check and calculate reselection criterion for all 6 neighbour cells and
+ * return, if cell reselection has to be triggered */
+static int gsm322_nb_check(struct osmocom_ms *ms, int any)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm48_sysinfo *s;
+	int i = 0, reselect = 0;
+	uint16_t acc_class;
+	int band, class;
+	struct gsm322_neighbour *nb;
+	time_t now;
+	char arfcn_text[10];
+
+	time(&now);
+
+	/* set out access class depending on the cell selection type */
+	if (any) {
+		acc_class = (subscr->acc_class | 0x0400); /* add emergency */
+		LOGP(DNB, LOGL_DEBUG, "Re-select using access class with "
+			"Emergency class.\n");
+	} else {
+		acc_class = subscr->acc_class;
+		LOGP(DNB, LOGL_DEBUG, "Re-select using access class.\n");
+	}
+
+	if (ms->rrlayer.monitor) {
+		vty_notify(ms, "MON: cell    ARFCN     LAC    C1  C2  CRH RLA_C "
+			"bargraph\n");
+		snprintf(arfcn_text, 10, "%s         ",
+			gsm_print_arfcn(cs->sel_arfcn));
+		arfcn_text[9] = '\0';
+		vty_notify(ms, "MON: serving %s 0x%04x %3d %3d     %4d  "
+			"%s\n", arfcn_text, cs->sel_lac, cs->c1, cs->c2,
+			cs->rla_c_dbm, bargraph(cs->rla_c_dbm / 2, -55, -24));
+	}
+
+	/* loop through all neighbour cells and select best cell */
+	llist_for_each_entry(nb, &cs->nb_list, entry) {
+		LOGP(DNB, LOGL_INFO, "Checking cell of ARFCN %s for cell "
+			"re-selection.\n", gsm_print_arfcn(nb->arfcn));
+		s = cs->list[arfcn2index(nb->arfcn)].sysinfo;
+		nb->checked_for_resel = 0;
+		nb->suitable_allowable = 0;
+		nb->c12_valid = 1;
+		nb->prio_low = 0;
+
+		if (nb->state == GSM322_NB_NOT_SUP) {
+			LOGP(DNB, LOGL_INFO, "Skip cell: ARFCN not supported."
+				"\n");
+			if (ms->rrlayer.monitor) {
+				snprintf(arfcn_text, 10, "%s         ",
+					gsm_print_arfcn(nb->arfcn));
+				arfcn_text[9] = '\0';
+				vty_notify(ms, "MON: nb %2d   %s  ARFCN not "
+					"supported\n", i + 1, arfcn_text);
+			}
+			goto cont;
+		}
+		/* check if we have successfully read BCCH */
+		if (!s || nb->state != GSM322_NB_SYSINFO) {
+			LOGP(DNB, LOGL_INFO, "Skip cell: There are no system "
+				"informations available.\n");
+			if (ms->rrlayer.monitor) {
+				snprintf(arfcn_text, 10, "%s         ",
+					gsm_print_arfcn(nb->arfcn));
+				arfcn_text[9] = '\0';
+				vty_notify(ms, "MON: nb %2d   %s           "
+					"         %4d  %s\n",
+					i + 1, arfcn_text, nb->rla_c_dbm,
+					bargraph(nb->rla_c_dbm / 2, -55, -24));
+			}
+			goto cont;
+		}
+
+		/* get prio */
+		if (s->sp && s->sp_cbq)
+			nb->prio_low = 1;
+
+		/* get C1 & C2 */
+		band = gsm_arfcn2band(nb->arfcn);
+		class = class_of_band(ms, band);
+		nb->c1 = calculate_c1(DNB, nb->rla_c_dbm, s->rxlev_acc_min_db,
+			ms_pwr_dbm(band, s->ms_txpwr_max_cch),
+			ms_class_gmsk_dbm(band, class));
+		nb->c2 = calculate_c2(nb->c1, 0,
+			(cs->last_serving_valid
+				&& cs->last_serving_arfcn == nb->arfcn),
+				s->sp, s->sp_cro, now - nb->created, s->sp_pt,
+				s->sp_to);
+		nb->c12_valid = 1;
+
+		/* calculate CRH depending on LAI */
+		if (cs->sel_mcc == s->mcc && cs->sel_mnc == s->mnc
+		 && cs->sel_lac == s->lac) {
+			LOGP(DNB, LOGL_INFO, "-> Cell of is in the same LA, "
+				"so CRH = 0\n");
+			nb->crh = 0;
+		} else if (any) {
+			LOGP(DNB, LOGL_INFO, "-> Cell of is in a different LA, "
+				"but service is limited, so CRH = 0\n");
+			nb->crh = 0;
+		} else {
+			nb->crh = s->cell_resel_hyst_db;
+			LOGP(DNB, LOGL_INFO, "-> Cell of is in a different LA, "
+				"and service is normal, so CRH = %d\n",
+				nb->crh);
+		}
+
+		if (ms->rrlayer.monitor) {
+			snprintf(arfcn_text, 10, "%s         ",
+				gsm_print_arfcn(nb->arfcn));
+			arfcn_text[9] = '\0';
+			vty_notify(ms, "MON: nb %2d   %s 0x%04x %3d %3d %2d"
+				"  %4d  %s\n", i + 1, arfcn_text, s->lac,
+				nb->c1, nb->c2, nb->crh, nb->rla_c_dbm,
+				bargraph(nb->rla_c_dbm / 2, -55, -24));
+		}
+
+		/* if cell is barred and we don't override */
+		if (s->cell_barr && !(s->sp && s->sp_cbq)) {
+			LOGP(DNB, LOGL_INFO, "Skip cell: Cell is barred.\n");
+			goto cont;
+		}
+
+		/* if we have no access to the cell and we don't override */
+		if (!subscr->acc_barr
+		 && !(acc_class & (s->class_barr ^ 0xffff))) {
+			LOGP(DNB, LOGL_INFO, "Skip cell: Class is "
+				"barred for our access. (access=%04x "
+				"barred=%04x)\n", acc_class, s->class_barr);
+			goto cont;
+		}
+
+		/* check if LA is forbidden */
+		if (any && gsm322_is_forbidden_la(ms, s->mcc, s->mnc, s->lac)) {
+			LOGP(DNB, LOGL_INFO, "Skip cell: Cell has "
+				"forbidden LA.\n");
+			goto cont;
+		}
+
+		/* check if we have same PLMN */
+		if (!any && (cs->sel_mcc != s->mcc || cs->sel_mnc != s->mnc)) {
+			LOGP(DNB, LOGL_INFO, "Skip cell: PLMN of cell "
+				"does not match target PLMN. (cell: mcc=%s "
+				"mnc=%s)\n", gsm_print_mcc(s->mcc),
+				gsm_print_mnc(s->mnc));
+			goto cont;
+		}
+
+		/* check criterion C1 */
+		if (nb->c1 < 0) {
+			LOGP(DNB, LOGL_INFO, "Skip cell: C1 criterion "
+				" (>0) not met. (C1 = %d)\n", nb->c1);
+			goto cont;
+		}
+
+		/* we can use this cell, if it is better */
+		nb->suitable_allowable = 1;
+
+		/* check priority */
+		if (!cs->prio_low && nb->prio_low) {
+			LOGP(DNB, LOGL_INFO, "Skip cell: cell has low "
+				"priority, but serving cell has normal "
+				"prio.\n");
+			goto cont;
+		}
+		if (cs->prio_low && !nb->prio_low) {
+			LOGP(DNB, LOGL_INFO, "Found cell: cell has normal "
+				"priority, but serving cell has low prio.\n");
+			reselect = 1;
+			goto cont;
+		}
+
+		/* find better cell */
+		if (nb->c2 - nb->crh > cs->c2) {
+			LOGP(DNB, LOGL_INFO, "Found cell: cell is better "
+				"than serving cell.\n");
+			reselect = 1;
+			goto cont;
+		}
+
+cont:
+		if (++i == GSM58_NB_NUMBER)
+			break;
+	}
+
+	if (!i) {
+		if (ms->rrlayer.monitor)
+			vty_notify(ms, "MON: no neighbour cells\n");
+	}
+
+	if (cs->resel_when + GSM58_RESEL_THRESHOLD >= now) {
+		LOGP(DNB, LOGL_INFO, "Found better neighbour cell, but "
+			"reselection threshold not reached.\n");
+		reselect = 0;
+	}
+
+	if (reselect && set->stick) {
+		LOGP(DNB, LOGL_INFO, "Don't trigger cell re-selection, because "
+			"we stick to serving cell.\n");
+		reselect = 0;
+	}
+
+	return reselect;
+}
+
+/* select a suitable and allowable cell */
+static int gsm322_nb_scan(struct osmocom_ms *ms)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm_settings *set = &ms->settings;
+	int i = 0;
+	struct gsm322_neighbour *nb, *best_nb_low = NULL, *best_nb_normal = 0;
+	int16_t best_low = -32768, best_normal = -32768;
+
+	if (set->stick) {
+		LOGP(DCS, LOGL_DEBUG, "Do not re-select cell, because we stick "
+			" to a cell.\n");
+		goto no_cell_found;
+	}
+
+	if (!cs->c12_valid) {
+		LOGP(DCS, LOGL_DEBUG, "Do not re-select cell, because there "
+			" are no valid C1 and C2.\n");
+		goto no_cell_found;
+	}
+
+	/* loop through all neighbour cells and select best cell */
+	llist_for_each_entry(nb, &cs->nb_list, entry) {
+		LOGP(DCS, LOGL_INFO, "Checking cell with ARFCN %s for cell "
+			"re-selection. (C2 = %d)\n", gsm_print_arfcn(nb->arfcn),
+			nb->c2);
+		/* track which cells have been checked do far */
+		if (nb->checked_for_resel) {
+			LOGP(DCS, LOGL_INFO, "Skip cell: alredy tried to "
+				"select.\n");
+			goto cont;
+		}
+
+		/* check if we can use this cell */
+		if (!nb->suitable_allowable) {
+			LOGP(DCS, LOGL_INFO, "Skip cell: not suitable and/or "
+				"allowable.\n");
+			goto cont;
+		}
+
+		/* check if cell is "better" */
+		if (nb->prio_low) {
+			if (nb->c2 - nb->crh > best_low) {
+				best_low = nb->c2 - nb->crh;
+				best_nb_low = nb;
+			}
+		} else {
+			if (nb->c2 - nb->crh > best_normal) {
+				best_normal = nb->c2 - nb->crh;
+				best_nb_normal = nb;
+			}
+		}
+
+cont:
+		if (++i == GSM58_NB_NUMBER)
+			break;
+	}
+
+	nb = NULL;
+	if (best_nb_normal) {
+		nb = best_nb_normal;
+		LOGP(DCS, LOGL_INFO, "Best neighbour cell with ARFCN %s "
+			"selected. (normal priority)\n",
+			gsm_print_arfcn(nb->arfcn));
+	}
+	if (best_nb_low) {
+		nb = best_nb_low;
+		LOGP(DCS, LOGL_INFO, "Best neighbour cell with ARFCN %s "
+			"selected. (low priority)\n",
+			gsm_print_arfcn(nb->arfcn));
+	}
+	if (!nb) {
+		struct msgb *nmsg;
+
+		LOGP(DCS, LOGL_INFO, "No (more) acceptable neighbour cell "
+			"available\n");
+
+no_cell_found:
+		/* Tell cell selection process to handle "no cell found". */
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_NO_CELL_FOUND);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_cs_sendmsg(ms, nmsg);
+
+		return 0;
+	}
+	nb->checked_for_resel = 1;
+
+	/* NOTE: We might already have system information from previous
+	 * scan. But we need recent informations, so we scan again!
+	 */
+
+	/* Tune to frequency for a while, to receive broadcasts. */
+	cs->arfcn = nb->arfcn;
+	cs->arfci = arfcn2index(cs->arfcn);
+	LOGP(DCS, LOGL_DEBUG, "Scanning ARFCN %s of neighbour "
+		"cell during cell reselection.\n", gsm_print_arfcn(cs->arfcn));
+	/* Allocate/clean system information. */
+	cs->list[cs->arfci].flags &= ~GSM322_CS_FLAG_SYSINFO;
+	if (cs->list[cs->arfci].sysinfo)
+		memset(cs->list[cs->arfci].sysinfo, 0,
+			sizeof(struct gsm48_sysinfo));
+	else
+		cs->list[cs->arfci].sysinfo = talloc_zero(ms,
+			struct gsm48_sysinfo);
+	if (!cs->list[cs->arfci].sysinfo)
+		exit(-ENOMEM);
+	cs->si = cs->list[cs->arfci].sysinfo;
+	cs->sync_retries = SYNC_RETRIES;
+	return gsm322_sync_to_cell(cs, NULL, 0);
+}
+
+/* start/modify measurement process with the current list of neighbour cells.
+ * only do that if: 1. we are camping  2. we are on serving cell */
+static int gsm322_nb_start(struct osmocom_ms *ms, int synced)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = &cs->sel_si;
+	struct gsm322_neighbour *nb, *nb2;
+	int i, num;
+	uint8_t map[128];
+	uint16_t nc[32];
+	uint8_t changed = 0;
+	int refer_pcs, index;
+	uint16_t arfcn;
+
+	if (cs->ms->settings.no_neighbour)
+		return 0;
+
+	if (synced)
+		cs->nb_meas_set = 0;
+
+	refer_pcs = gsm_refer_pcs(cs->sel_arfcn, s);
+
+	/* remove all neighbours that are not in list anymore */
+	memset(map, 0, sizeof(map));
+	llist_for_each_entry_safe(nb, nb2, &cs->nb_list, entry) {
+		i = nb->arfcn & 1023;
+		map[i >> 3] |= (1 << (i & 7));
+#ifndef TEST_INCLUDE_SERV
+		if (!(s->freq[i].mask & FREQ_TYPE_NCELL)) {
+#else
+		if (!(s->freq[i].mask & (FREQ_TYPE_NCELL | FREQ_TYPE_SERV))) {
+#endif
+			LOGP(DNB, LOGL_INFO, "Removing neighbour cell %s from "
+				"list.\n", gsm_print_arfcn(nb->arfcn));
+			gsm322_nb_free(nb);
+			changed = 1;
+			continue;
+		}
+#ifndef TEST_INCLUDE_SERV
+		 if (nb->arfcn == cs->sel_arfcn) {
+			LOGP(DNB, LOGL_INFO, "Removing serving cell %s (former "
+				"neighbour cell).\n",
+				gsm_print_arfcn(nb->arfcn));
+			gsm322_nb_free(nb);
+			changed = 1;
+			continue;
+		}
+#endif
+	}
+
+	/* add missing entries to list */
+	for (i = 0; i <= 1023; i++) {
+#ifndef TEST_INCLUDE_SERV
+		if ((s->freq[i].mask & FREQ_TYPE_NCELL) &&
+		  !(map[i >> 3] & (1 << (i & 7)))) {
+#else
+		if ((s->freq[i].mask & (FREQ_TYPE_NCELL | FREQ_TYPE_SERV)) &&
+		  !(map[i >> 3] & (1 << (i & 7)))) {
+#endif
+			index = i;
+			if (refer_pcs && i >= 512 && i <= 810)
+				index = i-512+1024;
+			arfcn = index2arfcn(index);
+#ifndef TEST_INCLUDE_SERV
+			if (arfcn == cs->sel_arfcn) {
+				LOGP(DNB, LOGL_INFO, "Omitting serving cell %s."
+					"\n", gsm_print_arfcn(cs->arfcn));
+				continue;
+			}
+#endif
+			nb = gsm322_nb_alloc(cs, arfcn);
+			LOGP(DNB, LOGL_INFO, "Adding neighbour cell %s to "
+				"list.\n", gsm_print_arfcn(nb->arfcn));
+			if (!(cs->list[index].flags & GSM322_CS_FLAG_SUPPORT))
+				nb->state = GSM322_NB_NOT_SUP;
+			changed = 1;
+		}
+	}
+
+	/* if nothing has changed, we are done */
+	if (!changed && cs->nb_meas_set)
+		return 0;
+
+	/* start neigbour cell measurement task */
+	num = 0;
+	llist_for_each_entry(nb, &cs->nb_list, entry) {
+		if (nb->state == GSM322_NB_NOT_SUP)
+			continue;
+		/* it should not happen that there are more than 32 nb-cells */
+		if (num == 32)
+			break;
+		nc[num] = nb->arfcn;
+		num++;
+	}
+	LOGP(DNB, LOGL_INFO, "Sending list of neighbour cells to layer1.\n");
+	l1ctl_tx_neigh_pm_req(ms, num, nc);
+	cs->nb_meas_set = 1;
+
+	return 1;
+}
+
+
+/* a complete set of measurements are received, calculate the RLA_C, sort */
+static int gsm322_nb_trigger_event(struct gsm322_cellsel *cs)
+{
+	struct osmocom_ms *ms = cs->ms;
+	struct gsm322_neighbour *nb, *nb_sync = NULL, *nb_again = NULL;
+	int i = 0;
+	time_t now;
+
+	time(&now);
+
+	/* check the list for reading neighbour cell's BCCH */
+	llist_for_each_entry(nb, &cs->nb_list, entry) {
+		if (nb->rla_c_dbm >= cs->ms->settings.min_rxlev_dbm) {
+			/* select the strongest unsynced cell */
+			if (nb->state == GSM322_NB_RLA_C) {
+				nb_sync = nb;
+				break;
+			}
+#if 0
+if (nb->state == GSM322_NB_SYSINFO) {
+printf("%d time to sync again: %u\n", nb->arfcn, now + GSM58_READ_AGAIN - nb->when);
+}
+#endif
+			/* select the strongest cell to be read/try again */
+			if (!nb_again) {
+				if ((nb->state == GSM322_NB_NO_SYNC
+				  || nb->state == GSM322_NB_NO_BCCH)
+				 && nb->when + GSM58_TRY_AGAIN <= now)
+					nb_again = nb;
+				else
+				if (nb->state == GSM322_NB_SYSINFO
+				 && nb->when + GSM58_READ_AGAIN <= now)
+					nb_again = nb;
+			}
+		}
+		if (++i == GSM58_NB_NUMBER)
+			break;
+	}
+
+	/* trigger sync to neighbour cell, priorize the untested cell */
+	if (nb_sync || nb_again) {
+		if (nb_sync) {
+			nb = nb_sync;
+			cs->arfcn = nb->arfcn;
+			cs->arfci = arfcn2index(cs->arfcn);
+			LOGP(DNB, LOGL_INFO, "Syncing to new neighbour cell "
+				"%s.\n", gsm_print_arfcn(cs->arfcn));
+		} else {
+			nb = nb_again;
+			cs->arfcn = nb->arfcn;
+			cs->arfci = arfcn2index(cs->arfcn);
+			LOGP(DNB, LOGL_INFO, "Syncing again to neighbour cell "
+				"%s after timerout.\n",
+				gsm_print_arfcn(cs->arfcn));
+		}
+		/* Allocate/clean system information. */
+		cs->list[cs->arfci].flags &= ~GSM322_CS_FLAG_SYSINFO;
+		if (cs->list[cs->arfci].sysinfo)
+			memset(cs->list[cs->arfci].sysinfo, 0,
+				sizeof(struct gsm48_sysinfo));
+		else
+			cs->list[cs->arfci].sysinfo = talloc_zero(ms,
+							struct gsm48_sysinfo);
+		if (!cs->list[cs->arfci].sysinfo)
+			exit(-ENOMEM);
+		cs->si = cs->list[cs->arfci].sysinfo;
+		cs->sync_retries = SYNC_RETRIES;
+		return gsm322_sync_to_cell(cs, nb, 0);
+	}
+
+	if (gsm322_nb_check(ms, (cs->state == GSM322_C7_CAMPED_ANY_CELL)) > 0) {
+		struct msgb *nmsg;
+
+		LOGP(DNB, LOGL_INFO, "Better neighbour cell triggers cell "
+			"reselection.\n");
+
+		if (ms->rrlayer.monitor)
+			vty_notify(ms, "MON: trigger cell re-selection: "
+				"better cell\n");
+
+		cs->resel_when = now;
+
+		/* unset selected cell */
+		gsm322_unselect_cell(cs);
+
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_CELL_RESEL);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_c_event(ms, nmsg);
+		msgb_free(nmsg);
+		return 0;
+	}
+
+	if (cs->neighbour) {
+		cs->arfcn = cs->sel_arfcn;
+		cs->arfci = arfcn2index(cs->arfcn);
+		cs->si = cs->list[cs->arfci].sysinfo;
+		if (!cs->si) {
+			LOGP(DNB, LOGL_FATAL, "No SI after neighbour scan, please fix!\n");
+			exit(0L);
+		}
+		LOGP(DNB, LOGL_INFO, "Syncing back to serving cell\n");
+		cs->sync_retries = SYNC_RETRIES_SERVING;
+		return gsm322_sync_to_cell(cs, NULL, 0);
+	}
+
+	/* do nothing */
+	return 0;
+}
+
+
+/* we (successfully) synced to a neighbour */
+static int gsm322_nb_synced(struct gsm322_cellsel *cs, int yes)
+{
+	time_t now;
+
+	LOGP(DNB, LOGL_INFO, "%s to neighbour cell %d.\n",
+		(yes) ? "Synced" : "Failed to sync", cs->arfcn);
+
+	if (yes) {
+		start_cs_timer(cs, GSM322_NB_TIMEOUT, 0);
+		return 0;
+	}
+
+	cs->neighbour->state = GSM322_NB_NO_SYNC;
+	time(&now);
+	cs->neighbour->when = now;
+
+	return gsm322_nb_trigger_event(cs);
+}
+
+/* we (successfully) read the neighbour */
+static int gsm322_nb_read(struct gsm322_cellsel *cs, int yes)
+{
+	time_t now;
+
+	LOGP(DNB, LOGL_INFO, "%s from neighbour cell %d (rxlev %s).\n",
+		(yes) ? "Read" : "Failed to read",
+		cs->arfcn, gsm_print_rxlev(cs->list[cs->arfci].rxlev));
+
+	cs->neighbour->state = (yes) ? GSM322_NB_SYSINFO : GSM322_NB_NO_BCCH;
+	time(&now);
+	cs->neighbour->when = now;
+
+	return gsm322_nb_trigger_event(cs);
+}
+
+/* a complete set of measurements are received, calculate the RLA_C, sort */
+static int gsm322_nb_new_rxlev(struct gsm322_cellsel *cs)
+{
+	struct gsm322_neighbour *nb, *strongest_nb;
+	int i = 0;
+	int8_t strongest;
+	struct llist_head sorted;
+	struct llist_head *lh, *lh2;
+	struct gsm48_sysinfo *s = &cs->sel_si;
+	int band = gsm_arfcn2band(cs->arfcn);
+	int class = class_of_band(cs->ms, band);
+
+
+	/* calculate the RAL_C of serving cell */
+	if (cs->rxlev_count) {
+		cs->rla_c_dbm = (cs->rxlev_sum_dbm + (cs->rxlev_count / 2))
+					/ cs->rxlev_count;
+		cs->rxlev_sum_dbm = 0;
+		cs->rxlev_count = 0;
+	}
+
+	LOGP(DNB, LOGL_INFO, "RLA_C of serving cell: %d\n", cs->rla_c_dbm);
+
+	/* calculate C1 criterion, SI 3 carries complete neighbour cell info */
+	cs->prio_low = 0;
+	if (s && (s->si3 || s->si4)) {
+		cs->c1 = calculate_c1(DNB, cs->rla_c_dbm, s->rxlev_acc_min_db,
+			ms_pwr_dbm(band, s->ms_txpwr_max_cch),
+			ms_class_gmsk_dbm(band, class));
+		cs->c2 = calculate_c2(cs->c1, 1, 0, s->sp, s->sp_cro, 0, s->sp_pt, s->sp_to);
+		cs->c12_valid = 1;
+
+		if (s->sp && s->sp_cbq)
+			cs->prio_low = 1;
+	}
+
+	/* calculate the RAL_C of neighbours */
+	llist_for_each_entry(nb, &cs->nb_list, entry) {
+		if (nb->state == GSM322_NB_NOT_SUP)
+			continue;
+		/* if sysinfo is gone due to scanning, mark neighbour as
+		 * unscanned. */
+		if (nb->state == GSM322_NB_SYSINFO) {
+			if (!cs->list[arfcn2index(nb->arfcn)].sysinfo) {
+				nb->state = GSM322_NB_NO_BCCH;
+				nb->when = 0;
+			}
+		}
+		nb->rla_c_dbm =
+			(nb->rxlev_sum_dbm + (nb->rxlev_count / 2))
+				/ nb->rxlev_count;
+		nb->rxlev_count = 0;
+		nb->rxlev_sum_dbm = 0;
+		if (nb->state == GSM322_NB_NEW)
+			nb->state = GSM322_NB_RLA_C;
+	}
+
+	/* sort the 6 strongest */
+	INIT_LLIST_HEAD(&sorted);
+
+	/* detach up to 6 of the strongest neighbour cells from list and put
+	 * them in the "sorted" list */
+	while (!llist_empty(&cs->nb_list)) {
+		strongest = -128;
+		strongest_nb = NULL;
+		llist_for_each_entry(nb, &cs->nb_list, entry) {
+			if (nb->state == GSM322_NB_NOT_SUP)
+				continue;
+			if (nb->rla_c_dbm > strongest) {
+				strongest = nb->rla_c_dbm;
+				strongest_nb = nb;
+			}
+		}
+		if (strongest_nb == NULL) /* this should not happen */
+			break;
+		LOGP(DNB, LOGL_INFO, "#%d ARFCN=%d RLA_C=%d\n",
+			i+1, strongest_nb->arfcn, strongest_nb->rla_c_dbm);
+		llist_del(&strongest_nb->entry);
+		llist_add(&strongest_nb->entry, &sorted);
+		if (++i == GSM58_NB_NUMBER)
+			break;
+	}
+
+	/* take the sorted list and attat it to the head of the neighbour cell
+	 * list */
+	llist_for_each_safe(lh, lh2, &sorted) {
+		llist_del(lh);
+		llist_add(lh, &cs->nb_list);
+	}
+
+	return gsm322_nb_trigger_event(cs);
+}
+
+/* accumulate the measurement results and check if there is a complete set for
+ * all neighbour cells received. */
+static int gsm322_nb_meas_ind(struct osmocom_ms *ms, uint16_t arfcn,
+	uint8_t rx_lev)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm322_neighbour *nb;
+	int enough_results = 1, result = 0;
+
+	llist_for_each_entry(nb, &cs->nb_list, entry) {
+		if (nb->state == GSM322_NB_NOT_SUP)
+			continue;
+		if (arfcn != nb->arfcn) {
+			if (nb->rxlev_count < RLA_C_NUM)
+				enough_results = 0;
+			continue;
+		}
+		nb->rxlev_sum_dbm += rx_lev - 110;
+		nb->rxlev_count++;
+		LOGP(DNB, LOGL_INFO, "Measurement result for ARFCN %s: %d\n",
+			gsm_print_arfcn(arfcn), rx_lev - 110);
+
+		if (nb->rxlev_count < RLA_C_NUM)
+			enough_results = 0;
+
+		result = 1;
+	}
+
+	if (!result)
+		LOGP(DNB, LOGL_INFO, "Measurement result for ARFCN %s not "
+			"requested. (not a bug)\n", gsm_print_arfcn(arfcn));
+
+	if (enough_results)
+		return gsm322_nb_new_rxlev(cs);
+
+	return 0;
+}
+
+int gsm322_meas(struct osmocom_ms *ms, uint8_t rx_lev)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+
+	if (cs->neighbour)
+		return -EINVAL;
+
+	cs->rxlev_sum_dbm += rx_lev - 110;
+	cs->rxlev_count++;
+
+	return 0;
+}
+
+/*
+ * dump lists
+ */
+
+int gsm322_dump_sorted_plmn(struct osmocom_ms *ms)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_plmn_list *temp;
+
+	LOGP(DPLMN, LOGL_INFO, "MCC    |MNC    |allowed|rx-lev\n");
+	LOGP(DPLMN, LOGL_INFO, "-------+-------+-------+-------\n");
+	llist_for_each_entry(temp, &plmn->sorted_plmn, entry) {
+		LOGP(DPLMN, LOGL_INFO, "%s    |%s%s    |%s    |%s\n",
+			gsm_print_mcc(temp->mcc), gsm_print_mnc(temp->mnc),
+			((temp->mnc & 0x00f) == 0x00f) ? " ":"",
+			(temp->cause) ? "no ":"yes",
+			gsm_print_rxlev(temp->rxlev));
+	}
+
+	return 0;
+}
+
+int gsm322_dump_cs_list(struct gsm322_cellsel *cs, uint8_t flags,
+			void (*print)(void *, const char *, ...), void *priv)
+{
+	int i;
+	struct gsm48_sysinfo *s;
+
+	print(priv, "ARFCN  |MCC    |MNC    |LAC    |cell ID|forb.LA|prio   |"
+		"min-db |max-pwr|rx-lev\n");
+	print(priv, "-------+-------+-------+-------+-------+-------+-------+"
+		"-------+-------+-------\n");
+	for (i = 0; i <= 1023+299; i++) {
+		s = cs->list[i].sysinfo;
+		if (!s || !(cs->list[i].flags & flags))
+			continue;
+		if (i >= 1024)
+			print(priv, "%4dPCS|", i-1024+512);
+		else if (i >= 512 && i <= 885)
+			print(priv, "%4dDCS|", i);
+		else
+			print(priv, "%4d   |", i);
+		if (s->mcc) {
+			print(priv, "%s    |%s%s    |", gsm_print_mcc(s->mcc),
+				gsm_print_mnc(s->mnc),
+				((s->mnc & 0x00f) == 0x00f) ? " ":"");
+			print(priv, "0x%04x |0x%04x |", s->lac, s->cell_id);
+		} else
+			print(priv, "n/a    |n/a    |n/a    |n/a    |");
+		if ((cs->list[i].flags & GSM322_CS_FLAG_SYSINFO)) {
+			if ((cs->list[i].flags & GSM322_CS_FLAG_FORBIDD))
+				print(priv, "yes    |");
+			else
+				print(priv, "no     |");
+			if ((cs->list[i].flags & GSM322_CS_FLAG_BARRED))
+				print(priv, "barred |");
+			else {
+				if (cs->list[i].sysinfo->cell_barr)
+					print(priv, "low    |");
+				else
+					print(priv, "normal |");
+			}
+		} else
+			print(priv, "n/a    |n/a    |");
+		if (s->si3 || s->si4)
+			print(priv, "%4d   |%4d   |%s\n", s->rxlev_acc_min_db,
+				s->ms_txpwr_max_cch,
+				gsm_print_rxlev(cs->list[i].rxlev));
+		else
+			print(priv, "n/a    |n/a    |n/a\n");
+	}
+	print(priv, "\n");
+
+	return 0;
+}
+
+int gsm322_dump_forbidden_la(struct osmocom_ms *ms,
+			void (*print)(void *, const char *, ...), void *priv)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_la_list *temp;
+
+	print(priv, "MCC    |MNC    |LAC    |cause\n");
+	print(priv, "-------+-------+-------+-------\n");
+	llist_for_each_entry(temp, &plmn->forbidden_la, entry)
+		print(priv, "%s    |%s%s    |0x%04x |#%d\n",
+			gsm_print_mcc(temp->mcc), gsm_print_mnc(temp->mnc),
+			((temp->mnc & 0x00f) == 0x00f) ? " ":"",
+			temp->lac, temp->cause);
+
+	return 0;
+}
+
+int gsm322_dump_ba_list(struct gsm322_cellsel *cs, uint16_t mcc, uint16_t mnc,
+			void (*print)(void *, const char *, ...), void *priv)
+{
+	struct gsm322_ba_list *ba;
+	int i;
+
+	llist_for_each_entry(ba, &cs->ba_list, entry) {
+		if (mcc && mnc && (mcc != ba->mcc || mnc != ba->mnc))
+			continue;
+		print(priv, "Band Allocation of network: MCC %s MNC %s "
+			"(%s, %s)\n", gsm_print_mcc(ba->mcc),
+			gsm_print_mnc(ba->mnc), gsm_get_mcc(ba->mcc),
+			gsm_get_mnc(ba->mcc, ba->mnc));
+		for (i = 0; i <= 1023+299; i++) {
+			if ((ba->freq[i >> 3] & (1 << (i & 7))))
+				print(priv, " %s",
+					gsm_print_arfcn(index2arfcn(i)));
+		}
+		print(priv, "\n");
+	}
+
+	return 0;
+}
+
+int gsm322_dump_nb_list(struct gsm322_cellsel *cs,
+			void (*print)(void *, const char *, ...), void *priv)
+{
+	struct gsm48_sysinfo *s;
+	struct gsm322_neighbour *nb;
+	int i = 0;
+
+	if (!cs->selected) {
+		print(priv, "No serving cell selected (yet).\n");
+		return 0;
+	}
+	print(priv, "Serving cell:\n\n");
+	print(priv, "ARFCN=%s  ", gsm_print_arfcn(cs->sel_arfcn));
+	print(priv, "RLA_C=%s  ", gsm_print_rxlev(cs->rla_c_dbm + 110));
+	if (cs->c12_valid)
+		print(priv, "C1=%d  C2=%d  ", cs->c1, cs->c1);
+	else
+		print(priv, "C1 -  C2 -  ");
+	print(priv, "LAC=0x%04x\n\n", (cs->selected) ? cs->sel_si.lac : 0);
+
+	print(priv, "Neighbour cells:\n\n");
+	llist_for_each_entry(nb, &cs->nb_list, entry) {
+		if (i == 0) {
+			print(priv, "#      |ARFCN  |RLA_C  |C1     |C2     |"
+				"CRH    |prio   |LAC    |cell ID|usable |"
+				"state\n");
+			print(priv, "----------------------------------------"
+				"----------------------------------------"
+				"-------\n");
+		} else
+		if (i == GSM58_NB_NUMBER)
+			print(priv, "--- unmonitored cells: ---\n");
+		i++;
+		if (cs->last_serving_valid
+		 && cs->last_serving_arfcn == nb->arfcn)
+			print(priv, "%2d last|", i);
+		else
+			print(priv, "%2d     |", i);
+		if ((nb->arfcn & ARFCN_PCS))
+			print(priv, "%4dPCS|", nb->arfcn & 1023);
+		else if (i >= 512 && i <= 885)
+			print(priv, "%4dDCS|", nb->arfcn & 1023);
+		else
+			print(priv, "%4d   |", nb->arfcn);
+		if (nb->state == GSM322_NB_NOT_SUP) {
+			print(priv, "  ARFCN not supported\n");
+			continue;
+		}
+		if (nb->rla_c_dbm > -128)
+			print(priv, "%6s |",
+				gsm_print_rxlev(nb->rla_c_dbm + 110));
+		else
+			print(priv, "-      |");
+		if (nb->state == GSM322_NB_SYSINFO && nb->c12_valid)
+			print(priv, "%4d   |%4d   |%4d   |", nb->c1, nb->c1,
+				nb->crh);
+		else
+			print(priv, "-      |-      |-      |");
+		s = cs->list[arfcn2index(nb->arfcn)].sysinfo;
+		if (nb->state == GSM322_NB_SYSINFO && s) {
+			print(priv, "%s |0x%04x |0x%04x |",
+				(nb->prio_low) ? "low   ":"normal", s->lac,
+				s->cell_id);
+		} else
+			print(priv, "-      |-      |-      |");
+
+		print(priv, "%s    |",
+			(nb->suitable_allowable) ? "yes" : "no ");
+		print(priv, "%s\n", get_nb_state_name(nb->state));
+	}
+
+	if (i == 0)
+		print(priv, "No neighbour cells available (yet).\n");
+
+	return 0;
+}
+
+/*
+ * initialization
+ */
+
+int gsm322_init(struct osmocom_ms *ms)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	FILE *fp;
+	char *ba_filename;
+	int i;
+	struct gsm322_ba_list *ba;
+	uint8_t buf[4];
+	char version[32];
+
+	LOGP(DPLMN, LOGL_INFO, "init PLMN process\n");
+	LOGP(DCS, LOGL_INFO, "init Cell Selection process\n");
+
+	memset(plmn, 0, sizeof(*plmn));
+	memset(cs, 0, sizeof(*cs));
+	plmn->ms = ms;
+	cs->ms = ms;
+
+	/* set initial state */
+	plmn->state = 0;
+	cs->state = 0;
+
+	/* init lists */
+	INIT_LLIST_HEAD(&plmn->event_queue);
+	INIT_LLIST_HEAD(&cs->event_queue);
+	INIT_LLIST_HEAD(&plmn->sorted_plmn);
+	INIT_LLIST_HEAD(&plmn->forbidden_la);
+	INIT_LLIST_HEAD(&cs->ba_list);
+	INIT_LLIST_HEAD(&cs->nb_list);
+
+	/* set supported frequencies in cell selection list */
+	for (i = 0; i <= 1023+299; i++)
+		if ((ms->settings.freq_map[i >> 3] & (1 << (i & 7))))
+			cs->list[i].flags |= GSM322_CS_FLAG_SUPPORT;
+
+	/* read BA list */
+	ba_filename = talloc_asprintf(ms, "%s/%s.ba", config_dir, ms->name);
+	fp = fopen(ba_filename, "r");
+	talloc_free(ba_filename);
+	if (fp) {
+		int rc;
+		char *s_rc;
+
+		s_rc = fgets(version, sizeof(version), fp);
+		version[sizeof(version) - 1] = '\0';
+		if (!s_rc || !!strcmp(ba_version, version)) {
+			LOGP(DCS, LOGL_NOTICE, "BA version missmatch, "
+				"stored BA list becomes obsolete.\n");
+		} else
+		while(!feof(fp)) {
+			ba = talloc_zero(ms, struct gsm322_ba_list);
+			if (!ba)
+				return -ENOMEM;
+			rc = fread(buf, 4, 1, fp);
+			if (!rc) {
+				talloc_free(ba);
+				break;
+			}
+			ba->mcc = (buf[0] << 8) | buf[1];
+			ba->mnc = (buf[2] << 8) | buf[3];
+			rc = fread(ba->freq, sizeof(ba->freq), 1, fp);
+			if (!rc) {
+				talloc_free(ba);
+				break;
+			}
+			llist_add_tail(&ba->entry, &cs->ba_list);
+			LOGP(DCS, LOGL_INFO, "Read stored BA list (mcc=%s "
+				"mnc=%s  %s, %s)\n", gsm_print_mcc(ba->mcc),
+				gsm_print_mnc(ba->mnc), gsm_get_mcc(ba->mcc),
+				gsm_get_mnc(ba->mcc, ba->mnc));
+		}
+		fclose(fp);
+	} else
+		LOGP(DCS, LOGL_INFO, "No stored BA list\n");
+
+	return 0;
+}
+
+int gsm322_exit(struct osmocom_ms *ms)
+{
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct llist_head *lh, *lh2;
+	struct msgb *msg;
+	FILE *fp;
+	char *ba_filename;
+	struct gsm322_ba_list *ba;
+	uint8_t buf[4];
+	int rc = 0;
+	int i;
+
+	LOGP(DPLMN, LOGL_INFO, "exit PLMN process\n");
+	LOGP(DCS, LOGL_INFO, "exit Cell Selection process\n");
+
+	/* stop cell selection process (if any) */
+	new_c_state(cs, GSM322_C0_NULL);
+
+	/* stop timers */
+	stop_cs_timer(cs);
+	stop_any_timer(cs);
+	stop_plmn_timer(plmn);
+
+	/* flush sysinfo */
+	for (i = 0; i <= 1023+299; i++) {
+		if (cs->list[i].sysinfo) {
+			LOGP(DCS, LOGL_DEBUG, "free sysinfo ARFCN=%s\n",
+				gsm_print_arfcn(index2arfcn(i)));
+			talloc_free(cs->list[i].sysinfo);
+			cs->list[i].sysinfo = NULL;
+		}
+		cs->list[i].flags = 0;
+	}
+	cs->si = NULL;
+
+	/* store BA list */
+	ba_filename = talloc_asprintf(ms, "%s/%s.ba", config_dir, ms->name);
+	if (ba_filename) {
+		fp = fopen(ba_filename, "w");
+		talloc_free(ba_filename);
+		if (fp) {
+			fputs(ba_version, fp);
+			llist_for_each_entry(ba, &cs->ba_list, entry) {
+				buf[0] = ba->mcc >> 8;
+				buf[1] = ba->mcc & 0xff;
+				buf[2] = ba->mnc >> 8;
+				buf[3] = ba->mnc & 0xff;
+
+				rc += fwrite(buf, 4, 1, fp);
+				rc += fwrite(ba->freq, sizeof(ba->freq), 1, fp);
+			}
+			fclose(fp);
+		}
+	}
+
+	if (rc == 2)
+		LOGP(DCS, LOGL_INFO, "Write stored BA list (mcc=%s "
+			"mnc=%s  %s, %s)\n", gsm_print_mcc(ba->mcc),
+			gsm_print_mnc(ba->mnc), gsm_get_mcc(ba->mcc),
+			gsm_get_mnc(ba->mcc, ba->mnc));
+	else
+		LOGP(DCS, LOGL_ERROR, "Failed to write BA list\n");
+
+	/* free lists */
+	while ((msg = msgb_dequeue(&plmn->event_queue)))
+		msgb_free(msg);
+	while ((msg = msgb_dequeue(&cs->event_queue)))
+		msgb_free(msg);
+	llist_for_each_safe(lh, lh2, &plmn->sorted_plmn) {
+		llist_del(lh);
+		talloc_free(lh);
+	}
+	llist_for_each_safe(lh, lh2, &plmn->forbidden_la) {
+		llist_del(lh);
+		talloc_free(lh);
+	}
+	llist_for_each_safe(lh, lh2, &cs->ba_list) {
+		llist_del(lh);
+		talloc_free(lh);
+	}
+	llist_for_each_safe(lh, lh2, &cs->nb_list)
+		gsm322_nb_free(container_of(lh, struct gsm322_neighbour,
+				entry));
+	return 0;
+}
diff --git a/src/host/layer23/src/mobile/gsm411_sms.c b/src/host/layer23/src/mobile/gsm411_sms.c
new file mode 100644
index 00000000..c476ff40
--- /dev/null
+++ b/src/host/layer23/src/mobile/gsm411_sms.c
@@ -0,0 +1,955 @@
+/*
+ * Code based on work of:
+ * (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
+ * (C) 2009 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2010 by On-Waves
+ *
+ * (C) 2011 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/mobile/mncc.h>
+#include <osmocom/bb/mobile/transaction.h>
+#include <osmocom/bb/mobile/gsm411_sms.h>
+#include <osmocom/gsm/gsm0411_utils.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/bb/mobile/vty.h>
+#include <osmocom/bb/mobile/primitives.h>
+
+#define UM_SAPI_SMS 3
+
+extern void *l23_ctx;
+static uint32_t new_callref = 0x40000001;
+
+static int gsm411_rl_recv(struct gsm411_smr_inst *inst, int msg_type,
+                        struct msgb *msg);
+static int gsm411_mn_recv(struct gsm411_smc_inst *inst, int msg_type,
+			struct msgb *msg);
+static int gsm411_mm_send(struct gsm411_smc_inst *inst, int msg_type,
+			struct msgb *msg, int cp_msg_type);
+static int gsm411_mn_send(struct gsm411_smr_inst *inst, int msg_type,
+			struct msgb *msg);
+/*
+ * init / exit
+ */
+
+int gsm411_sms_init(struct osmocom_ms *ms)
+{
+	LOGP(DLSMS, LOGL_INFO, "init SMS\n");
+
+	return 0;
+}
+
+int gsm411_sms_exit(struct osmocom_ms *ms)
+{
+	struct gsm_trans *trans, *trans2;
+
+	LOGP(DLSMS, LOGL_INFO, "exit SMS processes for %s\n", ms->name);
+
+	llist_for_each_entry_safe(trans, trans2, &ms->trans_list, entry) {
+		if (trans->protocol == GSM48_PDISC_SMS) {
+			LOGP(DLSMS, LOGL_NOTICE, "Free pendig "
+				"SMS-transaction.\n");
+			trans_free(trans);
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * SMS content
+ */
+
+struct gsm_sms *sms_alloc(void)
+{
+	return talloc_zero(l23_ctx, struct gsm_sms);
+}
+
+void sms_free(struct gsm_sms *sms)
+{
+	talloc_free(sms);
+}
+
+struct gsm_sms *sms_from_text(const char *receiver, int dcs, const char *text)
+{
+	struct gsm_sms *sms = sms_alloc();
+
+	if (!sms)
+		return NULL;
+
+	OSMO_STRLCPY_ARRAY(sms->text, text);
+
+	/* FIXME: don't use ID 1 static */
+	sms->reply_path_req = 0;
+	sms->status_rep_req = 0;
+	sms->ud_hdr_ind = 0;
+	sms->protocol_id = 0; /* implicit */
+	sms->data_coding_scheme = dcs;
+	OSMO_STRLCPY_ARRAY(sms->address, receiver);
+	/* Generate user_data */
+	sms->user_data_len = gsm_7bit_encode_n(sms->user_data,
+		sizeof(sms->user_data), sms->text, NULL);
+
+	return sms;
+}
+
+static int gsm411_sms_report(struct osmocom_ms *ms, struct gsm_sms *sms,
+	uint8_t cause)
+{
+	vty_notify(ms, NULL);
+	if (!cause)
+		vty_notify(ms, "SMS to %s successfull\n", sms->address);
+	else
+		vty_notify(ms, "SMS to %s failed: %s\n", sms->address,
+			get_value_string(gsm411_rp_cause_strs, cause));
+
+	mobile_prim_ntfy_sms_status(ms, sms, cause);
+	return 0;
+}
+/*
+ * transaction
+ */
+
+/* SMS Specific transaction release.
+ * gets called by trans_free, DO NOT CALL YOURSELF!
+ */
+void _gsm411_sms_trans_free(struct gsm_trans *trans)
+{
+	gsm411_smr_clear(&trans->sms.smr_inst);
+	gsm411_smc_clear(&trans->sms.smc_inst);
+
+	if (trans->sms.sms) {
+		LOGP(DLSMS, LOGL_ERROR, "Transaction contains SMS.\n");
+		gsm411_sms_report(trans->ms, trans->sms.sms,
+			GSM411_RP_CAUSE_MO_SMS_REJECTED);
+		sms_free(trans->sms.sms);
+		trans->sms.sms = NULL;
+	}
+}
+
+/* release MM connection, free transaction */
+static int gsm411_trans_free(struct gsm_trans *trans)
+{
+	struct msgb *nmsg;
+
+	/* release MM connection */
+	nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMSMS_REL_REQ, trans->callref,
+				trans->transaction_id, trans->sms.sapi);
+	if (!nmsg)
+		return -ENOMEM;
+	LOGP(DLSMS, LOGL_INFO, "Sending MMSMS_REL_REQ\n");
+	gsm48_mmxx_downmsg(trans->ms, nmsg);
+
+	trans->callref = 0;
+	trans_free(trans);
+
+	return 0;
+}
+
+/*
+ * receive SMS
+ */
+
+/* store the SMS to disk */
+static int sms_store(struct osmocom_ms *ms, struct msgb *msg,
+	struct gsm_sms *gsms)
+{
+	const char osmocomsms[] = ".osmocom/bb/sms.txt";
+	const char *home;
+	char *sms_file;
+	char vty_text[sizeof(gsms->text)], *p;
+	FILE *fp;
+
+	/* remove linefeeds and show at VTY */
+	strcpy(vty_text, gsms->text);
+	for (p = vty_text; *p; p++) {
+		if (*p == '\n' || *p == '\r')
+			*p = ' ';
+	}
+	vty_notify(ms, NULL);
+	vty_notify(ms, "SMS from %s: '%s'\n", gsms->address, vty_text);
+
+	home = getenv("HOME");
+        if (!home) {
+fail:
+		fprintf(stderr, "Can't deliver SMS, be sure to create '%s' in "
+			"your home directory.\n", osmocomsms);
+		return GSM411_RP_CAUSE_MT_MEM_EXCEEDED;
+	}
+	sms_file = talloc_asprintf(l23_ctx, "%s/%s", home, osmocomsms);
+	if (!sms_file)
+		goto fail;
+
+	fp = fopen(sms_file, "a");
+	if (!fp) {
+		talloc_free(sms_file);
+		goto fail;
+	}
+	fprintf(fp, "[SMS from %s]\n%s\n", gsms->address, gsms->text);
+	fclose(fp);
+
+	talloc_free(sms_file);
+
+	return 0;
+}
+
+/* now here comes our SMS */
+static int gsm340_rx_sms_deliver(struct osmocom_ms *ms, struct msgb *msg,
+	struct gsm_sms *gsms)
+{
+	mobile_prim_ntfy_sms_new(ms, gsms);
+	if (!ms->settings.store_sms)
+		return 0;
+	return sms_store(ms, msg, gsms);
+}
+
+/* process an incoming TPDU (called from RP-DATA)
+ * return value > 0: RP CAUSE for ERROR; < 0: silent error; 0 = success */
+static int gsm340_rx_tpdu(struct gsm_trans *trans, struct msgb *msg, uint8_t msg_ref)
+{
+	uint8_t *smsp = msgb_sms(msg);
+	struct gsm_sms *gsms;
+	unsigned int sms_alphabet;
+	uint8_t sms_mti;
+	uint8_t oa_len_bytes;
+	uint8_t address_lv[12]; /* according to 03.40 / 9.1.2.5 */
+	int rc = 0;
+
+	gsms = sms_alloc();
+	gsms->msg_ref = msg_ref;
+
+	/* invert those fields where 0 means active/present */
+	sms_mti = *smsp & 0x03;
+	/* uint8_t sms_mms = !!(*smsp & 0x04); */
+	gsms->status_rep_req = (*smsp & 0x20);
+	gsms->ud_hdr_ind = (*smsp & 0x40);
+	gsms->reply_path_req  = (*smsp & 0x80);
+	smsp++;
+
+	/* length in bytes of the originate address */
+	oa_len_bytes = 2 + *smsp/2 + *smsp%2;
+	if (oa_len_bytes > 12) {
+		LOGP(DLSMS, LOGL_ERROR, "Originate Address > 12 bytes ?!?\n");
+		rc = GSM411_RP_CAUSE_SEMANT_INC_MSG;
+		goto out;
+	}
+	memset(address_lv, 0, sizeof(address_lv));
+	memcpy(address_lv, smsp, oa_len_bytes);
+	/* mangle first byte to reflect length in bytes, not digits */
+	address_lv[0] = oa_len_bytes - 1;
+	/* convert to real number */
+	if (((smsp[1] & 0x70) >> 4) == 1)
+		strcpy(gsms->address, "+");
+	else if (((smsp[1] & 0x70) >> 4) == 2)
+		strcpy(gsms->address, "0");
+	else
+		gsms->address[0] = '\0';
+	gsm48_decode_bcd_number(gsms->address + strlen(gsms->address),
+		sizeof(gsms->address) - strlen(gsms->address), address_lv, 1);
+	smsp += oa_len_bytes;
+
+	gsms->protocol_id = *smsp++;
+	gsms->data_coding_scheme = *smsp++;
+
+	sms_alphabet = gsm338_get_sms_alphabet(gsms->data_coding_scheme);
+	if (sms_alphabet == 0xffffffff) {
+		sms_free(gsms);
+		return GSM411_RP_CAUSE_MO_NET_OUT_OF_ORDER;
+	}
+
+	/* get timestamp */
+	gsms->time = gsm340_scts(smsp);
+	smsp += 7;
+
+	/* user data */
+	gsms->user_data_len = *smsp++;
+	if (gsms->user_data_len) {
+		memcpy(gsms->user_data, smsp, gsms->user_data_len);
+
+		switch (sms_alphabet) {
+		case DCS_7BIT_DEFAULT:
+			gsm_7bit_decode_n(gsms->text, sizeof(gsms->text),
+				smsp, gsms->user_data_len);
+			break;
+		case DCS_8BIT_DATA:
+		case DCS_UCS2:
+		case DCS_NONE:
+			break;
+		}
+	}
+
+	LOGP(DLSMS, LOGL_INFO, "RX SMS: MTI: 0x%02x, "
+	     "MR: 0x%02x PID: 0x%02x, DCS: 0x%02x, OA: %s, "
+	     "UserDataLength: 0x%02x, UserData: \"%s\"\n",
+	     sms_mti, gsms->msg_ref,
+	     gsms->protocol_id, gsms->data_coding_scheme, gsms->address,
+	     gsms->user_data_len,
+			sms_alphabet == DCS_7BIT_DEFAULT ? gsms->text :
+				osmo_hexdump(gsms->user_data,
+						gsms->user_data_len));
+
+	switch (sms_mti) {
+	case GSM340_SMS_DELIVER_SC2MS:
+		/* MS is receiving an SMS */
+		rc = gsm340_rx_sms_deliver(trans->ms, msg, gsms);
+		break;
+	case GSM340_SMS_STATUS_REP_SC2MS:
+	case GSM340_SMS_SUBMIT_REP_SC2MS:
+		LOGP(DLSMS, LOGL_NOTICE, "Unimplemented MTI 0x%02x\n", sms_mti);
+		rc = GSM411_RP_CAUSE_IE_NOTEXIST;
+		break;
+	default:
+		LOGP(DLSMS, LOGL_NOTICE, "Undefined MTI 0x%02x\n", sms_mti);
+		rc = GSM411_RP_CAUSE_IE_NOTEXIST;
+		break;
+	}
+
+out:
+	sms_free(gsms);
+
+	return rc;
+}
+
+static int gsm411_send_rp_ack(struct gsm_trans *trans, uint8_t msg_ref)
+{
+	struct msgb *msg = gsm411_msgb_alloc();
+
+	LOGP(DLSMS, LOGL_INFO, "TX: SMS RP ACK\n");
+
+	gsm411_push_rp_header(msg, GSM411_MT_RP_ACK_MO, msg_ref);
+	return gsm411_smr_send(&trans->sms.smr_inst, GSM411_SM_RL_REPORT_REQ,
+		msg);
+}
+
+static int gsm411_send_rp_error(struct gsm_trans *trans,
+				uint8_t msg_ref, uint8_t cause)
+{
+	struct msgb *msg = gsm411_msgb_alloc();
+
+	msgb_tv_put(msg, 1, cause);
+
+	LOGP(DLSMS, LOGL_NOTICE, "TX: SMS RP ERROR, cause %d (%s)\n", cause,
+		get_value_string(gsm411_rp_cause_strs, cause));
+
+	gsm411_push_rp_header(msg, GSM411_MT_RP_ERROR_MO, msg_ref);
+	return gsm411_smr_send(&trans->sms.smr_inst, GSM411_SM_RL_REPORT_REQ,
+		msg);
+}
+
+/* Receive a 04.11 TPDU inside RP-DATA / user data */
+static int gsm411_rx_rp_ud(struct msgb *msg, struct gsm_trans *trans,
+			  struct gsm411_rp_hdr *rph,
+			  uint8_t src_len, uint8_t *src,
+			  uint8_t dst_len, uint8_t *dst,
+			  uint8_t tpdu_len, uint8_t *tpdu)
+{
+	int rc = 0;
+
+	if (dst_len && dst)
+		LOGP(DLSMS, LOGL_ERROR, "RP-DATA (MT) with DST ?!?\n");
+
+	if (!src_len || !src || !tpdu_len || !tpdu) {
+		LOGP(DLSMS, LOGL_ERROR,
+			"RP-DATA (MO) without DST or TPDU ?!?\n");
+		gsm411_send_rp_error(trans, rph->msg_ref,
+				     GSM411_RP_CAUSE_INV_MAND_INF);
+		return -EIO;
+	}
+	msg->l4h = tpdu;
+
+	LOGP(DLSMS, LOGL_INFO, "DST(%u,%s)\n", src_len,
+		osmo_hexdump(src, src_len));
+	LOGP(DLSMS, LOGL_INFO, "TPDU(%ti,%s)\n", msg->tail-msg->l4h,
+		osmo_hexdump(msg->l4h, msg->tail-msg->l4h));
+
+	rc = gsm340_rx_tpdu(trans, msg, rph->msg_ref);
+	if (rc == 0)
+		return gsm411_send_rp_ack(trans, rph->msg_ref);
+	else if (rc > 0)
+		return gsm411_send_rp_error(trans, rph->msg_ref, rc);
+	else
+		return rc;
+}
+
+/* Receive a 04.11 RP-DATA message in accordance with Section 7.3.1.2 */
+static int gsm411_rx_rp_data(struct msgb *msg, struct gsm_trans *trans,
+			     struct gsm411_rp_hdr *rph)
+{
+	uint8_t src_len, dst_len, rpud_len;
+	uint8_t *src = NULL, *dst = NULL , *rp_ud = NULL;
+
+	/* in the MO case, this should always be zero length */
+	src_len = rph->data[0];
+	if (src_len)
+		src = &rph->data[1];
+
+	dst_len = rph->data[1+src_len];
+	if (dst_len)
+		dst = &rph->data[1+src_len+1];
+
+	rpud_len = rph->data[1+src_len+1+dst_len];
+	if (rpud_len)
+		rp_ud = &rph->data[1+src_len+1+dst_len+1];
+
+	LOGP(DLSMS, LOGL_INFO, "RX_RP-DATA: src_len=%u, dst_len=%u ud_len=%u\n",
+		src_len, dst_len, rpud_len);
+	return gsm411_rx_rp_ud(msg, trans, rph, src_len, src, dst_len, dst,
+				rpud_len, rp_ud);
+}
+
+/* receive RL DATA */
+static int gsm411_rx_rl_data(struct msgb *msg, struct gsm48_hdr *gh,
+			     struct gsm_trans *trans)
+{
+	struct gsm411_rp_hdr *rp_data = (struct gsm411_rp_hdr*)&gh->data;
+	uint8_t msg_type =  rp_data->msg_type & 0x07;
+	int rc = 0;
+
+	switch (msg_type) {
+	case GSM411_MT_RP_DATA_MT:
+		LOGP(DLSMS, LOGL_INFO, "RX SMS RP-DATA (MT)\n");
+		rc = gsm411_rx_rp_data(msg, trans, rp_data);
+		break;
+	default:
+		LOGP(DLSMS, LOGL_NOTICE, "Invalid RP type 0x%02x\n", msg_type);
+		gsm411_trans_free(trans);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+/*
+ * send SMS
+ */
+
+/* Receive a 04.11 RP-ACK message (response to RP-DATA from us) */
+static int gsm411_rx_rp_ack(struct msgb *msg, struct gsm_trans *trans,
+			    struct gsm411_rp_hdr *rph)
+{
+	struct osmocom_ms *ms = trans->ms;
+	struct gsm_sms *sms = trans->sms.sms;
+
+	/* Acnkowledgement to MT RP_DATA, i.e. the MS confirms it
+	 * successfully received a SMS.  We can now safely mark it as
+	 * transmitted */
+
+	if (!sms) {
+		LOGP(DLSMS, LOGL_ERROR, "RX RP-ACK but no sms in "
+			"transaction?!?\n");
+		return gsm411_send_rp_error(trans, rph->msg_ref,
+					    GSM411_RP_CAUSE_PROTOCOL_ERR);
+	}
+
+	gsm411_sms_report(ms, sms, 0);
+
+	sms_free(sms);
+	trans->sms.sms = NULL;
+
+	return 0;
+}
+
+static int gsm411_rx_rp_error(struct msgb *msg, struct gsm_trans *trans,
+			      struct gsm411_rp_hdr *rph)
+{
+	struct osmocom_ms *ms = trans->ms;
+	struct gsm_sms *sms = trans->sms.sms;
+	uint8_t cause_len = rph->data[0];
+	uint8_t cause = rph->data[1];
+
+	/* Error in response to MT RP_DATA, i.e. the MS did not
+	 * successfully receive the SMS.  We need to investigate
+	 * the cause and take action depending on it */
+
+	LOGP(DLSMS, LOGL_NOTICE, "%s: RX SMS RP-ERROR, cause %d:%d (%s)\n",
+	     trans->ms->name, cause_len, cause,
+	     get_value_string(gsm411_rp_cause_strs, cause));
+
+	if (!sms) {
+		LOGP(DLSMS, LOGL_ERROR,
+			"RX RP-ERR, but no sms in transaction?!?\n");
+		return -EINVAL;
+#if 0
+		return gsm411_send_rp_error(trans, rph->msg_ref,
+					    GSM411_RP_CAUSE_PROTOCOL_ERR);
+#endif
+	}
+
+	gsm411_sms_report(ms, sms, cause);
+
+	sms_free(sms);
+	trans->sms.sms = NULL;
+
+	return 0;
+}
+
+/* receive RL REPORT */
+static int gsm411_rx_rl_report(struct msgb *msg, struct gsm48_hdr *gh,
+			     struct gsm_trans *trans)
+{
+	struct gsm411_rp_hdr *rp_data = (struct gsm411_rp_hdr*)&gh->data;
+	uint8_t msg_type =  rp_data->msg_type & 0x07;
+	int rc = 0;
+
+	switch (msg_type) {
+	case GSM411_MT_RP_ACK_MT:
+		LOGP(DLSMS, LOGL_INFO, "RX SMS RP-ACK (MT)\n");
+		rc = gsm411_rx_rp_ack(msg, trans, rp_data);
+		break;
+	case GSM411_MT_RP_ERROR_MT:
+		LOGP(DLSMS, LOGL_INFO, "RX SMS RP-ERROR (MT)\n");
+		rc = gsm411_rx_rp_error(msg, trans, rp_data);
+		break;
+	default:
+		LOGP(DLSMS, LOGL_NOTICE, "Invalid RP type 0x%02x\n", msg_type);
+		gsm411_trans_free(trans);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+/* generate a msgb containing a TPDU derived from struct gsm_sms,
+ * returns total size of TPDU */
+static int gsm340_gen_tpdu(struct msgb *msg, struct gsm_sms *sms)
+{
+	uint8_t *smsp;
+	uint8_t da[12];	/* max len per 03.40 */
+	uint8_t da_len = 0;
+	uint8_t octet_len;
+	unsigned int old_msg_len = msg->len;
+	uint8_t sms_vpf = GSM340_TP_VPF_NONE;
+	uint8_t sms_vp;
+
+	/* generate first octet with masked bits */
+	smsp = msgb_put(msg, 1);
+	/* TP-MTI (message type indicator) */
+	*smsp = GSM340_SMS_SUBMIT_MS2SC;
+	/* TP-RD */
+	if (0 /* FIXME */)
+		*smsp |= 0x04;
+	/* TP-VPF */
+	*smsp |= (sms_vpf << 3);
+	/* TP-SRI(deliver)/SRR(submit) */
+	if (sms->status_rep_req)
+		*smsp |= 0x20;
+	/* TP-UDHI (indicating TP-UD contains a header) */
+	if (sms->ud_hdr_ind)
+		*smsp |= 0x40;
+	/* TP-RP */
+	if (sms->reply_path_req)
+		*smsp |= 0x80;
+
+	/* generate message ref */
+	smsp = msgb_put(msg, 1);
+	*smsp = sms->msg_ref;
+
+	/* generate destination address */
+	if (sms->address[0] == '+')
+		da_len = gsm340_gen_oa(da, sizeof(da), 0x1, 0x1,
+							sms->address + 1);
+	else
+		da_len = gsm340_gen_oa(da, sizeof(da), 0x0, 0x1, sms->address);
+	smsp = msgb_put(msg, da_len);
+	memcpy(smsp, da, da_len);
+
+	/* generate TP-PID */
+	smsp = msgb_put(msg, 1);
+	*smsp = sms->protocol_id;
+
+	/* generate TP-DCS */
+	smsp = msgb_put(msg, 1);
+	*smsp = sms->data_coding_scheme;
+
+	/* generate TP-VP */
+	switch (sms_vpf) {
+	case GSM340_TP_VPF_NONE:
+		sms_vp = 0;
+		break;
+	default:
+		fprintf(stderr, "VPF unsupported, please fix!\n");
+		exit(0);
+	}
+	smsp = msgb_put(msg, sms_vp);
+
+	/* generate TP-UDL */
+	smsp = msgb_put(msg, 1);
+	*smsp = sms->user_data_len;
+
+	/* generate TP-UD */
+	switch (gsm338_get_sms_alphabet(sms->data_coding_scheme)) {
+	case DCS_7BIT_DEFAULT:
+		octet_len = sms->user_data_len*7/8;
+		if (sms->user_data_len*7%8 != 0)
+			octet_len++;
+		/* Warning, user_data_len indicates the amount of septets
+		 * (characters), we need amount of octets occupied */
+		smsp = msgb_put(msg, octet_len);
+		memcpy(smsp, sms->user_data, octet_len);
+		break;
+	case DCS_UCS2:
+	case DCS_8BIT_DATA:
+		smsp = msgb_put(msg, sms->user_data_len);
+		memcpy(smsp, sms->user_data, sms->user_data_len);
+		break;
+	default:
+		LOGP(DLSMS, LOGL_NOTICE, "Unhandled Data Coding Scheme: "
+			"0x%02X\n", sms->data_coding_scheme);
+		break;
+	}
+
+	return msg->len - old_msg_len;
+}
+
+/* Take a SMS in gsm_sms structure and send it. */
+int gsm411_tx_sms_submit(struct osmocom_ms *ms, const char *sms_sca,
+	struct gsm_sms *sms)
+{
+	struct msgb *msg;
+	struct gsm_trans *trans;
+	uint8_t *data, *rp_ud_len;
+	int rc;
+	int transaction_id;
+	uint8_t sca[11];	/* max len per 03.40 */
+
+	LOGP(DLSMS, LOGL_INFO, "..._sms_submit()\n");
+
+	/* no running, no transaction */
+	if (!ms->started || ms->shutdown != MS_SHUTDOWN_NONE) {
+		LOGP(DLSMS, LOGL_ERROR, "Phone is down\n");
+		gsm411_sms_report(ms, sms, GSM411_RP_CAUSE_MO_TEMP_FAIL);
+		sms_free(sms);
+		return -EIO;
+	}
+
+	/* allocate transaction with dummy reference */
+	transaction_id = trans_assign_trans_id(ms, GSM48_PDISC_SMS, 0);
+	if (transaction_id < 0) {
+		LOGP(DLSMS, LOGL_ERROR, "No transaction ID available\n");
+		gsm411_sms_report(ms, sms, GSM411_RP_CAUSE_MO_CONGESTION);
+		sms_free(sms);
+		return -ENOMEM;
+	}
+	trans = trans_alloc(ms, GSM48_PDISC_SMS, transaction_id, new_callref++);
+	if (!trans) {
+		LOGP(DLSMS, LOGL_ERROR, "No memory for trans\n");
+		gsm411_sms_report(ms, sms, GSM411_RP_CAUSE_MO_TEMP_FAIL);
+		sms_free(sms);
+		return -ENOMEM;
+	}
+	gsm411_smc_init(&trans->sms.smc_inst, transaction_id, 0,
+		gsm411_mn_recv, gsm411_mm_send);
+	gsm411_smr_init(&trans->sms.smr_inst, transaction_id, 0,
+		gsm411_rl_recv, gsm411_mn_send);
+	trans->sms.sms = sms;
+	trans->sms.sapi = UM_SAPI_SMS;
+
+	msg = gsm411_msgb_alloc();
+
+	/* no orig Address */
+	data = (uint8_t *)msgb_put(msg, 1);
+	data[0] = 0x00;	/* originator length == 0 */
+
+	/* Destination Address */
+        sca[1] = 0x80; /* no extension */
+	sca[1] |= ((sms_sca[0] == '+') ? 0x01 : 0x00) << 4; /* type */
+	sca[1] |= 0x1; /* plan*/
+
+	rc = gsm48_encode_bcd_number(sca, sizeof(sca), 1,
+				sms_sca + (sms_sca[0] == '+'));
+	if (rc < 0) {
+error:
+		gsm411_sms_report(ms, sms, GSM411_RP_CAUSE_SEMANT_INC_MSG);
+		gsm411_trans_free(trans);
+		msgb_free(msg);
+		return rc;
+	}
+	data = msgb_put(msg, rc);
+	memcpy(data, sca, rc);
+
+	/* obtain a pointer for the rp_ud_len, so we can fill it later */
+	rp_ud_len = (uint8_t *)msgb_put(msg, 1);
+
+	/* generate the 03.40 TPDU */
+	rc = gsm340_gen_tpdu(msg, sms);
+	if (rc < 0)
+		goto error;
+	*rp_ud_len = rc;
+
+	LOGP(DLSMS, LOGL_INFO, "TX: SMS DELIVER\n");
+
+	gsm411_push_rp_header(msg, GSM411_MT_RP_DATA_MO, sms->msg_ref);
+	return gsm411_smr_send(&trans->sms.smr_inst, GSM411_SM_RL_DATA_REQ,
+		msg);
+}
+
+/* create and send SMS */
+int sms_send(struct osmocom_ms *ms, const char *sms_sca, const char *number,
+	const char *text, uint8_t msg_ref)
+{
+	struct gsm_sms *sms = sms_from_text(number, 0, text);
+
+	if (!sms)
+		return -ENOMEM;
+
+	sms->msg_ref = msg_ref;
+	return gsm411_tx_sms_submit(ms, sms_sca, sms);
+}
+
+/*
+ * message flow between layers
+ */
+
+/* push MMSMS header and send to MM */
+static int gsm411_to_mm(struct msgb *msg, struct gsm_trans *trans,
+	int msg_type)
+{
+	struct gsm48_mmxx_hdr *mmh;
+
+	/* push RR header */
+	msgb_push(msg, sizeof(struct gsm48_mmxx_hdr));
+	mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	mmh->msg_type = msg_type;
+	mmh->ref = trans->callref;
+	mmh->transaction_id = trans->transaction_id;
+	mmh->sapi = trans->sms.sapi;
+	mmh->emergency = 0;
+
+	/* send message to MM */
+	LOGP(DLSMS, LOGL_INFO, "Sending '%s' to MM (callref=%x, "
+		"transaction_id=%d, sapi=%d)\n", get_mmxx_name(msg_type),
+		trans->callref, trans->transaction_id, trans->sms.sapi);
+	return gsm48_mmxx_downmsg(trans->ms, msg);
+}
+
+/* mm_send: receive MMSMS sap message from SMC */
+static int gsm411_mm_send(struct gsm411_smc_inst *inst, int msg_type,
+			struct msgb *msg, int cp_msg_type)
+{
+	struct gsm_trans *trans =
+		container_of(inst, struct gsm_trans, sms.smc_inst);
+	int rc = 0;
+
+	switch (msg_type) {
+	case GSM411_MMSMS_EST_REQ:
+		gsm411_to_mm(msg, trans, msg_type);
+		break;
+	case GSM411_MMSMS_DATA_REQ:
+		gsm411_push_cp_header(msg, trans->protocol,
+			trans->transaction_id, cp_msg_type);
+		msg->l3h = msg->data;
+		LOGP(DLSMS, LOGL_INFO, "sending CP message (trans=%x)\n",
+			trans->transaction_id);
+		rc = gsm411_to_mm(msg, trans, msg_type);
+		break;
+	case GSM411_MMSMS_REL_REQ:
+		LOGP(DLSMS, LOGL_INFO, "Got MMSMS_REL_REQ, destroying "
+			"transaction.\n");
+		gsm411_to_mm(msg, trans, msg_type);
+		gsm411_trans_free(trans);
+		break;
+	default:
+		msgb_free(msg);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+/* mm_send: receive MNSMS sap message from SMR */
+static int gsm411_mn_send(struct gsm411_smr_inst *inst, int msg_type,
+			struct msgb *msg)
+{
+	struct gsm_trans *trans =
+		container_of(inst, struct gsm_trans, sms.smr_inst);
+
+	/* forward to SMC */
+	return gsm411_smc_send(&trans->sms.smc_inst, msg_type, msg);
+}
+
+/* receive SM-RL sap message from SMR
+ * NOTE: Message is freed by sender
+ */
+static int gsm411_rl_recv(struct gsm411_smr_inst *inst, int msg_type,
+                        struct msgb *msg)
+{
+	struct gsm_trans *trans =
+		container_of(inst, struct gsm_trans, sms.smr_inst);
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	int rc = 0;
+
+	switch (msg_type) {
+	case GSM411_SM_RL_DATA_IND:
+		rc = gsm411_rx_rl_data(msg, gh, trans);
+		break;
+	case GSM411_SM_RL_REPORT_IND:
+		if (!gh)
+			LOGP(DLSMS, LOGL_INFO, "Release transaction on empty "
+				"report.\n");
+		else {
+			LOGP(DLSMS, LOGL_INFO, "Release transaction on RL "
+				"report.\n");
+			rc = gsm411_rx_rl_report(msg, gh, trans);
+		}
+		break;
+	default:
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+/* receive MNSMS sap message from SMC
+ * NOTE: Message is freed by sender
+ */
+static int gsm411_mn_recv(struct gsm411_smc_inst *inst, int msg_type,
+			struct msgb *msg)
+{
+	struct gsm_trans *trans =
+		container_of(inst, struct gsm_trans, sms.smc_inst);
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	int rc = 0;
+
+	switch (msg_type) {
+	case GSM411_MNSMS_EST_IND:
+	case GSM411_MNSMS_DATA_IND:
+		LOGP(DLSMS, LOGL_INFO, "MNSMS-DATA/EST-IND\n");
+		rc = gsm411_smr_recv(&trans->sms.smr_inst, msg_type, msg);
+		break;
+	case GSM411_MNSMS_ERROR_IND:
+		if (gh)
+			LOGP(DLSMS, LOGL_INFO, "MNSMS-ERROR-IND, cause %d "
+				"(%s)\n", gh->data[0],
+				get_value_string(gsm411_cp_cause_strs,
+							gh->data[0]));
+		else
+			LOGP(DLSMS, LOGL_INFO, "MNSMS-ERROR-IND, no cause\n");
+		rc = gsm411_smr_recv(&trans->sms.smr_inst, msg_type, msg);
+		break;
+	default:
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+/* receive est/data message from MM layer */
+static int gsm411_mmsms_ind(int mmsms_msg, struct gsm_trans *trans,
+	struct msgb *msg)
+{
+	struct osmocom_ms *ms = trans->ms;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	int msg_type = gh->msg_type & 0xbf;
+	uint8_t transaction_id = ((gh->proto_discr & 0xf0) ^ 0x80) >> 4;
+		/* flip */
+
+	/* pull the MMSMS header */
+	msgb_pull(msg, sizeof(struct gsm48_mmxx_hdr));
+
+	LOGP(DLSMS, LOGL_INFO, "(ms %s) Received est/data '%u'\n", ms->name,
+		msg_type);
+
+	/* 5.4: For MO, if a CP-DATA is received for a new
+	 * transaction, equals reception of an implicit
+	 * last CP-ACK for previous transaction */
+	if (trans->sms.smc_inst.cp_state == GSM411_CPS_IDLE
+	 && msg_type == GSM411_MT_CP_DATA) {
+		int i;
+		struct gsm_trans *ptrans;
+
+		/* Scan through all remote initiated transactions */
+		for (i=8; i<15; i++) {
+			if (i == transaction_id)
+				continue;
+
+			ptrans = trans_find_by_id(ms, GSM48_PDISC_SMS, i);
+			if (!ptrans)
+				continue;
+
+			LOGP(DLSMS, LOGL_INFO, "Implicit CP-ACK for "
+				"trans_id=%x\n", i);
+
+			/* Finish it for good */
+			gsm411_trans_free(ptrans);
+		}
+	}
+	return gsm411_smc_recv(&trans->sms.smc_inst, mmsms_msg, msg, msg_type);
+}
+
+/* receive message from MM layer */
+int gsm411_rcv_sms(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	int msg_type = mmh->msg_type;
+	int sapi = mmh->sapi;
+	struct gsm_trans *trans;
+	int rc = 0;
+
+	trans = trans_find_by_callref(ms, mmh->ref);
+	if (!trans) {
+		LOGP(DLSMS, LOGL_INFO, " -> (new transaction sapi=%d)\n", sapi);
+		trans = trans_alloc(ms, GSM48_PDISC_SMS, mmh->transaction_id,
+					mmh->ref);
+		if (!trans)
+			return -ENOMEM;
+		gsm411_smc_init(&trans->sms.smc_inst, trans->transaction_id, 0,
+			gsm411_mn_recv, gsm411_mm_send);
+		gsm411_smr_init(&trans->sms.smr_inst, trans->transaction_id, 0,
+			gsm411_rl_recv, gsm411_mn_send);
+		trans->sms.sapi = mmh->sapi;
+	}
+
+	LOGP(DLSMS, LOGL_INFO, "(ms %s) Received '%s' from MM\n", ms->name,
+		get_mmxx_name(msg_type));
+
+	switch (msg_type) {
+	case GSM48_MMSMS_EST_CNF:
+		rc = gsm411_smc_recv(&trans->sms.smc_inst, GSM411_MMSMS_EST_CNF,
+			msg, 0);
+		break;
+	case GSM48_MMSMS_EST_IND:
+	case GSM48_MMSMS_DATA_IND:
+		rc = gsm411_mmsms_ind(msg_type, trans, msg);
+		break;
+	case GSM48_MMSMS_REL_IND:
+	case GSM48_MMSMS_ERR_IND:
+		LOGP(DLSMS, LOGL_INFO, "MM connection released.\n");
+		trans_free(trans);
+		break;
+	default:
+		LOGP(DLSMS, LOGL_NOTICE, "Message unhandled.\n");
+		rc = -ENOTSUP;
+	}
+
+	return rc;
+}
+
diff --git a/src/host/layer23/src/mobile/gsm480_ss.c b/src/host/layer23/src/mobile/gsm480_ss.c
new file mode 100644
index 00000000..116c72f5
--- /dev/null
+++ b/src/host/layer23/src/mobile/gsm480_ss.c
@@ -0,0 +1,1273 @@
+/*
+ * (C) 2011 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/mobile/mncc.h>
+#include <osmocom/bb/mobile/transaction.h>
+#include <osmocom/bb/mobile/gsm480_ss.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/bb/mobile/vty.h>
+#include <osmocom/gsm/protocol/gsm_04_80.h>
+#include <osmocom/gsm/gsm48.h>
+
+static uint32_t new_callref = 0x80000001;
+
+static int gsm480_to_mm(struct msgb *msg, struct gsm_trans *trans,
+	int msg_type);
+static const struct value_string gsm480_err_names[] = {
+	{ GSM0480_ERR_CODE_UNKNOWN_SUBSCRIBER,
+		"UNKNOWN SUBSCRIBER" },
+	{ GSM0480_ERR_CODE_ILLEGAL_SUBSCRIBER,
+		"ILLEGAL SUBSCRIBER" },
+	{ GSM0480_ERR_CODE_BEARER_SERVICE_NOT_PROVISIONED,
+		"BEARER SERVICE NOT PROVISIONED" },
+	{ GSM0480_ERR_CODE_TELESERVICE_NOT_PROVISIONED,
+		"TELESERVICE NOT PROVISIONED" },
+	{ GSM0480_ERR_CODE_ILLEGAL_EQUIPMENT,
+		"ILLEGAL EQUIPMENT" },
+	{ GSM0480_ERR_CODE_CALL_BARRED,
+		"CALL BARRED" },
+	{ GSM0480_ERR_CODE_ILLEGAL_SS_OPERATION,
+		"ILLEGAL SS OPERATION" },
+	{ GSM0480_ERR_CODE_SS_ERROR_STATUS,
+		"SS ERROR STATUS" },
+	{ GSM0480_ERR_CODE_SS_NOT_AVAILABLE,
+		"SS NOT AVAILABLE" },
+	{ GSM0480_ERR_CODE_SS_SUBSCRIPTION_VIOLATION,
+		"SS SUBSCRIPTION VIOLATION" },
+	{ GSM0480_ERR_CODE_SS_INCOMPATIBILITY,
+		"SS INCOMPATIBILITY" },
+	{ GSM0480_ERR_CODE_FACILITY_NOT_SUPPORTED,
+		"FACILITY NOT SUPPORTED" },
+	{ GSM0480_ERR_CODE_ABSENT_SUBSCRIBER,
+		"ABSENT SUBSCRIBER" },
+	{ GSM0480_ERR_CODE_SYSTEM_FAILURE,
+		"SYSTEM FAILURE" },
+	{ GSM0480_ERR_CODE_DATA_MISSING,
+		"DATA MISSING" },
+	{ GSM0480_ERR_CODE_UNEXPECTED_DATA_VALUE,
+		"UNEXPECTED DATA VALUE" },
+	{ GSM0480_ERR_CODE_PW_REGISTRATION_FAILURE,
+		"PW REGISTRATION FAILURE" },
+	{ GSM0480_ERR_CODE_NEGATIVE_PW_CHECK,
+		"NEGATIVE PW CHECK" },
+	{ GSM0480_ERR_CODE_NUM_PW_ATTEMPTS_VIOLATION,
+		"NUM PW ATTEMPTS VIOLATION" },
+	{ GSM0480_ERR_CODE_UNKNOWN_ALPHABET,
+		"UNKNOWN ALPHABET" },
+	{ GSM0480_ERR_CODE_USSD_BUSY,
+		"USSD BUSY" },
+	{ GSM0480_ERR_CODE_MAX_MPTY_PARTICIPANTS,
+		"MAX MPTY PARTICIPANTS" },
+	{ GSM0480_ERR_CODE_RESOURCES_NOT_AVAILABLE,
+		"RESOURCES NOT AVAILABLE" },
+	{0,	NULL }
+};
+
+/* taken from Wireshark */
+static const struct value_string Teleservice_vals[] = {
+	{0x00, "allTeleservices" },
+	{0x10, "allSpeechTransmissionServices" },
+	{0x11, "telephony" },
+	{0x12, "emergencyCalls" },
+	{0x20, "allShortMessageServices" },
+	{0x21, "shortMessageMT-PP" },
+	{0x22, "shortMessageMO-PP" },
+	{0x60, "allFacsimileTransmissionServices" },
+	{0x61, "facsimileGroup3AndAlterSpeech" },
+	{0x62, "automaticFacsimileGroup3" },
+	{0x63, "facsimileGroup4" },
+
+	{0x70, "allDataTeleservices" },
+	{0x80, "allTeleservices-ExeptSMS" },
+
+	{0x90, "allVoiceGroupCallServices" },
+	{0x91, "voiceGroupCall" },
+	{0x92, "voiceBroadcastCall" },
+
+	{0xd0, "allPLMN-specificTS" },
+	{0xd1, "plmn-specificTS-1" },
+	{0xd2, "plmn-specificTS-2" },
+	{0xd3, "plmn-specificTS-3" },
+	{0xd4, "plmn-specificTS-4" },
+	{0xd5, "plmn-specificTS-5" },
+	{0xd6, "plmn-specificTS-6" },
+	{0xd7, "plmn-specificTS-7" },
+	{0xd8, "plmn-specificTS-8" },
+	{0xd9, "plmn-specificTS-9" },
+	{0xda, "plmn-specificTS-A" },
+	{0xdb, "plmn-specificTS-B" },
+	{0xdc, "plmn-specificTS-C" },
+	{0xdd, "plmn-specificTS-D" },
+	{0xde, "plmn-specificTS-E" },
+	{0xdf, "plmn-specificTS-F" },
+	{ 0, NULL }
+};
+
+/* taken from Wireshark */
+static const struct value_string Bearerservice_vals[] = {
+	{0x00, "allBearerServices" },
+	{0x10, "allDataCDA-Services" },
+	{0x11, "dataCDA-300bps" },
+	{0x12, "dataCDA-1200bps" },
+	{0x13, "dataCDA-1200-75bps" },
+	{0x14, "dataCDA-2400bps" },
+	{0x15, "dataCDA-4800bps" },
+	{0x16, "dataCDA-9600bps" },
+	{0x17, "general-dataCDA" },
+
+	{0x18, "allDataCDS-Services" },
+	{0x1A, "dataCDS-1200bps" },
+	{0x1C, "dataCDS-2400bps" },
+	{0x1D, "dataCDS-4800bps" },
+	{0x1E, "dataCDS-9600bps" },
+	{0x1F, "general-dataCDS" },
+
+	{0x20, "allPadAccessCA-Services" },
+	{0x21, "padAccessCA-300bps" },
+	{0x22, "padAccessCA-1200bps" },
+	{0x23, "padAccessCA-1200-75bps" },
+	{0x24, "padAccessCA-2400bps" },
+	{0x25, "padAccessCA-4800bps" },
+	{0x26, "padAccessCA-9600bps" },
+	{0x27, "general-padAccessCA" },
+
+	{0x28, "allDataPDS-Services" },
+	{0x2C, "dataPDS-2400bps" },
+	{0x2D, "dataPDS-4800bps" },
+	{0x2E, "dataPDS-9600bps" },
+	{0x2F, "general-dataPDS" },
+
+	{0x30, "allAlternateSpeech-DataCDA" },
+	{0x38, "allAlternateSpeech-DataCDS" },
+	{0x40, "allSpeechFollowedByDataCDA" },
+	{0x48, "allSpeechFollowedByDataCDS" },
+
+	{0x50, "allDataCircuitAsynchronous" },
+	{0x60, "allAsynchronousServices" },
+	{0x58, "allDataCircuitSynchronous" },
+	{0x68, "allSynchronousServices" },
+
+	{0xD0, "allPLMN-specificBS" },
+	{0xD1, "plmn-specificBS-1" },
+	{0xD2, "plmn-specificBS-2" },
+	{0xD3, "plmn-specificBS-3" },
+	{0xD4, "plmn-specificBS-4" },
+	{0xD5, "plmn-specificBS-5" },
+	{0xD6, "plmn-specificBS-6" },
+	{0xD7, "plmn-specificBS-7" },
+	{0xD8, "plmn-specificBS-8" },
+	{0xD9, "plmn-specificBS-9" },
+	{0xDA, "plmn-specificBS-A" },
+	{0xDB, "plmn-specificBS-B" },
+	{0xDC, "plmn-specificBS-C" },
+	{0xDD, "plmn-specificBS-D" },
+	{0xDE, "plmn-specificBS-E" },
+	{0xDF, "plmn-specificBS-F" },
+	{ 0, NULL }
+};
+
+static int gsm480_ss_result(struct osmocom_ms *ms, const char *response,
+	uint8_t error)
+{
+	vty_notify(ms, NULL);
+	if (response) {
+		char text[256], *t = text, *s;
+
+		OSMO_STRLCPY_ARRAY(text, response);
+		while ((s = strchr(text, '\r')))
+			*s = '\n';
+		while ((s = strsep(&t, "\n"))) {
+			vty_notify(ms, "Service response: %s\n", s);
+		}
+	} else if (error)
+		vty_notify(ms, "Service request failed: %s\n",
+			get_value_string(gsm480_err_names, error));
+	else
+		vty_notify(ms, "Service request failed.\n");
+
+	return 0;
+}
+
+enum {
+	GSM480_SS_ST_IDLE = 0,
+	GSM480_SS_ST_REGISTER,
+	GSM480_SS_ST_ACTIVE,
+};
+
+/*
+ * init / exit
+ */
+
+int gsm480_ss_init(struct osmocom_ms *ms)
+{
+	LOGP(DSS, LOGL_INFO, "init SS\n");
+
+	return 0;
+}
+
+int gsm480_ss_exit(struct osmocom_ms *ms)
+{
+	struct gsm_trans *trans, *trans2;
+
+	LOGP(DSS, LOGL_INFO, "exit SS processes for %s\n", ms->name);
+
+	llist_for_each_entry_safe(trans, trans2, &ms->trans_list, entry) {
+		if (trans->protocol == GSM48_PDISC_NC_SS) {
+			LOGP(DSS, LOGL_NOTICE, "Free pendig "
+				"SS-transaction.\n");
+			trans_free(trans);
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * transaction
+ */
+
+/* SS Specific transaction release.
+ * gets called by trans_free, DO NOT CALL YOURSELF!
+ */
+void _gsm480_ss_trans_free(struct gsm_trans *trans)
+{
+	if (trans->ss.msg) {
+		LOGP(DSS, LOGL_INFO, "Free pending SS request\n");
+		msgb_free(trans->ss.msg);
+		trans->ss.msg = NULL;
+	}
+	vty_notify(trans->ms, NULL);
+	vty_notify(trans->ms, "Service connection terminated.\n");
+}
+
+/* release MM connection, free transaction */
+static int gsm480_trans_free(struct gsm_trans *trans)
+{
+	struct msgb *nmsg;
+
+	/* release MM connection */
+	nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMSS_REL_REQ, trans->callref,
+				trans->transaction_id, 0);
+	if (!nmsg)
+		return -ENOMEM;
+	LOGP(DSS, LOGL_INFO, "Sending MMSS_REL_REQ\n");
+	gsm48_mmxx_downmsg(trans->ms, nmsg);
+
+	trans->callref = 0;
+	trans_free(trans);
+
+	return 0;
+}
+
+/*
+ * endcoding
+ */
+
+#define GSM480_ALLOC_SIZE       512+128
+#define GSM480_ALLOC_HEADROOM   128
+
+struct msgb *gsm480_msgb_alloc(void)
+{
+	return msgb_alloc_headroom(GSM480_ALLOC_SIZE, GSM480_ALLOC_HEADROOM,
+		"GSM 04.80");
+}
+
+static inline unsigned char *msgb_wrap_with_L(struct msgb *msgb)
+{
+	uint8_t *data = msgb_push(msgb, 1);
+
+	data[0] = msgb->len - 1;
+	return data;
+}
+
+static inline void msgb_wrap_with_TL_asn(struct msgb *msg, uint8_t tag)
+{
+	int len = msg->len;
+	uint8_t *data = msgb_push(msg, (len >= 128) ? 3 : 2);
+
+	*data++ = tag;
+	if (len >= 128)
+		*data++ = 0x81;
+	*data = len;
+	return;
+}
+
+/* support function taken from OpenBSC */
+static inline unsigned char *msgb_push_TLV1(struct msgb *msgb, uint8_t tag,
+uint8_t value)
+{
+	uint8_t *data = msgb_push(msgb, 3);
+
+	data[0] = tag;
+	data[1] = 1;
+	data[2] = value;
+	return data;
+}
+
+static const char *ss_code_by_char(const char *code, uint8_t *ss_code)
+{
+	if (!strncmp(code, "21", 2)) {
+		*ss_code = 33;
+		return code + 2;
+	}
+	if (!strncmp(code, "67", 2)) {
+		*ss_code = 41;
+		return code + 2;
+	}
+	if (!strncmp(code, "61", 2)) {
+		*ss_code = 42;
+		return code + 2;
+	}
+	if (!strncmp(code, "62", 2)) {
+		*ss_code = 43;
+		return code + 2;
+	}
+	if (!strncmp(code, "002", 3)) {
+		*ss_code = 32;
+		return code + 3;
+	}
+	if (!strncmp(code, "004", 3)) {
+		*ss_code = 40;
+		return code + 3;
+	}
+
+	return NULL;
+}
+
+static const char *decode_ss_code(uint8_t ss_code)
+{
+	static char unknown[16];
+	
+	switch (ss_code) {
+	case 33:
+		return "CFU";
+	case 41:
+		return "CFB";
+	case 42:
+		return "CFNR";
+	case 43:
+		return "CF Not Reachable";
+	case 32:
+		return "All CF";
+	case 40:
+		return "All conditional CF";
+	default:
+		sprintf(unknown, "Unknown %d", ss_code);
+		return unknown;
+	}
+}
+
+static int gsm480_tx_release_compl(struct gsm_trans *trans, uint8_t cause)
+{
+	struct msgb *msg;
+	struct gsm48_hdr *gh;
+
+	msg = gsm480_msgb_alloc();
+	if (!msg)
+		return -ENOMEM;
+
+	gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh));
+	gh->proto_discr = GSM48_PDISC_NC_SS | (trans->transaction_id << 4);
+	gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE;
+
+	if (cause) {
+		uint8_t *tlv = msgb_put(msg, 4);
+		*tlv = GSM48_IE_CAUSE;
+		*tlv = 2;
+		*tlv = 0x80 | cause;
+		*tlv = 0x80 | GSM48_CAUSE_LOC_USER;
+	}
+	return gsm480_to_mm(msg, trans, GSM48_MMSS_DATA_REQ);
+}
+
+static int return_imei(struct osmocom_ms *ms)
+{
+	char text[32];
+	struct gsm_settings *set = &ms->settings;
+
+	sprintf(text, "IMEI: %s SV: %s", set->imei,
+		set->imeisv + strlen(set->imei));
+	gsm480_ss_result(ms, text, 0);
+
+	return 0;
+}
+
+/* prepend invoke-id, facility IE and facility message */
+static int gsm480_tx_invoke(struct gsm_trans *trans, struct msgb *msg,
+	uint8_t msg_type)
+{
+	struct gsm48_hdr *gh;
+
+	/* Pre-pend the invoke ID */
+        msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, trans->ss.invoke_id);
+
+	/* Wrap this up as invoke vomponent */
+	if (msg_type == GSM0480_MTYPE_FACILITY)
+		msgb_wrap_with_TL_asn(msg, GSM0480_CTYPE_RETURN_RESULT);
+	else
+		msgb_wrap_with_TL_asn(msg, GSM0480_CTYPE_INVOKE);
+
+	/* Wrap this up as facility IE */
+	if (msg_type == GSM0480_MTYPE_FACILITY)
+		msgb_wrap_with_L(msg);
+	else
+		msgb_wrap_with_TL(msg, GSM0480_IE_FACILITY);
+
+	/* FIXME: If phase 2, we need SSVERSION to be added */
+
+	/* Push L3 header */
+	gh = (struct gsm48_hdr *) msgb_push(msg, sizeof(*gh));
+	gh->proto_discr = GSM48_PDISC_NC_SS | (trans->transaction_id << 4);
+	gh->msg_type = msg_type;
+
+	if (msg_type == GSM0480_MTYPE_FACILITY) {
+		/* directly transmit data on established connection */
+		return gsm480_to_mm(msg, trans, GSM48_MMSS_DATA_REQ);
+	} else {
+		/* store header until our MM connection is established */
+		trans->ss.msg = msg;
+
+		/* request establishment */
+		msg = gsm480_msgb_alloc();
+		if (!msg) {
+			trans_free(trans);
+			return -ENOMEM;
+		}
+		return gsm480_to_mm(msg, trans, GSM48_MMSS_EST_REQ);
+	}
+}
+
+static int gsm480_tx_cf(struct gsm_trans *trans, uint8_t msg_type,
+	uint8_t op_code, uint8_t ss_code, const char *dest)
+{
+	struct msgb *msg;
+
+	/* allocate message */
+	msg = gsm480_msgb_alloc();
+	if (!msg) {
+		trans_free(trans);
+		return -ENOMEM;
+	}
+
+	if (dest) {
+		uint8_t tlv[32];
+		int rc;
+
+	        /* Forwarding To address */
+		tlv[0] = 0x84;
+		tlv[2] = 0x80; /* no extension */
+		tlv[2] |= ((dest[0] == '+') ? 0x01 : 0x00) << 4; /* type */
+		tlv[2] |= 0x1; /* plan*/
+		rc = gsm48_encode_bcd_number(tlv + 1, sizeof(tlv) - 1, 1,
+					dest + (dest[0] == '+'));
+		if (rc < 0) {
+			msgb_free(msg);
+			trans_free(trans);
+			return -EINVAL;
+		}
+		memcpy(msgb_put(msg, rc + 1), tlv, rc + 1);
+	}
+
+	/* Encode ss-Code */
+	msgb_push_TLV1(msg, ASN1_OCTET_STRING_TAG, ss_code);
+
+	/* Then wrap these as a Sequence */
+	msgb_wrap_with_TL_asn(msg, GSM_0480_SEQUENCE_TAG);
+
+	/* Pre-pend the operation code */
+	msgb_push_TLV1(msg, GSM0480_OPERATION_CODE, op_code);
+
+	return gsm480_tx_invoke(trans, msg, msg_type);
+}
+
+static int gsm480_tx_ussd(struct gsm_trans *trans, uint8_t msg_type,
+	const char *text)
+{
+	struct msgb *msg;
+	int length;
+
+	/* allocate message */
+	msg = gsm480_msgb_alloc();
+	if (!msg) {
+		trans_free(trans);
+		return -ENOMEM;
+	}
+
+	/* Encode service request */
+	gsm_7bit_encode_n_ussd(msg->data, msgb_tailroom(msg), text, &length);
+	msgb_put(msg, length);
+
+	/* Then wrap it as an Octet String */
+	msgb_wrap_with_TL_asn(msg, ASN1_OCTET_STRING_TAG);
+
+	/* Pre-pend the DCS octet string */
+	msgb_push_TLV1(msg, ASN1_OCTET_STRING_TAG, 0x0F);
+
+	/* Then wrap these as a Sequence */
+	msgb_wrap_with_TL_asn(msg, GSM_0480_SEQUENCE_TAG);
+
+	if (msg_type == GSM0480_MTYPE_FACILITY) {
+		/* Pre-pend the operation code */
+		msgb_push_TLV1(msg, GSM0480_OPERATION_CODE,
+				GSM0480_OP_CODE_USS_REQUEST);
+
+		/* Then wrap these as a Sequence */
+		msgb_wrap_with_TL_asn(msg, GSM_0480_SEQUENCE_TAG);
+	} else {
+		/* Pre-pend the operation code */
+		msgb_push_TLV1(msg, GSM0480_OPERATION_CODE,
+				GSM0480_OP_CODE_PROCESS_USS_REQ);
+	}
+
+	return gsm480_tx_invoke(trans, msg, msg_type);
+}
+
+/* create and send service code */
+int ss_send(struct osmocom_ms *ms, const char *code, int new_trans)
+{
+	struct gsm_trans *trans = NULL, *transt;
+	int transaction_id;
+
+	/* look for an old transaction */
+	if (!new_trans) {
+		llist_for_each_entry(transt, &ms->trans_list, entry) {
+			if (transt->protocol == GSM48_PDISC_NC_SS) {
+				trans = transt;
+				break;
+			}
+		}
+	}
+
+	/* if there is an old transaction, check if we can send data */
+	if (trans) {
+		if (trans->ss.state != GSM480_SS_ST_ACTIVE) {
+			LOGP(DSS, LOGL_INFO, "Pending trans not active.\n");
+			gsm480_ss_result(trans->ms, "Current service pending",
+				0);
+			return 0;
+		}
+		if (!strcmp(code, "hangup")) {
+			gsm480_tx_release_compl(trans, 0);
+			gsm480_trans_free(trans);
+			return 0;
+		}
+		LOGP(DSS, LOGL_INFO, "Existing transaction.\n");
+		return gsm480_tx_ussd(trans, GSM0480_MTYPE_FACILITY, code);
+	}
+
+	/* do nothing, if hangup is received */
+	if (!strcmp(code, "hangup"))
+		return 0;
+
+	/* internal codes */
+	if (!strcmp(code, "*#06#")) {
+		return return_imei(ms);
+	}
+
+	/* no running, no transaction */
+	if (!ms->started || ms->shutdown != MS_SHUTDOWN_NONE) {
+		gsm480_ss_result(ms, "<phone is down>", 0);
+		return -EIO;
+	}
+
+	/* allocate transaction with dummy reference */
+	transaction_id = trans_assign_trans_id(ms, GSM48_PDISC_NC_SS,
+		0);
+	if (transaction_id < 0) {
+		LOGP(DSS, LOGL_ERROR, "No transaction ID available\n");
+		gsm480_ss_result(ms, NULL,
+			GSM0480_ERR_CODE_RESOURCES_NOT_AVAILABLE);
+		return -ENOMEM;
+	}
+	trans = trans_alloc(ms, GSM48_PDISC_NC_SS, transaction_id,
+		new_callref++);
+	if (!trans) {
+		LOGP(DSS, LOGL_ERROR, "No memory for trans\n");
+		gsm480_ss_result(ms, NULL,
+			GSM0480_ERR_CODE_RESOURCES_NOT_AVAILABLE);
+		return -ENOMEM;
+	}
+
+	/* go register sent state */
+	trans->ss.state = GSM480_SS_ST_REGISTER;
+
+	/* FIXME: generate invoke ID */
+	trans->ss.invoke_id = 5;
+
+	/* interrogate */
+	if (code[0] == '*' && code[1] == '#' && code[strlen(code) - 1] == '#') {
+		uint8_t ss_code = 0;
+
+		ss_code_by_char(code + 2, &ss_code);
+		if (ss_code)
+			return gsm480_tx_cf(trans, GSM0480_MTYPE_REGISTER,
+				GSM0480_OP_CODE_INTERROGATE_SS, ss_code, NULL);
+	} else
+	/* register / activate */
+	if (code[0] == '*' && code[strlen(code) - 1] == '#') {
+		uint8_t ss_code = 0;
+		const char *to;
+		char dest[32];
+
+		/* double star */
+		if (code[1] == '*')
+			code++;
+
+		to = ss_code_by_char(code + 1, &ss_code);
+	
+		/* register */
+		if (ss_code && to && to[0] == '*') {
+			OSMO_STRLCPY_ARRAY(dest, to + 1);
+			return gsm480_tx_cf(trans, GSM0480_MTYPE_REGISTER,
+				GSM0480_OP_CODE_REGISTER_SS, ss_code, dest);
+		}
+		/* activate */
+		if (ss_code && to && to[0] == '#') {
+			return gsm480_tx_cf(trans, GSM0480_MTYPE_REGISTER,
+				GSM0480_OP_CODE_ACTIVATE_SS, ss_code, NULL);
+		}
+	} else
+	/* erasure */
+	if (code[0] == '#' && code[1] == '#' && code[strlen(code) - 1] == '#') {
+		uint8_t ss_code = 0;
+
+		ss_code_by_char(code + 2, &ss_code);
+	
+		if (ss_code)
+			return gsm480_tx_cf(trans, GSM0480_MTYPE_REGISTER,
+				GSM0480_OP_CODE_ERASE_SS, ss_code, NULL);
+	} else
+	/* deactivate */
+	if (code[0] == '#' && code[strlen(code) - 1] == '#') {
+		uint8_t ss_code = 0;
+
+		ss_code_by_char(code + 1, &ss_code);
+	
+		if (ss_code)
+			return gsm480_tx_cf(trans, GSM0480_MTYPE_REGISTER,
+				GSM0480_OP_CODE_DEACTIVATE_SS, ss_code, NULL);
+	}
+
+	/* other codes */
+	return gsm480_tx_ussd(trans, GSM0480_MTYPE_REGISTER, code);
+}
+
+/*
+ * decoding
+ */
+
+static int parse_tag_asn1(const uint8_t *data, int len,
+	const uint8_t **tag_data, int *tag_len)
+{
+	/* at least 2 bytes (tag + len) */
+	if (len < 2)
+		return -1;
+
+	/* extended length */
+	if (data[1] == 0x81) {
+		/* at least 2 bytes (tag + 0x81 + len) */
+		if (len < 3)
+			return -1;
+		*tag_len = data[2];
+		*tag_data = data + 3;
+		len -= 3;
+	} else {
+		*tag_len = data[1];
+		*tag_data = data + 2;
+		len -= 2;
+	}
+
+	/* check for buffer overflow */
+	if (len < *tag_len)
+		return -1;
+	
+	/* return length */
+	return len;
+}
+
+static int gsm480_rx_ussd(struct gsm_trans *trans, const uint8_t *data,
+	int len)
+{
+	int num_chars;
+	char text[256];
+	int i;
+	const uint8_t *tag_data;
+	int tag_len;
+
+	/* sequence tag */
+	if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 0) {
+		LOGP(DSS, LOGL_NOTICE, "2. Sequence tag too short\n");
+		return -EINVAL;
+	}
+	if (data[0] != GSM_0480_SEQUENCE_TAG) {
+		LOGP(DSS, LOGL_NOTICE, "Expecting 2. Sequence Tag\n");
+		return -EINVAL;
+	}
+	len = tag_len;
+	data = tag_data;
+
+	/* DSC */
+	if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 1) {
+		LOGP(DSS, LOGL_NOTICE, "DSC tag too short\n");
+		return -EINVAL;
+	}
+	if (data[0] != ASN1_OCTET_STRING_TAG || tag_len != 1) {
+		LOGP(DSS, LOGL_NOTICE, "Expecting DSC tag\n");
+		return -EINVAL;
+	}
+	if (tag_data[0] != 0x0f) {
+		LOGP(DSS, LOGL_NOTICE, "DSC not 0x0f\n");
+		return -EINVAL;
+	}
+	len -= tag_data - data + tag_len;
+	data = tag_data + tag_len;
+
+	/* text */
+	if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 0) {
+		LOGP(DSS, LOGL_NOTICE, "Text tag too short\n");
+		return -EINVAL;
+	}
+	if (data[0] != ASN1_OCTET_STRING_TAG) {
+		LOGP(DSS, LOGL_NOTICE, "Expecting text tag\n");
+		return -EINVAL;
+	}
+	num_chars = tag_len * 8 / 7;
+	gsm_7bit_decode_n_ussd(text, sizeof(text), tag_data, num_chars);
+
+	for (i = 0; text[i]; i++) {
+		if (text[i] == '\r')
+			text[i] = '\n';
+	}
+	/* remove last CR, if exists */
+	if (text[0] && text[strlen(text) - 1] == '\n')
+		text[strlen(text) - 1] = '\0';
+	gsm480_ss_result(trans->ms, text, 0);
+
+	return 0;
+}
+
+static int gsm480_rx_cf(struct gsm_trans *trans, const uint8_t *data,
+	int len)
+{
+	struct osmocom_ms *ms = trans->ms;
+	const uint8_t *tag_data, *data2;
+	int tag_len, len2;
+	char number[32];
+
+	LOGP(DSS, LOGL_INFO, "call forwarding reply: len %d data %s\n", len,
+		osmo_hexdump(data, len));
+
+	vty_notify(ms, NULL);
+
+	/* forwarding feature list */
+	if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 0) {
+		LOGP(DSS, LOGL_NOTICE, "Tag too short\n");
+		return -EINVAL;
+	}
+	if (data[0] == 0x80) {
+		if ((tag_data[0] & 0x01))
+			vty_notify(ms, "Status: activated\n");
+		else
+			vty_notify(ms, "Status: deactivated\n");
+		return 0;
+	}
+
+	switch(data[0]) {
+	case 0xa3:
+		len = tag_len;
+		data = tag_data;
+		break;
+	case 0xa0: /* forwarding info */
+		len = tag_len;
+		data = tag_data;
+		if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 1) {
+			LOGP(DSS, LOGL_NOTICE, "Tag too short\n");
+			return -EINVAL;
+		}
+		/* check for SS code */
+		if (data[0] != 0x04)
+			break;
+		vty_notify(ms, "Reply for %s\n", decode_ss_code(tag_data[0]));
+		len -= tag_data - data + tag_len;
+		data = tag_data + tag_len;
+		/* sequence tag */
+		if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 0) {
+			LOGP(DSS, LOGL_NOTICE, "Tag too short\n");
+			return -EINVAL;
+		}
+		if (data[0] != GSM_0480_SEQUENCE_TAG) {
+			LOGP(DSS, LOGL_NOTICE, "Expecting sequence tag\n");
+			return -EINVAL;
+		}
+		len = tag_len;
+		data = tag_data;
+		break;
+	default:
+		vty_notify(ms, "Call Forwarding reply unsupported.\n");
+		return 0;
+	}
+	
+	while (len) {
+		/* sequence tag */
+		if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 0) {
+			LOGP(DSS, LOGL_NOTICE, "Tag too short\n");
+			return -EINVAL;
+		}
+		if (data[0] != GSM_0480_SEQUENCE_TAG) {
+			len -= tag_data - data + tag_len;
+			data = tag_data + tag_len;
+			LOGP(DSS, LOGL_NOTICE, "Skipping tag 0x%x\n", data[0]);
+			continue;
+		}
+		len -= tag_data - data + tag_len;
+		data = tag_data + tag_len;
+		len2 = tag_len;
+		data2 = tag_data;
+
+		while (len2) {
+			/* tags in sequence */
+			if (parse_tag_asn1(data2, len2, &tag_data, &tag_len)
+				< 1) {
+				LOGP(DSS, LOGL_NOTICE, "Tag too short\n");
+				return -EINVAL;
+			}
+			LOGP(DSS, LOGL_INFO, "Tag: len %d data %s\n", tag_len,
+				osmo_hexdump(tag_data, tag_len));
+			switch (data2[0]) {
+			case 0x82:
+				vty_notify(ms, "Bearer Service: %s\n",
+					get_value_string(Bearerservice_vals,
+								tag_data[0]));
+				break;
+			case 0x83:
+				vty_notify(ms, "Teleservice: %s\n",
+					get_value_string(Teleservice_vals,
+								tag_data[0]));
+				break;
+			case 0x84:
+				if ((tag_data[0] & 0x01))
+					vty_notify(ms, "Status: activated\n");
+				else
+					vty_notify(ms, "Status: deactivated\n");
+				break;
+			case 0x85:
+				if (((tag_data[0] & 0x70) >> 4) == 1)
+					strcpy(number, "+");
+				else if (((tag_data[0] & 0x70) >> 4) == 2)
+					strcpy(number, "0");
+				else
+					number[0] = '\0';
+				gsm48_decode_bcd_number(number + strlen(number),
+					sizeof(number) - strlen(number),
+					tag_data - 1, 1);
+				vty_notify(ms, "Destination: %s\n", number);
+				break;
+			}
+			len2 -= tag_data - data2 + tag_len;
+			data2 = tag_data + tag_len;
+		}
+	}
+
+	return 0;
+}
+
+static int gsm480_rx_result(struct gsm_trans *trans, const uint8_t *data,
+	int len, int msg_type)
+{
+	const uint8_t *tag_data;
+	int tag_len;
+	int rc = 0;
+
+	LOGP(DSS, LOGL_INFO, "Result received (len %d)\n", len);
+
+	if (len && data[0] == 0x8d) {
+		LOGP(DSS, LOGL_NOTICE, "Skipping mysterious 0x8d\n");
+		len--;
+		data++;
+	}
+
+	/* invoke ID */
+	if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 1) {
+		LOGP(DSS, LOGL_NOTICE, "Invoke ID too short\n");
+		return -EINVAL;
+	}
+	if (data[0] != GSM0480_COMPIDTAG_INVOKE_ID || tag_len != 1) {
+		LOGP(DSS, LOGL_NOTICE, "Expecting invoke ID\n");
+		return -EINVAL;
+	}
+
+	if (msg_type == GSM0480_CTYPE_RETURN_RESULT) {
+		if (trans->ss.invoke_id != data[2]) {
+			LOGP(DSS, LOGL_NOTICE, "Invoke ID mismatch\n");
+		}
+	}
+	/* Store invoke ID, in case we wan't to send a result. */
+	trans->ss.invoke_id = tag_data[0];
+	len -= tag_data - data + tag_len;
+	data = tag_data + tag_len;
+
+	if (!len) {
+		gsm480_ss_result(trans->ms, "<no result>", 0);
+		return 0;
+	}
+
+	/* sequence tag */
+	if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 0) {
+		LOGP(DSS, LOGL_NOTICE, "Sequence tag too short\n");
+		return -EINVAL;
+	}
+	if (data[0] != GSM_0480_SEQUENCE_TAG) {
+		LOGP(DSS, LOGL_NOTICE, "Expecting Sequence Tag, trying "
+			"Operation Tag\n");
+		goto operation;
+	}
+	len = tag_len;
+	data = tag_data;
+
+	/* operation */
+operation:
+	if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 1) {
+		LOGP(DSS, LOGL_NOTICE, "Operation too short\n");
+		return -EINVAL;
+	}
+	if (data[0] != GSM0480_OPERATION_CODE || tag_len != 1) {
+		LOGP(DSS, LOGL_NOTICE, "Expecting Operation Code\n");
+		return -EINVAL;
+	}
+	len -= tag_data - data + tag_len;
+	data = tag_data + tag_len;
+
+	switch (tag_data[0]) {
+	case GSM0480_OP_CODE_PROCESS_USS_REQ:
+	case GSM0480_OP_CODE_USS_REQUEST:
+		rc = gsm480_rx_ussd(trans, data, len);
+		break;
+	case GSM0480_OP_CODE_INTERROGATE_SS:
+	case GSM0480_OP_CODE_REGISTER_SS:
+	case GSM0480_OP_CODE_ACTIVATE_SS:
+	case GSM0480_OP_CODE_DEACTIVATE_SS:
+	case GSM0480_OP_CODE_ERASE_SS:
+		rc = gsm480_rx_cf(trans, data, len);
+		break;
+	default:
+		LOGP(DSS, LOGL_NOTICE, "Operation code not USS\n");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+/* facility from BSC */
+static int gsm480_rx_fac_ie(struct gsm_trans *trans, const uint8_t *data,
+	int len)
+{
+	int rc = 0;
+	const uint8_t *tag_data;
+	int tag_len;
+
+	LOGP(DSS, LOGL_INFO, "Facility received (len %d)\n", len);
+
+	if (parse_tag_asn1(data, len, &tag_data, &tag_len) < 0) {
+		LOGP(DSS, LOGL_NOTICE, "Facility too short\n");
+		return -EINVAL;
+	}
+
+	switch (data[0]) {
+	case GSM0480_CTYPE_INVOKE:
+	case GSM0480_CTYPE_RETURN_RESULT:
+		rc = gsm480_rx_result(trans, tag_data, tag_len, data[0]);
+		break;
+	case GSM0480_CTYPE_RETURN_ERROR:
+		// FIXME: return error code
+		gsm480_ss_result(trans->ms, "<error received>", 0);
+		break;
+	case GSM0480_CTYPE_REJECT:
+		gsm480_ss_result(trans->ms, "<service rejected>", 0);
+		break;
+	default:
+		LOGP(DSS, LOGL_NOTICE, "CTYPE unknown\n");
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int gsm480_rx_cause_ie(struct gsm_trans *trans, const uint8_t *data,
+	int len)
+{
+	uint8_t value;
+
+	LOGP(DSS, LOGL_INFO, "Cause received (len %d)\n", len);
+
+	if (len < 2) {
+		LOGP(DSS, LOGL_NOTICE, "Cause too short\n");
+		return -EINVAL;
+	}
+	if (!(data[1] & 0x80)) {
+		if (len < 3) {
+			LOGP(DSS, LOGL_NOTICE, "Cause too short\n");
+			return -EINVAL;
+		}
+		value = data[3] & 0x7f;
+	} else
+		value = data[2] & 0x7f;
+
+	LOGP(DSS, LOGL_INFO, "Received Cause %d\n", value);
+
+	/* this is an error */
+	return -EINVAL;
+}
+
+/* release complete from BSC */
+static int gsm480_rx_release_comp(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	int rc = 0;
+
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
+	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
+		rc = gsm480_rx_fac_ie(trans, TLVP_VAL(&tp, GSM48_IE_FACILITY),
+			*(TLVP_VAL(&tp, GSM48_IE_FACILITY)-1));
+	} else {
+		/* facility optional */
+		LOGP(DSS, LOGL_INFO, "No facility IE received\n");
+		if (TLVP_PRESENT(&tp, GSM48_IE_CAUSE)) {
+			rc = gsm480_rx_cause_ie(trans,
+				TLVP_VAL(&tp, GSM48_IE_CAUSE),
+				*(TLVP_VAL(&tp, GSM48_IE_CAUSE)-1));
+		}
+	}
+
+	if (rc < 0)
+		gsm480_ss_result(trans->ms, NULL, 0);
+	if (rc > 0)
+		gsm480_ss_result(trans->ms, NULL, rc);
+
+	/* remote releases */
+	gsm480_trans_free(trans);
+
+	return rc;
+}
+
+/* facility from BSC */
+static int gsm480_rx_facility(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	int rc = 0;
+
+	/* go register state */
+	trans->ss.state = GSM480_SS_ST_ACTIVE;
+
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len,
+		GSM48_IE_FACILITY, 0);
+	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
+		rc = gsm480_rx_fac_ie(trans, TLVP_VAL(&tp, GSM48_IE_FACILITY),
+			*(TLVP_VAL(&tp, GSM48_IE_FACILITY)-1));
+	} else {
+		LOGP(DSS, LOGL_INFO, "No facility IE received\n");
+		/* release 3.7.5 */
+		gsm480_tx_release_compl(trans, 96);
+		/* local releases */
+		gsm480_trans_free(trans);
+	}
+
+	if (rc < 0)
+		gsm480_ss_result(trans->ms, NULL, 0);
+	if (rc > 0)
+		gsm480_ss_result(trans->ms, NULL, rc);
+
+	return rc;
+}
+
+/* regisster from BSC */
+static int gsm480_rx_register(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	int rc = 0;
+
+	/* go register state */
+	trans->ss.state = GSM480_SS_ST_ACTIVE;
+
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
+	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
+		rc = gsm480_rx_fac_ie(trans, TLVP_VAL(&tp, GSM48_IE_FACILITY),
+			*(TLVP_VAL(&tp, GSM48_IE_FACILITY)-1));
+	} else {
+		/* facility optional */
+		LOGP(DSS, LOGL_INFO, "No facility IE received\n");
+		/* release 3.7.5 */
+		gsm480_tx_release_compl(trans, 96);
+		/* local releases */
+		gsm480_trans_free(trans);
+	}
+
+	if (rc < 0)
+		gsm480_ss_result(trans->ms, NULL, 0);
+	if (rc > 0)
+		gsm480_ss_result(trans->ms, NULL, rc);
+
+	return rc;
+}
+
+/*
+ * message handling
+ */
+
+/* push MMSS header and send to MM */
+static int gsm480_to_mm(struct msgb *msg, struct gsm_trans *trans,
+	int msg_type)
+{
+	struct gsm48_mmxx_hdr *mmh;
+
+	/* set l3H */
+	msg->l3h = msg->data;
+
+	/* push RR header */
+	msgb_push(msg, sizeof(struct gsm48_mmxx_hdr));
+	mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	mmh->msg_type = msg_type;
+	mmh->ref = trans->callref;
+	mmh->transaction_id = trans->transaction_id;
+	mmh->sapi = 0;
+	mmh->emergency = 0;
+
+	/* send message to MM */
+	LOGP(DSS, LOGL_INFO, "Sending '%s' to MM (callref=%x, "
+		"transaction_id=%d)\n", get_mmxx_name(msg_type), trans->callref,
+		trans->transaction_id);
+	return gsm48_mmxx_downmsg(trans->ms, msg);
+}
+
+/* receive est confirm from MM layer */
+static int gsm480_mmss_est(int mmss_msg, struct gsm_trans *trans,
+	struct msgb *msg)
+{
+	struct osmocom_ms *ms = trans->ms;
+	struct msgb *temp;
+
+	LOGP(DSS, LOGL_INFO, "(ms %s) Received confirm, sending pending SS\n",
+		ms->name);
+
+	/* remove transaction, if no SS message */
+	if (!trans->ss.msg) {
+		LOGP(DSS, LOGL_ERROR, "(ms %s) No pending SS!\n", ms->name);
+		gsm480_trans_free(trans);
+		return -EINVAL;
+	}
+
+	/* detach message and then send */
+	temp = trans->ss.msg;
+	trans->ss.msg = NULL;
+	return gsm480_to_mm(temp, trans, GSM48_MMSS_DATA_REQ);
+}
+
+/* receive data indication from MM layer */
+static int gsm480_mmss_ind(int mmss_msg, struct gsm_trans *trans,
+	struct msgb *msg)
+{
+	struct osmocom_ms *ms = trans->ms;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	int msg_type = gh->msg_type & 0xbf;
+	int rc = 0;
+
+	/* pull the MMSS header */
+	msgb_pull(msg, sizeof(struct gsm48_mmxx_hdr));
+
+	LOGP(DSS, LOGL_INFO, "(ms %s) Received est/data '%u'\n", ms->name,
+		msg_type);
+
+	switch (msg_type) {
+	case GSM0480_MTYPE_RELEASE_COMPLETE:
+		rc = gsm480_rx_release_comp(trans, msg);
+		break;
+	case GSM0480_MTYPE_FACILITY:
+		rc = gsm480_rx_facility(trans, msg);
+		break;
+	case GSM0480_MTYPE_REGISTER:
+		rc = gsm480_rx_register(trans, msg);
+		break;
+	default:
+		LOGP(DSS, LOGL_NOTICE, "Message unhandled.\n");
+		/* release 3.7.4 */
+		gsm480_tx_release_compl(trans, 97);
+		gsm480_trans_free(trans);
+		rc = -ENOTSUP;
+	}
+
+	return rc;
+}
+
+/* receive message from MM layer */
+int gsm480_rcv_ss(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	int msg_type = mmh->msg_type;
+	struct gsm_trans *trans;
+	int rc = 0;
+
+	trans = trans_find_by_callref(ms, mmh->ref);
+	if (!trans) {
+		LOGP(DSS, LOGL_INFO, " -> (new transaction)\n");
+		trans = trans_alloc(ms, GSM48_PDISC_NC_SS, mmh->transaction_id,
+					mmh->ref);
+		if (!trans)
+			return -ENOMEM;
+	}
+
+	LOGP(DSS, LOGL_INFO, "(ms %s) Received '%s' from MM\n", ms->name,
+		get_mmxx_name(msg_type));
+
+	switch (msg_type) {
+	case GSM48_MMSS_EST_CNF:
+		rc = gsm480_mmss_est(msg_type, trans, msg);
+		break;
+	case GSM48_MMSS_EST_IND:
+	case GSM48_MMSS_DATA_IND:
+		rc = gsm480_mmss_ind(msg_type, trans, msg);
+		break;
+	case GSM48_MMSS_REL_IND:
+	case GSM48_MMSS_ERR_IND:
+		LOGP(DSS, LOGL_INFO, "MM connection released.\n");
+		trans_free(trans);
+		break;
+	default:
+		LOGP(DSS, LOGL_NOTICE, "Message unhandled.\n");
+		rc = -ENOTSUP;
+	}
+
+	return rc;
+}
+
diff --git a/src/host/layer23/src/mobile/gsm48_cc.c b/src/host/layer23/src/mobile/gsm48_cc.c
new file mode 100644
index 00000000..f1e81098
--- /dev/null
+++ b/src/host/layer23/src/mobile/gsm48_cc.c
@@ -0,0 +1,2221 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/core/talloc.h>
+
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/mobile/mncc.h>
+#include <osmocom/bb/mobile/transaction.h>
+#include <osmocom/bb/mobile/gsm48_cc.h>
+#include <osmocom/bb/mobile/voice.h>
+#include <l1ctl_proto.h>
+
+static int gsm48_cc_tx_release(struct gsm_trans *trans, void *arg);
+static int gsm48_rel_null_free(struct gsm_trans *trans);
+int mncc_release_ind(struct osmocom_ms *ms, struct gsm_trans *trans,
+		     uint32_t callref, int location, int value);
+static int gsm48_cc_tx_disconnect(struct gsm_trans *trans, void *arg);
+static int gsm48_cc_tx_connect_ack(struct gsm_trans *trans, void *arg);
+
+/*
+ * init
+ */
+
+int gsm48_cc_init(struct osmocom_ms *ms)
+{
+	struct gsm48_cclayer *cc = &ms->cclayer;
+
+	cc->ms = ms;
+
+	if (!cc->mncc_upqueue.next == 0)
+		return 0;
+
+	LOGP(DCC, LOGL_INFO, "init Call Control\n");
+
+	INIT_LLIST_HEAD(&cc->mncc_upqueue);
+
+	return 0;
+}
+
+int gsm48_cc_exit(struct osmocom_ms *ms)
+{
+	struct gsm48_cclayer *cc = &ms->cclayer;
+	struct gsm_trans *trans, *trans2;
+	struct msgb *msg;
+
+	LOGP(DCC, LOGL_INFO, "exit Call Control processes for %s\n", ms->name);
+
+	llist_for_each_entry_safe(trans, trans2, &ms->trans_list, entry) {
+		if (trans->protocol == GSM48_PDISC_CC) {
+			LOGP(DCC, LOGL_NOTICE, "Free pendig CC-transaction.\n");
+			trans_free(trans);
+		}
+	}
+
+	while ((msg = msgb_dequeue(&cc->mncc_upqueue)))
+		msgb_free(msg);
+
+	return 0;
+}
+
+/*
+ * messages
+ */
+
+/* names of MNCC-SAP */
+static const struct value_string gsm_mncc_names[] = {
+	{ MNCC_SETUP_REQ,	"MNCC_SETUP_REQ" },
+	{ MNCC_SETUP_IND,	"MNCC_SETUP_IND" },
+	{ MNCC_SETUP_RSP,	"MNCC_SETUP_RSP" },
+	{ MNCC_SETUP_CNF,	"MNCC_SETUP_CNF" },
+	{ MNCC_SETUP_COMPL_REQ,	"MNCC_SETUP_COMPL_REQ" },
+	{ MNCC_SETUP_COMPL_IND,	"MNCC_SETUP_COMPL_IND" },
+	{ MNCC_CALL_CONF_IND,	"MNCC_CALL_CONF_IND" },
+	{ MNCC_CALL_PROC_REQ,	"MNCC_CALL_PROC_REQ" },
+	{ MNCC_PROGRESS_REQ,	"MNCC_PROGRESS_REQ" },
+	{ MNCC_ALERT_REQ,	"MNCC_ALERT_REQ" },
+	{ MNCC_ALERT_IND,	"MNCC_ALERT_IND" },
+	{ MNCC_NOTIFY_REQ,	"MNCC_NOTIFY_REQ" },
+	{ MNCC_NOTIFY_IND,	"MNCC_NOTIFY_IND" },
+	{ MNCC_DISC_REQ,	"MNCC_DISC_REQ" },
+	{ MNCC_DISC_IND,	"MNCC_DISC_IND" },
+	{ MNCC_REL_REQ,		"MNCC_REL_REQ" },
+	{ MNCC_REL_IND,		"MNCC_REL_IND" },
+	{ MNCC_REL_CNF,		"MNCC_REL_CNF" },
+	{ MNCC_FACILITY_REQ,	"MNCC_FACILITY_REQ" },
+	{ MNCC_FACILITY_IND,	"MNCC_FACILITY_IND" },
+	{ MNCC_START_DTMF_IND,	"MNCC_START_DTMF_IND" },
+	{ MNCC_START_DTMF_RSP,	"MNCC_START_DTMF_RSP" },
+	{ MNCC_START_DTMF_REJ,	"MNCC_START_DTMF_REJ" },
+	{ MNCC_STOP_DTMF_IND,	"MNCC_STOP_DTMF_IND" },
+	{ MNCC_STOP_DTMF_RSP,	"MNCC_STOP_DTMF_RSP" },
+	{ MNCC_MODIFY_REQ,	"MNCC_MODIFY_REQ" },
+	{ MNCC_MODIFY_IND,	"MNCC_MODIFY_IND" },
+	{ MNCC_MODIFY_RSP,	"MNCC_MODIFY_RSP" },
+	{ MNCC_MODIFY_CNF,	"MNCC_MODIFY_CNF" },
+	{ MNCC_MODIFY_REJ,	"MNCC_MODIFY_REJ" },
+	{ MNCC_HOLD_IND,	"MNCC_HOLD_IND" },
+	{ MNCC_HOLD_CNF,	"MNCC_HOLD_CNF" },
+	{ MNCC_HOLD_REJ,	"MNCC_HOLD_REJ" },
+	{ MNCC_RETRIEVE_IND,	"MNCC_RETRIEVE_IND" },
+	{ MNCC_RETRIEVE_CNF,	"MNCC_RETRIEVE_CNF" },
+	{ MNCC_RETRIEVE_REJ,	"MNCC_RETRIEVE_REJ" },
+	{ MNCC_USERINFO_REQ,	"MNCC_USERINFO_REQ" },
+	{ MNCC_USERINFO_IND,	"MNCC_USERINFO_IND" },
+	{ MNCC_REJ_REQ,		"MNCC_REJ_REQ" },
+	{ MNCC_REJ_IND,		"MNCC_REJ_IND" },
+	{ MNCC_PROGRESS_IND,	"MNCC_PROGRESS_IND" },
+	{ MNCC_CALL_PROC_IND,	"MNCC_CALL_PROC_IND" },
+	{ MNCC_CALL_CONF_REQ,	"MNCC_CALL_CONF_REQ" },
+	{ MNCC_START_DTMF_REQ,	"MNCC_START_DTMF_REQ" },
+	{ MNCC_STOP_DTMF_REQ,	"MNCC_STOP_DTMF_REQ" },
+	{ MNCC_HOLD_REQ,	"MNCC_HOLD_REQ " },
+	{ MNCC_RETRIEVE_REQ,	"MNCC_RETRIEVE_REQ" },
+	{ MNCC_FRAME_RECV,      "MNCC_FRAME_RECV" },
+	{ MNCC_FRAME_DROP,      "MNCC_FRAME_DROP" },
+	{ MNCC_LCHAN_MODIFY,    "MNCC_LCHAN_MODIFY" },
+	{ 0,			NULL }
+};
+
+const char *get_mncc_name(int value)
+{
+	return get_value_string(gsm_mncc_names, value);
+}
+
+/* push MMCC header and send to MM */
+static int gsm48_cc_to_mm(struct msgb *msg, struct gsm_trans *trans,
+	int msg_type)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_mmxx_hdr *mmh;
+	int emergency = 0;
+
+	/* Add protocol type and transaction ID */
+	gh->proto_discr = trans->protocol | (trans->transaction_id << 4);
+
+	/* indicate emergency setup to MM layer */
+	if (gh->msg_type == GSM48_MT_CC_EMERG_SETUP)
+		emergency = 1;
+
+	/* push RR header */
+	msgb_push(msg, sizeof(struct gsm48_mmxx_hdr));
+	mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	mmh->msg_type = msg_type;
+	mmh->ref = trans->callref;
+	mmh->transaction_id = trans->transaction_id;
+	mmh->sapi = 0;
+	mmh->emergency = emergency;
+
+	/* send message to MM */
+	LOGP(DCC, LOGL_INFO, "Sending '%s' using %s (callref=%x, "
+		"transaction_id=%d)\n", gsm48_cc_msg_name(gh->msg_type),
+		get_mmxx_name(msg_type), trans->callref, trans->transaction_id);
+	return gsm48_mmxx_downmsg(trans->ms, msg);
+}
+
+/* enqueue message to application (MNCC-SAP) */
+static int mncc_recvmsg(struct osmocom_ms *ms, struct gsm_trans *trans,
+       	int msg_type, struct gsm_mncc *mncc)
+{
+	struct gsm48_cclayer *cc = &ms->cclayer;
+	struct msgb *msg;
+
+	if (trans)
+		LOGP(DCC, LOGL_INFO, "(ms %s ti %x) Sending '%s' to MNCC.\n",
+			ms->name, trans->transaction_id,
+			get_mncc_name(msg_type));
+	else
+		LOGP(DCC, LOGL_INFO, "(ms %s ti -) Sending '%s' to MNCC.\n",
+			ms->name, get_mncc_name(msg_type));
+
+	mncc->msg_type = msg_type;
+
+	msg = msgb_alloc(sizeof(struct gsm_mncc), "MNCC");
+	if (!msg)
+		return -ENOMEM;
+	memcpy(msg->data, mncc, sizeof(struct gsm_mncc));
+	msgb_enqueue(&cc->mncc_upqueue, msg);
+
+	return 0;
+}
+
+/* dequeue messages to layer 4 */
+int mncc_dequeue(struct osmocom_ms *ms)
+{
+	struct gsm48_cclayer *cc = &ms->cclayer;
+	struct gsm_mncc *mncc;
+	struct msgb *msg;
+	int work = 0;
+
+	while ((msg = msgb_dequeue(&cc->mncc_upqueue))) {
+		mncc = (struct gsm_mncc *)msg->data;
+		if (ms->mncc_entity.mncc_recv)
+			ms->mncc_entity.mncc_recv(ms, mncc->msg_type, mncc);
+		work = 1; /* work done */
+		msgb_free(msg);
+	}
+
+	return work;
+}
+
+
+/*
+ * state transition
+ */
+
+static void new_cc_state(struct gsm_trans *trans, int state)
+{
+	if (state > 31 || state < 0)
+		return;
+
+	DEBUGP(DCC, "new state %s -> %s\n",
+		gsm48_cc_state_name(trans->cc.state),
+		gsm48_cc_state_name(state));
+
+	trans->cc.state = state;
+}
+
+/*
+ * timers
+ */
+
+/* timeout events of all timers */
+static void gsm48_cc_timeout(void *arg)
+{
+	struct gsm_trans *trans = arg;
+	int disconnect = 0, release = 0, abort = 1;
+	int mo_cause = GSM48_CC_CAUSE_RECOVERY_TIMER;
+	int mo_location = GSM48_CAUSE_LOC_PRN_S_LU;
+	int l4_cause = GSM48_CC_CAUSE_NORMAL_UNSPEC;
+	int l4_location = GSM48_CAUSE_LOC_PRN_S_LU;
+	struct gsm_mncc mo_rel, l4_rel;
+
+	memset(&mo_rel, 0, sizeof(struct gsm_mncc));
+	mo_rel.callref = trans->callref;
+	memset(&l4_rel, 0, sizeof(struct gsm_mncc));
+	l4_rel.callref = trans->callref;
+
+	LOGP(DCC, LOGL_INFO, "Timer T%x has fired.\n", trans->cc.Tcurrent);
+
+	switch(trans->cc.Tcurrent) {
+	case 0x303:
+		/* abort if connection is not already esablished */
+		if (trans->cc.state == GSM_CSTATE_MM_CONNECTION_PEND)
+			abort = 1;
+		else
+			release = 1;
+		l4_cause = GSM48_CC_CAUSE_USER_NOTRESPOND;
+		break;
+	case 0x305:
+		release = 1;
+		mo_cause = trans->cc.msg.cause.value;
+		mo_location = trans->cc.msg.cause.location;
+		break;
+	case 0x308:
+		if (!trans->cc.T308_second) {
+			/* restart T308 a second time */
+			gsm48_cc_tx_release(trans, &trans->cc.msg);
+			trans->cc.T308_second = 1;
+			break; /* stay in release state */
+		}
+		/* release MM conn, got NULL state, free trans */
+		gsm48_rel_null_free(trans);
+
+		return;
+	case 0x310:
+		disconnect = 1;
+		l4_cause = GSM48_CC_CAUSE_USER_NOTRESPOND;
+		break;
+	case 0x313:
+		disconnect = 1;
+		/* unknown, did not find it in the specs */
+		break;
+	default:
+		release = 1;
+	}
+
+	if ((release || abort) && trans->callref) {
+		/* process release towards layer 4 */
+		mncc_release_ind(trans->ms, trans, trans->callref,
+				 l4_location, l4_cause);
+	}
+
+	if (disconnect && trans->callref) {
+		/* process disconnect towards layer 4 */
+		mncc_set_cause(&l4_rel, l4_location, l4_cause);
+		mncc_recvmsg(trans->ms, trans, MNCC_DISC_IND, &l4_rel);
+	}
+
+	/* process disconnect towards mobile station */
+	if (disconnect || release || abort) {
+		mncc_set_cause(&mo_rel, mo_location, mo_cause);
+		mo_rel.cause.diag[0] =
+			((trans->cc.Tcurrent & 0xf00) >> 8) + '0';
+		mo_rel.cause.diag[1] =
+			((trans->cc.Tcurrent & 0x0f0) >> 4) + '0';
+		mo_rel.cause.diag[2] = (trans->cc.Tcurrent & 0x00f) + '0';
+		mo_rel.cause.diag_len = 3;
+
+		if (disconnect)
+			gsm48_cc_tx_disconnect(trans, &mo_rel);
+		if (release)
+			gsm48_cc_tx_release(trans, &mo_rel);
+		if (abort) {
+			/* release MM conn, got NULL state, free trans */
+			gsm48_rel_null_free(trans);
+		}
+	}
+}
+
+/* start various timers */
+static void gsm48_start_cc_timer(struct gsm_trans *trans, int current,
+				 int sec, int micro)
+{
+	LOGP(DCC, LOGL_INFO, "starting timer T%x with %d seconds\n", current,
+		sec);
+	trans->cc.timer.cb = gsm48_cc_timeout;
+	trans->cc.timer.data = trans;
+	osmo_timer_schedule(&trans->cc.timer, sec, micro);
+	trans->cc.Tcurrent = current;
+}
+
+/* stop various timers */
+static void gsm48_stop_cc_timer(struct gsm_trans *trans)
+{
+	if (osmo_timer_pending(&trans->cc.timer)) {
+		LOGP(DCC, LOGL_INFO, "stopping pending timer T%x\n",
+			trans->cc.Tcurrent);
+		osmo_timer_del(&trans->cc.timer);
+		trans->cc.Tcurrent = 0;
+	}
+}
+
+/*
+ * process handlers (misc)
+ */
+
+/* Call Control Specific transaction release.
+ * gets called by trans_free, DO NOT CALL YOURSELF!
+ */
+void _gsm48_cc_trans_free(struct gsm_trans *trans)
+{
+	gsm48_stop_cc_timer(trans);
+
+	/* disable audio distribution */
+	if (trans->ms->mncc_entity.ref == trans->callref)
+		trans->ms->mncc_entity.ref = 0;
+
+	/* send release to L4, if callref still exists */
+	if (trans->callref) {
+		/* Ressource unavailable */
+		mncc_release_ind(trans->ms, trans, trans->callref,
+			GSM48_CAUSE_LOC_PRN_S_LU,
+			GSM48_CC_CAUSE_RESOURCE_UNAVAIL);
+	}
+	if (trans->cc.state != GSM_CSTATE_NULL)
+		new_cc_state(trans, GSM_CSTATE_NULL);
+}
+
+/* release MM connection, go NULL state, free transaction */
+static int gsm48_rel_null_free(struct gsm_trans *trans)
+{
+	struct msgb *nmsg;
+
+	/* release MM connection */
+	nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMCC_REL_REQ, trans->callref,
+					trans->transaction_id, 0);
+	if (!nmsg)
+		return -ENOMEM;
+	LOGP(DCC, LOGL_INFO, "Sending MMCC_REL_REQ\n");
+	gsm48_mmxx_downmsg(trans->ms, nmsg);
+
+	new_cc_state(trans, GSM_CSTATE_NULL);
+
+	trans->callref = 0;
+	trans_free(trans);
+
+	return 0;
+}
+
+void mncc_set_cause(struct gsm_mncc *data, int loc, int val)
+{
+        data->fields |= MNCC_F_CAUSE;
+	data->cause.coding = 0x3;
+	data->cause.location = loc;
+	data->cause.value = val;
+}
+
+/* send release indication to upper layer */
+int mncc_release_ind(struct osmocom_ms *ms, struct gsm_trans *trans,
+		     uint32_t callref, int location, int value)
+{
+	struct gsm_mncc rel;
+
+	memset(&rel, 0, sizeof(rel));
+	rel.callref = callref;
+	mncc_set_cause(&rel, location, value);
+	return mncc_recvmsg(ms, trans, MNCC_REL_IND, &rel);
+}
+
+/* sending status message in response to unknown message */
+static int gsm48_cc_tx_status(struct gsm_trans *trans, int cause)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	uint8_t *cause_ie, *call_state_ie;
+
+	LOGP(DCC, LOGL_INFO, "sending STATUS (cause %d)\n", cause);
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_STATUS;
+
+	cause_ie = msgb_put(nmsg, 3);
+	cause_ie[0] = 2;
+	cause_ie[1] = GSM48_CAUSE_CS_GSM | GSM48_CAUSE_LOC_PRN_S_LU;
+	cause_ie[2] = 0x80 | cause;
+
+	call_state_ie = msgb_put(nmsg, 1);
+	call_state_ie[0] = 0xc0 | trans->cc.state;
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* reply status enquiry */
+static int gsm48_cc_rx_status_enq(struct gsm_trans *trans, struct msgb *msg)
+{
+	LOGP(DCC, LOGL_INFO, "received STATUS ENQUIREY\n");
+
+	return gsm48_cc_tx_status(trans, GSM48_CC_CAUSE_RESP_STATUS_INQ);
+}
+
+static int gsm48_cc_rx_status(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct gsm_mncc_cause cause;
+
+	if (payload_len < 1 || payload_len < gh->data[0] + 1) {
+		LOGP(DCC, LOGL_NOTICE, "Short read of status message "
+			"error.\n");
+		return -EINVAL;
+	}
+	gsm48_decode_cause(&cause, gh->data);
+
+	LOGP(DCC, LOGL_INFO, "received STATUS (cause %d)\n", cause.value);
+
+	return 0;
+}
+
+/*
+ * process handlers (mobile originating call establish)
+ */
+
+/* on SETUP request from L4, init MM connection */
+static int gsm48_cc_init_mm(struct gsm_trans *trans, void *arg)
+{
+	struct msgb *nmsg;
+	struct gsm_mncc *data = arg;
+	struct gsm48_mmxx_hdr *nmmh;
+
+	/* store setup message */
+	memcpy(&trans->cc.msg, data, sizeof(struct gsm_mncc));
+
+	new_cc_state(trans, GSM_CSTATE_MM_CONNECTION_PEND);
+
+	/* establish MM connection */
+	nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMCC_EST_REQ, trans->callref,
+					trans->transaction_id, 0);
+	if (!nmsg)
+		return -ENOMEM;
+	nmmh = (struct gsm48_mmxx_hdr *) nmsg->data;
+	if (data->emergency)
+		nmmh->emergency = 1;
+	LOGP(DCC, LOGL_INFO, "Sending MMCC_EST_REQ\n");
+	return gsm48_mmxx_downmsg(trans->ms, nmsg);
+}
+
+/* abort connection prior SETUP */
+static int gsm48_cc_abort_mm(struct gsm_trans *trans, void *arg)
+{
+	struct msgb *nmsg;
+
+	/* abort MM connection */
+	nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMCC_REL_REQ, trans->callref,
+			trans->transaction_id, 0);
+	if (!nmsg)
+		return -ENOMEM;
+	LOGP(DCC, LOGL_INFO, "Sending MMCC_REL_REQ\n");
+	gsm48_mmxx_downmsg(trans->ms, nmsg);
+
+	new_cc_state(trans, GSM_CSTATE_NULL);
+
+	trans->callref = 0;
+	trans_free(trans);
+
+	return 0;
+}
+
+/* setup message from upper layer */
+static int gsm48_cc_tx_setup(struct gsm_trans *trans)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm_mncc *setup = &trans->cc.msg;
+	int rc, transaction_id;
+	uint8_t *ie;
+
+	LOGP(DCC, LOGL_INFO, "sending SETUP\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	/* transaction id must not be assigned */
+	if (trans->transaction_id != 0xff) { /* unasssigned */
+		LOGP(DCC, LOGL_NOTICE, "TX Setup with assigned transaction. "
+			"This is not allowed!\n");
+		/* Temporarily out of order */
+		rc = mncc_release_ind(trans->ms, trans, trans->callref,
+				      GSM48_CAUSE_LOC_PRN_S_LU,
+				      GSM48_CC_CAUSE_NORMAL_UNSPEC);
+		trans->callref = 0;
+		trans_free(trans);
+		return rc;
+	}
+
+	/* Get free transaction_id */
+	transaction_id = trans_assign_trans_id(trans->ms, GSM48_PDISC_CC, 0);
+	if (transaction_id < 0) {
+		/* no free transaction ID */
+		rc = mncc_release_ind(trans->ms, trans, trans->callref,
+				      GSM48_CAUSE_LOC_PRN_S_LU,
+				      GSM48_CC_CAUSE_RESOURCE_UNAVAIL);
+		trans->callref = 0;
+		trans_free(trans);
+		return rc;
+	}
+	trans->transaction_id = transaction_id;
+
+	gh->msg_type = (setup->emergency) ? GSM48_MT_CC_EMERG_SETUP :
+						GSM48_MT_CC_SETUP;
+
+	/* actually we have to start it when CM SERVICE REQUEST has been sent,
+	 * but there is no primitive for that defined. i think it is ok to
+	 * do it here rather than inventing MMCC-NOTIFY-IND.
+	 */
+	gsm48_start_cc_timer(trans, 0x303, GSM48_T303_MS);
+
+	/* bearer capability (optional for emergency calls only) */
+	if (setup->fields & MNCC_F_BEARER_CAP)
+		gsm48_encode_bearer_cap(nmsg, 0, &setup->bearer_cap);
+	if (!setup->emergency) {
+		/* facility */
+		if (setup->fields & MNCC_F_FACILITY)
+			gsm48_encode_facility(nmsg, 0, &setup->facility);
+		/* called party BCD number */
+		if (setup->fields & MNCC_F_CALLED)
+			gsm48_encode_called(nmsg, &setup->called);
+		/* user-user */
+		if (setup->fields & MNCC_F_USERUSER)
+			gsm48_encode_useruser(nmsg, 0, &setup->useruser);
+		/* ss version */
+		if (setup->fields & MNCC_F_SSVERSION)
+			gsm48_encode_ssversion(nmsg, &setup->ssversion);
+		/* CLIR suppression */
+		if (setup->clir.sup) {
+			ie = msgb_put(nmsg, 1);
+			ie[0] = GSM48_IE_CLIR_SUPP;
+		}
+		/* CLIR invocation */
+		if (setup->clir.inv) {
+			ie = msgb_put(nmsg, 1);
+			ie[0] = GSM48_IE_CLIR_INVOC;
+		}
+		/* cc cap */
+		if (setup->fields & MNCC_F_CCCAP)
+			gsm48_encode_cccap(nmsg, &setup->cccap);
+	}
+
+	/* actually MM CONNECTION PENDING */
+	new_cc_state(trans, GSM_CSTATE_INITIATED);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* progress is received from lower layer */
+static int gsm48_cc_rx_progress(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc progress;
+
+	LOGP(DCC, LOGL_INFO, "received PROGRESS\n");
+
+	memset(&progress, 0, sizeof(struct gsm_mncc));
+	progress.callref = trans->callref;
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len,
+		GSM48_IE_PROGR_IND, 0);
+	/* progress */
+	if (TLVP_PRESENT(&tp, GSM48_IE_PROGR_IND)) {
+		progress.fields |= MNCC_F_PROGRESS;
+		gsm48_decode_progress(&progress.progress,
+				TLVP_VAL(&tp, GSM48_IE_PROGR_IND)-1);
+		/* store last progress indicator */
+		trans->cc.prog_ind = progress.progress.descr;
+	}
+	/* user-user */
+	if (TLVP_PRESENT(&tp, GSM48_IE_USER_USER)) {
+		progress.fields |= MNCC_F_USERUSER;
+		gsm48_decode_useruser(&progress.useruser,
+				TLVP_VAL(&tp, GSM48_IE_USER_USER)-1);
+	}
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_PROGRESS_IND, &progress);
+}
+
+/* call proceeding is received from lower layer */
+static int gsm48_cc_rx_call_proceeding(struct gsm_trans *trans,
+	struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc call_proc;
+
+	LOGP(DCC, LOGL_INFO, "sending CALL PROCEEDING\n");
+
+	gsm48_stop_cc_timer(trans);
+
+	memset(&call_proc, 0, sizeof(struct gsm_mncc));
+	call_proc.callref = trans->callref;
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
+#if 0
+	/* repeat */
+	if (TLVP_PRESENT(&tp, GSM48_IE_REPEAT_CIR))
+		call_conf.repeat = 1;
+	if (TLVP_PRESENT(&tp, GSM48_IE_REPEAT_SEQ))
+		call_conf.repeat = 2;
+#endif
+	/* bearer capability */
+	if (TLVP_PRESENT(&tp, GSM48_IE_BEARER_CAP)) {
+		call_proc.fields |= MNCC_F_BEARER_CAP;
+		gsm48_decode_bearer_cap(&call_proc.bearer_cap,
+				  TLVP_VAL(&tp, GSM48_IE_BEARER_CAP)-1);
+	}
+	/* facility */
+	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
+		call_proc.fields |= MNCC_F_FACILITY;
+		gsm48_decode_facility(&call_proc.facility,
+				TLVP_VAL(&tp, GSM48_IE_FACILITY)-1);
+	}
+
+	/* progress */
+	if (TLVP_PRESENT(&tp, GSM48_IE_PROGR_IND)) {
+		call_proc.fields |= MNCC_F_PROGRESS;
+		gsm48_decode_progress(&call_proc.progress,
+				TLVP_VAL(&tp, GSM48_IE_PROGR_IND)-1);
+		/* store last progress indicator */
+		trans->cc.prog_ind = call_proc.progress.descr;
+	}
+
+	/* start T310, if last progress indicator was 1 or 2 or 64 */
+	if (trans->cc.prog_ind == 1
+	 || trans->cc.prog_ind == 2
+	 || trans->cc.prog_ind == 64)
+		gsm48_start_cc_timer(trans, 0x310, GSM48_T310_MS);
+
+	new_cc_state(trans, GSM_CSTATE_MO_CALL_PROC);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_CALL_PROC_IND,
+			    &call_proc);
+}
+
+/* alerting is received by the lower layer */
+static int gsm48_cc_rx_alerting(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc alerting;
+
+	LOGP(DCC, LOGL_INFO, "received ALERTING\n");
+
+	gsm48_stop_cc_timer(trans);
+	/* no T301 in MS call control */
+
+	memset(&alerting, 0, sizeof(struct gsm_mncc));
+	alerting.callref = trans->callref;
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
+	/* facility */
+	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
+		alerting.fields |= MNCC_F_FACILITY;
+		gsm48_decode_facility(&alerting.facility,
+				TLVP_VAL(&tp, GSM48_IE_FACILITY)-1);
+	}
+	/* progress */
+	if (TLVP_PRESENT(&tp, GSM48_IE_PROGR_IND)) {
+		alerting.fields |= MNCC_F_PROGRESS;
+		gsm48_decode_progress(&alerting.progress,
+				TLVP_VAL(&tp, GSM48_IE_PROGR_IND)-1);
+	}
+	/* user-user */
+	if (TLVP_PRESENT(&tp, GSM48_IE_USER_USER)) {
+		alerting.fields |= MNCC_F_USERUSER;
+		gsm48_decode_useruser(&alerting.useruser,
+				TLVP_VAL(&tp, GSM48_IE_USER_USER)-1);
+	}
+
+	new_cc_state(trans, GSM_CSTATE_CALL_DELIVERED);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_ALERT_IND,
+			    &alerting);
+}
+
+/* connect is received from lower layer */
+static int gsm48_cc_rx_connect(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc connect;
+
+	LOGP(DCC, LOGL_INFO, "received CONNECT\n");
+
+	gsm48_stop_cc_timer(trans);
+
+	memset(&connect, 0, sizeof(struct gsm_mncc));
+	connect.callref = trans->callref;
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
+	/* facility */
+	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
+		connect.fields |= MNCC_F_FACILITY;
+		gsm48_decode_facility(&connect.facility,
+				TLVP_VAL(&tp, GSM48_IE_FACILITY)-1);
+	}
+	/* connected */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CONN_BCD)) {
+		connect.fields |= MNCC_F_CONNECTED;
+		gsm48_decode_connected(&connect.connected,
+				TLVP_VAL(&tp, GSM48_IE_CONN_BCD)-1);
+	}
+	/* progress */
+	if (TLVP_PRESENT(&tp, GSM48_IE_PROGR_IND)) {
+		connect.fields |= MNCC_F_PROGRESS;
+		gsm48_decode_progress(&connect.progress,
+				TLVP_VAL(&tp, GSM48_IE_PROGR_IND)-1);
+	}
+	/* user-user */
+	if (TLVP_PRESENT(&tp, GSM48_IE_USER_USER)) {
+		connect.fields |= MNCC_F_USERUSER;
+		gsm48_decode_useruser(&connect.useruser,
+				TLVP_VAL(&tp, GSM48_IE_USER_USER)-1);
+	}
+
+	/* ACTIVE state is set during this: */
+	gsm48_cc_tx_connect_ack(trans, NULL);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_SETUP_CNF, &connect);
+}
+
+/* connect ack message from upper layer */
+static int gsm48_cc_tx_connect_ack(struct gsm_trans *trans, void *arg)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending CONNECT ACKNOWLEDGE\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_CONNECT_ACK;
+
+	new_cc_state(trans, GSM_CSTATE_ACTIVE);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/*
+ * process handlers (mobile terminating call establish)
+ */
+
+/* setup is received from lower layer */
+static int gsm48_cc_rx_setup(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc setup;
+
+	LOGP(DCC, LOGL_INFO, "received SETUP\n");
+
+	memset(&setup, 0, sizeof(struct gsm_mncc));
+	setup.callref = trans->callref;
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
+
+	/* bearer capability */
+	if (TLVP_PRESENT(&tp, GSM48_IE_BEARER_CAP)) {
+		setup.fields |= MNCC_F_BEARER_CAP;
+		gsm48_decode_bearer_cap(&setup.bearer_cap,
+				  TLVP_VAL(&tp, GSM48_IE_BEARER_CAP)-1);
+	}
+	/* facility */
+	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
+		setup.fields |= MNCC_F_FACILITY;
+		gsm48_decode_facility(&setup.facility,
+				TLVP_VAL(&tp, GSM48_IE_FACILITY)-1);
+	}
+	/* progress */
+	if (TLVP_PRESENT(&tp, GSM48_IE_PROGR_IND)) {
+		setup.fields |= MNCC_F_PROGRESS;
+		gsm48_decode_progress(&setup.progress,
+				TLVP_VAL(&tp, GSM48_IE_PROGR_IND)-1);
+	}
+	/* signal */
+	if (TLVP_PRESENT(&tp, GSM48_IE_SIGNAL)) {
+		setup.fields |= MNCC_F_SIGNAL;
+		gsm48_decode_signal(&setup.signal,
+				TLVP_VAL(&tp, GSM48_IE_SIGNAL)-1);
+	}
+	/* calling party bcd number */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CALLING_BCD)) {
+		setup.fields |= MNCC_F_CALLING;
+		gsm48_decode_calling(&setup.calling,
+			      TLVP_VAL(&tp, GSM48_IE_CALLING_BCD)-1);
+	}
+	/* called party bcd number */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CALLED_BCD)) {
+		setup.fields |= MNCC_F_CALLED;
+		gsm48_decode_called(&setup.called,
+			      TLVP_VAL(&tp, GSM48_IE_CALLED_BCD)-1);
+	}
+	/* redirecting party bcd number */
+	if (TLVP_PRESENT(&tp, GSM48_IE_REDIR_BCD)) {
+		setup.fields |= MNCC_F_REDIRECTING;
+		gsm48_decode_redirecting(&setup.redirecting,
+			      TLVP_VAL(&tp, GSM48_IE_REDIR_BCD)-1);
+	}
+	/* user-user */
+	if (TLVP_PRESENT(&tp, GSM48_IE_USER_USER)) {
+		setup.fields |= MNCC_F_USERUSER;
+		gsm48_decode_useruser(&setup.useruser,
+				TLVP_VAL(&tp, GSM48_IE_USER_USER)-1);
+	}
+
+	new_cc_state(trans, GSM_CSTATE_CALL_PRESENT);
+
+	/* indicate setup to MNCC */
+	mncc_recvmsg(trans->ms, trans, MNCC_SETUP_IND, &setup);
+
+	return 0;
+}
+
+/* call conf message from upper layer */
+static int gsm48_cc_tx_call_conf(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *confirm = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending CALL CONFIRMED (proceeding)\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_CALL_CONF;
+
+	new_cc_state(trans, GSM_CSTATE_MO_TERM_CALL_CONF);
+
+	/* bearer capability */
+	if (confirm->fields & MNCC_F_BEARER_CAP)
+		gsm48_encode_bearer_cap(nmsg, 0, &confirm->bearer_cap);
+	/* cause */
+	if (confirm->fields & MNCC_F_CAUSE)
+		gsm48_encode_cause(nmsg, 0, &confirm->cause);
+	/* cc cap */
+	if (confirm->fields & MNCC_F_CCCAP)
+		gsm48_encode_cccap(nmsg, &confirm->cccap);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* alerting message from upper layer */
+static int gsm48_cc_tx_alerting(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *alerting = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending ALERTING\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_ALERTING;
+
+	/* facility */
+	if (alerting->fields & MNCC_F_FACILITY)
+		gsm48_encode_facility(nmsg, 0, &alerting->facility);
+	/* user-user */
+	if (alerting->fields & MNCC_F_USERUSER)
+		gsm48_encode_useruser(nmsg, 0, &alerting->useruser);
+	/* ss version */
+	if (alerting->fields & MNCC_F_SSVERSION)
+		gsm48_encode_ssversion(nmsg, &alerting->ssversion);
+
+	new_cc_state(trans, GSM_CSTATE_CALL_RECEIVED);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* connect message from upper layer */
+static int gsm48_cc_tx_connect(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *connect = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending CONNECT\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_CONNECT;
+
+	gsm48_stop_cc_timer(trans);
+	gsm48_start_cc_timer(trans, 0x313, GSM48_T313_MS);
+
+	/* facility */
+	if (connect->fields & MNCC_F_FACILITY)
+		gsm48_encode_facility(nmsg, 0, &connect->facility);
+	/* user-user */
+	if (connect->fields & MNCC_F_USERUSER)
+		gsm48_encode_useruser(nmsg, 0, &connect->useruser);
+	/* ss version */
+	if (connect->fields & MNCC_F_SSVERSION)
+		gsm48_encode_ssversion(nmsg, &connect->ssversion);
+
+	new_cc_state(trans, GSM_CSTATE_CONNECT_REQUEST);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* connect ack is received from lower layer */
+static int gsm48_cc_rx_connect_ack(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm_mncc connect_ack;
+
+	LOGP(DCC, LOGL_INFO, "received CONNECT ACKNOWLEDGE\n");
+
+	gsm48_stop_cc_timer(trans);
+
+	new_cc_state(trans, GSM_CSTATE_ACTIVE);
+
+	memset(&connect_ack, 0, sizeof(struct gsm_mncc));
+	connect_ack.callref = trans->callref;
+	return mncc_recvmsg(trans->ms, trans, MNCC_SETUP_COMPL_IND,
+			    &connect_ack);
+}
+
+/*
+ * process handlers (during active state)
+ */
+
+/* notify message from upper layer */
+static int gsm48_cc_tx_notify(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *notify = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending NOTIFY\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_NOTIFY;
+
+	/* notify */
+	gsm48_encode_notify(nmsg, notify->notify);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* notify is received from lower layer */
+static int gsm48_cc_rx_notify(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct gsm_mncc notify;
+
+	LOGP(DCC, LOGL_INFO, "received NOTIFY\n");
+
+	memset(&notify, 0, sizeof(struct gsm_mncc));
+	notify.callref = trans->callref;
+	/* notify */
+	if (payload_len < 1) {
+		LOGP(DCC, LOGL_NOTICE, "Short read of notify message error.\n");
+		return -EINVAL;
+	}
+	gsm48_decode_notify(&notify.notify, gh->data);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_NOTIFY_IND, &notify);
+}
+
+/* start dtmf message from upper layer */
+static int gsm48_cc_tx_start_dtmf(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *dtmf = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending START DTMF\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_START_DTMF;
+
+	/* keypad */
+	gsm48_encode_keypad(nmsg, dtmf->keypad);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* start dtmf ack is received from lower layer */
+static int gsm48_cc_rx_start_dtmf_ack(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc dtmf;
+
+	LOGP(DCC, LOGL_INFO, "received START DTMF ACKNOWLEDGE\n");
+
+	memset(&dtmf, 0, sizeof(struct gsm_mncc));
+	dtmf.callref = trans->callref;
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
+	/* keypad facility */
+	if (TLVP_PRESENT(&tp, GSM48_IE_KPD_FACILITY)) {
+		dtmf.fields |= MNCC_F_KEYPAD;
+		gsm48_decode_keypad(&dtmf.keypad,
+			      TLVP_VAL(&tp, GSM48_IE_KPD_FACILITY)-1);
+	}
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_START_DTMF_RSP, &dtmf);
+}
+
+/* start dtmf rej is received from lower layer */
+static int gsm48_cc_rx_start_dtmf_rej(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct gsm_mncc dtmf;
+
+	LOGP(DCC, LOGL_INFO, "received START DTMF REJECT\n");
+
+	memset(&dtmf, 0, sizeof(struct gsm_mncc));
+	dtmf.callref = trans->callref;
+	/* cause */
+	if (payload_len < 1) {
+		LOGP(DCC, LOGL_NOTICE, "Short read of dtmf reject message "
+			"error.\n");
+		return -EINVAL;
+	}
+	gsm48_decode_cause(&dtmf.cause, gh->data);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_START_DTMF_REJ, &dtmf);
+}
+
+/* stop dtmf message from upper layer */
+static int gsm48_cc_tx_stop_dtmf(struct gsm_trans *trans, void *arg)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending STOP DTMF\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_STOP_DTMF;
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* stop dtmf ack is received from lower layer */
+static int gsm48_cc_rx_stop_dtmf_ack(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc dtmf;
+
+	LOGP(DCC, LOGL_INFO, "received STOP DTMF ACKNOWLEDGE\n");
+
+	memset(&dtmf, 0, sizeof(struct gsm_mncc));
+	dtmf.callref = trans->callref;
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_STOP_DTMF_RSP, &dtmf);
+}
+
+/* hold message from upper layer */
+static int gsm48_cc_tx_hold(struct gsm_trans *trans, void *arg)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending HOLD\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_HOLD;
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* hold ack is received from lower layer */
+static int gsm48_cc_rx_hold_ack(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm_mncc hold;
+
+	LOGP(DCC, LOGL_INFO, "received HOLD ACKNOWLEDGE\n");
+
+	memset(&hold, 0, sizeof(struct gsm_mncc));
+	hold.callref = trans->callref;
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_HOLD_CNF, &hold);
+}
+
+/* hold rej is received from lower layer */
+static int gsm48_cc_rx_hold_rej(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct gsm_mncc hold;
+
+	LOGP(DCC, LOGL_INFO, "received HOLD REJECT\n");
+
+	memset(&hold, 0, sizeof(struct gsm_mncc));
+	hold.callref = trans->callref;
+	/* cause */
+	if (payload_len < 1) {
+		LOGP(DCC, LOGL_NOTICE, "Short read of hold reject message "
+			"error.\n");
+		return -EINVAL;
+	}
+	gsm48_decode_cause(&hold.cause, gh->data);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_HOLD_REJ, &hold);
+}
+
+/* retrieve message from upper layer */
+static int gsm48_cc_tx_retrieve(struct gsm_trans *trans, void *arg)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending RETRIEVE\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_RETR;
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* retrieve ack is received from lower layer */
+static int gsm48_cc_rx_retrieve_ack(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm_mncc retrieve;
+
+	LOGP(DCC, LOGL_INFO, "received RETRIEVE ACKNOWLEDGE\n");
+
+	memset(&retrieve, 0, sizeof(struct gsm_mncc));
+	retrieve.callref = trans->callref;
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_RETRIEVE_CNF, &retrieve);
+}
+
+/* retrieve rej is received from lower layer */
+static int gsm48_cc_rx_retrieve_rej(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct gsm_mncc retrieve;
+
+	LOGP(DCC, LOGL_INFO, "received RETRIEVE REJECT\n");
+
+	memset(&retrieve, 0, sizeof(struct gsm_mncc));
+	retrieve.callref = trans->callref;
+	/* cause */
+	if (payload_len < 1) {
+		LOGP(DCC, LOGL_NOTICE, "Short read of retrieve reject message "
+			"error.\n");
+		return -EINVAL;
+	}
+	gsm48_decode_cause(&retrieve.cause, gh->data);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_RETRIEVE_REJ, &retrieve);
+}
+
+/* facility message from upper layer or from timer event */
+static int gsm48_cc_tx_facility(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *fac = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending FACILITY\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_FACILITY;
+
+	/* facility */
+	gsm48_encode_facility(nmsg, 1, &fac->facility);
+	/* ss version */
+	if (fac->fields & MNCC_F_SSVERSION)
+		gsm48_encode_ssversion(nmsg, &fac->ssversion);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* facility is received from lower layer */
+static int gsm48_cc_rx_facility(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct gsm_mncc fac;
+
+	LOGP(DCC, LOGL_INFO, "received FACILITY\n");
+
+	memset(&fac, 0, sizeof(struct gsm_mncc));
+	fac.callref = trans->callref;
+	if (payload_len < 1) {
+		LOGP(DCC, LOGL_NOTICE, "Short read of facility message "
+			"error.\n");
+		return -EINVAL;
+	}
+	/* facility */
+	gsm48_decode_facility(&fac.facility, gh->data);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_FACILITY_IND, &fac);
+}
+
+/* user info message from upper layer or from timer event */
+static int gsm48_cc_tx_userinfo(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *user = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending USERINFO\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_USER_INFO;
+
+	/* user-user */
+	if (user->fields & MNCC_F_USERUSER)
+		gsm48_encode_useruser(nmsg, 1, &user->useruser);
+	/* more data */
+	if (user->more)
+		gsm48_encode_more(nmsg);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* user info is received from lower layer */
+static int gsm48_cc_rx_userinfo(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc user;
+
+	LOGP(DCC, LOGL_INFO, "received USERINFO\n");
+
+	memset(&user, 0, sizeof(struct gsm_mncc));
+	user.callref = trans->callref;
+	if (payload_len < 1) {
+		LOGP(DCC, LOGL_NOTICE, "Short read of userinfo message "
+			"error.\n");
+		return -EINVAL;
+	}
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len,
+		GSM48_IE_USER_USER, 0);
+	/* user-user */
+	gsm48_decode_useruser(&user.useruser,
+			TLVP_VAL(&tp, GSM48_IE_USER_USER)-1);
+	/* more data */
+	if (TLVP_PRESENT(&tp, GSM48_IE_MORE_DATA))
+		user.more = 1;
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_USERINFO_IND, &user);
+}
+
+/* modify message from upper layer or from timer event */
+static int gsm48_cc_tx_modify(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *modify = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending MODIFY\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_MODIFY;
+
+	gsm48_start_cc_timer(trans, 0x323, GSM48_T323_MS);
+
+	/* bearer capability */
+	gsm48_encode_bearer_cap(nmsg, 1, &modify->bearer_cap);
+
+	new_cc_state(trans, GSM_CSTATE_MO_TERM_MODIFY);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* modify complete is received from lower layer */
+static int gsm48_cc_rx_modify_complete(struct gsm_trans *trans,
+	struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct gsm_mncc modify;
+
+	LOGP(DCC, LOGL_INFO, "received MODIFY COMPLETE\n");
+
+	gsm48_stop_cc_timer(trans);
+
+	memset(&modify, 0, sizeof(struct gsm_mncc));
+	modify.callref = trans->callref;
+	if (payload_len < 1) {
+		LOGP(DCC, LOGL_NOTICE, "Short read of modify complete message "
+			"error.\n");
+		return -EINVAL;
+	}
+	/* bearer capability */
+	gsm48_decode_bearer_cap(&modify.bearer_cap, gh->data);
+
+	new_cc_state(trans, GSM_CSTATE_ACTIVE);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_MODIFY_CNF, &modify);
+}
+
+/* modify reject is received from lower layer */
+static int gsm48_cc_rx_modify_reject(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc modify;
+
+	LOGP(DCC, LOGL_INFO, "received MODIFY REJECT\n");
+
+	gsm48_stop_cc_timer(trans);
+
+	memset(&modify, 0, sizeof(struct gsm_mncc));
+	modify.callref = trans->callref;
+	if (payload_len < 1) {
+		LOGP(DCC, LOGL_NOTICE, "Short read of modify reject message "
+			"error.\n");
+		return -EINVAL;
+	}
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len,
+		GSM48_IE_BEARER_CAP, GSM48_IE_CAUSE);
+	/* bearer capability */
+	if (TLVP_PRESENT(&tp, GSM48_IE_BEARER_CAP)) {
+		modify.fields |= MNCC_F_BEARER_CAP;
+		gsm48_decode_bearer_cap(&modify.bearer_cap,
+				  TLVP_VAL(&tp, GSM48_IE_BEARER_CAP)-1);
+	}
+	/* cause */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CAUSE)) {
+		modify.fields |= MNCC_F_CAUSE;
+		gsm48_decode_cause(&modify.cause,
+			     TLVP_VAL(&tp, GSM48_IE_CAUSE)-1);
+	}
+
+	new_cc_state(trans, GSM_CSTATE_ACTIVE);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_MODIFY_REJ, &modify);
+}
+
+/* modify is received from lower layer */
+static int gsm48_cc_rx_modify(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct gsm_mncc modify;
+
+	LOGP(DCC, LOGL_INFO, "received MODIFY\n");
+
+	memset(&modify, 0, sizeof(struct gsm_mncc));
+	modify.callref = trans->callref;
+	if (payload_len < 1) {
+		LOGP(DCC, LOGL_NOTICE, "Short read of modify message error.\n");
+		return -EINVAL;
+	}
+	/* bearer capability */
+	gsm48_decode_bearer_cap(&modify.bearer_cap, gh->data);
+
+	new_cc_state(trans, GSM_CSTATE_MO_ORIG_MODIFY);
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_MODIFY_IND, &modify);
+}
+
+/* modify complete message from upper layer or from timer event */
+static int gsm48_cc_tx_modify_complete(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *modify = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending MODIFY COMPLETE\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_MODIFY_COMPL;
+
+	/* bearer capability */
+	gsm48_encode_bearer_cap(nmsg, 1, &modify->bearer_cap);
+
+	new_cc_state(trans, GSM_CSTATE_ACTIVE);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* modify reject message from upper layer or from timer event */
+static int gsm48_cc_tx_modify_reject(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *modify = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending MODIFY REJECT\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_MODIFY_REJECT;
+
+	/* bearer capability */
+	gsm48_encode_bearer_cap(nmsg, 1, &modify->bearer_cap);
+	/* cause */
+	gsm48_encode_cause(nmsg, 1, &modify->cause);
+
+	new_cc_state(trans, GSM_CSTATE_ACTIVE);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/*
+ * process handlers (call clearing)
+ */
+
+static struct gsm_mncc_cause default_cause = {
+	.location       = GSM48_CAUSE_LOC_PRN_S_LU,
+	.coding         = 0,
+	.rec            = 0,
+	.rec_val        = 0,
+	.value          = GSM48_CC_CAUSE_NORMAL_UNSPEC,
+	.diag_len       = 0,
+	.diag           = { 0 },
+};
+
+/* disconnect message from upper layer or from timer event */
+static int gsm48_cc_tx_disconnect(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *disc = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending DISCONNECT\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_DISCONNECT;
+
+	gsm48_stop_cc_timer(trans);
+	gsm48_start_cc_timer(trans, 0x305, GSM48_T305_MS);
+
+	/* cause */
+	if (disc->fields & MNCC_F_CAUSE)
+		gsm48_encode_cause(nmsg, 1, &disc->cause);
+	else
+		gsm48_encode_cause(nmsg, 1, &default_cause);
+
+	/* facility */
+	if (disc->fields & MNCC_F_FACILITY)
+		gsm48_encode_facility(nmsg, 0, &disc->facility);
+	/* progress */
+	if (disc->fields & MNCC_F_PROGRESS)
+		gsm48_encode_progress(nmsg, 0, &disc->progress);
+	/* user-user */
+	if (disc->fields & MNCC_F_USERUSER)
+		gsm48_encode_useruser(nmsg, 0, &disc->useruser);
+	/* ss version */
+	if (disc->fields & MNCC_F_SSVERSION)
+		gsm48_encode_ssversion(nmsg, &disc->ssversion);
+
+	new_cc_state(trans, GSM_CSTATE_DISCONNECT_REQ);
+
+	return gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+}
+
+/* release message from upper layer or from timer event */
+static int gsm48_cc_tx_release(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *rel = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending RELEASE\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_RELEASE;
+
+	gsm48_stop_cc_timer(trans);
+	gsm48_start_cc_timer(trans, 0x308, GSM48_T308_MS);
+
+	/* cause */
+	if (rel->fields & MNCC_F_CAUSE)
+		gsm48_encode_cause(nmsg, 0, &rel->cause);
+	/* facility */
+	if (rel->fields & MNCC_F_FACILITY)
+		gsm48_encode_facility(nmsg, 0, &rel->facility);
+	/* user-user */
+	if (rel->fields & MNCC_F_USERUSER)
+		gsm48_encode_useruser(nmsg, 0, &rel->useruser);
+	/* ss version */
+	if (rel->fields & MNCC_F_SSVERSION)
+		gsm48_encode_ssversion(nmsg, &rel->ssversion);
+
+	trans->cc.T308_second = 0;
+	memcpy(&trans->cc.msg, rel, sizeof(struct gsm_mncc));
+
+	if (trans->cc.state != GSM_CSTATE_RELEASE_REQ)
+		new_cc_state(trans, GSM_CSTATE_RELEASE_REQ);
+
+	gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+
+#if 0
+	/* release without sending MMCC_REL_REQ */
+	new_cc_state(trans, GSM_CSTATE_NULL);
+	trans->callref = 0;
+	trans_free(trans);
+#endif
+
+	return 0;
+}
+
+/* reject message from upper layer */
+static int gsm48_cc_tx_release_compl(struct gsm_trans *trans, void *arg)
+{
+	struct gsm_mncc *rel = arg;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+
+	LOGP(DCC, LOGL_INFO, "sending RELEASE COMPLETE\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->msg_type = GSM48_MT_CC_RELEASE_COMPL;
+
+	gsm48_stop_cc_timer(trans);
+
+	/* cause */
+	if (rel->fields & MNCC_F_CAUSE)
+		gsm48_encode_cause(nmsg, 0, &rel->cause);
+	/* facility */
+	if (rel->fields & MNCC_F_FACILITY)
+		gsm48_encode_facility(nmsg, 0, &rel->facility);
+	/* user-user */
+	if (rel->fields & MNCC_F_USERUSER)
+		gsm48_encode_useruser(nmsg, 0, &rel->useruser);
+	/* ss version */
+	if (rel->fields & MNCC_F_SSVERSION)
+		gsm48_encode_ssversion(nmsg, &rel->ssversion);
+
+	/* release without sending MMCC_REL_REQ */
+	new_cc_state(trans, GSM_CSTATE_NULL);
+	trans->callref = 0;
+	trans_free(trans);
+
+	return 0;
+}
+
+/* disconnect is received from lower layer */
+static int gsm48_cc_rx_disconnect(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc disc;
+
+	LOGP(DCC, LOGL_INFO, "received DISCONNECT\n");
+
+	gsm48_stop_cc_timer(trans);
+
+	new_cc_state(trans, GSM_CSTATE_DISCONNECT_IND);
+
+	memset(&disc, 0, sizeof(struct gsm_mncc));
+	disc.callref = trans->callref;
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len,
+		GSM48_IE_CAUSE, 0);
+	/* cause */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CAUSE)) {
+		disc.fields |= MNCC_F_CAUSE;
+		gsm48_decode_cause(&disc.cause,
+			     TLVP_VAL(&tp, GSM48_IE_CAUSE)-1);
+	}
+	/* facility */
+	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
+		disc.fields |= MNCC_F_FACILITY;
+		gsm48_decode_facility(&disc.facility,
+				TLVP_VAL(&tp, GSM48_IE_FACILITY)-1);
+	}
+	/* progress */
+	if (TLVP_PRESENT(&tp, GSM48_IE_PROGR_IND)) {
+		disc.fields |= MNCC_F_PROGRESS;
+		gsm48_decode_progress(&disc.progress,
+				TLVP_VAL(&tp, GSM48_IE_PROGR_IND)-1);
+	}
+	/* user-user */
+	if (TLVP_PRESENT(&tp, GSM48_IE_USER_USER)) {
+		disc.fields |= MNCC_F_USERUSER;
+		gsm48_decode_useruser(&disc.useruser,
+				TLVP_VAL(&tp, GSM48_IE_USER_USER)-1);
+	}
+
+	/* store disconnect cause for T305 expiry */
+	memcpy(&trans->cc.msg, &disc, sizeof(struct gsm_mncc));
+
+	return mncc_recvmsg(trans->ms, trans, MNCC_DISC_IND, &disc);
+}
+
+/* release is received from lower layer */
+static int gsm48_cc_rx_release(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc rel;
+
+	LOGP(DCC, LOGL_INFO, "received RELEASE\n");
+
+	gsm48_stop_cc_timer(trans);
+
+	memset(&rel, 0, sizeof(struct gsm_mncc));
+	rel.callref = trans->callref;
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
+	/* cause */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CAUSE)) {
+		rel.fields |= MNCC_F_CAUSE;
+		gsm48_decode_cause(&rel.cause,
+			     TLVP_VAL(&tp, GSM48_IE_CAUSE)-1);
+	}
+	/* facility */
+	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
+		rel.fields |= MNCC_F_FACILITY;
+		gsm48_decode_facility(&rel.facility,
+				TLVP_VAL(&tp, GSM48_IE_FACILITY)-1);
+	}
+	/* user-user */
+	if (TLVP_PRESENT(&tp, GSM48_IE_USER_USER)) {
+		rel.fields |= MNCC_F_USERUSER;
+		gsm48_decode_useruser(&rel.useruser,
+				TLVP_VAL(&tp, GSM48_IE_USER_USER)-1);
+	}
+
+	/* in case we receive a relase, when we are already in NULL state */
+	if (trans->cc.state == GSM_CSTATE_NULL) {
+		LOGP(DCC, LOGL_INFO, "ignoring RELEASE in NULL state\n");
+		/* release MM conn, free trans */
+		return gsm48_rel_null_free(trans);
+	}
+	if (trans->cc.state == GSM_CSTATE_RELEASE_REQ) {
+		/* release collision 5.4.5 */
+		mncc_recvmsg(trans->ms, trans, MNCC_REL_CNF, &rel);
+	} else {
+		struct msgb *nmsg;
+
+		/* forward cause only */
+		LOGP(DCC, LOGL_INFO, "sending RELEASE COMPLETE\n");
+
+		nmsg = gsm48_l3_msgb_alloc();
+		if (!nmsg)
+			return -ENOMEM;
+		gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+		gh->msg_type = GSM48_MT_CC_RELEASE_COMPL;
+
+		if (rel.fields & MNCC_F_CAUSE)
+			gsm48_encode_cause(nmsg, 0, &rel.cause);
+
+		gsm48_cc_to_mm(nmsg, trans, GSM48_MMCC_DATA_REQ);
+
+		/* release indication */
+		mncc_recvmsg(trans->ms, trans, MNCC_REL_IND, &rel);
+	}
+
+	/* release MM conn, got NULL state, free trans */
+	return gsm48_rel_null_free(trans);
+}
+
+/* release complete is received from lower layer */
+static int gsm48_cc_rx_release_compl(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct gsm_mncc rel;
+
+	LOGP(DCC, LOGL_INFO, "received RELEASE COMPLETE\n");
+
+	gsm48_stop_cc_timer(trans);
+
+	memset(&rel, 0, sizeof(struct gsm_mncc));
+	rel.callref = trans->callref;
+	tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0);
+	/* cause */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CAUSE)) {
+		rel.fields |= MNCC_F_CAUSE;
+		gsm48_decode_cause(&rel.cause,
+			     TLVP_VAL(&tp, GSM48_IE_CAUSE)-1);
+	}
+	/* facility */
+	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
+		rel.fields |= MNCC_F_FACILITY;
+		gsm48_decode_facility(&rel.facility,
+				TLVP_VAL(&tp, GSM48_IE_FACILITY)-1);
+	}
+	/* user-user */
+	if (TLVP_PRESENT(&tp, GSM48_IE_USER_USER)) {
+		rel.fields |= MNCC_F_USERUSER;
+		gsm48_decode_useruser(&rel.useruser,
+				TLVP_VAL(&tp, GSM48_IE_USER_USER)-1);
+	}
+
+	if (trans->callref) {
+		switch (trans->cc.state) {
+		case GSM_CSTATE_CALL_PRESENT:
+			mncc_recvmsg(trans->ms, trans,
+					  MNCC_REJ_IND, &rel);
+			break;
+		case GSM_CSTATE_RELEASE_REQ:
+			mncc_recvmsg(trans->ms, trans,
+					  MNCC_REL_CNF, &rel);
+			break;
+		default:
+			mncc_recvmsg(trans->ms, trans,
+					  MNCC_REL_IND, &rel);
+		}
+	}
+
+	/* release MM conn, got NULL state, free trans */
+	return gsm48_rel_null_free(trans);
+}
+
+/*
+ * state machines
+ */
+
+/* state trasitions for MNCC messages (upper layer) */
+static struct downstate {
+	uint32_t	states;
+	int		type;
+	int		(*rout) (struct gsm_trans *trans, void *arg);
+} downstatelist[] = {
+	/* mobile originating call establishment */
+	{SBIT(GSM_CSTATE_NULL), /* 5.2.1 */
+	 MNCC_SETUP_REQ, gsm48_cc_init_mm},
+
+	{SBIT(GSM_CSTATE_MM_CONNECTION_PEND), /* 5.2.1 */
+	 MNCC_REL_REQ, gsm48_cc_abort_mm},
+
+	/* mobile terminating call establishment */
+	{SBIT(GSM_CSTATE_CALL_PRESENT), /* 5.2.2.3.1 */
+	 MNCC_CALL_CONF_REQ, gsm48_cc_tx_call_conf},
+
+	{SBIT(GSM_CSTATE_MO_TERM_CALL_CONF), /* 5.2.2.3.2 */
+	 MNCC_ALERT_REQ, gsm48_cc_tx_alerting},
+
+	{SBIT(GSM_CSTATE_MO_TERM_CALL_CONF) |
+	 SBIT(GSM_CSTATE_CALL_RECEIVED), /* 5.2.2.5 */
+	 MNCC_SETUP_RSP, gsm48_cc_tx_connect},
+
+	 /* signalling during call */
+	{SBIT(GSM_CSTATE_ACTIVE), /* 5.3.1 */
+	 MNCC_NOTIFY_REQ, gsm48_cc_tx_notify},
+
+	{ALL_STATES, /* 5.5.7.1 */
+	 MNCC_START_DTMF_REQ, gsm48_cc_tx_start_dtmf},
+
+	{ALL_STATES, /* 5.5.7.3 */
+	 MNCC_STOP_DTMF_REQ, gsm48_cc_tx_stop_dtmf},
+
+	{SBIT(GSM_CSTATE_ACTIVE),
+	 MNCC_HOLD_REQ, gsm48_cc_tx_hold},
+
+	{SBIT(GSM_CSTATE_ACTIVE),
+	 MNCC_RETRIEVE_REQ, gsm48_cc_tx_retrieve},
+
+	{ALL_STATES - SBIT(GSM_CSTATE_NULL) - SBIT(GSM_CSTATE_RELEASE_REQ),
+	 MNCC_FACILITY_REQ, gsm48_cc_tx_facility},
+
+	{SBIT(GSM_CSTATE_ACTIVE),
+	 MNCC_USERINFO_REQ, gsm48_cc_tx_userinfo},
+
+	/* clearing */
+	{ALL_STATES - SBIT(GSM_CSTATE_NULL) - SBIT(GSM_CSTATE_DISCONNECT_IND) -
+	 SBIT(GSM_CSTATE_RELEASE_REQ) -
+	 SBIT(GSM_CSTATE_DISCONNECT_REQ), /* 5.4.3.1 */
+	 MNCC_DISC_REQ, gsm48_cc_tx_disconnect},
+
+	{SBIT(GSM_CSTATE_INITIATED),
+	 MNCC_REJ_REQ, gsm48_cc_tx_release_compl},
+
+	{ALL_STATES - SBIT(GSM_CSTATE_NULL) -
+	 SBIT(GSM_CSTATE_RELEASE_REQ), /* ??? */
+	 MNCC_REL_REQ, gsm48_cc_tx_release},
+
+	/* modify */
+	{SBIT(GSM_CSTATE_ACTIVE),
+	 MNCC_MODIFY_REQ, gsm48_cc_tx_modify},
+
+	{SBIT(GSM_CSTATE_MO_ORIG_MODIFY),
+	 MNCC_MODIFY_RSP, gsm48_cc_tx_modify_complete},
+
+	{SBIT(GSM_CSTATE_MO_ORIG_MODIFY),
+	 MNCC_MODIFY_REJ, gsm48_cc_tx_modify_reject},
+};
+
+#define DOWNSLLEN \
+	(sizeof(downstatelist) / sizeof(struct downstate))
+
+int mncc_tx_to_cc(void *inst, int msg_type, void *arg)
+{
+	struct osmocom_ms *ms = (struct osmocom_ms *) inst;
+	struct gsm_mncc *data = arg;
+	struct gsm_trans *trans;
+	int i, rc;
+
+	if (!ms->started || ms->shutdown != MS_SHUTDOWN_NONE) {
+		LOGP(DCC, LOGL_NOTICE, "Phone is down!\n");
+		if (ms->mncc_entity.mncc_recv && msg_type != MNCC_REL_REQ) {
+			struct gsm_mncc rel;
+
+			memset(&rel, 0, sizeof(rel));
+			rel.callref = data->callref;
+			mncc_set_cause(&rel, GSM48_CAUSE_LOC_PRN_S_LU,
+			GSM48_CC_CAUSE_DEST_OOO);
+			ms->mncc_entity.mncc_recv(ms, MNCC_REL_IND, &rel);
+		}
+		return -EBUSY;
+	}
+
+	data->msg_type = msg_type;
+
+	/* Find callref */
+	trans = trans_find_by_callref(ms, data->callref);
+
+	if (!trans) {
+		/* check for SETUP message */
+		if (msg_type != MNCC_SETUP_REQ) {
+			/* Invalid call reference */
+			LOGP(DCC, LOGL_NOTICE, "transaction not found\n");
+			return mncc_release_ind(ms, NULL, data->callref,
+				GSM48_CAUSE_LOC_PRN_S_LU,
+				GSM48_CC_CAUSE_INVAL_TRANS_ID);
+		}
+		if (data->callref >= 0x40000000) {
+			LOGP(DCC, LOGL_FATAL, "MNCC ref wrong.\n");
+			return mncc_release_ind(ms, NULL, data->callref,
+				GSM48_CAUSE_LOC_PRN_S_LU,
+				GSM48_CC_CAUSE_INVAL_TRANS_ID);
+		}
+
+		/* Create transaction */
+		trans = trans_alloc(ms, GSM48_PDISC_CC, 0xff, data->callref);
+		if (!trans) {
+			/* No memory or whatever */
+			return mncc_release_ind(ms, NULL, data->callref,
+				GSM48_CAUSE_LOC_PRN_S_LU,
+				GSM48_CC_CAUSE_RESOURCE_UNAVAIL);
+		}
+	}
+
+	switch (msg_type) {
+	case GSM_TCHF_FRAME:
+		return gsm_send_voice(ms, arg);
+	case MNCC_LCHAN_MODIFY:
+		return 0;
+	case MNCC_FRAME_RECV:
+		ms->mncc_entity.ref = trans->callref;
+		gsm48_rr_audio_mode(ms,
+			AUDIO_TX_TRAFFIC_REQ | AUDIO_RX_TRAFFIC_IND);
+		return 0;
+	case MNCC_FRAME_DROP:
+		if (ms->mncc_entity.ref == trans->callref)
+			ms->mncc_entity.ref = 0;
+		gsm48_rr_audio_mode(ms, AUDIO_TX_MICROPHONE | AUDIO_RX_SPEAKER);
+		return 0;
+	}
+
+	/* Find function for current state and message */
+	for (i = 0; i < DOWNSLLEN; i++)
+		if ((msg_type == downstatelist[i].type)
+		 && ((1 << trans->cc.state) & downstatelist[i].states))
+			break;
+	if (i == DOWNSLLEN) {
+		LOGP(DCC, LOGL_NOTICE, "Message %d unhandled at state %d\n",
+			msg_type, trans->cc.state);
+		return 0;
+	}
+
+	rc = downstatelist[i].rout(trans, arg);
+
+	return rc;
+}
+
+/* state trasitions for call control messages (lower layer) */
+static struct datastate {
+	uint32_t	states;
+	int		type;
+	int		(*rout) (struct gsm_trans *trans, struct msgb *msg);
+} datastatelist[] = {
+	/* mobile originating call establishment */
+	{SBIT(GSM_CSTATE_INITIATED), /* 5.2.1.3 */
+	 GSM48_MT_CC_CALL_PROC, gsm48_cc_rx_call_proceeding},
+
+	{SBIT(GSM_CSTATE_INITIATED) | SBIT(GSM_CSTATE_MO_CALL_PROC) |
+	 SBIT(GSM_CSTATE_CALL_DELIVERED), /* 5.2.1.4.1 */
+	 GSM48_MT_CC_PROGRESS, gsm48_cc_rx_progress},
+
+	{SBIT(GSM_CSTATE_INITIATED) |
+	 SBIT(GSM_CSTATE_MO_CALL_PROC), /* 5.2.1.5 */
+	 GSM48_MT_CC_ALERTING, gsm48_cc_rx_alerting},
+
+	{SBIT(GSM_CSTATE_INITIATED) | SBIT(GSM_CSTATE_MO_CALL_PROC) |
+	 SBIT(GSM_CSTATE_CALL_DELIVERED), /* 5.2.1.6 */
+	 GSM48_MT_CC_CONNECT, gsm48_cc_rx_connect},
+
+	/* mobile terminating call establishment */
+	{SBIT(GSM_CSTATE_NULL), /* 5.2.2.1 */
+	 GSM48_MT_CC_SETUP, gsm48_cc_rx_setup},
+
+	{SBIT(GSM_CSTATE_CONNECT_REQUEST), /* 5.2.2.6 */
+	 GSM48_MT_CC_CONNECT_ACK, gsm48_cc_rx_connect_ack},
+
+	 /* signalling during call */
+	{SBIT(GSM_CSTATE_ACTIVE), /* 5.3.1 */
+	 GSM48_MT_CC_NOTIFY, gsm48_cc_rx_notify},
+
+	{ALL_STATES, /* 8.4 */
+	 GSM48_MT_CC_STATUS_ENQ, gsm48_cc_rx_status_enq},
+
+	{ALL_STATES,
+	 GSM48_MT_CC_STATUS, gsm48_cc_rx_status},
+
+	{ALL_STATES, /* 5.5.7.2 */
+	 GSM48_MT_CC_START_DTMF_ACK, gsm48_cc_rx_start_dtmf_ack},
+
+	{ALL_STATES, /* 5.5.7.2 */
+	 GSM48_MT_CC_START_DTMF_REJ, gsm48_cc_rx_start_dtmf_rej},
+
+	{ALL_STATES, /* 5.5.7.4 */
+	 GSM48_MT_CC_STOP_DTMF_ACK, gsm48_cc_rx_stop_dtmf_ack},
+
+	{SBIT(GSM_CSTATE_ACTIVE),
+	 GSM48_MT_CC_HOLD_ACK, gsm48_cc_rx_hold_ack},
+
+	{SBIT(GSM_CSTATE_ACTIVE),
+	 GSM48_MT_CC_HOLD_REJ, gsm48_cc_rx_hold_rej},
+
+	{SBIT(GSM_CSTATE_ACTIVE),
+	 GSM48_MT_CC_RETR_ACK, gsm48_cc_rx_retrieve_ack},
+
+	{SBIT(GSM_CSTATE_ACTIVE),
+	 GSM48_MT_CC_RETR_REJ, gsm48_cc_rx_retrieve_rej},
+
+	{ALL_STATES - SBIT(GSM_CSTATE_NULL),
+	 GSM48_MT_CC_FACILITY, gsm48_cc_rx_facility},
+
+	{SBIT(GSM_CSTATE_ACTIVE),
+	 GSM48_MT_CC_USER_INFO, gsm48_cc_rx_userinfo},
+
+	/* clearing */
+	{ALL_STATES - SBIT(GSM_CSTATE_NULL) - SBIT(GSM_CSTATE_RELEASE_REQ) -
+	 SBIT(GSM_CSTATE_DISCONNECT_IND), /* 5.4.4.1.1 */
+	 GSM48_MT_CC_DISCONNECT, gsm48_cc_rx_disconnect},
+
+	{ALL_STATES, /* 5.4.3.3 & 5.4.5!!!*/
+	 GSM48_MT_CC_RELEASE, gsm48_cc_rx_release},
+
+	{ALL_STATES, /* 5.4.4.1.3 */
+	 GSM48_MT_CC_RELEASE_COMPL, gsm48_cc_rx_release_compl},
+
+	/* modify */
+	{SBIT(GSM_CSTATE_ACTIVE),
+	 GSM48_MT_CC_MODIFY, gsm48_cc_rx_modify},
+
+	{SBIT(GSM_CSTATE_MO_TERM_MODIFY),
+	 GSM48_MT_CC_MODIFY_COMPL, gsm48_cc_rx_modify_complete},
+
+	{SBIT(GSM_CSTATE_MO_TERM_MODIFY),
+	 GSM48_MT_CC_MODIFY_REJECT, gsm48_cc_rx_modify_reject},
+};
+
+#define DATASLLEN \
+	(sizeof(datastatelist) / sizeof(struct datastate))
+
+static int gsm48_cc_data_ind(struct gsm_trans *trans, struct msgb *msg)
+{
+	struct osmocom_ms *ms = trans->ms;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	int msg_type = gh->msg_type & 0xbf;
+	uint8_t transaction_id = ((gh->proto_discr & 0xf0) ^ 0x80) >> 4;
+		/* flip */
+	int msg_supported = 0; /* determine, if message is supported at all */
+	int i, rc;
+
+	/* set transaction ID, if not already */
+	trans->transaction_id = transaction_id;
+
+	/* pull the MMCC header */
+	msgb_pull(msg, sizeof(struct gsm48_mmxx_hdr));
+
+	LOGP(DCC, LOGL_INFO, "(ms %s) Received '%s' in CC state %s\n", ms->name,
+		gsm48_cc_msg_name(msg_type),
+		gsm48_cc_state_name(trans->cc.state));
+
+	/* find function for current state and message */
+	for (i = 0; i < DATASLLEN; i++) {
+		if (msg_type == datastatelist[i].type)
+			msg_supported = 1;
+		if ((msg_type == datastatelist[i].type)
+		 && ((1 << trans->cc.state) & datastatelist[i].states))
+			break;
+	}
+	if (i == DATASLLEN) {
+		if (msg_supported) {
+			LOGP(DCC, LOGL_NOTICE, "Message unhandled at this "
+				"state.\n");
+			return gsm48_cc_tx_status(trans,
+				GSM48_REJECT_MSG_TYPE_NOT_COMPATIBLE);
+		} else {
+			LOGP(DCC, LOGL_NOTICE, "Message not supported.\n");
+			return gsm48_cc_tx_status(trans,
+				GSM48_REJECT_MSG_TYPE_NOT_IMPLEMENTED);
+		}
+	}
+
+	rc = datastatelist[i].rout(trans, msg);
+
+	return rc;
+}
+
+/* receive message from MM layer */
+int gsm48_rcv_cc(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	int msg_type = mmh->msg_type;
+	struct gsm_trans *trans;
+	int rc = 0;
+
+	trans = trans_find_by_callref(ms, mmh->ref);
+	if (!trans) {
+		trans = trans_alloc(ms, GSM48_PDISC_CC, mmh->transaction_id,
+					mmh->ref);
+		if (!trans)
+			return -ENOMEM;
+	}
+
+	LOGP(DCC, LOGL_INFO, "(ms %s) Received '%s' in CC state %s\n", ms->name,
+		get_mmxx_name(msg_type),
+		gsm48_cc_state_name(trans->cc.state));
+
+	switch (msg_type) {
+	case GSM48_MMCC_EST_IND:
+		/* data included */
+		rc = gsm48_cc_data_ind(trans, msg);
+		break;
+	case GSM48_MMCC_EST_CNF:
+		/* send setup after confirm */
+		if (trans->cc.state == GSM_CSTATE_MM_CONNECTION_PEND)
+			rc = gsm48_cc_tx_setup(trans);
+		else
+			LOGP(DCC, LOGL_ERROR, "Oops, MMCC-EST-CONF in state "
+				"%d?\n", trans->cc.state);
+		break;
+	case GSM48_MMCC_ERR_IND: /* no supporting re-establishment */
+	case GSM48_MMCC_REL_IND:
+		/* release L4, release transaction */
+		mncc_release_ind(trans->ms, trans, trans->callref,
+			 GSM48_CAUSE_LOC_PRN_S_LU, mmh->cause);
+		/* release without sending MMCC_REL_REQ */
+		new_cc_state(trans, GSM_CSTATE_NULL);
+		trans->callref = 0;
+		trans_free(trans);
+		break;
+	case GSM48_MMCC_DATA_IND:
+		rc = gsm48_cc_data_ind(trans, msg);
+		break;
+	case GSM48_MMCC_UNIT_DATA_IND:
+		break;
+	case GSM48_MMCC_SYNC_IND:
+		break;
+	default:
+		LOGP(DCC, LOGL_NOTICE, "Message unhandled.\n");
+		rc = -ENOTSUP;
+	}
+
+	return rc;
+}
+
+int mncc_clear_trans(void *inst, uint8_t protocol)
+{
+	struct osmocom_ms *ms = (struct osmocom_ms *) inst;
+	struct gsm_mncc rel;
+	struct gsm_trans *trans, *trans2;
+
+	memset(&rel, 0, sizeof(struct gsm_mncc));
+
+	/* safe, in case the release process will destroy transaction node */
+	llist_for_each_entry_safe(trans, trans2, &ms->trans_list, entry) {
+		if (trans->protocol == protocol) {
+			LOGP(DCC, LOGL_NOTICE, "Release CC-transaction.\n");
+			rel.callref = trans->callref;
+			mncc_set_cause(&rel, GSM48_CAUSE_LOC_PRN_S_LU,
+				GSM48_CC_CAUSE_TEMP_FAILURE);
+			mncc_tx_to_cc(ms, MNCC_REL_REQ, &rel);
+		}
+	}
+
+	return 0;
+
+}
+
diff --git a/src/host/layer23/src/mobile/gsm48_mm.c b/src/host/layer23/src/mobile/gsm48_mm.c
new file mode 100644
index 00000000..02d861e8
--- /dev/null
+++ b/src/host/layer23/src/mobile/gsm48_mm.c
@@ -0,0 +1,4396 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/core/talloc.h>
+
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/networks.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/mobile/gsm48_cc.h>
+#include <osmocom/bb/mobile/gsm480_ss.h>
+#include <osmocom/bb/mobile/gsm411_sms.h>
+#include <osmocom/bb/mobile/app_mobile.h>
+#include <osmocom/bb/mobile/primitives.h>
+#include <osmocom/bb/mobile/vty.h>
+#include <osmocom/bb/common/utils.h>
+
+extern void *l23_ctx;
+
+void mm_conn_free(struct gsm48_mm_conn *conn);
+static int gsm48_rcv_rr(struct osmocom_ms *ms, struct msgb *msg);
+static int gsm48_rcv_mmr(struct osmocom_ms *ms, struct msgb *msg);
+static int gsm48_mm_ev(struct osmocom_ms *ms, int msg_type, struct msgb *msg);
+static int gsm48_mm_tx_id_rsp(struct osmocom_ms *ms, uint8_t mi_type);
+static int gsm48_mm_tx_loc_upd_req(struct osmocom_ms *ms);
+static int gsm48_mm_loc_upd_failed(struct osmocom_ms *ms, struct msgb *msg);
+static int gsm48_mm_conn_go_dedic(struct osmocom_ms *ms);
+static int gsm48_mm_init_mm_reject(struct osmocom_ms *ms, struct msgb *msg);
+static int gsm48_mm_data_ind(struct osmocom_ms *ms, struct msgb *msg);
+static void new_mm_state(struct gsm48_mmlayer *mm, int state, int substate);
+static int gsm48_mm_loc_upd_normal(struct osmocom_ms *ms, struct msgb *msg);
+static int gsm48_mm_loc_upd_periodic(struct osmocom_ms *ms, struct msgb *msg);
+static int gsm48_mm_loc_upd(struct osmocom_ms *ms, struct msgb *msg);
+
+/*
+ * notes
+ */
+
+/*
+ * Notes on IMSI detach procedure:
+ *
+ * At the end of the procedure, the state of MM, RR, cell selection: No SIM.
+ *
+ * In MM IDLE state, cell available: RR is establised, IMSI detach specific
+ * procedure is performed.
+ *
+ * In MM IDLE state, no cell: State is silently changed to No SIM.
+ *
+ * During any MM connection state, or Wait for network command: All MM
+ * connections (if any) are released locally, and IMSI detach specific
+ * procedure is performed.
+ *
+ * During IMSI detach processing: Request of IMSI detach is ignored.
+ *
+ * Any other state: The special 'delay_detach' flag is set only. If set, at any
+ * state transition we will clear the flag and restart the procedure again.
+ *
+ * The procedure is not spec conform, but always succeeds.
+ *
+ */
+
+/* Notes on Service states:
+ *
+ * There are two PLMN search states:
+ *
+ * - PLMN SEARCH NORMAL
+ * - PLMN SEARCH
+ *
+ * They are entered, if: (4.2.1.2)
+ * - ME is switched on
+ * - SIM is inserted
+ * - user has asked PLMN selection in certain Service states
+ * - coverage is lost in certain Service states
+ * - roaming is denied
+ * - (optionally see 4.2.1.2)
+ *
+ * PLMN SEARCH NORMAL state is then entered, if all these conditions are met:
+ *  - SIM is valid
+ *  - SIM state is U1
+ *  - SIM LAI valid
+ *  - cell selected
+ *  - cell == SIM LAI
+ *
+ * Otherwhise PLMN SEARCH is entered.
+ *
+ * During PLMN SEARCH NORMAL state: (4.2.2.5)
+ *  - on expirery of T3212: Perform periodic location update, when back
+ *    to NORMAL SERVICE state.
+ *  - perform IMSI detach
+ *  - perform MM connections
+ *  - respond to paging (if possible)
+ *
+ * During PLMN SEARCH state: (4.2.2.6)
+ *  - reject MM connection except for emergency calls
+ *
+ *
+ * The NO CELL AVAILABLE state is entered, if:
+ *  - no cell found during PLMN search
+ *
+ * During NO CELL AVAILABLE state:
+ *  - reject any MM connection
+ *
+ * The NO IMSI state is entered if:
+ *  - SIM is invalid
+ *  - and cell is selected during PLMN SEARCH states
+ *
+ * During NO IMSO state: (4.2.2.4)
+ *  - reject MM connection except for emergency calls
+ *
+ * The LIMITED SERVICE state is entered if:
+ *  - SIM is valid
+ *  - and SIM state is U3
+ *  - and cell is selected
+ *
+ * During LIMITED SERVICE state: (4.2.2.3)
+ *  - reject MM connection except for emergency calls
+ *  - perform location update, if new LAI is entered
+ *
+ *
+ * The LOCATION UPDATE NEEDED state is entered if:
+ *  - SIM is valid
+ *  - and location update must be performed for any reason
+ *
+ * During LOCATION UPDATE NEEDED state:
+ *  - reject MM connection except for emergency calls
+ *
+ * In all IDLE states:
+ *  - on expirery of T3211 or T3213: Perform location update, when back
+ *    to NORMAL SERVICE state.
+ *
+ * This state is left if location update is possible and directly enter
+ * state ATTEMPTING TO UPDATE and trigger location update.
+ * The function gsm48_mm_loc_upd_possible() is used to check this on state
+ * change.
+ *
+ *
+ * The ATTEMPTING TO UPDATE state is entered if:
+ *  - SIM is valid
+ *  - and SIM state is U2
+ *  - and cell is selected
+ *
+ * During ATTEMPTING TO UPDATE state: (4.2.2.2)
+ *  - on expirery of T3211 or T3213: Perform location updated
+ *  - on expirery of T3212: Perform location updated
+ *  - on change of LAI: Perform location update
+ *  - (abnormal cases unsupported)
+ *  - accept MM connection for emergency calls
+ *  - trigger location update on any other MM connection
+ *  - respond to paging (with IMSI only, because in U2 TMSI is not valid)
+ *
+ *
+ * The NORMAL SERVICE state is entered if:
+ *  - SIM is valid
+ *  - and SIM state is U1
+ *  - and cell is selected
+ *  - and SIM LAI == cell
+ *
+ * During NORMAL SERVICE state: (4.2.2.1)
+ *  - on expirery of T3211 or T3213: Perform location updated
+ *  - on expirery of T3212: Perform location updated
+ *  - on change of LAI: Perform location update
+ *  - perform IMSI detach
+ *  - perform MM connections
+ *  - respond to paging
+ *
+ *
+ * gsm48_mm_set_plmn_search() is used enter PLMN SEARCH or PLMN SEARCH NORMAL
+ * state. Depending on the conditions above, the appropiate state is selected.
+ *
+ *
+ * gsm48_mm_return_idle() is used to select the Service state when returning
+ * to MM IDLE state after cell reselection.
+ *
+ *
+ * If cell selection process indicates NO_CELL_FOUND:
+ *
+ * - NO CELL AVAILABLE state is entered, if not already.
+ *
+ * gsm48_mm_no_cell_found() is used to select the Service state.
+ *
+ *
+ * If cell selection process indicates CELL_SELECTED:
+ *
+ * - NO IMSI state is entered, if no SIM valid.
+ * - Otherwise NORMAL SERVICES state is entered, if
+ *   SIM state is U1, SIM LAI == cell, IMSI is attached, T3212 not expired.
+ * - Otherwise NORMAL SERVICES state is entered, if
+ *   SIM state is U1, SIM LAI == cell, attach not required, T3212 not expired.
+ * - Otherwise LIMITED SERVICE state is entered, if
+ *   CS mode is automatic, cell is forbidden PLMN or forbidden LA.
+ * - Otherwise LIMITED SERVICE state is entered, if
+ *   CS mode is manual, cell is not the selected one.
+ * - Otherwise LOCATION UPDATE NEEDED state is entered.
+ *
+ * gsm48_mm_cell_selected() is used to select the Service state.
+ *
+ */
+
+/*
+ * support functions
+ */
+
+/* get supported power level of given arfcn */
+uint8_t gsm48_current_pwr_lev(struct gsm_settings *set, uint16_t arfcn)
+{
+	uint8_t pwr_lev;
+
+	if (arfcn >= (512 | ARFCN_PCS) && arfcn <= (810 | ARFCN_PCS))
+		pwr_lev = set->class_pcs - 1;
+	else if (arfcn >= 512 && arfcn <= 885)
+		pwr_lev = set->class_dcs - 1;
+	else if (arfcn >= 259 && arfcn <= 340)
+		pwr_lev = set->class_400 - 1;
+	else if (arfcn >= 128 && arfcn <= 251)
+		pwr_lev = set->class_850 - 1;
+	else
+		pwr_lev = set->class_900 - 1;
+
+	return pwr_lev;
+}
+
+/* decode network name */
+static int decode_network_name(char *name, int name_len,
+	const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+	int length, padding;
+
+	name[0] = '\0';
+	if (in_len < 1)
+		return -EINVAL;
+
+	/* must be CB encoded */
+	if ((lv[1] & 0x70) != 0x00)
+		return -ENOTSUP;
+
+	padding = lv[1] & 0x03;
+	length = ((in_len - 1) * 8 - padding) / 7;
+	if (length <= 0)
+		return 0;
+	gsm_7bit_decode_n(name, name_len, lv + 2, length);
+
+	return length;
+}
+
+/* encode 'mobile identity' */
+int gsm48_encode_mi(uint8_t *buf, struct msgb *msg, struct osmocom_ms *ms,
+	uint8_t mi_type)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm_settings *set = &ms->settings;
+	uint8_t *ie;
+
+	switch(mi_type) {
+	case GSM_MI_TYPE_TMSI:
+		gsm48_generate_mid_from_tmsi(buf, subscr->tmsi);
+		break;
+	case GSM_MI_TYPE_IMSI:
+		gsm48_generate_mid_from_imsi(buf, subscr->imsi);
+		break;
+	case GSM_MI_TYPE_IMEI:
+		gsm48_generate_mid_from_imsi(buf, set->imei);
+		break;
+	case GSM_MI_TYPE_IMEISV:
+		gsm48_generate_mid_from_imsi(buf, set->imeisv);
+		break;
+	case GSM_MI_TYPE_NONE:
+	default:
+	        buf[0] = GSM48_IE_MOBILE_ID;
+	        buf[1] = 1;
+	        buf[2] = 0xf0;
+		break;
+	}
+	/* alter MI type */
+	buf[2] = (buf[2] & ~GSM_MI_TYPE_MASK) | mi_type;
+
+	if (msg) {
+		/* MI as LV */
+		ie = msgb_put(msg, 1 + buf[1]);
+		memcpy(ie, buf + 1, 1 + buf[1]);
+	}
+
+	return 0;
+}
+
+/* encode 'classmark 1' */
+int gsm48_encode_classmark1(struct gsm48_classmark1 *cm, uint8_t rev_lev,
+	uint8_t es_ind, uint8_t a5_1, uint8_t pwr_lev)
+{
+	memset(cm, 0, sizeof(*cm));
+	cm->rev_lev = rev_lev;
+	cm->es_ind = es_ind;
+	cm->a5_1 = !a5_1;
+	cm->pwr_lev = pwr_lev;
+
+	return 0;
+}
+
+/*
+ * timers
+ */
+
+static void timeout_mm_t3210(void *arg)
+{
+	struct gsm48_mmlayer *mm = arg;
+
+	LOGP(DMM, LOGL_INFO, "timer T3210 (loc. upd. timeout) has fired\n");
+	gsm48_mm_ev(mm->ms, GSM48_MM_EVENT_TIMEOUT_T3210, NULL);
+}
+
+static void timeout_mm_t3211(void *arg)
+{
+	struct gsm48_mmlayer *mm = arg;
+
+	LOGP(DSUM, LOGL_INFO, "Location update retry\n");
+	LOGP(DMM, LOGL_INFO, "timer T3211 (loc. upd. retry delay) has fired\n");
+	gsm48_mm_ev(mm->ms, GSM48_MM_EVENT_TIMEOUT_T3211, NULL);
+}
+
+static void timeout_mm_t3212(void *arg)
+{
+	struct gsm48_mmlayer *mm = arg;
+
+	LOGP(DSUM, LOGL_INFO, "Periodic location update\n");
+	LOGP(DMM, LOGL_INFO, "timer T3212 (periodic loc. upd. delay) has "
+		"fired\n");
+
+	/* reset attempt counter when attempting to update (4.4.4.5) */
+	if (mm->state == GSM48_MM_ST_MM_IDLE
+	 && mm->substate == GSM48_MM_SST_ATTEMPT_UPDATE)
+		mm->lupd_attempt = 0;
+
+	gsm48_mm_ev(mm->ms, GSM48_MM_EVENT_TIMEOUT_T3212, NULL);
+}
+
+static void timeout_mm_t3213(void *arg)
+{
+	struct gsm48_mmlayer *mm = arg;
+
+	LOGP(DSUM, LOGL_INFO, "Location update retry\n");
+	LOGP(DMM, LOGL_INFO, "timer T3213 (delay after RA failure) has "
+		"fired\n");
+	gsm48_mm_ev(mm->ms, GSM48_MM_EVENT_TIMEOUT_T3213, NULL);
+}
+
+static void timeout_mm_t3230(void *arg)
+{
+	struct gsm48_mmlayer *mm = arg;
+
+	LOGP(DMM, LOGL_INFO, "timer T3230 (MM connection timeout) has "
+		"fired\n");
+	gsm48_mm_ev(mm->ms, GSM48_MM_EVENT_TIMEOUT_T3230, NULL);
+}
+
+static void timeout_mm_t3220(void *arg)
+{
+	struct gsm48_mmlayer *mm = arg;
+
+	LOGP(DMM, LOGL_INFO, "timer T3220 (IMSI detach keepalive) has "
+		"fired\n");
+	gsm48_mm_ev(mm->ms, GSM48_MM_EVENT_TIMEOUT_T3220, NULL);
+}
+
+static void timeout_mm_t3240(void *arg)
+{
+	struct gsm48_mmlayer *mm = arg;
+
+	LOGP(DMM, LOGL_INFO, "timer T3240 (RR release timeout) has fired\n");
+	gsm48_mm_ev(mm->ms, GSM48_MM_EVENT_TIMEOUT_T3240, NULL);
+}
+
+static void start_mm_t3210(struct gsm48_mmlayer *mm)
+{
+	LOGP(DMM, LOGL_INFO, "starting T3210 (loc. upd. timeout) with %d.%d "
+		"seconds\n", GSM_T3210_MS);
+	mm->t3210.cb = timeout_mm_t3210;
+	mm->t3210.data = mm;
+	osmo_timer_schedule(&mm->t3210, GSM_T3210_MS);
+}
+
+static void start_mm_t3211(struct gsm48_mmlayer *mm)
+{
+	LOGP(DMM, LOGL_INFO, "starting T3211 (loc. upd. retry delay) with "
+		"%d.%d seconds\n", GSM_T3211_MS);
+	mm->t3211.cb = timeout_mm_t3211;
+	mm->t3211.data = mm;
+	osmo_timer_schedule(&mm->t3211, GSM_T3211_MS);
+}
+
+static void start_mm_t3212(struct gsm48_mmlayer *mm, int sec)
+{
+	/* don't start, if is not available */
+	if (!sec)
+		return;
+
+	LOGP(DMM, LOGL_INFO, "starting T3212 (periodic loc. upd. delay) with "
+		"%d seconds\n", sec);
+	mm->t3212.cb = timeout_mm_t3212;
+	mm->t3212.data = mm;
+	osmo_timer_schedule(&mm->t3212, sec, 0);
+}
+
+static void start_mm_t3213(struct gsm48_mmlayer *mm)
+{
+	LOGP(DMM, LOGL_INFO, "starting T3213 (delay after RA failure) with "
+		"%d.%d seconds\n", GSM_T3213_MS);
+	mm->t3213.cb = timeout_mm_t3213;
+	mm->t3213.data = mm;
+	osmo_timer_schedule(&mm->t3213, GSM_T3213_MS);
+}
+
+static void start_mm_t3220(struct gsm48_mmlayer *mm)
+{
+	LOGP(DMM, LOGL_INFO, "starting T3220 (IMSI detach keepalive) with "
+		"%d.%d seconds\n", GSM_T3220_MS);
+	mm->t3220.cb = timeout_mm_t3220;
+	mm->t3220.data = mm;
+	osmo_timer_schedule(&mm->t3220, GSM_T3220_MS);
+}
+
+static void start_mm_t3230(struct gsm48_mmlayer *mm)
+{
+	LOGP(DMM, LOGL_INFO, "starting T3230 (MM connection timeout) with "
+		"%d.%d seconds\n", GSM_T3230_MS);
+	mm->t3230.cb = timeout_mm_t3230;
+	mm->t3230.data = mm;
+	osmo_timer_schedule(&mm->t3230, GSM_T3230_MS);
+}
+
+static void start_mm_t3240(struct gsm48_mmlayer *mm)
+{
+	LOGP(DMM, LOGL_INFO, "starting T3240 (RR release timeout) with %d.%d "
+		"seconds\n", GSM_T3240_MS);
+	mm->t3240.cb = timeout_mm_t3240;
+	mm->t3240.data = mm;
+	osmo_timer_schedule(&mm->t3240, GSM_T3240_MS);
+}
+
+static void stop_mm_t3210(struct gsm48_mmlayer *mm)
+{
+	if (osmo_timer_pending(&mm->t3210)) {
+		LOGP(DMM, LOGL_INFO, "stopping pending (loc. upd. timeout) "
+			"timer T3210\n");
+		osmo_timer_del(&mm->t3210);
+	}
+}
+
+static void stop_mm_t3211(struct gsm48_mmlayer *mm)
+{
+	if (osmo_timer_pending(&mm->t3211)) {
+		LOGP(DMM, LOGL_INFO, "stopping pending (loc. upd. retry "
+			"delay) timer T3211\n");
+		osmo_timer_del(&mm->t3211);
+	}
+}
+
+static void stop_mm_t3212(struct gsm48_mmlayer *mm)
+{
+	if (osmo_timer_pending(&mm->t3212)) {
+		LOGP(DMM, LOGL_INFO, "stopping pending (periodic loc. upd. "
+			"delay) timer T3212\n");
+		osmo_timer_del(&mm->t3212);
+	}
+}
+
+static void stop_mm_t3213(struct gsm48_mmlayer *mm)
+{
+	if (osmo_timer_pending(&mm->t3213)) {
+		LOGP(DMM, LOGL_INFO, "stopping pending (delay after RA "
+			"failure) timer T3213\n");
+		osmo_timer_del(&mm->t3213);
+	}
+}
+
+static void stop_mm_t3220(struct gsm48_mmlayer *mm)
+{
+	if (osmo_timer_pending(&mm->t3220)) {
+		LOGP(DMM, LOGL_INFO, "stopping pending (IMSI detach keepalive) "
+			"timer T3220\n");
+		osmo_timer_del(&mm->t3220);
+	}
+}
+
+static void stop_mm_t3230(struct gsm48_mmlayer *mm)
+{
+	if (osmo_timer_pending(&mm->t3230)) {
+		LOGP(DMM, LOGL_INFO, "stopping pending (MM connection timeout) "
+			"timer T3230\n");
+		osmo_timer_del(&mm->t3230);
+	}
+}
+
+static void stop_mm_t3240(struct gsm48_mmlayer *mm)
+{
+	if (osmo_timer_pending(&mm->t3240)) {
+		LOGP(DMM, LOGL_INFO, "stopping pending (RR release timeout) "
+			"timer T3240\n");
+		osmo_timer_del(&mm->t3240);
+	}
+}
+
+static void stop_mm_t3241(struct gsm48_mmlayer *mm)
+{
+	/* not implemented, not required */
+}
+
+/*
+ * messages
+ */
+
+/* names of MM events */
+static const struct value_string gsm48_mmevent_names[] = {
+	{ GSM48_MM_EVENT_CELL_SELECTED,	"MM_EVENT_CELL_SELECTED" },
+	{ GSM48_MM_EVENT_NO_CELL_FOUND,	"MM_EVENT_NO_CELL_FOUND" },
+	{ GSM48_MM_EVENT_TIMEOUT_T3210,	"MM_EVENT_TIMEOUT_T3210" },
+	{ GSM48_MM_EVENT_TIMEOUT_T3211,	"MM_EVENT_TIMEOUT_T3211" },
+	{ GSM48_MM_EVENT_TIMEOUT_T3212,	"MM_EVENT_TIMEOUT_T3212" },
+	{ GSM48_MM_EVENT_TIMEOUT_T3213,	"MM_EVENT_TIMEOUT_T3213" },
+	{ GSM48_MM_EVENT_TIMEOUT_T3220,	"MM_EVENT_TIMEOUT_T3220" },
+	{ GSM48_MM_EVENT_TIMEOUT_T3230,	"MM_EVENT_TIMEOUT_T3230" },
+	{ GSM48_MM_EVENT_TIMEOUT_T3240,	"MM_EVENT_TIMEOUT_T3240" },
+	{ GSM48_MM_EVENT_IMSI_DETACH,	"MM_EVENT_IMSI_DETACH" },
+	{ GSM48_MM_EVENT_POWER_OFF,	"MM_EVENT_POWER_OFF" },
+	{ GSM48_MM_EVENT_PAGING,	"MM_EVENT_PAGING" },
+	{ GSM48_MM_EVENT_AUTH_RESPONSE,	"MM_EVENT_AUTH_RESPONSE" },
+	{ GSM48_MM_EVENT_SYSINFO,	"MM_EVENT_SYSINFO" },
+	{ GSM48_MM_EVENT_USER_PLMN_SEL,	"MM_EVENT_USER_PLMN_SEL" },
+	{ GSM48_MM_EVENT_LOST_COVERAGE,	"MM_EVENT_LOST_COVERAGE" },
+	{ 0,				NULL }
+};
+
+const char *get_mmevent_name(int value)
+{
+	return get_value_string(gsm48_mmevent_names, value);
+}
+
+/* names of MM-SAP */
+static const struct value_string gsm48_mm_msg_names[] = {
+	{ GSM48_MT_MM_IMSI_DETACH_IND,	"MT_MM_IMSI_DETACH_IND" },
+	{ GSM48_MT_MM_LOC_UPD_ACCEPT,	"MT_MM_LOC_UPD_ACCEPT" },
+	{ GSM48_MT_MM_LOC_UPD_REJECT,	"MT_MM_LOC_UPD_REJECT" },
+	{ GSM48_MT_MM_LOC_UPD_REQUEST,	"MT_MM_LOC_UPD_REQUEST" },
+	{ GSM48_MT_MM_AUTH_REJ,		"MT_MM_AUTH_REJ" },
+	{ GSM48_MT_MM_AUTH_REQ,		"MT_MM_AUTH_REQ" },
+	{ GSM48_MT_MM_AUTH_RESP,	"MT_MM_AUTH_RESP" },
+	{ GSM48_MT_MM_ID_REQ,		"MT_MM_ID_REQ" },
+	{ GSM48_MT_MM_ID_RESP,		"MT_MM_ID_RESP" },
+	{ GSM48_MT_MM_TMSI_REALL_CMD,	"MT_MM_TMSI_REALL_CMD" },
+	{ GSM48_MT_MM_TMSI_REALL_COMPL,	"MT_MM_TMSI_REALL_COMPL" },
+	{ GSM48_MT_MM_CM_SERV_ACC,	"MT_MM_CM_SERV_ACC" },
+	{ GSM48_MT_MM_CM_SERV_REJ,	"MT_MM_CM_SERV_REJ" },
+	{ GSM48_MT_MM_CM_SERV_ABORT,	"MT_MM_CM_SERV_ABORT" },
+	{ GSM48_MT_MM_CM_SERV_REQ,	"MT_MM_CM_SERV_REQ" },
+	{ GSM48_MT_MM_CM_SERV_PROMPT,	"MT_MM_CM_SERV_PROMPT" },
+	{ GSM48_MT_MM_CM_REEST_REQ,	"MT_MM_CM_REEST_REQ" },
+	{ GSM48_MT_MM_ABORT,		"MT_MM_ABORT" },
+	{ GSM48_MT_MM_NULL,		"MT_MM_NULL" },
+	{ GSM48_MT_MM_STATUS,		"MT_MM_STATUS" },
+	{ GSM48_MT_MM_INFO,		"MT_MM_INFO" },
+	{ 0,				NULL }
+};
+
+const char *get_mm_name(int value)
+{
+	return get_value_string(gsm48_mm_msg_names, value);
+}
+
+/* names of MMxx-SAP */
+static const struct value_string gsm48_mmxx_msg_names[] = {
+	{ GSM48_MMCC_EST_REQ,		"MMCC_EST_REQ" },
+	{ GSM48_MMCC_EST_IND,		"MMCC_EST_IND" },
+	{ GSM48_MMCC_EST_CNF,		"MMCC_EST_CNF" },
+	{ GSM48_MMCC_REL_REQ,		"MMCC_REL_REQ" },
+	{ GSM48_MMCC_REL_IND,		"MMCC_REL_IND" },
+	{ GSM48_MMCC_DATA_REQ,		"MMCC_DATA_REQ" },
+	{ GSM48_MMCC_DATA_IND,		"MMCC_DATA_IND" },
+	{ GSM48_MMCC_UNIT_DATA_REQ,	"MMCC_UNIT_DATA_REQ" },
+	{ GSM48_MMCC_UNIT_DATA_IND,	"MMCC_UNIT_DATA_IND" },
+	{ GSM48_MMCC_SYNC_IND,		"MMCC_SYNC_IND" },
+	{ GSM48_MMCC_REEST_REQ,		"MMCC_REEST_REQ" },
+	{ GSM48_MMCC_REEST_CNF,		"MMCC_REEST_CNF" },
+	{ GSM48_MMCC_ERR_IND,		"MMCC_ERR_IND" },
+	{ GSM48_MMCC_PROMPT_IND,	"MMCC_PROMPT_IND" },
+	{ GSM48_MMCC_PROMPT_REJ,	"MMCC_PROMPT_REJ" },
+	{ GSM48_MMSS_EST_REQ,		"MMSS_EST_REQ" },
+	{ GSM48_MMSS_EST_IND,		"MMSS_EST_IND" },
+	{ GSM48_MMSS_EST_CNF,		"MMSS_EST_CNF" },
+	{ GSM48_MMSS_REL_REQ,		"MMSS_REL_REQ" },
+	{ GSM48_MMSS_REL_IND,		"MMSS_REL_IND" },
+	{ GSM48_MMSS_DATA_REQ,		"MMSS_DATA_REQ" },
+	{ GSM48_MMSS_DATA_IND,		"MMSS_DATA_IND" },
+	{ GSM48_MMSS_UNIT_DATA_REQ,	"MMSS_UNIT_DATA_REQ" },
+	{ GSM48_MMSS_UNIT_DATA_IND,	"MMSS_UNIT_DATA_IND" },
+	{ GSM48_MMSS_REEST_REQ,		"MMSS_REEST_REQ" },
+	{ GSM48_MMSS_REEST_CNF,		"MMSS_REEST_CNF" },
+	{ GSM48_MMSS_ERR_IND,		"MMSS_ERR_IND" },
+	{ GSM48_MMSS_PROMPT_IND,	"MMSS_PROMPT_IND" },
+	{ GSM48_MMSS_PROMPT_REJ,	"MMSS_PROMPT_REJ" },
+	{ GSM48_MMSMS_EST_REQ,		"MMSMS_EST_REQ" },
+	{ GSM48_MMSMS_EST_IND,		"MMSMS_EST_IND" },
+	{ GSM48_MMSMS_EST_CNF,		"MMSMS_EST_CNF" },
+	{ GSM48_MMSMS_REL_REQ,		"MMSMS_REL_REQ" },
+	{ GSM48_MMSMS_REL_IND,		"MMSMS_REL_IND" },
+	{ GSM48_MMSMS_DATA_REQ,		"MMSMS_DATA_REQ" },
+	{ GSM48_MMSMS_DATA_IND,		"MMSMS_DATA_IND" },
+	{ GSM48_MMSMS_UNIT_DATA_REQ,	"MMSMS_UNIT_DATA_REQ" },
+	{ GSM48_MMSMS_UNIT_DATA_IND,	"MMSMS_UNIT_DATA_IND" },
+	{ GSM48_MMSMS_REEST_REQ,	"MMSMS_REEST_REQ" },
+	{ GSM48_MMSMS_REEST_CNF,	"MMSMS_REEST_CNF" },
+	{ GSM48_MMSMS_ERR_IND,		"MMSMS_ERR_IND" },
+	{ GSM48_MMSMS_PROMPT_IND,	"MMSMS_PROMPT_IND" },
+	{ GSM48_MMSMS_PROMPT_REJ,	"MMSMS_PROMPT_REJ" },
+	{ 0,				NULL }
+};
+
+const char *get_mmxx_name(int value)
+{
+	return get_value_string(gsm48_mmxx_msg_names, value);
+}
+
+/* names of MMR-SAP */
+static const struct value_string gsm48_mmr_msg_names[] = {
+	{ GSM48_MMR_REG_REQ,		"MMR_REG_REQ" },
+	{ GSM48_MMR_REG_CNF,		"MMR_REG_CNF" },
+	{ GSM48_MMR_NREG_REQ,		"MMR_NREG_REQ" },
+	{ GSM48_MMR_NREG_IND,		"MMR_NREG_IND" },
+	{ 0,				NULL }
+};
+
+const char *get_mmr_name(int value)
+{
+	return get_value_string(gsm48_mmr_msg_names, value);
+}
+
+/* allocate GSM 04.08 message (MMxx-SAP) */
+struct msgb *gsm48_mmxx_msgb_alloc(int msg_type, uint32_t ref,
+	uint8_t transaction_id, uint8_t sapi)
+{
+	struct msgb *msg;
+	struct gsm48_mmxx_hdr *mmh;
+
+	msg = msgb_alloc_headroom(MMXX_ALLOC_SIZE+MMXX_ALLOC_HEADROOM,
+		MMXX_ALLOC_HEADROOM, "GSM 04.08 MMxx");
+	if (!msg)
+		return NULL;
+
+	mmh = (struct gsm48_mmxx_hdr *)msgb_put(msg, sizeof(*mmh));
+	mmh->msg_type = msg_type;
+	mmh->ref = ref;
+	mmh->transaction_id = transaction_id;
+	mmh->sapi = sapi;
+
+	return msg;
+}
+
+/* allocate MM event message */
+struct msgb *gsm48_mmevent_msgb_alloc(int msg_type)
+{
+	struct msgb *msg;
+	struct gsm48_mm_event *mme;
+
+	msg = msgb_alloc_headroom(sizeof(*mme), 0, "GSM 04.08 MM event");
+	if (!msg)
+		return NULL;
+
+	mme = (struct gsm48_mm_event *)msgb_put(msg, sizeof(*mme));
+	mme->msg_type = msg_type;
+
+	return msg;
+}
+
+/* allocate MMR message */
+struct msgb *gsm48_mmr_msgb_alloc(int msg_type)
+{
+	struct msgb *msg;
+	struct gsm48_mmr *mmr;
+
+	msg = msgb_alloc_headroom(sizeof(*mmr), 0, "GSM 04.08 MMR");
+	if (!msg)
+		return NULL;
+
+	mmr = (struct gsm48_mmr *)msgb_put(msg, sizeof(*mmr));
+	mmr->msg_type = msg_type;
+
+	return msg;
+}
+
+/* queue message (MMxx-SAP) */
+int gsm48_mmxx_upmsg(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	msgb_enqueue(&mm->mmxx_upqueue, msg);
+
+	return 0;
+}
+
+/* queue message (MMR-SAP) */
+int gsm48_mmr_downmsg(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	msgb_enqueue(&mm->mmr_downqueue, msg);
+
+	return 0;
+}
+
+/* queue MM event message */
+int gsm48_mmevent_msg(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	msgb_enqueue(&mm->event_queue, msg);
+
+	return 0;
+}
+
+/* dequeue messages (MMxx-SAP) */
+int gsm48_mmxx_dequeue(struct osmocom_ms *ms)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct msgb *msg;
+	struct gsm48_mmxx_hdr *mmh;
+	int work = 0;
+
+	while ((msg = msgb_dequeue(&mm->mmxx_upqueue))) {
+		mmh = (struct gsm48_mmxx_hdr *) msg->data;
+		switch (mmh->msg_type & GSM48_MMXX_MASK) {
+		case GSM48_MMCC_CLASS:
+			gsm48_rcv_cc(ms, msg);
+			break;
+		case GSM48_MMSS_CLASS:
+			gsm480_rcv_ss(ms, msg);
+			break;
+		case GSM48_MMSMS_CLASS:
+			gsm411_rcv_sms(ms, msg);
+			break;
+		}
+		msgb_free(msg);
+		work = 1; /* work done */
+	}
+
+	return work;
+}
+
+/* dequeue messages (MMR-SAP) */
+int gsm48_mmr_dequeue(struct osmocom_ms *ms)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct msgb *msg;
+	int work = 0;
+
+	while ((msg = msgb_dequeue(&mm->mmr_downqueue))) {
+		gsm48_rcv_mmr(ms, msg);
+		msgb_free(msg);
+		work = 1; /* work done */
+	}
+
+	return work;
+}
+
+/* dequeue messages (RR-SAP) */
+int gsm48_rr_dequeue(struct osmocom_ms *ms)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct msgb *msg;
+	int work = 0;
+
+	while ((msg = msgb_dequeue(&mm->rr_upqueue))) {
+		/* msg is freed there */
+		gsm48_rcv_rr(ms, msg);
+		work = 1; /* work done */
+	}
+
+	return work;
+}
+
+/* dequeue MM event messages */
+int gsm48_mmevent_dequeue(struct osmocom_ms *ms)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mm_event *mme;
+	struct msgb *msg;
+	int work = 0;
+
+	while ((msg = msgb_dequeue(&mm->event_queue))) {
+		mme = (struct gsm48_mm_event *) msg->data;
+		gsm48_mm_ev(ms, mme->msg_type, msg);
+		msgb_free(msg);
+		work = 1; /* work done */
+	}
+
+	return work;
+}
+
+/* push RR header and send to RR */
+static int gsm48_mm_to_rr(struct osmocom_ms *ms, struct msgb *msg, int msg_type,
+	uint8_t sapi, uint8_t cause)
+{
+	struct gsm48_rr_hdr *rrh;
+
+	/* push RR header */
+	msgb_push(msg, sizeof(struct gsm48_rr_hdr));
+	rrh = (struct gsm48_rr_hdr *) msg->data;
+	rrh->msg_type = msg_type;
+	rrh->sapi = sapi;
+	rrh->cause = cause;
+
+	/* send message to RR */
+	return gsm48_rr_downmsg(ms, msg);
+}
+
+/*
+ * state transition
+ */
+
+const char *gsm48_mm_state_names[] = {
+	"NULL",
+	"undefined 1",
+	"undefined 2",
+	"location updating initiated",
+	"undefined 4",
+	"wait for outgoing MM connection",
+	"MM connection active",
+	"IMSI detach initiated",
+	"process CM service prompt",
+	"wait for network command",
+	"location updating reject",
+	"undefined 11",
+	"undefined 12",
+	"wait for RR connection (location updating)",
+	"wait for RR connection (MM connection)",
+	"wait for RR connection (IMSI detach)",
+	"undefined 16",
+	"wait for re-establishment",
+	"wait for RR connection active",
+	"MM idle",
+	"wait for additional outgoing MM connection",
+	"MM_CONN_ACTIVE_VGCS",
+	"WAIT_RR_CONN_VGCS",
+	"location updating pending",
+	"IMSI detach pending",
+	"RR connection release not allowed"
+};
+
+const char *gsm48_mm_substate_names[] = {
+	"NULL",
+	"normal service",
+	"attempting to update",
+	"limited service",
+	"no IMSI",
+	"no cell available",
+	"location updating needed",
+	"PLMN search",
+	"PLMN search (normal)",
+	"RX_VGCS_NORMAL",
+	"RX_VGCS_LIMITED"
+};
+
+/* change state from LOCATION UPDATE NEEDED to ATTEMPTING TO UPDATE */
+static int gsm48_mm_loc_upd_possible(struct gsm48_mmlayer *mm)
+{
+	// TODO: check if really possible
+	new_mm_state(mm, GSM48_MM_ST_MM_IDLE, GSM48_MM_SST_ATTEMPT_UPDATE);
+	return gsm48_mm_loc_upd_normal(mm->ms, NULL);
+}
+
+/* Set new MM state, also new substate in case of MM IDLE state. */
+static void new_mm_state(struct gsm48_mmlayer *mm, int state, int substate)
+{
+	struct osmocom_ms *ms = mm->ms;
+	struct gsm322_plmn *plmn = &ms->plmn;
+
+	/* IDLE -> IDLE */
+	if (mm->state == GSM48_MM_ST_MM_IDLE && state == mm->state)
+		LOGP(DMM, LOGL_INFO, "new MM IDLE state %s -> %s\n",
+			gsm48_mm_substate_names[mm->substate],
+			gsm48_mm_substate_names[substate]);
+	/* IDLE -> non-IDLE */
+	else if (mm->state == GSM48_MM_ST_MM_IDLE)
+		LOGP(DMM, LOGL_INFO, "new state MM IDLE, %s -> %s\n",
+			gsm48_mm_substate_names[mm->substate],
+			gsm48_mm_state_names[state]);
+	/* non-IDLE -> IDLE */
+	else if (state == GSM48_MM_ST_MM_IDLE)
+		LOGP(DMM, LOGL_INFO, "new state %s -> MM IDLE, %s\n",
+			gsm48_mm_state_names[mm->state],
+			gsm48_mm_substate_names[substate]);
+	/* non-IDLE -> non-IDLE */
+	else
+		LOGP(DMM, LOGL_INFO, "new state %s -> %s\n",
+			gsm48_mm_state_names[mm->state],
+			gsm48_mm_state_names[state]);
+
+	/* display service on new IDLE state */
+	if (state == GSM48_MM_ST_MM_IDLE
+	 && (mm->state != GSM48_MM_ST_MM_IDLE || mm->substate != substate)) {
+		switch (substate) {
+		case GSM48_MM_SST_NORMAL_SERVICE:
+			vty_notify(ms, NULL);
+			vty_notify(ms, "On Network, normal service: %s, %s\n",
+				gsm_get_mcc(plmn->mcc),
+				gsm_get_mnc(plmn->mcc, plmn->mnc));
+			break;
+		case GSM48_MM_SST_LIMITED_SERVICE:
+			vty_notify(ms, NULL);
+			vty_notify(ms, "Limited service, emergency calls are "
+				"possible.\n");
+			break;
+		case GSM48_MM_SST_PLMN_SEARCH_NORMAL:
+		case GSM48_MM_SST_PLMN_SEARCH:
+			vty_notify(ms, NULL);
+			vty_notify(ms, "Searching network...\n");
+			break;
+		case GSM48_MM_SST_NO_IMSI:
+			vty_notify(ms, NULL);
+			vty_notify(ms, "No SIM, emergency calls are "
+				"possible.\n");
+			break;
+		case GSM48_MM_SST_NO_CELL_AVAIL:
+			vty_notify(ms, NULL);
+			vty_notify(ms, "No service.\n");
+			break;
+		case GSM48_MM_SST_ATTEMPT_UPDATE:
+			vty_notify(ms, NULL);
+			vty_notify(ms, "Trying to registering with "
+				"network...\n");
+			break;
+		}
+	}
+
+	/* remember most recent substate */
+	if (mm->state == GSM48_MM_ST_MM_IDLE)
+		mm->mr_substate = mm->substate;
+
+	mm->state = state;
+	mm->substate = substate;
+	mobile_prim_ntfy_mm_status(ms, mm->state, mm->substate, mm->mr_substate);
+
+	/* resend detach event, if flag is set */
+	if (state == GSM48_MM_ST_MM_IDLE && mm->delay_detach) {
+		struct msgb *nmsg;
+
+		mm->delay_detach = 0;
+
+		nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_IMSI_DETACH);
+		if (!nmsg)
+			return;
+		gsm48_mmevent_msg(ms, nmsg);
+	}
+
+	/* 4.4.2 start T3212 in MM IDLE mode if not started or has expired */
+	if (state == GSM48_MM_ST_MM_IDLE
+	 && (substate == GSM48_MM_SST_NORMAL_SERVICE
+	  || substate == GSM48_MM_SST_ATTEMPT_UPDATE)) {
+		struct gsm48_sysinfo *s = &mm->ms->cellsel.sel_si;
+
+	  	/* start periodic location update timer */
+		if (s->t3212 && !osmo_timer_pending(&mm->t3212)) {
+			mm->t3212_value = s->t3212;
+			start_mm_t3212(mm, mm->t3212_value);
+		}
+		/* perform pending location update */
+		if (mm->lupd_retry) {
+			LOGP(DMM, LOGL_INFO, "Loc. upd. pending (type %d)\n",
+				mm->lupd_type);
+			mm->lupd_retry = 0;
+			gsm48_mm_loc_upd(ms, NULL);
+			/* must exit, because this function can be called
+			 * recursively
+			 */
+			return;
+		}
+		if (mm->lupd_periodic) {
+			LOGP(DMM, LOGL_INFO, "Periodic loc. upd. pending "
+				"(type %d)\n", mm->lupd_type);
+			mm->lupd_periodic = 0;
+			if (s->t3212) /* still required? */
+				gsm48_mm_loc_upd_periodic(ms, NULL);
+			else
+				LOGP(DMM, LOGL_INFO, "but not requred\n");
+			/* must exit, because this function can be called
+			 * recursively
+			 */
+			return;
+		}
+	}
+
+	/* check if location update is possible */
+	if (state == GSM48_MM_ST_MM_IDLE
+	 && substate == GSM48_MM_SST_LOC_UPD_NEEDED) {
+		gsm48_mm_loc_upd_possible(mm);
+		/* must exit, because this function can be called recursively */
+		return;
+	}
+}
+
+/* return PLMN SEARCH or PLMN SEARCH NORMAL state */
+static int gsm48_mm_set_plmn_search(struct osmocom_ms *ms)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+
+	/* SIM not inserted */
+	if (!subscr->sim_valid) {
+		LOGP(DMM, LOGL_INFO, "Selecting PLMN SEARCH state, because "
+			"no SIM.\n");
+		return GSM48_MM_SST_PLMN_SEARCH;
+	}
+
+	/* SIM not updated */
+	if (subscr->ustate != GSM_SIM_U1_UPDATED) {
+		LOGP(DMM, LOGL_INFO, "Selecting PLMN SEARCH state, because "
+			"SIM not updated.\n");
+		return GSM48_MM_SST_PLMN_SEARCH;
+	}
+	if (subscr->lac == 0x0000 || subscr->lac >= 0xfffe) {
+		LOGP(DMM, LOGL_INFO, "Selecting PLMN SEARCH state, because "
+			"LAI in SIM not valid.\n");
+		return GSM48_MM_SST_PLMN_SEARCH;
+	}
+
+	/* no cell selected */
+	if (!cs->selected) {
+		LOGP(DMM, LOGL_INFO, "Selecting PLMN SEARCH state, because "
+			"no cell selected.\n");
+		return GSM48_MM_SST_PLMN_SEARCH;
+	}
+
+	/* selected cell's LAI not equal to LAI stored on the sim */
+	if (cs->sel_mcc != subscr->mcc
+	 || cs->sel_mnc != subscr->mnc
+	 || cs->sel_lac != subscr->lac) {
+		LOGP(DMM, LOGL_INFO, "Selecting PLMN SEARCH state, because "
+			"LAI of selected cell (MCC %s MNC %s LAC 0x%04x) "
+			"!= LAI in SIM (MCC %s MNC %s LAC 0x%04x).\n",
+			gsm_print_mcc(cs->sel_mcc), gsm_print_mnc(cs->sel_mnc),
+			cs->sel_lac, gsm_print_mcc(subscr->mcc),
+			gsm_print_mnc(subscr->mnc), subscr->lac);
+		return GSM48_MM_SST_PLMN_SEARCH;
+	}
+
+	/* SIM is updated in this LA */
+	LOGP(DMM, LOGL_INFO, "Selecting PLMN SEARCH NORMAL state.\n");
+	return GSM48_MM_SST_PLMN_SEARCH_NORMAL;
+}
+
+/* 4.2.3 when returning to MM IDLE state, this function is called */
+static int gsm48_mm_return_idle(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = &cs->sel_si;
+
+	if (cs->state != GSM322_C3_CAMPED_NORMALLY
+	 && cs->state != GSM322_C7_CAMPED_ANY_CELL) {
+		LOGP(DMM, LOGL_INFO, "Not camping, wait for CS process to "
+			"camp, it sends us CELL_SELECTED then.\n");
+		return 0;
+	}
+
+	/* 4.4.4.9 start T3211 when RR is released */
+	if (mm->start_t3211) {
+		LOGP(DMM, LOGL_INFO, "Starting T3211 after RR release.\n");
+		mm->start_t3211 = 0;
+		start_mm_t3211(mm);
+	}
+
+	/* return from location update with "Roaming not allowed" */
+	if (mm->state == GSM48_MM_ST_LOC_UPD_REJ && mm->lupd_rej_cause == 13) {
+		LOGP(DMM, LOGL_INFO, "Roaming not allowed as returning to "
+			"MM IDLE\n");
+		new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+			gsm48_mm_set_plmn_search(ms));
+
+		return 0;
+	}
+
+	/* no SIM present or invalid */
+	if (!subscr->sim_valid) {
+		LOGP(DMM, LOGL_INFO, "SIM invalid as returning to MM IDLE\n");
+
+		/* stop periodic location updating */
+		mm->lupd_pending = 0;
+		stop_mm_t3212(mm); /* 4.4.2 */
+
+		new_mm_state(mm, GSM48_MM_ST_MM_IDLE, GSM48_MM_SST_NO_IMSI);
+
+		return 0;
+	}
+
+	/* if we are attached and selected cell equals the registered LAI */
+	if (subscr->imsi_attached
+	 && subscr->lac /* valid */
+	 && cs->sel_mcc == subscr->mcc
+	 && cs->sel_mnc == subscr->mnc
+	 && cs->sel_lac == subscr->lac) {
+		LOGP(DMM, LOGL_INFO, "We are in registered LAI as returning "
+			"to MM IDLE\n");
+		/* if SIM not updated (abnormal case as described in 4.4.4.9) */
+		if (subscr->ustate != GSM_SIM_U1_UPDATED)
+			new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+				GSM48_MM_SST_ATTEMPT_UPDATE);
+		else
+			new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+				GSM48_MM_SST_NORMAL_SERVICE);
+
+		return 0;
+	}
+
+	if (cs->state == GSM322_C3_CAMPED_NORMALLY) {
+		LOGP(DMM, LOGL_INFO, "We are camping normally as returning to "
+			"MM IDLE\n");
+		if (gsm_subscr_is_forbidden_plmn(subscr, cs->sel_mcc,
+				cs->sel_mnc)) {
+			/* location update not allowed */
+			LOGP(DMM, LOGL_INFO, "Loc. upd. not allowed PLMN.\n");
+			new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+				GSM48_MM_SST_LIMITED_SERVICE);
+		} else
+		if (gsm322_is_forbidden_la(ms, cs->sel_mcc, cs->sel_mnc,
+				cs->sel_lac)) {
+			/* location update not allowed */
+			LOGP(DMM, LOGL_INFO, "Loc. upd. not allowed LA.\n");
+			new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+				GSM48_MM_SST_LIMITED_SERVICE);
+		} else
+		/* 4.4.4.9 if cell is barred, don't start */
+		if ((!subscr->acc_barr && s->cell_barr)
+		 || (!subscr->acc_barr && !((subscr->acc_class & 0xfbff) &
+					(s->class_barr ^ 0xffff)))) {
+			LOGP(DMM, LOGL_INFO, "Loc. upd. no access.\n");
+			new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+				GSM48_MM_SST_LIMITED_SERVICE);
+		} else {
+			/* location update allowed */
+			LOGP(DMM, LOGL_INFO, "Loc. upd. allowed.\n");
+			new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+				GSM48_MM_SST_LOC_UPD_NEEDED);
+		}
+	} else {
+		/* location update not allowed */
+		LOGP(DMM, LOGL_INFO, "We are camping on any cell as returning "
+			"to MM IDLE\n");
+		new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+			GSM48_MM_SST_LIMITED_SERVICE);
+	}
+
+	return 0;
+}
+
+/* 4.2.1.1 Service state PLMN SEARCH (NORMAL) is left if no cell found */
+static int gsm48_mm_no_cell_found(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	new_mm_state(mm, GSM48_MM_ST_MM_IDLE, GSM48_MM_SST_NO_CELL_AVAIL);
+
+	return 0;
+}
+
+/* 4.2.1.1 Service state PLMN SEARCH (NORMAL) / NO CELL AVAILABLE is left
+ * if cell selected
+ */
+static int gsm48_mm_cell_selected(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm322_plmn *plmn = &ms->plmn;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = &cs->sel_si;
+	struct gsm_settings *set = &ms->settings;
+
+	/* no SIM is inserted */
+	if (!subscr->sim_valid) {
+		LOGP(DMM, LOGL_INFO, "SIM invalid as cell is selected.\n");
+		new_mm_state(mm, GSM48_MM_ST_MM_IDLE, GSM48_MM_SST_NO_IMSI);
+
+		return 0;
+	}
+
+	/* SIM not updated in this LA */
+	if (subscr->ustate == GSM_SIM_U1_UPDATED
+	 && subscr->lac /* valid */
+	 && cs->sel_mcc == subscr->mcc
+	 && cs->sel_mnc == subscr->mnc
+	 && cs->sel_lac == subscr->lac
+	 && !mm->lupd_periodic) {
+		if (subscr->imsi_attached) {
+			struct msgb *nmsg;
+
+			LOGP(DMM, LOGL_INFO, "Valid in location area.\n");
+			new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+				GSM48_MM_SST_NORMAL_SERVICE);
+
+			/* send message to PLMN search process */
+			nmsg = gsm322_msgb_alloc(GSM322_EVENT_REG_SUCCESS);
+			if (!nmsg)
+				return -ENOMEM;
+			gsm322_plmn_sendmsg(ms, nmsg);
+
+			return 0;
+		}
+		if (!s->att_allowed) {
+			struct msgb *nmsg;
+
+			LOGP(DMM, LOGL_INFO, "Attachment not required.\n");
+			new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+				GSM48_MM_SST_NORMAL_SERVICE);
+
+			/* send message to PLMN search process */
+			nmsg = gsm322_msgb_alloc(GSM322_EVENT_REG_SUCCESS);
+			if (!nmsg)
+				return -ENOMEM;
+			gsm322_plmn_sendmsg(ms, nmsg);
+
+			return 0;
+		}
+		/* else, continue */
+	}
+
+	/* PLMN mode auto and selected cell is forbidden */
+	if (set->plmn_mode == PLMN_MODE_AUTO
+	 && (!cs->selected
+	  || gsm_subscr_is_forbidden_plmn(subscr, cs->sel_mcc, cs->sel_mnc)
+	  || gsm322_is_forbidden_la(ms, cs->sel_mcc, cs->sel_mnc,
+	 	cs->sel_lac))) {
+		struct msgb *nmsg;
+
+		LOGP(DMM, LOGL_INFO, "Selected cell is forbidden.\n");
+		new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+			GSM48_MM_SST_LIMITED_SERVICE);
+
+		/* send message to PLMN search process */
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_REG_FAILED);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_plmn_sendmsg(ms, nmsg);
+
+		return 0;
+	}
+
+	/* PLMN mode manual and selected cell not selected PLMN.
+	 * in M3 state the PLMN is not selected for registration. */
+	if (set->plmn_mode == PLMN_MODE_MANUAL
+	 && (!cs->selected
+	  || plmn->mcc != cs->sel_mcc
+	  || plmn->mnc != cs->sel_mnc
+	  || plmn->state == GSM322_M3_NOT_ON_PLMN)) {
+		struct msgb *nmsg;
+
+		LOGP(DMM, LOGL_INFO, "Selected cell not found.\n");
+		new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+			GSM48_MM_SST_LIMITED_SERVICE);
+
+		/* send message to PLMN search process */
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_REG_FAILED);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_plmn_sendmsg(ms, nmsg);
+
+		return 0;
+	}
+
+	/* other cases */
+	new_mm_state(mm, GSM48_MM_ST_MM_IDLE, GSM48_MM_SST_LOC_UPD_NEEDED);
+
+	return 0;
+}
+
+/* 4.2.1.2 Service state PLMN SEARCH (NORMAL) is entered */
+static int gsm48_mm_plmn_search(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	new_mm_state(mm, GSM48_MM_ST_MM_IDLE, gsm48_mm_set_plmn_search(ms));
+
+	return 0;
+}
+
+/*
+ * init and exit
+ */
+
+/* initialize Mobility Management process */
+int gsm48_mm_init(struct osmocom_ms *ms)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	memset(mm, 0, sizeof(*mm));
+	mm->ms = ms;
+
+	LOGP(DMM, LOGL_INFO, "init Mobility Management process\n");
+
+	/* 4.2.1.1 */
+	mm->state = GSM48_MM_ST_MM_IDLE;
+	mm->substate = gsm48_mm_set_plmn_search(ms);
+
+	/* init lists */
+	INIT_LLIST_HEAD(&mm->mm_conn);
+	INIT_LLIST_HEAD(&mm->rr_upqueue);
+	INIT_LLIST_HEAD(&mm->mmxx_upqueue);
+	INIT_LLIST_HEAD(&mm->mmr_downqueue);
+	INIT_LLIST_HEAD(&mm->event_queue);
+
+	return 0;
+}
+
+/* exit MM process */
+int gsm48_mm_exit(struct osmocom_ms *ms)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mm_conn *conn;
+	struct msgb *msg;
+
+	LOGP(DMM, LOGL_INFO, "exit Mobility Management process\n");
+
+	/* flush lists */
+	while (!llist_empty(&mm->mm_conn)) {
+		conn = llist_entry(mm->mm_conn.next,
+			struct gsm48_mm_conn, list);
+		mm_conn_free(conn);
+	}
+	while ((msg = msgb_dequeue(&mm->rr_upqueue)))
+		msgb_free(msg);
+	while ((msg = msgb_dequeue(&mm->mmxx_upqueue)))
+		msgb_free(msg);
+	while ((msg = msgb_dequeue(&mm->mmr_downqueue)))
+		msgb_free(msg);
+	while ((msg = msgb_dequeue(&mm->event_queue)))
+		msgb_free(msg);
+
+	/* stop timers */
+	stop_mm_t3210(mm);
+	stop_mm_t3211(mm);
+	stop_mm_t3212(mm);
+	stop_mm_t3213(mm);
+	stop_mm_t3220(mm);
+	stop_mm_t3230(mm);
+	stop_mm_t3240(mm);
+
+	return 0;
+}
+
+/*
+ * MM connection management
+ */
+
+static const char *gsm48_mmxx_state_names[] = {
+	"IDLE",
+	"CONN_PEND",
+	"DEDICATED",
+	"CONN_SUSP",
+	"REESTPEND"
+};
+
+uint32_t mm_conn_new_ref = 0x80000001;
+
+/* new MM connection state */
+static void new_conn_state(struct gsm48_mm_conn *conn, int state)
+{
+	LOGP(DMM, LOGL_INFO, "(ref %x) new state %s -> %s\n", conn->ref,
+		gsm48_mmxx_state_names[conn->state],
+		gsm48_mmxx_state_names[state]);
+	conn->state = state;
+}
+
+/* find MM connection by protocol+ID */
+struct gsm48_mm_conn *mm_conn_by_id(struct gsm48_mmlayer *mm,
+				   uint8_t proto, uint8_t transaction_id)
+{
+	struct gsm48_mm_conn *conn;
+
+	llist_for_each_entry(conn, &mm->mm_conn, list) {
+		if (conn->protocol == proto &&
+		    conn->transaction_id == transaction_id)
+			return conn;
+	}
+	return NULL;
+}
+
+/* find MM connection by reference */
+struct gsm48_mm_conn *mm_conn_by_ref(struct gsm48_mmlayer *mm,
+					uint32_t ref)
+{
+	struct gsm48_mm_conn *conn;
+
+	llist_for_each_entry(conn, &mm->mm_conn, list) {
+		if (conn->ref == ref)
+			return conn;
+	}
+	return NULL;
+}
+
+/* create MM connection instance */
+static struct gsm48_mm_conn* mm_conn_new(struct gsm48_mmlayer *mm,
+	int proto, uint8_t transaction_id, uint8_t sapi, uint32_t ref)
+{
+	struct gsm48_mm_conn *conn = talloc_zero(l23_ctx, struct gsm48_mm_conn);
+
+	if (!conn)
+		return NULL;
+
+	LOGP(DMM, LOGL_INFO, "New MM Connection (proto 0x%02x trans_id %d "
+		"sapi %d ref %x)\n", proto, transaction_id, sapi, ref);
+
+	conn->mm = mm;
+	conn->state = GSM48_MMXX_ST_IDLE;
+	conn->transaction_id = transaction_id;
+	conn->protocol = proto;
+	conn->sapi = sapi;
+	conn->ref = ref;
+
+	llist_add(&conn->list, &mm->mm_conn);
+
+	return conn;
+}
+
+/* destroy MM connection instance */
+void mm_conn_free(struct gsm48_mm_conn *conn)
+{
+	LOGP(DMM, LOGL_INFO, "Freeing MM Connection\n");
+
+	new_conn_state(conn, GSM48_MMXX_ST_IDLE);
+
+	llist_del(&conn->list);
+
+	talloc_free(conn);
+}
+
+/* support function to release pending/all ongoing MM connections */
+static int gsm48_mm_release_mm_conn(struct osmocom_ms *ms, int abort_any,
+				    uint8_t cause, int error, uint8_t sapi)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mm_conn *conn, *conn2;
+	struct msgb *nmsg;
+	struct gsm48_mmxx_hdr *nmmh;
+
+	/* Note: For SAPI 0 all connections are released */
+
+	if (abort_any)
+		LOGP(DMM, LOGL_INFO, "Release any MM Connection "
+			"(sapi = %d)\n", sapi);
+	else
+		LOGP(DMM, LOGL_INFO, "Release pending MM Connections "
+			"(sapi = %d)\n", sapi);
+
+	/* release MM connection(s) */
+	llist_for_each_entry_safe(conn, conn2, &mm->mm_conn, list) {
+		/* abort any OR the pending connection */
+		if ((abort_any || conn->state == GSM48_MMXX_ST_CONN_PEND)
+		 && (sapi == conn->sapi || sapi == 0)) {
+			/* send MMxx-REL-IND */
+			nmsg = NULL;
+			switch(conn->protocol) {
+			case GSM48_PDISC_CC:
+				nmsg = gsm48_mmxx_msgb_alloc(
+					error ? GSM48_MMCC_ERR_IND
+					: GSM48_MMCC_REL_IND, conn->ref,
+						conn->transaction_id,
+						conn->sapi);
+				break;
+			case GSM48_PDISC_NC_SS:
+				nmsg = gsm48_mmxx_msgb_alloc(
+					error ? GSM48_MMSS_ERR_IND
+					: GSM48_MMSS_REL_IND, conn->ref,
+						conn->transaction_id,
+						conn->sapi);
+				break;
+			case GSM48_PDISC_SMS:
+				nmsg = gsm48_mmxx_msgb_alloc(
+					error ? GSM48_MMSMS_ERR_IND
+					: GSM48_MMSMS_REL_IND, conn->ref,
+						conn->transaction_id,
+						conn->sapi);
+				break;
+			}
+			if (!nmsg) {
+				/* this should not happen */
+				mm_conn_free(conn);
+				continue; /* skip if not of CC type */
+			}
+			nmmh = (struct gsm48_mmxx_hdr *)nmsg->data;
+			nmmh->cause = cause;
+			gsm48_mmxx_upmsg(ms, nmsg);
+
+			mm_conn_free(conn);
+		}
+	}
+	return 0;
+}
+
+/*
+ * process handlers (Common procedures)
+ */
+
+/* sending MM STATUS message */
+static int gsm48_mm_tx_mm_status(struct osmocom_ms *ms, uint8_t cause)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *ngh;
+	uint8_t *reject_cause;
+
+	LOGP(DMM, LOGL_INFO, "MM STATUS (cause #%d)\n", cause);
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	ngh = (struct gsm48_hdr *)msgb_put(nmsg, sizeof(*ngh));
+	reject_cause = msgb_put(nmsg, 1);
+
+	ngh->proto_discr = GSM48_PDISC_MM;
+	ngh->msg_type = GSM48_MT_MM_STATUS;
+	*reject_cause = cause;
+
+	/* push RR header and send down */
+	return gsm48_mm_to_rr(ms, nmsg, GSM48_RR_DATA_REQ, 0, 0);
+}
+
+/* 4.3.1.2 sending TMSI REALLOCATION COMPLETE message */
+static int gsm48_mm_tx_tmsi_reall_cpl(struct osmocom_ms *ms)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *ngh;
+
+	LOGP(DMM, LOGL_INFO, "TMSI REALLOCATION COMPLETE\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	ngh = (struct gsm48_hdr *)msgb_put(nmsg, sizeof(*ngh));
+
+	ngh->proto_discr = GSM48_PDISC_MM;
+	ngh->msg_type = GSM48_MT_MM_TMSI_REALL_COMPL;
+
+	/* push RR header and send down */
+	return gsm48_mm_to_rr(ms, nmsg, GSM48_RR_DATA_REQ, 0, 0);
+}
+
+/* 4.3.1 TMSI REALLOCATION COMMAND is received */
+static int gsm48_mm_rx_tmsi_realloc_cmd(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct gsm48_loc_area_id *lai = (struct gsm48_loc_area_id *) gh->data;
+	uint8_t mi_type, *mi;
+	uint32_t tmsi;
+
+	if (payload_len < sizeof(struct gsm48_loc_area_id) + 2) {
+		short_read:
+		LOGP(DMM, LOGL_NOTICE, "Short read of TMSI REALLOCATION "
+			"COMMAND message error.\n");
+		return -EINVAL;
+	}
+	/* LAI */
+	gsm48_decode_lai_hex(lai, &subscr->mcc, &subscr->mnc, &subscr->lac);
+	/* MI */
+	mi = gh->data + sizeof(struct gsm48_loc_area_id);
+	mi_type = mi[1] & GSM_MI_TYPE_MASK;
+	switch (mi_type) {
+	case GSM_MI_TYPE_TMSI:
+		if (payload_len + sizeof(struct gsm48_loc_area_id) < 6
+		 || mi[0] < 5)
+			goto short_read;
+		memcpy(&tmsi, mi+2, 4);
+		subscr->tmsi = ntohl(tmsi);
+		LOGP(DMM, LOGL_INFO, "TMSI 0x%08x (%u) assigned.\n",
+			subscr->tmsi, subscr->tmsi);
+		gsm48_mm_tx_tmsi_reall_cpl(ms);
+		break;
+	case GSM_MI_TYPE_IMSI:
+		subscr->tmsi = 0xffffffff;
+		LOGP(DMM, LOGL_INFO, "TMSI removed.\n");
+		gsm48_mm_tx_tmsi_reall_cpl(ms);
+		break;
+	default:
+		subscr->tmsi = 0xffffffff;
+		LOGP(DMM, LOGL_NOTICE, "TMSI reallocation with unknown MI "
+			"type %d.\n", mi_type);
+		gsm48_mm_tx_mm_status(ms, GSM48_REJECT_INCORRECT_MESSAGE);
+	}
+
+	/* store LOCI on sim */
+	gsm_subscr_write_loci(ms);
+
+	return 0;
+}
+
+/* 4.3.2.2 AUTHENTICATION REQUEST is received */
+static int gsm48_mm_rx_auth_req(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct gsm48_auth_req *ar = (struct gsm48_auth_req *) gh->data;
+	uint8_t no_sim = 0;
+
+	if (payload_len < sizeof(struct gsm48_auth_req)) {
+		LOGP(DMM, LOGL_NOTICE, "Short read of AUTHENTICATION REQUEST "
+			"message error.\n");
+		return -EINVAL;
+	}
+
+	/* SIM is not available */
+	if (!subscr->sim_valid) {
+		LOGP(DMM, LOGL_INFO, "AUTHENTICATION REQUEST without SIM\n");
+		return gsm48_mm_tx_mm_status(ms,
+			GSM48_REJECT_MSG_NOT_COMPATIBLE);
+	}
+
+	LOGP(DMM, LOGL_INFO, "AUTHENTICATION REQUEST (seq %d)\n", ar->key_seq);
+
+	/* key_seq and random
+	 * in case of test card, there is a dummy response.
+	 * authentication request is possible during emergency call, if
+	 * IMSI is known to the network. in case of emergency IMSI, we need to
+	 * send a dummy response also.
+	 */
+	if (mm->est_cause == RR_EST_CAUSE_EMERGENCY && set->emergency_imsi[0])
+		no_sim = 1;
+	gsm_subscr_generate_kc(ms, ar->key_seq, ar->rand, no_sim);
+
+	/* wait for auth response event from SIM */
+	return 0;
+}
+
+/* 4.3.2.2 sending AUTHENTICATION RESPONSE */
+static int gsm48_mm_tx_auth_rsp(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mm_event *mme = (struct gsm48_mm_event *) msg->data;
+	struct msgb *nmsg;
+	struct gsm48_hdr *ngh;
+	uint8_t *sres;
+
+	LOGP(DMM, LOGL_INFO, "AUTHENTICATION RESPONSE\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	ngh = (struct gsm48_hdr *)msgb_put(nmsg, sizeof(*ngh));
+
+	ngh->proto_discr = GSM48_PDISC_MM;
+	ngh->msg_type = GSM48_MT_MM_AUTH_RESP;
+
+	/* SRES */
+	sres = msgb_put(nmsg, 4);
+	memcpy(sres, mme->sres, 4);
+
+	/* push RR header and send down */
+	return gsm48_mm_to_rr(ms, nmsg, GSM48_RR_DATA_REQ, 0, 0);
+}
+
+/* 4.3.2.5 AUTHENTICATION REJECT is received */
+static int gsm48_mm_rx_auth_rej(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	LOGP(DMM, LOGL_INFO, "AUTHENTICATION REJECT\n");
+
+	stop_mm_t3212(mm); /* 4.4.2 */
+
+	/* SIM invalid */
+	subscr->sim_valid = 0;
+
+	/* TMSI and LAI invalid */
+	subscr->tmsi = 0xffffffff;
+	subscr->lac = 0x0000;
+
+	/* key is invalid */
+	subscr->key_seq = 7;
+
+	/* update status */
+	new_sim_ustate(subscr, GSM_SIM_U3_ROAMING_NA);
+
+	/* store LOCI on sim */
+	gsm_subscr_write_loci(ms);
+
+	/* abort IMSI detach procedure */
+	if (mm->state == GSM48_MM_ST_IMSI_DETACH_INIT) {
+		struct msgb *nmsg;
+		struct gsm48_rr_hdr *nrrh;
+
+		/* abort RR connection */
+		nmsg = gsm48_rr_msgb_alloc(GSM48_RR_ABORT_REQ);
+		if (!nmsg)
+			return -ENOMEM;
+		nrrh = (struct gsm48_rr_hdr *) nmsg->data;
+		nrrh->cause = GSM48_RR_CAUSE_NORMAL;
+		gsm48_rr_downmsg(ms, nmsg);
+
+		/* return to MM IDLE */
+		return gsm48_mm_return_idle(ms, NULL);
+	}
+
+	return 0;
+}
+
+/* 4.3.3.1 IDENTITY REQUEST is received */
+static int gsm48_mm_rx_id_req(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	uint8_t mi_type;
+
+	if (payload_len < 1) {
+		LOGP(DMM, LOGL_NOTICE, "Short read of IDENTITY REQUEST message "
+			"error.\n");
+		return -EINVAL;
+	}
+
+	/* id type */
+	mi_type = *gh->data;
+	LOGP(DMM, LOGL_INFO, "IDENTITY REQUEST (mi_type %d)\n", mi_type);
+
+	/* check if request can be fulfilled */
+	if (!subscr->sim_valid && mi_type != GSM_MI_TYPE_IMEI
+	 && mi_type != GSM_MI_TYPE_IMEISV) {
+		LOGP(DMM, LOGL_INFO, "IDENTITY REQUEST without SIM\n");
+		return gsm48_mm_tx_mm_status(ms,
+			GSM48_REJECT_MSG_NOT_COMPATIBLE);
+	}
+	if (mi_type == GSM_MI_TYPE_TMSI && subscr->tmsi == 0xffffffff) {
+		LOGP(DMM, LOGL_INFO, "IDENTITY REQUEST of TMSI, but we have no "
+			"TMSI\n");
+		return gsm48_mm_tx_mm_status(ms,
+			GSM48_REJECT_MSG_NOT_COMPATIBLE);
+	}
+
+	return gsm48_mm_tx_id_rsp(ms, mi_type);
+}
+
+/* send IDENTITY RESPONSE message */
+static int gsm48_mm_tx_id_rsp(struct osmocom_ms *ms, uint8_t mi_type)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *ngh;
+	uint8_t buf[11];
+
+	LOGP(DMM, LOGL_INFO, "IDENTITY RESPONSE\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	ngh = (struct gsm48_hdr *)msgb_put(nmsg, sizeof(*ngh));
+
+	ngh->proto_discr = GSM48_PDISC_MM;
+	ngh->msg_type = GSM48_MT_MM_ID_RESP;
+
+	/* MI */
+	gsm48_encode_mi(buf, nmsg, ms, mi_type);
+
+	/* push RR header and send down */
+	return gsm48_mm_to_rr(ms, nmsg, GSM48_RR_DATA_REQ, 0, 0);
+}
+
+/* 4.3.4.1 sending IMSI DETACH INDICATION message */
+static int gsm48_mm_tx_imsi_detach(struct osmocom_ms *ms, int rr_prim)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm_support *sup = &ms->support;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct msgb *nmsg;
+	struct gsm48_hdr *ngh;
+	uint8_t pwr_lev;
+	uint8_t buf[11];
+	struct gsm48_classmark1 cm;
+
+
+	LOGP(DMM, LOGL_INFO, "IMSI DETACH INDICATION\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	ngh = (struct gsm48_hdr *)msgb_put(nmsg, sizeof(*ngh));
+
+	ngh->proto_discr = GSM48_PDISC_MM;
+	ngh->msg_type = GSM48_MT_MM_IMSI_DETACH_IND;
+
+	/* classmark 1 */
+	if (rr_prim == GSM48_RR_EST_REQ)
+		pwr_lev = gsm48_current_pwr_lev(set, cs->sel_arfcn);
+	else
+		pwr_lev = gsm48_current_pwr_lev(set, rr->cd_now.arfcn);
+	gsm48_encode_classmark1(&cm, sup->rev_lev, sup->es_ind, set->a5_1,
+		pwr_lev);
+        msgb_v_put(nmsg, *((uint8_t *)&cm));
+	/* MI */
+	if (subscr->tmsi != 0xffffffff) { /* have TMSI ? */
+		gsm48_encode_mi(buf, nmsg, ms, GSM_MI_TYPE_TMSI);
+		LOGP(DMM, LOGL_INFO, " using TMSI 0x%08x\n", subscr->tmsi);
+	} else {
+		gsm48_encode_mi(buf, nmsg, ms, GSM_MI_TYPE_IMSI);
+		LOGP(DMM, LOGL_INFO, " using IMSI %s\n", subscr->imsi);
+	}
+
+	/* push RR header and send down */
+	mm->est_cause = RR_EST_CAUSE_OTHER_SDCCH;
+	return gsm48_mm_to_rr(ms, nmsg, rr_prim, 0, mm->est_cause);
+}
+
+/* detach has ended */
+static int gsm48_mm_imsi_detach_end(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+
+	LOGP(DMM, LOGL_INFO, "IMSI has been detached.\n");
+
+	/* stop IMSI detach timer (if running) */
+	stop_mm_t3220(mm);
+
+	/* SIM invalid */
+	subscr->sim_valid = 0;
+
+	/* wait for RR idle and then power off when IMSI is detached */
+	if (ms->shutdown != MS_SHUTDOWN_NONE) {
+		if (mm->state == GSM48_MM_ST_MM_IDLE) {
+			mobile_exit(ms, 1);
+			return 0;
+		}
+		/* power off when MM idle */
+		mm->power_off_idle = 1;
+
+		/* return to MM IDLE */
+		return gsm48_mm_return_idle(ms, NULL);
+	}
+
+	/* send SIM remove event to gsm322 */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_SIM_REMOVE);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_plmn_sendmsg(ms, nmsg);
+
+	/* return to MM IDLE */
+	return gsm48_mm_return_idle(ms, NULL);
+}
+
+/* abort radio connection */
+static int gsm48_mm_imsi_detach_abort(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+
+	/* abort RR if timer fired */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_ABORT_REQ);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *) nmsg->data;
+	nrrh->cause = GSM48_RR_CAUSE_NORMAL;
+	gsm48_rr_downmsg(ms, nmsg);
+
+	/* imsi detach has ended now */
+	return gsm48_mm_imsi_detach_end(ms, msg);
+}
+
+/* start an IMSI detach in MM IDLE */
+static int gsm48_mm_imsi_detach_start(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_sysinfo *s = &ms->cellsel.sel_si;
+
+	/* we may silently finish IMSI detach */
+	if (!s->att_allowed || !subscr->imsi_attached) {
+		LOGP(DMM, LOGL_INFO, "IMSI detach not required.\n");
+
+		return gsm48_mm_imsi_detach_end(ms, msg);
+	}
+	LOGP(DMM, LOGL_INFO, "IMSI detach started (MM IDLE)\n");
+
+	new_mm_state(mm, GSM48_MM_ST_WAIT_RR_CONN_IMSI_D, 0);
+
+	/* establish RR and send IMSI detach */
+	return gsm48_mm_tx_imsi_detach(ms, GSM48_RR_EST_REQ);
+}
+
+/* IMSI detach has been sent, wait for RR release */
+static int gsm48_mm_imsi_detach_sent(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	/* start T3220 (4.3.4.1) */
+	start_mm_t3220(mm);
+
+	LOGP(DMM, LOGL_INFO, "IMSI detach started (Wait for RR release)\n");
+
+	new_mm_state(mm, GSM48_MM_ST_IMSI_DETACH_INIT, 0);
+
+	return 0;
+}
+
+/* release MM connection and proceed with IMSI detach */
+static int gsm48_mm_imsi_detach_release(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_sysinfo *s = &ms->cellsel.sel_si;
+
+	/* stop MM connection timer */
+	stop_mm_t3230(mm);
+
+	/* release all connections */
+	gsm48_mm_release_mm_conn(ms, 1, 16, 0, 0);
+
+	/* wait for release of RR */
+	if (!s->att_allowed || !subscr->imsi_attached) {
+		LOGP(DMM, LOGL_INFO, "IMSI detach not required.\n");
+		new_mm_state(mm, GSM48_MM_ST_WAIT_NETWORK_CMD, 0);
+
+		/* power off */
+		if (ms->shutdown != MS_SHUTDOWN_NONE) {
+			mobile_exit(ms, 1);
+			return 0;
+		}
+
+		return 0;
+	}
+
+	/* send IMSI detach */
+	gsm48_mm_tx_imsi_detach(ms, GSM48_RR_DATA_REQ);
+
+	/* go to sent state */
+	return gsm48_mm_imsi_detach_sent(ms, msg);
+}
+
+/* ignore ongoing IMSI detach */
+static int gsm48_mm_imsi_detach_ignore(struct osmocom_ms *ms, struct msgb *msg)
+{
+	return 0;
+}
+
+/* delay until state change (and then retry) */
+static int gsm48_mm_imsi_detach_delay(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	LOGP(DMM, LOGL_INFO, "IMSI detach delayed.\n");
+
+	/* remember to detach later */
+	mm->delay_detach = 1;
+
+	return 0;
+}
+
+/* 4.3.5.2 ABORT is received */
+static int gsm48_mm_rx_abort(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	uint8_t reject_cause;
+
+	if (payload_len < 1) {
+		LOGP(DMM, LOGL_NOTICE, "Short read of ABORT message error.\n");
+		return -EINVAL;
+	}
+
+	reject_cause = *gh->data;
+
+	if (llist_empty(&mm->mm_conn)) {
+		LOGP(DMM, LOGL_NOTICE, "ABORT (cause #%d) while no MM "
+			"connection is established.\n", reject_cause);
+		return gsm48_mm_tx_mm_status(ms,
+			GSM48_REJECT_MSG_NOT_COMPATIBLE);
+	} else {
+		LOGP(DMM, LOGL_NOTICE, "ABORT (cause #%d) while MM connection "
+			"is established.\n", reject_cause);
+		/* stop MM connection timer */
+		stop_mm_t3230(mm);
+
+		gsm48_mm_release_mm_conn(ms, 1, 16, 0, 0);
+	}
+
+	if (reject_cause == GSM48_REJECT_ILLEGAL_ME) {
+		/* SIM invalid */
+		subscr->sim_valid = 0;
+
+		/* TMSI and LAI invalid */
+		subscr->tmsi = 0xffffffff;
+		subscr->lac = 0x0000;
+
+		/* key is invalid */
+		subscr->key_seq = 7;
+
+		/* update status */
+		new_sim_ustate(subscr, GSM_SIM_U3_ROAMING_NA);
+
+		/* store LOCI on sim */
+		gsm_subscr_write_loci(ms);
+
+		/* return to MM IDLE */
+		return gsm48_mm_return_idle(ms, NULL);
+	}
+
+	return 0;
+}
+
+/* 4.3.6.2 MM INFORMATION is received */
+static int gsm48_mm_rx_info(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+
+	if (payload_len < 0) {
+		LOGP(DMM, LOGL_NOTICE, "Short read of MM INFORMATION message "
+			"error.\n");
+		return -EINVAL;
+	}
+	tlv_parse(&tp, &gsm48_mm_att_tlvdef, gh->data, payload_len, 0, 0);
+
+	/* long name */
+	if (TLVP_PRESENT(&tp, GSM48_IE_NAME_LONG)) {
+		decode_network_name(mm->name_long, sizeof(mm->name_long),
+				TLVP_VAL(&tp, GSM48_IE_NAME_LONG)-1);
+	}
+	/* short name */
+	if (TLVP_PRESENT(&tp, GSM48_IE_NAME_SHORT)) {
+		decode_network_name(mm->name_short, sizeof(mm->name_short),
+				TLVP_VAL(&tp, GSM48_IE_NAME_SHORT)-1);
+	}
+
+	return 0;
+}
+
+/*
+ * process handlers for Location Update + IMSI attach (MM specific procedures)
+ */
+
+/* 4.4.2 received sysinfo change event */
+static int gsm48_mm_sysinfo(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_sysinfo *s = &ms->cellsel.sel_si;
+
+	/* t3212 not changed in these states */
+	if (mm->state == GSM48_MM_ST_MM_IDLE
+	 && (mm->substate == GSM48_MM_SST_NO_CELL_AVAIL
+	  || mm->substate == GSM48_MM_SST_LIMITED_SERVICE
+	  || mm->substate == GSM48_MM_SST_PLMN_SEARCH
+	  || mm->substate == GSM48_MM_SST_PLMN_SEARCH_NORMAL))
+		return 0;
+
+	/* new periodic location update timer timeout */
+	if (s->t3212 && s->t3212 != mm->t3212_value) {
+		if (osmo_timer_pending(&mm->t3212)) {
+			int t;
+			struct timeval current_time;
+
+			/* get rest time */
+			gettimeofday(&current_time, NULL);
+			t = mm->t3212.timeout.tv_sec - current_time.tv_sec;
+			if (t < 0)
+				t = 0;
+			LOGP(DMM, LOGL_INFO, "New T3212 while timer is running "
+				"(value %d rest %d)\n", s->t3212, t);
+
+			/* rest time modulo given value */
+			mm->t3212.timeout.tv_sec = current_time.tv_sec
+				+ (t % s->t3212);
+		} else {
+			uint32_t rand = layer23_random();
+
+			LOGP(DMM, LOGL_INFO, "New T3212 while timer is not "
+				"running (value %d)\n", s->t3212);
+
+			/* value between 0 and given value */
+			start_mm_t3212(mm, rand % (s->t3212 + 1));
+		}
+		mm->t3212_value = s->t3212;
+	}
+
+	return 0;
+}
+
+/* 4.4.4.1 (re)start location update
+ *
+ * this function is called by
+ * - normal location update
+ * - periodic location update
+ * - imsi attach (normal loc. upd. function)
+ * - retry timers (T3211 and T3213)
+ */
+static int gsm48_mm_loc_upd(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = &cs->sel_si;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm_settings *set = &ms->settings;
+	struct msgb *nmsg;
+	int msg_type;
+
+	/* (re)start only if we still require location update */
+	if (!mm->lupd_pending) {
+		LOGP(DMM, LOGL_INFO, "No loc. upd. pending.\n");
+		/* use MM IDLE to selecte the idle state */
+		return gsm48_mm_return_idle(ms, NULL);
+	}
+
+	/* must camp normally */
+	if (cs->state != GSM322_C3_CAMPED_NORMALLY) {
+		LOGP(DMM, LOGL_INFO, "Loc. upd. not camping normally.\n");
+		msg_type = GSM322_EVENT_REG_FAILED;
+		stop:
+		LOGP(DSUM, LOGL_INFO, "Location updating not possible\n");
+		_stop:
+		mm->lupd_pending = 0;
+
+#if 0
+		/* don't send message, if we got not triggered by PLMN search */
+		if (!msg)
+			return 0;
+#endif
+
+		/* send message to PLMN search process */
+		nmsg = gsm322_msgb_alloc(msg_type);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_plmn_sendmsg(ms, nmsg);
+		/* use MM IDLE to selecte the idle state */
+		return gsm48_mm_return_idle(ms, NULL);
+	}
+
+	/* deny network, if disabled */
+	if (set->no_lupd) {
+		LOGP(DMM, LOGL_INFO, "Loc. upd. disabled, adding "
+			"forbidden PLMN.\n");
+		LOGP(DSUM, LOGL_INFO, "Location updating is disabled by "
+			"configuration\n");
+		gsm_subscr_add_forbidden_plmn(subscr, cs->sel_mcc,
+			cs->sel_mnc, GSM48_REJECT_PLMN_NOT_ALLOWED);
+		msg_type = GSM322_EVENT_REG_FAILED;
+		goto _stop;
+	}
+
+	/* if LAI is forbidden, don't start */
+	if (gsm_subscr_is_forbidden_plmn(subscr, cs->sel_mcc, cs->sel_mnc)) {
+		LOGP(DMM, LOGL_INFO, "Loc. upd. not allowed PLMN.\n");
+		msg_type = GSM322_EVENT_REG_FAILED;
+		goto stop;
+	}
+	if (gsm322_is_forbidden_la(ms, cs->sel_mcc,
+		cs->sel_mnc, cs->sel_lac)) {
+		LOGP(DMM, LOGL_INFO, "Loc. upd. not allowed LA.\n");
+		msg_type = GSM322_EVENT_REG_FAILED;
+		goto stop;
+	}
+
+	/* 4.4.4.9 if cell is barred, don't start */
+	if ((!subscr->acc_barr && s->cell_barr)
+	 || (!subscr->acc_barr && !((subscr->acc_class & 0xfbff) &
+	 				(s->class_barr ^ 0xffff)))) {
+		LOGP(DMM, LOGL_INFO, "Loc. upd. no access.\n");
+		msg_type = GSM322_EVENT_REG_FAILED;
+		goto stop;
+	}
+
+	mm->lupd_mcc = cs->sel_mcc;
+	mm->lupd_mnc = cs->sel_mnc;
+	mm->lupd_lac = cs->sel_lac;
+
+	LOGP(DSUM, LOGL_INFO, "Perform location update (MCC %s, MNC %s "
+		"LAC 0x%04x)\n", gsm_print_mcc(mm->lupd_mcc),
+		gsm_print_mnc(mm->lupd_mnc), mm->lupd_lac);
+
+	return gsm48_mm_tx_loc_upd_req(ms);
+}
+
+/* initiate a normal location update / imsi attach */
+static int gsm48_mm_loc_upd_normal(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = &cs->sel_si;
+	struct msgb *nmsg;
+
+	/* in case we already have a location update going on */
+	if (mm->lupd_pending) {
+		LOGP(DMM, LOGL_INFO, "Loc. upd. already pending.\n");
+
+		return -EBUSY;
+	}
+
+	/* no location update, if limited service */
+	if (cs->state != GSM322_C3_CAMPED_NORMALLY) {
+		LOGP(DMM, LOGL_INFO, "Loc. upd. not allowed.\n");
+
+#if 0
+		/* don't send message, if we got not triggered by PLMN search */
+		if (!msg)
+			return 0;
+#endif
+
+		/* send message to PLMN search process */
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_REG_FAILED);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_plmn_sendmsg(ms, nmsg);
+
+		return 0;
+	}
+
+	/* if location update is not required */
+	if (subscr->ustate == GSM_SIM_U1_UPDATED
+	 && cs->selected
+	 && cs->sel_mcc == subscr->mcc
+	 && cs->sel_mnc == subscr->mnc
+	 && cs->sel_lac == subscr->lac
+	 && (subscr->imsi_attached
+	  || !s->att_allowed)) {
+		LOGP(DMM, LOGL_INFO, "Loc. upd. not required.\n");
+	  	subscr->imsi_attached = 1;
+
+		/* go straight to normal service state */
+		new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+				GSM48_MM_SST_NORMAL_SERVICE);
+
+#if 0
+		/* don't send message, if we got not triggered by PLMN search */
+		if (!msg)
+			return 0;
+#endif
+
+		/* send message to PLMN search process */
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_REG_SUCCESS);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm322_plmn_sendmsg(ms, nmsg);
+
+		return 0;
+	}
+
+	/* 4.4.3 is attachment required? */
+	if (subscr->ustate == GSM_SIM_U1_UPDATED
+	 && cs->selected
+	 && cs->sel_mcc == subscr->mcc
+	 && cs->sel_mnc == subscr->mnc
+	 && cs->sel_lac == subscr->lac
+	 && !subscr->imsi_attached
+	 && s->att_allowed) {
+		/* do location update for IMSI attach */
+		LOGP(DMM, LOGL_INFO, "Do Loc. upd. for IMSI attach.\n");
+		mm->lupd_type = 2;
+	} else {
+		/* do normal location update */
+		LOGP(DMM, LOGL_INFO, "Do normal Loc. upd.\n");
+		mm->lupd_type = 0;
+	}
+
+	/* start location update */
+	mm->lupd_attempt = 0;
+	mm->lupd_pending = 1;
+	mm->lupd_ra_failure = 0;
+
+	return gsm48_mm_loc_upd(ms, msg);
+}
+
+/* initiate a periodic location update */
+static int gsm48_mm_loc_upd_periodic(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	/* in case we already have a location update going on */
+	if (mm->lupd_pending) {
+		LOGP(DMM, LOGL_INFO, "Loc. upd. already pending.\n");
+		return -EBUSY;
+	}
+
+	/* start periodic location update */
+	mm->lupd_type = 1;
+	mm->lupd_pending = 1;
+	mm->lupd_ra_failure = 0;
+
+	return gsm48_mm_loc_upd(ms, msg);
+}
+
+/* ignore location update */
+static int gsm48_mm_loc_upd_ignore(struct osmocom_ms *ms, struct msgb *msg)
+{
+	return 0;
+}
+
+/* 9.2.15 send LOCATION UPDATING REQUEST message */
+static int gsm48_mm_tx_loc_upd_req(struct osmocom_ms *ms)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_support *sup = &ms->support;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct msgb *nmsg;
+	struct gsm48_hdr *ngh;
+	struct gsm48_loc_upd_req *nlu; /* NOTE: mi_len is part of struct */
+	uint8_t pwr_lev;
+	uint8_t buf[11];
+
+	LOGP(DMM, LOGL_INFO, "LOCATION UPDATING REQUEST\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	ngh = (struct gsm48_hdr *)msgb_put(nmsg, sizeof(*ngh));
+	nlu = (struct gsm48_loc_upd_req *)msgb_put(nmsg, sizeof(*nlu));
+
+	ngh->proto_discr = GSM48_PDISC_MM;
+	ngh->msg_type = GSM48_MT_MM_LOC_UPD_REQUEST;
+
+	/* location updating type */
+	nlu->type = mm->lupd_type;
+	/* cipering key */
+	nlu->key_seq = gsm_subscr_get_key_seq(ms, subscr);
+	/* LAI (last SIM stored LAI)
+	 *
+	 * NOTE: The TMSI is only valid within a LAI!
+	 */
+	gsm48_encode_lai_hex(&nlu->lai, subscr->mcc, subscr->mnc, subscr->lac);
+	LOGP(DMM, LOGL_INFO, " using LAI (mcc %s mnc %s " "lac 0x%04x)\n",
+		gsm_print_mcc(subscr->mcc),
+		gsm_print_mnc(subscr->mnc), subscr->lac);
+	/* classmark 1 */
+	pwr_lev = gsm48_current_pwr_lev(set, cs->sel_arfcn);
+	gsm48_encode_classmark1(&nlu->classmark1, sup->rev_lev, sup->es_ind,
+		set->a5_1, pwr_lev);
+	/* MI */
+	if (subscr->tmsi != 0xffffffff) { /* have TMSI ? */
+		gsm48_encode_mi(buf, NULL, ms, GSM_MI_TYPE_TMSI);
+		LOGP(DMM, LOGL_INFO, " using TMSI 0x%08x\n", subscr->tmsi);
+	} else {
+		gsm48_encode_mi(buf, NULL, ms, GSM_MI_TYPE_IMSI);
+		LOGP(DMM, LOGL_INFO, " using IMSI %s\n", subscr->imsi);
+	}
+	msgb_put(nmsg, buf[1]); /* length is part of nlu */
+	memcpy(&nlu->mi_len, buf + 1, 1 + buf[1]);
+
+	new_mm_state(mm, GSM48_MM_ST_WAIT_RR_CONN_LUPD, 0);
+
+	/* push RR header and send down */
+	mm->est_cause = RR_EST_CAUSE_LOC_UPD;
+	return gsm48_mm_to_rr(ms, nmsg, GSM48_RR_EST_REQ, 0, mm->est_cause);
+}
+
+/* 4.4.4.1 RR is esablised during location update */
+static int gsm48_mm_est_loc_upd(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	/* start location update timer */
+	start_mm_t3210(mm);
+
+	new_mm_state(mm, GSM48_MM_ST_LOC_UPD_INIT, 0);
+
+	return 0;
+}
+
+/* 4.4.4.6 LOCATION UPDATING ACCEPT is received */
+static int gsm48_mm_rx_loc_upd_acc(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_loc_area_id *lai = (struct gsm48_loc_area_id *) gh->data;
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	struct tlv_parsed tp;
+	struct msgb *nmsg;
+
+	if (payload_len < sizeof(struct gsm48_loc_area_id)) {
+		short_read:
+		LOGP(DMM, LOGL_NOTICE, "Short read of LOCATION UPDATING ACCEPT "
+			"message error.\n");
+		return -EINVAL;
+	}
+	tlv_parse(&tp, &gsm48_mm_att_tlvdef,
+		gh->data + sizeof(struct gsm48_loc_area_id),
+		payload_len - sizeof(struct gsm48_loc_area_id), 0, 0);
+
+	/* update has finished */
+	mm->lupd_pending = 0;
+
+	/* RA was successfull */
+	mm->lupd_ra_failure = 0;
+
+	/* stop periodic location updating timer */
+	stop_mm_t3212(mm); /* 4.4.2 */
+
+	/* LAI */
+	gsm48_decode_lai_hex(lai, &subscr->mcc, &subscr->mnc, &subscr->lac);
+
+	/* stop location update timer */
+	stop_mm_t3210(mm);
+
+	/* reset attempt counter */
+	mm->lupd_attempt = 0;
+
+	/* mark SIM as attached */
+	subscr->imsi_attached = 1;
+
+	/* set the status in the sim to updated */
+	new_sim_ustate(subscr, GSM_SIM_U1_UPDATED);
+
+	/* store LOCI on sim */
+	gsm_subscr_write_loci(ms);
+
+	/* set last registered PLMN */
+	if (subscr->lac > 0x0000 && subscr->lac < 0xfffe) {
+		subscr->plmn_valid = 1;
+		subscr->plmn_mcc = subscr->mcc;
+		subscr->plmn_mnc = subscr->mnc;
+	}
+
+	LOGP(DSUM, LOGL_INFO, "Location update accepted\n");
+	LOGP(DMM, LOGL_INFO, "LOCATION UPDATING ACCEPT (mcc %s mnc %s "
+		"lac 0x%04x)\n", gsm_print_mcc(subscr->mcc),
+		gsm_print_mnc(subscr->mnc), subscr->lac);
+
+	/* remove LA from forbidden list */
+	gsm322_del_forbidden_la(ms, subscr->mcc, subscr->mnc, subscr->lac);
+
+	/* MI */
+	if (TLVP_PRESENT(&tp, GSM48_IE_MOBILE_ID)) {
+		const uint8_t *mi;
+		uint8_t mi_type;
+		uint32_t tmsi;
+
+		mi = TLVP_VAL(&tp, GSM48_IE_MOBILE_ID)-1;
+		if (mi[0] < 1)
+			goto short_read;
+		mi_type = mi[1] & GSM_MI_TYPE_MASK;
+		switch (mi_type) {
+		case GSM_MI_TYPE_TMSI:
+			if (payload_len + sizeof(struct gsm48_loc_area_id) < 6
+			 || mi[0] < 5)
+				goto short_read;
+			memcpy(&tmsi, mi+2, 4);
+			subscr->tmsi = ntohl(tmsi);
+			LOGP(DMM, LOGL_INFO, "got TMSI 0x%08x (%u)\n",
+				subscr->tmsi, subscr->tmsi);
+
+			/* store LOCI on sim */
+			gsm_subscr_write_loci(ms);
+
+			/* send TMSI REALLOCATION COMPLETE */
+			gsm48_mm_tx_tmsi_reall_cpl(ms);
+			break;
+		case GSM_MI_TYPE_IMSI:
+			LOGP(DMM, LOGL_INFO, "TMSI removed\n");
+			subscr->tmsi = 0xffffffff;
+
+			/* store LOCI on sim */
+			gsm_subscr_write_loci(ms);
+
+			/* send TMSI REALLOCATION COMPLETE */
+			gsm48_mm_tx_tmsi_reall_cpl(ms);
+			break;
+		default:
+			LOGP(DMM, LOGL_NOTICE, "TMSI reallocation with unknown "
+				"MI type %d.\n", mi_type);
+		}
+	}
+
+	/* send message to PLMN search process */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_REG_SUCCESS);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_plmn_sendmsg(ms, nmsg);
+
+	/* follow on proceed */
+	if (TLVP_PRESENT(&tp, GSM48_IE_MOBILE_ID))
+		LOGP(DMM, LOGL_NOTICE, "follow-on proceed not supported.\n");
+
+	/* start RR release timer */
+	start_mm_t3240(mm);
+
+	new_mm_state(mm, GSM48_MM_ST_WAIT_NETWORK_CMD, 0);
+
+	return 0;
+}
+
+/* 4.4.4.7 LOCATION UPDATING REJECT is received */
+static int gsm48_mm_rx_loc_upd_rej(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+
+	if (payload_len < 1) {
+		LOGP(DMM, LOGL_NOTICE, "Short read of LOCATION UPDATING REJECT "
+			"message error.\n");
+		return -EINVAL;
+	}
+
+	/* RA was successfull */
+	mm->lupd_ra_failure = 0;
+
+	/* stop periodic location updating timer */
+	stop_mm_t3212(mm); /* 4.4.2 */
+
+	/* stop location update timer */
+	stop_mm_t3210(mm);
+
+	/* store until RR is released */
+	mm->lupd_rej_cause = *gh->data;
+
+	/* start RR release timer */
+	start_mm_t3240(mm);
+
+	new_mm_state(mm, GSM48_MM_ST_LOC_UPD_REJ, 0);
+
+	return 0;
+}
+
+/* 4.4.4.7 RR is released after location update reject */
+static int gsm48_mm_rel_loc_upd_rej(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+	struct gsm322_msg *ngm;
+
+	LOGP(DMM, LOGL_INFO, "Loc. upd. rejected (cause %d)\n",
+		mm->lupd_rej_cause);
+
+	/* stop RR release timer */
+	stop_mm_t3240(mm);
+
+	/* new status */
+	switch (mm->lupd_rej_cause) {
+	case GSM48_REJECT_IMSI_UNKNOWN_IN_HLR:
+	case GSM48_REJECT_ILLEGAL_MS:
+	case GSM48_REJECT_ILLEGAL_ME:
+		/* reset attempt counter */
+		mm->lupd_attempt = 0;
+
+		/* SIM invalid */
+		subscr->sim_valid = 0;
+
+		// fall through
+	case GSM48_REJECT_PLMN_NOT_ALLOWED:
+	case GSM48_REJECT_LOC_NOT_ALLOWED:
+	case GSM48_REJECT_ROAMING_NOT_ALLOWED:
+		/* TMSI and LAI invalid */
+		subscr->tmsi = 0xffffffff;
+		subscr->lac = 0x0000;
+
+		/* key is invalid */
+		subscr->key_seq = 7;
+
+		/* update status */
+		new_sim_ustate(subscr, GSM_SIM_U3_ROAMING_NA);
+
+		/* store LOCI on sim */
+		gsm_subscr_write_loci(ms);
+
+		/* update has finished */
+		mm->lupd_pending = 0;
+	}
+
+	/* send event to PLMN search process */
+	switch(mm->lupd_rej_cause) {
+	case GSM48_REJECT_ROAMING_NOT_ALLOWED:
+	case GSM48_REJECT_PLMN_NOT_ALLOWED:
+	case GSM48_REJECT_LOC_NOT_ALLOWED:
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_ROAMING_NA);
+		break;
+	case GSM48_REJECT_IMSI_UNKNOWN_IN_HLR:
+	case GSM48_REJECT_ILLEGAL_MS:
+	case GSM48_REJECT_ILLEGAL_ME:
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_INVALID_SIM);
+		break;
+	default:
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_REG_FAILED);
+	}
+	if (!nmsg)
+		return -ENOMEM;
+	ngm = (struct gsm322_msg *)nmsg->data;
+	ngm->reject = mm->lupd_rej_cause;
+	gsm322_plmn_sendmsg(ms, nmsg);
+
+	/* forbidden list */
+	switch (mm->lupd_rej_cause) {
+	case GSM48_REJECT_IMSI_UNKNOWN_IN_HLR:
+		LOGP(DSUM, LOGL_INFO, "Location update failed (IMSI unknown "
+			"in HLR)\n");
+		break;
+	case GSM48_REJECT_ILLEGAL_MS:
+		LOGP(DSUM, LOGL_INFO, "Location update failed (Illegal MS)\n");
+		break;
+	case GSM48_REJECT_ILLEGAL_ME:
+		LOGP(DSUM, LOGL_INFO, "Location update failed (Illegal ME)\n");
+		break;
+	case GSM48_REJECT_PLMN_NOT_ALLOWED:
+		gsm_subscr_add_forbidden_plmn(subscr, mm->lupd_mcc,
+			mm->lupd_mnc, mm->lupd_rej_cause);
+		LOGP(DSUM, LOGL_INFO, "Location update failed (PLMN not "
+			"allowed)\n");
+		break;
+	case GSM48_REJECT_LOC_NOT_ALLOWED:
+	case GSM48_REJECT_ROAMING_NOT_ALLOWED:
+		gsm322_add_forbidden_la(ms, mm->lupd_mcc, mm->lupd_mnc,
+			mm->lupd_lac, mm->lupd_rej_cause);
+		LOGP(DSUM, LOGL_INFO, "Location update failed (LAI not "
+			"allowed)\n");
+		break;
+	default:
+		/* 4.4.4.9 continue with failure handling */
+		return gsm48_mm_loc_upd_failed(ms, NULL);
+	}
+
+	/* return to MM IDLE */
+	return gsm48_mm_return_idle(ms, NULL);
+}
+
+/* 4.2.2 delay a location update */
+static int gsm48_mm_loc_upd_delay_per(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	LOGP(DMM, LOGL_INFO, "Schedule a pending periodic loc. upd.\n");
+	mm->lupd_periodic = 1;
+
+	return 0;
+}
+
+/* delay a location update retry */
+static int gsm48_mm_loc_upd_delay_retry(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	LOGP(DMM, LOGL_INFO, "Schedule a pending periodic loc. upd.\n");
+	mm->lupd_retry = 1;
+
+	return 0;
+}
+
+/* process failues as described in the lower part of 4.4.4.9 */
+static int gsm48_mm_loc_upd_failed(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm_subscriber *subscr = &ms->subscr;
+
+	LOGP(DSUM, LOGL_INFO, "Location update failed\n");
+
+	/* stop location update timer, if running */
+	stop_mm_t3210(mm);
+
+	if (subscr->ustate == GSM_SIM_U1_UPDATED
+	 && mm->lupd_mcc == subscr->mcc
+	 && mm->lupd_mnc == subscr->mnc
+	 && mm->lupd_lac == subscr->lac) {
+		if (mm->lupd_attempt < 4) {
+			LOGP(DSUM, LOGL_INFO, "Try location update later\n");
+			LOGP(DMM, LOGL_INFO, "Loc. upd. failed, retry #%d\n",
+				mm->lupd_attempt);
+
+			/* start update retry timer */
+			start_mm_t3211(mm);
+
+			/* return to MM IDLE */
+			return gsm48_mm_return_idle(ms, NULL);
+		} else
+			LOGP(DMM, LOGL_INFO, "Loc. upd. failed too often.\n");
+	}
+
+	/* TMSI and LAI invalid */
+	subscr->tmsi = 0xffffffff;
+	subscr->lac = 0x0000;
+
+	/* key is invalid */
+	subscr->key_seq = 7;
+
+	/* update status */
+	new_sim_ustate(subscr, GSM_SIM_U2_NOT_UPDATED);
+
+	/* store LOCI on sim */
+	gsm_subscr_write_loci(ms);
+
+	/* start update retry timer (RR connection is released) */
+	if (mm->lupd_attempt < 4) {
+		mm->start_t3211 = 1;
+		LOGP(DSUM, LOGL_INFO, "Try location update later\n");
+	}
+
+	/* return to MM IDLE */
+	return gsm48_mm_return_idle(ms, NULL);
+}
+
+/* abort a location update due to radio failure or release */
+static int gsm48_mm_rel_loc_upd_abort(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *)msg->data;
+
+	/* stop RR release timer */
+	stop_mm_t3240(mm);
+
+	if (rrh->msg_type == GSM48_RR_REL_IND) {
+		LOGP(DMM, LOGL_INFO, "RR link released after loc. upd.\n");
+
+		/* continue with failure handling */
+		return gsm48_mm_loc_upd_failed(ms, NULL);
+	}
+
+	LOGP(DMM, LOGL_INFO, "Loc. upd. aborted by radio (cause #%d)\n",
+		rrh->cause);
+
+	/* random access failure, but not two successive failures */
+	if (rrh->cause == RR_REL_CAUSE_RA_FAILURE && !mm->lupd_ra_failure) {
+		mm->lupd_ra_failure = 1;
+
+		/* start RA failure timer */
+		start_mm_t3213(mm);
+
+		return 0;
+	}
+
+	/* RA was successfull or sent twice */
+	mm->lupd_ra_failure = 0;
+
+	/* continue with failure handling */
+	return gsm48_mm_loc_upd_failed(ms, NULL);
+}
+
+/* location update has timed out */
+static int gsm48_mm_loc_upd_timeout(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+
+	/* abort RR connection */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_ABORT_REQ);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *) nmsg->data;
+	nrrh->cause = GSM48_RR_CAUSE_ABNORMAL_TIMER;
+	gsm48_rr_downmsg(ms, nmsg);
+
+	/* continue with failure handling */
+	return gsm48_mm_loc_upd_failed(ms, NULL);
+}
+
+/*
+ * process handlers for MM connections
+ */
+
+/* cm reestablish request message from upper layer */
+static int gsm48_mm_tx_cm_serv_req(struct osmocom_ms *ms, int rr_prim,
+	uint8_t cm_serv)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm_settings *set = &ms->settings;
+	struct msgb *nmsg;
+	struct gsm48_hdr *ngh;
+	struct gsm48_service_request *nsr; /* NOTE: includes MI length */
+	uint8_t *cm2lv;
+	uint8_t buf[11];
+
+	LOGP(DMM, LOGL_INFO, "CM SERVICE REQUEST (cause %d)\n", mm->est_cause);
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	ngh = (struct gsm48_hdr *)msgb_put(nmsg, sizeof(*ngh));
+	nsr = (struct gsm48_service_request *)msgb_put(nmsg, sizeof(*nsr));
+	cm2lv = (uint8_t *)&nsr->classmark;
+
+	ngh->proto_discr = GSM48_PDISC_MM;
+	ngh->msg_type = GSM48_MT_MM_CM_SERV_REQ;
+
+	/* type and key */
+	nsr->cm_service_type = cm_serv;
+	nsr->cipher_key_seq = gsm_subscr_get_key_seq(ms, subscr);
+	/* classmark 2 */
+	cm2lv[0] = sizeof(struct gsm48_classmark2);
+	gsm48_rr_enc_cm2(ms, (struct gsm48_classmark2 *)(cm2lv + 1),
+		(rr_prim == GSM48_RR_EST_REQ)	? cs->sel_arfcn
+						: rr->cd_now.arfcn);
+	/* MI */
+	if (mm->est_cause == RR_EST_CAUSE_EMERGENCY && set->emergency_imsi[0]) {
+		LOGP(DMM, LOGL_INFO, "-> Using IMSI %s for emergency\n",
+			set->emergency_imsi);
+		gsm48_generate_mid_from_imsi(buf, set->emergency_imsi);
+	} else
+	if (!subscr->sim_valid) { /* have no SIM ? */
+		LOGP(DMM, LOGL_INFO, "-> Using IMEI %s\n",
+			set->imei);
+		gsm48_encode_mi(buf, NULL, ms, GSM_MI_TYPE_IMEI);
+	} else
+	if (subscr->tmsi != 0xffffffff) { /* have TMSI ? */
+		gsm48_encode_mi(buf, NULL, ms, GSM_MI_TYPE_TMSI);
+		LOGP(DMM, LOGL_INFO, "-> Using TMSI\n");
+	} else {
+		gsm48_encode_mi(buf, NULL, ms, GSM_MI_TYPE_IMSI);
+		LOGP(DMM, LOGL_INFO, "-> Using IMSI %s\n",
+			subscr->imsi);
+	}
+	msgb_put(nmsg, buf[1]); /* length is part of nsr */
+	memcpy(&nsr->mi_len, buf + 1, 1 + buf[1]);
+	/* prio is optional for eMLPP */
+
+	/* push RR header and send down */
+	return gsm48_mm_to_rr(ms, nmsg, rr_prim, 0, mm->est_cause);
+}
+
+/* cm service abort message from upper layer
+ * NOTE: T3240 is started by the calling function
+ */
+static int gsm48_mm_tx_cm_service_abort(struct osmocom_ms *ms)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *ngh;
+
+	LOGP(DMM, LOGL_INFO, "CM SERVICE ABORT\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	ngh = (struct gsm48_hdr *)msgb_put(nmsg, sizeof(*ngh));
+
+	ngh->proto_discr = GSM48_PDISC_MM;
+	ngh->msg_type = GSM48_MT_MM_CM_SERV_ABORT;
+
+	/* push RR header and send down */
+	return gsm48_mm_to_rr(ms, nmsg, GSM48_RR_DATA_REQ, 0, 0);
+}
+
+/* cm service acknowledge is received from lower layer */
+static int gsm48_mm_rx_cm_service_acc(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	/* stop MM connection timer */
+	stop_mm_t3230(mm);
+
+	new_mm_state(mm, GSM48_MM_ST_MM_CONN_ACTIVE, 0);
+
+	return gsm48_mm_conn_go_dedic(ms);
+}
+
+/* 9.2.6 CM SERVICE REJECT message received */
+static int gsm48_mm_rx_cm_service_rej(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
+	uint8_t abort_any = 0;
+	uint8_t reject_cause;
+
+	if (payload_len < 1) {
+		LOGP(DMM, LOGL_NOTICE, "Short read of cm service reject "
+			"message error.\n");
+		return -EINVAL;
+	}
+
+	/* reject cause */
+	reject_cause = *gh->data;
+
+	LOGP(DMM, LOGL_INFO, "CM SERVICE REJECT (cause %d)\n", reject_cause);
+
+	/* stop MM connection timer */
+	stop_mm_t3230(mm);
+
+	/* selection action on cause value */
+	switch (reject_cause) {
+	case GSM48_REJECT_IMSI_UNKNOWN_IN_VLR:
+	case GSM48_REJECT_ILLEGAL_ME:
+		abort_any = 1;
+
+		/* TMSI and LAI invalid */
+		subscr->tmsi = 0xffffffff;
+		subscr->lac = 0x0000;
+
+		/* key is invalid */
+		subscr->key_seq = 7;
+
+		/* update status */
+		new_sim_ustate(subscr, GSM_SIM_U2_NOT_UPDATED);
+
+		/* store LOCI on sim */
+		gsm_subscr_write_loci(ms);
+
+		/* change to WAIT_NETWORK_CMD state impied by abort_any == 1 */
+
+		if (reject_cause == GSM48_REJECT_ILLEGAL_ME)
+			subscr->sim_valid = 0;
+
+		break;
+	default:
+		/* state implied by the number of remaining connections */
+		;
+	}
+
+	/* release MM connection(s) */
+	gsm48_mm_release_mm_conn(ms, abort_any, 16, 0, 0);
+
+	/* state depends on the existance of remaining MM connections */
+	if (llist_empty(&mm->mm_conn))
+		new_mm_state(mm, GSM48_MM_ST_WAIT_NETWORK_CMD, 0);
+	else
+		new_mm_state(mm, GSM48_MM_ST_MM_CONN_ACTIVE, 0);
+
+	return 0;
+}
+
+/* initiate an MM connection 4.5.1.1
+ *
+ * this function is called when:
+ * - no RR connection exists
+ * - an RR connection exists, but this is the first MM connection
+ * - an RR connection exists, and there are already MM connection(s)
+ */
+static int gsm48_mm_init_mm(struct osmocom_ms *ms, struct msgb *msg,
+	int rr_prim)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	int msg_type = mmh->msg_type;
+	int emergency = 0;
+	uint8_t cause = 0, cm_serv = 0, proto = 0;
+	struct msgb *nmsg;
+	struct gsm48_mmxx_hdr *nmmh;
+	struct gsm48_mm_conn *conn, *conn_found = NULL;
+	uint8_t sapi = mmh->sapi;
+
+	/* reset loc. upd. counter on CM service request */
+	mm->lupd_attempt = 0;
+
+	/* find if there is already a pending connection */
+	llist_for_each_entry(conn, &mm->mm_conn, list) {
+		if (conn->state == GSM48_MMXX_ST_CONN_PEND) {
+			conn_found = conn;
+			break;
+		}
+	}
+
+	/* if pending connection */
+	if (conn_found) {
+		LOGP(DMM, LOGL_INFO, "Init MM Connection, but already have "
+			"pending MM Connection.\n");
+		cause = 17;
+		/* use sapi from connection. if no connection, use sapi from
+		 * message.
+		 */
+		sapi = conn_found->sapi;
+		reject:
+		nmsg = NULL;
+		switch(msg_type) {
+		case GSM48_MMCC_EST_REQ:
+			nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMCC_REL_IND,
+				mmh->ref, mmh->transaction_id, sapi);
+			break;
+		case GSM48_MMSS_EST_REQ:
+			nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMSS_REL_IND,
+				mmh->ref, mmh->transaction_id, sapi);
+			break;
+		case GSM48_MMSMS_EST_REQ:
+			nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMSMS_REL_IND,
+				mmh->ref, mmh->transaction_id, sapi);
+			break;
+		}
+		if (!nmsg)
+			return -ENOMEM;
+		nmmh = (struct gsm48_mmxx_hdr *)nmsg->data;
+		nmmh->cause = cause;
+		gsm48_mmxx_upmsg(ms, nmsg);
+
+		return -EBUSY;
+	}
+	/* in case of an emergency setup */
+	if (msg_type == GSM48_MMCC_EST_REQ && mmh->emergency)
+		emergency = 1;
+
+	/* if sim is not updated */
+	if (!emergency && subscr->ustate != GSM_SIM_U1_UPDATED) {
+		LOGP(DMM, LOGL_INFO, "Init MM Connection, but SIM not "
+			"updated.\n");
+		cause = 21;
+		goto reject;
+	}
+
+	if (mm->state == GSM48_MM_ST_MM_IDLE) {
+		/* current MM idle state */
+		switch (mm->substate) {
+		case GSM48_MM_SST_NORMAL_SERVICE:
+		case GSM48_MM_SST_PLMN_SEARCH_NORMAL:
+			LOGP(DMM, LOGL_INFO, "Init MM Connection.\n");
+			break; /* allow when normal */
+		case GSM48_MM_SST_LOC_UPD_NEEDED:
+		case GSM48_MM_SST_ATTEMPT_UPDATE:
+			/* store mm request if attempting to update */
+			if (!emergency) {
+				LOGP(DMM, LOGL_INFO, "Init MM Connection, but "
+					"attempting to update.\n");
+				cause = 21;
+				goto reject;
+				/* TODO: implement delay and start loc upd. */
+			}
+			break;
+		default:
+			/* reject if not emergency */
+			if (!emergency) {
+				LOGP(DMM, LOGL_INFO, "Init MM Connection, not "
+					"in normal state.\n");
+				cause = 21;
+				goto reject;
+			}
+			break;
+		}
+	} else
+		LOGP(DMM, LOGL_INFO, "Init another MM Connection.\n");
+
+	/* set cause, service, proto */
+	switch(msg_type) {
+	case GSM48_MMCC_EST_REQ:
+		if (emergency) {
+			cause = RR_EST_CAUSE_EMERGENCY;
+			cm_serv = GSM48_CMSERV_EMERGENCY;
+		} else {
+			cause = RR_EST_CAUSE_ORIG_TCHF;
+			cm_serv = GSM48_CMSERV_MO_CALL_PACKET;
+		}
+		proto = GSM48_PDISC_CC;
+		break;
+	case GSM48_MMSS_EST_REQ:
+		cause = RR_EST_CAUSE_OTHER_SDCCH;
+		cm_serv = GSM48_CMSERV_SUP_SERV;
+		proto = GSM48_PDISC_NC_SS;
+		break;
+	case GSM48_MMSMS_EST_REQ:
+		cause = RR_EST_CAUSE_OTHER_SDCCH;
+		cm_serv = GSM48_CMSERV_SMS;
+		proto = GSM48_PDISC_SMS;
+		break;
+	}
+
+	/* create MM connection instance */
+	conn = mm_conn_new(mm, proto, mmh->transaction_id, mmh->sapi, mmh->ref);
+	if (!conn)
+		return -ENOMEM;
+
+	new_conn_state(conn, GSM48_MMXX_ST_CONN_PEND);
+
+	/* send CM SERVICE REQUEST */
+	if (rr_prim) {
+		mm->est_cause = cause;
+		return gsm48_mm_tx_cm_serv_req(ms, rr_prim, cm_serv);
+	} else
+		return 0;
+}
+
+/* 4.5.1.1 a) MM connection request triggers RR connection */
+static int gsm48_mm_init_mm_no_rr(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	int rc;
+
+	/* start MM connection by requesting RR connection */
+	rc = gsm48_mm_init_mm(ms, msg, GSM48_RR_EST_REQ);
+	if (rc)
+		return rc;
+
+	new_mm_state(mm, GSM48_MM_ST_WAIT_RR_CONN_MM_CON, 0);
+
+	return 0;
+}
+
+/* 4.5.1.1 a) RR is esablised during mm connection, wait for CM accepted */
+static int gsm48_mm_est_mm_con(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	/* 4.5.1.7 if there is no more MM connection */
+	if (llist_empty(&mm->mm_conn)) {
+		LOGP(DMM, LOGL_INFO, "MM Connection, are already gone.\n");
+
+		/* start RR release timer */
+		start_mm_t3240(mm);
+
+		new_mm_state(mm, GSM48_MM_ST_WAIT_NETWORK_CMD, 0);
+
+		/* send abort */
+		return gsm48_mm_tx_cm_service_abort(ms);
+	}
+
+	/* start MM connection timer */
+	start_mm_t3230(mm);
+
+	new_mm_state(mm, GSM48_MM_ST_WAIT_OUT_MM_CONN, 0);
+
+	return 0;
+}
+
+/* 4.5.1.1 b) MM connection request on existing RR connection */
+static int gsm48_mm_init_mm_first(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	int rc;
+
+	/* start MM connection by sending data */
+	rc = gsm48_mm_init_mm(ms, msg, GSM48_RR_DATA_REQ);
+	if (rc)
+		return rc;
+
+	/* stop "RR connection release not allowed" timer */
+	stop_mm_t3241(mm);
+
+	/* start MM connection timer */
+	start_mm_t3230(mm);
+
+	new_mm_state(mm, GSM48_MM_ST_WAIT_OUT_MM_CONN, 0);
+
+	return 0;
+}
+
+/* 4.5.1.1 b) another MM connection request on existing RR connection */
+static int gsm48_mm_init_mm_more(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	int rc;
+
+	/* start MM connection by sending data */
+	rc = gsm48_mm_init_mm(ms, msg, GSM48_RR_DATA_REQ);
+	if (rc)
+		return rc;
+
+	/* start MM connection timer */
+	start_mm_t3230(mm);
+
+	new_mm_state(mm, GSM48_MM_ST_WAIT_ADD_OUT_MM_CON, 0);
+
+	return 0;
+}
+
+/* 4.5.1.1 b) delay on WAIT FOR NETWORK COMMAND state */
+static int gsm48_mm_init_mm_wait(struct osmocom_ms *ms, struct msgb *msg)
+{
+	/* reject */
+	gsm48_mm_init_mm_reject(ms, msg);
+#if 0
+	this requires handling when leaving this state...
+
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	int rc;
+
+	/* just create the MM connection in pending state */
+	rc = gsm48_mm_init_mm(ms, msg, 0);
+	if (rc)
+		return rc;
+
+	/* start MM connection timer */
+	start_mm_t3230(mm);
+
+	new_mm_state(mm, GSM48_MM_ST_WAIT_ADD_OUT_MM_CON, 0);
+#endif
+
+	return 0;
+}
+
+/* initiate an mm connection other cases */
+static int gsm48_mm_init_mm_reject(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	int msg_type = mmh->msg_type;
+	int sapi = mmh->sapi;
+	struct msgb *nmsg;
+	struct gsm48_mmxx_hdr *nmmh;
+
+	/* reject */
+	nmsg = NULL;
+	switch(msg_type) {
+	case GSM48_MMCC_EST_REQ:
+		nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMCC_REL_IND, mmh->ref,
+			mmh->transaction_id, sapi);
+		break;
+	case GSM48_MMSS_EST_REQ:
+		nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMSS_REL_IND, mmh->ref,
+			mmh->transaction_id, sapi);
+		break;
+	case GSM48_MMSMS_EST_REQ:
+		nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMSMS_REL_IND, mmh->ref,
+			mmh->transaction_id, sapi);
+		break;
+	}
+	if (!nmsg)
+		return -ENOMEM;
+	nmmh = (struct gsm48_mmxx_hdr *)nmsg->data;
+	nmmh->cause = 17;
+	gsm48_mmxx_upmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* accepting pending connection, got dedicated mode
+ *
+ * this function is called:
+ * - when ciphering command is received
+ * - when cm service is accepted
+ */
+static int gsm48_mm_conn_go_dedic(struct osmocom_ms *ms)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mm_conn *conn, *conn_found = NULL;
+	struct msgb *nmsg;
+
+	/* the first and only pending connection is the recent requested */
+	llist_for_each_entry(conn, &mm->mm_conn, list) {
+		if (conn->state == GSM48_MMXX_ST_CONN_PEND) {
+			conn_found = conn;
+			break;
+		}
+	}
+
+	/* if no pending connection (anymore) */
+	if (!conn_found) {
+		LOGP(DMM, LOGL_INFO, "No pending MM Connection.\n");
+
+		return 0;
+	}
+
+	new_conn_state(conn, GSM48_MMXX_ST_DEDICATED);
+
+	/* send establishment confirm */
+	nmsg = NULL;
+	switch(conn_found->protocol) {
+	case GSM48_PDISC_CC:
+		nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMCC_EST_CNF,
+			conn_found->ref, conn_found->transaction_id,
+			conn_found->sapi);
+		break;
+	case GSM48_PDISC_NC_SS:
+		nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMSS_EST_CNF,
+			conn_found->ref, conn_found->transaction_id,
+			conn_found->sapi);
+		break;
+	case GSM48_PDISC_SMS:
+		if (!mm->sapi3_link) {
+			LOGP(DMM, LOGL_INFO, "Sapi 3 link down, requesting "
+				"link, waiting for confirm.\n");
+			nmsg = gsm48_l3_msgb_alloc();
+			if (!nmsg)
+				return -ENOMEM;
+			return gsm48_mm_to_rr(ms, nmsg, GSM48_RR_EST_REQ,
+				conn_found->sapi, 0);
+		}
+		nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMSMS_EST_CNF,
+			conn_found->ref, conn_found->transaction_id,
+			conn_found->sapi);
+		break;
+	}
+	if (!nmsg)
+		return -ENOMEM;
+
+	gsm48_mmxx_upmsg(ms, nmsg);
+
+	return 0;
+}
+
+/* a RR-SYNC-IND is received during MM connection establishment */
+static int gsm48_mm_sync_ind_wait(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *)msg->data;
+
+	if (rrh->cause != RR_SYNC_CAUSE_CIPHERING) {
+		LOGP(DMM, LOGL_NOTICE, "Ignore sync indication, not waiting "
+			"for CM service\n");
+		return -EINVAL;
+	}
+
+	/* stop MM connection timer */
+	stop_mm_t3230(mm);
+
+	new_mm_state(mm, GSM48_MM_ST_MM_CONN_ACTIVE, 0);
+
+	return gsm48_mm_conn_go_dedic(ms);
+}
+
+/* a RR-SYNC-IND is received during MM connection active */
+static int gsm48_mm_sync_ind_active(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mm_conn *conn;
+	struct msgb *nmsg;
+
+	/* stop MM connection timer */
+	stop_mm_t3230(mm);
+
+	/* broadcast all MMCC connection(s) */
+	llist_for_each_entry(conn, &mm->mm_conn, list) {
+		/* send MMCC-SYNC-IND */
+		nmsg = NULL;
+		switch(conn->protocol) {
+		case GSM48_PDISC_CC:
+			nmsg = gsm48_mmxx_msgb_alloc(GSM48_MMCC_SYNC_IND,
+				conn->ref, conn->transaction_id, conn->sapi);
+			break;
+		}
+		if (!nmsg)
+			continue; /* skip if not of CC type */
+
+		/* copy L3 message */
+		nmsg->l3h = msgb_put(nmsg, msgb_l3len(msg));
+		memcpy(nmsg->l3h, msg->l3h, msgb_l3len(msg));
+		gsm48_mmxx_upmsg(ms, nmsg);
+	}
+
+	return 0;
+}
+
+/* 4.5.1.2 RR abort/release is received during MM connection establishment */
+static int gsm48_mm_abort_mm_con(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *)msg->data;
+	int cause;
+
+	/* stop RR release timer */
+	stop_mm_t3240(mm);
+
+	/* this conversion is not of any standard */
+	switch(rrh->cause) {
+	case RR_REL_CAUSE_NOT_AUTHORIZED:
+	case RR_REL_CAUSE_EMERGENCY_ONLY:
+	case RR_REL_CAUSE_TRY_LATER:
+		cause = 21;
+		break;
+	case RR_REL_CAUSE_NORMAL:
+		cause = 16;
+		break;
+	default:
+		cause = 47;
+	}
+
+	/* stop MM connection timer */
+	stop_mm_t3230(mm);
+
+	/* release all connections */
+	gsm48_mm_release_mm_conn(ms, 1, cause, 1, 0);
+
+	/* return to MM IDLE */
+	return gsm48_mm_return_idle(ms, NULL);
+}
+
+/* 4.5.1.2 timeout is received during MM connection establishment */
+static int gsm48_mm_timeout_mm_con(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	/* release pending connection */
+	gsm48_mm_release_mm_conn(ms, 0, 102, 0, 0);
+
+	/* state depends on the existance of remaining MM connections */
+	if (llist_empty(&mm->mm_conn)) {
+		/* start RR release timer */
+		start_mm_t3240(mm);
+
+		new_mm_state(mm, GSM48_MM_ST_WAIT_NETWORK_CMD, 0);
+	} else
+		new_mm_state(mm, GSM48_MM_ST_MM_CONN_ACTIVE, 0);
+
+	return 0;
+}
+
+/* respond to paging */
+static int gsm48_mm_est(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	mm->est_cause = RR_EST_CAUSE_ANS_PAG_ANY;
+	new_mm_state(mm, GSM48_MM_ST_WAIT_NETWORK_CMD, 0);
+
+	return 0;
+}
+
+/* send CM data */
+static int gsm48_mm_data(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	struct gsm48_mm_conn *conn;
+	int msg_type = mmh->msg_type;
+
+	/* get connection, if not exist (anymore), release */
+	conn = mm_conn_by_ref(mm, mmh->ref);
+	if (!conn) {
+		LOGP(DMM, LOGL_INFO, "MMXX_DATA_REQ with unknown (already "
+			"released) ref=%x, sending MMXX_REL_IND\n", mmh->ref);
+		switch(msg_type & GSM48_MMXX_MASK) {
+		case GSM48_MMCC_CLASS:
+			mmh->msg_type = GSM48_MMCC_REL_IND;
+			break;
+		case GSM48_MMSS_CLASS:
+			mmh->msg_type = GSM48_MMSS_REL_IND;
+			break;
+		case GSM48_MMSMS_CLASS:
+			mmh->msg_type = GSM48_MMSMS_REL_IND;
+			break;
+		}
+		mmh->cause = 31;
+
+		/* mirror message with REL_IND + cause */
+		return gsm48_mmxx_upmsg(ms, msg);
+	}
+
+	/* set SAPI, if upper layer does not do it correctly */
+	mmh->sapi = conn->sapi;
+
+	/* pull MM header */
+	msgb_pull(msg, sizeof(struct gsm48_mmxx_hdr));
+
+	/* push RR header and send down */
+	return gsm48_mm_to_rr(ms, msg, GSM48_RR_DATA_REQ, conn->sapi, 0);
+}
+
+/* release of MM connection (active state) */
+static int gsm48_mm_release_active(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	struct gsm48_mm_conn *conn;
+
+	/* get connection, if not exist (anymore), release */
+	conn = mm_conn_by_ref(mm, mmh->ref);
+	if (conn)
+		mm_conn_free(conn);
+
+	/* state depends on the existance of remaining MM connections */
+	if (llist_empty(&mm->mm_conn)) {
+		/* start RR release timer */
+		start_mm_t3240(mm);
+
+		new_mm_state(mm, GSM48_MM_ST_WAIT_NETWORK_CMD, 0);
+	} else
+		new_mm_state(mm, GSM48_MM_ST_MM_CONN_ACTIVE, 0);
+
+	return 0;
+}
+
+/* release of MM connection (wait for additional state) */
+static int gsm48_mm_release_wait_add(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	struct gsm48_mm_conn *conn;
+
+	/* get connection, if not exist (anymore), release */
+	conn = mm_conn_by_ref(mm, mmh->ref);
+	if (conn)
+		mm_conn_free(conn);
+
+	return 0;
+}
+
+/* release of MM connection (wait for active state) */
+static int gsm48_mm_release_wait_active(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	struct gsm48_mm_conn *conn;
+
+	/* get connection, if not exist (anymore), release */
+	conn = mm_conn_by_ref(mm, mmh->ref);
+	if (conn)
+		mm_conn_free(conn);
+
+	/* 4.5.1.7 if there is no MM connection during wait for active state */
+	if (llist_empty(&mm->mm_conn)) {
+		LOGP(DMM, LOGL_INFO, "No MM Connection during 'wait for "
+			"active' state.\n");
+
+		/* start RR release timer */
+		start_mm_t3240(mm);
+
+		new_mm_state(mm, GSM48_MM_ST_WAIT_NETWORK_CMD, 0);
+
+		/* send abort */
+		return gsm48_mm_tx_cm_service_abort(ms);
+	}
+
+	return 0;
+}
+
+/* release of MM connection (wait for RR state) */
+static int gsm48_mm_release_wait_rr(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	struct gsm48_mm_conn *conn;
+
+	/* get connection, if not exist (anymore), release */
+	conn = mm_conn_by_ref(mm, mmh->ref);
+	if (conn)
+		mm_conn_free(conn);
+
+	/* later, if RR connection is established, the CM SERIVE ABORT
+	 * message will be sent
+	 */
+	return 0;
+}
+
+/* abort RR connection (due to T3240) */
+static int gsm48_mm_abort_rr(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+
+	/* send abort to RR */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_ABORT_REQ);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *) nmsg->data;
+	nrrh->cause = GSM48_RR_CAUSE_ABNORMAL_TIMER;
+	gsm48_rr_downmsg(ms, nmsg);
+
+	/* return to MM IDLE */
+	return gsm48_mm_return_idle(ms, NULL);
+}
+
+/*
+ * other processes
+ */
+
+/* RR is released in other states */
+static int gsm48_mm_rel_other(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	/* stop RR release timer (if running) */
+	stop_mm_t3240(mm);
+
+	/* return to MM IDLE */
+	return gsm48_mm_return_idle(ms, NULL);
+}
+
+/*
+ * sapi 3
+ */
+
+static int gsm48_rcv_rr_sapi3(struct osmocom_ms *ms, struct msgb *msg,
+	int msg_type, uint8_t sapi)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mm_conn *conn;
+
+	switch (msg_type) {
+	case GSM48_RR_EST_CNF:
+		LOGP(DMM, LOGL_INFO, "SAPI 3 link up, confirming conns.\n");
+		mm->sapi3_link = 1;
+		/* indicate establishment to sapi 3 connections */
+		llist_for_each_entry(conn, &mm->mm_conn, list) {
+			if (conn->sapi == sapi
+			 && conn->state == GSM48_MMXX_ST_DEDICATED) {
+				struct msgb *nmsg;
+				nmsg = gsm48_mmxx_msgb_alloc(
+					GSM48_MMSMS_EST_CNF, conn->ref,
+					conn->transaction_id, conn->sapi);
+				if (!nmsg)
+					return -ENOMEM;
+				gsm48_mmxx_upmsg(ms, nmsg);
+			}
+		}
+		break;
+	case GSM48_RR_DATA_IND:
+		return gsm48_mm_data_ind(ms, msg);
+	case GSM48_RR_REL_IND:
+		LOGP(DMM, LOGL_INFO, "SAPI 3 link down, releasing conns.\n");
+		mm->sapi3_link = 0;
+		gsm48_mm_release_mm_conn(ms, 1, 16, 0, sapi);
+		break;
+	}
+	msgb_free(msg);
+
+	return 0;
+}
+
+/*
+ * state machines
+ */
+
+/* state trasitions for MMxx-SAP messages from upper layers */
+static struct downstate {
+	uint32_t	states;
+	uint32_t	substates;
+	int		type;
+	int		(*rout) (struct osmocom_ms *ms, struct msgb *msg);
+} downstatelist[] = {
+	/* 4.2.2.1 Normal service */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NORMAL_SERVICE),
+	 GSM48_MMCC_EST_REQ, gsm48_mm_init_mm_no_rr},
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NORMAL_SERVICE),
+	 GSM48_MMSS_EST_REQ, gsm48_mm_init_mm_no_rr},
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NORMAL_SERVICE),
+	 GSM48_MMSMS_EST_REQ, gsm48_mm_init_mm_no_rr},
+
+	/* 4.2.2.2 Attempt to update / Loc. Upd. needed */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_ATTEMPT_UPDATE) |
+				SBIT(GSM48_MM_SST_LOC_UPD_NEEDED),
+	 GSM48_MMCC_EST_REQ, gsm48_mm_init_mm_no_rr}, /* emergency only */
+
+	/* 4.2.2.3 Limited service */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_LIMITED_SERVICE),
+	 GSM48_MMCC_EST_REQ, gsm48_mm_init_mm_no_rr},
+
+	/* 4.2.2.4 No IMSI */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NO_IMSI),
+	 GSM48_MMCC_EST_REQ, gsm48_mm_init_mm_no_rr},
+
+	/* 4.2.2.5 PLMN search, normal service */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH_NORMAL),
+	 GSM48_MMCC_EST_REQ, gsm48_mm_init_mm_no_rr},
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH_NORMAL),
+	 GSM48_MMSS_EST_REQ, gsm48_mm_init_mm_no_rr},
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH_NORMAL),
+	 GSM48_MMSMS_EST_REQ, gsm48_mm_init_mm_no_rr},
+
+	/* 4.2.2.6 PLMN search */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH),
+	 GSM48_MMCC_EST_REQ, gsm48_mm_init_mm_no_rr},
+
+	/* 4.5.1.1 MM Connection (EST) */
+	{SBIT(GSM48_MM_ST_RR_CONN_RELEASE_NA), ALL_STATES,
+	 GSM48_MMCC_EST_REQ, gsm48_mm_init_mm_first},
+
+	{SBIT(GSM48_MM_ST_RR_CONN_RELEASE_NA), ALL_STATES,
+	 GSM48_MMSS_EST_REQ, gsm48_mm_init_mm_first},
+
+	{SBIT(GSM48_MM_ST_RR_CONN_RELEASE_NA), ALL_STATES,
+	 GSM48_MMSMS_EST_REQ, gsm48_mm_init_mm_first},
+
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE), ALL_STATES,
+	 GSM48_MMCC_EST_REQ, gsm48_mm_init_mm_more},
+
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE), ALL_STATES,
+	 GSM48_MMSS_EST_REQ, gsm48_mm_init_mm_more},
+
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE), ALL_STATES,
+	 GSM48_MMSMS_EST_REQ, gsm48_mm_init_mm_more},
+
+	{SBIT(GSM48_MM_ST_WAIT_NETWORK_CMD), ALL_STATES,
+	 GSM48_MMCC_EST_REQ, gsm48_mm_init_mm_wait},
+
+	{SBIT(GSM48_MM_ST_WAIT_NETWORK_CMD), ALL_STATES,
+	 GSM48_MMSS_EST_REQ, gsm48_mm_init_mm_wait},
+
+	{SBIT(GSM48_MM_ST_WAIT_NETWORK_CMD), ALL_STATES,
+	 GSM48_MMSMS_EST_REQ, gsm48_mm_init_mm_wait},
+
+	{ALL_STATES, ALL_STATES,
+	 GSM48_MMCC_EST_REQ, gsm48_mm_init_mm_reject},
+
+	{ALL_STATES, ALL_STATES,
+	 GSM48_MMSS_EST_REQ, gsm48_mm_init_mm_reject},
+
+	{ALL_STATES, ALL_STATES,
+	 GSM48_MMSMS_EST_REQ, gsm48_mm_init_mm_reject},
+
+	/* 4.5.2.1 MM Connection (DATA) */
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE) |
+	 SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), ALL_STATES,
+	 GSM48_MMCC_DATA_REQ, gsm48_mm_data},
+
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE) |
+	 SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), ALL_STATES,
+	 GSM48_MMSS_DATA_REQ, gsm48_mm_data},
+
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE) |
+	 SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), ALL_STATES,
+	 GSM48_MMSMS_DATA_REQ, gsm48_mm_data},
+
+	/* 4.5.2.1 MM Connection (REL) */
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE), ALL_STATES,
+	 GSM48_MMCC_REL_REQ, gsm48_mm_release_active},
+
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE), ALL_STATES,
+	 GSM48_MMSS_REL_REQ, gsm48_mm_release_active},
+
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE), ALL_STATES,
+	 GSM48_MMSMS_REL_REQ, gsm48_mm_release_active},
+
+	{SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), ALL_STATES,
+	 GSM48_MMCC_REL_REQ, gsm48_mm_release_wait_add},
+
+	{SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), ALL_STATES,
+	 GSM48_MMSS_REL_REQ, gsm48_mm_release_wait_add},
+
+	{SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), ALL_STATES,
+	 GSM48_MMSMS_REL_REQ, gsm48_mm_release_wait_add},
+
+	{SBIT(GSM48_MM_ST_WAIT_OUT_MM_CONN), ALL_STATES,
+	 GSM48_MMCC_REL_REQ, gsm48_mm_release_wait_active},
+
+	{SBIT(GSM48_MM_ST_WAIT_OUT_MM_CONN), ALL_STATES,
+	 GSM48_MMSS_REL_REQ, gsm48_mm_release_wait_active},
+
+	{SBIT(GSM48_MM_ST_WAIT_OUT_MM_CONN), ALL_STATES,
+	 GSM48_MMSMS_REL_REQ, gsm48_mm_release_wait_active},
+
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_MM_CON), ALL_STATES,
+	 GSM48_MMCC_REL_REQ, gsm48_mm_release_wait_rr},
+
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_MM_CON), ALL_STATES,
+	 GSM48_MMSS_REL_REQ, gsm48_mm_release_wait_rr},
+
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_MM_CON), ALL_STATES,
+	 GSM48_MMSMS_REL_REQ, gsm48_mm_release_wait_rr},
+};
+
+#define DOWNSLLEN \
+	(sizeof(downstatelist) / sizeof(struct downstate))
+
+int gsm48_mmxx_downmsg(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_mmxx_hdr *mmh = (struct gsm48_mmxx_hdr *)msg->data;
+	int msg_type = mmh->msg_type;
+	struct gsm48_mm_conn *conn;
+	int i, rc;
+
+	/* keep up to date with the transaction ID */
+	conn = mm_conn_by_ref(mm, mmh->ref);
+	if (conn)
+		conn->transaction_id = mmh->transaction_id;
+
+	LOGP(DMM, LOGL_INFO, "(ms %s) Received '%s' event in state %s\n",
+		ms->name, get_mmxx_name(msg_type),
+		gsm48_mm_state_names[mm->state]);
+	if (mm->state == GSM48_MM_ST_MM_IDLE)
+		LOGP(DMM, LOGL_INFO, "-> substate %s\n",
+			gsm48_mm_substate_names[mm->substate]);
+	LOGP(DMM, LOGL_INFO, "-> callref %x, transaction_id %d\n",
+		mmh->ref, mmh->transaction_id);
+
+	/* Find function for current state and message */
+	for (i = 0; i < DOWNSLLEN; i++)
+		if ((msg_type == downstatelist[i].type)
+		 && ((1 << mm->state) & downstatelist[i].states)
+		 && ((1 << mm->substate) & downstatelist[i].substates))
+			break;
+	if (i == DOWNSLLEN) {
+		LOGP(DMM, LOGL_NOTICE, "Message unhandled at this state.\n");
+		msgb_free(msg);
+		return 0;
+	}
+
+	rc = downstatelist[i].rout(ms, msg);
+
+	if (downstatelist[i].rout != gsm48_mm_data)
+		msgb_free(msg);
+
+	return rc;
+}
+
+/* state trasitions for radio ressource messages (lower layer) */
+static struct rrdatastate {
+	uint32_t	states;
+	int		type;
+	int		(*rout) (struct osmocom_ms *ms, struct msgb *msg);
+} rrdatastatelist[] = {
+	/* paging */
+	{SBIT(GSM48_MM_ST_MM_IDLE),
+	 GSM48_RR_EST_IND, gsm48_mm_est},
+
+	/* imsi detach */
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_IMSI_D), /* 4.3.4.4 */
+	 GSM48_RR_EST_CNF, gsm48_mm_imsi_detach_sent},
+
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_IMSI_D), /* 4.3.4.4 (unsuc.) */
+	 GSM48_RR_REL_IND, gsm48_mm_imsi_detach_end},
+	 	/* also this may happen if SABM is ackwnowledged with DISC */
+
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_IMSI_D), /* 4.3.4.4 (lost) */
+	 GSM48_RR_ABORT_IND, gsm48_mm_imsi_detach_end},
+
+	{SBIT(GSM48_MM_ST_IMSI_DETACH_INIT), /* 4.3.4.4 (unsuc.) */
+	 GSM48_RR_REL_IND, gsm48_mm_imsi_detach_end},
+
+	{SBIT(GSM48_MM_ST_IMSI_DETACH_INIT), /* 4.3.4.4 (lost) */
+	 GSM48_RR_ABORT_IND, gsm48_mm_imsi_detach_end},
+
+	/* location update */
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_LUPD), /* 4.4.4.1 */
+	 GSM48_RR_EST_CNF, gsm48_mm_est_loc_upd},
+
+	{SBIT(GSM48_MM_ST_LOC_UPD_INIT) |
+	 SBIT(GSM48_MM_ST_WAIT_RR_CONN_LUPD), /* 4.4.4.9 */
+	 GSM48_RR_REL_IND, gsm48_mm_rel_loc_upd_abort},
+
+	{SBIT(GSM48_MM_ST_LOC_UPD_INIT) |
+	 SBIT(GSM48_MM_ST_WAIT_RR_CONN_LUPD), /* 4.4.4.9 */
+	 GSM48_RR_ABORT_IND, gsm48_mm_rel_loc_upd_abort},
+
+	{SBIT(GSM48_MM_ST_LOC_UPD_REJ), /* 4.4.4.7 */
+	 GSM48_RR_REL_IND, gsm48_mm_rel_loc_upd_rej},
+
+	{SBIT(GSM48_MM_ST_LOC_UPD_REJ), /* 4.4.4.7 */
+	 GSM48_RR_ABORT_IND, gsm48_mm_rel_loc_upd_rej},
+
+	/* MM connection (EST) */
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_MM_CON), /* 4.5.1.1 */
+	 GSM48_RR_EST_CNF, gsm48_mm_est_mm_con},
+
+	/* MM connection (DATA) */
+	{ALL_STATES,
+	 GSM48_RR_DATA_IND, gsm48_mm_data_ind},
+
+	/* MM connection (SYNC) */
+	{SBIT(GSM48_MM_ST_WAIT_OUT_MM_CONN) |
+	 SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), /* 4.5.1.1 */
+	 GSM48_RR_SYNC_IND, gsm48_mm_sync_ind_wait},
+
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE),
+	 GSM48_RR_SYNC_IND, gsm48_mm_sync_ind_active},
+
+	/* MM connection (REL/ABORT) */
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_MM_CON) |
+	 SBIT(GSM48_MM_ST_WAIT_OUT_MM_CONN) |
+	 SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), /* 4.5.1.2 */
+	 GSM48_RR_REL_IND, gsm48_mm_abort_mm_con},
+
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_MM_CON) |
+	 SBIT(GSM48_MM_ST_WAIT_OUT_MM_CONN) |
+	 SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), /* 4.5.1.2 */
+	 GSM48_RR_ABORT_IND, gsm48_mm_abort_mm_con},
+
+	/* MM connection (REL/ABORT with re-establishment possibility) */
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE), /* not supported */
+	 GSM48_RR_REL_IND, gsm48_mm_abort_mm_con},
+
+	{SBIT(GSM48_MM_ST_MM_CONN_ACTIVE) |
+	 SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), /* not supported */
+	 GSM48_RR_ABORT_IND, gsm48_mm_abort_mm_con},
+
+	/* other (also wait for network command) */
+	{ALL_STATES,
+	 GSM48_RR_REL_IND, gsm48_mm_rel_other},
+
+	{ALL_STATES,
+	 GSM48_RR_ABORT_IND, gsm48_mm_rel_other},
+};
+
+#define RRDATASLLEN \
+	(sizeof(rrdatastatelist) / sizeof(struct rrdatastate))
+
+static int gsm48_rcv_rr(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *)msg->data;
+	int msg_type = rrh->msg_type;
+	int sapi = rrh->sapi;
+	int i, rc;
+
+	LOGP(DMM, LOGL_INFO, "(ms %s) Received '%s' from RR in state %s "
+		"(sapi %d)\n", ms->name, get_rr_name(msg_type),
+		gsm48_mm_state_names[mm->state], sapi);
+
+	if (sapi)
+		return gsm48_rcv_rr_sapi3(ms, msg, msg_type, sapi);
+
+	/* find function for current state and message */
+	for (i = 0; i < RRDATASLLEN; i++)
+		if ((msg_type == rrdatastatelist[i].type)
+		 && ((1 << mm->state) & rrdatastatelist[i].states))
+			break;
+	if (i == RRDATASLLEN) {
+		LOGP(DMM, LOGL_NOTICE, "Message unhandled at this state.\n");
+		msgb_free(msg);
+		return 0;
+	}
+
+	rc = rrdatastatelist[i].rout(ms, msg);
+
+	if (rrdatastatelist[i].rout != gsm48_mm_data_ind)
+		msgb_free(msg);
+
+	return rc;
+}
+
+/* state trasitions for mobile managemnt messages (lower layer) */
+static struct mmdatastate {
+	uint32_t	states;
+	int		type;
+	int		(*rout) (struct osmocom_ms *ms, struct msgb *msg);
+} mmdatastatelist[] = {
+	{ALL_STATES, /* 4.3.1.2 */
+	 GSM48_MT_MM_TMSI_REALL_CMD, gsm48_mm_rx_tmsi_realloc_cmd},
+
+	{ALL_STATES, /* 4.3.2.2 */
+	 GSM48_MT_MM_AUTH_REQ, gsm48_mm_rx_auth_req},
+
+	{ALL_STATES, /* 4.3.2.5 */
+	 GSM48_MT_MM_AUTH_REJ, gsm48_mm_rx_auth_rej},
+
+	{ALL_STATES, /* 4.3.3.2 */
+	 GSM48_MT_MM_ID_REQ, gsm48_mm_rx_id_req},
+
+	{ALL_STATES, /* 4.3.5.2 */
+	 GSM48_MT_MM_ABORT, gsm48_mm_rx_abort},
+
+	{ALL_STATES, /* 4.3.6.2 */
+	 GSM48_MT_MM_INFO, gsm48_mm_rx_info},
+
+	{SBIT(GSM48_MM_ST_LOC_UPD_INIT), /* 4.4.4.6 */
+	 GSM48_MT_MM_LOC_UPD_ACCEPT, gsm48_mm_rx_loc_upd_acc},
+
+	{SBIT(GSM48_MM_ST_LOC_UPD_INIT), /* 4.4.4.7 */
+	 GSM48_MT_MM_LOC_UPD_REJECT, gsm48_mm_rx_loc_upd_rej},
+
+	{ALL_STATES, /* 4.5.1.1 */
+	 GSM48_MT_MM_CM_SERV_ACC, gsm48_mm_rx_cm_service_acc},
+
+	{ALL_STATES, /* 4.5.1.1 */
+	 GSM48_MT_MM_CM_SERV_REJ, gsm48_mm_rx_cm_service_rej},
+};
+
+#define MMDATASLLEN \
+	(sizeof(mmdatastatelist) / sizeof(struct mmdatastate))
+
+static int gsm48_mm_data_ind(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *)msg->data;
+	int sapi = rrh->sapi;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	uint8_t pdisc = gh->proto_discr & 0x0f;
+	uint8_t msg_type = gh->msg_type & 0xbf;
+	struct gsm48_mmxx_hdr *mmh;
+	int msg_supported = 0; /* determine, if message is supported at all */
+	int rr_prim = -1, rr_est = -1; /* no prim set */
+	uint8_t skip_ind;
+	int i, rc;
+
+	/* 9.2.19 */
+	if (msg_type == GSM48_MT_MM_NULL) {
+		msgb_free(msg);
+		return 0;
+	}
+
+	if (mm->state == GSM48_MM_ST_IMSI_DETACH_INIT) {
+		LOGP(DMM, LOGL_NOTICE, "DATA IND ignored during IMSI "
+			"detach.\n");
+		msgb_free(msg);
+		return 0;
+	}
+	/* pull the RR header */
+	msgb_pull(msg, sizeof(struct gsm48_rr_hdr));
+
+	/* create transaction (if not exists) and push message */
+	switch (pdisc) {
+	case GSM48_PDISC_CC:
+		rr_prim = GSM48_MMCC_DATA_IND;
+		rr_est = GSM48_MMCC_EST_IND;
+		break;
+	case GSM48_PDISC_NC_SS:
+		rr_prim = GSM48_MMSS_DATA_IND;
+		rr_est = GSM48_MMSS_EST_IND;
+		break;
+	case GSM48_PDISC_SMS:
+		rr_prim = GSM48_MMSMS_DATA_IND;
+		rr_est = GSM48_MMSMS_EST_IND;
+		break;
+	}
+	if (rr_prim != -1) {
+		uint8_t transaction_id = ((gh->proto_discr & 0xf0) ^ 0x80) >> 4;
+			/* flip */
+		struct gsm48_mm_conn *conn;
+
+		/* find transaction, if any */
+		conn = mm_conn_by_id(mm, pdisc, transaction_id);
+
+		/* create MM connection instance */
+		if (!conn) {
+			conn = mm_conn_new(mm, pdisc, transaction_id, sapi,
+				mm_conn_new_ref++);
+			rr_prim = rr_est;
+		}
+		if (!conn) {
+			msgb_free(msg);
+			return -ENOMEM;
+		}
+
+		/* push new header */
+		msgb_push(msg, sizeof(struct gsm48_mmxx_hdr));
+		mmh = (struct gsm48_mmxx_hdr *)msg->data;
+		mmh->msg_type = rr_prim;
+		mmh->ref = conn->ref;
+		mmh->transaction_id = conn->transaction_id;
+		mmh->sapi = conn->sapi;
+
+		/* go MM CONN ACTIVE state */
+		if (mm->state == GSM48_MM_ST_WAIT_NETWORK_CMD
+		 || mm->state == GSM48_MM_ST_RR_CONN_RELEASE_NA) {
+			/* stop RR release timer */
+			stop_mm_t3240(mm);
+
+			/* stop "RR connection release not allowed" timer */
+			stop_mm_t3241(mm);
+
+			new_mm_state(mm, GSM48_MM_ST_MM_CONN_ACTIVE, 0);
+		}
+	}
+
+	/* forward message */
+	switch (pdisc) {
+	case GSM48_PDISC_MM:
+		skip_ind = (gh->proto_discr & 0xf0) >> 4;
+
+		/* ignore if skip indicator is not B'0000' */
+		if (skip_ind) {
+			msgb_free(msg);
+			return 0;
+		}
+		break; /* follow the selection proceedure below */
+
+	case GSM48_PDISC_CC:
+		rc = gsm48_rcv_cc(ms, msg);
+		msgb_free(msg);
+		return rc;
+
+	case GSM48_PDISC_NC_SS:
+		rc = gsm480_rcv_ss(ms, msg);
+		msgb_free(msg);
+		return rc;
+
+	case GSM48_PDISC_SMS:
+		rc = gsm411_rcv_sms(ms, msg);
+		msgb_free(msg);
+		return rc;
+
+	case 0x0f: /* test TS 04.14 */
+		LOGP(DMM, LOGL_NOTICE, "Test protocol 0x%02x according to "
+			"TS 04.14 is not supported.\n", pdisc);
+		goto status;
+	default:
+		LOGP(DMM, LOGL_NOTICE, "Protocol type 0x%02x unsupported.\n",
+			pdisc);
+status:
+		msgb_free(msg);
+		return gsm48_mm_tx_mm_status(ms,
+			GSM48_REJECT_MSG_TYPE_NOT_IMPLEMENTED);
+	}
+
+	LOGP(DMM, LOGL_INFO, "(ms %s) Received '%s' in MM state %s\n", ms->name,
+		get_mm_name(msg_type), gsm48_mm_state_names[mm->state]);
+
+	stop_mm_t3212(mm); /* 4.4.2 */
+
+	/* 11.2 re-start pending RR release timer */
+	if (osmo_timer_pending(&mm->t3240)) {
+		stop_mm_t3240(mm);
+		start_mm_t3240(mm);
+	}
+
+	/* find function for current state and message */
+	for (i = 0; i < MMDATASLLEN; i++) {
+		if (msg_type == mmdatastatelist[i].type)
+			msg_supported = 1;
+		if ((msg_type == mmdatastatelist[i].type)
+		 && ((1 << mm->state) & mmdatastatelist[i].states))
+			break;
+	}
+	if (i == MMDATASLLEN) {
+		msgb_free(msg);
+		if (msg_supported) {
+			LOGP(DMM, LOGL_NOTICE, "Message unhandled at this "
+				"state.\n");
+			return gsm48_mm_tx_mm_status(ms,
+				GSM48_REJECT_MSG_TYPE_NOT_COMPATIBLE);
+		} else {
+			LOGP(DMM, LOGL_NOTICE, "Message not supported.\n");
+			return gsm48_mm_tx_mm_status(ms,
+				GSM48_REJECT_MSG_TYPE_NOT_IMPLEMENTED);
+		}
+	}
+
+	rc = mmdatastatelist[i].rout(ms, msg);
+
+	msgb_free(msg);
+
+	return rc;
+}
+
+/* state trasitions for mobile management events */
+static struct eventstate {
+	uint32_t	states;
+	uint32_t	substates;
+	int		type;
+	int		(*rout) (struct osmocom_ms *ms, struct msgb *msg);
+} eventstatelist[] = {
+	/* 4.2.3 return to MM IDLE */
+	{ALL_STATES - SBIT(GSM48_MM_ST_MM_IDLE), ALL_STATES,
+	 GSM48_MM_EVENT_NO_CELL_FOUND, gsm48_mm_no_cell_found},
+
+	{ALL_STATES - SBIT(GSM48_MM_ST_MM_IDLE), ALL_STATES,
+	 GSM48_MM_EVENT_CELL_SELECTED, gsm48_mm_return_idle},
+
+	/* 4.2.2.1 Normal service */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NORMAL_SERVICE),
+	 GSM48_MM_EVENT_USER_PLMN_SEL, gsm48_mm_plmn_search}, /* 4.2.1.2 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NORMAL_SERVICE),
+	 GSM48_MM_EVENT_LOST_COVERAGE, gsm48_mm_plmn_search}, /* 4.2.1.2 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NORMAL_SERVICE),
+	 GSM48_MM_EVENT_CELL_SELECTED, gsm48_mm_loc_upd_normal}, /* change */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NORMAL_SERVICE),
+	 GSM48_MM_EVENT_TIMEOUT_T3211, gsm48_mm_loc_upd},
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NORMAL_SERVICE),
+	 GSM48_MM_EVENT_TIMEOUT_T3213, gsm48_mm_loc_upd},
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NORMAL_SERVICE),
+	 GSM48_MM_EVENT_TIMEOUT_T3212, gsm48_mm_loc_upd_periodic},
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NORMAL_SERVICE),
+	 GSM48_MM_EVENT_IMSI_DETACH, gsm48_mm_imsi_detach_start},
+
+	/* 4.2.2.2 Attempt to update / Loc. upd. needed */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_ATTEMPT_UPDATE) |
+				SBIT(GSM48_MM_SST_LOC_UPD_NEEDED),
+	 GSM48_MM_EVENT_USER_PLMN_SEL, gsm48_mm_plmn_search}, /* 4.2.1.2 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_ATTEMPT_UPDATE) |
+				SBIT(GSM48_MM_SST_LOC_UPD_NEEDED),
+	 GSM48_MM_EVENT_LOST_COVERAGE, gsm48_mm_plmn_search}, /* 4.2.1.2 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_ATTEMPT_UPDATE) |
+				SBIT(GSM48_MM_SST_LOC_UPD_NEEDED),
+	 GSM48_MM_EVENT_CELL_SELECTED, gsm48_mm_loc_upd_normal}, /* change */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_ATTEMPT_UPDATE),
+	 GSM48_MM_EVENT_TIMEOUT_T3211, gsm48_mm_loc_upd},
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_ATTEMPT_UPDATE),
+	 GSM48_MM_EVENT_TIMEOUT_T3213, gsm48_mm_loc_upd},
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_ATTEMPT_UPDATE),
+	 GSM48_MM_EVENT_TIMEOUT_T3212, gsm48_mm_loc_upd_periodic},
+
+	/* 4.2.2.3 Limited service */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_LIMITED_SERVICE),
+	 GSM48_MM_EVENT_USER_PLMN_SEL, gsm48_mm_plmn_search}, /* 4.2.1.2 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_LIMITED_SERVICE),
+	 GSM48_MM_EVENT_LOST_COVERAGE, gsm48_mm_plmn_search}, /* 4.2.1.2 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_LIMITED_SERVICE),
+	 GSM48_MM_EVENT_CELL_SELECTED, gsm48_mm_loc_upd_normal}, /* if allow. */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_LIMITED_SERVICE),
+	 GSM48_MM_EVENT_TIMEOUT_T3212, gsm48_mm_loc_upd_delay_per}, /* 4.4.2 */
+
+	/* 4.2.2.4 No IMSI */
+	/* 4.2.2.5 PLMN search, normal service */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH_NORMAL),
+	 GSM48_MM_EVENT_NO_CELL_FOUND, gsm48_mm_no_cell_found}, /* 4.2.1.1 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH_NORMAL),
+	 GSM48_MM_EVENT_CELL_SELECTED, gsm48_mm_cell_selected}, /* 4.2.1.1 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH_NORMAL),
+	 GSM48_MM_EVENT_TIMEOUT_T3212, gsm48_mm_loc_upd_delay_per}, /* 4.4.2 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH_NORMAL),
+	 GSM48_MM_EVENT_IMSI_DETACH, gsm48_mm_imsi_detach_start},
+
+	/* 4.2.2.6 PLMN search */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH),
+	 GSM48_MM_EVENT_NO_CELL_FOUND, gsm48_mm_no_cell_found}, /* 4.2.1.1 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH),
+	 GSM48_MM_EVENT_CELL_SELECTED, gsm48_mm_cell_selected}, /* 4.2.1.1 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_PLMN_SEARCH),
+	 GSM48_MM_EVENT_TIMEOUT_T3212, gsm48_mm_loc_upd_delay_per}, /* 4.4.2 */
+
+	/* No cell available */
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NO_CELL_AVAIL),
+	 GSM48_MM_EVENT_CELL_SELECTED, gsm48_mm_cell_selected}, /* 4.2.1.1 */
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), SBIT(GSM48_MM_SST_NO_CELL_AVAIL),
+	 GSM48_MM_EVENT_TIMEOUT_T3212, gsm48_mm_loc_upd_delay_per}, /* 4.4.2 */
+
+	/* IMSI detach in other cases */
+	{SBIT(GSM48_MM_ST_MM_IDLE), ALL_STATES, /* silently detach */
+	 GSM48_MM_EVENT_IMSI_DETACH, gsm48_mm_imsi_detach_end},
+
+	{SBIT(GSM48_MM_ST_WAIT_OUT_MM_CONN) |
+	 SBIT(GSM48_MM_ST_MM_CONN_ACTIVE) |
+	 SBIT(GSM48_MM_ST_PROCESS_CM_SERV_P) |
+	 SBIT(GSM48_MM_ST_WAIT_REEST) |
+	 SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON) |
+	 SBIT(GSM48_MM_ST_MM_CONN_ACTIVE_VGCS) |
+	 SBIT(GSM48_MM_ST_WAIT_NETWORK_CMD), ALL_STATES, /* we can release */
+	 GSM48_MM_EVENT_IMSI_DETACH, gsm48_mm_imsi_detach_release},
+
+	{SBIT(GSM48_MM_ST_WAIT_RR_CONN_IMSI_D) |
+	 SBIT(GSM48_MM_ST_IMSI_DETACH_INIT) |
+	 SBIT(GSM48_MM_ST_IMSI_DETACH_PEND), ALL_STATES, /* ignore */
+	 GSM48_MM_EVENT_IMSI_DETACH, gsm48_mm_imsi_detach_ignore},
+
+	{ALL_STATES, ALL_STATES,
+	 GSM48_MM_EVENT_IMSI_DETACH, gsm48_mm_imsi_detach_delay},
+
+	{SBIT(GSM48_MM_ST_IMSI_DETACH_INIT), ALL_STATES,
+	 GSM48_MM_EVENT_TIMEOUT_T3220, gsm48_mm_imsi_detach_abort},
+
+	/* location update in other cases */
+	{SBIT(GSM48_MM_ST_MM_IDLE), ALL_STATES,
+	 GSM48_MM_EVENT_TIMEOUT_T3211, gsm48_mm_loc_upd_delay_retry},
+
+	{SBIT(GSM48_MM_ST_MM_IDLE), ALL_STATES,
+	 GSM48_MM_EVENT_TIMEOUT_T3213, gsm48_mm_loc_upd_delay_retry},
+
+	{ALL_STATES, ALL_STATES,
+	 GSM48_MM_EVENT_TIMEOUT_T3212, gsm48_mm_loc_upd_ignore},
+
+	{ALL_STATES - SBIT(GSM48_MM_ST_MM_IDLE), ALL_STATES,
+	 GSM48_MM_EVENT_TIMEOUT_T3210, gsm48_mm_loc_upd_timeout},
+
+	{ALL_STATES - SBIT(GSM48_MM_ST_MM_IDLE), ALL_STATES,
+	 GSM48_MM_EVENT_TIMEOUT_T3213, gsm48_mm_loc_upd_failed},
+		/* 4.4.4.9 c) (but without retry) */
+
+	/* SYSINFO event */
+	{ALL_STATES, ALL_STATES,
+	 GSM48_MM_EVENT_SYSINFO, gsm48_mm_sysinfo},
+
+	/* T3240 timed out */
+	{SBIT(GSM48_MM_ST_WAIT_NETWORK_CMD) |
+	 SBIT(GSM48_MM_ST_LOC_UPD_REJ), ALL_STATES, /* 4.4.4.8 */
+	 GSM48_MM_EVENT_TIMEOUT_T3240, gsm48_mm_abort_rr},
+
+	/* T3230 timed out */
+	{SBIT(GSM48_MM_ST_WAIT_OUT_MM_CONN) |
+	 SBIT(GSM48_MM_ST_WAIT_ADD_OUT_MM_CON), ALL_STATES,
+	 GSM48_MM_EVENT_TIMEOUT_T3230, gsm48_mm_timeout_mm_con},
+
+	/* SIM reports SRES */
+	{ALL_STATES, ALL_STATES, /* 4.3.2.2 */
+	 GSM48_MM_EVENT_AUTH_RESPONSE, gsm48_mm_tx_auth_rsp},
+
+#if 0
+	/* change in classmark is reported */
+	{ALL_STATES, ALL_STATES,
+	 GSM48_MM_EVENT_CLASSMARK_CHG, gsm48_mm_classm_chg},
+#endif
+};
+
+#define EVENTSLLEN \
+	(sizeof(eventstatelist) / sizeof(struct eventstate))
+
+static int gsm48_mm_ev(struct osmocom_ms *ms, int msg_type, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	int i, rc;
+
+	if (mm->state == GSM48_MM_ST_MM_IDLE) {
+		if (msg_type != GSM48_MM_EVENT_SYSINFO)
+			LOGP(DMM, LOGL_INFO, "(ms %s) Received '%s' event in "
+				"state MM IDLE, %s\n", ms->name,
+				get_mmevent_name(msg_type),
+				gsm48_mm_substate_names[mm->substate]);
+	} else
+		LOGP(DMM, LOGL_INFO, "(ms %s) Received '%s' event in state "
+			"%s\n", ms->name, get_mmevent_name(msg_type),
+		gsm48_mm_state_names[mm->state]);
+
+	/* Find function for current state and message */
+	for (i = 0; i < EVENTSLLEN; i++)
+		if ((msg_type == eventstatelist[i].type)
+		 && ((1 << mm->state) & eventstatelist[i].states)
+		 && ((1 << mm->substate) & eventstatelist[i].substates))
+			break;
+	if (i == EVENTSLLEN) {
+		LOGP(DMM, LOGL_NOTICE, "Message unhandled at this state.\n");
+		return 0;
+	}
+
+	rc = eventstatelist[i].rout(ms, msg);
+
+	return rc;
+}
+
+/*
+ * MM Register (SIM insert and remove)
+ */
+
+/* register new SIM card and trigger attach */
+static int gsm48_mmr_reg_req(struct osmocom_ms *ms)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct msgb *nmsg;
+
+	/* schedule insertion of SIM */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_SIM_INSERT);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm322_plmn_sendmsg(ms, nmsg);
+
+	/* 4.2.1.2 SIM is inserted in state NO IMSI */
+	if (mm->state == GSM48_MM_ST_MM_IDLE
+	 && mm->substate == GSM48_MM_SST_NO_IMSI)
+		new_mm_state(mm, GSM48_MM_ST_MM_IDLE,
+			gsm48_mm_set_plmn_search(ms));
+
+	return 0;
+}
+
+/* trigger detach of sim card */
+static int gsm48_mmr_nreg_req(struct osmocom_ms *ms)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+	struct msgb *nmsg;
+
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_IMSI_DETACH);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmevent_msg(mm->ms, nmsg);
+
+	return 0;
+}
+
+static int gsm48_rcv_mmr(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmr *mmr = (struct gsm48_mmr *)msg->data;
+	int msg_type = mmr->msg_type;
+	int rc = 0;
+
+	LOGP(DMM, LOGL_INFO, "(ms %s) Received '%s' event\n", ms->name,
+		get_mmr_name(msg_type));
+	switch(msg_type) {
+		case GSM48_MMR_REG_REQ:
+			rc = gsm48_mmr_reg_req(ms);
+			break;
+		case GSM48_MMR_NREG_REQ:
+			rc = gsm48_mmr_nreg_req(ms);
+			break;
+		default:
+			LOGP(DMM, LOGL_NOTICE, "Message unhandled.\n");
+	}
+
+	return rc;
+}
+
+
diff --git a/src/host/layer23/src/mobile/gsm48_rr.c b/src/host/layer23/src/mobile/gsm48_rr.c
new file mode 100644
index 00000000..c074323f
--- /dev/null
+++ b/src/host/layer23/src/mobile/gsm48_rr.c
@@ -0,0 +1,5668 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/* Very short description of some of the procedures:
+ *
+ * A radio ressource request causes sendig a channel request on RACH.
+ * After receiving of an immediate assignment the link will be establised.
+ * After the link is established, the dedicated mode is entered and confirmed.
+ *
+ * A Paging request also triggers the channel request as above...
+ * After the link is established, the dedicated mode is entered and indicated.
+ *
+ * During dedicated mode, messages are transferred.
+ *
+ * When an assignment command or a handover command is received, the current
+ * link is released. After release, the new channel is activated and the
+ * link is established again. After link is establised, pending messages from
+ * radio ressource are sent.
+ *
+ * When the assignment or handover fails, the old channel is activate and the
+ * link is established again. Also pending messages are sent.
+ *
+ */
+
+/* Testing delayed (immediate) assigment / handover
+ *
+ * When enabled, the starting time will be set by given frames in the future.
+ * If a starting time is given by the network, this time is ignored.
+ */
+//#define TEST_STARTING_TIMER 140
+
+/* Testing if frequency modification works correctly "after time".
+ *
+ * When enabled, the starting time will be set in the future.
+ * A wrong channel is defined "before time", so noise is received until
+ * starting time elapses.
+ * If a starting time is given by the network, this time is ignored.
+ * Also channel definitions "before time" are ignored.
+ *
+ * NOTE: TEST_STARTING_TIMER MUST be defined also.
+ */
+//#define TEST_FREQUENCY_MOD
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/core/bitvec.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/l1l2_interface.h>
+#include <osmocom/bb/common/l23_app.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/networks.h>
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/mobile/vty.h>
+#include <osmocom/bb/common/utils.h>
+
+#include <l1ctl_proto.h>
+
+static void start_rr_t_meas(struct gsm48_rrlayer *rr, int sec, int micro);
+static void stop_rr_t_starting(struct gsm48_rrlayer *rr);
+static void stop_rr_t3124(struct gsm48_rrlayer *rr);
+static int gsm48_rcv_rsl(struct osmocom_ms *ms, struct msgb *msg);
+static int gsm48_rr_dl_est(struct osmocom_ms *ms);
+static int gsm48_rr_tx_meas_rep(struct osmocom_ms *ms);
+static int gsm48_rr_set_mode(struct osmocom_ms *ms, uint8_t chan_nr,
+	uint8_t mode);
+static int gsm48_rr_rel_cnf(struct osmocom_ms *ms, struct msgb *msg);
+
+/*
+ * support
+ */
+
+#define MIN(a, b) ((a < b) ? a : b)
+
+/* decode "Power Command" (10.5.2.28) and (10.5.2.28a) */
+static int gsm48_decode_power_cmd_acc(struct gsm48_power_cmd *pc,
+	uint8_t *power_level, uint8_t *atc)
+{
+	*power_level = pc->power_level;
+	if (atc) /* only in case of 10.5.2.28a */
+		*atc = pc->atc;
+
+	return 0;
+}
+
+/* 10.5.2.38 decode Starting time IE */
+static int gsm48_decode_start_time(struct gsm48_rr_cd *cd,
+	struct gsm48_start_time *st)
+{
+	cd->start = 1;
+	cd->start_tm.t1 = st->t1;
+	cd->start_tm.t2 = st->t2;
+	cd->start_tm.t3 = (st->t3_high << 3) | st->t3_low;
+	cd->start_tm.fn = gsm_gsmtime2fn(&cd->start_tm);
+
+	return 0;
+}
+
+/* decode "BA Range" (10.5.2.1a) */
+static int gsm48_decode_ba_range(const uint8_t *ba, uint8_t ba_len,
+	uint32_t *range, uint8_t *ranges, int max_ranges)
+{
+	/* ba = pointer to IE without IE type and length octets
+	 * ba_len = number of octets
+	 * range = pointer to store decoded range
+	 * ranges = number of ranges decoded
+	 * max_ranges = maximum number of decoded ranges that can be stored
+	 */
+	uint16_t lower, higher;
+	int i, n, required_octets;
+
+	/* find out how much ba ranges will be decoded */
+	n = *ba++;
+	ba_len --;
+	required_octets = 5 * (n >> 1) + 3 * (n & 1);
+	if (required_octets > ba_len) {
+		LOGP(DRR, LOGL_NOTICE, "BA range IE too short: %d ranges "
+			"require %d octets, but only %d octets remain.\n",
+			n, required_octets, ba_len);
+		*ranges = 0;
+		return -EINVAL;
+	}
+
+	if (n > max_ranges) {
+		LOGP(DRR, LOGL_NOTICE, "BA range %d exceed the maximum number "
+			"of ranges supported by this mobile (%d).\n",
+			n, max_ranges);
+		n = max_ranges;
+	}
+
+	/* decode ranges */
+	for (i = 0; i < n; i++) {
+		if (!(i & 1)) {
+			/* decode even range number */
+			lower = *ba++ << 2;
+			lower |= (*ba >> 6);
+			higher = (*ba++ & 0x3f) << 4;
+			higher |= *ba >> 4;
+		} else {
+			lower = (*ba++ & 0x0f) << 6;
+			lower |= *ba >> 2;
+			higher = (*ba++ & 0x03) << 8;
+			higher |= *ba++;
+			/* decode odd range number */
+		}
+		*range++ = (higher << 16) | lower;
+	}
+	*ranges = n;
+
+	return 0;
+}
+
+/* decode "Cell Description" (10.5.2.2) */
+static int gsm48_decode_cell_desc(struct gsm48_cell_desc *cd, uint16_t *arfcn,
+	uint8_t *ncc, uint8_t *bcc)
+{
+	*arfcn = (cd->arfcn_hi << 8) + cd->arfcn_lo;
+	*ncc = cd->ncc;
+	*bcc = cd->bcc;
+
+	return 0;
+}
+
+/* decode "Synchronization Indication" (10.5.2.39) */
+static int gsm48_decode_sync_ind(struct gsm48_rrlayer *rr,
+	struct gsm48_sync_ind *si)
+{
+	rr->hando_sync_ind = si->si;
+	rr->hando_rot = si->rot;
+	rr->hando_nci = si->nci;
+
+	return 0;
+}
+
+/* 3.1.4.3 set sequence number and increment */
+static int gsm48_apply_v_sd(struct gsm48_rrlayer *rr, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	uint8_t pdisc = gh->proto_discr & 0x0f;
+	uint8_t v_sd;
+
+	switch (pdisc) {
+	case GSM48_PDISC_MM:
+	case GSM48_PDISC_CC:
+	case GSM48_PDISC_NC_SS:
+		/* all thre pdiscs share the same V(SD) */
+		pdisc = GSM48_PDISC_MM;
+		// fall through
+	case GSM48_PDISC_GROUP_CC:
+	case GSM48_PDISC_BCAST_CC:
+	case GSM48_PDISC_PDSS1:
+	case GSM48_PDISC_PDSS2:
+		/* extract v_sd(pdisc) */
+		v_sd = (rr->v_sd >> pdisc) & 1;
+
+		/* replace bit 7 vy v_sd */
+		gh->msg_type &= 0xbf;
+		gh->msg_type |= (v_sd << 6);
+
+		/* increment V(SD) */
+		rr->v_sd ^= (1 << pdisc);
+		LOGP(DRR, LOGL_INFO, "Using and incrementing V(SD) = %d "
+			"(pdisc %x)\n", v_sd, pdisc);
+		break;
+	case GSM48_PDISC_RR:
+	case GSM48_PDISC_SMS:
+		/* no V(VSD) is required */
+		break;
+	default:
+		LOGP(DRR, LOGL_ERROR, "Error, V(SD) of pdisc %x not handled\n",
+			pdisc);
+		return -ENOTSUP;
+	}
+
+	return 0;
+}
+
+/* set channel mode if supported, or return error cause */
+static uint8_t gsm48_rr_check_mode(struct osmocom_ms *ms, uint8_t chan_nr,
+	uint8_t mode)
+{
+	struct gsm_settings *set = &ms->settings;
+	uint8_t ch_type, ch_subch, ch_ts;
+
+	/* only complain if we use TCH/F or TCH/H */
+	rsl_dec_chan_nr(chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (ch_type != RSL_CHAN_Bm_ACCHs
+	 && ch_type != RSL_CHAN_Lm_ACCHs)
+		return 0;
+
+	switch (mode) {
+	case GSM48_CMODE_SIGN:
+		LOGP(DRR, LOGL_INFO, "Mode: signalling\n");
+		break;
+	case GSM48_CMODE_SPEECH_V1:
+		if (ch_type == RSL_CHAN_Bm_ACCHs) {
+			if (!set->full_v1) {
+				LOGP(DRR, LOGL_NOTICE, "Not supporting "
+					"full-rate speech V1\n");
+				return GSM48_RR_CAUSE_CHAN_MODE_UNACCT;
+			}
+			LOGP(DRR, LOGL_INFO, "Mode: full-rate speech V1\n");
+		} else {
+			if (!set->half_v1) {
+				LOGP(DRR, LOGL_NOTICE, "Not supporting "
+					"half-rate speech V1\n");
+				return GSM48_RR_CAUSE_CHAN_MODE_UNACCT;
+			}
+			LOGP(DRR, LOGL_INFO, "Mode: half-rate speech V1\n");
+		}
+		break;
+	case GSM48_CMODE_SPEECH_EFR:
+		if (ch_type == RSL_CHAN_Bm_ACCHs) {
+			if (!set->full_v2) {
+				LOGP(DRR, LOGL_NOTICE, "Not supporting "
+					"full-rate speech V2\n");
+				return GSM48_RR_CAUSE_CHAN_MODE_UNACCT;
+			}
+			LOGP(DRR, LOGL_INFO, "Mode: full-rate speech V2\n");
+		} else {
+			LOGP(DRR, LOGL_NOTICE, "Not supporting "
+					"half-rate speech V2\n");
+			return GSM48_RR_CAUSE_CHAN_MODE_UNACCT;
+		}
+		break;
+	case GSM48_CMODE_SPEECH_AMR:
+		if (ch_type == RSL_CHAN_Bm_ACCHs) {
+			if (!set->full_v3) {
+				LOGP(DRR, LOGL_NOTICE, "Not supporting "
+					"full-rate speech V3\n");
+				return GSM48_RR_CAUSE_CHAN_MODE_UNACCT;
+			}
+			LOGP(DRR, LOGL_INFO, "Mode: full-rate speech V3\n");
+		} else {
+			if (!set->half_v3) {
+				LOGP(DRR, LOGL_NOTICE, "Not supporting "
+					"half-rate speech V3\n");
+				return GSM48_RR_CAUSE_CHAN_MODE_UNACCT;
+			}
+			LOGP(DRR, LOGL_INFO, "Mode: half-rate speech V3\n");
+		}
+		break;
+	default:
+		LOGP(DRR, LOGL_ERROR, "Mode 0x%02x not supported!\n", mode);
+		return GSM48_RR_CAUSE_CHAN_MODE_UNACCT;
+	}
+
+	return 0;
+}
+
+/* apply new "alter_delay" in dedicated mode */
+int gsm48_rr_alter_delay(struct osmocom_ms *ms)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm_settings *set = &rr->ms->settings;
+
+	if (rr->state != GSM48_RR_ST_DEDICATED)
+		return -EINVAL;
+	l1ctl_tx_param_req(ms, rr->cd_now.ind_ta - set->alter_delay,
+		(set->alter_tx_power) ? set->alter_tx_power_value
+					: rr->cd_now.ind_tx_power);
+
+	return 0;
+}
+
+/*
+ * state transition
+ */
+
+const char *gsm48_rr_state_names[] = {
+	"idle",
+	"connection pending",
+	"dedicated",
+	"release pending",
+};
+
+static void new_rr_state(struct gsm48_rrlayer *rr, int state)
+{
+	if (state < 0 || state >=
+		(sizeof(gsm48_rr_state_names) / sizeof(char *)))
+		return;
+
+	/* must check against equal state */
+	if (rr->state == state) {
+		LOGP(DRR, LOGL_INFO, "equal state ? %s\n",
+			gsm48_rr_state_names[rr->state]);
+		return;
+	}
+
+	LOGP(DRR, LOGL_INFO, "new state %s -> %s\n",
+		gsm48_rr_state_names[rr->state], gsm48_rr_state_names[state]);
+
+	/* abort handover, in case of release of dedicated mode */
+	if (rr->state == GSM48_RR_ST_DEDICATED) {
+		/* disable handover / assign state */
+		rr->modify_state = GSM48_RR_MOD_NONE;
+		/* stop start_time_timer */
+		stop_rr_t_starting(rr);
+		/* stop handover timer */
+		stop_rr_t3124(rr);
+	}
+
+	rr->state = state;
+
+	if (state == GSM48_RR_ST_IDLE) {
+		struct msgb *msg, *nmsg;
+		struct gsm322_msg *em;
+
+		/* release dedicated mode, if any */
+		l1ctl_tx_dm_rel_req(rr->ms);
+		rr->ms->meas.rl_fail = 0;
+		rr->dm_est = 0;
+		l1ctl_tx_reset_req(rr->ms, L1CTL_RES_T_FULL);
+		/* free establish message, if any */
+		rr->rr_est_req = 0;
+		if (rr->rr_est_msg) {
+			msgb_free(rr->rr_est_msg);
+			rr->rr_est_msg = NULL;
+		}
+		/* free all pending messages */
+		while((msg = msgb_dequeue(&rr->downqueue)))
+			msgb_free(msg);
+		/* clear all descriptions of last channel */
+		memset(&rr->cd_now, 0, sizeof(rr->cd_now));
+		/* reset ciphering */
+		rr->cipher_on = 0;
+		/* reset audio mode */
+		/* tell cell selection process to return to idle mode
+		 * NOTE: this must be sent unbuffered, because it will
+		 * leave camping state, so it locks against subsequent
+		 * establishment of dedicated channel, before the
+		 * cell selection process returned to camping state
+		 * again. (after cell reselection)
+		 */
+		nmsg = gsm322_msgb_alloc(GSM322_EVENT_RET_IDLE);
+		if (!nmsg)
+			return;
+		/* return to same cell after LOC.UPD. */
+		if (rr->est_cause == RR_EST_CAUSE_LOC_UPD) {
+			em = (struct gsm322_msg *) nmsg->data;
+			em->same_cell = 1;
+		}
+		gsm322_c_event(rr->ms, nmsg);
+		msgb_free(nmsg);
+		/* reset any BA range */
+		rr->ba_ranges = 0;
+	}
+}
+
+const char *gsm48_sapi3_state_names[] = {
+	"idle",
+	"wait establishment",
+	"established",
+	"wait release",
+};
+
+static void new_sapi3_state(struct gsm48_rrlayer *rr, int state)
+{
+	if (state < 0 || state >=
+		(sizeof(gsm48_sapi3_state_names) / sizeof(char *)))
+		return;
+
+	LOGP(DRR, LOGL_INFO, "new SAPI 3 link state %s -> %s\n",
+		gsm48_sapi3_state_names[rr->sapi3_state],
+		gsm48_sapi3_state_names[state]);
+
+	rr->sapi3_state = state;
+}
+
+/*
+ * messages
+ */
+
+/* names of RR-SAP */
+static const struct value_string gsm48_rr_msg_names[] = {
+	{ GSM48_RR_EST_REQ,		"RR_EST_REQ" },
+	{ GSM48_RR_EST_IND,		"RR_EST_IND" },
+	{ GSM48_RR_EST_CNF,		"RR_EST_CNF" },
+	{ GSM48_RR_REL_IND,		"RR_REL_IND" },
+	{ GSM48_RR_SYNC_IND,		"RR_SYNC_IND" },
+	{ GSM48_RR_DATA_REQ,		"RR_DATA_REQ" },
+	{ GSM48_RR_DATA_IND,		"RR_DATA_IND" },
+	{ GSM48_RR_UNIT_DATA_IND,	"RR_UNIT_DATA_IND" },
+	{ GSM48_RR_ABORT_REQ,		"RR_ABORT_REQ" },
+	{ GSM48_RR_ABORT_IND,		"RR_ABORT_IND" },
+	{ GSM48_RR_ACT_REQ,		"RR_ACT_REQ" },
+	{ 0,				NULL }
+};
+
+const char *get_rr_name(int value)
+{
+	return get_value_string(gsm48_rr_msg_names, value);
+}
+
+/* allocate GSM 04.08 layer 3 message */
+struct msgb *gsm48_l3_msgb_alloc(void)
+{
+	struct msgb *msg;
+
+	msg = msgb_alloc_headroom(L3_ALLOC_SIZE+L3_ALLOC_HEADROOM,
+		L3_ALLOC_HEADROOM, "GSM 04.08 L3");
+	if (!msg)
+		return NULL;
+	msg->l3h = msg->data;
+
+	return msg;
+}
+
+/* allocate GSM 04.06 layer 2 RSL message */
+struct msgb *gsm48_rsl_msgb_alloc(void)
+{
+	struct msgb *msg;
+
+	msg = msgb_alloc_headroom(RSL_ALLOC_SIZE+RSL_ALLOC_HEADROOM,
+		RSL_ALLOC_HEADROOM, "GSM 04.06 RSL");
+	if (!msg)
+		return NULL;
+	msg->l2h = msg->data;
+
+	return msg;
+}
+
+/* allocate GSM 04.08 message (RR-SAP) */
+struct msgb *gsm48_rr_msgb_alloc(int msg_type)
+{
+	struct msgb *msg;
+	struct gsm48_rr_hdr *rrh;
+
+	msg = msgb_alloc_headroom(RR_ALLOC_SIZE+RR_ALLOC_HEADROOM,
+		RR_ALLOC_HEADROOM, "GSM 04.08 RR");
+	if (!msg)
+		return NULL;
+
+	rrh = (struct gsm48_rr_hdr *) msgb_put(msg, sizeof(*rrh));
+	rrh->msg_type = msg_type;
+
+	return msg;
+}
+
+/* queue message (RR-SAP) */
+int gsm48_rr_upmsg(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_mmlayer *mm = &ms->mmlayer;
+
+	msgb_enqueue(&mm->rr_upqueue, msg);
+
+	return 0;
+}
+
+/* push rsl header and send (RSL-SAP) */
+static int gsm48_send_rsl(struct osmocom_ms *ms, uint8_t msg_type,
+				struct msgb *msg, uint8_t link_id)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+
+	if (!msg->l3h) {
+		LOGP(DRR, LOGL_ERROR, "FIX l3h\n");
+		return -EINVAL;
+	}
+	rsl_rll_push_l3(msg, msg_type, rr->cd_now.chan_nr, link_id, 1);
+
+	return lapdm_rslms_recvmsg(msg, &ms->lapdm_channel);
+}
+
+/* push rsl header without L3 info and send (RSL-SAP) */
+static int gsm48_send_rsl_nol3(struct osmocom_ms *ms, uint8_t msg_type,
+				struct msgb *msg, uint8_t link_id)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+
+	rsl_rll_push_hdr(msg, msg_type, rr->cd_now.chan_nr,
+		link_id, 1);
+
+	return lapdm_rslms_recvmsg(msg, &ms->lapdm_channel);
+}
+
+/* enqueue messages (RSL-SAP) */
+static int rcv_rsl(struct msgb *msg, struct lapdm_entity *le, void *l3ctx)
+{
+	struct osmocom_ms *ms = l3ctx;
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+
+	msgb_enqueue(&rr->rsl_upqueue, msg);
+
+	return 0;
+}
+
+/* dequeue messages (RSL-SAP) */
+int gsm48_rsl_dequeue(struct osmocom_ms *ms)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct msgb *msg;
+	int work = 0;
+
+	while ((msg = msgb_dequeue(&rr->rsl_upqueue))) {
+		/* msg is freed there */
+		gsm48_rcv_rsl(ms, msg);
+		work = 1; /* work done */
+	}
+
+	return work;
+}
+
+int gsm48_rr_start_monitor(struct osmocom_ms *ms)
+{
+	ms->rrlayer.monitor = 1;
+
+	return 0;
+}
+
+int gsm48_rr_stop_monitor(struct osmocom_ms *ms)
+{
+	ms->rrlayer.monitor = 0;
+
+	return 0;
+}
+
+/* release L3 link in both directions in case of main link release */
+static int gsm48_release_sapi3_link(struct osmocom_ms *ms)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm48_rr_hdr *nrrh;
+	struct msgb *nmsg;
+	uint8_t *mode;
+
+	if (rr->sapi3_state == GSM48_RR_SAPI3ST_IDLE)
+		return 0;
+
+	LOGP(DRR, LOGL_INFO, "Main signallin link is down, so release SAPI 3 "
+		"link locally.\n");
+
+	new_sapi3_state(rr, GSM48_RR_SAPI3ST_IDLE);
+
+	/* disconnect the SAPI 3 signalling link */
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	mode = msgb_put(nmsg, 2);
+	mode[0] = RSL_IE_RELEASE_MODE;
+	mode[1] = 1; /* local release */
+	gsm48_send_rsl_nol3(ms, RSL_MT_REL_REQ, nmsg, rr->sapi3_link_id);
+
+	/* send inication to upper layer */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_REL_IND);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+	nrrh->cause = RR_REL_CAUSE_NORMAL;
+	nrrh->sapi = rr->sapi3_link_id & 7;
+	gsm48_rr_upmsg(ms, nmsg);
+
+	return 0;
+}
+
+/*
+ * timers handling
+ */
+
+/* special timer to monitor measurements */
+static void timeout_rr_meas(void *arg)
+{
+	struct gsm48_rrlayer *rr = arg;
+	struct gsm322_cellsel *cs = &rr->ms->cellsel;
+	struct rx_meas_stat *meas = &rr->ms->meas;
+	struct gsm_settings *set = &rr->ms->settings;
+	int rxlev, berr, snr;
+	uint8_t ch_type, ch_subch, ch_ts;
+	char text[256];
+
+	/* don't monitor if no cell is selcted or if we scan neighbour cells */
+	if (!cs->selected || cs->neighbour) {
+		sprintf(text, "MON: not camping on serving cell");
+		goto restart;
+	} else if (!meas->frames) {
+		sprintf(text, "MON: no cell info");
+	} else {
+		rxlev = (meas->rxlev + meas->frames / 2) / meas->frames;
+		berr = (meas->berr + meas->frames / 2) / meas->frames;
+		snr = (meas->snr + meas->frames / 2) / meas->frames;
+		sprintf(text, "MON: f=%d lev=%s snr=%2d ber=%3d "
+			"LAI=%s %s %04x ID=%04x", cs->sel_arfcn,
+			gsm_print_rxlev(rxlev), berr, snr,
+			gsm_print_mcc(cs->sel_mcc),
+			gsm_print_mnc(cs->sel_mnc), cs->sel_lac, cs->sel_id);
+		if (rr->state == GSM48_RR_ST_DEDICATED) {
+			rsl_dec_chan_nr(rr->cd_now.chan_nr, &ch_type,
+				&ch_subch, &ch_ts);
+			sprintf(text + strlen(text), " TA=%d pwr=%d TS=%d",
+			rr->cd_now.ind_ta - set->alter_delay,
+			(set->alter_tx_power) ? set->alter_tx_power_value
+					: rr->cd_now.ind_tx_power, ch_ts);
+			if (ch_type == RSL_CHAN_SDCCH8_ACCH
+			 || ch_type == RSL_CHAN_SDCCH4_ACCH)
+				sprintf(text + strlen(text), "/%d", ch_subch);
+		} else
+			gsm322_meas(rr->ms, rxlev);
+	}
+	LOGP(DRR, LOGL_INFO, "%s\n", text);
+	if (rr->monitor)
+		vty_notify(rr->ms, "%s\n", text);
+
+	if (rr->dm_est)
+		gsm48_rr_tx_meas_rep(rr->ms);
+
+restart:
+	meas->frames = meas->snr = meas->berr = meas->rxlev = 0;
+	start_rr_t_meas(rr, 1, 0);
+}
+
+/* special timer to assign / handover when starting time is reached */
+static void timeout_rr_t_starting(void *arg)
+{
+	struct gsm48_rrlayer *rr = arg;
+	struct msgb *nmsg;
+
+	LOGP(DRR, LOGL_INFO, "starting timer has fired\n");
+
+	/* open channel when starting timer of IMM.ASS has fired */
+	if (rr->modify_state == GSM48_RR_MOD_IMM_ASS) {
+		rr->modify_state = GSM48_RR_MOD_NONE;
+		gsm48_rr_dl_est(rr->ms);
+		return;
+	}
+
+	/* start suspension of current link */
+	LOGP(DRR, LOGL_INFO, "request suspension of data link\n");
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return;
+	gsm48_send_rsl(rr->ms, RSL_MT_SUSP_REQ, nmsg, 0);
+
+	/* release SAPI 3 link, if exits
+	 * FIXME: suspend and resume afterward */
+	gsm48_release_sapi3_link(rr->ms);
+}
+
+/* special timer to ensure that UA is sent before disconnecting channel */
+static void timeout_rr_t_rel_wait(void *arg)
+{
+	struct gsm48_rrlayer *rr = arg;
+
+	LOGP(DRR, LOGL_INFO, "L2 release timer has fired, done waiting\n");
+
+	/* return to idle now */
+	new_rr_state(rr, GSM48_RR_ST_IDLE);
+}
+
+/* 3.4.13.1.1: Timeout of T3110 */
+static void timeout_rr_t3110(void *arg)
+{
+	struct gsm48_rrlayer *rr = arg;
+	struct osmocom_ms *ms = rr->ms;
+	struct msgb *nmsg;
+	uint8_t *mode;
+
+	LOGP(DRR, LOGL_INFO, "timer T3110 has fired, release locally\n");
+
+	new_rr_state(rr, GSM48_RR_ST_REL_PEND);
+
+	/* disconnect the main signalling link */
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return;
+	mode = msgb_put(nmsg, 2);
+	mode[0] = RSL_IE_RELEASE_MODE;
+	mode[1] = 1; /* local release */
+	gsm48_send_rsl_nol3(ms, RSL_MT_REL_REQ, nmsg, 0);
+
+	/* release SAPI 3 link, if exits */
+	gsm48_release_sapi3_link(ms);
+
+	return;
+}
+
+static void timeout_rr_t3122(void *arg)
+{
+	LOGP(DRR, LOGL_INFO, "timer T3122 has fired\n");
+}
+
+static void timeout_rr_t3126(void *arg)
+{
+	struct gsm48_rrlayer *rr = arg;
+	struct osmocom_ms *ms = rr->ms;
+
+	LOGP(DRR, LOGL_INFO, "timer T3126 has fired\n");
+	if (rr->rr_est_req) {
+		struct msgb *msg = gsm48_rr_msgb_alloc(GSM48_RR_REL_IND);
+		struct gsm48_rr_hdr *rrh;
+
+		LOGP(DSUM, LOGL_INFO, "Requesting channel failed\n");
+		if (!msg)
+			return;
+		rrh = (struct gsm48_rr_hdr *)msg->data;
+		rrh->cause = RR_REL_CAUSE_RA_FAILURE;
+		gsm48_rr_upmsg(ms, msg);
+	}
+
+	new_rr_state(rr, GSM48_RR_ST_IDLE);
+}
+
+static void start_rr_t_meas(struct gsm48_rrlayer *rr, int sec, int micro)
+{
+	rr->t_meas.cb = timeout_rr_meas;
+	rr->t_meas.data = rr;
+	osmo_timer_schedule(&rr->t_meas, sec, micro);
+}
+
+static void start_rr_t_rel_wait(struct gsm48_rrlayer *rr, int sec, int micro)
+{
+	LOGP(DRR, LOGL_INFO, "starting T_rel_wait with %d.%03d seconds\n", sec,
+		micro / 1000);
+	rr->t_rel_wait.cb = timeout_rr_t_rel_wait;
+	rr->t_rel_wait.data = rr;
+	osmo_timer_schedule(&rr->t_rel_wait, sec, micro);
+}
+
+static void start_rr_t_starting(struct gsm48_rrlayer *rr, int sec, int micro)
+{
+	LOGP(DRR, LOGL_INFO, "starting T_starting with %d.%03d seconds\n", sec,
+		micro / 1000);
+	rr->t_starting.cb = timeout_rr_t_starting;
+	rr->t_starting.data = rr;
+	osmo_timer_schedule(&rr->t_starting, sec, micro);
+}
+
+static void start_rr_t3110(struct gsm48_rrlayer *rr, int sec, int micro)
+{
+	LOGP(DRR, LOGL_INFO, "starting T3110 with %d.%03d seconds\n", sec,
+		micro / 1000);
+	rr->t3110.cb = timeout_rr_t3110;
+	rr->t3110.data = rr;
+	osmo_timer_schedule(&rr->t3110, sec, micro);
+}
+
+static void start_rr_t3122(struct gsm48_rrlayer *rr, int sec, int micro)
+{
+	LOGP(DRR, LOGL_INFO, "starting T3122 with %d.%03d seconds\n", sec,
+		micro / 1000);
+	rr->t3122.cb = timeout_rr_t3122;
+	rr->t3122.data = rr;
+	osmo_timer_schedule(&rr->t3122, sec, micro);
+}
+
+static void start_rr_t3126(struct gsm48_rrlayer *rr, int sec, int micro)
+{
+	LOGP(DRR, LOGL_INFO, "starting T3126 with %d.%03d seconds\n", sec,
+		micro / 1000);
+	rr->t3126.cb = timeout_rr_t3126;
+	rr->t3126.data = rr;
+	osmo_timer_schedule(&rr->t3126, sec, micro);
+}
+
+static void stop_rr_t_meas(struct gsm48_rrlayer *rr)
+{
+	if (osmo_timer_pending(&rr->t_meas)) {
+		LOGP(DRR, LOGL_INFO, "stopping pending timer T_meas\n");
+		osmo_timer_del(&rr->t_meas);
+	}
+}
+
+static void stop_rr_t_starting(struct gsm48_rrlayer *rr)
+{
+	if (osmo_timer_pending(&rr->t_starting)) {
+		LOGP(DRR, LOGL_INFO, "stopping pending timer T_starting\n");
+		osmo_timer_del(&rr->t_starting);
+	}
+}
+
+static void stop_rr_t_rel_wait(struct gsm48_rrlayer *rr)
+{
+	if (osmo_timer_pending(&rr->t_rel_wait)) {
+		LOGP(DRR, LOGL_INFO, "stopping pending timer T_rel_wait\n");
+		osmo_timer_del(&rr->t_rel_wait);
+	}
+}
+
+static void stop_rr_t3110(struct gsm48_rrlayer *rr)
+{
+	if (osmo_timer_pending(&rr->t3110)) {
+		LOGP(DRR, LOGL_INFO, "stopping pending timer T3110\n");
+		osmo_timer_del(&rr->t3110);
+	}
+}
+
+static void stop_rr_t3122(struct gsm48_rrlayer *rr)
+{
+	if (osmo_timer_pending(&rr->t3122)) {
+		LOGP(DRR, LOGL_INFO, "stopping pending timer T3122\n");
+		osmo_timer_del(&rr->t3122);
+	}
+}
+
+static void stop_rr_t3124(struct gsm48_rrlayer *rr)
+{
+	if (osmo_timer_pending(&rr->t3124)) {
+		LOGP(DRR, LOGL_INFO, "stopping pending timer T3124\n");
+		osmo_timer_del(&rr->t3124);
+	}
+}
+
+static void stop_rr_t3126(struct gsm48_rrlayer *rr)
+{
+	if (osmo_timer_pending(&rr->t3126)) {
+		LOGP(DRR, LOGL_INFO, "stopping pending timer T3126\n");
+		osmo_timer_del(&rr->t3126);
+	}
+}
+
+/*
+ * status
+ */
+
+/* send rr status request */
+static int gsm48_rr_tx_rr_status(struct osmocom_ms *ms, uint8_t cause)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm48_rr_status *st;
+
+	LOGP(DRR, LOGL_INFO, "RR STATUS (cause #%d)\n", cause);
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+	st = (struct gsm48_rr_status *) msgb_put(nmsg, sizeof(*st));
+
+	gh->proto_discr = GSM48_PDISC_RR;
+	gh->msg_type = GSM48_MT_RR_CIPH_M_COMPL;
+
+	/* rr cause */
+	st->rr_cause = cause;
+
+	return gsm48_send_rsl(ms, RSL_MT_DATA_REQ, nmsg, 0);
+}
+
+/*
+ * ciphering
+ */
+
+/* send chiperhing mode complete */
+static int gsm48_rr_tx_cip_mode_cpl(struct osmocom_ms *ms, uint8_t cr)
+{
+	struct gsm_settings *set = &ms->settings;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm48_rr_hdr *nrrh;
+	uint8_t buf[11], *tlv;
+
+	LOGP(DRR, LOGL_INFO, "CIPHERING MODE COMPLETE (cr %d)\n", cr);
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+
+	gh->proto_discr = GSM48_PDISC_RR;
+	gh->msg_type = GSM48_MT_RR_CIPH_M_COMPL;
+
+	/* MI */
+	if (cr) {
+		gsm48_generate_mid_from_imsi(buf, set->imeisv);
+		/* alter MI type */
+	        buf[2] = (buf[2] & ~GSM_MI_TYPE_MASK) | GSM_MI_TYPE_IMEISV;
+		tlv = msgb_put(nmsg, 2 + buf[1]);
+		memcpy(tlv, buf, 2 + buf[1]);
+	}
+
+	gsm48_send_rsl(ms, RSL_MT_DATA_REQ, nmsg, 0);
+
+	/* send RR_SYNC_IND(ciphering) */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_SYNC_IND);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+	nrrh->cause = RR_SYNC_CAUSE_CIPHERING;
+	return gsm48_rr_upmsg(ms, nmsg);
+}
+
+/* receive ciphering mode command */
+static int gsm48_rr_rx_cip_mode_cmd(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_cip_mode_cmd *cm = (struct gsm48_cip_mode_cmd *)gh->data;
+	int payload_len = msgb_l3len(msg) - sizeof(*gh) - sizeof(*cm);
+	uint8_t sc, alg_id, cr;
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of CIPHERING MODE COMMAND "
+			"message.\n");
+		return gsm48_rr_tx_rr_status(ms,
+			GSM48_RR_CAUSE_PROT_ERROR_UNSPC);
+	}
+
+	/* cipher mode setting */
+	sc = cm->sc;
+	alg_id = cm->alg_id;
+	/* cipher mode response */
+	cr = cm->cr;
+
+	if (!sc)
+		LOGP(DRR, LOGL_INFO, "CIPHERING MODE COMMAND (sc=%u, cr=%u)\n",
+			sc, cr);
+	else
+		LOGP(DRR, LOGL_INFO, "CIPHERING MODE COMMAND (sc=%u, "
+			"algo=A5/%d cr=%u)\n", sc, alg_id + 1, cr);
+
+	/* 3.4.7.2 */
+	if (rr->cipher_on && sc) {
+		LOGP(DRR, LOGL_NOTICE, "chiphering already applied\n");
+		return gsm48_rr_tx_rr_status(ms,
+			GSM48_RR_CAUSE_PROT_ERROR_UNSPC);
+	}
+
+	/* check if we actually support this cipher */
+	if (sc && ((alg_id == GSM_CIPHER_A5_1 && !set->a5_1)
+		|| (alg_id == GSM_CIPHER_A5_2 && !set->a5_2)
+		|| (alg_id == GSM_CIPHER_A5_3 && !set->a5_3)
+		|| (alg_id == GSM_CIPHER_A5_4 && !set->a5_4)
+		|| (alg_id == GSM_CIPHER_A5_5 && !set->a5_5)
+		|| (alg_id == GSM_CIPHER_A5_6 && !set->a5_6)
+		|| (alg_id == GSM_CIPHER_A5_7 && !set->a5_7))) {
+		LOGP(DRR, LOGL_NOTICE, "algo not supported\n");
+		return gsm48_rr_tx_rr_status(ms,
+			GSM48_RR_CAUSE_PROT_ERROR_UNSPC);
+	}
+
+	/* check if we have no key */
+	if (sc && subscr->key_seq == 7) {
+		LOGP(DRR, LOGL_NOTICE, "no key available\n");
+		return gsm48_rr_tx_rr_status(ms,
+			GSM48_RR_CAUSE_PROT_ERROR_UNSPC);
+	}
+
+	/* change to ciphering */
+	rr->cipher_on = sc;
+	rr->cipher_type = alg_id;
+	if (rr->cipher_on)
+		l1ctl_tx_crypto_req(ms, rr->cd_now.chan_nr,
+			rr->cipher_type + 1, subscr->key, 8);
+	else
+		l1ctl_tx_crypto_req(ms, rr->cd_now.chan_nr,
+			0, NULL, 0);
+
+	/* response (using the new mode) */
+	return gsm48_rr_tx_cip_mode_cpl(ms, cr);
+}
+
+/*
+ * classmark
+ */
+
+/* Encode  "Classmark 3" (10.5.1.7) */
+static int gsm48_rr_enc_cm3(struct osmocom_ms *ms, uint8_t *buf, uint8_t *len)
+{
+	struct gsm_support *sup = &ms->support;
+	struct gsm_settings *set = &ms->settings;
+	struct bitvec bv;
+
+	memset(&bv, 0, sizeof(bv));
+	bv.data = buf;
+	bv.data_len = 12;
+
+	/* spare bit */
+	bitvec_set_bit(&bv, 0);
+	/* band 3 supported */
+	if (set->dcs)
+		bitvec_set_bit(&bv, ONE);
+	else
+		bitvec_set_bit(&bv, ZERO);
+	/* band 2 supported */
+	if (set->e_gsm || set->r_gsm)
+		bitvec_set_bit(&bv, ONE);
+	else
+		bitvec_set_bit(&bv, ZERO);
+	/* band 1 supported */
+	if (set->p_gsm && !(set->e_gsm || set->r_gsm))
+		bitvec_set_bit(&bv, ONE);
+	else
+		bitvec_set_bit(&bv, ZERO);
+	/* a5 bits */
+	if (set->a5_7)
+		bitvec_set_bit(&bv, ONE);
+	else
+		bitvec_set_bit(&bv, ZERO);
+	if (set->a5_6)
+		bitvec_set_bit(&bv, ONE);
+	else
+		bitvec_set_bit(&bv, ZERO);
+	if (set->a5_5)
+		bitvec_set_bit(&bv, ONE);
+	else
+		bitvec_set_bit(&bv, ZERO);
+	if (set->a5_4)
+		bitvec_set_bit(&bv, ONE);
+	else
+		bitvec_set_bit(&bv, ZERO);
+	/* radio capability */
+	if (!set->dcs && !set->p_gsm && !(set->e_gsm || set->r_gsm)) {
+		/* Fig. 10.5.7 / TS 24.0008: none of dcs, p, e, r */
+	} else
+	if (set->dcs && !set->p_gsm && !(set->e_gsm || set->r_gsm)) {
+		/* dcs only */
+		bitvec_set_uint(&bv, 0, 4);
+		bitvec_set_uint(&bv, set->class_dcs, 4);
+	} else
+	if (set->dcs && (set->p_gsm || (set->e_gsm || set->r_gsm))) {
+		/* dcs */
+		bitvec_set_uint(&bv, set->class_dcs, 4);
+		/* low band */
+		bitvec_set_uint(&bv, set->class_900, 4);
+	} else {
+		/* low band only */
+		bitvec_set_uint(&bv, 0, 4);
+		bitvec_set_uint(&bv, set->class_900, 4);
+	}
+	/* r support */
+	if (set->r_gsm) {
+		bitvec_set_bit(&bv, ONE);
+		bitvec_set_uint(&bv, set->class_900, 3);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* multi slot support */
+	if (sup->ms_sup) {
+		bitvec_set_bit(&bv, ONE);
+		bitvec_set_uint(&bv, sup->ms_sup, 5);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* ucs2 treatment */
+	if (sup->ucs2_treat) {
+		bitvec_set_bit(&bv, ONE);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* support extended measurements */
+	if (sup->ext_meas) {
+		bitvec_set_bit(&bv, ONE);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* support measurement capability */
+	if (sup->meas_cap) {
+		bitvec_set_bit(&bv, ONE);
+		bitvec_set_uint(&bv, sup->sms_val, 4);
+		bitvec_set_uint(&bv, sup->sm_val, 4);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* positioning method capability */
+	if (sup->loc_serv) {
+		bitvec_set_bit(&bv, ONE);
+		bitvec_set_bit(&bv, sup->e_otd_ass == 1);
+		bitvec_set_bit(&bv, sup->e_otd_based == 1);
+		bitvec_set_bit(&bv, sup->gps_ass == 1);
+		bitvec_set_bit(&bv, sup->gps_based == 1);
+		bitvec_set_bit(&bv, sup->gps_conv == 1);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* The following bits are described in TS 24.008 */
+	/* EDGE multi slot support */
+	if (set->edge_ms_sup) {
+		bitvec_set_bit(&bv, ONE);
+		bitvec_set_uint(&bv, set->edge_ms_sup, 5);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* EDGE support */
+	if (set->edge_psk_sup) {
+		bitvec_set_bit(&bv, ONE);
+		bitvec_set_bit(&bv, set->edge_psk_uplink == 1);
+		if (set->p_gsm || (set->e_gsm || set->r_gsm)) {
+			bitvec_set_bit(&bv, ONE);
+			bitvec_set_uint(&bv, set->class_900_edge, 2);
+		} else {
+			bitvec_set_bit(&bv, ZERO);
+		}
+		if (set->dcs || set->pcs) {
+			bitvec_set_bit(&bv, ONE);
+			bitvec_set_uint(&bv, set->class_dcs_pcs_edge, 2);
+		} else {
+			bitvec_set_bit(&bv, ZERO);
+		}
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* GSM 400 Bands */
+	if (set->gsm_480 || set->gsm_450) {
+		bitvec_set_bit(&bv, ONE);
+		bitvec_set_bit(&bv, set->gsm_480 == 1);
+		bitvec_set_bit(&bv, set->gsm_450 == 1);
+		bitvec_set_uint(&bv, set->class_400, 4);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* GSM 850 Band */
+	if (set->gsm_850) {
+		bitvec_set_bit(&bv, ONE);
+		bitvec_set_uint(&bv, set->class_850, 4);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* PCS Band */
+	if (set->pcs) {
+		bitvec_set_bit(&bv, ONE);
+		bitvec_set_uint(&bv, set->class_pcs, 4);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* RAT Capability */
+	bitvec_set_bit(&bv, set->umts_fdd == 1);
+	bitvec_set_bit(&bv, set->umts_tdd == 1);
+	bitvec_set_bit(&bv, set->cdma_2000 == 1);
+	/* DTM */
+	if (set->dtm) {
+		bitvec_set_bit(&bv, ONE);
+		bitvec_set_uint(&bv, set->class_dtm, 2);
+		bitvec_set_bit(&bv, set->dtm_mac == 1);
+		bitvec_set_bit(&bv, set->dtm_egprs == 1);
+	} else {
+		bitvec_set_bit(&bv, ZERO);
+	}
+	/* info: The max number of bits are about 80. */
+
+	/* partial bytes will be padded with zero */
+	*len = (bv.cur_bit + 7) >> 3;
+	bitvec_fill(&bv, (*len*8) - bv.cur_bit, ZERO);
+
+	return 0;
+}
+
+/* encode classmark 2 */
+int gsm48_rr_enc_cm2(struct osmocom_ms *ms, struct gsm48_classmark2 *cm,
+	uint16_t arfcn)
+{
+	struct gsm_support *sup = &ms->support;
+	struct gsm_settings *set = &ms->settings;
+
+	cm->pwr_lev = gsm48_current_pwr_lev(set, arfcn);
+	cm->a5_1 = !set->a5_1;
+	cm->es_ind = sup->es_ind;
+	cm->rev_lev = sup->rev_lev;
+	cm->fc = (set->r_gsm || set->e_gsm);
+	cm->vgcs = sup->vgcs;
+	cm->vbs = sup->vbs;
+	cm->sm_cap = set->sms_ptp;
+	cm->ss_scr = sup->ss_ind;
+	cm->ps_cap = sup->ps_cap;
+	cm->a5_2 = set->a5_2;
+	cm->a5_3 = set->a5_3;
+	cm->cmsp = sup->cmsp;
+	cm->solsa = sup->solsa;
+	cm->lcsva_cap = sup->lcsva;
+
+	return 0;
+}
+
+/* send classmark change */
+static int gsm48_rr_tx_cm_change(struct osmocom_ms *ms)
+{
+	struct gsm_support *sup = &ms->support;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm48_cm_change *cc;
+	uint8_t cm3[14], *tlv;
+
+	LOGP(DRR, LOGL_INFO, "CLASSMARK CHANGE\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+	cc = (struct gsm48_cm_change *) msgb_put(nmsg, sizeof(*cc));
+
+	gh->proto_discr = GSM48_PDISC_RR;
+	gh->msg_type = GSM48_MT_RR_CLSM_CHG;
+
+	/* classmark 2 */
+	cc->cm2_len = sizeof(cc->cm2);
+	gsm48_rr_enc_cm2(ms, &cc->cm2, rr->cd_now.arfcn);
+
+	/* classmark 3 */
+	if (set->dcs || set->pcs || set->e_gsm || set->r_gsm || set->gsm_850
+	 || set->a5_7 || set->a5_6 || set->a5_5 || set->a5_4
+	 || sup->ms_sup
+	 || sup->ucs2_treat
+	 || sup->ext_meas || sup->meas_cap
+	 || sup->loc_serv) {
+		cc->cm2.cm3 = 1;
+		cm3[0] = GSM48_IE_CLASSMARK3;
+		gsm48_rr_enc_cm3(ms, cm3 + 2, &cm3[1]);
+		tlv = msgb_put(nmsg, 2 + cm3[1]);
+		memcpy(tlv, cm3, 2 + cm3[1]);
+	}
+
+	return gsm48_send_rsl(ms, RSL_MT_DATA_REQ, nmsg, 0);
+}
+
+/* receiving classmark enquiry */
+static int gsm48_rr_rx_cm_enq(struct osmocom_ms *ms, struct msgb *msg)
+{
+	/* send classmark */
+	return gsm48_rr_tx_cm_change(ms);
+}
+
+/*
+ * random access
+ */
+
+/* start random access */
+static int gsm48_rr_chan_req(struct osmocom_ms *ms, int cause, int paging,
+	int paging_mi_type)
+{
+	struct gsm_settings *set = &ms->settings;
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+	uint8_t chan_req_val, chan_req_mask;
+	int rc;
+
+	LOGP(DSUM, LOGL_INFO, "Establish radio link due to %s request\n",
+		(paging) ? "paging" : "mobility management");
+
+	/* ignore paging, if not camping */
+	if (paging
+	 && (!cs->selected || (cs->state != GSM322_C3_CAMPED_NORMALLY
+			    && cs->state != GSM322_C7_CAMPED_ANY_CELL))) {
+		LOGP(DRR, LOGL_INFO, "Paging, but not camping, ignore.\n");
+	 	return -EINVAL;
+	}
+
+	/* ignore channel request while not camping on a cell */
+	if (!cs->selected) {
+		LOGP(DRR, LOGL_INFO, "Channel request rejected, we did not "
+			"properly select the serving cell.\n");
+
+		goto rel_ind;
+	}
+
+	/* tell cell selection process to leave idle mode
+	 * NOTE: this must be sent unbuffered, because the state may not
+	 * change until idle mode is left
+	 */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_LEAVE_IDLE);
+	if (!nmsg)
+		return -ENOMEM;
+	rc = gsm322_c_event(ms, nmsg);
+	msgb_free(nmsg);
+	if (rc) {
+		if (paging)
+			return rc;
+		LOGP(DRR, LOGL_INFO, "Failed to leave IDLE mode.\n");
+		goto undefined;
+	}
+
+	/* 3.3.1.1.2 */
+	new_rr_state(rr, GSM48_RR_ST_CONN_PEND);
+
+	/* set assignment state */
+	rr->wait_assign = 0;
+
+	/* number of retransmissions (with first transmission) */
+	rr->n_chan_req = s->max_retrans + 1;
+
+	/* generate CHAN REQ (9.1.8) */
+	switch (cause) {
+	case RR_EST_CAUSE_EMERGENCY:
+		/* 101xxxxx */
+		chan_req_mask = 0x1f;
+		chan_req_val = 0xa0;
+		LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (Emergency call)\n",
+			chan_req_val);
+		break;
+	case RR_EST_CAUSE_REESTAB_TCH_F:
+		chan_req_mask = 0x1f;
+		chan_req_val = 0xc0;
+		LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (re-establish "
+			"TCH/F)\n", chan_req_val);
+		break;
+	case RR_EST_CAUSE_REESTAB_TCH_H:
+		if (s->neci) {
+			chan_req_mask = 0x03;
+			chan_req_val = 0x68;
+			LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x "
+				"(re-establish TCH/H with NECI)\n",
+				chan_req_val);
+		} else {
+			chan_req_mask = 0x1f;
+			chan_req_val = 0xc0;
+			LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x "
+				"(re-establish TCH/H no NECI)\n", chan_req_val);
+		}
+		break;
+	case RR_EST_CAUSE_REESTAB_2_TCH_H:
+		if (s->neci) {
+			chan_req_mask = 0x03;
+			chan_req_val = 0x6c;
+			LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x "
+				"(re-establish TCH/H+TCH/H with NECI)\n",
+				chan_req_val);
+		} else {
+			chan_req_mask = 0x1f;
+			chan_req_val = 0xc0;
+			LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x "
+				"(re-establish TCH/H+TCH/H no NECI)\n",
+				chan_req_val);
+		}
+		break;
+	case RR_EST_CAUSE_ANS_PAG_ANY:
+		chan_req_mask = 0x1f;
+		chan_req_val = 0x80;
+		LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (PAGING "
+			"Any channel)\n", chan_req_val);
+		break;
+	case RR_EST_CAUSE_ANS_PAG_SDCCH:
+		chan_req_mask = 0x0f;
+		chan_req_val = 0x10;
+		LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (PAGING SDCCH)\n",
+			chan_req_val);
+		break;
+	case RR_EST_CAUSE_ANS_PAG_TCH_F:
+		switch (set->ch_cap) {
+		case GSM_CAP_SDCCH:
+			chan_req_mask = 0x0f;
+			chan_req_val = 0x10;
+			break;
+		case GSM_CAP_SDCCH_TCHF:
+			chan_req_mask = 0x1f;
+			chan_req_val = 0x80;
+			break;
+		default:
+			chan_req_mask = 0x0f;
+			chan_req_val = 0x20;
+			break;
+		}
+		LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (PAGING TCH/F)\n",
+			chan_req_val);
+		break;
+	case RR_EST_CAUSE_ANS_PAG_TCH_ANY:
+		switch (set->ch_cap) {
+		case GSM_CAP_SDCCH:
+			chan_req_mask = 0x0f;
+			chan_req_val = 0x10;
+			break;
+		case GSM_CAP_SDCCH_TCHF:
+			chan_req_mask = 0x1f;
+			chan_req_val = 0x80;
+			break;
+		default:
+			chan_req_mask = 0x0f;
+			chan_req_val = 0x30;
+			break;
+		}
+		LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (PAGING TCH/H or "
+				"TCH/F)\n", chan_req_val);
+		break;
+	case RR_EST_CAUSE_ORIG_TCHF:
+		/* ms supports no dual rate */
+		chan_req_mask = 0x1f;
+		chan_req_val = 0xe0;
+		LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (Orig TCH/F)\n",
+			chan_req_val);
+		break;
+	case RR_EST_CAUSE_LOC_UPD:
+		if (s->neci) {
+			chan_req_mask = 0x0f;
+			chan_req_val = 0x00;
+			LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (Location "
+				"Update with NECI)\n", chan_req_val);
+		} else {
+			chan_req_mask = 0x1f;
+			chan_req_val = 0x00;
+			LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (Location "
+				"Update no NECI)\n", chan_req_val);
+		}
+		break;
+	case RR_EST_CAUSE_OTHER_SDCCH:
+		if (s->neci) {
+			chan_req_mask = 0x0f;
+			chan_req_val = 0x10;
+			LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (OHTER "
+				"with NECI)\n", chan_req_val);
+		} else {
+			chan_req_mask = 0x1f;
+			chan_req_val = 0xe0;
+			LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: %02x (OTHER "
+				"no NECI)\n", chan_req_val);
+		}
+		break;
+	default:
+		if (!rr->rr_est_req) /* no request from MM */
+			return -EINVAL;
+
+		LOGP(DRR, LOGL_INFO, "CHANNEL REQUEST: with unknown "
+			"establishment cause: %d\n", cause);
+		undefined:
+		LOGP(DSUM, LOGL_INFO, "Requesting channel failed\n");
+
+rel_ind:
+		nmsg = gsm48_rr_msgb_alloc(GSM48_RR_REL_IND);
+		if (!nmsg)
+			return -ENOMEM;
+		nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+		nrrh->cause = RR_REL_CAUSE_UNDEFINED;
+		gsm48_rr_upmsg(ms, nmsg);
+		new_rr_state(rr, GSM48_RR_ST_IDLE);
+		return -EINVAL;
+	}
+
+	/* store value, mask and history */
+	rr->chan_req_val = chan_req_val;
+	rr->chan_req_mask = chan_req_mask;
+	rr->cr_hist[2].valid = 0;
+	rr->cr_hist[1].valid = 0;
+	rr->cr_hist[0].valid = 0;
+
+	/* store establishment cause, so 'choose cell' selects the last cell
+	 * after location updating */
+	rr->est_cause = cause;
+
+	/* store paging mobile identity type, if we respond to paging */
+	rr->paging_mi_type = paging_mi_type;
+
+	/* if channel is already active somehow */
+	if (cs->ccch_state == GSM322_CCCH_ST_DATA)
+		return gsm48_rr_tx_rand_acc(ms, NULL);
+
+	return 0;
+}
+
+/* send first/next channel request in conn pend state */
+int gsm48_rr_tx_rand_acc(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = &ms->cellsel.sel_si;
+	struct gsm_settings *set = &ms->settings;
+	struct msgb *nmsg;
+	struct abis_rsl_cchan_hdr *ncch;
+	int slots;
+	uint8_t chan_req;
+	uint8_t tx_power;
+
+	/* already assigned */
+	if (rr->wait_assign == 2)
+		return 0;
+
+	/* store frame number */
+	if (msg) {
+		struct abis_rsl_cchan_hdr *ch = msgb_l2(msg);
+		struct gsm48_req_ref *ref =
+				(struct gsm48_req_ref *) (ch->data + 1);
+
+		if (msgb_l2len(msg) < sizeof(*ch) + sizeof(*ref)) {
+			LOGP(DRR, LOGL_ERROR, "CHAN_CNF too slort\n");
+			return -EINVAL;
+		}
+
+		/* shift history and store */
+		memcpy(&(rr->cr_hist[2]), &(rr->cr_hist[1]),
+			sizeof(struct gsm48_cr_hist));
+		memcpy(&(rr->cr_hist[1]), &(rr->cr_hist[0]),
+			sizeof(struct gsm48_cr_hist));
+		rr->cr_hist[0].valid = 1;
+		rr->cr_hist[0].ref.ra = rr->cr_ra;
+		rr->cr_hist[0].ref.t1 = ref->t1;
+		rr->cr_hist[0].ref.t2 = ref->t2;
+		rr->cr_hist[0].ref.t3_low = ref->t3_low;
+		rr->cr_hist[0].ref.t3_high = ref->t3_high;
+	}
+
+	if (cs->ccch_state != GSM322_CCCH_ST_DATA) {
+		LOGP(DRR, LOGL_INFO, "CCCH channel activation failed.\n");
+fail:
+		if (rr->rr_est_req) {
+			struct msgb *msg =
+				gsm48_rr_msgb_alloc(GSM48_RR_REL_IND);
+			struct gsm48_rr_hdr *rrh;
+
+			LOGP(DSUM, LOGL_INFO, "Requesting channel failed\n");
+			if (!msg)
+				return -ENOMEM;
+			rrh = (struct gsm48_rr_hdr *)msg->data;
+			rrh->cause = RR_REL_CAUSE_RA_FAILURE;
+			gsm48_rr_upmsg(ms, msg);
+		}
+
+		new_rr_state(rr, GSM48_RR_ST_IDLE);
+
+		return 0;
+	}
+
+	if (!s || !s->si3 || !s->tx_integer) {
+		LOGP(DRR, LOGL_NOTICE, "Not enough SYSINFO\n");
+		goto fail;
+	}
+
+	if (rr->state == GSM48_RR_ST_IDLE) {
+		LOGP(DRR, LOGL_INFO, "MM already released RR.\n");
+
+		return 0;
+	}
+
+	LOGP(DRR, LOGL_INFO, "RANDOM ACCESS (requests left %d)\n",
+		rr->n_chan_req);
+
+	if (!rr->n_chan_req) {
+		LOGP(DRR, LOGL_INFO, "Done with sending RANDOM ACCESS "
+			"bursts\n");
+		if (!osmo_timer_pending(&rr->t3126))
+			start_rr_t3126(rr, 5, 0); /* TODO improve! */
+		return 0;
+	}
+	rr->n_chan_req--;
+
+	if (rr->wait_assign == 0) {
+		/* first random acces, without delay of slots */
+		slots = 0;
+		rr->wait_assign = 1;
+	} else {
+		/* subsequent random acces, with slots from table 3.1 */
+		switch(s->tx_integer) {
+		case 3: case 8: case 14: case 50:
+			if (s->ccch_conf != 1) /* not combined CCCH */
+				slots = 55;
+			else
+				slots = 41;
+			break;
+		case 4: case 9: case 16:
+			if (s->ccch_conf != 1)
+				slots = 76;
+			else
+				slots = 52;
+			break;
+		case 5: case 10: case 20:
+			if (s->ccch_conf != 1)
+				slots = 109;
+			else
+				slots = 58;
+			break;
+		case 6: case 11: case 25:
+			if (s->ccch_conf != 1)
+				slots = 163;
+			else
+				slots = 86;
+			break;
+		default:
+			if (s->ccch_conf != 1)
+				slots = 217;
+			else
+				slots = 115;
+			break;
+		}
+	}
+
+	chan_req = layer23_random();
+	chan_req &= rr->chan_req_mask;
+	chan_req |= rr->chan_req_val;
+
+	LOGP(DRR, LOGL_INFO, "RANDOM ACCESS (Tx-integer %d combined %s "
+		"S(lots) %d ra 0x%02x)\n", s->tx_integer,
+		(s->ccch_conf == 1) ? "yes": "no", slots, chan_req);
+
+	slots = (random() % s->tx_integer) + slots;
+
+	/* (re)send CHANNEL RQD with new randiom */
+	nmsg = gsm48_rsl_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	ncch = (struct abis_rsl_cchan_hdr *) msgb_put(nmsg, sizeof(*ncch)
+							+ 4 + 2 + 2);
+	rsl_init_cchan_hdr(ncch, RSL_MT_CHAN_RQD);
+	ncch->chan_nr = RSL_CHAN_RACH;
+	ncch->data[0] = RSL_IE_REQ_REFERENCE;
+	ncch->data[1] = chan_req;
+	ncch->data[2] = (slots >> 8) | ((s->ccch_conf == 1) << 7);
+	ncch->data[3] = slots;
+	ncch->data[4] = RSL_IE_ACCESS_DELAY;
+	ncch->data[5] = set->alter_delay; /* (-)=earlier (+)=later */
+	ncch->data[6] = RSL_IE_MS_POWER;
+	if (set->alter_tx_power) {
+		tx_power = set->alter_tx_power_value;
+		LOGP(DRR, LOGL_INFO, "Use alternative tx-power %d (%d dBm)\n",
+			tx_power,
+			ms_pwr_dbm(gsm_arfcn2band(cs->arfcn), tx_power));
+	} else {
+		tx_power = s->ms_txpwr_max_cch;
+		/* power offset in case of DCS1800 */
+		if (s->po && (cs->arfcn & 1023) >= 512
+		 && (cs->arfcn & 1023) <= 885) {
+			LOGP(DRR, LOGL_INFO, "Use MS-TXPWR-MAX-CCH power value "
+				"%d (%d dBm) with offset %d dBm\n", tx_power,
+				ms_pwr_dbm(gsm_arfcn2band(cs->arfcn), tx_power),
+				s->po_value * 2);
+			/* use reserved bits 7,8 for offset (+ X * 2dB) */
+			tx_power |= s->po_value << 6;
+		} else
+			LOGP(DRR, LOGL_INFO, "Use MS-TXPWR-MAX-CCH power value "
+				"%d (%d dBm)\n", tx_power,
+				ms_pwr_dbm(gsm_arfcn2band(cs->arfcn),
+							tx_power));
+	}
+	ncch->data[7] = tx_power;
+
+	/* set initial indications */
+	rr->cd_now.ind_tx_power = s->ms_txpwr_max_cch;
+	rr->cd_now.ind_ta = set->alter_delay;
+
+	/* store ra until confirmed, then copy it with time into cr_hist */
+	rr->cr_ra = chan_req;
+
+	return lapdm_rslms_recvmsg(nmsg, &ms->lapdm_channel);
+}
+
+/*
+ * system information
+ */
+
+/* send sysinfo event to other layers */
+static int gsm48_new_sysinfo(struct osmocom_ms *ms, uint8_t type)
+{
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct msgb *nmsg;
+	struct gsm322_msg *em;
+
+	/* update list of measurements, if BA(SACCH) is complete and new */
+	if (s
+	 && (type == GSM48_MT_RR_SYSINFO_5
+	  || type == GSM48_MT_RR_SYSINFO_5bis
+	  || type == GSM48_MT_RR_SYSINFO_5ter)
+	 && s->si5
+	 && (!s->nb_ext_ind_si5 || s->si5bis)) {
+		struct gsm48_rr_meas *rrmeas = &ms->rrlayer.meas;
+		int n = 0, i, refer_pcs;
+
+		LOGP(DRR, LOGL_NOTICE, "Complete set of SI5* for BA(%d)\n",
+			s->nb_ba_ind_si5);
+		rrmeas->nc_num = 0;
+		refer_pcs = gsm_refer_pcs(cs->arfcn, s);
+
+		/* collect channels from freq list (1..1023,0) */
+		for (i = 1; i <= 1024; i++) {
+			if ((s->freq[i & 1023].mask & FREQ_TYPE_REP)) {
+				if (n == 32) {
+					LOGP(DRR, LOGL_NOTICE, "SI5* report "
+						"exceeds 32 BCCHs\n");
+					break;
+				}
+				if (refer_pcs && i >= 512 && i <= 810)
+					rrmeas->nc_arfcn[n] = i | ARFCN_PCS;
+				else
+					rrmeas->nc_arfcn[n] = i & 1023;
+				rrmeas->nc_rxlev_dbm[n] = -128;
+				LOGP(DRR, LOGL_NOTICE, "SI5* report arfcn %s\n",
+					gsm_print_arfcn(rrmeas->nc_arfcn[n]));
+				n++;
+			}
+		}
+		rrmeas->nc_num = n;
+	}
+
+	/* send sysinfo event to other layers */
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_SYSINFO);
+	if (!nmsg)
+		return -ENOMEM;
+	em = (struct gsm322_msg *) nmsg->data;
+	em->sysinfo = type;
+	gsm322_cs_sendmsg(ms, nmsg);
+
+	/* if not camping, we don't care about SI */
+	if (ms->cellsel.neighbour
+	 || (ms->cellsel.state != GSM322_C3_CAMPED_NORMALLY
+	  && ms->cellsel.state != GSM322_C7_CAMPED_ANY_CELL))
+		return 0;
+
+	/* send timer info to location update process */
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_SYSINFO);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmevent_msg(ms, nmsg);
+
+	return 0;
+}
+
+/* receive "SYSTEM INFORMATION 1" message (9.1.31) */
+static int gsm48_rr_rx_sysinfo1(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_1 *si = msgb_l3(msg);
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	int payload_len = msgb_l3len(msg) - sizeof(*si);
+
+	if (!s) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, SYSTEM INFORMATION 1 "
+			"ignored\n");
+		return -EINVAL;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of SYSTEM INFORMATION 1 "
+			"message.\n");
+		return -EINVAL;
+	}
+
+	if (!memcmp(si, s->si1_msg, MIN(msgb_l3len(msg), sizeof(s->si1_msg))))
+		return 0;
+
+	gsm48_decode_sysinfo1(s, si, msgb_l3len(msg));
+
+	LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 1\n");
+
+	return gsm48_new_sysinfo(ms, si->header.system_information);
+}
+
+/* receive "SYSTEM INFORMATION 2" message (9.1.32) */
+static int gsm48_rr_rx_sysinfo2(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_2 *si = msgb_l3(msg);
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	int payload_len = msgb_l3len(msg) - sizeof(*si);
+
+	if (!s) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, SYSTEM INFORMATION 2 "
+			"ignored\n");
+		return -EINVAL;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of SYSTEM INFORMATION 2 "
+			"message.\n");
+		return -EINVAL;
+	}
+
+	if (!memcmp(si, s->si2_msg, MIN(msgb_l3len(msg), sizeof(s->si2_msg))))
+		return 0;
+
+	gsm48_decode_sysinfo2(s, si, msgb_l3len(msg));
+
+	LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 2\n");
+
+	return gsm48_new_sysinfo(ms, si->header.system_information);
+}
+
+/* receive "SYSTEM INFORMATION 2bis" message (9.1.33) */
+static int gsm48_rr_rx_sysinfo2bis(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_2bis *si = msgb_l3(msg);
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	int payload_len = msgb_l3len(msg) - sizeof(*si);
+
+	if (!s) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, SYSTEM INFORMATION 2bis"
+			" ignored\n");
+		return -EINVAL;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of SYSTEM INFORMATION 2bis "
+			"message.\n");
+		return -EINVAL;
+	}
+
+	if (!memcmp(si, s->si2b_msg, MIN(msgb_l3len(msg), sizeof(s->si2b_msg))))
+		return 0;
+
+	gsm48_decode_sysinfo2bis(s, si, msgb_l3len(msg));
+
+	LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 2bis\n");
+
+	return gsm48_new_sysinfo(ms, si->header.system_information);
+}
+
+/* receive "SYSTEM INFORMATION 2ter" message (9.1.34) */
+static int gsm48_rr_rx_sysinfo2ter(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_2ter *si = msgb_l3(msg);
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	int payload_len = msgb_l3len(msg) - sizeof(*si);
+
+	if (!s) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, SYSTEM INFORMATION 2ter"
+			" ignored\n");
+		return -EINVAL;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of SYSTEM INFORMATION 2ter "
+			"message.\n");
+		return -EINVAL;
+	}
+
+	if (!memcmp(si, s->si2t_msg, MIN(msgb_l3len(msg), sizeof(s->si2t_msg))))
+		return 0;
+
+	gsm48_decode_sysinfo2ter(s, si, msgb_l3len(msg));
+
+	LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 2ter\n");
+
+	return gsm48_new_sysinfo(ms, si->header.system_information);
+}
+
+/* receive "SYSTEM INFORMATION 3" message (9.1.35) */
+static int gsm48_rr_rx_sysinfo3(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_3 *si = msgb_l3(msg);
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	int payload_len = msgb_l3len(msg) - sizeof(*si);
+
+	if (!s) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, SYSTEM INFORMATION 3 "
+			"ignored\n");
+		return -EINVAL;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of SYSTEM INFORMATION 3 "
+			"message.\n");
+		return -EINVAL;
+	}
+
+	if (!memcmp(si, s->si3_msg, MIN(msgb_l3len(msg), sizeof(s->si3_msg))))
+		return 0;
+
+	gsm48_decode_sysinfo3(s, si, msgb_l3len(msg));
+
+	if (cs->ccch_mode == CCCH_MODE_NONE) {
+		cs->ccch_mode = (s->ccch_conf == 1) ? CCCH_MODE_COMBINED :
+			CCCH_MODE_NON_COMBINED;
+		LOGP(DRR, LOGL_NOTICE, "Changing CCCH_MODE to %d\n",
+			cs->ccch_mode);
+		l1ctl_tx_ccch_mode_req(ms, cs->ccch_mode);
+	}
+
+	return gsm48_new_sysinfo(ms, si->header.system_information);
+}
+
+/* receive "SYSTEM INFORMATION 4" message (9.1.36) */
+static int gsm48_rr_rx_sysinfo4(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_4 *si = msgb_l3(msg);
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	int payload_len = msgb_l3len(msg) - sizeof(*si);
+
+	if (!s) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, SYSTEM INFORMATION 4 "
+			"ignored\n");
+		return -EINVAL;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of SYSTEM INFORMATION 4 "
+			"message.\n");
+		return -EINVAL;
+	}
+
+	if (!memcmp(si, s->si4_msg, MIN(msgb_l3len(msg), sizeof(s->si4_msg))))
+		return 0;
+
+	gsm48_decode_sysinfo4(s, si, msgb_l3len(msg));
+
+	LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 4 (mcc %s mnc %s "
+		"lac 0x%04x)\n", gsm_print_mcc(s->mcc),
+		gsm_print_mnc(s->mnc), s->lac);
+
+	return gsm48_new_sysinfo(ms, si->header.system_information);
+}
+
+/* receive "SYSTEM INFORMATION 5" message (9.1.37) */
+static int gsm48_rr_rx_sysinfo5(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_5 *si = msgb_l3(msg);
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	int payload_len = msgb_l3len(msg) - sizeof(*si);
+
+	if (!s) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, SYSTEM INFORMATION 5 "
+			"ignored\n");
+		return -EINVAL;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of SYSTEM INFORMATION 5 "
+			"message.\n");
+		return -EINVAL;
+	}
+
+	if (!memcmp(si, s->si5_msg, MIN(msgb_l3len(msg), sizeof(s->si5_msg))))
+		return 0;
+
+	gsm48_decode_sysinfo5(s, si, msgb_l3len(msg));
+
+	LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 5\n");
+
+	return gsm48_new_sysinfo(ms, si->system_information);
+}
+
+/* receive "SYSTEM INFORMATION 5bis" message (9.1.38) */
+static int gsm48_rr_rx_sysinfo5bis(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_5bis *si = msgb_l3(msg);
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	int payload_len = msgb_l3len(msg) - sizeof(*si);
+
+	if (!s) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, SYSTEM INFORMATION 5bis"
+			" ignored\n");
+		return -EINVAL;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of SYSTEM INFORMATION 5bis "
+			"message.\n");
+		return -EINVAL;
+	}
+
+	if (!memcmp(si, s->si5b_msg, MIN(msgb_l3len(msg),
+			sizeof(s->si5b_msg))))
+		return 0;
+
+	gsm48_decode_sysinfo5bis(s, si, msgb_l3len(msg));
+
+	LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 5bis\n");
+
+	return gsm48_new_sysinfo(ms, si->system_information);
+}
+
+/* receive "SYSTEM INFORMATION 5ter" message (9.1.39) */
+static int gsm48_rr_rx_sysinfo5ter(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_5ter *si = msgb_l3(msg);
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	int payload_len = msgb_l3len(msg) - sizeof(*si);
+
+	if (!s) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, SYSTEM INFORMATION 5ter"
+			" ignored\n");
+		return -EINVAL;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of SYSTEM INFORMATION 5ter "
+			"message.\n");
+		return -EINVAL;
+	}
+
+	if (!memcmp(si, s->si5t_msg, MIN(msgb_l3len(msg),
+			sizeof(s->si5t_msg))))
+		return 0;
+
+	gsm48_decode_sysinfo5ter(s, si, msgb_l3len(msg));
+
+	LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 5ter\n");
+
+	return gsm48_new_sysinfo(ms, si->system_information);
+}
+
+/* receive "SYSTEM INFORMATION 6" message (9.1.39) */
+static int gsm48_rr_rx_sysinfo6(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_6 *si = msgb_l3(msg);
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	struct rx_meas_stat *meas = &ms->meas;
+	int payload_len = msgb_l3len(msg) - sizeof(*si);
+
+	if (!s) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, SYSTEM INFORMATION 6 "
+			"ignored\n");
+		return -EINVAL;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of SYSTEM INFORMATION 6 "
+			"message.\n");
+		return -EINVAL;
+	}
+
+	if (!memcmp(si, s->si6_msg, MIN(msgb_l3len(msg), sizeof(s->si6_msg))))
+		return 0;
+
+	gsm48_decode_sysinfo6(s, si, msgb_l3len(msg));
+
+	LOGP(DRR, LOGL_INFO, "New SYSTEM INFORMATION 6 (mcc %s mnc %s "
+		"lac 0x%04x SACCH-timeout %d)\n", gsm_print_mcc(s->mcc),
+		gsm_print_mnc(s->mnc), s->lac, s->sacch_radio_link_timeout);
+
+	meas->rl_fail = meas->s = s->sacch_radio_link_timeout;
+	LOGP(DRR, LOGL_INFO, "using (new) SACCH timeout %d\n", meas->rl_fail);
+
+	return gsm48_new_sysinfo(ms, si->system_information);
+}
+
+/*
+ * paging
+ */
+
+/* paging channel request */
+static int gsm48_rr_chan2cause[4] = {
+	RR_EST_CAUSE_ANS_PAG_ANY,
+	RR_EST_CAUSE_ANS_PAG_SDCCH,
+	RR_EST_CAUSE_ANS_PAG_TCH_F,
+	RR_EST_CAUSE_ANS_PAG_TCH_ANY
+};
+
+/* given LV of mobile identity is checked agains ms */
+static uint8_t gsm_match_mi(struct osmocom_ms *ms, uint8_t *mi)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	char imsi[16];
+	uint32_t tmsi;
+	uint8_t mi_type;
+
+	if (mi[0] < 1)
+		return 0;
+	mi_type = mi[1] & GSM_MI_TYPE_MASK;
+	switch (mi_type) {
+	case GSM_MI_TYPE_TMSI:
+		if (mi[0] < 5)
+			return 0;
+		memcpy(&tmsi, mi+2, 4);
+		if (ms->subscr.tmsi == ntohl(tmsi)
+		 && ms->subscr.mcc == cs->sel_mcc
+		 && ms->subscr.mnc == cs->sel_mnc
+		 && ms->subscr.lac == cs->sel_lac) {
+			LOGP(DPAG, LOGL_INFO, " TMSI %08x matches\n",
+				ntohl(tmsi));
+
+			return mi_type;
+		} else
+			LOGP(DPAG, LOGL_INFO, " TMSI %08x (not for us)\n",
+				ntohl(tmsi));
+		break;
+	case GSM_MI_TYPE_IMSI:
+		gsm48_mi_to_string(imsi, sizeof(imsi), mi + 1, mi[0]);
+		if (!strcmp(imsi, ms->subscr.imsi)) {
+			LOGP(DPAG, LOGL_INFO, " IMSI %s matches\n", imsi);
+
+			return mi_type;
+		} else
+			LOGP(DPAG, LOGL_INFO, " IMSI %s (not for us)\n", imsi);
+		break;
+	default:
+		LOGP(DPAG, LOGL_NOTICE, "Paging with unsupported MI type %d.\n",
+			mi_type);
+	}
+
+	return 0;
+}
+
+/* 9.1.22 PAGING REQUEST 1 message received */
+static int gsm48_rr_rx_pag_req_1(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_paging1 *pa = msgb_l3(msg);
+	int payload_len = msgb_l3len(msg) - sizeof(*pa);
+	int chan_1, chan_2;
+	uint8_t *mi, mi_type;
+
+	/* empty paging request */
+	if (payload_len >= 2 && (pa->data[1] & GSM_MI_TYPE_MASK) == 0)
+		return 0;
+
+	/* 3.3.1.1.2: ignore paging while not camping on a cell */
+	if (rr->state != GSM48_RR_ST_IDLE || !cs->selected
+	 || (cs->state != GSM322_C3_CAMPED_NORMALLY
+	  && cs->state != GSM322_C7_CAMPED_ANY_CELL)
+	 || cs->neighbour) {
+		LOGP(DRR, LOGL_INFO, "PAGING ignored, we are not camping.\n");
+
+		return 0;
+	}
+	LOGP(DPAG, LOGL_INFO, "PAGING REQUEST 1\n");
+
+	if (payload_len < 2) {
+		short_read:
+		LOGP(DRR, LOGL_NOTICE, "Short read of PAGING REQUEST 1 "
+			"message.\n");
+
+		return -EINVAL;
+	}
+
+	/* channel needed */
+	chan_1 = pa->cneed1;
+	chan_2 = pa->cneed2;
+	/* first MI */
+	mi = pa->data;
+	if (payload_len < mi[0] + 1)
+		goto short_read;
+	if ((mi_type = gsm_match_mi(ms, mi)) > 0)
+		return gsm48_rr_chan_req(ms, gsm48_rr_chan2cause[chan_1], 1,
+			mi_type);
+	/* second MI */
+	payload_len -= mi[0] + 1;
+	mi = pa->data + mi[0] + 1;
+	if (payload_len < 2)
+		return 0;
+	if (mi[0] != GSM48_IE_MOBILE_ID)
+		return 0;
+	if (payload_len < mi[1] + 2)
+		goto short_read;
+	if ((mi_type = gsm_match_mi(ms, mi + 1)) > 0)
+		return gsm48_rr_chan_req(ms, gsm48_rr_chan2cause[chan_2], 1,
+			mi_type);
+
+	return 0;
+}
+
+/* 9.1.23 PAGING REQUEST 2 message received */
+static int gsm48_rr_rx_pag_req_2(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_paging2 *pa = msgb_l3(msg);
+	int payload_len = msgb_l3len(msg) - sizeof(*pa);
+	uint8_t *mi, mi_type;
+	int chan_1, chan_2, chan_3;
+
+	/* 3.3.1.1.2: ignore paging while not camping on a cell */
+	if (rr->state != GSM48_RR_ST_IDLE || !cs->selected
+	 || (cs->state != GSM322_C3_CAMPED_NORMALLY
+	  && cs->state != GSM322_C7_CAMPED_ANY_CELL)
+	 || cs->neighbour) {
+		LOGP(DRR, LOGL_INFO, "PAGING ignored, we are not camping.\n");
+
+		return 0;
+	}
+	LOGP(DPAG, LOGL_INFO, "PAGING REQUEST 2\n");
+
+	if (payload_len < 0) {
+		short_read:
+		LOGP(DRR, LOGL_NOTICE, "Short read of PAGING REQUEST 2 "
+			"message .\n");
+
+		return -EINVAL;
+	}
+
+	/* channel needed */
+	chan_1 = pa->cneed1;
+	chan_2 = pa->cneed2;
+	/* first MI */
+	if (ms->subscr.tmsi == ntohl(pa->tmsi1)
+	 && ms->subscr.mcc == cs->sel_mcc
+	 && ms->subscr.mnc == cs->sel_mnc
+	 && ms->subscr.lac == cs->sel_lac) {
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x matches\n", ntohl(pa->tmsi1));
+		return gsm48_rr_chan_req(ms, gsm48_rr_chan2cause[chan_1], 1,
+			GSM_MI_TYPE_TMSI);
+	} else
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x (not for us)\n",
+			ntohl(pa->tmsi1));
+	/* second MI */
+	if (ms->subscr.tmsi == ntohl(pa->tmsi2)
+	 && ms->subscr.mcc == cs->sel_mcc
+	 && ms->subscr.mnc == cs->sel_mnc
+	 && ms->subscr.lac == cs->sel_lac) {
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x matches\n", ntohl(pa->tmsi2));
+		return gsm48_rr_chan_req(ms, gsm48_rr_chan2cause[chan_2], 1,
+			GSM_MI_TYPE_TMSI);
+	} else
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x (not for us)\n",
+			ntohl(pa->tmsi2));
+	/* third MI */
+	mi = pa->data;
+	if (payload_len < 2)
+		return 0;
+	if (mi[0] != GSM48_IE_MOBILE_ID)
+		return 0;
+	if (payload_len < mi[1] + 2 + 1) /* must include "channel needed" */
+		goto short_read;
+	chan_3 = mi[mi[1] + 2] & 0x03; /* channel needed */
+	if ((mi_type = gsm_match_mi(ms, mi + 1)) > 0)
+		return gsm48_rr_chan_req(ms, gsm48_rr_chan2cause[chan_3], 1,
+			mi_type);
+
+	return 0;
+}
+
+/* 9.1.24 PAGING REQUEST 3 message received */
+static int gsm48_rr_rx_pag_req_3(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_paging3 *pa = msgb_l3(msg);
+	int payload_len = msgb_l3len(msg) - sizeof(*pa);
+	int chan_1, chan_2, chan_3, chan_4;
+
+	/* 3.3.1.1.2: ignore paging while not camping on a cell */
+	if (rr->state != GSM48_RR_ST_IDLE || !cs->selected
+	 || (cs->state != GSM322_C3_CAMPED_NORMALLY
+	  && cs->state != GSM322_C7_CAMPED_ANY_CELL)
+	 || cs->neighbour) {
+		LOGP(DRR, LOGL_INFO, "PAGING ignored, we are not camping.\n");
+
+		return 0;
+	}
+	LOGP(DPAG, LOGL_INFO, "PAGING REQUEST 3\n");
+
+	if (payload_len < 0) { /* must include "channel needed", part of *pa */
+		LOGP(DRR, LOGL_NOTICE, "Short read of PAGING REQUEST 3 "
+			"message .\n");
+
+		return -EINVAL;
+	}
+
+	/* channel needed */
+	chan_1 = pa->cneed1;
+	chan_2 = pa->cneed2;
+	chan_3 = pa->cneed3;
+	chan_4 = pa->cneed4;
+	/* first MI */
+	if (ms->subscr.tmsi == ntohl(pa->tmsi1)
+	 && ms->subscr.mcc == cs->sel_mcc
+	 && ms->subscr.mnc == cs->sel_mnc
+	 && ms->subscr.lac == cs->sel_lac) {
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x matches\n", ntohl(pa->tmsi1));
+		return gsm48_rr_chan_req(ms, gsm48_rr_chan2cause[chan_1], 1,
+			GSM_MI_TYPE_TMSI);
+	} else
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x (not for us)\n",
+			ntohl(pa->tmsi1));
+	/* second MI */
+	if (ms->subscr.tmsi == ntohl(pa->tmsi2)
+	 && ms->subscr.mcc == cs->sel_mcc
+	 && ms->subscr.mnc == cs->sel_mnc
+	 && ms->subscr.lac == cs->sel_lac) {
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x matches\n", ntohl(pa->tmsi2));
+		return gsm48_rr_chan_req(ms, gsm48_rr_chan2cause[chan_2], 1,
+			GSM_MI_TYPE_TMSI);
+	} else
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x (not for us)\n",
+			ntohl(pa->tmsi2));
+	/* thrid MI */
+	if (ms->subscr.tmsi == ntohl(pa->tmsi3)
+	 && ms->subscr.mcc == cs->sel_mcc
+	 && ms->subscr.mnc == cs->sel_mnc
+	 && ms->subscr.lac == cs->sel_lac) {
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x matches\n", ntohl(pa->tmsi3));
+		return gsm48_rr_chan_req(ms, gsm48_rr_chan2cause[chan_3], 1,
+			GSM_MI_TYPE_TMSI);
+	} else
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x (not for us)\n",
+			ntohl(pa->tmsi3));
+	/* fourth MI */
+	if (ms->subscr.tmsi == ntohl(pa->tmsi4)
+	 && ms->subscr.mcc == cs->sel_mcc
+	 && ms->subscr.mnc == cs->sel_mnc
+	 && ms->subscr.lac == cs->sel_lac) {
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x matches\n", ntohl(pa->tmsi4));
+		return gsm48_rr_chan_req(ms, gsm48_rr_chan2cause[chan_4], 1,
+			GSM_MI_TYPE_TMSI);
+	} else
+		LOGP(DPAG, LOGL_INFO, " TMSI %08x (not for us)\n",
+			ntohl(pa->tmsi4));
+
+	return 0;
+}
+
+/*
+ * (immediate) assignment
+ */
+
+/* match request reference agains request history */
+static int gsm48_match_ra(struct osmocom_ms *ms, struct gsm48_req_ref *ref)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	int i;
+	uint8_t ia_t1, ia_t2, ia_t3;
+	uint8_t cr_t1, cr_t2, cr_t3;
+
+	for (i = 0; i < 3; i++) {
+		/* filter confirmed RACH requests only */
+		if (rr->cr_hist[i].valid && ref->ra == rr->cr_hist[i].ref.ra) {
+		 	ia_t1 = ref->t1;
+		 	ia_t2 = ref->t2;
+		 	ia_t3 = (ref->t3_high << 3) | ref->t3_low;
+			ref = &rr->cr_hist[i].ref;
+		 	cr_t1 = ref->t1;
+		 	cr_t2 = ref->t2;
+		 	cr_t3 = (ref->t3_high << 3) | ref->t3_low;
+			if (ia_t1 == cr_t1 && ia_t2 == cr_t2
+			 && ia_t3 == cr_t3) {
+		 		LOGP(DRR, LOGL_INFO, "request %02x matches "
+					"(fn=%d,%d,%d)\n", ref->ra, ia_t1,
+					ia_t2, ia_t3);
+				return 1;
+			} else
+		 		LOGP(DRR, LOGL_INFO, "request %02x matches "
+					"but not frame number (IMM.ASS "
+					"fn=%d,%d,%d != RACH fn=%d,%d,%d)\n",
+					ref->ra, ia_t1, ia_t2, ia_t3,
+					cr_t1, cr_t2, cr_t3);
+		}
+	}
+
+	return 0;
+}
+
+/* 9.1.18 IMMEDIATE ASSIGNMENT is received */
+static int gsm48_rr_rx_imm_ass(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm48_imm_ass *ia = msgb_l3(msg);
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	int ma_len = msgb_l3len(msg) - sizeof(*ia);
+	uint8_t ch_type, ch_subch, ch_ts;
+	struct gsm48_rr_cd cd;
+#ifndef TEST_STARTING_TIMER
+	uint8_t *st, st_len;
+#endif
+
+	/* ignore imm.ass. while not camping on a cell */
+	if (!cs->selected || cs->neighbour || !s) {
+		LOGP(DRR, LOGL_INFO, "IMMEDIATED ASSGINMENT ignored, we are "
+			"have not proper selected the serving cell.\n");
+
+		return 0;
+	}
+
+	memset(&cd, 0, sizeof(cd));
+	cd.ind_tx_power = rr->cd_now.ind_tx_power;
+
+	if (ma_len < 0 /* mobile allocation IE must be included */
+	 || ia->mob_alloc_len > ma_len) { /* short read of IE */
+		LOGP(DRR, LOGL_NOTICE, "Short read of IMMEDIATE ASSIGNMENT "
+			"message.\n");
+		return -EINVAL;
+	}
+	if (ia->mob_alloc_len > 8) {
+		LOGP(DRR, LOGL_NOTICE, "Moble allocation in IMMEDIATE "
+			"ASSIGNMENT too large.\n");
+		return -EINVAL;
+	}
+
+	/* starting time */
+#ifdef TEST_STARTING_TIMER
+	cd.start = 1;
+	cd.start_tm.fn = (ms->meas.last_fn + TEST_STARTING_TIMER) % 42432;
+	LOGP(DRR, LOGL_INFO, " TESTING: starting time ahead\n");
+#else
+	st_len = ma_len - ia->mob_alloc_len;
+	st = ia->mob_alloc + ia->mob_alloc_len;
+	if (st_len >= 3 && st[0] == GSM48_IE_START_TIME)
+		gsm48_decode_start_time(&cd, (struct gsm48_start_time *)(st+1));
+#endif
+
+	/* decode channel description */
+	LOGP(DRR, LOGL_INFO, "IMMEDIATE ASSIGNMENT:\n");
+	cd.chan_nr = ia->chan_desc.chan_nr;
+	rsl_dec_chan_nr(cd.chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (ia->chan_desc.h0.h) {
+		cd.h = 1;
+		gsm48_decode_chan_h1(&ia->chan_desc, &cd.tsc, &cd.maio,
+			&cd.hsn);
+		LOGP(DRR, LOGL_INFO, " (ta %d/%dm ra 0x%02x chan_nr 0x%02x "
+			"MAIO %u HSN %u TS %u SS %u TSC %u)\n",
+			ia->timing_advance,
+			ia->timing_advance * GSM_TA_CM / 100,
+			ia->req_ref.ra, ia->chan_desc.chan_nr, cd.maio,
+			cd.hsn, ch_ts, ch_subch, cd.tsc);
+	} else {
+		cd.h = 0;
+		gsm48_decode_chan_h0(&ia->chan_desc, &cd.tsc, &cd.arfcn);
+		if (gsm_refer_pcs(cs->arfcn, s))
+			cd.arfcn |= ARFCN_PCS;
+		LOGP(DRR, LOGL_INFO, " (ta %d/%dm ra 0x%02x chan_nr 0x%02x "
+			"ARFCN %s TS %u SS %u TSC %u)\n",
+			ia->timing_advance,
+			ia->timing_advance * GSM_TA_CM / 100,
+			ia->req_ref.ra, ia->chan_desc.chan_nr,
+			gsm_print_arfcn(cd.arfcn), ch_ts, ch_subch, cd.tsc);
+	}
+
+	/* 3.3.1.1.2: ignore assignment while idle */
+	if (rr->state != GSM48_RR_ST_CONN_PEND || rr->wait_assign == 0) {
+		LOGP(DRR, LOGL_INFO, "Not for us, no request.\n");
+		return 0;
+	}
+
+	if (rr->wait_assign == 2) {
+		LOGP(DRR, LOGL_INFO, "Ignoring, channel already assigned.\n");
+		return 0;
+	}
+
+	/* request ref */
+	if (gsm48_match_ra(ms, &ia->req_ref)) {
+		/* channel description */
+		memcpy(&rr->cd_now, &cd, sizeof(rr->cd_now));
+		/* timing advance */
+		rr->cd_now.ind_ta = ia->timing_advance;
+		/* mobile allocation */
+		memcpy(&rr->cd_now.mob_alloc_lv, &ia->mob_alloc_len,
+			ia->mob_alloc_len + 1);
+		rr->wait_assign = 2;
+		/* reset scheduler */
+		LOGP(DRR, LOGL_INFO, "resetting scheduler\n");
+		l1ctl_tx_reset_req(ms, L1CTL_RES_T_SCHED);
+
+		return gsm48_rr_dl_est(ms);
+	}
+	LOGP(DRR, LOGL_INFO, "Request, but not for us.\n");
+
+	return 0;
+}
+
+/* 9.1.19 IMMEDIATE ASSIGNMENT EXTENDED is received */
+static int gsm48_rr_rx_imm_ass_ext(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	struct gsm48_imm_ass_ext *ia = msgb_l3(msg);
+	int ma_len = msgb_l3len(msg) - sizeof(*ia);
+	uint8_t ch_type, ch_subch, ch_ts;
+	struct gsm48_rr_cd cd1, cd2;
+#ifndef TEST_STARTING_TIMER
+	uint8_t *st, st_len;
+#endif
+
+	/* ignore imm.ass.ext while not camping on a cell */
+	if (!cs->selected || cs->neighbour || !s) {
+		LOGP(DRR, LOGL_INFO, "IMMEDIATED ASSGINMENT ignored, we are "
+			"have not proper selected the serving cell.\n");
+
+		return 0;
+	}
+
+	memset(&cd1, 0, sizeof(cd1));
+	cd1.ind_tx_power = rr->cd_now.ind_tx_power;
+	memset(&cd2, 0, sizeof(cd2));
+	cd2.ind_tx_power = rr->cd_now.ind_tx_power;
+
+	if (ma_len < 0 /* mobile allocation IE must be included */
+	 || ia->mob_alloc_len > ma_len) { /* short read of IE */
+		LOGP(DRR, LOGL_NOTICE, "Short read of IMMEDIATE ASSIGNMENT "
+			"EXTENDED message.\n");
+		return -EINVAL;
+	}
+	if (ia->mob_alloc_len > 4) {
+		LOGP(DRR, LOGL_NOTICE, "Moble allocation in IMMEDIATE "
+			"ASSIGNMENT EXTENDED too large.\n");
+		return -EINVAL;
+	}
+
+#ifdef TEST_STARTING_TIMER
+	cd1.start = 1;
+	cd2.start_tm.fn = (ms->meas.last_fn + TEST_STARTING_TIMER) % 42432;
+	memcpy(&cd2, &cd1, sizeof(cd2));
+	LOGP(DRR, LOGL_INFO, " TESTING: starting time ahead\n");
+#else
+	/* starting time */
+	st_len = ma_len - ia->mob_alloc_len;
+	st = ia->mob_alloc + ia->mob_alloc_len;
+	if (st_len >= 3 && st[0] == GSM48_IE_START_TIME) {
+		gsm48_decode_start_time(&cd1,
+			(struct gsm48_start_time *)(st+1));
+		memcpy(&cd2, &cd1, sizeof(cd2));
+	}
+#endif
+
+	/* decode channel description */
+	LOGP(DRR, LOGL_INFO, "IMMEDIATE ASSIGNMENT EXTENDED:\n");
+	cd1.chan_nr = ia->chan_desc1.chan_nr;
+	rsl_dec_chan_nr(cd1.chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (ia->chan_desc1.h0.h) {
+		cd1.h = 1;
+		gsm48_decode_chan_h1(&ia->chan_desc1, &cd1.tsc, &cd1.maio,
+			&cd1.hsn);
+		LOGP(DRR, LOGL_INFO, " assignment 1 (ta %d/%dm ra 0x%02x "
+			"chan_nr 0x%02x MAIO %u HSN %u TS %u SS %u TSC %u)\n",
+			ia->timing_advance1,
+			ia->timing_advance1 * GSM_TA_CM / 100,
+			ia->req_ref1.ra, ia->chan_desc1.chan_nr, cd1.maio,
+			cd1.hsn, ch_ts, ch_subch, cd1.tsc);
+	} else {
+		cd1.h = 0;
+		gsm48_decode_chan_h0(&ia->chan_desc1, &cd1.tsc, &cd1.arfcn);
+		if (gsm_refer_pcs(cs->arfcn, s))
+			cd1.arfcn |= ARFCN_PCS;
+		LOGP(DRR, LOGL_INFO, " assignment 1 (ta %d/%dm ra 0x%02x "
+			"chan_nr 0x%02x ARFCN %s TS %u SS %u TSC %u)\n",
+			ia->timing_advance1,
+			ia->timing_advance1 * GSM_TA_CM / 100,
+			ia->req_ref1.ra, ia->chan_desc1.chan_nr,
+			gsm_print_arfcn(cd1.arfcn), ch_ts, ch_subch, cd1.tsc);
+	}
+	cd2.chan_nr = ia->chan_desc2.chan_nr;
+	rsl_dec_chan_nr(cd2.chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (ia->chan_desc2.h0.h) {
+		cd2.h = 1;
+		gsm48_decode_chan_h1(&ia->chan_desc2, &cd2.tsc, &cd2.maio,
+			&cd2.hsn);
+		LOGP(DRR, LOGL_INFO, " assignment 2 (ta %d/%dm ra 0x%02x "
+			"chan_nr 0x%02x MAIO %u HSN %u TS %u SS %u TSC %u)\n",
+			ia->timing_advance2,
+			ia->timing_advance2 * GSM_TA_CM / 100,
+			ia->req_ref2.ra, ia->chan_desc2.chan_nr, cd2.maio,
+			cd2.hsn, ch_ts, ch_subch, cd2.tsc);
+	} else {
+		cd2.h = 0;
+		gsm48_decode_chan_h0(&ia->chan_desc2, &cd2.tsc, &cd2.arfcn);
+		if (gsm_refer_pcs(cs->arfcn, s))
+			cd2.arfcn |= ARFCN_PCS;
+		LOGP(DRR, LOGL_INFO, " assignment 2 (ta %d/%dm ra 0x%02x "
+			"chan_nr 0x%02x ARFCN %s TS %u SS %u TSC %u)\n",
+			ia->timing_advance2,
+			ia->timing_advance2 * GSM_TA_CM / 100,
+			ia->req_ref2.ra, ia->chan_desc2.chan_nr,
+			gsm_print_arfcn(cd2.arfcn), ch_ts, ch_subch, cd2.tsc);
+	}
+
+	/* 3.3.1.1.2: ignore assignment while idle */
+	if (rr->state != GSM48_RR_ST_CONN_PEND || rr->wait_assign == 0) {
+		LOGP(DRR, LOGL_INFO, "Not for us, no request.\n");
+		return 0;
+	}
+
+	if (rr->wait_assign == 2) {
+		LOGP(DRR, LOGL_INFO, "Ignoring, channel already assigned.\n");
+		return 0;
+	}
+
+	/* request ref 1 */
+	if (gsm48_match_ra(ms, &ia->req_ref1)) {
+		/* channel description */
+		memcpy(&rr->cd_now, &cd1, sizeof(rr->cd_now));
+		/* timing advance */
+		rr->cd_now.ind_ta = ia->timing_advance1;
+		/* mobile allocation */
+		memcpy(&rr->cd_now.mob_alloc_lv, &ia->mob_alloc_len,
+			ia->mob_alloc_len + 1);
+		rr->wait_assign = 2;
+		/* reset scheduler */
+		LOGP(DRR, LOGL_INFO, "resetting scheduler\n");
+		l1ctl_tx_reset_req(ms, L1CTL_RES_T_SCHED);
+
+		return gsm48_rr_dl_est(ms);
+	}
+	/* request ref 2 */
+	if (gsm48_match_ra(ms, &ia->req_ref2)) {
+		/* channel description */
+		memcpy(&rr->cd_now, &cd2, sizeof(rr->cd_now));
+		/* timing advance */
+		rr->cd_now.ind_ta = ia->timing_advance2;
+		/* mobile allocation */
+		memcpy(&rr->cd_now.mob_alloc_lv, &ia->mob_alloc_len,
+			ia->mob_alloc_len + 1);
+		rr->wait_assign = 2;
+		/* reset scheduler */
+		LOGP(DRR, LOGL_INFO, "resetting scheduler\n");
+		l1ctl_tx_reset_req(ms, L1CTL_RES_T_SCHED);
+
+		return gsm48_rr_dl_est(ms);
+	}
+	LOGP(DRR, LOGL_INFO, "Request, but not for us.\n");
+
+	return 0;
+}
+
+/* 9.1.20 IMMEDIATE ASSIGNMENT REJECT is received */
+static int gsm48_rr_rx_imm_ass_rej(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm48_imm_ass_rej *ia = msgb_l3(msg);
+	int payload_len = msgb_l3len(msg) - sizeof(*ia);
+	int i;
+	struct gsm48_req_ref *req_ref;
+	uint8_t t3122_value;
+
+	/* 3.3.1.1.2: ignore assignment while idle */
+	if (rr->state != GSM48_RR_ST_CONN_PEND || rr->wait_assign == 0)
+		return 0;
+
+	if (rr->wait_assign == 2) {
+		return 0;
+	}
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of IMMEDIATE ASSIGNMENT "
+			"REJECT message.\n");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < 4; i++) {
+		/* request reference */
+		req_ref = (struct gsm48_req_ref *)
+				(((uint8_t *)&ia->req_ref1) + i * 4);
+		LOGP(DRR, LOGL_INFO, "IMMEDIATE ASSIGNMENT REJECT "
+			"(ref 0x%02x)\n", req_ref->ra);
+		if (gsm48_match_ra(ms, req_ref)) {
+			/* wait indication */
+			t3122_value = *(((uint8_t *)&ia->wait_ind1) + i * 4);
+			if (t3122_value)
+				start_rr_t3122(rr, t3122_value, 0);
+			/* start timer 3126 if not already */
+			if (!osmo_timer_pending(&rr->t3126))
+				start_rr_t3126(rr, 5, 0); /* TODO improve! */
+			/* stop assignmnet requests */
+			rr->n_chan_req = 0;
+
+			/* wait until timer 3126 expires, then release
+			 * or wait for channel assignment */
+			return 0;
+		}
+	}
+
+	return 0;
+}
+
+/* 9.1.1 ADDITIONAL ASSIGMENT is received */
+static int gsm48_rr_rx_add_ass(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_add_ass *aa = (struct gsm48_add_ass *)gh->data;
+	int payload_len = msgb_l3len(msg) - sizeof(*gh) - sizeof(*aa);
+	struct tlv_parsed tp;
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of ADDITIONAL ASSIGNMENT "
+			"message.\n");
+		return gsm48_rr_tx_rr_status(ms,
+			GSM48_RR_CAUSE_PROT_ERROR_UNSPC);
+	}
+	tlv_parse(&tp, &gsm48_rr_att_tlvdef, aa->data, payload_len, 0, 0);
+
+	return gsm48_rr_tx_rr_status(ms, GSM48_RR_CAUSE_PROT_ERROR_UNSPC);
+}
+
+/*
+ * measturement reports
+ */
+
+static int gsm48_rr_tx_meas_rep(struct osmocom_ms *ms)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm48_sysinfo *s = ms->cellsel.si;
+	struct rx_meas_stat *meas = &rr->ms->meas;
+	struct gsm48_rr_meas *rrmeas = &rr->meas;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm48_meas_res *mr;
+	uint8_t serv_rxlev_full = 0, serv_rxlev_sub = 0, serv_rxqual_full = 0,
+		serv_rxqual_sub = 0;
+	uint8_t ta, tx_power;
+	uint8_t rep_ba = 0, rep_valid = 0, meas_valid = 0;
+	uint8_t n = 0, rxlev_nc[6], bsic_nc[6], bcch_f_nc[6];
+
+	/* just in case! */
+	if (!s)
+		return -EINVAL;
+
+	/* check if SI5* is completely received, check BA-IND */
+	if (s->si5
+	 && (!s->nb_ext_ind_si5 || s->si5bis)) {
+		rep_ba = s->nb_ba_ind_si5;
+		if ((s->si5bis && s->nb_ext_ind_si5
+		  && s->nb_ba_ind_si5bis != rep_ba)
+		 || (s->si5ter && s->nb_ba_ind_si5ter != rep_ba)) {
+			LOGP(DRR, LOGL_NOTICE, "BA-IND missmatch on SI5*");
+		} else
+			rep_valid = 1;
+	}
+
+	/* check for valid measurements, any frame must exist */
+	if (meas->frames) {
+		meas_valid = 1;
+		serv_rxlev_full = serv_rxlev_sub =
+			(meas->rxlev + (meas->frames / 2)) / meas->frames;
+		serv_rxqual_full = serv_rxqual_sub = 0; // FIXME
+	}
+
+	memset(&rxlev_nc, 0, sizeof(rxlev_nc));
+	memset(&bsic_nc, 0, sizeof(bsic_nc));
+	memset(&bcch_f_nc, 0, sizeof(bcch_f_nc));
+	if (rep_valid) {
+		int8_t strongest, current;
+		uint8_t ncc;
+		int i, index;
+
+#if 0
+		/* FIXME: multi-band reporting, if not: 0 = normal reporting */
+		uint8_t multi_rep = s->si5ter ?
+			s->nb_multi_rep_si5ter : 0;
+#endif
+
+		/* get 6 strongest measurements */
+		strongest = 127; /* infinite */
+		for (n = 0; n < 6; n++) {
+			current = -128; /* -infinite */
+			index = 0;
+			for (i = 0; i < rrmeas->nc_num; i++) {
+				/* only check if NCC is permitted */
+				ncc = rrmeas->nc_bsic[i] >> 3;
+				if ((s->nb_ncc_permitted_si6 & (1 << ncc))
+				 && rrmeas->nc_rxlev_dbm[i] > current
+				 && rrmeas->nc_rxlev_dbm[i] < strongest) {
+					current = rrmeas->nc_rxlev_dbm[i];
+					index = i;
+				}
+			}
+			if (current == -128) /* no more found */
+				break;
+			rxlev_nc[n] = rrmeas->nc_rxlev_dbm[index] + 110;
+			bsic_nc[n] = rrmeas->nc_bsic[index];
+			bcch_f_nc[n] = index;
+		}
+	}
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+
+	/* use indicated tx-power and TA (not the altered ones) */
+	tx_power = rr->cd_now.ind_tx_power;
+	// FIXME: degrade power to the max supported level
+	ta = rr->cd_now.ind_ta;
+
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+	mr = (struct gsm48_meas_res *) msgb_put(nmsg, sizeof(*mr));
+
+	gh->proto_discr = GSM48_PDISC_RR;
+	gh->msg_type = GSM48_MT_RR_MEAS_REP;
+
+	/* measurement results */
+	mr->rxlev_full = serv_rxlev_full;
+	mr->rxlev_sub = serv_rxlev_sub;
+	mr->rxqual_full = serv_rxqual_full;
+	mr->rxqual_sub = serv_rxqual_sub;
+	mr->dtx_used = 0; // FIXME: no DTX yet
+	mr->ba_used = rep_ba;
+	mr->meas_valid = !meas_valid; /* 0 = valid */
+	if (rep_valid) {
+		mr->no_nc_n_hi = n >> 2;
+		mr->no_nc_n_lo = n & 3;
+	} else {
+		/* no results for serving cells */
+		mr->no_nc_n_hi = 1;
+		mr->no_nc_n_lo = 3;
+	}
+	mr->rxlev_nc1 = rxlev_nc[0];
+	mr->rxlev_nc2_hi = rxlev_nc[1] >> 1;
+	mr->rxlev_nc2_lo = rxlev_nc[1] & 1;
+	mr->rxlev_nc3_hi = rxlev_nc[2] >> 2;
+	mr->rxlev_nc3_lo = rxlev_nc[2] & 3;
+	mr->rxlev_nc4_hi = rxlev_nc[3] >> 3;
+	mr->rxlev_nc4_lo = rxlev_nc[3] & 7;
+	mr->rxlev_nc5_hi = rxlev_nc[4] >> 4;
+	mr->rxlev_nc5_lo = rxlev_nc[4] & 15;
+	mr->rxlev_nc6_hi = rxlev_nc[5] >> 5;
+	mr->rxlev_nc6_lo = rxlev_nc[5] & 31;
+	mr->bsic_nc1_hi = bsic_nc[0] >> 3;
+	mr->bsic_nc1_lo = bsic_nc[0] & 7;
+	mr->bsic_nc2_hi = bsic_nc[1] >> 4;
+	mr->bsic_nc2_lo = bsic_nc[1] & 15;
+	mr->bsic_nc3_hi = bsic_nc[2] >> 5;
+	mr->bsic_nc3_lo = bsic_nc[2] & 31;
+	mr->bsic_nc4 = bsic_nc[3];
+	mr->bsic_nc5 = bsic_nc[4];
+	mr->bsic_nc6 = bsic_nc[5];
+	mr->bcch_f_nc1 = bcch_f_nc[0];
+	mr->bcch_f_nc2 = bcch_f_nc[1];
+	mr->bcch_f_nc3 = bcch_f_nc[2];
+	mr->bcch_f_nc4 = bcch_f_nc[3];
+	mr->bcch_f_nc5_hi = bcch_f_nc[4] >> 1;
+	mr->bcch_f_nc5_lo = bcch_f_nc[4] & 1;
+	mr->bcch_f_nc6_hi = bcch_f_nc[5] >> 2;
+	mr->bcch_f_nc6_lo = bcch_f_nc[5] & 3;
+
+	LOGP(DRR, LOGL_INFO, "MEAS REP: pwr=%d TA=%d meas-invalid=%d "
+		"rxlev-full=%d rxlev-sub=%d rxqual-full=%d rxqual-sub=%d "
+		"dtx %d ba %d no-ncell-n %d\n", tx_power, ta, mr->meas_valid,
+		mr->rxlev_full - 110, mr->rxlev_sub - 110,
+		mr->rxqual_full, mr->rxqual_sub, mr->dtx_used, mr->ba_used,
+		(mr->no_nc_n_hi << 2) | mr->no_nc_n_lo);
+
+	msgb_tv16_push(nmsg, RSL_IE_L3_INFO,
+		nmsg->tail - (uint8_t *)msgb_l3(nmsg));
+	msgb_push(nmsg, 2 + 2);
+	nmsg->data[0] = RSL_IE_TIMING_ADVANCE;
+	nmsg->data[1] = ta;
+	nmsg->data[2] = RSL_IE_MS_POWER;
+	nmsg->data[3] = tx_power;
+	rsl_rll_push_hdr(nmsg, RSL_MT_UNIT_DATA_REQ, rr->cd_now.chan_nr,
+		0x40, 1);
+
+	return lapdm_rslms_recvmsg(nmsg, &ms->lapdm_channel);
+}
+
+/*
+ * link establishment and release
+ */
+
+/* process "Loss Of Signal" */
+int gsm48_rr_los(struct osmocom_ms *ms)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	uint8_t *mode;
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+
+	LOGP(DSUM, LOGL_INFO, "Radio link lost signal\n");
+
+	/* stop T3211 if running */
+	stop_rr_t3110(rr);
+
+	switch(rr->state) {
+	case GSM48_RR_ST_CONN_PEND:
+		LOGP(DRR, LOGL_INFO, "LOS during RACH request\n");
+
+		/* stop pending RACH timer */
+		stop_rr_t3126(rr);
+		break;
+	case GSM48_RR_ST_DEDICATED:
+		LOGP(DRR, LOGL_INFO, "LOS during dedicated mode, release "
+			"locally\n");
+
+		new_rr_state(rr, GSM48_RR_ST_REL_PEND);
+
+		/* release message */
+		rel_local:
+		nmsg = gsm48_l3_msgb_alloc();
+		if (!nmsg)
+			return -ENOMEM;
+		mode = msgb_put(nmsg, 2);
+		mode[0] = RSL_IE_RELEASE_MODE;
+		mode[1] = 1; /* local release */
+		/* start release */
+		gsm48_send_rsl_nol3(ms, RSL_MT_REL_REQ, nmsg, 0);
+		/* release SAPI 3 link, if exits */
+		gsm48_release_sapi3_link(ms);
+		return 0;
+	case GSM48_RR_ST_REL_PEND:
+		LOGP(DRR, LOGL_INFO, "LOS during RR release procedure, release "
+			"locally\n");
+
+		/* stop pending RACH timer */
+		stop_rr_t3110(rr);
+
+		/* release locally */
+		goto rel_local;
+	default:
+		/* this should not happen */
+		LOGP(DRR, LOGL_ERROR, "LOS in IDLE state, ignoring\n");
+		return -EINVAL;
+	}
+
+	/* send inication to upper layer */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_REL_IND);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+	nrrh->cause = RR_REL_CAUSE_LOST_SIGNAL;
+	gsm48_rr_upmsg(ms, nmsg);
+
+	/* return idle */
+	new_rr_state(rr, GSM48_RR_ST_IDLE);
+	return 0;
+}
+
+/* activation of channel in dedicated mode */
+static int gsm48_rr_activate_channel(struct osmocom_ms *ms,
+	struct gsm48_rr_cd *cd, uint16_t *ma, uint8_t ma_len)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm_settings *set = &ms->settings;
+ 	struct gsm48_sysinfo *s = ms->cellsel.si;
+ 	struct rx_meas_stat *meas = &ms->meas;
+	uint8_t ch_type, ch_subch, ch_ts;
+	uint8_t timeout = 64;
+
+	/* setting (new) timing advance */
+	LOGP(DRR, LOGL_INFO, "setting indicated TA %d (actual TA %d)\n",
+		cd->ind_ta, cd->ind_ta - set->alter_delay);
+	l1ctl_tx_param_req(ms, cd->ind_ta - set->alter_delay,
+			(set->alter_tx_power) ? set->alter_tx_power_value
+						: cd->ind_tx_power);
+
+	/* reset measurement and link timeout */
+	meas->ds_fail = 0;
+	if (s) {
+		if (s->sacch_radio_link_timeout) {
+			timeout = s->sacch_radio_link_timeout;
+			LOGP(DRR, LOGL_INFO, "using last SACCH timeout %d\n",
+				timeout);
+		} else if (s->bcch_radio_link_timeout) {
+			timeout = s->bcch_radio_link_timeout;
+			LOGP(DRR, LOGL_INFO, "using last BCCH timeout %d\n",
+				timeout);
+		}
+	}
+	meas->rl_fail = meas->s = timeout;
+
+	/* setting initial (invalid) measurement report, resetting SI5* */
+	if (s) {
+		memset(s->si5_msg, 0, sizeof(s->si5_msg));
+		memset(s->si5b_msg, 0, sizeof(s->si5b_msg));
+		memset(s->si5t_msg, 0, sizeof(s->si5t_msg));
+	}
+	meas->frames = meas->snr = meas->berr = meas->rxlev = 0;
+	rr->meas.nc_num = 0;
+	stop_rr_t_meas(rr);
+	start_rr_t_meas(rr, 1, 0);
+	gsm48_rr_tx_meas_rep(ms);
+
+	/* establish */
+	LOGP(DRR, LOGL_INFO, "establishing channel in dedicated mode\n");
+	rsl_dec_chan_nr(cd->chan_nr, &ch_type, &ch_subch, &ch_ts);
+	LOGP(DRR, LOGL_INFO, " Channel type %d, subch %d, ts %d, mode %d, "
+		"audio-mode %d, cipher %d\n", ch_type, ch_subch, ch_ts,
+		cd->mode, rr->audio_mode, rr->cipher_type + 1);
+	if (cd->h)
+		l1ctl_tx_dm_est_req_h1(ms, cd->maio, cd->hsn,
+			ma, ma_len, cd->chan_nr, cd->tsc, cd->mode,
+			rr->audio_mode);
+	else
+		l1ctl_tx_dm_est_req_h0(ms, cd->arfcn, cd->chan_nr, cd->tsc,
+			cd->mode, rr->audio_mode);
+	rr->dm_est = 1;
+
+	/* old SI 5/6 are not valid on a new dedicated channel */
+	s->si5 = s->si5bis = s->si5ter = s->si6 = 0;
+
+	if (rr->cipher_on)
+		l1ctl_tx_crypto_req(ms, rr->cd_now.chan_nr,
+			rr->cipher_type + 1, subscr->key, 8);
+
+	return 0;
+}
+
+/* frequency change of channel "after time" */
+static int gsm48_rr_channel_after_time(struct osmocom_ms *ms,
+	struct gsm48_rr_cd *cd, uint16_t *ma, uint8_t ma_len, uint16_t fn)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+
+	if (cd->h)
+		l1ctl_tx_dm_freq_req_h1(ms, cd->maio, cd->hsn,
+			ma, ma_len, cd->tsc, fn);
+	else
+		l1ctl_tx_dm_freq_req_h0(ms, cd->arfcn, cd->tsc, fn);
+
+	if (rr->cipher_on)
+		l1ctl_tx_crypto_req(ms, rr->cd_now.chan_nr,
+			rr->cipher_type + 1, subscr->key, 8);
+
+	gsm48_rr_set_mode(ms, cd->chan_nr, cd->mode);
+
+	return 0;
+}
+
+/* render list of hopping channels from channel description elements */
+static int gsm48_rr_render_ma(struct osmocom_ms *ms, struct gsm48_rr_cd *cd,
+	uint16_t *ma, uint8_t *ma_len)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	struct gsm_settings *set = &ms->settings;
+	int i, pcs, index;
+	uint16_t arfcn;
+
+	pcs = gsm_refer_pcs(cs->arfcn, s) ? ARFCN_PCS : 0;
+
+	/* no hopping (no MA), channel description is valid */
+	if (!cd->h) {
+		*ma_len = 0;
+		return 0;
+	}
+
+	/* decode mobile allocation */
+	if (cd->mob_alloc_lv[0]) {
+		struct gsm_sysinfo_freq *freq = s->freq;
+
+		LOGP(DRR, LOGL_INFO, "decoding mobile allocation\n");
+
+		if (cd->cell_desc_lv[0]) {
+			LOGP(DRR, LOGL_INFO, "using cell channel descr.\n");
+			if (cd->cell_desc_lv[0] != 16) {
+				LOGP(DRR, LOGL_ERROR, "cell channel descr. "
+					"has invalid lenght\n");
+				return GSM48_RR_CAUSE_ABNORMAL_UNSPEC;
+			}
+			gsm48_decode_freq_list(freq, cd->cell_desc_lv + 1, 16,
+				0xce, FREQ_TYPE_SERV);
+		}
+
+		gsm48_decode_mobile_alloc(freq, cd->mob_alloc_lv + 1,
+			cd->mob_alloc_lv[0], ma, ma_len, 0);
+		if (*ma_len < 1) {
+			LOGP(DRR, LOGL_NOTICE, "mobile allocation with no "
+				"frequency available\n");
+			return GSM48_RR_CAUSE_NO_CELL_ALLOC_A;
+
+		}
+	} else
+	/* decode frequency list */
+	if (cd->freq_list_lv[0]) {
+		struct gsm_sysinfo_freq f[1024];
+		int j = 0;
+
+		LOGP(DRR, LOGL_INFO, "decoding frequency list\n");
+
+		/* get bitmap */
+		if (gsm48_decode_freq_list(f, cd->freq_list_lv + 1,
+			cd->freq_list_lv[0], 0xce, FREQ_TYPE_SERV)) {
+			LOGP(DRR, LOGL_NOTICE, "frequency list invalid\n");
+			return GSM48_RR_CAUSE_ABNORMAL_UNSPEC;
+		}
+
+		/* collect channels from bitmap (1..1023,0) */
+		for (i = 1; i <= 1024; i++) {
+			if ((f[i & 1023].mask & FREQ_TYPE_SERV)) {
+				LOGP(DRR, LOGL_INFO, "Listed ARFCN #%d: %s\n",
+					j, gsm_print_arfcn((i & 1023) | pcs));
+				if (j == 64) {
+					LOGP(DRR, LOGL_NOTICE, "frequency list "
+						"exceeds 64 entries!\n");
+					return GSM48_RR_CAUSE_ABNORMAL_UNSPEC;
+				}
+				ma[j++] = i & 1023;
+			}
+		}
+		*ma_len = j;
+	} else
+	/* decode frequency channel sequence */
+	if (cd->freq_seq_lv[0]) {
+		int j = 0, inc;
+
+		LOGP(DRR, LOGL_INFO, "decoding frequency channel sequence\n");
+
+		if (cd->freq_seq_lv[0] != 9) {
+			LOGP(DRR, LOGL_NOTICE, "invalid frequency channel "
+				"sequence\n");
+			return GSM48_RR_CAUSE_ABNORMAL_UNSPEC;
+		}
+		arfcn = cd->freq_seq_lv[1] & 0x7f;
+		LOGP(DRR, LOGL_INFO, "Listed Sequence ARFCN #%d: %s\n", j,
+			gsm_print_arfcn(arfcn | pcs));
+		ma[j++] = arfcn;
+		for (i = 0; i < 16; i++) {
+			if ((i & 1))
+				inc = cd->freq_seq_lv[2 + (i >> 1)] & 0x0f;
+			else
+				inc = cd->freq_seq_lv[2 + (i >> 1)] >> 4;
+			if (inc) {
+				arfcn += inc;
+				LOGP(DRR, LOGL_INFO, "Listed Sequence ARFCN "
+					"#%d: %s\n", j,
+					gsm_print_arfcn(i | pcs));
+				ma[j++] = arfcn;
+			} else
+				arfcn += 15;
+		}
+		*ma_len = j;
+	} else {
+		LOGP(DRR, LOGL_NOTICE, "hopping, but nothing that tells us "
+			"a sequence\n");
+		return GSM48_RR_CAUSE_ABNORMAL_UNSPEC;
+	}
+
+	/* convert to band_arfcn and check for unsported frequency */
+	for (i = 0; i < *ma_len; i++) {
+		arfcn = ma[i] | pcs;
+		ma[i] = arfcn;
+		index = arfcn2index(arfcn);
+		if (!(set->freq_map[index >> 3] & (1 << (index & 7)))) {
+			LOGP(DRR, LOGL_NOTICE, "Hopping ARFCN %s not "
+				"supported\n", gsm_print_arfcn(arfcn));
+			return GSM48_RR_CAUSE_FREQ_NOT_IMPL;
+		}
+	}
+
+	return 0;
+}
+
+/* activate link and send establish request */
+static int gsm48_rr_dl_est(struct osmocom_ms *ms)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm48_pag_rsp *pr;
+	uint8_t mi[11];
+	uint16_t ma[64];
+	uint8_t ma_len;
+
+	/* 3.3.1.1.3.1 */
+	stop_rr_t3126(rr);
+
+	/* check if we have to change channel at starting time (we delay) */
+	if (rr->cd_now.start) {
+		int32_t now, start, diff;
+		uint32_t start_mili = 0;
+
+		/* how much time do we have left? */
+		now = ms->meas.last_fn % 42432;
+		start = rr->cd_now.start_tm.fn % 42432;
+		diff = start - now;
+		if (diff < 0)
+			diff += 42432;
+		LOGP(DRR, LOGL_INFO, " (Tnow %d Tstart %d diff %d)\n",
+			now, start, diff);
+		start_mili = (uint32_t)diff * 19580 / 42432 * 10;
+		if (diff >= 32024 || !start_mili) {
+			LOGP(DRR, LOGL_INFO, " -> Start time already "
+				"elapsed\n");
+			rr->cd_now.start = 0;
+		} else {
+			LOGP(DRR, LOGL_INFO, " -> Start time is %d ms in the "
+				"future\n", start_mili);
+		}
+
+#ifndef TEST_FREQUENCY_MOD
+		/* schedule start of IMM.ASS */
+		rr->modify_state = GSM48_RR_MOD_IMM_ASS;
+		start_rr_t_starting(rr, start_mili / 1000,
+			(start_mili % 1000) * 1000);
+		/* when timer fires, start time is already elapsed */
+		rr->cd_now.start = 0;
+
+		return 0;
+#endif
+	}
+
+	/* get hopping sequence, if required */
+	if (gsm48_rr_render_ma(ms, &rr->cd_now, ma, &ma_len))
+		return -EINVAL;
+
+	/* clear all sequence numbers for all possible PDs */
+	rr->v_sd = 0;
+
+	/* send DL_EST_REQ */
+	if (rr->rr_est_msg) {
+		LOGP(DRR, LOGL_INFO, "sending establish message\n");
+
+		/* use queued message */
+		nmsg = rr->rr_est_msg;
+		rr->rr_est_msg = 0;
+
+		/* set sequence number and increment */
+		gsm48_apply_v_sd(rr, nmsg);
+	} else {
+		/* create paging response */
+		nmsg = gsm48_l3_msgb_alloc();
+		if (!nmsg)
+			return -ENOMEM;
+		gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+		gh->proto_discr = GSM48_PDISC_RR;
+		gh->msg_type = GSM48_MT_RR_PAG_RESP;
+		pr = (struct gsm48_pag_rsp *) msgb_put(nmsg, sizeof(*pr));
+		/* key sequence */
+		pr->key_seq = gsm_subscr_get_key_seq(ms, subscr);
+		/* classmark 2 */
+		pr->cm2_len = sizeof(pr->cm2);
+		gsm48_rr_enc_cm2(ms, &pr->cm2, rr->cd_now.arfcn);
+		/* mobile identity */
+		if (ms->subscr.tmsi != 0xffffffff
+		 && ms->subscr.mcc == cs->sel_mcc
+		 && ms->subscr.mnc == cs->sel_mnc
+		 && ms->subscr.lac == cs->sel_lac
+		 && rr->paging_mi_type == GSM_MI_TYPE_TMSI) {
+			gsm48_generate_mid_from_tmsi(mi, subscr->tmsi);
+			LOGP(DRR, LOGL_INFO, "sending paging response with "
+				"TMSI\n");
+		} else if (subscr->imsi[0]) {
+			gsm48_generate_mid_from_imsi(mi, subscr->imsi);
+			LOGP(DRR, LOGL_INFO, "sending paging response with "
+				"IMSI\n");
+		} else {
+			mi[1] = 1;
+			mi[2] = 0xf0 | GSM_MI_TYPE_NONE;
+			LOGP(DRR, LOGL_INFO, "sending paging response without "
+				"TMSI/IMSI\n");
+		}
+		msgb_put(nmsg, 1 + mi[1]);
+		memcpy(pr->data, mi + 1, 1 + mi[1]);
+	}
+
+#ifdef TEST_FREQUENCY_MOD
+	LOGP(DRR, LOGL_INFO, " TESTING: frequency modify IMM.ASS\n");
+	memcpy(&rr->cd_before, &rr->cd_now, sizeof(rr->cd_before));
+	rr->cd_before.h = 0;
+	rr->cd_before.arfcn = 0;
+	/* activate channel */
+	gsm48_rr_activate_channel(ms, &rr->cd_before, ma, ma_len);
+	/* render channel "after time" */
+	gsm48_rr_render_ma(ms, &rr->cd_now, ma, &ma_len);
+	/* schedule change of channel */
+	gsm48_rr_channel_after_time(ms, &rr->cd_now, ma, ma_len,
+		rr->cd_now.start_tm.fn);
+#else
+	/* activate channel */
+	gsm48_rr_activate_channel(ms, &rr->cd_now, ma, ma_len);
+#endif
+
+	/* set T200 of SAPI 0 */
+	ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_sec =
+		T200_DCCH;
+	ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_usec = 0;
+
+	/* start establishmnet */
+	return gsm48_send_rsl(ms, RSL_MT_EST_REQ, nmsg, 0);
+}
+
+/* the link is established */
+static int gsm48_rr_estab_cnf(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm_support *sup = &ms->support;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	uint8_t *mode;
+	struct msgb *nmsg;
+
+	/* if MM has releases before confirm, we start release */
+	if (rr->state == GSM48_RR_ST_REL_PEND) {
+		LOGP(DRR, LOGL_INFO, "MM already released RR.\n");
+		/* release message */
+		nmsg = gsm48_l3_msgb_alloc();
+		if (!nmsg)
+			return -ENOMEM;
+		mode = msgb_put(nmsg, 2);
+		mode[0] = RSL_IE_RELEASE_MODE;
+		mode[1] = 0; /* normal release */
+		/* start release */
+		return gsm48_send_rsl_nol3(ms, RSL_MT_REL_REQ, nmsg, 0);
+	}
+
+	/* 3.3.1.1.4 */
+	new_rr_state(rr, GSM48_RR_ST_DEDICATED);
+
+	/* early classmark sending */
+	if (cs->si->ecsm && sup->es_ind)
+		gsm48_rr_tx_cm_change(ms);
+
+	/* send confirm to upper layer */
+	nmsg = gsm48_rr_msgb_alloc(
+		(rr->rr_est_req) ? GSM48_RR_EST_CNF : GSM48_RR_EST_IND);
+	if (!nmsg)
+		return -ENOMEM;
+	return gsm48_rr_upmsg(ms, nmsg);
+}
+
+/* the link is released in pending state (by l2) */
+static int gsm48_rr_rel_ind(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+
+	/* switch back to old channel, if modify/ho failed */
+	switch (rr->modify_state) {
+	case GSM48_RR_MOD_ASSIGN:
+	case GSM48_RR_MOD_HANDO:
+		/* channel is deactivate there */
+		return gsm48_rr_rel_cnf(ms, msg);
+	case GSM48_RR_MOD_ASSIGN_RESUME:
+	case GSM48_RR_MOD_HANDO_RESUME:
+		rr->modify_state = GSM48_RR_MOD_NONE;
+		break;
+	}
+
+	LOGP(DSUM, LOGL_INFO, "Radio link is released\n");
+
+	/* send inication to upper layer */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_REL_IND);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+	nrrh->cause = RR_REL_CAUSE_NORMAL;
+	gsm48_rr_upmsg(ms, nmsg);
+
+	/* start release timer, so UA will be transmitted */
+	start_rr_t_rel_wait(rr, 1, 500000);
+
+	/* pending release */
+	new_rr_state(rr, GSM48_RR_ST_REL_PEND);
+
+	/* also release SAPI 3 link, if exists */
+	gsm48_release_sapi3_link(ms);
+
+	return 0;
+}
+
+/* 9.1.7 CHANNEL RELEASE is received  */
+static int gsm48_rr_rx_chan_rel(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_chan_rel *cr = (struct gsm48_chan_rel *)gh->data;
+	int payload_len = msgb_l3len(msg) - sizeof(*gh) - sizeof(*cr);
+	struct tlv_parsed tp;
+	struct msgb *nmsg;
+	uint8_t *mode;
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of CHANNEL RELEASE "
+			"message.\n");
+		return gsm48_rr_tx_rr_status(ms,
+			GSM48_RR_CAUSE_PROT_ERROR_UNSPC);
+	}
+	tlv_parse(&tp, &gsm48_rr_att_tlvdef, cr->data, payload_len, 0, 0);
+
+	LOGP(DRR, LOGL_INFO, "channel release request with cause 0x%02x\n",
+		cr->rr_cause);
+
+	/* BA range */
+	if (TLVP_PRESENT(&tp, GSM48_IE_BA_RANGE)) {
+		gsm48_decode_ba_range(TLVP_VAL(&tp, GSM48_IE_BA_RANGE),
+			*(TLVP_VAL(&tp, GSM48_IE_BA_RANGE) - 1), rr->ba_range,
+			&rr->ba_ranges,
+			sizeof(rr->ba_range) / sizeof(rr->ba_range[0]));
+		/* NOTE: the ranges are kept until IDLE state is returned
+		 * (see new_rr_state)
+		 */
+	}
+
+	new_rr_state(rr, GSM48_RR_ST_REL_PEND);
+
+	/* start T3110, so that two DISCs can be sent due to T200 timeout */
+	start_rr_t3110(rr, 1, 500000);
+
+	/* disconnect the main signalling link */
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	mode = msgb_put(nmsg, 2);
+	mode[0] = RSL_IE_RELEASE_MODE;
+	mode[1] = 0; /* normal release */
+	gsm48_send_rsl_nol3(ms, RSL_MT_REL_REQ, nmsg, 0);
+
+	/* release SAPI 3 link, if exits */
+	gsm48_release_sapi3_link(ms);
+	return 0;
+}
+
+/*
+ * frequency redefition, chanel mode modify, assignment, and handover
+ */
+
+/* set channel mode in case of TCH */
+static int gsm48_rr_set_mode(struct osmocom_ms *ms, uint8_t chan_nr,
+	uint8_t mode)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	uint8_t ch_type, ch_subch, ch_ts;
+
+	/* only apply mode to TCH/F or TCH/H */
+	rsl_dec_chan_nr(chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (ch_type != RSL_CHAN_Bm_ACCHs
+	 && ch_type != RSL_CHAN_Lm_ACCHs)
+		return -ENOTSUP;
+
+	/* setting (new) timing advance */
+	LOGP(DRR, LOGL_INFO, "setting TCH mode to %d, audio mode to %d\n",
+		mode, rr->audio_mode);
+	l1ctl_tx_tch_mode_req(ms, mode, rr->audio_mode);
+
+	return 0;
+}
+
+/* 9.1.13 FREQUENCY REDEFINITION is received */
+static int gsm48_rr_rx_frq_redef(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	struct gsm48_frq_redef *fr = msgb_l3(msg);
+	int mob_al_len = msgb_l3len(msg) - sizeof(*fr);
+	uint8_t ch_type, ch_subch, ch_ts;
+	struct gsm48_rr_cd cd;
+	uint8_t cause;
+	uint8_t *st;
+	uint16_t ma[64];
+	uint8_t ma_len;
+
+	memcpy(&cd, &rr->cd_now, sizeof(cd));
+
+	if (mob_al_len < 0 /* mobile allocation IE must be included */
+	 || fr->mob_alloc_len + 2 > mob_al_len) { /* short read of IE */
+		LOGP(DRR, LOGL_NOTICE, "Short read of FREQUENCY REDEFINITION "
+			"message.\n");
+		return -EINVAL;
+	}
+	if (fr->mob_alloc_len > 8) {
+		LOGP(DRR, LOGL_NOTICE, "Moble allocation in FREQUENCY "
+			"REDEFINITION too large.\n");
+		return -EINVAL;
+	}
+
+	/* decode channel description */
+	LOGP(DRR, LOGL_INFO, "FREQUENCY REDEFINITION:\n");
+	cd.chan_nr = fr->chan_desc.chan_nr;
+	rsl_dec_chan_nr(cd.chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (fr->chan_desc.h0.h) {
+		cd.h = 1;
+		gsm48_decode_chan_h1(&fr->chan_desc, &cd.tsc, &cd.maio,
+			&cd.hsn);
+		LOGP(DRR, LOGL_INFO, " (MAIO %u HSN %u TS %u SS %u TSC %u)\n",
+			cd.maio, cd.hsn, ch_ts, ch_subch, cd.tsc);
+	} else {
+		cd.h = 0;
+		gsm48_decode_chan_h0(&fr->chan_desc, &cd.tsc, &cd.arfcn);
+		if (gsm_refer_pcs(cs->arfcn, s))
+			cd.arfcn |= ARFCN_PCS;
+		LOGP(DRR, LOGL_INFO, " (ARFCN %s TS %u SS %u TSC %u)\n",
+			gsm_print_arfcn(cd.arfcn), ch_ts, ch_subch, cd.tsc);
+	}
+
+	/* mobile allocation */
+	memcpy(rr->cd_now.mob_alloc_lv, &fr->mob_alloc_len,
+		fr->mob_alloc_len + 1);
+
+	/* starting time */
+	st = fr->mob_alloc + fr->mob_alloc_len;
+	gsm48_decode_start_time(&cd, (struct gsm48_start_time *)(st+1));
+
+	/* cell channel description */
+	if (mob_al_len >= fr->mob_alloc_len + 2 + 17
+	 && fr->mob_alloc[fr->mob_alloc_len + 2] == GSM48_IE_CELL_CH_DESC) {
+		const uint8_t *v = fr->mob_alloc + fr->mob_alloc_len + 2 + 1;
+
+		LOGP(DRR, LOGL_INFO, " using cell channel description)\n");
+		cd.cell_desc_lv[0] = 16;
+		memcpy(cd.cell_desc_lv + 1, v, 17);
+	}
+
+	/* render channel "after time" */
+	cause = gsm48_rr_render_ma(ms, &rr->cd_now, ma, &ma_len);
+	if (cause)
+		return gsm48_rr_tx_rr_status(ms, cause);
+
+	/* update to new channel data */
+	memcpy(&rr->cd_now, &cd, sizeof(rr->cd_now));
+
+	/* schedule change of channel */
+	gsm48_rr_channel_after_time(ms, &rr->cd_now, ma, ma_len,
+		rr->cd_now.start_tm.fn);
+
+	rr->cd_now.start = 0;
+
+	return 0;
+}
+
+/* 9.1.6 sending CHANNEL MODE MODIFY ACKNOWLEDGE */
+static int gsm48_rr_tx_chan_modify_ack(struct osmocom_ms *ms,
+		struct gsm48_chan_desc *cd, uint8_t mode)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm48_chan_mode_modify *cm;
+
+	LOGP(DRR, LOGL_INFO, "CHAN.MODE.MOD ACKNOWLEDGE\n");
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+	cm = (struct gsm48_chan_mode_modify *) msgb_put(nmsg, sizeof(*cm));
+
+	gh->proto_discr = GSM48_PDISC_RR;
+	gh->msg_type = GSM48_MT_RR_CHAN_MODE_MODIF_ACK;
+
+	/* CD */
+	memcpy(&cm->chan_desc, cd, sizeof(struct gsm48_chan_desc));
+	/* mode */
+	cm->mode = mode;
+
+	return gsm48_send_rsl(ms, RSL_MT_DATA_REQ, nmsg, 0);
+}
+
+/* 9.1.5 CHANNEL MODE MODIFY is received */
+static int gsm48_rr_rx_chan_modify(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_chan_mode_modify *cm =
+		(struct gsm48_chan_mode_modify *)gh->data;
+	int payload_len = msgb_l3len(msg) - sizeof(*gh) - sizeof(*cm);
+	struct gsm48_rr_cd *cd = &rr->cd_now;
+	uint8_t ch_type, ch_subch, ch_ts;
+	uint8_t cause;
+
+	LOGP(DRR, LOGL_INFO, "CHANNEL MODE MODIFY\n");
+
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of CHANNEL MODE MODIFY "
+			"message.\n");
+		return gsm48_rr_tx_rr_status(ms,
+			GSM48_RR_CAUSE_PROT_ERROR_UNSPC);
+	}
+
+	/* decode channel description */
+	cd->chan_nr = cm->chan_desc.chan_nr;
+	rsl_dec_chan_nr(cd->chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (cm->chan_desc.h0.h) {
+		cd->h = 1;
+		gsm48_decode_chan_h1(&cm->chan_desc, &cd->tsc, &cd->maio,
+			&cd->hsn);
+		LOGP(DRR, LOGL_INFO, " (chan_nr 0x%02x MAIO %u HSN %u TS %u "
+			"SS %u TSC %u mode %u)\n", cm->chan_desc.chan_nr,
+			cd->maio, cd->hsn, ch_ts, ch_subch, cd->tsc, cm->mode);
+	} else {
+		cd->h = 0;
+		gsm48_decode_chan_h0(&cm->chan_desc, &cd->tsc, &cd->arfcn);
+		if (gsm_refer_pcs(cs->arfcn, s))
+			cd->arfcn |= ARFCN_PCS;
+		LOGP(DRR, LOGL_INFO, " (chan_nr 0x%02x ARFCN %s TS %u SS %u "
+			"TSC %u mode %u)\n", cm->chan_desc.chan_nr,
+			gsm_print_arfcn(cd->arfcn), ch_ts, ch_subch, cd->tsc,
+			cm->mode);
+	}
+	/* mode */
+	cause = gsm48_rr_check_mode(ms, cd->chan_nr, cm->mode);
+	if (cause)
+		return gsm48_rr_tx_rr_status(ms, cause);
+	cd->mode = cm->mode;
+	gsm48_rr_set_mode(ms, cd->chan_nr, cd->mode);
+
+	return gsm48_rr_tx_chan_modify_ack(ms, &cm->chan_desc, cm->mode);
+}
+
+/* 9.1.3 sending ASSIGNMENT COMPLETE */
+static int gsm48_rr_tx_ass_cpl(struct osmocom_ms *ms, uint8_t cause)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm48_ass_cpl *ac;
+
+	LOGP(DRR, LOGL_INFO, "ASSIGNMENT COMPLETE (cause #%d)\n", cause);
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+	ac = (struct gsm48_ass_cpl *) msgb_put(nmsg, sizeof(*ac));
+
+	gh->proto_discr = GSM48_PDISC_RR;
+	gh->msg_type = GSM48_MT_RR_ASS_COMPL;
+
+	/* RR_CAUSE */
+	ac->rr_cause = cause;
+
+	/* set T200 of SAPI 0 */
+	ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_sec =
+		T200_DCCH;
+	ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_usec = 0;
+
+	return gsm48_send_rsl(ms, RSL_MT_RES_REQ, nmsg, 0);
+}
+
+/* 9.1.4 sending ASSIGNMENT FAILURE */
+static int gsm48_rr_tx_ass_fail(struct osmocom_ms *ms, uint8_t cause,
+	uint8_t rsl_prim)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm48_ass_fail *af;
+
+	LOGP(DRR, LOGL_INFO, "ASSIGNMENT FAILURE (cause #%d)\n", cause);
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+	af = (struct gsm48_ass_fail *) msgb_put(nmsg, sizeof(*af));
+
+	gh->proto_discr = GSM48_PDISC_RR;
+	gh->msg_type = GSM48_MT_RR_ASS_COMPL;
+
+	/* RR_CAUSE */
+	af->rr_cause = cause;
+
+	return gsm48_send_rsl(ms, rsl_prim, nmsg, 0);
+}
+
+/* 9.1.2 ASSIGNMENT COMMAND is received */
+static int gsm48_rr_rx_ass_cmd(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_ass_cmd *ac = (struct gsm48_ass_cmd *)gh->data;
+	int payload_len = msgb_l3len(msg) - sizeof(*gh) - sizeof(*ac);
+	struct tlv_parsed tp;
+	struct gsm48_rr_cd *cda = &rr->cd_after;
+	struct gsm48_rr_cd *cdb = &rr->cd_before;
+	uint8_t ch_type, ch_subch, ch_ts;
+	uint8_t before_time = 0;
+	uint16_t ma[64];
+	uint8_t ma_len;
+	uint32_t start_mili = 0;
+	uint8_t cause;
+	struct msgb *nmsg;
+
+
+	LOGP(DRR, LOGL_INFO, "ASSIGNMENT COMMAND\n");
+
+	memset(cda, 0, sizeof(*cda));
+	cda->ind_tx_power = rr->cd_now.ind_tx_power;
+	memset(cdb, 0, sizeof(*cdb));
+	cdb->ind_tx_power = rr->cd_now.ind_tx_power;
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of ASSIGNMENT COMMAND "
+			"message.\n");
+		return gsm48_rr_tx_rr_status(ms,
+			GSM48_RR_CAUSE_PROT_ERROR_UNSPC);
+	}
+	tlv_parse(&tp, &gsm48_rr_att_tlvdef, ac->data, payload_len, 0, 0);
+
+	/* decode channel description (before time) */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CH_DESC_1_BEFORE)) {
+		struct gsm48_chan_desc *ccd = (struct gsm48_chan_desc *)
+			TLVP_VAL(&tp, GSM48_IE_CH_DESC_1_BEFORE);
+		cdb->chan_nr = ccd->chan_nr;
+		rsl_dec_chan_nr(cdb->chan_nr, &ch_type, &ch_subch, &ch_ts);
+		if (ccd->h0.h) {
+			cdb->h = 1;
+			gsm48_decode_chan_h1(ccd, &cdb->tsc, &cdb->maio,
+				&cdb->hsn);
+			LOGP(DRR, LOGL_INFO, " before: (chan_nr 0x%02x MAIO %u "
+				"HSN %u TS %u SS %u TSC %u)\n", ccd->chan_nr,
+				cdb->maio, cdb->hsn, ch_ts, ch_subch, cdb->tsc);
+		} else {
+			cdb->h = 0;
+			gsm48_decode_chan_h0(ccd, &cdb->tsc, &cdb->arfcn);
+			if (gsm_refer_pcs(cs->arfcn, s))
+				cdb->arfcn |= ARFCN_PCS;
+			LOGP(DRR, LOGL_INFO, " before: (chan_nr 0x%02x "
+				"ARFCN %s TS %u SS %u TSC %u)\n", ccd->chan_nr,
+				gsm_print_arfcn(cdb->arfcn),
+				ch_ts, ch_subch, cdb->tsc);
+		}
+		before_time = 1;
+	}
+
+	/* decode channel description (after time) */
+	cda->chan_nr = ac->chan_desc.chan_nr;
+	rsl_dec_chan_nr(cda->chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (ac->chan_desc.h0.h) {
+		cda->h = 1;
+		gsm48_decode_chan_h1(&ac->chan_desc, &cda->tsc, &cda->maio,
+			&cda->hsn);
+		LOGP(DRR, LOGL_INFO, " after: (chan_nr 0x%02x MAIO %u HSN %u "
+			"TS %u SS %u TSC %u)\n", ac->chan_desc.chan_nr,
+			cda->maio, cda->hsn, ch_ts, ch_subch, cda->tsc);
+	} else {
+		cda->h = 0;
+		gsm48_decode_chan_h0(&ac->chan_desc, &cda->tsc, &cda->arfcn);
+		if (gsm_refer_pcs(cs->arfcn, s))
+			cda->arfcn |= ARFCN_PCS;
+		LOGP(DRR, LOGL_INFO, " after: (chan_nr 0x%02x ARFCN %s TS %u "
+			"SS %u TSC %u)\n", ac->chan_desc.chan_nr,
+			gsm_print_arfcn(cda->arfcn), ch_ts, ch_subch, cda->tsc);
+	}
+
+	/* starting time */
+#ifdef TEST_STARTING_TIMER
+	cda->start = 1;
+	cda->start_tm.fn = (ms->meas.last_fn + TEST_STARTING_TIMER) % 42432;
+	LOGP(DRR, LOGL_INFO, " TESTING: starting time ahead\n");
+#else
+	if (TLVP_PRESENT(&tp, GSM48_IE_START_TIME)) {
+		gsm48_decode_start_time(cda, (struct gsm48_start_time *)
+			TLVP_VAL(&tp, GSM48_IE_START_TIME));
+		/* 9.1.2.5 "... before time IE is not present..." */
+		if (!before_time) {
+			LOGP(DRR, LOGL_INFO, " -> channel description after "
+				"time only, but starting time\n");
+		} else
+			LOGP(DRR, LOGL_INFO, " -> channel description before "
+				"and after time\n");
+	} else {
+		/* 9.1.2.5 "... IEs unnecessary in this message." */
+		if (before_time) {
+			before_time = 0;
+			LOGP(DRR, LOGL_INFO, " -> channel description before "
+				"time, but no starting time, ignoring!\n");
+		}
+	}
+#endif
+
+	/* mobile allocation / frequency list after time */
+	if (cda->h) {
+		if (TLVP_PRESENT(&tp, GSM48_IE_MA_AFTER)) {
+			const uint8_t *lv =
+				TLVP_VAL(&tp, GSM48_IE_MA_AFTER) - 1;
+
+			LOGP(DRR, LOGL_INFO, " after: hopping required and "
+				"mobile allocation available\n");
+			if (*lv + 1 > sizeof(cda->mob_alloc_lv)) {
+				LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+				return -ENOMEM;
+			}
+			memcpy(cda->mob_alloc_lv, lv, *lv + 1);
+		} else
+		if (TLVP_PRESENT(&tp, GSM48_IE_FREQ_L_AFTER)) {
+			const uint8_t *lv =
+				TLVP_VAL(&tp, GSM48_IE_FREQ_L_AFTER) - 1;
+
+			LOGP(DRR, LOGL_INFO, " after: hopping required and "
+				"frequency list available\n");
+			if (*lv + 1 > sizeof(cda->freq_list_lv)) {
+				LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+				return -ENOMEM;
+			}
+			memcpy(cda->freq_list_lv, lv, *lv + 1);
+		} else {
+			LOGP(DRR, LOGL_NOTICE, " after: hopping required, but "
+				"no mobile allocation / frequency list\n");
+		}
+	}
+
+	/* mobile allocation / frequency list before time */
+	if (cdb->h) {
+		if (TLVP_PRESENT(&tp, GSM48_IE_MA_BEFORE)) {
+			const uint8_t *lv =
+				TLVP_VAL(&tp, GSM48_IE_MA_BEFORE) - 1;
+
+			LOGP(DRR, LOGL_INFO, " before: hopping required and "
+				"mobile allocation available\n");
+			if (*lv + 1 > sizeof(cdb->mob_alloc_lv)) {
+				LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+				return -ENOMEM;
+			}
+			memcpy(cdb->mob_alloc_lv, lv, *lv + 1);
+		} else
+		if (TLVP_PRESENT(&tp, GSM48_IE_FREQ_L_BEFORE)) {
+			const uint8_t *lv =
+				TLVP_VAL(&tp, GSM48_IE_FREQ_L_BEFORE) - 1;
+
+			LOGP(DRR, LOGL_INFO, " before: hopping required and "
+				"frequency list available\n");
+			if (*lv + 1 > sizeof(cdb->freq_list_lv)) {
+				LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+				return -ENOMEM;
+			}
+			memcpy(cdb->freq_list_lv, lv, *lv + 1);
+		} else
+		if (TLVP_PRESENT(&tp, GSM48_IE_F_CH_SEQ_BEFORE)) {
+			const uint8_t *v =
+				TLVP_VAL(&tp, GSM48_IE_F_CH_SEQ_BEFORE);
+			uint8_t len = TLVP_LEN(&tp, GSM48_IE_F_CH_SEQ_BEFORE);
+
+			LOGP(DRR, LOGL_INFO, " before: hopping required and "
+				"frequency channel sequence available\n");
+			if (len + 1 > sizeof(cdb->freq_seq_lv)) {
+				LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+				return -ENOMEM;
+			}
+			cdb->freq_seq_lv[0] = len;
+			memcpy(cdb->freq_seq_lv + 1, v, len);
+		} else
+		if (cda->mob_alloc_lv[0]) {
+			LOGP(DRR, LOGL_INFO, " before: hopping required and "
+				"mobile allocation not available, using "
+				"mobile allocation after time\n");
+			memcpy(cdb->mob_alloc_lv, cda->mob_alloc_lv,
+				sizeof(cdb->mob_alloc_lv));
+		} else
+		if (cda->freq_list_lv[0]) {
+			LOGP(DRR, LOGL_INFO, " before: hopping required and "
+				"frequency list not available, using "
+				"frequency list after time\n");
+			memcpy(cdb->freq_list_lv, cda->freq_list_lv,
+				sizeof(cdb->freq_list_lv));
+		} else {
+			LOGP(DRR, LOGL_NOTICE, " before: hopping required, but "
+				"no mobile allocation / frequency list\n");
+		}
+	}
+
+	/* cell channel description */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CELL_CH_DESC)) {
+		const uint8_t *v = TLVP_VAL(&tp, GSM48_IE_CELL_CH_DESC);
+		uint8_t len = TLVP_LEN(&tp, GSM48_IE_CELL_CH_DESC);
+
+		LOGP(DRR, LOGL_INFO, " both: using cell channel description "
+			"in case of mobile allocation\n");
+		if (len + 1 > sizeof(cdb->cell_desc_lv)) {
+			LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+			return -ENOMEM;
+		}
+		cdb->cell_desc_lv[0] = len;
+		memcpy(cdb->cell_desc_lv + 1, v, len);
+		cda->cell_desc_lv[0] = len;
+		memcpy(cda->cell_desc_lv + 1, v, len);
+	} else {
+		/* keep old */
+		memcpy(cdb->cell_desc_lv, rr->cd_now.cell_desc_lv,
+			sizeof(cdb->cell_desc_lv));
+		memcpy(cda->cell_desc_lv, rr->cd_now.cell_desc_lv,
+			sizeof(cda->cell_desc_lv));
+	}
+
+	/* channel mode */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CHANMODE_1)) {
+		cda->mode = cdb->mode = *TLVP_VAL(&tp, GSM48_IE_CHANMODE_1);
+		LOGP(DRR, LOGL_INFO, " both: changing channel mode 0x%02x\n",
+			cda->mode);
+	} else
+		cda->mode = cdb->mode = rr->cd_now.mode;
+
+	/* cipher mode setting */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CIP_MODE_SET)) {
+		cda->cipher = cdb->cipher =
+			*TLVP_VAL(&tp, GSM48_IE_CIP_MODE_SET);
+		LOGP(DRR, LOGL_INFO, " both: changing cipher mode 0x%02x\n",
+			cda->cipher);
+	} else
+		cda->cipher = cdb->cipher = rr->cd_now.cipher;
+
+	/* power command and TA (before and after time) */
+	gsm48_decode_power_cmd_acc(
+		(struct gsm48_power_cmd *) &ac->power_command,
+		&cda->ind_tx_power, NULL);
+	cdb->ind_tx_power = cda->ind_tx_power;
+	cda->ind_ta = cdb->ind_ta = rr->cd_now.ind_ta; /* same cell */
+	LOGP(DRR, LOGL_INFO, " both: (tx_power %d TA %d)\n", cda->ind_tx_power,
+		cda->ind_ta);
+
+	/* check if we have to change channel at starting time */
+	if (cda->start) {
+		int32_t now, start, diff;
+
+		/* how much time do we have left? */
+		now = ms->meas.last_fn % 42432;
+		start = cda->start_tm.fn % 42432;
+		diff = start - now;
+		if (diff < 0)
+			diff += 42432;
+		LOGP(DRR, LOGL_INFO, " after: (Tnow %d Tstart %d diff %d)\n",
+			now, start, diff);
+		start_mili = (uint32_t)diff * 19580 / 42432 * 10;
+		if (diff >= 32024 || !start_mili) {
+			LOGP(DRR, LOGL_INFO, " -> Start time already "
+				"elapsed\n");
+			before_time = 0;
+			cda->start = 0;
+		} else {
+			LOGP(DRR, LOGL_INFO, " -> Start time is %d ms in the "
+				"future\n", start_mili);
+		}
+	}
+
+	/* check if channels are valid */
+	cause = gsm48_rr_check_mode(ms, cda->chan_nr, cda->mode);
+	if (cause)
+		return gsm48_rr_tx_ass_fail(ms, cause, RSL_MT_DATA_REQ);
+	if (before_time) {
+		cause = gsm48_rr_render_ma(ms, cdb, ma, &ma_len);
+		if (cause)
+			return gsm48_rr_tx_ass_fail(ms, cause, RSL_MT_DATA_REQ);
+	}
+	cause = gsm48_rr_render_ma(ms, cda, ma, &ma_len);
+	if (cause)
+		return gsm48_rr_tx_ass_fail(ms, cause, RSL_MT_DATA_REQ);
+
+#ifdef TEST_FREQUENCY_MOD
+	LOGP(DRR, LOGL_INFO, " TESTING: frequency modify ASS.CMD\n");
+	before_time = 1;
+	memcpy(cdb, cda, sizeof(*cdb));
+	cdb->h = 0;
+	cdb->arfcn = 0;
+#endif
+
+	/* schedule start of assignment */
+	rr->modify_state = GSM48_RR_MOD_ASSIGN;
+	if (!before_time && cda->start) {
+		start_rr_t_starting(rr, start_mili / 1000, start_mili % 1000);
+		/* when timer fires, start time is already elapsed */
+		cda->start = 0;
+
+		return 0;
+	}
+
+	/* if no starting time, start suspension of current link directly */
+	LOGP(DRR, LOGL_INFO, "request suspension of data link\n");
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_send_rsl(ms, RSL_MT_SUSP_REQ, nmsg, 0);
+
+	/* release SAPI 3 link, if exits
+	 * FIXME: suspend and resume afterward */
+	gsm48_release_sapi3_link(ms);
+
+	return 0;
+}
+
+/* 9.1.16 sending HANDOVER COMPLETE */
+static int gsm48_rr_tx_hando_cpl(struct osmocom_ms *ms, uint8_t cause)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm48_ho_cpl *hc;
+
+	LOGP(DRR, LOGL_INFO, "HANDOVER COMPLETE (cause #%d)\n", cause);
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+	hc = (struct gsm48_ho_cpl *) msgb_put(nmsg, sizeof(*hc));
+
+	gh->proto_discr = GSM48_PDISC_RR;
+	gh->msg_type = GSM48_MT_RR_HANDO_COMPL;
+
+	/* RR_CAUSE */
+	hc->rr_cause = cause;
+
+	// FIXME: mobile observed time
+
+	/* set T200 of SAPI 0 */
+	ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_sec =
+		T200_DCCH;
+	ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_usec = 0;
+
+	return gsm48_send_rsl(ms, RSL_MT_RES_REQ, nmsg, 0);
+}
+
+/* 9.1.4 sending HANDOVER FAILURE */
+static int gsm48_rr_tx_hando_fail(struct osmocom_ms *ms, uint8_t cause,
+	uint8_t rsl_prim)
+{
+	struct msgb *nmsg;
+	struct gsm48_hdr *gh;
+	struct gsm48_ho_fail *hf;
+
+	LOGP(DRR, LOGL_INFO, "HANDOVER FAILURE (cause #%d)\n", cause);
+
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gh = (struct gsm48_hdr *) msgb_put(nmsg, sizeof(*gh));
+	hf = (struct gsm48_ho_fail *) msgb_put(nmsg, sizeof(*hf));
+
+	gh->proto_discr = GSM48_PDISC_RR;
+	gh->msg_type = GSM48_MT_RR_ASS_COMPL;
+
+	/* RR_CAUSE */
+	hf->rr_cause = cause;
+
+	return gsm48_send_rsl(ms, rsl_prim, nmsg, 0);
+}
+
+/* receiving HANDOVER COMMAND message (9.1.15) */
+static int gsm48_rr_rx_hando_cmd(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = cs->si;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_ho_cmd *ho = (struct gsm48_ho_cmd *)gh->data;
+	int payload_len = msgb_l3len(msg) - sizeof(*gh) - sizeof(*ho);
+	struct tlv_parsed tp;
+	struct gsm48_rr_cd *cda = &rr->cd_after;
+	struct gsm48_rr_cd *cdb = &rr->cd_before;
+	uint16_t arfcn;
+	uint8_t bcc, ncc;
+	uint8_t ch_type, ch_subch, ch_ts;
+	uint8_t before_time = 0;
+	uint16_t ma[64];
+	uint8_t ma_len;
+	uint32_t start_mili = 0;
+	uint8_t cause;
+	struct msgb *nmsg;
+
+	LOGP(DRR, LOGL_INFO, "HANDOVER COMMAND\n");
+
+	memset(cda, 0, sizeof(*cda));
+	cda->ind_tx_power = rr->cd_now.ind_tx_power;
+	memset(cdb, 0, sizeof(*cdb));
+	cdb->ind_tx_power = rr->cd_now.ind_tx_power;
+
+	if (payload_len < 0) {
+		LOGP(DRR, LOGL_NOTICE, "Short read of HANDOVER COMMAND "
+			"message.\n");
+		return gsm48_rr_tx_rr_status(ms,
+			GSM48_RR_CAUSE_PROT_ERROR_UNSPC);
+	}
+
+	/* cell description */
+	gsm48_decode_cell_desc(&ho->cell_desc, &arfcn, &ncc, &bcc);
+
+	/* handover reference */
+	rr->chan_req_val = ho->ho_ref;
+	rr->chan_req_mask = 0x00;
+
+	tlv_parse(&tp, &gsm48_rr_att_tlvdef, ho->data, payload_len, 0, 0);
+
+	/* sync ind */
+	if (TLVP_PRESENT(&tp, GSM48_IE_SYNC_IND)) {
+		gsm48_decode_sync_ind(rr, (struct gsm48_sync_ind *)
+			TLVP_VAL(&tp, GSM48_IE_SYNC_IND));
+		LOGP(DRR, LOGL_INFO, " (sync_ind=%d rot=%d nci=%d)\n",
+			rr->hando_sync_ind, rr->hando_rot, rr->hando_nci);
+	}
+
+	/* decode channel description (before time) */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CH_DESC_1_BEFORE)) {
+		struct gsm48_chan_desc *ccd = (struct gsm48_chan_desc *)
+			TLVP_VAL(&tp, GSM48_IE_CH_DESC_1_BEFORE);
+		cdb->chan_nr = ccd->chan_nr;
+		rsl_dec_chan_nr(cdb->chan_nr, &ch_type, &ch_subch, &ch_ts);
+		if (ccd->h0.h) {
+			cdb->h = 1;
+			gsm48_decode_chan_h1(ccd, &cdb->tsc, &cdb->maio,
+				&cdb->hsn);
+			LOGP(DRR, LOGL_INFO, " before: (chan_nr 0x%02x MAIO %u "
+				"HSN %u TS %u SS %u TSC %u)\n", ccd->chan_nr,
+				cdb->maio, cdb->hsn, ch_ts, ch_subch, cdb->tsc);
+		} else {
+			cdb->h = 0;
+			gsm48_decode_chan_h0(ccd, &cdb->tsc, &cdb->arfcn);
+			if (gsm_refer_pcs(cs->arfcn, s))
+				cdb->arfcn |= ARFCN_PCS;
+			LOGP(DRR, LOGL_INFO, " before: (chan_nr 0x%02x "
+				"ARFCN %s TS %u SS %u TSC %u)\n", ccd->chan_nr,
+				gsm_print_arfcn(cdb->arfcn),
+				ch_ts, ch_subch, cdb->tsc);
+		}
+		before_time = 1;
+	}
+
+	/* decode channel description (after time) */
+	cda->chan_nr = ho->chan_desc.chan_nr;
+	rsl_dec_chan_nr(cda->chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (ho->chan_desc.h0.h) {
+		cda->h = 1;
+		gsm48_decode_chan_h1(&ho->chan_desc, &cda->tsc, &cda->maio,
+			&cda->hsn);
+		LOGP(DRR, LOGL_INFO, " after: (chan_nr 0x%02x MAIO %u HSN %u "
+			"TS %u SS %u TSC %u)\n", ho->chan_desc.chan_nr,
+			cda->maio, cda->hsn, ch_ts, ch_subch, cda->tsc);
+	} else {
+		cda->h = 0;
+		gsm48_decode_chan_h0(&ho->chan_desc, &cda->tsc, &cda->arfcn);
+		if (gsm_refer_pcs(cs->arfcn, s))
+			cda->arfcn |= ARFCN_PCS;
+		LOGP(DRR, LOGL_INFO, " after: (chan_nr 0x%02x ARFCN %s TS %u "
+			"SS %u TSC %u)\n", ho->chan_desc.chan_nr,
+			gsm_print_arfcn(cda->arfcn), ch_ts, ch_subch, cda->tsc);
+	}
+
+	/* starting time */
+#ifdef TEST_STARTING_TIMER
+	cda->start = 1;
+	cda->start_tm.fn = (ms->meas.last_fn + TEST_STARTING_TIMER) % 42432;
+	LOGP(DRR, LOGL_INFO, " TESTING: starting time ahead\n");
+#else
+	if (TLVP_PRESENT(&tp, GSM48_IE_START_TIME)) {
+		gsm48_decode_start_time(cda, (struct gsm48_start_time *)
+			TLVP_VAL(&tp, GSM48_IE_START_TIME));
+		/* 9.1.2.5 "... before time IE is not present..." */
+		if (!before_time) {
+			LOGP(DRR, LOGL_INFO, " -> channel description after "
+				"time only, but starting time\n");
+		} else
+			LOGP(DRR, LOGL_INFO, " -> channel description before "
+				"and after time\n");
+	} else {
+		/* 9.1.2.5 "... IEs unnecessary in this message." */
+		if (before_time) {
+			before_time = 0;
+			LOGP(DRR, LOGL_INFO, " -> channel description before "
+				"time, but no starting time, ignoring!\n");
+		}
+	}
+#endif
+
+	/* mobile allocation / frequency list after time */
+	if (cda->h) {
+		if (TLVP_PRESENT(&tp, GSM48_IE_MA_AFTER)) {
+			const uint8_t *lv =
+				TLVP_VAL(&tp, GSM48_IE_MA_AFTER) - 1;
+
+			LOGP(DRR, LOGL_INFO, " after: hopping required and "
+				"mobile allocation available\n");
+			if (*lv + 1 > sizeof(cda->mob_alloc_lv)) {
+				LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+				return -ENOMEM;
+			}
+			memcpy(cda->mob_alloc_lv, lv, *lv + 1);
+		} else
+		if (TLVP_PRESENT(&tp, GSM48_IE_FREQ_L_AFTER)) {
+			const uint8_t *lv =
+				TLVP_VAL(&tp, GSM48_IE_FREQ_L_AFTER) - 1;
+
+			LOGP(DRR, LOGL_INFO, " after: hopping required and "
+				"frequency list available\n");
+			if (*lv + 1 > sizeof(cda->freq_list_lv)) {
+				LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+				return -ENOMEM;
+			}
+			memcpy(cda->freq_list_lv, lv, *lv + 1);
+		} else {
+			LOGP(DRR, LOGL_NOTICE, " after: hopping required, but "
+				"no mobile allocation / frequency list\n");
+		}
+	}
+
+	/* mobile allocation / frequency list before time */
+	if (cdb->h) {
+		if (TLVP_PRESENT(&tp, GSM48_IE_MA_BEFORE)) {
+			const uint8_t *lv =
+				TLVP_VAL(&tp, GSM48_IE_MA_BEFORE) - 1;
+
+			LOGP(DRR, LOGL_INFO, " before: hopping required and "
+				"mobile allocation available\n");
+			if (*lv + 1 > sizeof(cdb->mob_alloc_lv)) {
+				LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+				return -ENOMEM;
+			}
+			memcpy(cdb->mob_alloc_lv, lv, *lv + 1);
+		} else
+		if (TLVP_PRESENT(&tp, GSM48_IE_FREQ_L_BEFORE)) {
+			const uint8_t *lv =
+				TLVP_VAL(&tp, GSM48_IE_FREQ_L_BEFORE) - 1;
+
+			LOGP(DRR, LOGL_INFO, " before: hopping required and "
+				"frequency list available\n");
+			if (*lv + 1 > sizeof(cdb->freq_list_lv)) {
+				LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+				return -ENOMEM;
+			}
+			memcpy(cdb->freq_list_lv, lv, *lv + 1);
+		} else
+		if (TLVP_PRESENT(&tp, GSM48_IE_F_CH_SEQ_BEFORE)) {
+			const uint8_t *v =
+				TLVP_VAL(&tp, GSM48_IE_F_CH_SEQ_BEFORE);
+			uint8_t len = TLVP_LEN(&tp, GSM48_IE_F_CH_SEQ_BEFORE);
+
+			LOGP(DRR, LOGL_INFO, " before: hopping required and "
+				"frequency channel sequence available\n");
+			if (len + 1 > sizeof(cdb->freq_seq_lv)) {
+				LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+				return -ENOMEM;
+			}
+			cdb->freq_seq_lv[0] = len;
+			memcpy(cdb->freq_seq_lv, v + 1, *v);
+		} else
+		if (cda->mob_alloc_lv[0]) {
+			LOGP(DRR, LOGL_INFO, " before: hopping required and "
+				"mobile allocation not available, using "
+				"mobile allocation after time\n");
+			memcpy(cdb->mob_alloc_lv, cda->mob_alloc_lv,
+				sizeof(cdb->mob_alloc_lv));
+		} else
+		if (cda->freq_list_lv[0]) {
+			LOGP(DRR, LOGL_INFO, " before: hopping required and "
+				"frequency list not available, using "
+				"frequency list after time\n");
+			memcpy(cdb->freq_list_lv, cda->freq_list_lv,
+				sizeof(cdb->freq_list_lv));
+		} else {
+			LOGP(DRR, LOGL_NOTICE, " before: hopping required, but "
+				"no mobile allocation / frequency list\n");
+		}
+	}
+
+	/* cell channel description */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CELL_CH_DESC)) {
+		const uint8_t *v = TLVP_VAL(&tp, GSM48_IE_CELL_CH_DESC);
+		uint8_t len = TLVP_LEN(&tp, GSM48_IE_CELL_CH_DESC);
+
+		LOGP(DRR, LOGL_INFO, " both: using cell channel description "
+			"in case of mobile allocation\n");
+		if (len + 1 > sizeof(cdb->cell_desc_lv)) {
+			LOGP(DRR, LOGL_ERROR, "Error: no LV space!\n");
+			return -ENOMEM;
+		}
+		cdb->cell_desc_lv[0] = len;
+		memcpy(cdb->cell_desc_lv + 1, v, len);
+		cda->cell_desc_lv[0] = len;
+		memcpy(cda->cell_desc_lv + 1, v, len);
+	} else {
+		/* keep old */
+		memcpy(cdb->cell_desc_lv, rr->cd_now.cell_desc_lv,
+			sizeof(cdb->cell_desc_lv));
+		memcpy(cda->cell_desc_lv, rr->cd_now.cell_desc_lv,
+			sizeof(cda->cell_desc_lv));
+	}
+
+	/* channel mode */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CHANMODE_1)) {
+		cda->mode = cdb->mode = *TLVP_VAL(&tp, GSM48_IE_CHANMODE_1);
+		LOGP(DRR, LOGL_INFO, " both: changing channel mode 0x%02x\n",
+			cda->mode);
+	} else
+		cda->mode = cdb->mode = rr->cd_now.mode;
+
+	/* cipher mode setting */
+	if (TLVP_PRESENT(&tp, GSM48_IE_CIP_MODE_SET)) {
+		cda->cipher = cdb->cipher =
+			*TLVP_VAL(&tp, GSM48_IE_CIP_MODE_SET);
+		LOGP(DRR, LOGL_INFO, " both: changing cipher mode 0x%02x\n",
+			cda->cipher);
+	} else
+		cda->cipher = cdb->cipher = rr->cd_now.cipher;
+
+	/* power command and TA (before and after time) */
+	gsm48_decode_power_cmd_acc(
+		(struct gsm48_power_cmd *) &ho->power_command,
+		&cda->ind_tx_power, &rr->hando_act);
+	cdb->ind_tx_power = cda->ind_tx_power;
+	cda->ind_ta = cdb->ind_ta = rr->cd_now.ind_ta; /* same cell */
+	LOGP(DRR, LOGL_INFO, " both: (tx_power %d TA %d access=%s)\n",
+		cda->ind_tx_power, cda->ind_ta,
+		(rr->hando_act) ? "optional" : "mandatory");
+
+	/* check if we have to change channel at starting time */
+	if (cda->start) {
+		int32_t now, start, diff;
+
+		/* how much time do we have left? */
+		now = ms->meas.last_fn % 42432;
+		start = cda->start_tm.fn % 42432;
+		diff = start - now;
+		if (diff < 0)
+			diff += 42432;
+		LOGP(DRR, LOGL_INFO, " after: (Tnow %d Tstart %d diff %d)\n",
+			now, start, diff);
+		start_mili = (uint32_t)diff * 19580 / 42432 * 10;
+		if (diff >= 32024 || !start_mili) {
+			LOGP(DRR, LOGL_INFO, " -> Start time already "
+				"elapsed\n");
+			before_time = 0;
+			cda->start = 0;
+		} else {
+			LOGP(DRR, LOGL_INFO, " -> Start time is %d ms in the "
+				"future\n", start_mili);
+		}
+	}
+
+	/* check if channels are valid */
+	if (before_time) {
+		cause = gsm48_rr_render_ma(ms, cdb, ma, &ma_len);
+		if (cause)
+			return gsm48_rr_tx_hando_fail(ms, cause, RSL_MT_DATA_REQ);
+	}
+	cause = gsm48_rr_render_ma(ms, cda, ma, &ma_len);
+	if (cause)
+		return gsm48_rr_tx_hando_fail(ms, cause, RSL_MT_DATA_REQ);
+
+
+#if 0
+	if (not supported) {
+		LOGP(DRR, LOGL_NOTICE, "New channel is not supported.\n");
+		return GSM48_RR_CAUSE_CHAN_MODE_UNACCEPT;
+	}
+#endif
+
+#ifdef TEST_FREQUENCY_MOD
+	LOGP(DRR, LOGL_INFO, " TESTING: frequency modify HANDO.CMD\n");
+	before_time = 1;
+	memcpy(cdb, cda, sizeof(*cdb));
+	cdb->h = 0;
+	cdb->arfcn = 0;
+#endif
+
+	/* schedule start of handover */
+	rr->modify_state = GSM48_RR_MOD_HANDO;
+	if (!before_time && cda->start) {
+		start_rr_t_starting(rr, start_mili / 1000, start_mili % 1000);
+		/* when timer fires, start time is already elapsed */
+		cda->start = 0;
+
+		return 0;
+	}
+
+	/* if no starting time, start suspension of current link directly */
+	LOGP(DRR, LOGL_INFO, "request suspension of data link\n");
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_send_rsl(ms, RSL_MT_SUSP_REQ, nmsg, 0);
+
+	/* release SAPI 3 link, if exits
+	 * FIXME: suspend and resume afterward */
+	gsm48_release_sapi3_link(ms);
+
+	return 0;
+}
+
+/* send all queued messages down to layer 2 */
+static int gsm48_rr_dequeue_down(struct osmocom_ms *ms)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct msgb *msg;
+
+	while((msg = msgb_dequeue(&rr->downqueue))) {
+		struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *) msg->data;
+		uint8_t sapi = rrh->sapi;
+
+		LOGP(DRR, LOGL_INFO, "Sending queued message.\n");
+		if (sapi && rr->sapi3_state != GSM48_RR_SAPI3ST_ESTAB) {
+			LOGP(DRR, LOGL_INFO, "Dropping SAPI 3 msg, no link!\n");
+			msgb_free(msg);
+			return 0;
+		}
+		gsm48_send_rsl(ms, RSL_MT_DATA_REQ, msg, 0);
+	}
+
+	return 0;
+}
+
+/* channel is resumed in dedicated mode */
+static int gsm48_rr_estab_cnf_dedicated(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+
+	LOGP(DRR, LOGL_INFO, "data link is resumed\n");
+
+	/* transmit queued frames during ho / ass transition */
+	gsm48_rr_dequeue_down(ms);
+
+	rr->modify_state = GSM48_RR_MOD_NONE;
+
+	return 0;
+}
+
+/* suspend confirm in dedicated mode */
+static int gsm48_rr_susp_cnf_dedicated(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+
+	if (rr->modify_state) {
+		uint16_t ma[64];
+		uint8_t ma_len;
+
+		/* deactivating dedicated mode */
+		LOGP(DRR, LOGL_INFO, "suspension coplete, leaving dedicated "
+			"mode\n");
+		l1ctl_tx_dm_rel_req(ms);
+		ms->meas.rl_fail = 0;
+		rr->dm_est = 0;
+		l1ctl_tx_reset_req(ms, L1CTL_RES_T_SCHED);
+
+		/* store current channel descriptions */
+		memcpy(&rr->cd_last, &rr->cd_now, sizeof(rr->cd_last));
+
+		/* copy channel description "after time" */
+		memcpy(&rr->cd_now, &rr->cd_after, sizeof(rr->cd_now));
+
+		if (rr->cd_after.start) {
+			/* render channel "before time" */
+			gsm48_rr_render_ma(ms, &rr->cd_before, ma, &ma_len);
+
+			/* activate channel */
+			gsm48_rr_activate_channel(ms, &rr->cd_before, ma,
+				ma_len);
+
+			/* render channel "after time" */
+			gsm48_rr_render_ma(ms, &rr->cd_now, ma, &ma_len);
+
+			/* schedule change of channel */
+			gsm48_rr_channel_after_time(ms, &rr->cd_now, ma, ma_len,
+				rr->cd_now.start_tm.fn);
+		} else {
+			/* render channel "after time" */
+			gsm48_rr_render_ma(ms, &rr->cd_now, ma, &ma_len);
+
+			/* activate channel */
+			gsm48_rr_activate_channel(ms, &rr->cd_now, ma, ma_len);
+		}
+
+		/* send DL-RESUME REQUEST */
+		LOGP(DRR, LOGL_INFO, "request resume of data link\n");
+		switch (rr->modify_state) {
+		case GSM48_RR_MOD_ASSIGN:
+			gsm48_rr_tx_ass_cpl(ms, GSM48_RR_CAUSE_NORMAL);
+			break;
+		case GSM48_RR_MOD_HANDO:
+			gsm48_rr_tx_hando_cpl(ms, GSM48_RR_CAUSE_NORMAL);
+			break;
+		}
+
+#ifdef TODO
+		/* trigger RACH */
+		if (rr->modify_state == GSM48_RR_MOD_HANDO) {
+			gsm48_rr_tx_hando_access(ms);
+			rr->hando_acc_left = 3;
+		}
+#endif
+	}
+	return 0;
+}
+
+/*
+ * radio ressource requests
+ */
+
+/* establish request for dedicated mode */
+static int gsm48_rr_est_req(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct gsm48_sysinfo *s = &cs->sel_si;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *) msg->data;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	uint8_t cause;
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+	uint16_t acc_class;
+
+	/* 3.3.1.1.3.2 */
+	if (osmo_timer_pending(&rr->t3122)) {
+		if (rrh->cause != RR_EST_CAUSE_EMERGENCY) {
+			LOGP(DRR, LOGL_INFO, "T3122 running, rejecting!\n");
+			cause = RR_REL_CAUSE_T3122;
+			reject:
+			LOGP(DSUM, LOGL_INFO, "Establishing radio link not "
+				"possible\n");
+			nmsg = gsm48_rr_msgb_alloc(GSM48_RR_REL_IND);
+			if (!nmsg)
+				return -ENOMEM;
+			nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+			nrrh->cause = cause;
+			return gsm48_rr_upmsg(ms, nmsg);
+		}
+		LOGP(DRR, LOGL_INFO, "T3122 running, but emergency call\n");
+		stop_rr_t3122(rr);
+	}
+
+	/* if state is not idle */
+	if (rr->state != GSM48_RR_ST_IDLE) {
+		LOGP(DRR, LOGL_INFO, "We are not IDLE yet, rejecting!\n");
+		cause = RR_REL_CAUSE_TRY_LATER;
+	 	goto reject;
+	}
+
+	/* cell selected */
+	if (!cs->selected) {
+		LOGP(DRR, LOGL_INFO, "No cell selected, rejecting!\n");
+		cause = RR_REL_CAUSE_TRY_LATER;
+	 	goto reject;
+	}
+
+	/* check if camping */
+	if (cs->state != GSM322_C3_CAMPED_NORMALLY
+	 && rrh->cause != RR_EST_CAUSE_EMERGENCY) {
+		LOGP(DRR, LOGL_INFO, "Not camping normally, rejecting! "
+			"(cs->state = %d)\n", cs->state);
+		cause = RR_REL_CAUSE_EMERGENCY_ONLY;
+	 	goto reject;
+	}
+	if (cs->state != GSM322_C3_CAMPED_NORMALLY
+	 && cs->state != GSM322_C7_CAMPED_ANY_CELL) {
+		LOGP(DRR, LOGL_INFO, "Not camping, rejecting! "
+			"(cs->state = %d)\n", cs->state);
+		cause = RR_REL_CAUSE_TRY_LATER;
+	 	goto reject;
+	}
+
+	/* check for relevant informations */
+	if (!s->si3) {
+		LOGP(DRR, LOGL_INFO, "Not enough SI, rejecting!\n");
+		cause = RR_REL_CAUSE_TRY_LATER;
+	 	goto reject;
+	}
+
+	/* 3.3.1.1.1 */
+	if (!subscr->acc_barr && s->cell_barr) {
+		LOGP(DRR, LOGL_INFO, "Cell barred, rejecting!\n");
+	 	cause = RR_REL_CAUSE_NOT_AUTHORIZED;
+		goto reject;
+	}
+	if (rrh->cause == RR_EST_CAUSE_EMERGENCY)
+		acc_class = subscr->acc_class | 0x0400;
+	else
+		acc_class = subscr->acc_class & 0xfbff;
+	if (!subscr->acc_barr && !(acc_class & (s->class_barr ^ 0xffff))) {
+		LOGP(DRR, LOGL_INFO, "Cell barred for our access class (access "
+			"%04x barred %04x)!\n", acc_class, s->class_barr);
+	 	cause = RR_REL_CAUSE_NOT_AUTHORIZED;
+		goto reject;
+	}
+
+	/* requested by RR */
+	rr->rr_est_req = 1;
+
+	/* clone and store REQUEST message */
+	if (!gh) {
+		LOGP(DRR, LOGL_ERROR, "Error, missing l3 message\n");
+		return -EINVAL;
+	}
+	rr->rr_est_msg = gsm48_l3_msgb_alloc();
+	if (!rr->rr_est_msg)
+		return -ENOMEM;
+	memcpy(msgb_put(rr->rr_est_msg, msgb_l3len(msg)),
+		msgb_l3(msg), msgb_l3len(msg));
+
+	/* request channel */
+	return gsm48_rr_chan_req(ms, rrh->cause, 0, 0);
+}
+
+/* 3.4.2 transfer data in dedicated mode */
+static int gsm48_rr_data_req(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *) msg->data;
+	uint8_t sapi = rrh->sapi;
+
+	if (rr->state != GSM48_RR_ST_DEDICATED) {
+		msgb_free(msg);
+		return -EINVAL;
+	}
+
+	/* pull RR header */
+	msgb_pull(msg, sizeof(struct gsm48_rr_hdr));
+
+	/* set sequence number and increment */
+	gsm48_apply_v_sd(rr, msg);
+
+	/* queue message, during handover or assignment procedure */
+	if (rr->modify_state == GSM48_RR_MOD_ASSIGN
+	 || rr->modify_state == GSM48_RR_MOD_HANDO) {
+		LOGP(DRR, LOGL_INFO, "Queueing message during suspend.\n");
+		msgb_enqueue(&rr->downqueue, msg);
+		return 0;
+	}
+
+	if (sapi && rr->sapi3_state != GSM48_RR_SAPI3ST_ESTAB) {
+		LOGP(DRR, LOGL_INFO, "Dropping SAPI 3 msg, no link!\n");
+		msgb_free(msg);
+		return 0;
+	}
+
+	/* forward message */
+	return gsm48_send_rsl(ms, RSL_MT_DATA_REQ, msg,
+					sapi ? rr->sapi3_link_id : 0);
+}
+
+/*
+ * data indications from data link
+ */
+
+/* 3.4.2 data from layer 2 to RR and upper layer*/
+static int gsm48_rr_data_ind(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_rr_hdr *rrh;
+	uint8_t pdisc = gh->proto_discr & 0x0f;
+
+	if (pdisc == GSM48_PDISC_RR) {
+		int rc = -EINVAL;
+		uint8_t skip_ind = (gh->proto_discr & 0xf0) >> 4;
+
+		/* ignore if skip indicator is not B'0000' */
+		if (skip_ind)
+			return 0;
+
+		switch(gh->msg_type) {
+		case GSM48_MT_RR_ADD_ASS:
+			rc = gsm48_rr_rx_add_ass(ms, msg);
+			break;
+		case GSM48_MT_RR_ASS_CMD:
+			rc = gsm48_rr_rx_ass_cmd(ms, msg);
+			break;
+		case GSM48_MT_RR_CIPH_M_CMD:
+			rc = gsm48_rr_rx_cip_mode_cmd(ms, msg);
+			break;
+		case GSM48_MT_RR_CLSM_ENQ:
+			rc = gsm48_rr_rx_cm_enq(ms, msg);
+			break;
+		case GSM48_MT_RR_CHAN_MODE_MODIF:
+			rc = gsm48_rr_rx_chan_modify(ms, msg);
+			break;
+		case GSM48_MT_RR_HANDO_CMD:
+			rc = gsm48_rr_rx_hando_cmd(ms, msg);
+			break;
+		case GSM48_MT_RR_FREQ_REDEF:
+			rc = gsm48_rr_rx_frq_redef(ms, msg);
+			break;
+		case GSM48_MT_RR_CHAN_REL:
+			rc = gsm48_rr_rx_chan_rel(ms, msg);
+			break;
+		case GSM48_MT_RR_APP_INFO:
+			LOGP(DRR, LOGL_NOTICE, "APP INFO not supported!\n");
+			break;
+		default:
+			LOGP(DRR, LOGL_NOTICE, "Message type 0x%02x unknown.\n",
+				gh->msg_type);
+
+			/* status message */
+			gsm48_rr_tx_rr_status(ms, GSM48_RR_CAUSE_MSG_TYPE_N);
+		}
+
+		msgb_free(msg);
+		return rc;
+	}
+
+	/* pull off RSL header up to L3 message */
+	msgb_pull(msg, (long)msgb_l3(msg) - (long)msg->data);
+
+	/* push RR header */
+	msgb_push(msg, sizeof(struct gsm48_rr_hdr));
+	rrh = (struct gsm48_rr_hdr *)msg->data;
+	rrh->msg_type = GSM48_RR_DATA_IND;
+
+	return gsm48_rr_upmsg(ms, msg);
+}
+
+/* receive BCCH at RR layer */
+static int gsm48_rr_rx_bcch(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_header *sih = msgb_l3(msg);
+
+	switch (sih->system_information) {
+	case GSM48_MT_RR_SYSINFO_1:
+		return gsm48_rr_rx_sysinfo1(ms, msg);
+	case GSM48_MT_RR_SYSINFO_2:
+		return gsm48_rr_rx_sysinfo2(ms, msg);
+	case GSM48_MT_RR_SYSINFO_2bis:
+		return gsm48_rr_rx_sysinfo2bis(ms, msg);
+	case GSM48_MT_RR_SYSINFO_2ter:
+		return gsm48_rr_rx_sysinfo2ter(ms, msg);
+	case GSM48_MT_RR_SYSINFO_3:
+		return gsm48_rr_rx_sysinfo3(ms, msg);
+	case GSM48_MT_RR_SYSINFO_4:
+		return gsm48_rr_rx_sysinfo4(ms, msg);
+	default:
+#if 0
+		LOGP(DRR, LOGL_NOTICE, "BCCH message type 0x%02x not sup.\n",
+			sih->system_information);
+#endif
+		return -EINVAL;
+	}
+}
+
+/* receive CCCH at RR layer */
+static int gsm48_rr_rx_pch_agch(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_system_information_type_header *sih = msgb_l3(msg);
+
+	switch (sih->system_information) {
+	case GSM48_MT_RR_PAG_REQ_1:
+		return gsm48_rr_rx_pag_req_1(ms, msg);
+	case GSM48_MT_RR_PAG_REQ_2:
+		return gsm48_rr_rx_pag_req_2(ms, msg);
+	case GSM48_MT_RR_PAG_REQ_3:
+		return gsm48_rr_rx_pag_req_3(ms, msg);
+
+	case GSM48_MT_RR_IMM_ASS:
+		return gsm48_rr_rx_imm_ass(ms, msg);
+	case GSM48_MT_RR_IMM_ASS_EXT:
+		return gsm48_rr_rx_imm_ass_ext(ms, msg);
+	case GSM48_MT_RR_IMM_ASS_REJ:
+		return gsm48_rr_rx_imm_ass_rej(ms, msg);
+	default:
+#if 0
+		LOGP(DRR, LOGL_NOTICE, "CCCH message type 0x%02x unknown.\n",
+			sih->system_information);
+#endif
+		return -EINVAL;
+	}
+}
+
+/* receive ACCH at RR layer */
+static int gsm48_rr_rx_acch(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm_settings *set = &ms->settings;
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	struct gsm48_hdr *sih = msgb_l3(msg);
+	uint8_t ind_ta, ind_tx_power;
+
+	if (msgb_l2len(msg) < sizeof(*rllh) + 2 + 2) {
+		LOGP(DRR, LOGL_ERROR, "Missing TA and TX_POWER IEs\n");
+		return -EINVAL;
+	}
+
+	ind_ta = rllh->data[1];
+	ind_tx_power = rllh->data[3];
+	LOGP(DRR, LOGL_INFO, "Indicated ta %d (actual ta %d)\n",
+		ind_ta, ind_ta - set->alter_delay);
+	LOGP(DRR, LOGL_INFO, "Indicated tx_power %d\n",
+		ind_tx_power);
+	if (ind_ta != rr->cd_now.ind_ta
+	 || ind_tx_power != rr->cd_now.ind_tx_power) {
+		LOGP(DRR, LOGL_INFO, "setting new ta and tx_power\n");
+		l1ctl_tx_param_req(ms, ind_ta - set->alter_delay,
+			(set->alter_tx_power) ? set->alter_tx_power_value
+						: ind_tx_power);
+		rr->cd_now.ind_ta = ind_ta;
+		rr->cd_now.ind_tx_power = ind_tx_power;
+	}
+
+	switch (sih->msg_type) {
+	case GSM48_MT_RR_SYSINFO_5:
+		return gsm48_rr_rx_sysinfo5(ms, msg);
+	case GSM48_MT_RR_SYSINFO_5bis:
+		return gsm48_rr_rx_sysinfo5bis(ms, msg);
+	case GSM48_MT_RR_SYSINFO_5ter:
+		return gsm48_rr_rx_sysinfo5ter(ms, msg);
+	case GSM48_MT_RR_SYSINFO_6:
+		return gsm48_rr_rx_sysinfo6(ms, msg);
+	default:
+		LOGP(DRR, LOGL_NOTICE, "ACCH message type 0x%02x unknown.\n",
+			sih->msg_type);
+		return -EINVAL;
+	}
+}
+
+/* unit data from layer 2 to RR layer */
+static int gsm48_rr_unit_data_ind(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm322_cellsel *cs = &ms->cellsel;
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	struct tlv_parsed tv;
+	uint8_t ch_type, ch_subch, ch_ts;
+
+	DEBUGP(DRSL, "RSLms UNIT DATA IND chan_nr=0x%02x link_id=0x%02x\n",
+		rllh->chan_nr, rllh->link_id);
+
+	rsl_tlv_parse(&tv, rllh->data, msgb_l2len(msg)-sizeof(*rllh));
+	if (!TLVP_PRESENT(&tv, RSL_IE_L3_INFO)) {
+		DEBUGP(DRSL, "UNIT_DATA_IND without L3 INFO ?!?\n");
+		return -EIO;
+	}
+	msg->l3h = (uint8_t *) TLVP_VAL(&tv, RSL_IE_L3_INFO);
+
+	if (cs->ccch_state != GSM322_CCCH_ST_SYNC
+	 && cs->ccch_state != GSM322_CCCH_ST_DATA)
+	 	return -EINVAL;
+
+	/* temporary moved here until confirm is fixed */
+	if (cs->ccch_state != GSM322_CCCH_ST_DATA) {
+		LOGP(DCS, LOGL_INFO, "Channel provides data.\n");
+		cs->ccch_state = GSM322_CCCH_ST_DATA;
+
+		/* in dedicated mode */
+		if (ms->rrlayer.state == GSM48_RR_ST_CONN_PEND)
+			return gsm48_rr_tx_rand_acc(ms, NULL);
+
+		/* set timer for reading BCCH */
+		if (cs->state == GSM322_C2_STORED_CELL_SEL
+		 || cs->state == GSM322_C1_NORMAL_CELL_SEL
+		 || cs->state == GSM322_C6_ANY_CELL_SEL
+		 || cs->state == GSM322_C4_NORMAL_CELL_RESEL
+		 || cs->state == GSM322_C8_ANY_CELL_RESEL
+		 || cs->state == GSM322_C5_CHOOSE_CELL
+		 || cs->state == GSM322_C9_CHOOSE_ANY_CELL
+		 || cs->state == GSM322_PLMN_SEARCH
+		 || cs->state == GSM322_HPLMN_SEARCH)
+			start_cs_timer(cs, ms->support.scan_to, 0);
+				// TODO: timer depends on BCCH config
+	}
+
+	rsl_dec_chan_nr(rllh->chan_nr, &ch_type, &ch_subch, &ch_ts);
+	switch (ch_type) {
+	case RSL_CHAN_PCH_AGCH:
+		return gsm48_rr_rx_pch_agch(ms, msg);
+	case RSL_CHAN_BCCH:
+		return gsm48_rr_rx_bcch(ms, msg);
+	case RSL_CHAN_Bm_ACCHs:
+	case RSL_CHAN_Lm_ACCHs:
+	case RSL_CHAN_SDCCH4_ACCH:
+	case RSL_CHAN_SDCCH8_ACCH:
+		return gsm48_rr_rx_acch(ms, msg);
+	default:
+		LOGP(DRSL, LOGL_NOTICE, "RSL with chan_nr 0x%02x unknown.\n",
+			rllh->chan_nr);
+		return -EINVAL;
+	}
+}
+
+/* 3.4.13.3 RR abort in dedicated mode (also in conn. pending mode) */
+static int gsm48_rr_abort_req(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	uint8_t *mode;
+
+	/* stop pending RACH timer */
+	stop_rr_t3126(rr);
+
+	/* release "normally" if we are in dedicated mode */
+	if (rr->state == GSM48_RR_ST_DEDICATED) {
+		struct msgb *nmsg;
+
+		LOGP(DRR, LOGL_INFO, "Abort in dedicated state, send release "
+			"to layer 2.\n");
+
+		new_rr_state(rr, GSM48_RR_ST_REL_PEND);
+
+		/* release message */
+		nmsg = gsm48_l3_msgb_alloc();
+		if (!nmsg)
+			return -ENOMEM;
+		mode = msgb_put(nmsg, 2);
+		mode[0] = RSL_IE_RELEASE_MODE;
+		mode[1] = 0; /* normal release */
+		gsm48_send_rsl_nol3(ms, RSL_MT_REL_REQ, nmsg, 0);
+
+		/* release SAPI 3 link, if exits */
+		gsm48_release_sapi3_link(ms);
+		return 0;
+	}
+
+	LOGP(DRR, LOGL_INFO, "Abort in connection pending state, return to "
+		"idle state.\n");
+	/* return idle */
+	new_rr_state(rr, GSM48_RR_ST_IDLE);
+
+	return 0;
+}
+
+/* release confirm */
+static int gsm48_rr_rel_cnf(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+	uint8_t cause = RR_REL_CAUSE_NORMAL;
+	uint16_t ma[64];
+	uint8_t ma_len;
+
+	/* switch back to old channel, if modify/ho failed */
+	switch (rr->modify_state) {
+	case GSM48_RR_MOD_ASSIGN:
+	case GSM48_RR_MOD_HANDO:
+		/* deactivate channel */
+		l1ctl_tx_dm_rel_req(ms);
+		ms->meas.rl_fail = 0;
+		rr->dm_est = 0;
+		l1ctl_tx_reset_req(ms, L1CTL_RES_T_SCHED);
+
+		/* get old channel description */
+		memcpy(&rr->cd_now, &rr->cd_last, sizeof(rr->cd_now));
+
+		/* render and change radio to old channel */
+		gsm48_rr_render_ma(ms, &rr->cd_now, ma, &ma_len);
+		gsm48_rr_activate_channel(ms, &rr->cd_now, ma, ma_len);
+
+		/* re-establish old link */
+		nmsg = gsm48_l3_msgb_alloc();
+		if (!nmsg)
+			return -ENOMEM;
+		if (rr->modify_state == GSM48_RR_MOD_ASSIGN) {
+			rr->modify_state = GSM48_RR_MOD_ASSIGN_RESUME;
+			return gsm48_rr_tx_ass_fail(ms,
+				GSM48_RR_CAUSE_ABNORMAL_UNSPEC,
+				RSL_MT_RECON_REQ);
+		} else {
+			rr->modify_state = GSM48_RR_MOD_HANDO_RESUME;
+			return gsm48_rr_tx_hando_fail(ms,
+				GSM48_RR_CAUSE_ABNORMAL_UNSPEC,
+				RSL_MT_RECON_REQ);
+		}
+		/* returns above */
+	case GSM48_RR_MOD_ASSIGN_RESUME:
+	case GSM48_RR_MOD_HANDO_RESUME:
+		rr->modify_state = GSM48_RR_MOD_NONE;
+		cause = RR_REL_CAUSE_LINK_FAILURE;
+		break;
+	}
+
+	LOGP(DSUM, LOGL_INFO, "Requested channel aborted\n");
+
+	/* stop T3211 if running */
+	stop_rr_t3110(rr);
+
+	/* send release indication */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_REL_IND);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+	nrrh->cause = cause;
+	gsm48_rr_upmsg(ms, nmsg);
+
+	/* return idle */
+	new_rr_state(rr, GSM48_RR_ST_IDLE);
+	return 0;
+}
+
+/* MDL-ERROR */
+static int gsm48_rr_mdl_error_ind(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+	uint8_t *mode;
+	uint8_t cause = rllh->data[2];
+	uint8_t link_id = rllh->link_id;
+
+	switch (cause) {
+	case RLL_CAUSE_SEQ_ERR:
+	case RLL_CAUSE_UNSOL_DM_RESP_MF:
+		break;
+	default:
+		LOGP(DRR, LOGL_NOTICE, "MDL-Error (cause %d) ignoring\n",
+			cause);
+		return 0;
+	}
+
+	LOGP(DRR, LOGL_NOTICE, "MDL-Error (cause %d) aborting\n", cause);
+
+	/* disconnect the (main) signalling link */
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	mode = msgb_put(nmsg, 2);
+	mode[0] = RSL_IE_RELEASE_MODE;
+	mode[1] = 1; /* local release */
+	gsm48_send_rsl_nol3(ms, RSL_MT_REL_REQ, nmsg, link_id);
+
+	/* in case of modify/hando: wait for confirm */
+	if (rr->modify_state)
+		return 0;
+
+	/* send abort ind to upper layer */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_ABORT_IND);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+	nrrh->cause = RR_REL_CAUSE_LINK_FAILURE;
+	nrrh->sapi = link_id & 7;
+	gsm48_rr_upmsg(ms, nmsg);
+
+	/* only for main signalling link */
+	if ((link_id & 7) == 0) {
+		/* return idle */
+		new_rr_state(rr, GSM48_RR_ST_IDLE);
+		/* release SAPI 3 link, if exits */
+		gsm48_release_sapi3_link(ms);
+	} else {
+		new_sapi3_state(rr, GSM48_RR_SAPI3ST_IDLE);
+		LOGP(DSUM, LOGL_INFO, "Radio link SAPI3 failed\n");
+	}
+	return 0;
+}
+
+static int gsm48_rr_estab_ind_sapi3(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	uint8_t link_id = rllh->link_id;
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+
+	if (rr->state != GSM48_RR_ST_DEDICATED) {
+		/* disconnect sapi 3 link */
+		gsm48_release_sapi3_link(ms);
+		return -EINVAL;
+	}
+
+	new_sapi3_state(rr, GSM48_RR_SAPI3ST_ESTAB);
+	rr->sapi3_link_id = link_id; /* set link ID */
+
+	LOGP(DSUM, LOGL_INFO, "Radio link SAPI3 is established\n");
+
+	if ((link_id & 0xf8) == 0x00) {
+		/* raise T200 of SAPI 0 */
+		ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_sec =
+			T200_DCCH_SHARED;
+		ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_usec= 0;
+	}
+
+	/* send inication to upper layer */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_EST_IND);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+	nrrh->sapi = link_id & 7;
+
+	return gsm48_rr_upmsg(ms, nmsg);
+}
+
+static int gsm48_rr_estab_cnf_sapi3(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	uint8_t link_id = rllh->link_id;
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+
+	if (rr->state != GSM48_RR_ST_DEDICATED) {
+		gsm48_release_sapi3_link(ms);
+		return -EINVAL;
+	}
+
+	new_sapi3_state(rr, GSM48_RR_SAPI3ST_ESTAB);
+	rr->sapi3_link_id = link_id; /* set link ID, just to be sure */
+
+	LOGP(DSUM, LOGL_INFO, "Radio link SAPI3 is established\n");
+
+	/* send inication to upper layer */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_EST_CNF);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+	nrrh->sapi = link_id & 7;
+
+	return gsm48_rr_upmsg(ms, nmsg);
+}
+
+/* 3.4.2 data from layer 2 to RR and upper layer (sapi 3)*/
+static int gsm48_rr_data_ind_sapi3(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	uint8_t sapi = rllh->link_id & 7;
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_rr_hdr *rrh;
+	uint8_t pdisc = gh->proto_discr & 0x0f;
+
+	if (pdisc == GSM48_PDISC_RR) {
+		msgb_free(msg);
+		return -EINVAL;
+	}
+
+	/* pull off RSL header up to L3 message */
+	msgb_pull(msg, (long)msgb_l3(msg) - (long)msg->data);
+
+	/* push RR header */
+	msgb_push(msg, sizeof(struct gsm48_rr_hdr));
+	rrh = (struct gsm48_rr_hdr *)msg->data;
+	rrh->msg_type = GSM48_RR_DATA_IND;
+	rrh->sapi = sapi;
+
+	return gsm48_rr_upmsg(ms, msg);
+}
+
+static int gsm48_rr_rel_ind_sapi3(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	uint8_t link_id = rllh->link_id;
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+
+	new_sapi3_state(rr, GSM48_RR_SAPI3ST_IDLE);
+
+	LOGP(DSUM, LOGL_INFO, "Radio link SAPI3 is released\n");
+
+	/* lower T200 of SAPI 0 */
+	ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_sec =
+		T200_DCCH;
+	ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_usec = 0;
+
+	/* send inication to upper layer */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_REL_IND);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+	nrrh->cause = RR_REL_CAUSE_NORMAL;
+	nrrh->sapi = link_id & 7;
+
+	return gsm48_rr_upmsg(ms, nmsg);
+}
+
+/* request SAPI 3 establishment */
+static int gsm48_rr_est_req_sapi3(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	uint8_t ch_type, ch_subch, ch_ts;
+	struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *) msg->data;
+	uint8_t sapi = rrh->sapi;
+	struct msgb *nmsg;
+
+	if (rr->state != GSM48_RR_ST_DEDICATED) {
+		struct gsm48_rr_hdr *nrrh;
+
+		/* send inication to upper layer */
+		nmsg = gsm48_rr_msgb_alloc(GSM48_RR_REL_IND);
+		if (!nmsg)
+			return -ENOMEM;
+		nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+		nrrh->cause = RR_REL_CAUSE_NORMAL;
+		nrrh->sapi = sapi;
+		return gsm48_rr_upmsg(ms, nmsg);
+	}
+
+	rsl_dec_chan_nr(rr->cd_now.chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (ch_type != RSL_CHAN_Bm_ACCHs
+	 && ch_type != RSL_CHAN_Lm_ACCHs) {
+		LOGP(DRR, LOGL_INFO, "Requesting DCCH link, because no TCH "
+			"(sapi %d)\n", sapi);
+		rr->sapi3_link_id = 0x00 | sapi; /* SAPI 3, DCCH */
+		/* raise T200 of SAPI 0 */
+		ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_sec =
+			T200_DCCH_SHARED;
+		ms->lapdm_channel.lapdm_dcch.datalink[DL_SAPI0].dl.t200_usec= 0;
+	} else {
+		LOGP(DRR, LOGL_INFO, "Requesting ACCH link, because TCH "
+			"(sapi %d)\n", sapi);
+		rr->sapi3_link_id = 0x40 | sapi; /* SAPI 3, ACCH */
+	}
+
+	/* already established */
+	new_sapi3_state(rr, GSM48_RR_SAPI3ST_WAIT_EST);
+
+	/* send message */
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	return gsm48_send_rsl_nol3(ms, RSL_MT_EST_REQ, nmsg, rr->sapi3_link_id);
+}
+
+static int gsm48_rr_est_req_estab_sapi3(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *) msg->data;
+	uint8_t sapi = rrh->sapi;
+	struct msgb *nmsg;
+	struct gsm48_rr_hdr *nrrh;
+
+	LOGP(DRR, LOGL_INFO, "Radio link SAPI3 already established\n");
+
+	/* send inication to upper layer */
+	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_EST_CNF);
+	if (!nmsg)
+		return -ENOMEM;
+	nrrh = (struct gsm48_rr_hdr *)nmsg->data;
+	nrrh->sapi = sapi;
+
+	return gsm48_rr_upmsg(ms, nmsg);
+}
+
+/*
+ * state machines
+ */
+
+/* state trasitions for link layer messages (lower layer) */
+static struct dldatastate {
+	uint32_t	states;
+	int		type;
+	int		(*rout) (struct osmocom_ms *ms, struct msgb *msg);
+} dldatastatelist[] = {
+	/* SAPI 0 on DCCH */
+
+	/* data transfer */
+	{SBIT(GSM48_RR_ST_IDLE) |
+	 SBIT(GSM48_RR_ST_CONN_PEND) |
+	 SBIT(GSM48_RR_ST_DEDICATED) |
+	 SBIT(GSM48_RR_ST_REL_PEND),
+	 RSL_MT_UNIT_DATA_IND, gsm48_rr_unit_data_ind},
+
+	{SBIT(GSM48_RR_ST_DEDICATED), /* 3.4.2 */
+	 RSL_MT_DATA_IND, gsm48_rr_data_ind},
+
+	/* esablish */
+	{SBIT(GSM48_RR_ST_IDLE) |
+	 SBIT(GSM48_RR_ST_CONN_PEND) |
+	 SBIT(GSM48_RR_ST_REL_PEND),
+	 RSL_MT_EST_CONF, gsm48_rr_estab_cnf},
+
+	/* resume */
+	{SBIT(GSM48_RR_ST_DEDICATED),
+	 RSL_MT_EST_CONF, gsm48_rr_estab_cnf_dedicated},
+
+	/* release */
+	{SBIT(GSM48_RR_ST_CONN_PEND) |
+	 SBIT(GSM48_RR_ST_DEDICATED),
+	 RSL_MT_REL_IND, gsm48_rr_rel_ind},
+
+	{SBIT(GSM48_RR_ST_REL_PEND),
+	 RSL_MT_REL_CONF, gsm48_rr_rel_cnf},
+
+	/* reconnect */
+	{SBIT(GSM48_RR_ST_CONN_PEND) |
+	 SBIT(GSM48_RR_ST_DEDICATED),
+	 RSL_MT_REL_CONF, gsm48_rr_rel_cnf},
+
+	/* suspenion */
+	{SBIT(GSM48_RR_ST_DEDICATED),
+	 RSL_MT_SUSP_CONF, gsm48_rr_susp_cnf_dedicated},
+
+#if 0
+	{SBIT(GSM48_RR_ST_DEDICATED),
+	 RSL_MT_CHAN_CNF, gsm48_rr_rand_acc_cnf_dedicated},
+#endif
+
+	{SBIT(GSM48_RR_ST_DEDICATED),
+	 RSL_MT_ERROR_IND, gsm48_rr_mdl_error_ind},
+};
+
+#define DLDATASLLEN \
+	(sizeof(dldatastatelist) / sizeof(struct dldatastate))
+
+static struct dldatastate dldatastatelists3[] = {
+	/* SAPI 3 on DCCH */
+
+	/* establish */
+	{SBIT(GSM48_RR_SAPI3ST_IDLE),
+	 RSL_MT_EST_IND, gsm48_rr_estab_ind_sapi3},
+
+	/* establish */
+	{SBIT(GSM48_RR_SAPI3ST_IDLE) | SBIT(GSM48_RR_SAPI3ST_WAIT_EST),
+	 RSL_MT_EST_CONF, gsm48_rr_estab_cnf_sapi3},
+
+	/* data transfer */
+	{SBIT(GSM48_RR_SAPI3ST_ESTAB),
+	 RSL_MT_DATA_IND, gsm48_rr_data_ind_sapi3},
+
+	/* release */
+	{SBIT(GSM48_RR_SAPI3ST_WAIT_EST) | SBIT(GSM48_RR_SAPI3ST_ESTAB),
+	 RSL_MT_REL_IND, gsm48_rr_rel_ind_sapi3},
+
+	{ALL_STATES,
+	 RSL_MT_ERROR_IND, gsm48_rr_mdl_error_ind},
+};
+
+#define DLDATASLLENS3 \
+	(sizeof(dldatastatelists3) / sizeof(struct dldatastate))
+
+static int gsm48_rcv_rll(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	int msg_type = rllh->c.msg_type;
+	int link_id = rllh->link_id;
+	int i;
+	int rc;
+
+	LOGP(DRSL, LOGL_INFO, "(ms %s) Received '%s' from L2 in state "
+		"%s (link_id 0x%x)\n", ms->name, rsl_msg_name(msg_type),
+		gsm48_rr_state_names[rr->state], link_id);
+
+	/* find function for current state and message */
+	if (!(link_id & 7)) {
+		/* SAPI 0 */
+		for (i = 0; i < DLDATASLLEN; i++)
+			if ((msg_type == dldatastatelist[i].type)
+			 && ((1 << rr->state) & dldatastatelist[i].states))
+				break;
+		if (i == DLDATASLLEN) {
+			LOGP(DRSL, LOGL_NOTICE, "RSLms message '%s' "
+				"unhandled\n", rsl_msg_name(msg_type));
+			msgb_free(msg);
+			return 0;
+		}
+
+		rc = dldatastatelist[i].rout(ms, msg);
+	} else {
+		/* SAPI 3 */
+		for (i = 0; i < DLDATASLLENS3; i++)
+			if ((msg_type == dldatastatelists3[i].type)
+			 && ((1 << rr->sapi3_state) &
+			     dldatastatelists3[i].states))
+				break;
+		if (i == DLDATASLLENS3) {
+			LOGP(DRSL, LOGL_NOTICE, "RSLms message '%s' "
+				"unhandled\n", rsl_msg_name(msg_type));
+			msgb_free(msg);
+			return 0;
+		}
+
+		rc = dldatastatelists3[i].rout(ms, msg);
+	}
+
+	/* free msgb unless it is forwarded */
+	if (msg_type != RSL_MT_DATA_IND)
+		msgb_free(msg);
+
+	return rc;
+}
+
+static int gsm48_rcv_cch(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct abis_rsl_cchan_hdr *ch = msgb_l2(msg);
+	int msg_type = ch->c.msg_type;
+	int rc;
+
+	LOGP(DRSL, LOGL_INFO, "(ms %s) Received '%s' from L2 in state "
+		"%s\n", ms->name, rsl_msg_name(msg_type),
+		gsm48_rr_state_names[rr->state]);
+
+	if (rr->state == GSM48_RR_ST_CONN_PEND
+	 && msg_type == RSL_MT_CHAN_CONF) {
+	 	rc = gsm48_rr_tx_rand_acc(ms, msg);
+		msgb_free(msg);
+		return rc;
+	}
+
+	LOGP(DRSL, LOGL_NOTICE, "RSLms message unhandled\n");
+	msgb_free(msg);
+	return 0;
+}
+
+
+/* input function for L2 messags up to L3 */
+static int gsm48_rcv_rsl(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct abis_rsl_common_hdr *rslh = msgb_l2(msg);
+	int rc = 0;
+
+	switch (rslh->msg_discr & 0xfe) {
+	case ABIS_RSL_MDISC_RLL:
+		rc = gsm48_rcv_rll(ms, msg);
+		break;
+	case ABIS_RSL_MDISC_COM_CHAN:
+		rc = gsm48_rcv_cch(ms, msg);
+		break;
+	default:
+		/* FIXME: implement this */
+		LOGP(DRSL, LOGL_NOTICE, "unknown RSLms msg_discr 0x%02x\n",
+			rslh->msg_discr);
+		msgb_free(msg);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+/* state trasitions for RR-SAP messages from up (main link) */
+static struct rrdownstate {
+	uint32_t	states;
+	int		type;
+	int		(*rout) (struct osmocom_ms *ms, struct msgb *msg);
+} rrdownstatelist[] = {
+	/* SAPI 0 */
+
+	/* NOTE: If not IDLE, it is rejected there. */
+	{ALL_STATES, /* 3.3.1.1 */
+	 GSM48_RR_EST_REQ, gsm48_rr_est_req},
+
+	{SBIT(GSM48_RR_ST_DEDICATED), /* 3.4.2 */
+	 GSM48_RR_DATA_REQ, gsm48_rr_data_req},
+
+	{SBIT(GSM48_RR_ST_CONN_PEND) |
+	 SBIT(GSM48_RR_ST_DEDICATED), /* 3.4.13.3 */
+	 GSM48_RR_ABORT_REQ, gsm48_rr_abort_req},
+};
+
+#define RRDOWNSLLEN \
+	(sizeof(rrdownstatelist) / sizeof(struct rrdownstate))
+
+/* state trasitions for RR-SAP messages from up with (SAPI 3) */
+static struct rrdownstate rrdownstatelists3[] = {
+	/* SAPI 3 */
+
+	{SBIT(GSM48_RR_SAPI3ST_IDLE),
+	 GSM48_RR_EST_REQ, gsm48_rr_est_req_sapi3},
+
+	{SBIT(GSM48_RR_SAPI3ST_ESTAB),
+	 GSM48_RR_EST_REQ, gsm48_rr_est_req_estab_sapi3},
+
+	{SBIT(GSM48_RR_SAPI3ST_ESTAB),
+	 GSM48_RR_DATA_REQ, gsm48_rr_data_req}, /* handles SAPI 3 too */
+};
+
+#define RRDOWNSLLENS3 \
+	(sizeof(rrdownstatelists3) / sizeof(struct rrdownstate))
+
+int gsm48_rr_downmsg(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct gsm48_rr_hdr *rrh = (struct gsm48_rr_hdr *) msg->data;
+	int msg_type = rrh->msg_type;
+	int sapi = rrh->sapi;
+	int i;
+	int rc;
+
+	LOGP(DRR, LOGL_INFO, "(ms %s) Message '%s' received in state %s "
+		"(sapi %d)\n", ms->name, get_rr_name(msg_type),
+		gsm48_rr_state_names[rr->state], sapi);
+
+	if (!sapi) {
+		/* SAPI 0: find function for current state and message */
+		for (i = 0; i < RRDOWNSLLEN; i++)
+			if ((msg_type == rrdownstatelist[i].type)
+			 && ((1 << rr->state) & rrdownstatelist[i].states))
+				break;
+		if (i == RRDOWNSLLEN) {
+			LOGP(DRR, LOGL_NOTICE, "Message unhandled at this "
+				"state.\n");
+			msgb_free(msg);
+			return 0;
+		}
+
+		rc = rrdownstatelist[i].rout(ms, msg);
+	} else {
+		/* SAPI 3: find function for current state and message */
+		for (i = 0; i < RRDOWNSLLENS3; i++)
+			if ((msg_type == rrdownstatelists3[i].type)
+			 && ((1 << rr->sapi3_state)
+			     & rrdownstatelists3[i].states))
+				break;
+		if (i == RRDOWNSLLENS3) {
+			LOGP(DRR, LOGL_NOTICE, "Message unhandled at this "
+				"state.\n");
+			msgb_free(msg);
+			return 0;
+		}
+
+		rc = rrdownstatelists3[i].rout(ms, msg);
+	}
+
+	/* free msgb unless it is forwarded */
+	if (msg_type != GSM48_RR_DATA_REQ)
+		msgb_free(msg);
+
+	return rc;
+}
+
+/*
+ * init/exit
+ */
+
+int gsm48_rr_init(struct osmocom_ms *ms)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+
+	memset(rr, 0, sizeof(*rr));
+	rr->ms = ms;
+
+	LOGP(DRR, LOGL_INFO, "init Radio Ressource process\n");
+
+	INIT_LLIST_HEAD(&rr->rsl_upqueue);
+	INIT_LLIST_HEAD(&rr->downqueue);
+	/* downqueue is handled here, so don't add_work */
+
+	lapdm_channel_set_l3(&ms->lapdm_channel, &rcv_rsl, ms);
+
+	start_rr_t_meas(rr, 1, 0);
+
+	rr->audio_mode = AUDIO_TX_MICROPHONE | AUDIO_RX_SPEAKER;
+
+	return 0;
+}
+
+int gsm48_rr_exit(struct osmocom_ms *ms)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct msgb *msg;
+
+	LOGP(DRR, LOGL_INFO, "exit Radio Ressource process\n");
+
+	/* flush queues */
+	while ((msg = msgb_dequeue(&rr->rsl_upqueue)))
+		msgb_free(msg);
+	while ((msg = msgb_dequeue(&rr->downqueue)))
+		msgb_free(msg);
+
+	if (rr->rr_est_msg) {
+		msgb_free(rr->rr_est_msg);
+		rr->rr_est_msg = NULL;
+	}
+
+	stop_rr_t_meas(rr);
+	stop_rr_t_starting(rr);
+	stop_rr_t_rel_wait(rr);
+	stop_rr_t3110(rr);
+	stop_rr_t3122(rr);
+	stop_rr_t3124(rr);
+	stop_rr_t3126(rr);
+
+	return 0;
+}
+
+#if 0
+
+todo rr_sync_ind when receiving ciph, re ass, channel mode modify
+
+
+static void timeout_rr_t3124(void *arg)
+{
+	struct gsm48_rrlayer *rr = arg;
+	struct msgb *nmsg;
+
+	/* stop sending more access bursts when timer expired */
+	hando_acc_left = 0;
+
+	/* get old channel description */
+	memcpy(&rr->chan_desc, &rr->chan_last, sizeof(rr->chan_desc));
+
+	/* change radio to old channel */
+	tx_ph_dm_est_req(ms, rr->cd_now.arfcn, rr->cd_now.chan_nr,
+			 rr->cd_now.tsc);
+	rr->dm_est = 1;
+
+	/* re-establish old link */
+	nmsg = gsm48_l3_msgb_alloc();
+	if (!nmsg)
+		return -ENOMEM;
+	return gsm48_send_rsl(ms, RSL_MT_REEST_REQ, nmsg, 0);
+
+	todo
+}
+
+static void start_rr_t3124(struct gsm48_rrlayer *rr, int sec, int micro)
+{
+	LOGP(DRR, LOGL_INFO, "starting T3124 with %d.%03d seconds\n", sec,
+		micro / 1000);
+	rr->t3124.cb = timeout_rr_t3124;
+	rr->t3124.data = rr;
+	osmo_timer_schedule(&rr->t3124, sec, micro);
+}
+
+/* send HANDOVER ACCESS burst (9.1.14) */
+static int gsm48_rr_tx_hando_access(struct osmocom_ms *ms)
+{
+	nmsg = msgb_alloc_headroom(20, 16, "HAND_ACCESS");
+	if (!nmsg)
+		return -ENOMEM;
+	*msgb_put(nmsg, 1) = rr->hando_ref;
+	todo burst
+	return gsm48_send_rsl(ms, RSL_MT_RAND_ACC_REQ, nmsg, 0);
+}
+
+/* send next channel request in dedicated state */
+static int gsm48_rr_rand_acc_cnf_dedicated(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	struct msgb *nmsg;
+	int s;
+
+	if (rr->modify_state != GSM48_RR_MOD_HANDO) {
+		LOGP(DRR, LOGL_NOTICE, "Random acces confirm, but not in handover state.\n");
+		return 0;
+	}
+
+	/* send up to four handover access bursts */
+	if (rr->hando_acc_left) {
+		rr->hando_acc_left--;
+		gsm48_rr_tx_hando_access(ms);
+		return;
+	}
+
+	/* start timer for sending next HANDOVER ACCESS bursts afterwards */
+	if (!osmo_timer_pending(&rr->t3124)) {
+		if (allocated channel is SDCCH)
+			start_rr_t3124(rr, GSM_T3124_675);
+		else
+			start_rr_t3124(rr, GSM_T3124_320);
+	}
+	if (!rr->n_chan_req) {
+		start_rr_t3126(rr, 5, 0); /* TODO improve! */
+		return 0;
+	}
+	rr->n_chan_req--;
+
+	/* wait for PHYSICAL INFORMATION message or T3124 timeout */
+	return 0;
+
+}
+
+#endif
+
+int gsm48_rr_tx_voice(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	uint8_t ch_type, ch_subch, ch_ts;
+
+	if (!rr->dm_est) {
+		LOGP(DRR, LOGL_INFO, "Current channel is not active\n");
+		msgb_free(msg);
+		return -ENOTSUP;
+	}
+
+	rsl_dec_chan_nr(rr->cd_now.chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (ch_type != RSL_CHAN_Bm_ACCHs) {
+		LOGP(DRR, LOGL_INFO, "Current channel is not (yet) TCH/F\n");
+		msgb_free(msg);
+		return -ENOTSUP;
+	}
+
+	return l1ctl_tx_traffic_req(ms, msg, rr->cd_now.chan_nr, 0);
+}
+
+int gsm48_rr_audio_mode(struct osmocom_ms *ms, uint8_t mode)
+{
+	struct gsm48_rrlayer *rr = &ms->rrlayer;
+	uint8_t ch_type, ch_subch, ch_ts;
+
+	LOGP(DRR, LOGL_INFO, "setting audio mode to %d\n", mode);
+
+	rr->audio_mode = mode;
+
+	if (!rr->dm_est)
+		return 0;
+
+	rsl_dec_chan_nr(rr->cd_now.chan_nr, &ch_type, &ch_subch, &ch_ts);
+	if (ch_type != RSL_CHAN_Bm_ACCHs
+	 && ch_type != RSL_CHAN_Lm_ACCHs)
+		return 0;
+
+	return l1ctl_tx_tch_mode_req(ms, rr->cd_now.mode, mode);
+}
+
diff --git a/src/host/layer23/src/mobile/main.c b/src/host/layer23/src/mobile/main.c
new file mode 100644
index 00000000..9764b333
--- /dev/null
+++ b/src/host/layer23/src/mobile/main.c
@@ -0,0 +1,300 @@
+/* Main method of the layer2/3 stack */
+
+/* (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/mobile/app_mobile.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/gsmtap_util.h>
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/core/application.h>
+
+#include <arpa/inet.h>
+
+#define _GNU_SOURCE
+#include <getopt.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <time.h>
+#include <libgen.h>
+
+void *l23_ctx = NULL;
+struct llist_head ms_list;
+static char *gsmtap_ip = 0;
+static const char *custom_cfg_file = NULL;
+struct gsmtap_inst *gsmtap_inst = NULL;
+char *config_dir = NULL;
+int use_mncc_sock = 0;
+int daemonize = 0;
+
+int mncc_recv_socket(struct osmocom_ms *ms, int msg_type, void *arg);
+
+int mobile_delete(struct osmocom_ms *ms, int force);
+int mobile_signal_cb(unsigned int subsys, unsigned int signal,
+		     void *handler_data, void *signal_data);
+int mobile_work(struct osmocom_ms *ms);
+int mobile_exit(struct osmocom_ms *ms, int force);
+
+
+const char *debug_default =
+	"DCS:DNB:DPLMN:DRR:DMM:DSIM:DCC:DMNCC:DSS:DLSMS:DPAG:DSUM:DSAP:DGPS:DMOB:DPRIM:DLUA";
+
+const char *openbsc_copyright =
+	"Copyright (C) 2010-2015 Andreas Eversberg, Sylvain Munaut, Holger Freyther, Harald Welte\n"
+	"Contributions by Alex Badea, Pablo Neira, Steve Markgraf and others\n\n"
+	"License GPLv2+: GNU GPL version 2 or later "
+		"<http://gnu.org/licenses/gpl.html>\n"
+	"This is free software: you are free to change and redistribute it.\n"
+	"There is NO WARRANTY, to the extent permitted by law.\n";
+
+static void print_usage(const char *app)
+{
+	printf("Usage: %s\n", app);
+}
+
+static void print_help()
+{
+	printf(" Some help...\n");
+	printf("  -h --help		this text\n");
+	printf("  -i --gsmtap-ip	The destination IP used for GSMTAP.\n");
+	printf("  -d --debug		Change debug flags. default: %s\n",
+		debug_default);
+	printf("  -D --daemonize	Run as daemon\n");
+	printf("  -c --config-file filename The config file to use.\n");
+	printf("  -m --mncc-sock	Disable built-in MNCC handler and "
+		"offer socket\n");
+}
+
+static int handle_options(int argc, char **argv)
+{
+	while (1) {
+		int option_index = 0, c;
+		static struct option long_options[] = {
+			{"help", 0, 0, 'h'},
+			{"gsmtap-ip", 1, 0, 'i'},
+			{"debug", 1, 0, 'd'},
+			{"daemonize", 0, 0, 'D'},
+			{"config-file", 1, 0, 'c'},
+			{"mncc-sock", 0, 0, 'm'},
+			/* DEPRECATED options, to be removed */
+			{"vty-ip", 1, 0, 'u'},
+			{"vty-port", 1, 0, 'v'},
+			{0, 0, 0, 0},
+		};
+
+		c = getopt_long(argc, argv, "hi:u:c:v:d:Dm",
+				long_options, &option_index);
+		if (c == -1)
+			break;
+
+		switch (c) {
+		case 'h':
+			print_usage(argv[0]);
+			print_help();
+			exit(0);
+			break;
+		case 'i':
+			gsmtap_ip = optarg;
+			break;
+		case 'c':
+			custom_cfg_file = optarg;
+			break;
+		case 'd':
+			log_parse_category_mask(osmo_stderr_target, optarg);
+			break;
+		case 'D':
+			daemonize = 1;
+			break;
+		case 'm':
+			use_mncc_sock = 1;
+			break;
+		/* DEPRECATED options, to be removed */
+		case 'u':
+		case 'v':
+			fprintf(stderr, "Both 'u' and 'v' options are "
+				"deprecated! Please use the configuration file "
+				"in order to set VTY bind address.\n");
+			/* fall-thru */
+		default:
+			/* Unknown parameter passed */
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+void sighandler(int sigset)
+{
+	static uint8_t _quit = 1, count_int = 0;
+
+	if (sigset == SIGHUP || sigset == SIGPIPE)
+		return;
+
+	fprintf(stderr, "\nSignal %d received.\n", sigset);
+
+	switch (sigset) {
+	case SIGINT:
+		/* The first signal causes initiating of shutdown with detach
+		 * procedure. The second signal causes initiating of shutdown
+		 * without detach procedure. The third signal will exit process
+		 * immidiately. (in case it hangs)
+		 */
+		if (count_int == 0) {
+			fprintf(stderr, "Performing shutdown with clean "
+				"detach, if possible...\n");
+			osmo_signal_dispatch(SS_GLOBAL, S_GLOBAL_SHUTDOWN,
+				NULL);
+			count_int = 1;
+			break;
+		}
+		if (count_int == 2) {
+			fprintf(stderr, "Unclean exit, please turn off phone "
+				"to be sure it is not transmitting!\n");
+			exit(0);
+		}
+		/* fall through */
+	case SIGTSTP:
+		count_int = 2;
+		fprintf(stderr, "Performing shutdown without detach...\n");
+		osmo_signal_dispatch(SS_GLOBAL, S_GLOBAL_SHUTDOWN, &_quit);
+		break;
+	case SIGABRT:
+		/* in case of abort, we want to obtain a talloc report
+		 * and then return to the caller, who will abort the process
+		 */
+	case SIGUSR1:
+	case SIGUSR2:
+		talloc_report_full(l23_ctx, stderr);
+		break;
+	}
+}
+
+int main(int argc, char **argv)
+{
+	char *config_file;
+	int quit = 0;
+	int rc;
+
+	printf("%s\n", openbsc_copyright);
+
+	srand(time(NULL));
+
+	INIT_LLIST_HEAD(&ms_list);
+
+	l23_ctx = talloc_named_const(NULL, 1, "layer2 context");
+	/* TODO: measure and choose a proper pool size */
+	msgb_talloc_ctx_init(l23_ctx, 0);
+
+	/* Init default stderr logging */
+	osmo_init_logging2(l23_ctx, &log_info);
+
+	rc = handle_options(argc, argv);
+	if (rc) { /* Abort in case of parsing errors */
+		fprintf(stderr, "Error in command line options. Exiting.\n");
+		return 1;
+	}
+
+	if (gsmtap_ip) {
+		gsmtap_inst = gsmtap_source_init(gsmtap_ip, GSMTAP_UDP_PORT, 1);
+		if (!gsmtap_inst) {
+			fprintf(stderr, "Failed during gsmtap_init()\n");
+			exit(1);
+		}
+		gsmtap_source_add_sink(gsmtap_inst);
+	}
+
+	if (custom_cfg_file) {
+		/* Use full path provided by user */
+		config_file = talloc_strdup(l23_ctx, custom_cfg_file);
+	} else {
+		/* Obtain the user's home directory path */
+		const char *home_dir = getenv("HOME");
+		if (!home_dir)
+			home_dir = "~";
+
+		/* Concatenate it with default config path */
+		config_file = talloc_asprintf(l23_ctx, "%s/%s",
+			home_dir, ".osmocom/bb/mobile.cfg");
+	}
+
+	/* save the config file directory name */
+	config_dir = talloc_strdup(l23_ctx, config_file);
+	config_dir = dirname(config_dir);
+
+	if (use_mncc_sock)
+		rc = l23_app_init(mncc_recv_socket, config_file);
+	else
+		rc = l23_app_init(NULL, config_file);
+	if (rc)
+		exit(rc);
+
+	signal(SIGINT, sighandler);
+	signal(SIGTSTP, sighandler);
+	signal(SIGHUP, sighandler);
+	signal(SIGTERM, sighandler);
+	signal(SIGPIPE, sighandler);
+	signal(SIGABRT, sighandler);
+	signal(SIGUSR1, sighandler);
+	signal(SIGUSR2, sighandler);
+
+	if (daemonize) {
+		printf("Running as daemon\n");
+		rc = osmo_daemonize();
+		if (rc)
+			fprintf(stderr, "Failed to run as daemon\n");
+	}
+
+	while (1) {
+		l23_app_work(&quit);
+		if (quit && llist_empty(&ms_list))
+			break;
+		osmo_select_main(0);
+	}
+
+	l23_app_exit();
+	log_fini();
+
+	talloc_free(config_file);
+	talloc_free(config_dir);
+	talloc_report_full(l23_ctx, stderr);
+
+	signal(SIGINT, SIG_DFL);
+	signal(SIGTSTP, SIG_DFL);
+	signal(SIGHUP, SIG_DFL);
+	signal(SIGTERM, SIG_DFL);
+	signal(SIGPIPE, SIG_DFL);
+	signal(SIGABRT, SIG_DFL);
+	signal(SIGUSR1, SIG_DFL);
+	signal(SIGUSR2, SIG_DFL);
+
+	return 0;
+}
diff --git a/src/host/layer23/src/mobile/mncc_sock.c b/src/host/layer23/src/mobile/mncc_sock.c
new file mode 100644
index 00000000..d7d56cc0
--- /dev/null
+++ b/src/host/layer23/src/mobile/mncc_sock.c
@@ -0,0 +1,290 @@
+/* mncc_sock.c: Tie the MNCC interface to a unix domain socket */
+
+/* (C) 2008-2011,2018 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2009,2011 by Andreas Eversberg <andreas@eversberg.eu>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <assert.h>
+#include <stdint.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/mobile/mncc.h>
+#include <osmocom/bb/mobile/mncc_sock.h>
+#include <osmocom/bb/mobile/gsm48_cc.h>
+
+/* input from CC code into mncc_sock */
+int mncc_sock_from_cc(struct mncc_sock_state *state, struct msgb *msg)
+{
+	struct gsm_mncc *mncc_in = (struct gsm_mncc *) msgb_data(msg);
+	int msg_type = mncc_in->msg_type;
+
+	/* Check if we currently have a MNCC handler connected */
+	if (state->conn_bfd.fd < 0) {
+		LOGP(DMNCC, LOGL_ERROR, "mncc_sock receives %s for external CC app "
+			"but socket is gone\n", get_mncc_name(msg_type));
+		if (msg_type != GSM_TCHF_FRAME
+		 && msg_type != GSM_TCHF_FRAME_EFR
+		 && msg_type != MNCC_REL_IND) {
+			/* release the request */
+			struct gsm_mncc mncc_out;
+			memset(&mncc_out, 0, sizeof(mncc_out));
+			mncc_out.callref = mncc_in->callref;
+			mncc_set_cause(&mncc_out, GSM48_CAUSE_LOC_PRN_S_LU,
+					GSM48_CC_CAUSE_TEMP_FAILURE);
+			mncc_tx_to_cc(state->inst, MNCC_REL_REQ, &mncc_out);
+		}
+		/* free the original message */
+		msgb_free(msg);
+		return -1;
+	}
+
+	/* FIXME: check for some maximum queue depth? */
+
+	/* Actually enqueue the message and mark socket write need */
+	msgb_enqueue(&state->upqueue, msg);
+	state->conn_bfd.when |= BSC_FD_WRITE;
+	return 0;
+}
+
+void mncc_sock_write_pending(struct mncc_sock_state *state)
+{
+	state->conn_bfd.when |= BSC_FD_WRITE;
+}
+
+static void mncc_sock_close(struct mncc_sock_state *state)
+{
+	struct osmo_fd *bfd = &state->conn_bfd;
+
+	LOGP(DMNCC, LOGL_NOTICE, "MNCC Socket has closed connection\n");
+
+	close(bfd->fd);
+	bfd->fd = -1;
+	osmo_fd_unregister(bfd);
+
+	/* re-enable the generation of ACCEPT for new connections */
+	state->listen_bfd.when |= BSC_FD_READ;
+
+	/* FIXME: make sure we don't enqueue anymore */
+
+	/* release all exisitng calls */
+	mncc_clear_trans(state->inst, GSM48_PDISC_CC);
+
+	/* flush the queue */
+	while (!llist_empty(&state->upqueue)) {
+		struct msgb *msg = msgb_dequeue(&state->upqueue);
+		msgb_free(msg);
+	}
+}
+
+static int mncc_sock_read(struct osmo_fd *bfd)
+{
+	struct mncc_sock_state *state = (struct mncc_sock_state *)bfd->data;
+	struct gsm_mncc *mncc_prim;
+	struct msgb *msg;
+	int rc;
+
+	msg = msgb_alloc(sizeof(*mncc_prim)+256, "mncc_sock_rx");
+	if (!msg)
+		return -ENOMEM;
+
+	mncc_prim = (struct gsm_mncc *) msg->tail;
+
+	rc = recv(bfd->fd, msg->tail, msgb_tailroom(msg), 0);
+	if (rc == 0)
+		goto close;
+
+	if (rc < 0) {
+		if (errno == EAGAIN)
+			return 0;
+		goto close;
+	}
+
+	rc = mncc_tx_to_cc(state->inst, mncc_prim->msg_type, mncc_prim);
+
+	/* as we always synchronously process the message in mncc_send() and
+	 * its callbacks, we can free the message here. */
+	msgb_free(msg);
+
+	return rc;
+
+close:
+	msgb_free(msg);
+	mncc_sock_close(state);
+	return -1;
+}
+
+static int mncc_sock_write(struct osmo_fd *bfd)
+{
+	struct mncc_sock_state *state = bfd->data;
+	int rc;
+
+	while (!llist_empty(&state->upqueue)) {
+		struct msgb *msg, *msg2;
+		struct gsm_mncc *mncc_prim;
+
+		/* peek at the beginning of the queue */
+		msg = llist_entry(state->upqueue.next, struct msgb, list);
+		mncc_prim = (struct gsm_mncc *)msg->data;
+
+		bfd->when &= ~BSC_FD_WRITE;
+
+		/* bug hunter 8-): maybe someone forgot msgb_put(...) ? */
+		if (!msgb_length(msg)) {
+			LOGP(DMNCC, LOGL_ERROR, "message type (%d) with ZERO "
+				"bytes!\n", mncc_prim->msg_type);
+			goto dontsend;
+		}
+
+		/* try to send it over the socket */
+		rc = write(bfd->fd, msgb_data(msg), msgb_length(msg));
+		if (rc == 0)
+			goto close;
+		if (rc < 0) {
+			if (errno == EAGAIN) {
+				bfd->when |= BSC_FD_WRITE;
+				break;
+			}
+			goto close;
+		}
+
+dontsend:
+		/* _after_ we send it, we can deueue */
+		msg2 = msgb_dequeue(&state->upqueue);
+		assert(msg == msg2);
+		msgb_free(msg);
+	}
+	return 0;
+
+close:
+	mncc_sock_close(state);
+
+	return -1;
+}
+
+static int mncc_sock_cb(struct osmo_fd *bfd, unsigned int flags)
+{
+	int rc = 0;
+
+	if (flags & BSC_FD_READ)
+		rc = mncc_sock_read(bfd);
+	if (rc < 0)
+		return rc;
+
+	if (flags & BSC_FD_WRITE)
+		rc = mncc_sock_write(bfd);
+
+	return rc;
+}
+
+/* accept a new connection */
+static int mncc_sock_accept(struct osmo_fd *bfd, unsigned int flags)
+{
+	struct mncc_sock_state *state = (struct mncc_sock_state *)bfd->data;
+	struct osmo_fd *conn_bfd = &state->conn_bfd;
+	struct sockaddr_un un_addr;
+	socklen_t len;
+	int rc;
+
+	len = sizeof(un_addr);
+	rc = accept(bfd->fd, (struct sockaddr *) &un_addr, &len);
+	if (rc < 0) {
+		LOGP(DMNCC, LOGL_ERROR, "Failed to accept a new connection\n");
+		return -1;
+	}
+
+	if (conn_bfd->fd >= 0) {
+		LOGP(DMNCC, LOGL_NOTICE, "MNCC app connects but we already have "
+			"another active connection ?!?\n");
+		/* We already have one MNCC app connected, this is all we support */
+		state->listen_bfd.when &= ~BSC_FD_READ;
+		close(rc);
+		return 0;
+	}
+
+	conn_bfd->fd = rc;
+	conn_bfd->when = BSC_FD_READ;
+	conn_bfd->cb = mncc_sock_cb;
+	conn_bfd->data = state;
+
+	if (osmo_fd_register(conn_bfd) != 0) {
+		LOGP(DMNCC, LOGL_ERROR, "Failed to register new connection fd\n");
+		close(conn_bfd->fd);
+		conn_bfd->fd = -1;
+		return -1;
+	}
+
+	LOGP(DMNCC, LOGL_NOTICE, "MNCC Socket has connection with external "
+		"call control application\n");
+
+	return 0;
+}
+
+
+struct mncc_sock_state *mncc_sock_init(void *inst, const char *name)
+{
+	struct mncc_sock_state *state;
+	struct osmo_fd *bfd;
+	int rc;
+
+	state = talloc_zero(inst, struct mncc_sock_state);
+	if (!state)
+		return NULL;
+
+	state->inst = inst;
+	INIT_LLIST_HEAD(&state->upqueue);
+	state->conn_bfd.fd = -1;
+
+	bfd = &state->listen_bfd;
+
+	rc = osmo_sock_unix_init_ofd(bfd, SOCK_SEQPACKET, 0, name, OSMO_SOCK_F_BIND);
+	if (rc < 0) {
+		LOGP(DMNCC, LOGL_ERROR, "Could not create unix socket: %s\n",
+			strerror(errno));
+		talloc_free(state);
+		return NULL;
+	}
+
+	bfd->cb = mncc_sock_accept;
+	bfd->data = state;
+
+	return state;
+}
+
+void mncc_sock_exit(struct mncc_sock_state *state)
+{
+	if (state->conn_bfd.fd > -1)
+		mncc_sock_close(state);
+	osmo_fd_unregister(&state->listen_bfd);
+	close(state->listen_bfd.fd);
+	talloc_free(state);
+}
diff --git a/src/host/layer23/src/mobile/mnccms.c b/src/host/layer23/src/mobile/mnccms.c
new file mode 100644
index 00000000..22432913
--- /dev/null
+++ b/src/host/layer23/src/mobile/mnccms.c
@@ -0,0 +1,812 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <osmocom/core/talloc.h>
+
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/mobile/mncc.h>
+#include <osmocom/bb/mobile/mncc_ms.h>
+#include <osmocom/bb/mobile/vty.h>
+
+static uint32_t new_callref = 1;
+static LLIST_HEAD(call_list);
+
+static int dtmf_statemachine(struct gsm_call *call, struct gsm_mncc *mncc);
+static void timeout_dtmf(void *arg);
+
+/*
+ * support functions
+ */
+
+/* DTMF timer */
+static void start_dtmf_timer(struct gsm_call *call, uint16_t ms)
+{
+	LOGP(DCC, LOGL_INFO, "starting DTMF timer %d ms\n", ms);
+	call->dtmf_timer.cb = timeout_dtmf;
+	call->dtmf_timer.data = call;
+	osmo_timer_schedule(&call->dtmf_timer, 0, ms * 1000);
+}
+
+static void stop_dtmf_timer(struct gsm_call *call)
+{
+	if (osmo_timer_pending(&call->dtmf_timer)) {
+		LOGP(DCC, LOGL_INFO, "stopping pending DTMF timer\n");
+		osmo_timer_del(&call->dtmf_timer);
+	}
+}
+
+/* free call instance */
+static void free_call(struct gsm_call *call)
+{
+	stop_dtmf_timer(call);
+
+	llist_del(&call->entry);
+	DEBUGP(DMNCC, "(call %x) Call removed.\n", call->callref);
+	talloc_free(call);
+}
+
+
+struct gsm_call *get_call_ref(uint32_t callref)
+{
+	struct gsm_call *callt;
+
+	llist_for_each_entry(callt, &call_list, entry) {
+		if (callt->callref == callref)
+			return callt;
+	}
+	return NULL;
+}
+
+static int8_t mncc_get_bearer(struct gsm_settings *set, uint8_t speech_ver)
+{
+	switch (speech_ver) {
+	case 4:
+		if (set->full_v3)
+			LOGP(DMNCC, LOGL_INFO, " net suggests full rate v3\n");
+		else {
+			LOGP(DMNCC, LOGL_INFO, " full rate v3 not supported\n");
+			speech_ver = -1;
+		}
+		break;
+	case 2:
+		if (set->full_v2)
+			LOGP(DMNCC, LOGL_INFO, " net suggests full rate v2\n");
+		else {
+			LOGP(DMNCC, LOGL_INFO, " full rate v2 not supported\n");
+			speech_ver = -1;
+		}
+		break;
+	case 0: /* mandatory */
+		if (set->full_v1)
+			LOGP(DMNCC, LOGL_INFO, " net suggests full rate v1\n");
+		else {
+			LOGP(DMNCC, LOGL_INFO, " full rate v1 not supported\n");
+			speech_ver = -1;
+		}
+		break;
+	case 5:
+		if (set->half_v3)
+			LOGP(DMNCC, LOGL_INFO, " net suggests half rate v3\n");
+		else {
+			LOGP(DMNCC, LOGL_INFO, " half rate v3 not supported\n");
+			speech_ver = -1;
+		}
+		break;
+	case 1:
+		if (set->half_v1)
+			LOGP(DMNCC, LOGL_INFO, " net suggests half rate v1\n");
+		else {
+			LOGP(DMNCC, LOGL_INFO, " half rate v1 not supported\n");
+			speech_ver = -1;
+		}
+		break;
+	default:
+		LOGP(DMNCC, LOGL_INFO, " net suggests unknown speech version "
+			"%d\n", speech_ver);
+		speech_ver = -1;
+	}
+
+	return speech_ver;
+}
+
+static void mncc_set_bearer(struct osmocom_ms *ms, int8_t speech_ver,
+	struct gsm_mncc *mncc)
+{
+	struct gsm_settings *set = &ms->settings;
+	int i = 0;
+
+	mncc->fields |= MNCC_F_BEARER_CAP;
+	mncc->bearer_cap.coding = 0;
+	if (set->ch_cap == GSM_CAP_SDCCH_TCHF_TCHH
+	 && (set->half_v1 || set->half_v3)) {
+		mncc->bearer_cap.radio = 3;
+		LOGP(DMNCC, LOGL_INFO, " support TCH/H also\n");
+	} else {
+		mncc->bearer_cap.radio = 1;
+		LOGP(DMNCC, LOGL_INFO, " support TCH/F only\n");
+	}
+	mncc->bearer_cap.speech_ctm = 0;
+	/* if no specific speech_ver is given */
+	if (speech_ver < 0) {
+		/* if half rate is supported and prefered */
+		if (set->half_v3 && set->half && set->half_prefer) {
+			mncc->bearer_cap.speech_ver[i++] = 5;
+			LOGP(DMNCC, LOGL_INFO, " support half rate v3\n");
+		}
+		if (set->half_v1 && set->half && set->half_prefer) {
+			mncc->bearer_cap.speech_ver[i++] = 1;
+			LOGP(DMNCC, LOGL_INFO, " support half rate v1\n");
+		}
+		/* if full rate is supported */
+		if (set->full_v3) {
+			mncc->bearer_cap.speech_ver[i++] = 4;
+			LOGP(DMNCC, LOGL_INFO, " support full rate v3\n");
+		}
+		if (set->full_v2) {
+			mncc->bearer_cap.speech_ver[i++] = 2;
+			LOGP(DMNCC, LOGL_INFO, " support full rate v2\n");
+		}
+		if (set->full_v1) { /* mandatory, so it's always true */
+			mncc->bearer_cap.speech_ver[i++] = 0;
+			LOGP(DMNCC, LOGL_INFO, " support full rate v1\n");
+		}
+		/* if half rate is supported and not prefered */
+		if (set->half_v3 && set->half && !set->half_prefer) {
+			mncc->bearer_cap.speech_ver[i++] = 5;
+			LOGP(DMNCC, LOGL_INFO, " support half rate v3\n");
+		}
+		if (set->half_v1 && set->half && !set->half_prefer) {
+			mncc->bearer_cap.speech_ver[i++] = 1;
+			LOGP(DMNCC, LOGL_INFO, " support half rate v1\n");
+		}
+	/* if specific speech_ver is given (it must be supported) */
+	} else
+		mncc->bearer_cap.speech_ver[i++] = speech_ver;
+	mncc->bearer_cap.speech_ver[i] = -1; /* end of list */
+	mncc->bearer_cap.transfer = 0;
+	mncc->bearer_cap.mode = 0;
+}
+
+/*
+ * MNCCms dummy application
+ */
+
+/* this is a minimal implementation as required by GSM 04.08 */
+int mncc_recv_dummy(struct osmocom_ms *ms, int msg_type, void *arg)
+{
+	struct gsm_mncc *data = arg;
+	uint32_t callref = data->callref;
+	struct gsm_mncc rel;
+
+	if (msg_type == MNCC_REL_IND || msg_type == MNCC_REL_CNF)
+		return 0;
+
+	LOGP(DMNCC, LOGL_INFO, "Rejecting incoming call\n");
+
+	/* reject, as we don't support Calls */
+	memset(&rel, 0, sizeof(struct gsm_mncc));
+	rel.callref = callref;
+	mncc_set_cause(&rel, GSM48_CAUSE_LOC_USER,
+		GSM48_CC_CAUSE_INCOMPAT_DEST);
+
+	return mncc_tx_to_cc(ms, MNCC_REL_REQ, &rel);
+}
+
+/*
+ * MNCCms call application via socket
+ */
+int mncc_recv_socket(struct osmocom_ms *ms, int msg_type, void *arg)
+{
+	struct mncc_sock_state *state = ms->mncc_entity.sock_state;
+	struct gsm_mncc *mncc = arg;
+	struct msgb *msg;
+	unsigned char *data;
+
+	if (!state) {
+		if (msg_type != MNCC_REL_IND && msg_type != MNCC_REL_CNF) {
+			struct gsm_mncc rel;
+
+			/* reject */
+			memset(&rel, 0, sizeof(struct gsm_mncc));
+			rel.callref = mncc->callref;
+			mncc_set_cause(&rel, GSM48_CAUSE_LOC_USER,
+				GSM48_CC_CAUSE_TEMP_FAILURE);
+			return mncc_tx_to_cc(ms, MNCC_REL_REQ, &rel);
+		}
+		return 0;
+	}
+
+	mncc->msg_type = msg_type;
+
+	msg = msgb_alloc(sizeof(struct gsm_mncc), "MNCC");
+	if (!msg)
+		return -ENOMEM;
+
+	data = msgb_put(msg, sizeof(struct gsm_mncc));
+	memcpy(data, mncc, sizeof(struct gsm_mncc));
+
+	return mncc_sock_from_cc(state, msg);
+}
+
+/*
+ * MNCCms basic call application
+ */
+
+int mncc_recv_mobile(struct osmocom_ms *ms, int msg_type, void *arg)
+{
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_mncc *data = arg;
+	struct gsm_call *call = get_call_ref(data->callref);
+	struct gsm_mncc mncc;
+	uint8_t cause;
+	int8_t	speech_ver = -1, speech_ver_half = -1, temp;
+	int first_call = 0;
+
+	/* call does not exist */
+	if (!call && msg_type != MNCC_SETUP_IND) {
+		LOGP(DMNCC, LOGL_INFO, "Rejecting incoming call "
+			"(callref %x)\n", data->callref);
+		if (msg_type == MNCC_REL_IND || msg_type == MNCC_REL_CNF)
+			return 0;
+		cause = GSM48_CC_CAUSE_INCOMPAT_DEST;
+		release:
+		memset(&mncc, 0, sizeof(struct gsm_mncc));
+		mncc.callref = data->callref;
+		mncc_set_cause(&mncc, GSM48_CAUSE_LOC_USER, cause);
+		return mncc_tx_to_cc(ms, MNCC_REL_REQ, &mncc);
+	}
+
+	/* setup without call */
+	if (!call) {
+		if (llist_empty(&call_list))
+			first_call = 1;
+		call = talloc_zero(ms, struct gsm_call);
+		if (!call)
+			return -ENOMEM;
+		call->ms = ms;
+		call->callref = data->callref;
+		llist_add_tail(&call->entry, &call_list);
+	}
+
+	/* not in initiated state anymore */
+	call->init = false;
+
+	switch (msg_type) {
+	case MNCC_DISC_IND:
+		vty_notify(ms, NULL);
+		switch (data->cause.value) {
+		case GSM48_CC_CAUSE_UNASSIGNED_NR:
+			vty_notify(ms, "Call: Number not assigned\n");
+			break;
+		case GSM48_CC_CAUSE_NO_ROUTE:
+			vty_notify(ms, "Call: Destination unreachable\n");
+			break;
+		case GSM48_CC_CAUSE_NORM_CALL_CLEAR:
+			vty_notify(ms, "Call: Remote hangs up\n");
+			break;
+		case GSM48_CC_CAUSE_USER_BUSY:
+			vty_notify(ms, "Call: Remote busy\n");
+			break;
+		case GSM48_CC_CAUSE_USER_NOTRESPOND:
+			vty_notify(ms, "Call: Remote not responding\n");
+			break;
+		case GSM48_CC_CAUSE_USER_ALERTING_NA:
+			vty_notify(ms, "Call: Remote not answering\n");
+			break;
+		case GSM48_CC_CAUSE_CALL_REJECTED:
+			vty_notify(ms, "Call has been rejected\n");
+			break;
+		case GSM48_CC_CAUSE_NUMBER_CHANGED:
+			vty_notify(ms, "Call: Number changed\n");
+			break;
+		case GSM48_CC_CAUSE_PRE_EMPTION:
+			vty_notify(ms, "Call: Cleared due to pre-emption\n");
+			break;
+		case GSM48_CC_CAUSE_DEST_OOO:
+			vty_notify(ms, "Call: Remote out of order\n");
+			break;
+		case GSM48_CC_CAUSE_INV_NR_FORMAT:
+			vty_notify(ms, "Call: Number invalid or imcomplete\n");
+			break;
+		case GSM48_CC_CAUSE_NO_CIRCUIT_CHAN:
+			vty_notify(ms, "Call: No channel available\n");
+			break;
+		case GSM48_CC_CAUSE_NETWORK_OOO:
+			vty_notify(ms, "Call: Network out of order\n");
+			break;
+		case GSM48_CC_CAUSE_TEMP_FAILURE:
+			vty_notify(ms, "Call: Temporary failure\n");
+			break;
+		case GSM48_CC_CAUSE_SWITCH_CONG:
+			vty_notify(ms, "Congestion\n");
+			break;
+		default:
+			vty_notify(ms, "Call has been disconnected "
+				"(clear cause %d)\n", data->cause.value);
+		}
+		LOGP(DMNCC, LOGL_INFO, "Call has been disconnected "
+			"(cause %d)\n", data->cause.value);
+		if ((data->fields & MNCC_F_PROGRESS)
+		 && data->progress.descr == 8) {
+			vty_notify(ms, "Please hang up!\n");
+		 	break;
+		}
+		free_call(call);
+		cause = GSM48_CC_CAUSE_NORM_CALL_CLEAR;
+		goto release;
+	case MNCC_REL_IND:
+	case MNCC_REL_CNF:
+		vty_notify(ms, NULL);
+		if (data->cause.value == GSM48_CC_CAUSE_CALL_REJECTED)
+			vty_notify(ms, "Call has been rejected\n");
+		else
+			vty_notify(ms, "Call has been released\n");
+		LOGP(DMNCC, LOGL_INFO, "Call has been released (cause %d)\n",
+			data->cause.value);
+		free_call(call);
+		break;
+	case MNCC_CALL_PROC_IND:
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Call is proceeding\n");
+		LOGP(DMNCC, LOGL_INFO, "Call is proceeding\n");
+		if ((data->fields & MNCC_F_BEARER_CAP)
+		 && data->bearer_cap.speech_ver[0] >= 0) {
+			mncc_get_bearer(set, data->bearer_cap.speech_ver[0]);
+		}
+		break;
+	case MNCC_ALERT_IND:
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Call is alerting\n");
+		LOGP(DMNCC, LOGL_INFO, "Call is alerting\n");
+		break;
+	case MNCC_SETUP_CNF:
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Call is answered\n");
+		LOGP(DMNCC, LOGL_INFO, "Call is answered\n");
+		break;
+	case MNCC_SETUP_IND:
+		vty_notify(ms, NULL);
+		if (!first_call && !ms->settings.cw) {
+			vty_notify(ms, "Incoming call rejected while busy\n");
+			LOGP(DMNCC, LOGL_INFO, "Incoming call but busy\n");
+			cause = GSM48_CC_CAUSE_USER_BUSY;
+			goto release;
+		}
+		/* select first supported speech_ver */
+		if ((data->fields & MNCC_F_BEARER_CAP)) {
+			int i;
+
+			for (i = 0; data->bearer_cap.speech_ver[i] >= 0; i++) {
+
+				temp = mncc_get_bearer(set,
+					data->bearer_cap.speech_ver[i]);
+				if (temp < 0)
+					continue;
+				if (temp == 5 || temp == 1) { /* half */
+					/* only the first half rate */
+					if (speech_ver_half < 0)
+						speech_ver_half = temp;
+				} else {
+					/* only the first full rate */
+					if (speech_ver < 0)
+						speech_ver = temp;
+				}
+			}
+			/* half and full given */
+			if (speech_ver_half >= 0 && speech_ver >= 0) {
+				if (set->half_prefer) {
+					LOGP(DMNCC, LOGL_INFO, " both supported"
+						" codec rates are given, using "
+						"preferred half rate\n");
+					speech_ver = speech_ver_half;
+				} else
+					LOGP(DMNCC, LOGL_INFO, " both supported"
+						" codec rates are given, using "
+						"preferred full rate\n");
+			} else if (speech_ver_half < 0 && speech_ver < 0) {
+				LOGP(DMNCC, LOGL_INFO, " no supported codec "
+					"rate is given\n");
+			/* only half rate is given, use it */
+			} else if (speech_ver_half >= 0) {
+				LOGP(DMNCC, LOGL_INFO, " only supported half "
+					"rate codec is given, using it\n");
+				speech_ver = speech_ver_half;
+			/* only full rate is given, use it */
+			} else {
+				LOGP(DMNCC, LOGL_INFO, " only supported full "
+					"rate codec is given, using it\n");
+			}
+		}
+		/* presentation allowed if present == 0 */
+		if (data->calling.present || !data->calling.number[0])
+			vty_notify(ms, "Incoming call (anonymous)\n");
+		else if (data->calling.type == 1)
+			vty_notify(ms, "Incoming call (from +%s)\n",
+				data->calling.number);
+		else if (data->calling.type == 2)
+			vty_notify(ms, "Incoming call (from 0-%s)\n",
+				data->calling.number);
+		else
+			vty_notify(ms, "Incoming call (from %s)\n",
+				data->calling.number);
+		LOGP(DMNCC, LOGL_INFO, "Incoming call (from %s callref %x)\n",
+			data->calling.number, call->callref);
+		memset(&mncc, 0, sizeof(struct gsm_mncc));
+		mncc.callref = call->callref;
+		/* only include bearer cap, if not given in setup
+		 * or if multiple codecs are given
+		 * or if not only full rate
+		 * or if given codec is unimplemented
+		 */
+		if (!(data->fields & MNCC_F_BEARER_CAP) || speech_ver < 0)
+			mncc_set_bearer(ms, -1, &mncc);
+		else if (data->bearer_cap.speech_ver[1] >= 0
+		      || speech_ver != 0)
+			mncc_set_bearer(ms, speech_ver, &mncc);
+		/* CC capabilities (optional) */
+		if (ms->settings.cc_dtmf) {
+			mncc.fields |= MNCC_F_CCCAP;
+			mncc.cccap.dtmf = 1;
+		}
+		mncc_tx_to_cc(ms, MNCC_CALL_CONF_REQ, &mncc);
+		if (first_call)
+			LOGP(DMNCC, LOGL_INFO, "Ring!\n");
+		else {
+			LOGP(DMNCC, LOGL_INFO, "Knock!\n");
+			call->hold = true;
+		}
+		call->ring = true;
+		memset(&mncc, 0, sizeof(struct gsm_mncc));
+		mncc.callref = call->callref;
+		mncc_tx_to_cc(ms, MNCC_ALERT_REQ, &mncc);
+		if (ms->settings.auto_answer) {
+			LOGP(DMNCC, LOGL_INFO, "Auto-answering call\n");
+			mncc_answer(ms);
+		}
+		break;
+	case MNCC_SETUP_COMPL_IND:
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Call is connected\n");
+		LOGP(DMNCC, LOGL_INFO, "Call is connected\n");
+		break;
+	case MNCC_HOLD_CNF:
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Call is on hold\n");
+		LOGP(DMNCC, LOGL_INFO, "Call is on hold\n");
+		call->hold = true;
+		break;
+	case MNCC_HOLD_REJ:
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Call hold was rejected\n");
+		LOGP(DMNCC, LOGL_INFO, "Call hold was rejected\n");
+		break;
+	case MNCC_RETRIEVE_CNF:
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Call is retrieved\n");
+		LOGP(DMNCC, LOGL_INFO, "Call is retrieved\n");
+		call->hold = false;
+		break;
+	case MNCC_RETRIEVE_REJ:
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Call retrieve was rejected\n");
+		LOGP(DMNCC, LOGL_INFO, "Call retrieve was rejected\n");
+		break;
+	case MNCC_FACILITY_IND:
+		LOGP(DMNCC, LOGL_INFO, "Facility info not displayed, "
+			"unsupported\n");
+		break;
+	case MNCC_START_DTMF_RSP:
+	case MNCC_START_DTMF_REJ:
+	case MNCC_STOP_DTMF_RSP:
+		dtmf_statemachine(call, data);
+		break;
+	default:
+		LOGP(DMNCC, LOGL_INFO, "Message 0x%02x unsupported\n",
+			msg_type);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int mncc_call(struct osmocom_ms *ms, char *number)
+{
+	struct gsm_call *call;
+	struct gsm_mncc setup;
+
+	llist_for_each_entry(call, &call_list, entry) {
+		if (!call->hold) {
+			vty_notify(ms, NULL);
+			vty_notify(ms, "Please put active call on hold "
+				"first!\n");
+			LOGP(DMNCC, LOGL_INFO, "Cannot make a call, busy!\n");
+			return -EBUSY;
+		}
+	}
+
+	call = talloc_zero(ms, struct gsm_call);
+	if (!call)
+		return -ENOMEM;
+	call->ms = ms;
+	call->callref = new_callref++;
+	call->init = true;
+	llist_add_tail(&call->entry, &call_list);
+
+	memset(&setup, 0, sizeof(struct gsm_mncc));
+	setup.callref = call->callref;
+
+	if (!strncasecmp(number, "emerg", 5)) {
+		LOGP(DMNCC, LOGL_INFO, "Make emergency call\n");
+		/* emergency */
+		setup.emergency = 1;
+	} else {
+		LOGP(DMNCC, LOGL_INFO, "Make call to %s\n", number);
+		/* called number */
+		setup.fields |= MNCC_F_CALLED;
+		if (number[0] == '+') {
+			number++;
+			setup.called.type = 1; /* international */
+		} else
+			setup.called.type = 0; /* auto/unknown - prefix must be
+						  used */
+		setup.called.plan = 1; /* ISDN */
+		OSMO_STRLCPY_ARRAY(setup.called.number, number);
+
+		/* bearer capability (mandatory) */
+		mncc_set_bearer(ms, -1, &setup);
+
+		/* CLIR */
+		if (ms->settings.clir)
+			setup.clir.inv = 1;
+		else if (ms->settings.clip)
+			setup.clir.sup = 1;
+
+		/* CC capabilities (optional) */
+		if (ms->settings.cc_dtmf) {
+			setup.fields |= MNCC_F_CCCAP;
+			setup.cccap.dtmf = 1;
+		}
+	}
+
+	return mncc_tx_to_cc(ms, MNCC_SETUP_REQ, &setup);
+}
+
+int mncc_hangup(struct osmocom_ms *ms)
+{
+	struct gsm_call *call, *found = NULL;
+	struct gsm_mncc disc;
+
+	llist_for_each_entry(call, &call_list, entry) {
+		if (!call->hold) {
+			found = call;
+			break;
+		}
+	}
+	if (!found) {
+		LOGP(DMNCC, LOGL_INFO, "No active call to hangup\n");
+		vty_notify(ms, NULL);
+		vty_notify(ms, "No active call\n");
+		return -EINVAL;
+	}
+
+	memset(&disc, 0, sizeof(struct gsm_mncc));
+	disc.callref = found->callref;
+	mncc_set_cause(&disc, GSM48_CAUSE_LOC_USER,
+		GSM48_CC_CAUSE_NORM_CALL_CLEAR);
+	return mncc_tx_to_cc(ms, (call->init) ? MNCC_REL_REQ : MNCC_DISC_REQ,
+		&disc);
+}
+
+int mncc_answer(struct osmocom_ms *ms)
+{
+	struct gsm_call *call, *alerting = NULL;
+	struct gsm_mncc rsp;
+	int active = 0;
+
+	llist_for_each_entry(call, &call_list, entry) {
+		if (call->ring)
+			alerting = call;
+		else if (!call->hold)
+			active = 1;
+	}
+	if (!alerting) {
+		LOGP(DMNCC, LOGL_INFO, "No call alerting\n");
+		vty_notify(ms, NULL);
+		vty_notify(ms, "No alerting call\n");
+		return -EBUSY;
+	}
+	if (active) {
+		LOGP(DMNCC, LOGL_INFO, "Answer but we have an active call\n");
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Please put active call on hold first!\n");
+		return -EBUSY;
+	}
+	alerting->ring = false;
+	alerting->hold = false;
+
+	memset(&rsp, 0, sizeof(struct gsm_mncc));
+	rsp.callref = alerting->callref;
+	return mncc_tx_to_cc(ms, MNCC_SETUP_RSP, &rsp);
+}
+
+int mncc_hold(struct osmocom_ms *ms)
+{
+	struct gsm_call *call, *found = NULL;
+	struct gsm_mncc hold;
+
+	llist_for_each_entry(call, &call_list, entry) {
+		if (!call->hold) {
+			found = call;
+			break;
+		}
+	}
+	if (!found) {
+		LOGP(DMNCC, LOGL_INFO, "No active call to hold\n");
+		vty_notify(ms, NULL);
+		vty_notify(ms, "No active call\n");
+		return -EINVAL;
+	}
+
+	memset(&hold, 0, sizeof(struct gsm_mncc));
+	hold.callref = found->callref;
+	return mncc_tx_to_cc(ms, MNCC_HOLD_REQ, &hold);
+}
+
+int mncc_retrieve(struct osmocom_ms *ms, int number)
+{
+	struct gsm_call *call;
+	struct gsm_mncc retr;
+	int holdnum = 0, active = 0, i = 0;
+
+	llist_for_each_entry(call, &call_list, entry) {
+		if (call->hold)
+			holdnum++;
+		if (!call->hold)
+			active = 1;
+	}
+	if (active) {
+		LOGP(DMNCC, LOGL_INFO, "Cannot retrieve during active call\n");
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Hold active call first!\n");
+		return -EINVAL;
+	}
+	if (holdnum == 0) {
+		vty_notify(ms, NULL);
+		vty_notify(ms, "No call on hold!\n");
+		return -EINVAL;
+	}
+	if (holdnum > 1 && number <= 0) {
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Select call 1..%d\n", holdnum);
+		return -EINVAL;
+	}
+	if (holdnum == 1 && number <= 0)
+		number = 1;
+	if (number > holdnum) {
+		vty_notify(ms, NULL);
+		vty_notify(ms, "Given number %d out of range!\n", number);
+		vty_notify(ms, "Select call 1..%d\n", holdnum);
+		return -EINVAL;
+	}
+
+	llist_for_each_entry(call, &call_list, entry) {
+		i++;
+		if (i == number)
+			break;
+	}
+
+	memset(&retr, 0, sizeof(struct gsm_mncc));
+	retr.callref = call->callref;
+	return mncc_tx_to_cc(ms, MNCC_RETRIEVE_REQ, &retr);
+}
+
+/*
+ * DTMF
+ */
+
+static int dtmf_statemachine(struct gsm_call *call, struct gsm_mncc *mncc)
+{
+	struct osmocom_ms *ms = call->ms;
+	struct gsm_mncc dtmf;
+
+	switch (call->dtmf_state) {
+	case DTMF_ST_SPACE:
+	case DTMF_ST_IDLE:
+		/* end of string */
+		if (!call->dtmf[call->dtmf_index]) {
+			LOGP(DMNCC, LOGL_INFO, "done with DTMF\n");
+			call->dtmf_state = DTMF_ST_IDLE;
+			return -EOF;
+		}
+		memset(&dtmf, 0, sizeof(struct gsm_mncc));
+		dtmf.callref = call->callref;
+		dtmf.keypad = call->dtmf[call->dtmf_index++];
+		call->dtmf_state = DTMF_ST_START;
+		LOGP(DMNCC, LOGL_INFO, "start DTMF (keypad %c)\n",
+			dtmf.keypad);
+		return mncc_tx_to_cc(ms, MNCC_START_DTMF_REQ, &dtmf);
+	case DTMF_ST_START:
+		if (mncc->msg_type != MNCC_START_DTMF_RSP) {
+			LOGP(DMNCC, LOGL_INFO, "DTMF was rejected\n");
+			return -ENOTSUP;
+		}
+		start_dtmf_timer(call, 70);
+		call->dtmf_state = DTMF_ST_MARK;
+		LOGP(DMNCC, LOGL_INFO, "DTMF is on\n");
+		break;
+	case DTMF_ST_MARK:
+		memset(&dtmf, 0, sizeof(struct gsm_mncc));
+		dtmf.callref = call->callref;
+		call->dtmf_state = DTMF_ST_STOP;
+		LOGP(DMNCC, LOGL_INFO, "stop DTMF\n");
+		return mncc_tx_to_cc(ms, MNCC_STOP_DTMF_REQ, &dtmf);
+	case DTMF_ST_STOP:
+		start_dtmf_timer(call, 120);
+		call->dtmf_state = DTMF_ST_SPACE;
+		LOGP(DMNCC, LOGL_INFO, "DTMF is off\n");
+		break;
+	}
+
+	return 0;
+}
+
+static void timeout_dtmf(void *arg)
+{
+	struct gsm_call *call = arg;
+
+	LOGP(DCC, LOGL_INFO, "DTMF timer has fired\n");
+	dtmf_statemachine(call, NULL);
+}
+
+int mncc_dtmf(struct osmocom_ms *ms, char *dtmf)
+{
+	struct gsm_call *call, *found = NULL;
+
+	llist_for_each_entry(call, &call_list, entry) {
+		if (!call->hold) {
+			found = call;
+			break;
+		}
+	}
+	if (!found) {
+		LOGP(DMNCC, LOGL_INFO, "No active call to send DTMF\n");
+		vty_notify(ms, NULL);
+		vty_notify(ms, "No active call\n");
+		return -EINVAL;
+	}
+
+	if (call->dtmf_state != DTMF_ST_IDLE) {
+		LOGP(DMNCC, LOGL_INFO, "sending DTMF already\n");
+		return -EINVAL;
+	}
+
+	call->dtmf_index = 0;
+	OSMO_STRLCPY_ARRAY(call->dtmf, dtmf);
+	return dtmf_statemachine(call, NULL);
+}
+
diff --git a/src/host/layer23/src/mobile/primitives.c b/src/host/layer23/src/mobile/primitives.c
new file mode 100644
index 00000000..f562466a
--- /dev/null
+++ b/src/host/layer23/src/mobile/primitives.c
@@ -0,0 +1,230 @@
+/* (C) 2017 by Holger Hans Peter Freyther
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <inttypes.h>
+
+#include <osmocom/bb/mobile/gsm322.h>
+#include <osmocom/bb/mobile/primitives.h>
+#include <osmocom/bb/common/logging.h>
+
+#include <osmocom/core/timer.h>
+#include <osmocom/core/talloc.h>
+
+static LLIST_HEAD(s_prims);
+
+struct timer_closure {
+	struct llist_head entry;
+	struct mobile_prim_intf *intf;
+	struct osmo_timer_list timer;
+	uint64_t id;
+};
+
+struct mobile_prim_intf *mobile_prim_intf_alloc(struct osmocom_ms *ms)
+{
+	struct mobile_prim_intf *intf;
+
+	intf = talloc_zero(ms, struct mobile_prim_intf);
+	intf->ms = ms;
+
+	INIT_LLIST_HEAD(&intf->timers);
+	llist_add_tail(&intf->entry, &s_prims);
+	return intf;
+}
+
+void mobile_prim_intf_free(struct mobile_prim_intf *intf)
+{
+	struct timer_closure *timer, *tmp;
+
+	llist_for_each_entry_safe(timer, tmp, &intf->timers, entry) {
+		osmo_timer_del(&timer->timer);
+		llist_del(&timer->entry);
+		talloc_free(timer);
+	}
+	llist_del(&intf->entry);
+	talloc_free(intf);
+}
+
+struct mobile_prim *mobile_prim_alloc(unsigned int primitive, enum osmo_prim_operation op)
+{
+	struct msgb *msg = msgb_alloc(1024, "Mobile Primitive");
+	struct mobile_prim *prim = (struct mobile_prim *) msgb_put(msg, sizeof(*prim));
+	osmo_prim_init(&prim->hdr, 0, primitive, op, msg);
+	msg->l2h = msg->tail;
+	return prim;
+}
+
+static void timer_expired_cb(void *_closure)
+{
+	struct timer_closure *closure = _closure;
+	struct mobile_prim_intf *intf;
+	struct mobile_prim *prim;
+
+	prim = mobile_prim_alloc(PRIM_MOB_TIMER, PRIM_OP_INDICATION);
+	intf = closure->intf;
+	prim->u.timer.timer_id = closure->id;
+
+	llist_del(&closure->entry);
+	talloc_free(closure);
+
+	intf->indication(intf, prim);
+}
+
+static int create_timer(struct mobile_prim_intf *intf, struct mobile_timer_param *param)
+{
+	struct timer_closure *closure;
+
+	LOGP(DPRIM, LOGL_DEBUG, "Creating timer with reference: "
+		"%" PRIu64 "\n", param->timer_id);
+
+	closure = talloc_zero(intf, struct timer_closure);
+	closure->intf = intf;
+	closure->id = param->timer_id;
+	closure->timer.cb = timer_expired_cb;
+	closure->timer.data = closure;
+	llist_add_tail(&closure->entry, &intf->timers);
+	osmo_timer_schedule(&closure->timer, param->seconds, 0);
+	return 0;
+}
+
+static void dispatch(struct osmocom_ms *ms, struct mobile_prim *prim)
+{
+	struct mobile_prim_intf *intf, *tmp;
+
+	llist_for_each_entry_safe(intf, tmp, &s_prims, entry) {
+		if (intf->ms == ms)
+			intf->indication(intf, prim);
+	}
+	msgb_free(prim->hdr.msg);
+}
+
+void mobile_prim_ntfy_started(struct osmocom_ms *ms, bool started)
+{
+	struct mobile_prim *prim = mobile_prim_alloc(PRIM_MOB_STARTED, PRIM_OP_INDICATION);
+
+	prim->u.started.started = started;
+	dispatch(ms, prim);
+}
+
+void mobile_prim_ntfy_shutdown(struct osmocom_ms *ms, int old_state, int new_state)
+{
+	struct mobile_prim *prim = mobile_prim_alloc(PRIM_MOB_SHUTDOWN, PRIM_OP_INDICATION);
+
+	prim->u.shutdown.old_state = old_state;
+	prim->u.shutdown.new_state = new_state;
+	dispatch(ms, prim);
+}
+
+void mobile_prim_ntfy_sms_new(struct osmocom_ms *ms, struct gsm_sms *sms)
+{
+	struct mobile_prim *prim = mobile_prim_alloc(PRIM_MOB_SMS, PRIM_OP_INDICATION);
+
+	prim->u.sms.sms = *sms;
+	dispatch(ms, prim);
+}
+
+void mobile_prim_ntfy_sms_status(struct osmocom_ms *ms, struct gsm_sms *sms, uint8_t cause)
+{
+	struct mobile_prim *prim = mobile_prim_alloc(PRIM_MOB_SMS, PRIM_OP_INDICATION);
+
+	prim->u.sms.sms = *sms;
+	prim->u.sms.cause_valid = true;
+	prim->u.sms.cause = cause;
+	dispatch(ms, prim);
+}
+
+void mobile_prim_ntfy_mm_status(struct osmocom_ms *ms, int state, int substate, int mr_substate)
+{
+	struct mobile_prim *prim = mobile_prim_alloc(PRIM_MOB_MM, PRIM_OP_INDICATION);
+
+	prim->u.mm.state = state;
+	prim->u.mm.substate = substate;
+	prim->u.mm.prev_substate = mr_substate;
+	dispatch(ms, prim);
+}
+
+static int cancel_timer(struct mobile_prim_intf *intf, struct mobile_timer_param *param)
+{
+	struct timer_closure *closure;
+
+
+	llist_for_each_entry(closure, &intf->timers, entry) {
+		if (closure->id != param->timer_id)
+			continue;
+
+		LOGP(DPRIM, LOGL_DEBUG, "Canceling timer with reference: "
+			"%" PRIu64 "\n", param->timer_id);
+
+		osmo_timer_del(&closure->timer);
+		llist_del(&closure->entry);
+		talloc_free(closure);
+		return 0;
+	}
+	return -1;
+}
+
+static int send_sms(struct mobile_prim_intf *intf, struct mobile_sms_param *param)
+{
+	struct gsm_sms *sms;
+
+	sms = sms_alloc();
+	*sms = param->sms;
+
+	/* Force a NUL at the end of the string */
+	param->sca[sizeof(param->sca) - 1] = '\0';
+
+	return gsm411_tx_sms_submit(intf->ms, param->sca, sms);
+}
+
+static int network_reselect(struct mobile_prim_intf *intf)
+{
+	struct msgb *nmsg;
+
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_USER_RESEL);
+	if (!nmsg)
+		return -1;
+	gsm322_plmn_sendmsg(intf->ms, nmsg);
+	return 0;
+}
+
+int mobile_prim_intf_req(struct mobile_prim_intf *intf, struct mobile_prim *prim)
+{
+	int rc = 0;
+
+	switch (OSMO_PRIM_HDR(&prim->hdr)) {
+	case OSMO_PRIM(PRIM_MOB_TIMER, PRIM_OP_REQUEST):
+		rc = create_timer(intf, &prim->u.timer);
+		break;
+	case OSMO_PRIM(PRIM_MOB_TIMER_CANCEL, PRIM_OP_REQUEST):
+		rc = cancel_timer(intf, &prim->u.timer);
+		break;
+	case OSMO_PRIM(PRIM_MOB_SMS, PRIM_OP_REQUEST):
+		rc = send_sms(intf, &prim->u.sms);
+		break;
+	case OSMO_PRIM(PRIM_MOB_NETWORK_RESELECT, PRIM_OP_REQUEST):
+		rc = network_reselect(intf);
+		break;
+	default:
+		LOGP(DPRIM, LOGL_ERROR, "Unknown primitive: %d\n", OSMO_PRIM_HDR(&prim->hdr));
+		break;
+	}
+
+	msgb_free(prim->hdr.msg);
+	return rc;
+}
diff --git a/src/host/layer23/src/mobile/script_lua.c b/src/host/layer23/src/mobile/script_lua.c
new file mode 100644
index 00000000..9117cdd4
--- /dev/null
+++ b/src/host/layer23/src/mobile/script_lua.c
@@ -0,0 +1,698 @@
+/* (C) 2017-2018 by Holger Hans Peter Freyther
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <lua.h>
+#include <lualib.h>
+#include <lauxlib.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/mobile/app_mobile.h>
+#include <osmocom/bb/common/logging.h>
+
+#include <osmocom/bb/mobile/primitives.h>
+
+#include <osmocom/core/select.h>
+#include <osmocom/vty/misc.h>
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+struct timer_userdata {
+	int cb_ref;
+};
+
+struct fd_userdata {
+	struct lua_State *state;
+	struct osmo_fd fd;
+	int cb_ref;
+};
+
+static char lua_prim_key[] = "osmocom.org-mobile-prim";
+
+static struct mobile_prim_intf *get_primitive(lua_State *L)
+{
+	struct mobile_prim_intf *intf;
+
+	lua_pushlightuserdata(L, lua_prim_key);
+	lua_gettable(L, LUA_REGISTRYINDEX);
+	intf = (void *) lua_topointer(L, -1);
+	lua_pop(L, 1);
+	return intf;
+}
+
+static int lua_osmo_do_log(lua_State *L, int loglevel)
+{
+	int argc = lua_gettop(L);
+	lua_Debug ar = { 0, };
+	int i;
+
+	lua_getstack(L, 1, &ar);
+	lua_getinfo(L, "nSl", &ar);
+
+	LOGPSRC(DLUA, loglevel, ar.source, ar.currentline, "%s", "");
+	for (i = 1; i <= argc; ++i) {
+		if (!lua_isstring(L, i))
+			continue;
+		LOGPSRCC(DLUA, loglevel, ar.source, ar.currentline, 1,
+				"%s%s", i > 1 ? "\t" : "", lua_tostring(L, i));
+	}
+	LOGPC(DLUA, loglevel, "\n");
+	return 0;
+}
+
+static int lua_osmo_print(lua_State *L)
+{
+	return lua_osmo_do_log(L, LOGL_NOTICE);
+}
+
+static int lua_osmo_debug(lua_State *L)
+{
+	return lua_osmo_do_log(L, LOGL_DEBUG);
+}
+
+static int lua_osmo_error(lua_State *L)
+{
+	return lua_osmo_do_log(L, LOGL_ERROR);
+}
+
+static int lua_osmo_fatal(lua_State *L)
+{
+	return lua_osmo_do_log(L, LOGL_FATAL);
+}
+
+static const struct luaL_Reg global_runtime[] = {
+	{ "print", 	lua_osmo_print  },
+	{ "log_notice",	lua_osmo_print },
+	{ "log_debug",	lua_osmo_debug  },
+	{ "log_error",	lua_osmo_error  },
+	{ "log_fatal",	lua_osmo_fatal  },
+	{ NULL, NULL },
+};
+
+/* Push table and function.   Stack+=2 */
+static bool load_cb(struct osmocom_ms *ms, const char *cb_name)
+{
+	struct lua_State *L = ms->lua_state;
+
+	if (ms->lua_cb_ref == LUA_REFNIL)
+		return false;
+
+	lua_rawgeti(L, LUA_REGISTRYINDEX, ms->lua_cb_ref);
+	lua_pushstring(L, cb_name);
+	lua_gettable(L, -2);
+	if (lua_isnil(L, -1)) {
+		LOGP(DLUA, LOGL_DEBUG, "No handler for %s\n", cb_name);
+		lua_pop(L, 2);
+		return false;
+	}
+	return true;
+}
+
+/* Call callback. Stack-=func + args. func/args popped by lua_pcall */
+static void call_cb(lua_State *L, int args)
+{
+	int err = lua_pcall(L, args, 0, 0);
+	if (err) {
+		LOGP(DLUA, LOGL_ERROR, "lua error: %s\n", lua_tostring(L, -1));
+		lua_pop(L, 2);
+	}
+}
+
+static void handle_timeout(struct mobile_prim_intf *intf, struct mobile_timer_param *param)
+{
+	struct timer_userdata *timer = (void *)(intptr_t) param->timer_id;
+	lua_State *L = intf->ms->lua_state;
+	int err;
+
+	lua_rawgeti(L, LUA_REGISTRYINDEX, timer->cb_ref);
+	luaL_unref(L, LUA_REGISTRYINDEX, timer->cb_ref);
+	timer->cb_ref = LUA_NOREF;
+
+	err = lua_pcall(L, 0, 0, 0);
+	if (err) {
+		LOGP(DLUA, LOGL_ERROR, "lua error: %s\n", lua_tostring(L, -1));
+		lua_pop(L, 1);
+	}
+}
+
+static void handle_started(struct mobile_prim_intf *intf, struct mobile_started_param *param)
+{
+	struct lua_State *L = intf->ms->lua_state;
+
+	if (!load_cb(intf->ms, "Started"))
+		return;
+
+	lua_pushinteger(L, param->started);
+
+	call_cb(L, 1);
+	lua_pop(L, 1);
+}
+
+static void handle_shutdown(struct mobile_prim_intf *intf, struct mobile_shutdown_param *param)
+{
+	struct lua_State *L = intf->ms->lua_state;
+
+	if (!load_cb(intf->ms, "Shutdown"))
+		return;
+
+	lua_pushinteger(L, param->old_state);
+	lua_pushinteger(L, param->new_state);
+
+	call_cb(L, 2);
+	lua_pop(L, 1);
+}
+
+static void handle_sms(struct mobile_prim_intf *intf, struct mobile_sms_param *param)
+{
+	struct lua_State *L = intf->ms->lua_state;
+
+	if (!load_cb(intf->ms, "Sms"))
+		return;
+
+	lua_createtable(L, 0, 11);
+
+	lua_pushinteger(L, param->sms.validity_minutes);
+	lua_setfield(L, -2, "validity_minutes");
+
+	lua_pushinteger(L, param->sms.reply_path_req);
+	lua_setfield(L, -2, "reply_path_req");
+
+	lua_pushinteger(L, param->sms.status_rep_req);
+	lua_setfield(L, -2, "status_rep_req");
+
+	lua_pushinteger(L, param->sms.ud_hdr_ind);
+	lua_setfield(L, -2, "ud_hdr_ind");
+
+	lua_pushinteger(L, param->sms.protocol_id);
+	lua_setfield(L, -2, "protocol_id");
+
+	lua_pushinteger(L, param->sms.data_coding_scheme);
+	lua_setfield(L, -2, "data_coding_scheme");
+
+	lua_pushinteger(L, param->sms.msg_ref);
+	lua_setfield(L, -2, "msg_ref");
+
+	lua_pushstring(L, param->sms.address);
+	lua_setfield(L, -2, "address");
+
+	lua_pushinteger(L, param->sms.time);
+	lua_setfield(L, -2, "time");
+
+	lua_pushlstring(L, (char *) param->sms.user_data, param->sms.user_data_len);
+	lua_setfield(L, -2, "user_data");
+
+	lua_pushstring(L, param->sms.text);
+	lua_setfield(L, -2, "text");
+
+	lua_pushinteger(L, param->cause_valid);
+	lua_pushinteger(L, param->cause);
+
+	call_cb(L, 3);
+	lua_pop(L, 1);
+}
+
+static void handle_mm(struct mobile_prim_intf *intf, struct mobile_mm_param *param)
+{
+	lua_State *L = intf->ms->lua_state;
+
+	if (!load_cb(intf->ms, "Mm"))
+		return;
+
+	lua_pushinteger(L, param->state);
+	lua_pushinteger(L, param->substate);
+	lua_pushinteger(L, param->prev_substate);
+
+	call_cb(L, 3);
+	lua_pop(L, 1);
+}
+
+static int lua_osmo_timeout(lua_State *L)
+{
+	struct mobile_prim *prim;
+	struct timer_userdata *timer;
+
+	if(lua_gettop(L) != 2) {
+		lua_pushliteral(L, "Need two arguments");
+		lua_error(L);
+		return 0;
+	}
+
+	luaL_argcheck(L, lua_isnumber(L, -2), 1, "Timeout needs to be a number");
+	luaL_argcheck(L, lua_isfunction(L, -1), 2, "Callback needs to be a function");
+
+	/*
+	 * Create a handle to prevent the function to be GCed while we run the
+	 * timer. Add a metatable to the object so itself will be GCed properly.
+	 */
+	timer = lua_newuserdata(L, sizeof(*timer));
+	luaL_getmetatable(L, "Timer");
+	lua_setmetatable(L, -2);
+
+	lua_pushvalue(L, -2);
+	timer->cb_ref = luaL_ref(L, LUA_REGISTRYINDEX);
+
+	/* Take the address of the user data... */
+	prim = mobile_prim_alloc(PRIM_MOB_TIMER, PRIM_OP_REQUEST);
+	prim->u.timer.timer_id = (intptr_t) timer;
+	prim->u.timer.seconds = lua_tonumber(L, -3);
+	mobile_prim_intf_req(get_primitive(L), prim);
+
+	return 1;
+}
+
+static int lua_timer_cancel(lua_State *L)
+{
+	struct mobile_prim *prim;
+	struct timer_userdata *timer;
+
+	luaL_argcheck(L, lua_isuserdata(L, -1), 1, "No userdata");
+	timer = lua_touserdata(L, -1);
+	if (timer->cb_ref != LUA_NOREF) {
+		luaL_unref(L, LUA_REGISTRYINDEX, timer->cb_ref);
+		timer->cb_ref = LUA_NOREF;
+	}
+
+	prim = mobile_prim_alloc(PRIM_MOB_TIMER_CANCEL, PRIM_OP_REQUEST);
+	prim->u.timer.timer_id = (intptr_t) timer;
+	mobile_prim_intf_req(get_primitive(L), prim);
+	return 0;
+}
+
+static const struct luaL_Reg timer_funcs[] = {
+	{ "cancel", lua_timer_cancel },
+	{ "__gc", lua_timer_cancel },
+	{ NULL, NULL },
+};
+
+static int lua_osmo_ms(lua_State *L)
+{
+	lua_pushlightuserdata(L, get_primitive(L)->ms);
+	luaL_getmetatable(L, "MS");
+	lua_setmetatable(L, -2);
+
+	return 1;
+}
+
+static int lua_ms_imei(lua_State *L)
+{
+	struct osmocom_ms *ms = get_primitive(L)->ms;
+
+	luaL_argcheck(L, lua_isuserdata(L, -1), 1, "No userdata");
+	lua_pushstring(L, ms->settings.imei);
+	return 1;
+}
+static int lua_ms_imsi(lua_State *L)
+{
+	struct osmocom_ms *ms = get_primitive(L)->ms;
+
+	luaL_argcheck(L, lua_isuserdata(L, -1), 1, "No userdata");
+	lua_pushstring(L, ms->subscr.imsi);
+	return 1;
+}
+
+static int lua_ms_shutdown_state(lua_State *L)
+{
+	struct osmocom_ms *ms = get_primitive(L)->ms;
+
+	lua_pushinteger(L, ms->shutdown);
+	return 1;
+}
+
+static int lua_ms_started(lua_State *L)
+{
+	struct osmocom_ms *ms = get_primitive(L)->ms;
+
+	lua_pushinteger(L, ms->started);
+	return 1;
+}
+
+static int lua_ms_register(lua_State *L)
+{
+	struct osmocom_ms *ms = get_primitive(L)->ms;
+
+	/* callbacks must be a table */
+	luaL_checktype(L, 2, LUA_TTABLE);
+
+	if (ms->lua_cb_ref != LUA_REFNIL)
+		luaL_unref(L, LUA_REGISTRYINDEX, ms->lua_cb_ref);
+	ms->lua_cb_ref = luaL_ref(L, LUA_REGISTRYINDEX);
+	return 0;
+}
+
+static int lua_ms_no_shutdown(lua_State *L)
+{
+	struct osmocom_ms *ms = get_primitive(L)->ms;
+	char *name;
+	int res;
+
+	res = mobile_start(ms, &name);
+	lua_pushinteger(L, res);
+	return 1;
+}
+
+static int lua_ms_shutdown(lua_State *L)
+{
+	struct osmocom_ms *ms = get_primitive(L)->ms;
+	int argc = lua_gettop(L);
+	int force = 0;
+	int res;
+
+	if (argc >= 1) {
+		luaL_argcheck(L, lua_isboolean(L, -1), 1, "Force");
+		force = lua_toboolean(L, -1);
+	}
+
+	res = mobile_stop(ms, force);
+	lua_pushinteger(L, res);
+	return 1;
+}
+
+static int lua_ms_sms_send_simple(lua_State *L)
+{
+	const char *sms_sca, *number, *text;
+	struct mobile_prim *prim;
+	struct gsm_sms *sms;
+	int msg_ref;
+
+	luaL_argcheck(L, lua_isnumber(L, -1), 4, "msg_ref needs to be a number");
+	luaL_argcheck(L, lua_isstring(L, -2), 3, "text must be a string");
+	luaL_argcheck(L, lua_isstring(L, -3), 2, "number must be a string");
+	luaL_argcheck(L, lua_isstring(L, -4), 1, "sms_sca must be a string");
+
+	msg_ref = (int) lua_tonumber(L, -1);
+	text = lua_tostring(L, -2);
+	number = lua_tostring(L, -3);
+	sms_sca = lua_tostring(L, -4);
+
+	prim = mobile_prim_alloc(PRIM_MOB_SMS, PRIM_OP_REQUEST);
+
+	sms = sms_from_text(number, 0, text);
+	if (!sms) {
+		lua_pushinteger(L, -ENOMEM);
+		msgb_free(prim->hdr.msg);
+		return 1;
+	}
+
+	prim->u.sms.sms = *sms;
+	prim->u.sms.sms.msg_ref = msg_ref;
+	osmo_strlcpy(prim->u.sms.sca, sms_sca, sizeof(prim->u.sms.sca));
+	mobile_prim_intf_req(get_primitive(L), prim);
+
+	lua_pushinteger(L, 0);
+	return 1;
+}
+
+static int lua_ms_name(lua_State *L)
+{
+	lua_pushstring(L, get_primitive(L)->ms->name);
+	return 1;
+}
+
+static int lua_reselect_network(lua_State *L)
+{
+	struct mobile_prim *prim;
+
+	prim = mobile_prim_alloc(PRIM_MOB_NETWORK_RESELECT, PRIM_OP_REQUEST);
+	mobile_prim_intf_req(get_primitive(L), prim);
+
+	return 1;
+}
+
+/* Expect a fd on the stack and enable SO_PASSCRED */
+static int lua_unix_passcred(lua_State *L)
+{
+	int one = 1;
+	int fd, rc;
+
+	luaL_argcheck(L, lua_isnumber(L, -1), 1, "needs to be a filedescriptor");
+	fd = (int) lua_tonumber(L, -1);
+
+	rc = setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &one, sizeof(one));
+	if (rc != 0)
+		LOGP(DLUA, LOGL_ERROR, "Failed to set SO_PASSCRED: %s\n",
+			strerror(errno));
+	lua_pushinteger(L, rc);
+	return 1;
+}
+
+static void lua_fd_do_unregister(lua_State *L, struct fd_userdata *fdu) {
+	/* Unregister the fd and forget about the callback */
+	osmo_fd_unregister(&fdu->fd);
+	if (fdu->cb_ref != LUA_NOREF) {
+		luaL_unref(L, LUA_REGISTRYINDEX, fdu->cb_ref);
+		fdu->cb_ref = LUA_NOREF;
+	}
+}
+
+static int lua_fd_cb(struct osmo_fd *fd, unsigned int what) {
+	struct fd_userdata *fdu;
+	lua_State *L;
+	int cb_ref;
+	int err;
+
+	if (!fd->data) {
+		LOGP(DLUA, LOGL_ERROR,
+			"fd callback for fd(%d) but no lua callback\n", fd->fd);
+		return 0;
+	}
+
+	fdu = fd->data;
+	L = fdu->state;
+	cb_ref = fdu->cb_ref;
+	lua_rawgeti(L, LUA_REGISTRYINDEX, cb_ref);
+
+	err = lua_pcall(L, 0, 1, 0);
+	if (err) {
+		LOGP(DLUA, LOGL_ERROR, "lua error: %s\n", lua_tostring(L, -1));
+		lua_pop(L, 1);
+	}
+
+	/* Check if we should continue */
+	luaL_argcheck(L, lua_isnumber(L, -1), 1, "needs to be a number");
+	if (lua_tonumber(L, -1) == 1)
+		return 0;
+
+	lua_fd_do_unregister(L, fdu);
+	return 0;
+}
+
+/* Register the fd */
+static int lua_register_fd(lua_State *L)
+{
+	struct fd_userdata *fdu;
+
+	/* fd, cb */
+	luaL_argcheck(L, lua_isnumber(L, -2), 1, "needs to be a filedescriptor");
+	luaL_argcheck(L, lua_isfunction(L, -1), 2, "Callback needs to be a function");
+
+	/* Cretae a table so a user can unregister (and unregister on GC) */
+	fdu = lua_newuserdata(L, sizeof(*fdu));
+	fdu->state = L;
+	fdu->fd.fd = -1;
+	luaL_getmetatable(L, "Fd");
+	lua_setmetatable(L, -2);
+
+	/* Set the filedescriptor */
+	fdu->fd.fd = (int) lua_tonumber(L, -3);
+	fdu->fd.cb = lua_fd_cb;
+	fdu->fd.when = BSC_FD_READ;
+	fdu->fd.data = fdu;
+
+	/* Assuming that an error here will lead to a GC */
+	if (osmo_fd_register(&fdu->fd) != 0) {
+		fdu->cb_ref = LUA_NOREF;
+		lua_pushliteral(L, "Can't register the fd");
+		lua_error(L);
+		return 0;
+	}
+
+	/* Take the callback and keep a reference to it */
+	lua_pushvalue(L, -2);
+	fdu->cb_ref = luaL_ref(L, LUA_REGISTRYINDEX);
+
+	return 1;
+}
+
+static int lua_fd_unregister(lua_State *L) {
+	struct fd_userdata *fdu;
+
+	luaL_argcheck(L, lua_isuserdata(L, -1), 1, "No userdata");
+	fdu = lua_touserdata(L, -1);
+
+	lua_fd_do_unregister(L, fdu);
+	return 0;
+}
+
+
+static const struct luaL_Reg fd_funcs[] = {
+	{ "unregister", lua_fd_unregister },
+	{ "__gc", lua_fd_unregister },
+};
+
+static const struct luaL_Reg ms_funcs[] = {
+	{ "imsi", lua_ms_imsi },
+	{ "imei", lua_ms_imei },
+	{ "shutdown_state", lua_ms_shutdown_state },
+	{ "started", lua_ms_started },
+	{ "register", lua_ms_register },
+	{ "start", lua_ms_no_shutdown },
+	{ "stop", lua_ms_shutdown },
+	{ "sms_send_simple", lua_ms_sms_send_simple },
+	{ "number", lua_ms_name },
+	{ "reselect_network", lua_reselect_network },
+	{ NULL, NULL },
+};
+
+
+static const struct luaL_Reg osmo_funcs[] = {
+	{ "timeout",	lua_osmo_timeout },
+	{ "unix_passcred", lua_unix_passcred },
+	{ "register_fd", lua_register_fd },
+	{ "ms",	lua_osmo_ms },
+	{ NULL, NULL },
+};
+
+static void lua_prim_ind(struct mobile_prim_intf *intf, struct mobile_prim *prim)
+{
+	switch (OSMO_PRIM_HDR(&prim->hdr)) {
+	case OSMO_PRIM(PRIM_MOB_TIMER, PRIM_OP_INDICATION):
+		handle_timeout(intf, (struct mobile_timer_param *) &prim->u.timer);
+		break;
+	case OSMO_PRIM(PRIM_MOB_STARTED, PRIM_OP_INDICATION):
+		handle_started(intf, (struct mobile_started_param *) &prim->u.started);
+		break;
+	case OSMO_PRIM(PRIM_MOB_SHUTDOWN, PRIM_OP_INDICATION):
+		handle_shutdown(intf, (struct mobile_shutdown_param *) &prim->u.shutdown);
+		break;
+	case OSMO_PRIM(PRIM_MOB_SMS, PRIM_OP_INDICATION):
+		handle_sms(intf, (struct mobile_sms_param *) &prim->u.sms);
+		break;
+	case OSMO_PRIM(PRIM_MOB_MM, PRIM_OP_INDICATION):
+		handle_mm(intf, (struct mobile_mm_param *) &prim->u.mm);
+		break;
+	default:
+		LOGP(DLUA, LOGL_ERROR, "Unknown primitive: %d\n", OSMO_PRIM_HDR(&prim->hdr));
+	};
+}
+
+/*
+ *  Add functions to the global lua scope. Technically these are
+ *  included in the _G table. The following lua code can be used
+ *  to inspect it.
+ *
+ *  > for n in pairs(_G) do print(n) end
+ */
+static void add_globals(lua_State *L)
+{
+	lua_getglobal(L, "_G");
+	luaL_setfuncs(L, global_runtime, 0);
+	lua_pop(L, 1);
+}
+
+static void create_meta_table(lua_State *L, const char *name, const luaL_Reg *regs)
+{
+	luaL_newmetatable(L, name);
+	lua_pushliteral(L, "__index");
+	lua_pushvalue(L, -2);
+	lua_rawset(L, -3);
+	luaL_setfuncs(L, regs, 0);
+	lua_pop(L, 1);
+}
+
+static void add_runtime(lua_State *L, struct mobile_prim_intf *intf)
+{
+	add_globals(L);
+
+	/* Add a osmo module/table. Seems an oldschool module? */
+	lua_newtable(L);
+	luaL_setfuncs(L, osmo_funcs, 0);
+	lua_setglobal(L, "osmo");
+
+	/* Create metatables so we can GC objects... */
+	create_meta_table(L, "Timer", timer_funcs);
+	create_meta_table(L, "MS", ms_funcs);
+	create_meta_table(L, "Fd", fd_funcs);
+
+	/* Remember the primitive pointer... store it in the registry */
+	lua_pushlightuserdata(L, lua_prim_key);
+	lua_pushlightuserdata(L, intf);
+	lua_settable(L, LUA_REGISTRYINDEX);
+
+}
+
+static void *talloc_lua_alloc(void *ctx, void *ptr, size_t osize, size_t nsize)
+{
+	if (nsize == 0) {
+		talloc_free(ptr);
+		return NULL;
+	}
+	return talloc_realloc_size(ctx, ptr, nsize);
+}
+
+int script_lua_close(struct osmocom_ms *ms)
+{
+	struct mobile_prim_intf *intf;
+
+	if (!ms->lua_state)
+		return 0;
+
+	intf = get_primitive(ms->lua_state);
+	lua_close(ms->lua_state);
+	mobile_prim_intf_free(intf);
+	ms->lua_state = NULL;
+	return 0;
+}
+
+int script_lua_load(struct vty *vty, struct osmocom_ms *ms, const char *filename)
+{
+	struct mobile_prim_intf *intf;
+	int err;
+
+	script_lua_close(ms);
+	ms->lua_state = lua_newstate(talloc_lua_alloc, ms);
+	if (!ms->lua_state)
+		return -1;
+
+	ms->lua_cb_ref = LUA_REFNIL;
+	luaL_openlibs(ms->lua_state);
+
+	intf = mobile_prim_intf_alloc(ms);
+	intf->indication = lua_prim_ind;
+	add_runtime(ms->lua_state, intf);
+
+	err = luaL_loadfilex(ms->lua_state, filename, NULL);
+	if (err) {
+		vty_out(vty, "%% LUA load error: %s%s",
+				lua_tostring(ms->lua_state, -1), VTY_NEWLINE);
+		lua_pop(ms->lua_state, 1);
+		return -2;
+	}
+
+
+	err = lua_pcall(ms->lua_state, 0, 0, 0);
+	if (err) {
+		vty_out(vty, "%% LUA execute error: %s%s",
+				lua_tostring(ms->lua_state, -1), VTY_NEWLINE);
+		lua_pop(ms->lua_state, 1);
+		return -3;
+	}
+
+	return 0;
+}
diff --git a/src/host/layer23/src/mobile/script_nolua.c b/src/host/layer23/src/mobile/script_nolua.c
new file mode 100644
index 00000000..61466f77
--- /dev/null
+++ b/src/host/layer23/src/mobile/script_nolua.c
@@ -0,0 +1,36 @@
+/* (C) 2017 by Holger Hans Peter Freyther
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/logging.h>
+
+#include <osmocom/vty/misc.h>
+
+
+int script_lua_load(struct vty *vty, struct osmocom_ms *ms, const char *filename)
+{
+	vty_out(vty, "%% No LUA support compiled into mobile!%s", VTY_NEWLINE);
+	return -1;
+}
+
+int script_lua_close(struct osmocom_ms *ms)
+{
+	return 0;
+}
diff --git a/src/host/layer23/src/mobile/settings.c b/src/host/layer23/src/mobile/settings.c
new file mode 100644
index 00000000..a4bb4e36
--- /dev/null
+++ b/src/host/layer23/src/mobile/settings.c
@@ -0,0 +1,196 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <string.h>
+#include <osmocom/core/talloc.h>
+
+#include <osmocom/bb/mobile/app_mobile.h>
+#include <osmocom/bb/common/utils.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/networks.h>
+
+static char *layer2_socket_path = "/tmp/osmocom_l2";
+static char *sap_socket_path = "/tmp/osmocom_sap";
+
+int gsm_settings_init(struct osmocom_ms *ms)
+{
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_support *sup = &ms->support;
+
+	strcpy(set->layer2_socket_path, layer2_socket_path);
+	strcpy(set->sap_socket_path, sap_socket_path);
+
+	/* network search */
+	set->plmn_mode = PLMN_MODE_AUTO;
+
+	/* IMEI */
+	sprintf(set->imei,   "000000000000000");
+	sprintf(set->imeisv, "0000000000000000");
+
+	/* SIM type */
+	set->sim_type = GSM_SIM_TYPE_READER;
+
+	/* test SIM */
+	strcpy(set->test_imsi, "001010000000000");
+	set->test_rplmn_mcc = set->test_rplmn_mnc = 1;
+	set->test_lac = 0x0000;
+	set->test_tmsi = 0xffffffff;
+
+	/* set all supported features */
+	set->sms_ptp = sup->sms_ptp;
+	set->a5_1 = sup->a5_1;
+	set->a5_2 = sup->a5_2;
+	set->a5_3 = sup->a5_3;
+	set->a5_4 = sup->a5_4;
+	set->a5_5 = sup->a5_5;
+	set->a5_6 = sup->a5_6;
+	set->a5_7 = sup->a5_7;
+	set->p_gsm = sup->p_gsm;
+	set->e_gsm = sup->e_gsm;
+	set->r_gsm = sup->r_gsm;
+	set->dcs = sup->dcs;
+	set->class_900 = sup->class_900;
+	set->class_dcs = sup->class_dcs;
+	set->class_850 = sup->class_850;
+	set->class_pcs = sup->class_pcs;
+	set->class_400 = sup->class_400;
+	set->full_v1 = sup->full_v1;
+	set->full_v2 = sup->full_v2;
+	set->full_v3 = sup->full_v3;
+	set->half_v1 = sup->half_v1;
+	set->half_v3 = sup->half_v3;
+	set->ch_cap = sup->ch_cap;
+	set->min_rxlev_dbm = sup->min_rxlev_dbm;
+	set->dsc_max = sup->dsc_max;
+
+	if (sup->half_v1 || sup->half_v3)
+		set->half = 1;
+
+
+	/* software features */
+	set->cc_dtmf = 1;
+
+	set->any_timeout = MOB_C7_DEFLT_ANY_TIMEOUT;
+
+	set->store_sms = true;
+
+	INIT_LLIST_HEAD(&set->abbrev);
+
+	return 0;
+}
+
+int gsm_settings_arfcn(struct osmocom_ms *ms)
+{
+	int i;
+	struct gsm_settings *set = &ms->settings;
+
+	/* set supported frequencies */
+	memset(set->freq_map, 0, sizeof(set->freq_map));
+	if (set->p_gsm)
+		for(i = 1; i <= 124; i++)
+			set->freq_map[i >> 3] |= (1 << (i & 7));
+	if (set->gsm_850)
+		for(i = 128; i <= 251; i++)
+			set->freq_map[i >> 3] |= (1 << (i & 7));
+	if (set->gsm_450)
+		for(i = 259; i <= 293; i++)
+			set->freq_map[i >> 3] |= (1 << (i & 7));
+	if (set->gsm_480)
+		for(i = 306; i <= 340; i++)
+			set->freq_map[i >> 3] |= (1 << (i & 7));
+	if (set->dcs)
+		for(i = 512; i <= 885; i++)
+			set->freq_map[i >> 3] |= (1 << (i & 7));
+	if (set->pcs)
+		for(i = 1024; i <= 1024-512+810; i++)
+			set->freq_map[i >> 3] |= (1 << (i & 7));
+	if (set->e_gsm) {
+		for(i = 975; i <= 1023; i++)
+			set->freq_map[i >> 3] |= (1 << (i & 7));
+		set->freq_map[0] |= 1;
+	}
+	if (set->r_gsm)
+		for(i = 955; i <= 974; i++)
+			set->freq_map[i >> 3] |= (1 << (i & 7));
+
+	return 0;
+}
+
+int gsm_settings_exit(struct osmocom_ms *ms)
+{
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_settings_abbrev *abbrev;
+
+	while (!llist_empty(&set->abbrev)) {
+		abbrev = llist_entry(set->abbrev.next,
+			struct gsm_settings_abbrev, list);
+		llist_del(&abbrev->list);
+		talloc_free(abbrev);
+	}
+
+	script_lua_close(ms);
+
+	return 0;
+}
+
+char *gsm_check_imei(const char *imei, const char *sv)
+{
+	int i;
+
+	if (!imei || strlen(imei) != 15)
+		return "IMEI must have 15 digits!";
+
+	for (i = 0; i < strlen(imei); i++) {
+		if (imei[i] < '0' || imei[i] > '9')
+			return "IMEI must have digits 0 to 9 only!";
+	}
+
+	if (!sv || strlen(sv) != 1)
+		return "Software version must have 1 digit!";
+
+	if (sv[0] < '0' || sv[0] > '9')
+		return "Software version must have digits 0 to 9 only!";
+
+	return NULL;
+}
+
+int gsm_random_imei(struct gsm_settings *set)
+{
+	int digits = set->imei_random;
+	char rand[16+1];
+
+	if (digits <= 0)
+		return 0;
+	if (digits > 15)
+		digits = 15;
+
+	sprintf(rand, "%08d", layer23_random() % 100000000);
+	sprintf(rand + 8, "%07d", layer23_random() % 10000000);
+
+	strcpy(set->imei + 15 - digits, rand + 15 - digits);
+	osmo_strlcpy(set->imeisv, set->imei, 15);
+
+	return 0;
+}
+
diff --git a/src/host/layer23/src/mobile/subscriber.c b/src/host/layer23/src/mobile/subscriber.c
new file mode 100644
index 00000000..7a011411
--- /dev/null
+++ b/src/host/layer23/src/mobile/subscriber.c
@@ -0,0 +1,1309 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/crypt/auth.h>
+
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/sap_interface.h>
+#include <osmocom/bb/common/networks.h>
+#include <osmocom/bb/mobile/vty.h>
+
+/* enable to get an empty list of forbidden PLMNs, even if stored on SIM.
+ * if list is changed, the result is not written back to SIM */
+//#define TEST_EMPTY_FPLMN
+
+static void subscr_sim_query_cb(struct osmocom_ms *ms, struct msgb *msg);
+static void subscr_sim_update_cb(struct osmocom_ms *ms, struct msgb *msg);
+static void subscr_sim_key_cb(struct osmocom_ms *ms, struct msgb *msg);
+
+/*
+ * support
+ */
+
+char *gsm_check_imsi(const char *imsi)
+{
+	int i;
+
+	if (!imsi || strlen(imsi) != 15)
+		return "IMSI must have 15 digits!";
+
+	for (i = 0; i < strlen(imsi); i++) {
+		if (imsi[i] < '0' || imsi[i] > '9')
+			return "IMSI must have digits 0 to 9 only!";
+	}
+
+	return NULL;
+}
+
+static char *sim_decode_bcd(uint8_t *data, uint8_t length)
+{
+	int i, j = 0;
+	static char result[32], c;
+
+	for (i = 0; i < (length << 1); i++) {
+		if ((i & 1))
+			c = (data[i >> 1] >> 4);
+		else
+			c = (data[i >> 1] & 0xf);
+		if (c == 0xf)
+			break;
+		result[j++] = c + '0';
+		if (j == sizeof(result) - 1)
+			break;
+	}
+	result[j] = '\0';
+
+	return result;
+}
+
+/*
+ * init/exit
+ */
+
+int gsm_subscr_init(struct osmocom_ms *ms)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+
+	memset(subscr, 0, sizeof(*subscr));
+	subscr->ms = ms;
+
+	/* set TMSI / LAC invalid */
+	subscr->tmsi = 0xffffffff;
+	subscr->lac = 0x0000;
+
+	/* set key invalid */
+	subscr->key_seq = 7;
+
+	/* any cell selection timer timeout */
+	subscr->any_timeout = ms->settings.any_timeout;
+
+	/* init lists */
+	INIT_LLIST_HEAD(&subscr->plmn_list);
+	INIT_LLIST_HEAD(&subscr->plmn_na);
+
+	/* open SIM */
+	subscr->sim_handle_query = sim_open(ms, subscr_sim_query_cb);
+	subscr->sim_handle_update = sim_open(ms, subscr_sim_update_cb);
+	subscr->sim_handle_key = sim_open(ms, subscr_sim_key_cb);
+
+	return 0;
+}
+
+int gsm_subscr_exit(struct osmocom_ms *ms)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct llist_head *lh, *lh2;
+
+	if (subscr->sim_handle_query) {
+		sim_close(ms, subscr->sim_handle_query);
+		subscr->sim_handle_query = 0;
+	}
+	if (subscr->sim_handle_update) {
+		sim_close(ms, subscr->sim_handle_update);
+		subscr->sim_handle_update = 0;
+	}
+	if (subscr->sim_handle_key) {
+		sim_close(ms, subscr->sim_handle_key);
+		subscr->sim_handle_key = 0;
+	}
+
+	/* flush lists */
+	llist_for_each_safe(lh, lh2, &subscr->plmn_list) {
+		llist_del(lh);
+		talloc_free(lh);
+	}
+	llist_for_each_safe(lh, lh2, &subscr->plmn_na) {
+		llist_del(lh);
+		talloc_free(lh);
+	}
+
+	return 0;
+}
+
+/*
+ * test card
+ */
+
+/* Attach test card, no SIM must be currently attached */
+int gsm_subscr_testcard(struct osmocom_ms *ms, uint16_t mcc, uint16_t mnc,
+	uint16_t lac, uint32_t tmsi, uint8_t imsi_attached)
+{
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+	char *error;
+
+	if (subscr->sim_valid) {
+		LOGP(DMM, LOGL_ERROR, "Cannot insert card, until current card "
+			"is detached.\n");
+		return -EBUSY;
+	}
+
+	error = gsm_check_imsi(set->test_imsi);
+	if (error) {
+		LOGP(DMM, LOGL_ERROR, "%s\n", error);
+		return -EINVAL;
+	}
+
+	/* reset subscriber */
+	gsm_subscr_exit(ms);
+	gsm_subscr_init(ms);
+
+	subscr->sim_type = GSM_SIM_TYPE_TEST;
+	sprintf(subscr->sim_name, "test");
+	subscr->sim_valid = 1;
+	if (imsi_attached && set->test_rplmn_valid) {
+		subscr->imsi_attached = imsi_attached;
+		subscr->ustate = GSM_SIM_U1_UPDATED;
+	} else
+		subscr->ustate = GSM_SIM_U2_NOT_UPDATED;
+	subscr->acc_barr = set->test_barr; /* we may access barred cell */
+	subscr->acc_class = 0xffff; /* we have any access class */
+	subscr->plmn_valid = set->test_rplmn_valid;
+	subscr->plmn_mcc = mcc;
+	subscr->plmn_mnc = mnc;
+	subscr->mcc = mcc;
+	subscr->mnc = mnc;
+	subscr->lac = lac;
+	subscr->tmsi = tmsi;
+	subscr->always_search_hplmn = set->test_always;
+	subscr->t6m_hplmn = 1; /* try to find home network every 6 min */
+	strcpy(subscr->imsi, set->test_imsi);
+
+	LOGP(DMM, LOGL_INFO, "(ms %s) Inserting test card (IMSI=%s %s, %s)\n",
+		ms->name, subscr->imsi, gsm_imsi_mcc(subscr->imsi),
+		gsm_imsi_mnc(subscr->imsi));
+
+	if (subscr->plmn_valid)
+		LOGP(DMM, LOGL_INFO, "-> Test card registered to %s %s 0x%04x"
+			"(%s, %s)\n", gsm_print_mcc(mcc),
+			gsm_print_mnc(mnc), lac, gsm_get_mcc(mcc),
+			gsm_get_mnc(mcc, mnc));
+	else
+		LOGP(DMM, LOGL_INFO, "-> Test card not registered\n");
+	if (subscr->imsi_attached)
+		LOGP(DMM, LOGL_INFO, "-> Test card attached\n");
+
+	/* insert card */
+	nmsg = gsm48_mmr_msgb_alloc(GSM48_MMR_REG_REQ);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmr_downmsg(ms, nmsg);
+
+	return 0;
+}
+
+/*
+ * sim card
+ */
+
+static int subscr_sim_iccid(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+
+	strcpy(subscr->iccid, sim_decode_bcd(data, length));
+	sprintf(subscr->sim_name, "sim-%s", subscr->iccid);
+	LOGP(DMM, LOGL_INFO, "received ICCID %s from SIM\n", subscr->iccid);
+
+	return 0;
+}
+
+static int subscr_sim_imsi(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	char *imsi;
+
+	/* get actual length */
+	if (length < 1)
+		return -EINVAL;
+	if (data[0] + 1 < length) {
+		LOGP(DMM, LOGL_NOTICE, "invalid length = %d\n", length);
+		return -EINVAL;
+	}
+	length = data[0];
+
+	/* decode IMSI, skip first digit (parity) */
+	imsi = sim_decode_bcd(data + 1, length);
+	if (strlen(imsi) - 1 > GSM_IMSI_LENGTH - 1 || strlen(imsi) - 1 < 6) {
+		LOGP(DMM, LOGL_NOTICE, "IMSI invalid length = %zu\n",
+			strlen(imsi) - 1);
+		return -EINVAL;
+	}
+
+	OSMO_STRLCPY_ARRAY(subscr->imsi, imsi + 1);
+
+	LOGP(DMM, LOGL_INFO, "received IMSI %s from SIM\n", subscr->imsi);
+
+	return 0;
+}
+
+static int subscr_sim_loci(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm1111_ef_loci *loci;
+
+	if (length < 11)
+		return -EINVAL;
+	loci = (struct gsm1111_ef_loci *) data;
+
+	/* TMSI */
+	subscr->tmsi = ntohl(loci->tmsi);
+
+	/* LAI */
+	gsm48_decode_lai_hex(&loci->lai, &subscr->mcc, &subscr->mnc,
+		&subscr->lac);
+
+	/* location update status */
+	switch (loci->lupd_status & 0x07) {
+	case 0x00:
+		subscr->ustate = GSM_SIM_U1_UPDATED;
+		break;
+	case 0x02:
+	case 0x03:
+		subscr->ustate = GSM_SIM_U3_ROAMING_NA;
+		break;
+	default:
+		subscr->ustate = GSM_SIM_U2_NOT_UPDATED;
+	}
+
+	LOGP(DMM, LOGL_INFO, "received LOCI from SIM (mcc=%s mnc=%s lac=0x%04x "
+		"U%d)\n", gsm_print_mcc(subscr->mcc),
+		gsm_print_mnc(subscr->mnc), subscr->lac, subscr->ustate);
+
+	return 0;
+}
+
+static int subscr_sim_msisdn(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm1111_ef_adn *adn;
+
+	if (length < sizeof(*adn))
+		return -EINVAL;
+	adn = (struct gsm1111_ef_adn *) (data + length - sizeof(*adn));
+
+	/* empty */
+	subscr->msisdn[0] = '\0';
+	if (adn->len_bcd <= 1)
+		return 0;
+
+	/* number */
+	if (((adn->ton_npi & 0x70) >> 4) == 1)
+		strcpy(subscr->msisdn, "+");
+	if (((adn->ton_npi & 0x70) >> 4) == 2)
+		strcpy(subscr->msisdn, "0");
+	strncat(subscr->msisdn, sim_decode_bcd(adn->number, adn->len_bcd - 1),
+		sizeof(subscr->msisdn) - 2);
+
+	LOGP(DMM, LOGL_INFO, "received MSISDN %s from SIM\n", subscr->msisdn);
+
+	return 0;
+}
+
+static int subscr_sim_smsp(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm1111_ef_smsp *smsp;
+
+	if (length < sizeof(*smsp))
+		return -EINVAL;
+	smsp = (struct gsm1111_ef_smsp *) (data + length - sizeof(*smsp));
+
+	/* empty */
+	subscr->sms_sca[0] = '\0';
+
+	/* TS-Service Centre Address */
+	if (!(smsp->par_ind & 0x02) && smsp->ts_sca[0] <= 11) {
+		if (((smsp->ts_sca[1] & 0x70) >> 4) == 1)
+			strcpy(subscr->sms_sca, "+");
+		if (((smsp->ts_sca[1] & 0x70) >> 4) == 2)
+			strcpy(subscr->sms_sca, "0");
+		gsm48_decode_bcd_number(subscr->sms_sca +
+			strlen(subscr->sms_sca), sizeof(subscr->sms_sca)
+			- strlen(subscr->sms_sca), smsp->ts_sca, 1);
+	}
+
+	LOGP(DMM, LOGL_INFO, "received SMSP from SIM (sca=%s)\n",
+		subscr->sms_sca);
+
+	return 0;
+}
+
+static int subscr_sim_kc(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+
+	if (length < 9)
+		return -EINVAL;
+
+	/* key */
+	memcpy(subscr->key, data, 8);
+
+	/* key sequence */
+	subscr->key_seq = data[8] & 0x07;
+
+	LOGP(DMM, LOGL_INFO, "received KEY from SIM\n");
+
+	return 0;
+}
+
+static int subscr_sim_plmnsel(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm_sub_plmn_list *plmn;
+	struct llist_head *lh, *lh2;
+	uint8_t lai[5];
+	uint16_t dummy_lac;
+
+	/* flush list */
+	llist_for_each_safe(lh, lh2, &subscr->plmn_list) {
+		llist_del(lh);
+		talloc_free(lh);
+	}
+
+	while(length >= 3) {
+		/* end of list inside mandatory fields */
+		if (data[0] == 0xff && data[1] == 0xff && data[2] == 0x0ff)
+			break;
+
+		/* add to list */
+		plmn = talloc_zero(ms, struct gsm_sub_plmn_list);
+		if (!plmn)
+			return -ENOMEM;
+		lai[0] = data[0];
+		lai[1] = data[1];
+		lai[2] = data[2];
+		gsm48_decode_lai_hex((struct gsm48_loc_area_id *)lai,
+			&plmn->mcc, &plmn->mnc, &dummy_lac);
+		llist_add_tail(&plmn->entry, &subscr->plmn_list);
+
+		LOGP(DMM, LOGL_INFO, "received PLMN selector (mcc=%s mnc=%s) "
+			"from SIM\n",
+			gsm_print_mcc(plmn->mcc), gsm_print_mnc(plmn->mnc));
+
+		data += 3;
+		length -= 3;
+	}
+
+	return 0;
+}
+
+static int subscr_sim_hpplmn(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+
+	if (length < 1)
+		return -EINVAL;
+
+	/* HPLMN search interval */
+	subscr->t6m_hplmn = *data; /* multiple of 6 minutes */
+
+	LOGP(DMM, LOGL_INFO, "received HPPLMN %d (%d mins) from SIM\n",
+		subscr->t6m_hplmn, subscr->t6m_hplmn * 6);
+
+	return 0;
+}
+
+static int subscr_sim_spn(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	int i;
+
+	/* UCS2 code not supported */
+	if (length < 17 || data[1] >= 0x80)
+		return -ENOTSUP;
+
+	data++;
+	for (i = 0; i < 16; i++) {
+		if (*data == 0xff)
+			break;
+		subscr->sim_spn[i] = *data++;
+	}
+	subscr->sim_spn[i] = '\0';
+
+	LOGP(DMM, LOGL_INFO, "received SPN %s from SIM\n", subscr->sim_spn);
+
+	return 0;
+}
+
+static int subscr_sim_acc(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	uint16_t ac;
+
+	if (length < 2)
+		return -EINVAL;
+
+	/* cell access */
+	memcpy(&ac, data, sizeof(ac));
+	subscr->acc_class = ntohs(ac);
+
+	LOGP(DMM, LOGL_INFO, "received ACC %04x from SIM\n", subscr->acc_class);
+
+	return 0;
+}
+
+static int subscr_sim_fplmn(struct osmocom_ms *ms, uint8_t *data,
+	uint8_t length)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm_sub_plmn_na *na;
+	struct llist_head *lh, *lh2;
+	uint8_t lai[5];
+	uint16_t dummy_lac;
+
+#ifdef TEST_EMPTY_FPLMN
+	return 0;
+#endif
+
+	/* flush list */
+	llist_for_each_safe(lh, lh2, &subscr->plmn_na) {
+		llist_del(lh);
+		talloc_free(lh);
+	}
+
+	while (length >= 3) {
+		/* end of list inside mandatory fields */
+		if (data[0] == 0xff && data[1] == 0xff && data[2] == 0x0ff)
+			break;
+
+		/* add to list */
+		na = talloc_zero(ms, struct gsm_sub_plmn_na);
+		if (!na)
+			return -ENOMEM;
+		lai[0] = data[0];
+		lai[1] = data[1];
+		lai[2] = data[2];
+		gsm48_decode_lai_hex((struct gsm48_loc_area_id *)lai, &na->mcc,
+			&na->mnc, &dummy_lac);
+		LOGP(DMM, LOGL_INFO, "received Forbidden PLMN %s %s from SIM\n",
+			gsm_print_mcc(na->mcc), gsm_print_mnc(na->mnc));
+		na->cause = -1; /* must have a value, but SIM stores no cause */
+		llist_add_tail(&na->entry, &subscr->plmn_na);
+
+		data += 3;
+		length -= 3;
+	}
+	return 0;
+}
+
+static struct subscr_sim_file {
+	uint8_t         mandatory;
+	uint16_t	path[MAX_SIM_PATH_LENGTH];
+	uint16_t	file;
+	uint8_t		sim_job;
+	int		(*func)(struct osmocom_ms *ms, uint8_t *data,
+				uint8_t length);
+} subscr_sim_files[] = {
+	{ 1, { 0 },         0x2fe2, SIM_JOB_READ_BINARY, subscr_sim_iccid },
+	{ 1, { 0x7f20, 0 }, 0x6f07, SIM_JOB_READ_BINARY, subscr_sim_imsi },
+	{ 1, { 0x7f20, 0 }, 0x6f7e, SIM_JOB_READ_BINARY, subscr_sim_loci },
+	{ 0, { 0x7f20, 0 }, 0x6f20, SIM_JOB_READ_BINARY, subscr_sim_kc },
+	{ 0, { 0x7f20, 0 }, 0x6f30, SIM_JOB_READ_BINARY, subscr_sim_plmnsel },
+	{ 0, { 0x7f20, 0 }, 0x6f31, SIM_JOB_READ_BINARY, subscr_sim_hpplmn },
+	{ 0, { 0x7f20, 0 }, 0x6f46, SIM_JOB_READ_BINARY, subscr_sim_spn },
+	{ 0, { 0x7f20, 0 }, 0x6f78, SIM_JOB_READ_BINARY, subscr_sim_acc },
+	{ 0, { 0x7f20, 0 }, 0x6f7b, SIM_JOB_READ_BINARY, subscr_sim_fplmn },
+	{ 0, { 0x7f10, 0 }, 0x6f40, SIM_JOB_READ_RECORD, subscr_sim_msisdn },
+	{ 0, { 0x7f10, 0 }, 0x6f42, SIM_JOB_READ_RECORD, subscr_sim_smsp },
+	{ 0, { 0 },         0,      0,                   NULL }
+};
+
+/* request file from SIM */
+static int subscr_sim_request(struct osmocom_ms *ms)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct subscr_sim_file *sf = &subscr_sim_files[subscr->sim_file_index];
+	struct msgb *nmsg;
+	struct sim_hdr *nsh;
+	int i;
+
+	/* we are done, fire up PLMN and cell selection process */
+	if (!sf->func) {
+		LOGP(DMM, LOGL_INFO, "(ms %s) Done reading SIM card "
+			"(IMSI=%s %s, %s)\n", ms->name, subscr->imsi,
+			gsm_imsi_mcc(subscr->imsi), gsm_imsi_mnc(subscr->imsi));
+
+		/* if LAI is valid, set RPLMN */
+		if (subscr->lac > 0x0000 && subscr->lac < 0xfffe) {
+			subscr->plmn_valid = 1;
+			subscr->plmn_mcc = subscr->mcc;
+			subscr->plmn_mnc = subscr->mnc;
+			LOGP(DMM, LOGL_INFO, "-> SIM card registered to %s %s "
+				"(%s, %s)\n", gsm_print_mcc(subscr->plmn_mcc),
+				gsm_print_mnc(subscr->plmn_mnc),
+				gsm_get_mcc(subscr->plmn_mcc),
+				gsm_get_mnc(subscr->plmn_mcc,
+					subscr->plmn_mnc));
+		} else
+			LOGP(DMM, LOGL_INFO, "-> SIM card not registered\n");
+
+		/* insert card */
+		nmsg = gsm48_mmr_msgb_alloc(GSM48_MMR_REG_REQ);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm48_mmr_downmsg(ms, nmsg);
+
+		return 0;
+	}
+
+	/* trigger SIM reading */
+	nmsg = gsm_sim_msgb_alloc(subscr->sim_handle_query,
+		sf->sim_job);
+	if (!nmsg)
+		return -ENOMEM;
+	nsh = (struct sim_hdr *) nmsg->data;
+	i = 0;
+	while (sf->path[i]) {
+		nsh->path[i] = sf->path[i];
+		i++;
+	}
+	nsh->path[i] = 0; /* end of path */
+	nsh->file = sf->file;
+	nsh->rec_no = 1;
+	nsh->rec_mode = 0x04;
+	LOGP(DMM, LOGL_INFO, "Requesting SIM file 0x%04x\n", nsh->file);
+	sim_job(ms, nmsg);
+
+	return 0;
+}
+
+static void subscr_sim_query_cb(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct sim_hdr *sh = (struct sim_hdr *) msg->data;
+	uint8_t *payload = msg->data + sizeof(*sh);
+	uint16_t payload_len = msg->len - sizeof(*sh);
+	int rc;
+	struct subscr_sim_file *sf = &subscr_sim_files[subscr->sim_file_index];
+	struct msgb *nmsg;
+
+	/* error handling */
+	if (sh->job_type == SIM_JOB_ERROR) {
+		uint8_t cause = payload[0];
+
+		switch (cause) {
+			/* unlocking required */
+		case SIM_CAUSE_PIN1_REQUIRED:
+			LOGP(DMM, LOGL_INFO, "PIN is required, %d tries left\n",
+				payload[1]);
+
+			vty_notify(ms, NULL);
+			vty_notify(ms, "Please give PIN for ICCID %s (you have "
+				"%d tries left)\n", subscr->iccid, payload[1]);
+			subscr->sim_pin_required = 1;
+			break;
+		case SIM_CAUSE_PIN1_BLOCKED:
+			LOGP(DMM, LOGL_NOTICE, "PIN is blocked\n");
+
+			vty_notify(ms, NULL);
+			vty_notify(ms, "PIN is blocked\n");
+			if (payload[1]) {
+				vty_notify(ms, "Please give PUC for ICCID %s "
+					"(you have %d tries left)\n",
+					subscr->iccid, payload[1]);
+			}
+			subscr->sim_pin_required = 1;
+			break;
+		case SIM_CAUSE_PUC_BLOCKED:
+			LOGP(DMM, LOGL_NOTICE, "PUC is blocked\n");
+
+			vty_notify(ms, NULL);
+			vty_notify(ms, "PUC is blocked\n");
+			subscr->sim_pin_required = 1;
+			break;
+		default:
+			if (sf->func && !sf->mandatory) {
+				LOGP(DMM, LOGL_NOTICE, "SIM reading failed, "
+					"ignoring!\n");
+				goto ignore;
+			}
+			LOGP(DMM, LOGL_NOTICE, "SIM reading failed\n");
+
+			vty_notify(ms, NULL);
+			vty_notify(ms, "SIM failed, replace SIM!\n");
+
+			/* detach simcard */
+			subscr->sim_valid = 0;
+			nmsg = gsm48_mmr_msgb_alloc(GSM48_MMR_NREG_REQ);
+			if (!nmsg)
+				return;
+			gsm48_mmr_downmsg(ms, nmsg);
+		}
+		msgb_free(msg);
+
+		return;
+	}
+
+	/* if pin was successfully unlocked, then resend request */
+	if (subscr->sim_pin_required) {
+		subscr->sim_pin_required = 0;
+		subscr_sim_request(ms);
+		return;
+	}
+
+	/* done when nothing more to read. this happens on PIN requests */
+	if (!sf->func)
+		return;
+
+	/* call function do decode SIM reply */
+	rc = sf->func(ms, payload, payload_len);
+	if (rc) {
+		LOGP(DMM, LOGL_NOTICE, "SIM reading failed, file invalid\n");
+		if (subscr_sim_files[subscr->sim_file_index].mandatory) {
+			vty_notify(ms, NULL);
+			vty_notify(ms, "SIM failed, data invalid, replace "
+				"SIM!\n");
+			msgb_free(msg);
+
+			return;
+		}
+	}
+
+ignore:
+	msgb_free(msg);
+
+	/* trigger next file */
+	subscr->sim_file_index++;
+	subscr_sim_request(ms);
+}
+
+/* enter PIN */
+void gsm_subscr_sim_pin(struct osmocom_ms *ms, char *pin1, char *pin2,
+	int8_t mode)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+	uint8_t job;
+
+	/* skip, if no real valid SIM */
+	if (subscr->sim_type != GSM_SIM_TYPE_READER)
+		return;
+
+	switch (mode) {
+	case -1:
+		job = SIM_JOB_PIN1_DISABLE;
+		LOGP(DMM, LOGL_INFO, "disabling PIN %s\n", pin1);
+		break;
+	case 1:
+		job = SIM_JOB_PIN1_ENABLE;
+		LOGP(DMM, LOGL_INFO, "enabling PIN %s\n", pin1);
+		break;
+	case 2:
+		job = SIM_JOB_PIN1_CHANGE;
+		LOGP(DMM, LOGL_INFO, "changing PIN %s to %s\n", pin1, pin2);
+		break;
+	case 99:
+		job = SIM_JOB_PIN1_UNBLOCK;
+		LOGP(DMM, LOGL_INFO, "unblocking PIN %s with PUC %s\n", pin1,
+			pin2);
+		break;
+	default:
+		if (!subscr->sim_pin_required) {
+			LOGP(DMM, LOGL_ERROR, "No PIN required now\n");
+			return;
+		}
+		LOGP(DMM, LOGL_INFO, "entering PIN %s\n", pin1);
+		job = SIM_JOB_PIN1_UNLOCK;
+	}
+
+	nmsg = gsm_sim_msgb_alloc(subscr->sim_handle_query, job);
+	if (!nmsg)
+		return;
+	memcpy(msgb_put(nmsg, strlen(pin1) + 1), pin1, strlen(pin1) + 1);
+	memcpy(msgb_put(nmsg, strlen(pin2) + 1), pin2, strlen(pin2) + 1);
+	sim_job(ms, nmsg);
+}
+
+/* Attach SIM reader, no SIM must be currently attached */
+int gsm_subscr_simcard(struct osmocom_ms *ms)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+
+	if (subscr->sim_valid) {
+		LOGP(DMM, LOGL_ERROR, "Cannot attach card, until current card "
+			"is detached.\n");
+		return -EBUSY;
+	}
+
+	/* reset subscriber */
+	gsm_subscr_exit(ms);
+	gsm_subscr_init(ms);
+
+	subscr->sim_type = GSM_SIM_TYPE_READER;
+	sprintf(subscr->sim_name, "sim");
+	subscr->sim_valid = 1;
+	subscr->ustate = GSM_SIM_U2_NOT_UPDATED;
+
+	/* start with first index */
+	subscr->sim_file_index = 0;
+	return subscr_sim_request(ms);
+}
+
+/* update plmn not allowed list on SIM */
+static int subscr_write_plmn_na(struct osmocom_ms *ms)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+	struct sim_hdr *nsh;
+	struct gsm_sub_plmn_na *na, *nas[4] = { NULL, NULL, NULL, NULL };
+	int count = 0, i;
+	uint8_t *data;
+	uint8_t lai[5];
+
+#ifdef TEST_EMPTY_FPLMN
+	return 0;
+#endif
+
+	/* skip, if no real valid SIM */
+	if (subscr->sim_type != GSM_SIM_TYPE_READER || !subscr->sim_valid)
+		return 0;
+
+	/* get tail list from "PLMN not allowed" */
+	llist_for_each_entry(na, &subscr->plmn_na, entry) {
+		if (count < 4)
+			nas[count] = na;
+		else {
+			nas[0] = nas[1];
+			nas[1] = nas[2];
+			nas[2] = nas[3];
+			nas[3] = na;
+		}
+		count++;
+	}
+
+	/* write to SIM */
+	LOGP(DMM, LOGL_INFO, "Updating FPLMN on SIM\n");
+	nmsg = gsm_sim_msgb_alloc(subscr->sim_handle_update,
+		SIM_JOB_UPDATE_BINARY);
+	if (!nmsg)
+		return -ENOMEM;
+	nsh = (struct sim_hdr *) nmsg->data;
+	data = msgb_put(nmsg, 12);
+	nsh->path[0] = 0x7f20;
+	nsh->path[1] = 0;
+	nsh->file = 0x6f7b;
+	for (i = 0; i < 4; i++) {
+		if (nas[i]) {
+			gsm48_encode_lai_hex((struct gsm48_loc_area_id *)lai,
+			nas[i]->mcc, nas[i]->mnc, 0);
+			*data++ = lai[0];
+			*data++ = lai[1];
+			*data++ = lai[2];
+		} else {
+			*data++ = 0xff;
+			*data++ = 0xff;
+			*data++ = 0xff;
+		}
+	}
+	sim_job(ms, nmsg);
+
+	return 0;
+}
+
+/* update LOCI on SIM */
+int gsm_subscr_write_loci(struct osmocom_ms *ms)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+	struct sim_hdr *nsh;
+	struct gsm1111_ef_loci *loci;
+
+	/* skip, if no real valid SIM */
+	if (subscr->sim_type != GSM_SIM_TYPE_READER || !subscr->sim_valid)
+		return 0;
+
+	LOGP(DMM, LOGL_INFO, "Updating LOCI on SIM\n");
+
+	/* write to SIM */
+	nmsg = gsm_sim_msgb_alloc(subscr->sim_handle_update,
+		SIM_JOB_UPDATE_BINARY);
+	if (!nmsg)
+		return -ENOMEM;
+	nsh = (struct sim_hdr *) nmsg->data;
+	nsh->path[0] = 0x7f20;
+	nsh->path[1] = 0;
+	nsh->file = 0x6f7e;
+	loci = (struct gsm1111_ef_loci *)msgb_put(nmsg, sizeof(*loci));
+
+	/* TMSI */
+	loci->tmsi = htonl(subscr->tmsi);
+
+	/* LAI */
+	gsm48_encode_lai_hex(&loci->lai, subscr->mcc, subscr->mnc, subscr->lac);
+
+	/* TMSI time */
+	loci->tmsi_time = 0xff;
+
+	/* location update status */
+	switch (subscr->ustate) {
+	case GSM_SIM_U1_UPDATED:
+		loci->lupd_status = 0x00;
+		break;
+	case GSM_SIM_U3_ROAMING_NA:
+		loci->lupd_status = 0x03;
+		break;
+	default:
+		loci->lupd_status = 0x01;
+	}
+
+	sim_job(ms, nmsg);
+
+	return 0;
+}
+
+static void subscr_sim_update_cb(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct sim_hdr *sh = (struct sim_hdr *) msg->data;
+	uint8_t *payload = msg->data + sizeof(*sh);
+
+	/* error handling */
+	if (sh->job_type == SIM_JOB_ERROR)
+		LOGP(DMM, LOGL_NOTICE, "SIM update failed (cause %d)\n",
+			*payload);
+
+	msgb_free(msg);
+}
+
+int gsm_subscr_generate_kc(struct osmocom_ms *ms, uint8_t key_seq,
+	uint8_t *rand, uint8_t no_sim)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+	struct sim_hdr *nsh;
+
+	/* not a SIM */
+	if ((subscr->sim_type != GSM_SIM_TYPE_READER
+	  && subscr->sim_type != GSM_SIM_TYPE_TEST)
+	 || !subscr->sim_valid || no_sim) {
+		struct gsm48_mm_event *nmme;
+
+		LOGP(DMM, LOGL_INFO, "Sending dummy authentication response\n");
+		nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_AUTH_RESPONSE);
+		if (!nmsg)
+			return -ENOMEM;
+		nmme = (struct gsm48_mm_event *) nmsg->data;
+		nmme->sres[0] = 0x12;
+		nmme->sres[1] = 0x34;
+		nmme->sres[2] = 0x56;
+		nmme->sres[3] = 0x78;
+		gsm48_mmevent_msg(ms, nmsg);
+
+		return 0;
+	}
+
+	/* test SIM */
+	if (subscr->sim_type == GSM_SIM_TYPE_TEST) {
+		struct gsm48_mm_event *nmme;
+		struct gsm_settings *set = &ms->settings;
+		static struct osmo_sub_auth_data auth = {
+			.type = OSMO_AUTH_TYPE_GSM
+		};
+		struct osmo_auth_vector _vec;
+		struct osmo_auth_vector *vec = &_vec;
+
+		auth.algo = set->test_ki_type;
+		memcpy(auth.u.gsm.ki, set->test_ki, sizeof(auth.u.gsm.ki));
+		int ret = osmo_auth_gen_vec(vec, &auth, rand);
+		if (ret < 0)
+			return ret;
+
+		/* store sequence */
+		subscr->key_seq = key_seq;
+		memcpy(subscr->key, vec->kc, 8);
+
+		LOGP(DMM, LOGL_INFO, "Sending authentication response\n");
+		nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_AUTH_RESPONSE);
+		if (!nmsg)
+			return -ENOMEM;
+		nmme = (struct gsm48_mm_event *) nmsg->data;
+		memcpy(nmme->sres, vec->sres, 4);
+		gsm48_mmevent_msg(ms, nmsg);
+
+		return 0;
+	}
+
+	LOGP(DMM, LOGL_INFO, "Generating KEY at SIM\n");
+
+	/* command to SIM */
+	nmsg = gsm_sim_msgb_alloc(subscr->sim_handle_key, SIM_JOB_RUN_GSM_ALGO);
+	if (!nmsg)
+		return -ENOMEM;
+	nsh = (struct sim_hdr *) nmsg->data;
+	nsh->path[0] = 0x7f20;
+	nsh->path[1] = 0;
+
+	/* random */
+	memcpy(msgb_put(nmsg, 16), rand, 16);
+
+	/* store sequence */
+	subscr->key_seq = key_seq;
+
+	sim_job(ms, nmsg);
+
+	return 0;
+}
+
+static void subscr_sim_key_cb(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct sim_hdr *sh = (struct sim_hdr *) msg->data;
+	uint8_t *payload = msg->data + sizeof(*sh);
+	uint16_t payload_len = msg->len - sizeof(*sh);
+	struct msgb *nmsg;
+	struct sim_hdr *nsh;
+	struct gsm48_mm_event *nmme;
+	uint8_t *data;
+
+	/* error handling */
+	if (sh->job_type == SIM_JOB_ERROR) {
+		LOGP(DMM, LOGL_NOTICE, "key generation on SIM failed "
+			"(cause %d)\n", *payload);
+
+		msgb_free(msg);
+
+		return;
+	}
+
+	if (payload_len < 12) {
+		LOGP(DMM, LOGL_NOTICE, "response from SIM too short\n");
+		return;
+	}
+
+	/* store key */
+	memcpy(subscr->key, payload + 4, 8);
+
+	/* write to SIM */
+	LOGP(DMM, LOGL_INFO, "Updating KC on SIM\n");
+	nmsg = gsm_sim_msgb_alloc(subscr->sim_handle_update,
+		SIM_JOB_UPDATE_BINARY);
+	if (!nmsg)
+		return;
+	nsh = (struct sim_hdr *) nmsg->data;
+	nsh->path[0] = 0x7f20;
+	nsh->path[1] = 0;
+	nsh->file = 0x6f20;
+	data = msgb_put(nmsg, 9);
+	memcpy(data, subscr->key, 8);
+	data[8] = subscr->key_seq;
+	sim_job(ms, nmsg);
+
+	/* return signed response */
+	nmsg = gsm48_mmevent_msgb_alloc(GSM48_MM_EVENT_AUTH_RESPONSE);
+	if (!nmsg)
+		return;
+	nmme = (struct gsm48_mm_event *) nmsg->data;
+	memcpy(nmme->sres, payload, 4);
+	gsm48_mmevent_msg(ms, nmsg);
+
+	msgb_free(msg);
+}
+
+/*
+ * detach
+ */
+
+/* Detach card */
+int gsm_subscr_remove(struct osmocom_ms *ms)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+
+	if (!subscr->sim_valid) {
+		LOGP(DMM, LOGL_ERROR, "Cannot remove card, no card present\n");
+		return -EINVAL;
+	}
+
+	/* remove card */
+	nmsg = gsm48_mmr_msgb_alloc(GSM48_MMR_NREG_REQ);
+	if (!nmsg)
+		return -ENOMEM;
+	gsm48_mmr_downmsg(ms, nmsg);
+
+	return 0;
+}
+
+/*
+ * state and lists
+ */
+
+static const char *subscr_ustate_names[] = {
+	"U0_NULL",
+	"U1_UPDATED",
+	"U2_NOT_UPDATED",
+	"U3_ROAMING_NA"
+};
+
+/* change to new U state */
+void new_sim_ustate(struct gsm_subscriber *subscr, int state)
+{
+	LOGP(DMM, LOGL_INFO, "(ms %s) new state %s -> %s\n", subscr->ms->name,
+		subscr_ustate_names[subscr->ustate],
+		subscr_ustate_names[state]);
+
+	subscr->ustate = state;
+}
+
+/* del forbidden PLMN. if MCC==0, flush complete list */
+int gsm_subscr_del_forbidden_plmn(struct gsm_subscriber *subscr, uint16_t mcc,
+	uint16_t mnc)
+{
+	struct gsm_sub_plmn_na *na, *na2;
+	int deleted = 0;
+
+	llist_for_each_entry_safe(na, na2, &subscr->plmn_na, entry) {
+		if (!mcc || (na->mcc == mcc && na->mnc == mnc)) {
+			LOGP(DPLMN, LOGL_INFO, "Delete from list of forbidden "
+				"PLMNs (mcc=%s, mnc=%s)\n",
+				gsm_print_mcc(mcc), gsm_print_mnc(mnc));
+			llist_del(&na->entry);
+			talloc_free(na);
+			deleted = 1;
+			if (mcc)
+				break;
+		}
+	}
+
+	if (deleted) {
+		/* update plmn not allowed list on SIM */
+		subscr_write_plmn_na(subscr->ms);
+	}
+
+	return -EINVAL;
+}
+
+/* add forbidden PLMN */
+int gsm_subscr_add_forbidden_plmn(struct gsm_subscriber *subscr, uint16_t mcc,
+					uint16_t mnc, uint8_t cause)
+{
+	struct gsm_sub_plmn_na *na;
+
+	/* if already in the list, remove and add to tail */
+	gsm_subscr_del_forbidden_plmn(subscr, mcc, mnc);
+
+	LOGP(DPLMN, LOGL_INFO, "Add to list of forbidden PLMNs "
+		"(mcc=%s, mnc=%s)\n", gsm_print_mcc(mcc), gsm_print_mnc(mnc));
+	na = talloc_zero(subscr->ms, struct gsm_sub_plmn_na);
+	if (!na)
+		return -ENOMEM;
+	na->mcc = mcc;
+	na->mnc = mnc;
+	na->cause = cause ? : -1; /* cause 0 is not allowed */
+	llist_add_tail(&na->entry, &subscr->plmn_na);
+
+	/* don't add Home PLMN to SIM */
+	if (subscr->sim_valid && gsm_match_mnc(mcc, mnc, subscr->imsi))
+		return -EINVAL;
+
+	/* update plmn not allowed list on SIM */
+	subscr_write_plmn_na(subscr->ms);
+
+	return 0;
+}
+
+/* search forbidden PLMN */
+int gsm_subscr_is_forbidden_plmn(struct gsm_subscriber *subscr, uint16_t mcc,
+					uint16_t mnc)
+{
+	struct gsm_sub_plmn_na *na;
+
+	llist_for_each_entry(na, &subscr->plmn_na, entry) {
+		if (na->mcc == mcc && na->mnc == mnc)
+			return 1;
+	}
+
+	return 0;
+}
+
+int gsm_subscr_get_key_seq(struct osmocom_ms *ms, struct gsm_subscriber *subscr)
+{
+	if (ms->settings.force_rekey)
+		return 7;
+	else
+		return subscr->key_seq;
+}
+
+int gsm_subscr_dump_forbidden_plmn(struct osmocom_ms *ms,
+			void (*print)(void *, const char *, ...), void *priv)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct gsm_sub_plmn_na *temp;
+
+	print(priv, "MCC    |MNC    |cause\n");
+	print(priv, "-------+-------+-------\n");
+	llist_for_each_entry(temp, &subscr->plmn_na, entry)
+		print(priv, "%s    |%s%s    |#%d\n",
+			gsm_print_mcc(temp->mcc), gsm_print_mnc(temp->mnc),
+			((temp->mnc & 0x00f) == 0x00f) ? " ":"", temp->cause);
+
+	return 0;
+}
+
+/* dump subscriber */
+void gsm_subscr_dump(struct gsm_subscriber *subscr,
+			void (*print)(void *, const char *, ...), void *priv)
+{
+	int i;
+	struct gsm_sub_plmn_list *plmn_list;
+	struct gsm_sub_plmn_na *plmn_na;
+
+	print(priv, "Mobile Subscriber of MS '%s':\n", subscr->ms->name);
+
+	if (!subscr->sim_valid) {
+		print(priv, " No SIM present.\n");
+		return;
+	}
+
+	print(priv, " IMSI: %s\n", subscr->imsi);
+	if (subscr->iccid[0])
+		print(priv, " ICCID: %s\n", subscr->iccid);
+	if (subscr->sim_spn[0])
+		print(priv, " Service Provider Name: %s\n", subscr->sim_spn);
+	if (subscr->msisdn[0])
+		print(priv, " MSISDN: %s\n", subscr->msisdn);
+	if (subscr->sms_sca[0])
+		print(priv, " SMS Service Center Address: %s\n",
+			subscr->sms_sca);
+	print(priv, " Status: %s  IMSI %s", subscr_ustate_names[subscr->ustate],
+		(subscr->imsi_attached) ? "attached" : "detached");
+	if (subscr->tmsi != 0xffffffff)
+		print(priv, "  TMSI 0x%08x", subscr->tmsi);
+	if (subscr->lac > 0x0000 && subscr->lac < 0xfffe) {
+		print(priv, "\n");
+		print(priv, "         LAI: MCC %s  MNC %s  LAC 0x%04x  "
+			"(%s, %s)\n", gsm_print_mcc(subscr->mcc),
+			gsm_print_mnc(subscr->mnc), subscr->lac,
+			gsm_get_mcc(subscr->mcc),
+			gsm_get_mnc(subscr->mcc, subscr->mnc));
+	} else
+		print(priv, "  LAI: invalid\n");
+	if (subscr->key_seq != 7) {
+		print(priv, " Key: sequence %d ", subscr->key_seq);
+		for (i = 0; i < sizeof(subscr->key); i++)
+			print(priv, " %02x", subscr->key[i]);
+		print(priv, "\n");
+	}
+	if (subscr->plmn_valid)
+		print(priv, " Registered PLMN: MCC %s  MNC %s  (%s, %s)\n",
+			gsm_print_mcc(subscr->plmn_mcc),
+			gsm_print_mnc(subscr->plmn_mnc),
+			gsm_get_mcc(subscr->plmn_mcc),
+			gsm_get_mnc(subscr->plmn_mcc, subscr->plmn_mnc));
+	print(priv, " Access barred cells: %s\n",
+		(subscr->acc_barr) ? "yes" : "no");
+	print(priv, " Access classes:");
+	for (i = 0; i < 16; i++)
+		if ((subscr->acc_class & (1 << i)))
+			print(priv, " C%d", i);
+	print(priv, "\n");
+	if (!llist_empty(&subscr->plmn_list)) {
+		print(priv, " List of preferred PLMNs:\n");
+		print(priv, "        MCC    |MNC\n");
+		print(priv, "        -------+-------\n");
+		llist_for_each_entry(plmn_list, &subscr->plmn_list, entry)
+			print(priv, "        %s    |%s        (%s, %s)\n",
+			gsm_print_mcc(plmn_list->mcc),
+			gsm_print_mnc(plmn_list->mnc),
+			gsm_get_mcc(plmn_list->mcc),
+			gsm_get_mnc(plmn_list->mcc, plmn_list->mnc));
+	}
+	if (!llist_empty(&subscr->plmn_na)) {
+		print(priv, " List of forbidden PLMNs:\n");
+		print(priv, "        MCC    |MNC    |cause\n");
+		print(priv, "        -------+-------+-------\n");
+		llist_for_each_entry(plmn_na, &subscr->plmn_na, entry)
+			print(priv, "        %s    |%s%s    |#%d        "
+				"(%s, %s)\n", gsm_print_mcc(plmn_na->mcc),
+				gsm_print_mnc(plmn_na->mnc),
+				((plmn_na->mnc & 0x00f) == 0x00f) ? " ":"",
+				plmn_na->cause, gsm_get_mcc(plmn_na->mcc),
+				gsm_get_mnc(plmn_na->mcc, plmn_na->mnc));
+	}
+}
+
+/*
+ * SAP interface integration
+ */
+
+/* Attach SIM card over SAP */
+int gsm_subscr_sapcard(struct osmocom_ms *ms)
+{
+	struct gsm_subscriber *subscr = &ms->subscr;
+	struct msgb *nmsg;
+	int rc;
+
+	if (subscr->sim_valid) {
+		LOGP(DMM, LOGL_ERROR, "Cannot insert card, until current card "
+			"is detached.\n");
+		return -EBUSY;
+	}
+
+	/* reset subscriber */
+	gsm_subscr_exit(ms);
+	gsm_subscr_init(ms);
+
+	subscr->sim_type = GSM_SIM_TYPE_SAP;
+	sprintf(subscr->sim_name, "sap");
+	subscr->sim_valid = 1;
+
+	/* Try to connect to the SAP interface */
+	vty_notify(ms, NULL);
+	vty_notify(ms, "Connecting to the SAP interface...\n");
+	rc = sap_open(ms, ms->settings.sap_socket_path);
+	if (rc < 0) {
+		LOGP(DSAP, LOGL_ERROR, "Failed during sap_open(), no SAP based SIM reader\n");
+		vty_notify(ms, "SAP connection error!\n");
+		ms->sap_wq.bfd.fd = -1;
+
+		/* Detach SIM */
+		subscr->sim_valid = 0;
+		nmsg = gsm48_mmr_msgb_alloc(GSM48_MMR_NREG_REQ);
+		if (!nmsg)
+			return -ENOMEM;
+		gsm48_mmr_downmsg(ms, nmsg);
+
+		return rc;
+	}
+
+	return 0;
+}
+
+/* Deattach sapcard */
+int gsm_subscr_remove_sapcard(struct osmocom_ms *ms)
+{
+	return sap_close(ms);
+}
diff --git a/src/host/layer23/src/mobile/support.c b/src/host/layer23/src/mobile/support.c
new file mode 100644
index 00000000..e9361a35
--- /dev/null
+++ b/src/host/layer23/src/mobile/support.c
@@ -0,0 +1,181 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+
+void gsm_support_init(struct osmocom_ms *ms)
+{
+	struct gsm_support *sup = &ms->support;
+
+	memset(sup, 0, sizeof(*sup));
+	sup->ms = ms;
+
+	/* controlled early classmark sending */
+	sup->es_ind = 1; /* yes */
+	/* revision level */
+	sup->rev_lev = 1; /* phase 2 mobile station */
+	/* support of VGCS */
+	sup->vgcs = 0; /* no */
+	/* support of VBS */
+	sup->vbs = 0; /* no */
+	/* support of SMS */
+	sup->sms_ptp = 1; /* no */
+	/* screening indicator */
+	sup->ss_ind = 1; /* phase 2 error handling */
+	/* pseudo synchronised capability */
+	sup->ps_cap = 0; /* no */
+	/* CM service prompt */
+	sup->cmsp = 0; /* no */
+	/* solsa support */
+	sup->solsa = 0; /* no */
+	/* location service support */
+	sup->lcsva = 0; /* no */
+	sup->loc_serv = 0; /* no */
+	/* cipher support */
+	sup->a5_1 = 1;
+	sup->a5_2 = 1;
+	sup->a5_3 = 0;
+	sup->a5_4 = 0;
+	sup->a5_5 = 0;
+	sup->a5_6 = 0;
+	sup->a5_7 = 0;
+	/* radio support */
+	sup->p_gsm = 1; /* P-GSM */
+	sup->e_gsm = 1; /* E-GSM */
+	sup->r_gsm = 1; /* R-GSM */
+	sup->dcs = 1;
+	sup->gsm_850 = 1;
+	sup->pcs = 1;
+	sup->gsm_480 = 0;
+	sup->gsm_450 = 0;
+	/* rf power capability */
+	sup->class_900 = 4; /* CLASS 4: Handheld 2W */
+	sup->class_850 = 4;
+	sup->class_400 = 4;
+	sup->class_dcs = 1; /* CLASS 1: Handheld 1W */
+	sup->class_pcs = 1;
+	/* multi slot support */
+	sup->ms_sup = 0; /* no */
+	/* ucs2 treatment */
+	sup->ucs2_treat = 0; /* default */
+	/* support extended measurements */
+	sup->ext_meas = 0; /* no */
+	/* support switched measurement capability */
+	sup->meas_cap = 0; /* no */
+	//sup->sms_val = ;
+	//sup->sm_val = ;
+
+	/* radio */
+	sup->ch_cap = GSM_CAP_SDCCH_TCHF_TCHH;
+	sup->min_rxlev_dbm = -106; // TODO
+	sup->sync_to = 6; /* how long to wait sync (0.9 s) */
+	sup->scan_to = 4; /* how long to wait for all sysinfos (>=4 s) */
+	sup->dsc_max = 90; /* the specs defines 90 */
+
+	/* codec */
+	sup->full_v1 = 1;
+	sup->full_v2 = 1;
+	sup->full_v3 = 0;
+	sup->half_v1 = 1;
+	sup->half_v3 = 0;
+}
+
+/* (3.2.1) maximum channels to scan within each band */
+struct gsm_support_scan_max gsm_sup_smax[] = {
+	{ 259, 293, 15, 0 }, /* GSM 450 */
+	{ 306, 340, 15, 0 }, /* GSM 480 */
+	{ 438, 511, 25, 0 },
+	{ 128, 251, 30, 0 }, /* GSM 850 */
+	{ 955, 124, 30, 0 }, /* P,E,R GSM */
+	{ 512, 885, 40, 0 }, /* DCS 1800 */
+	{ 1024, 1322, 40, 0 }, /* PCS 1900 */
+	{ 0, 0, 0, 0 }
+};
+
+#define SUP_SET(item) \
+	((sup->item) ? ((set->item) ? "yes" : "disabled") : "no")
+/* dump support */
+void gsm_support_dump(struct osmocom_ms *ms,
+			void (*print)(void *, const char *, ...), void *priv)
+{
+	struct gsm_support *sup = &ms->support;
+	struct gsm_settings *set = &ms->settings;
+
+	print(priv, "Supported features of MS '%s':\n", sup->ms->name);
+	print(priv, " Phase %d mobile station\n", sup->rev_lev + 1);
+	print(priv, " R-GSM        : %s\n", SUP_SET(r_gsm));
+	print(priv, " E-GSM        : %s\n", SUP_SET(e_gsm));
+	print(priv, " P-GSM        : %s\n", SUP_SET(p_gsm));
+	if (set->r_gsm || set->e_gsm || set->p_gsm)
+		print(priv, " GSM900 Class : %d\n", set->class_900);
+	print(priv, " DCS 1800     : %s\n", SUP_SET(dcs));
+	if (set->dcs)
+		print(priv, " DCS Class    : %d\n", set->class_dcs);
+	print(priv, " GSM 850      : %s\n", SUP_SET(gsm_850));
+	if (set->gsm_850)
+		print(priv, " GSM 850 Class: %d\n", set->class_850);
+	print(priv, " PCS 1900     : %s\n", SUP_SET(pcs));
+	if (set->pcs)
+		print(priv, " PCS Class    : %d\n", set->class_pcs);
+	print(priv, " GSM 480      : %s\n", SUP_SET(gsm_480));
+	print(priv, " GSM 450      : %s\n", SUP_SET(gsm_450));
+	if (set->gsm_480 | set->gsm_450)
+		print(priv, " GSM 400 Class: %d\n", set->class_400);
+	print(priv, " CECS         : %s\n", (sup->es_ind) ? "yes" : "no");
+	print(priv, " VGCS         : %s\n", (sup->vgcs) ? "yes" : "no");
+	print(priv, " VBS          : %s\n", (sup->vbs) ? "yes" : "no");
+	print(priv, " SMS          : %s\n", SUP_SET(sms_ptp));
+	print(priv, " SS_IND       : %s\n", (sup->ss_ind) ? "yes" : "no");
+	print(priv, " PS_CAP       : %s\n", (sup->ps_cap) ? "yes" : "no");
+	print(priv, " CMSP         : %s\n", (sup->cmsp) ? "yes" : "no");
+	print(priv, " SoLSA        : %s\n", (sup->solsa) ? "yes" : "no");
+	print(priv, " LCSVA        : %s\n", (sup->lcsva) ? "yes" : "no");
+	print(priv, " LOC_SERV     : %s\n", (sup->loc_serv) ? "yes" : "no");
+	print(priv, " A5/1         : %s\n", SUP_SET(a5_1));
+	print(priv, " A5/2         : %s\n", SUP_SET(a5_2));
+	print(priv, " A5/3         : %s\n", SUP_SET(a5_3));
+	print(priv, " A5/4         : %s\n", SUP_SET(a5_4));
+	print(priv, " A5/5         : %s\n", SUP_SET(a5_5));
+	print(priv, " A5/6         : %s\n", SUP_SET(a5_6));
+	print(priv, " A5/7         : %s\n", SUP_SET(a5_7));
+	switch (set->ch_cap) {
+		case GSM_CAP_SDCCH:
+		print(priv, " Channels     : SDCCH only\n");
+		break;
+		case GSM_CAP_SDCCH_TCHF:
+		print(priv, " Channels     : SDCCH + TCH/F\n");
+		break;
+		case GSM_CAP_SDCCH_TCHF_TCHH:
+		print(priv, " Channels     : SDCCH + TCH/F + TCH/H\n");
+		break;
+	}
+	print(priv, " Full-Rate V1 : %s\n", SUP_SET(full_v1));
+	print(priv, " Full-Rate V2 : %s\n", SUP_SET(full_v2));
+	print(priv, " Full-Rate V3 : %s\n", SUP_SET(full_v3));
+	print(priv, " Half-Rate V1 : %s\n", SUP_SET(half_v1));
+	print(priv, " Half-Rate V3 : %s\n", SUP_SET(half_v3));
+	print(priv, " Min RXLEV    : %d\n", set->min_rxlev_dbm);
+}
+
diff --git a/src/host/layer23/src/mobile/transaction.c b/src/host/layer23/src/mobile/transaction.c
new file mode 100644
index 00000000..9824bd1b
--- /dev/null
+++ b/src/host/layer23/src/mobile/transaction.c
@@ -0,0 +1,141 @@
+/* GSM 04.07 Transaction handling */
+
+/* (C) 2009 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/msgb.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/logging.h>
+#include <osmocom/bb/mobile/mncc.h>
+#include <osmocom/bb/mobile/transaction.h>
+
+void _gsm48_cc_trans_free(struct gsm_trans *trans);
+void _gsm480_ss_trans_free(struct gsm_trans *trans);
+void _gsm411_sms_trans_free(struct gsm_trans *trans);
+
+struct gsm_trans *trans_find_by_id(struct osmocom_ms *ms,
+				   uint8_t proto, uint8_t trans_id)
+{
+	struct gsm_trans *trans;
+
+	llist_for_each_entry(trans, &ms->trans_list, entry) {
+		if (trans->protocol == proto &&
+		    trans->transaction_id == trans_id)
+			return trans;
+	}
+	return NULL;
+}
+
+struct gsm_trans *trans_find_by_callref(struct osmocom_ms *ms,
+					uint32_t callref)
+{
+	struct gsm_trans *trans;
+
+	llist_for_each_entry(trans, &ms->trans_list, entry) {
+		if (trans->callref == callref)
+			return trans;
+	}
+	return NULL;
+}
+
+struct gsm_trans *trans_alloc(struct osmocom_ms *ms,
+			      uint8_t protocol, uint8_t trans_id,
+			      uint32_t callref)
+{
+	struct gsm_trans *trans;
+
+	trans = talloc_zero(ms, struct gsm_trans);
+	if (!trans)
+		return NULL;
+
+	DEBUGP(DCC, "ms %s allocates transaction (proto %d trans_id %d "
+		"callref %x mem %p)\n", ms->name, protocol, trans_id, callref,
+		trans);
+
+	trans->ms = ms;
+
+	trans->protocol = protocol;
+	trans->transaction_id = trans_id;
+	trans->callref = callref;
+
+	llist_add_tail(&trans->entry, &ms->trans_list);
+
+	return trans;
+}
+
+void trans_free(struct gsm_trans *trans)
+{
+	switch (trans->protocol) {
+	case GSM48_PDISC_CC:
+		_gsm48_cc_trans_free(trans);
+		break;
+	case GSM48_PDISC_NC_SS:
+		_gsm480_ss_trans_free(trans);
+		break;
+	case GSM48_PDISC_SMS:
+		_gsm411_sms_trans_free(trans);
+		break;
+	}
+
+	DEBUGP(DCC, "ms %s frees transaction (mem %p)\n", trans->ms->name,
+		trans);
+
+	llist_del(&trans->entry);
+
+	talloc_free(trans);
+}
+
+/* allocate an unused transaction ID
+ * in the given protocol using the ti_flag specified */
+int trans_assign_trans_id(struct osmocom_ms *ms,
+			  uint8_t protocol, uint8_t ti_flag)
+{
+	struct gsm_trans *trans;
+	unsigned int used_tid_bitmask = 0;
+	int i, j, h;
+
+	if (ti_flag)
+		ti_flag = 0x8;
+
+	/* generate bitmask of already-used TIDs for this (proto) */
+	llist_for_each_entry(trans, &ms->trans_list, entry) {
+		if (trans->protocol != protocol ||
+		    trans->transaction_id == 0xff)
+			continue;
+		used_tid_bitmask |= (1 << trans->transaction_id);
+	}
+
+	/* find a new one, trying to go in a 'circular' pattern */
+	for (h = 6; h > 0; h--)
+		if (used_tid_bitmask & (1 << (h | ti_flag)))
+			break;
+	for (i = 0; i < 7; i++) {
+		j = ((h + i) % 7) | ti_flag;
+		if ((used_tid_bitmask & (1 << j)) == 0)
+			return j;
+	}
+
+	return -1;
+}
+
diff --git a/src/host/layer23/src/mobile/voice.c b/src/host/layer23/src/mobile/voice.c
new file mode 100644
index 00000000..b7678337
--- /dev/null
+++ b/src/host/layer23/src/mobile/voice.c
@@ -0,0 +1,78 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdlib.h>
+
+#include <osmocom/core/msgb.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/mobile/mncc.h>
+#include <osmocom/bb/mobile/voice.h>
+
+
+/*
+ * receive voice
+ */
+
+static int gsm_recv_voice(struct osmocom_ms *ms, struct msgb *msg)
+{
+	struct gsm_data_frame *mncc;
+
+	/* distribute and then free */
+	if (ms->mncc_entity.mncc_recv && ms->mncc_entity.ref) {
+		/* push mncc header in front of data */
+		mncc = (struct gsm_data_frame *)
+			msgb_push(msg, sizeof(struct gsm_data_frame));
+		mncc->msg_type = GSM_TCHF_FRAME;
+		mncc->callref =  ms->mncc_entity.ref;
+		ms->mncc_entity.mncc_recv(ms, mncc->msg_type, mncc);
+	}
+
+	msgb_free(msg);
+	return 0;
+}
+
+/*
+ * send voice
+ */
+int gsm_send_voice(struct osmocom_ms *ms, struct gsm_data_frame *data)
+{
+	struct msgb *nmsg;
+
+	nmsg = msgb_alloc_headroom(33 + 64, 64, "TCH/F");
+	if (!nmsg)
+		return -ENOMEM;
+	nmsg->l2h = msgb_put(nmsg, 33);
+	memcpy(nmsg->l2h, data->data, 33);
+
+	return gsm48_rr_tx_voice(ms, nmsg);
+}
+
+/*
+ * init
+ */
+
+int gsm_voice_init(struct osmocom_ms *ms)
+{
+	ms->l1_entity.l1_traffic_ind = gsm_recv_voice;
+
+	return 0;
+}
diff --git a/src/host/layer23/src/mobile/vty_interface.c b/src/host/layer23/src/mobile/vty_interface.c
new file mode 100644
index 00000000..a0ad9937
--- /dev/null
+++ b/src/host/layer23/src/mobile/vty_interface.c
@@ -0,0 +1,3038 @@
+/*
+ * (C) 2010 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <string.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <unistd.h>
+#include <sys/types.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/crypt/auth.h>
+
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/common/networks.h>
+#include <osmocom/bb/common/gps.h>
+#include <osmocom/bb/mobile/mncc.h>
+#include <osmocom/bb/mobile/mncc_ms.h>
+#include <osmocom/bb/mobile/transaction.h>
+#include <osmocom/bb/mobile/vty.h>
+#include <osmocom/bb/mobile/app_mobile.h>
+#include <osmocom/bb/mobile/gsm480_ss.h>
+#include <osmocom/bb/mobile/gsm411_sms.h>
+#include <osmocom/vty/telnet_interface.h>
+#include <osmocom/vty/misc.h>
+
+extern struct llist_head ms_list;
+extern struct llist_head active_connections;
+
+struct cmd_node ms_node = {
+	MS_NODE,
+	"%s(ms)# ",
+	1
+};
+
+struct cmd_node testsim_node = {
+	TESTSIM_NODE,
+	"%s(test-sim)# ",
+	1
+};
+
+struct cmd_node support_node = {
+	SUPPORT_NODE,
+	"%s(support)# ",
+	1
+};
+
+static void print_vty(void *priv, const char *fmt, ...)
+{
+	char buffer[1000];
+	struct vty *vty = priv;
+	va_list args;
+
+	va_start(args, fmt);
+	vsnprintf(buffer, sizeof(buffer) - 1, fmt, args);
+	buffer[sizeof(buffer) - 1] = '\0';
+	va_end(args);
+
+	if (buffer[0]) {
+		if (buffer[strlen(buffer) - 1] == '\n') {
+			buffer[strlen(buffer) - 1] = '\0';
+			vty_out(vty, "%s%s", buffer, VTY_NEWLINE);
+		} else
+			vty_out(vty, "%s", buffer);
+	}
+}
+
+int vty_check_number(struct vty *vty, const char *number)
+{
+	int i;
+
+	for (i = 0; i < strlen(number); i++) {
+		/* allow international notation with + */
+		if (i == 0 && number[i] == '+')
+			continue;
+		if (!(number[i] >= '0' && number[i] <= '9')
+		 && number[i] != '*'
+		 && number[i] != '#'
+		 && !(number[i] >= 'a' && number[i] <= 'c')) {
+			vty_out(vty, "Invalid digit '%c' of number!%s",
+				number[i], VTY_NEWLINE);
+			return -EINVAL;
+		}
+	}
+	if (number[0] == '\0' || (number[0] == '+' && number[1] == '\0')) {
+		vty_out(vty, "Given number has no digits!%s", VTY_NEWLINE);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int vty_reading = 0;
+static int hide_default = 0;
+
+static void vty_restart(struct vty *vty, struct osmocom_ms *ms)
+{
+	if (vty_reading)
+		return;
+	if (ms->shutdown != MS_SHUTDOWN_NONE)
+		return;
+	vty_out(vty, "You must restart MS '%s' ('shutdown / no shutdown') for "
+		"change to take effect!%s", ms->name, VTY_NEWLINE);
+}
+
+static void vty_restart_if_started(struct vty *vty, struct osmocom_ms *ms)
+{
+	if (!ms->started)
+		return;
+	vty_restart(vty, ms);
+}
+
+static struct osmocom_ms *get_ms(const char *name, struct vty *vty)
+{
+	struct osmocom_ms *ms;
+
+	llist_for_each_entry(ms, &ms_list, entity) {
+		if (!strcmp(ms->name, name)) {
+			if (ms->shutdown != MS_SHUTDOWN_NONE) {
+				vty_out(vty, "MS '%s' is admin down.%s", name,
+					VTY_NEWLINE);
+				return NULL;
+			}
+			return ms;
+		}
+	}
+	vty_out(vty, "MS name '%s' does not exits.%s", name, VTY_NEWLINE);
+
+	return NULL;
+}
+
+static void gsm_ms_dump(struct osmocom_ms *ms, struct vty *vty)
+{
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_trans *trans;
+	char *service = "";
+
+	if (!ms->started)
+		service = ", radio is not started";
+	else if (ms->mmlayer.state == GSM48_MM_ST_MM_IDLE) {
+		/* current MM idle state */
+		switch (ms->mmlayer.substate) {
+		case GSM48_MM_SST_NORMAL_SERVICE:
+		case GSM48_MM_SST_PLMN_SEARCH_NORMAL:
+			service = ", service is normal";
+			break;
+		case GSM48_MM_SST_LOC_UPD_NEEDED:
+		case GSM48_MM_SST_ATTEMPT_UPDATE:
+			service = ", service is limited (pending)";
+			break;
+		case GSM48_MM_SST_NO_CELL_AVAIL:
+			service = ", service is unavailable";
+			break;
+		default:
+			if (ms->subscr.sim_valid)
+				service = ", service is limited";
+			else
+				service = ", service is limited "
+					"(IMSI detached)";
+			break;
+		}
+	} else
+		service = ", MM connection active";
+
+	vty_out(vty, "MS '%s' is %s%s%s%s", ms->name,
+		(ms->shutdown != MS_SHUTDOWN_NONE) ? "administratively " : "",
+		(ms->shutdown != MS_SHUTDOWN_NONE || !ms->started) ? "down" : "up",
+		(ms->shutdown == MS_SHUTDOWN_NONE) ? service : "",
+		VTY_NEWLINE);
+	vty_out(vty, "  IMEI: %s%s", set->imei, VTY_NEWLINE);
+	vty_out(vty, "     IMEISV: %s%s", set->imeisv, VTY_NEWLINE);
+	if (set->imei_random)
+		vty_out(vty, "     IMEI generation: random (%d trailing "
+			"digits)%s", set->imei_random, VTY_NEWLINE);
+	else
+		vty_out(vty, "     IMEI generation: fixed%s", VTY_NEWLINE);
+
+	if (ms->shutdown != MS_SHUTDOWN_NONE)
+		return;
+
+	if (set->plmn_mode == PLMN_MODE_AUTO)
+		vty_out(vty, "  automatic network selection state: %s%s",
+			get_a_state_name(ms->plmn.state), VTY_NEWLINE);
+	else
+		vty_out(vty, "  manual network selection state   : %s%s",
+			get_m_state_name(ms->plmn.state), VTY_NEWLINE);
+	if (ms->plmn.mcc)
+		vty_out(vty, "                                     MCC=%s "
+			"MNC=%s (%s, %s)%s", gsm_print_mcc(ms->plmn.mcc),
+			gsm_print_mnc(ms->plmn.mnc), gsm_get_mcc(ms->plmn.mcc),
+			gsm_get_mnc(ms->plmn.mcc, ms->plmn.mnc), VTY_NEWLINE);
+	vty_out(vty, "  cell selection state: %s%s",
+		get_cs_state_name(ms->cellsel.state), VTY_NEWLINE);
+	if (ms->cellsel.sel_mcc) {
+		vty_out(vty, "                        ARFCN=%s MCC=%s MNC=%s "
+			"LAC=0x%04x CELLID=0x%04x%s",
+			gsm_print_arfcn(ms->cellsel.sel_arfcn),
+			gsm_print_mcc(ms->cellsel.sel_mcc),
+			gsm_print_mnc(ms->cellsel.sel_mnc),
+			ms->cellsel.sel_lac, ms->cellsel.sel_id, VTY_NEWLINE);
+		vty_out(vty, "                        (%s, %s)%s",
+			gsm_get_mcc(ms->cellsel.sel_mcc),
+			gsm_get_mnc(ms->cellsel.sel_mcc, ms->cellsel.sel_mnc),
+			VTY_NEWLINE);
+	}
+	vty_out(vty, "  radio ressource layer state: %s%s",
+		gsm48_rr_state_names[ms->rrlayer.state], VTY_NEWLINE);
+	vty_out(vty, "  mobility management layer state: %s",
+		gsm48_mm_state_names[ms->mmlayer.state]);
+	if (ms->mmlayer.state == GSM48_MM_ST_MM_IDLE)
+		vty_out(vty, ", %s",
+			gsm48_mm_substate_names[ms->mmlayer.substate]);
+	vty_out(vty, "%s", VTY_NEWLINE);
+	llist_for_each_entry(trans, &ms->trans_list, entry) {
+		vty_out(vty, "  call control state: %s%s",
+			gsm48_cc_state_name(trans->cc.state), VTY_NEWLINE);
+	}
+}
+
+
+DEFUN(show_ms, show_ms_cmd, "show ms [MS_NAME]",
+	SHOW_STR "Display available MS entities\n")
+{
+	struct osmocom_ms *ms;
+
+	if (argc) {
+		llist_for_each_entry(ms, &ms_list, entity) {
+			if (!strcmp(ms->name, argv[0])) {
+				gsm_ms_dump(ms, vty);
+				return CMD_SUCCESS;
+			}
+		}
+		vty_out(vty, "MS name '%s' does not exits.%s", argv[0],
+		VTY_NEWLINE);
+		return CMD_WARNING;
+	} else {
+		llist_for_each_entry(ms, &ms_list, entity) {
+			gsm_ms_dump(ms, vty);
+			vty_out(vty, "%s", VTY_NEWLINE);
+		}
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_support, show_support_cmd, "show support [MS_NAME]",
+	SHOW_STR "Display information about MS support\n"
+	"Name of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+
+	if (argc) {
+		ms = get_ms(argv[0], vty);
+		if (!ms)
+			return CMD_WARNING;
+		gsm_support_dump(ms, print_vty, vty);
+	} else {
+		llist_for_each_entry(ms, &ms_list, entity) {
+			gsm_support_dump(ms, print_vty, vty);
+			vty_out(vty, "%s", VTY_NEWLINE);
+		}
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_subscr, show_subscr_cmd, "show subscriber [MS_NAME]",
+	SHOW_STR "Display information about subscriber\n"
+	"Name of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+
+	if (argc) {
+		ms = get_ms(argv[0], vty);
+		if (!ms)
+			return CMD_WARNING;
+		gsm_subscr_dump(&ms->subscr, print_vty, vty);
+	} else {
+		llist_for_each_entry(ms, &ms_list, entity) {
+			if (ms->shutdown == MS_SHUTDOWN_NONE) {
+				gsm_subscr_dump(&ms->subscr, print_vty, vty);
+				vty_out(vty, "%s", VTY_NEWLINE);
+			}
+		}
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_cell, show_cell_cmd, "show cell MS_NAME",
+	SHOW_STR "Display information about received cells\n"
+	"Name of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	gsm322_dump_cs_list(&ms->cellsel, GSM322_CS_FLAG_SUPPORT, print_vty,
+		vty);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_cell_si, show_cell_si_cmd, "show cell MS_NAME <0-1023> [pcs]",
+	SHOW_STR "Display information about received cell\n"
+	"Name of MS (see \"show ms\")\nRadio frequency number\n"
+	"Given frequency is PCS band (1900) rather than DCS band.")
+{
+	struct osmocom_ms *ms;
+	struct gsm48_sysinfo *s;
+	uint16_t arfcn = atoi(argv[1]);
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (argc > 2) {
+		if (arfcn < 512 || arfcn > 810) {
+			vty_out(vty, "Given ARFCN not in PCS band%s",
+				VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		arfcn |= ARFCN_PCS;
+	}
+
+	s = ms->cellsel.list[arfcn2index(arfcn)].sysinfo;
+	if (!s) {
+		vty_out(vty, "Given ARFCN '%s' has no sysinfo available%s",
+			argv[1], VTY_NEWLINE);
+		return CMD_SUCCESS;
+	}
+
+	gsm48_sysinfo_dump(s, arfcn, print_vty, vty, ms->settings.freq_map);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_nbcells, show_nbcells_cmd, "show neighbour-cells MS_NAME",
+	SHOW_STR "Display information about current neighbour cells\n"
+	"Name of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	gsm322_dump_nb_list(&ms->cellsel, print_vty, vty);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_ba, show_ba_cmd, "show ba MS_NAME [MCC] [MNC]",
+	SHOW_STR "Display information about band allocations\n"
+	"Name of MS (see \"show ms\")\nMobile Country Code\n"
+	"Mobile Network Code")
+{
+	struct osmocom_ms *ms;
+	uint16_t mcc = 0, mnc = 0;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (argc >= 3) {
+		mcc = gsm_input_mcc((char *)argv[1]);
+		mnc = gsm_input_mnc((char *)argv[2]);
+		if (mcc == GSM_INPUT_INVALID) {
+			vty_out(vty, "Given MCC invalid%s", VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		if (mnc == GSM_INPUT_INVALID) {
+			vty_out(vty, "Given MNC invalid%s", VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	gsm322_dump_ba_list(&ms->cellsel, mcc, mnc, print_vty, vty);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_forb_plmn, show_forb_plmn_cmd, "show forbidden plmn MS_NAME",
+	SHOW_STR "Display information about forbidden cells / networks\n"
+	"Display forbidden PLMNs\nName of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	gsm_subscr_dump_forbidden_plmn(ms, print_vty, vty);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_forb_la, show_forb_la_cmd, "show forbidden location-area MS_NAME",
+	SHOW_STR "Display information about forbidden cells / networks\n"
+	"Display forbidden location areas\nName of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	gsm322_dump_forbidden_la(ms, print_vty, vty);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(monitor_network, monitor_network_cmd, "monitor network MS_NAME",
+	"Monitor...\nMonitor network information\nName of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	gsm48_rr_start_monitor(ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_monitor_network, no_monitor_network_cmd, "no monitor network MS_NAME",
+	NO_STR "Monitor...\nDeactivate monitor of network information\n"
+	"Name of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	gsm48_rr_stop_monitor(ms);
+
+	return CMD_SUCCESS;
+}
+
+static int _sim_test_cmd(struct vty *vty, int argc, const char *argv[],
+	int attached)
+{
+	struct osmocom_ms *ms;
+	struct gsm_settings *set;
+
+	/* Initial testcard settings */
+	uint16_t mcc = 0x001, mnc = 0x01f, lac = 0x0000;
+	uint32_t tmsi = 0xffffffff;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (ms->subscr.sim_valid) {
+		vty_out(vty, "SIM already attached, remove first!%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	set = &ms->settings;
+	if (set->test_rplmn_valid) {
+		mcc = set->test_rplmn_mcc;
+		mnc = set->test_rplmn_mnc;
+
+		if (set->test_lac > 0x0000 && set->test_lac < 0xfffe)
+			lac = set->test_lac;
+
+		if (set->test_tmsi != 0xffffffff)
+			tmsi = set->test_tmsi;
+	}
+
+	if (argc == 2) {
+		vty_out(vty, "Give MNC together with MCC%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (argc >= 3) {
+		mcc = gsm_input_mcc((char *)argv[1]);
+		mnc = gsm_input_mnc((char *)argv[2]);
+		if (mcc == GSM_INPUT_INVALID) {
+			vty_out(vty, "Given MCC invalid%s", VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		if (mnc == GSM_INPUT_INVALID) {
+			vty_out(vty, "Given MNC invalid%s", VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	if (argc >= 4)
+		lac = strtoul(argv[3], NULL, 16);
+
+	if (argc >= 5)
+		tmsi = strtoul(argv[4], NULL, 16);
+
+	gsm_subscr_testcard(ms, mcc, mnc, lac, tmsi, attached);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(sim_test, sim_test_cmd,
+	"sim testcard MS_NAME [MCC] [MNC] [LAC] [TMSI]",
+	"SIM actions\nAttach bulit in test SIM\nName of MS (see \"show ms\")\n"
+	"Optionally set mobile Country Code of RPLMN\n"
+	"Optionally set mobile Network Code of RPLMN\n"
+	"Optionally set location area code of RPLMN\n"
+	"Optionally set current assigned TMSI")
+{
+	return _sim_test_cmd(vty, argc, argv, 0);
+}
+
+DEFUN(sim_test_att, sim_test_att_cmd,
+	"sim testcard MS_NAME MCC MNC LAC TMSI attached",
+	"SIM actions\nAttach bulit in test SIM\nName of MS (see \"show ms\")\n"
+	"Set mobile Country Code of RPLMN\nSet mobile Network Code of RPLMN\n"
+	"Set location area code\nSet current assigned TMSI\n"
+	"Indicate to MM that card is already attached")
+{
+	return _sim_test_cmd(vty, argc, argv, 1);
+}
+
+DEFUN(sim_sap, sim_sap_cmd, "sim sap MS_NAME",
+	"SIM actions\nAttach SIM over SAP interface\n"
+	"Name of MS (see \"show ms\")\n")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (ms->subscr.sim_valid) {
+		vty_out(vty, "SIM already attached, remove first!%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (gsm_subscr_sapcard(ms) != 0) {
+		return CMD_WARNING;
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(sim_reader, sim_reader_cmd, "sim reader MS_NAME",
+	"SIM actions\nAttach SIM from reader\nName of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (ms->subscr.sim_valid) {
+		vty_out(vty, "SIM already attached, remove first!%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	gsm_subscr_simcard(ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(sim_remove, sim_remove_cmd, "sim remove MS_NAME",
+	"SIM actions\nDetach SIM card\nName of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (!ms->subscr.sim_valid) {
+		vty_out(vty, "No SIM attached!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (ms->subscr.sim_type == GSM_SIM_TYPE_SAP) {
+		gsm_subscr_remove_sapcard(ms);
+	}
+
+	gsm_subscr_remove(ms);
+	return CMD_SUCCESS;
+}
+
+DEFUN(sim_pin, sim_pin_cmd, "sim pin MS_NAME PIN",
+	"SIM actions\nEnter PIN for SIM card\nName of MS (see \"show ms\")\n"
+	"PIN number")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (strlen(argv[1]) < 4 || strlen(argv[1]) > 8) {
+		vty_out(vty, "PIN must be in range 4..8!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (!ms->subscr.sim_pin_required) {
+		vty_out(vty, "No PIN is required at this time!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	gsm_subscr_sim_pin(ms, (char *)argv[1], "", 0);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(sim_disable_pin, sim_disable_pin_cmd, "sim disable-pin MS_NAME PIN",
+	"SIM actions\nDisable PIN of SIM card\nName of MS (see \"show ms\")\n"
+	"PIN number")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (strlen(argv[1]) < 4 || strlen(argv[1]) > 8) {
+		vty_out(vty, "PIN must be in range 4..8!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	gsm_subscr_sim_pin(ms, (char *)argv[1], "", -1);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(sim_enable_pin, sim_enable_pin_cmd, "sim enable-pin MS_NAME PIN",
+	"SIM actions\nEnable PIN of SIM card\nName of MS (see \"show ms\")\n"
+	"PIN number")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (strlen(argv[1]) < 4 || strlen(argv[1]) > 8) {
+		vty_out(vty, "PIN must be in range 4..8!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	gsm_subscr_sim_pin(ms, (char *)argv[1], "", 1);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(sim_change_pin, sim_change_pin_cmd, "sim change-pin MS_NAME OLD NEW",
+	"SIM actions\nChange PIN of SIM card\nName of MS (see \"show ms\")\n"
+	"Old PIN number\nNew PIN number")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (strlen(argv[1]) < 4 || strlen(argv[1]) > 8) {
+		vty_out(vty, "Old PIN must be in range 4..8!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (strlen(argv[2]) < 4 || strlen(argv[2]) > 8) {
+		vty_out(vty, "New PIN must be in range 4..8!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	gsm_subscr_sim_pin(ms, (char *)argv[1], (char *)argv[2], 2);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(sim_unblock_pin, sim_unblock_pin_cmd, "sim unblock-pin MS_NAME PUC NEW",
+	"SIM actions\nChange PIN of SIM card\nName of MS (see \"show ms\")\n"
+	"Personal Unblock Key\nNew PIN number")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (strlen(argv[1]) != 8) {
+		vty_out(vty, "PUC must be 8 digits!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (strlen(argv[2]) < 4 || strlen(argv[2]) > 8) {
+		vty_out(vty, "PIN must be in range 4..8!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	gsm_subscr_sim_pin(ms, (char *)argv[1], (char *)argv[2], 99);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(sim_lai, sim_lai_cmd, "sim lai MS_NAME MCC MNC LAC",
+	"SIM actions\nChange LAI of SIM card\nName of MS (see \"show ms\")\n"
+	"Mobile Country Code\nMobile Network Code\nLocation Area Code "
+	" (use 0000 to remove LAI)")
+{
+	struct osmocom_ms *ms;
+	uint16_t mcc = gsm_input_mcc((char *)argv[1]),
+		 mnc = gsm_input_mnc((char *)argv[2]),
+		 lac = strtoul(argv[3], NULL, 16);
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (mcc == GSM_INPUT_INVALID) {
+		vty_out(vty, "Given MCC invalid%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (mnc == GSM_INPUT_INVALID) {
+		vty_out(vty, "Given MNC invalid%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	ms->subscr.mcc = mcc;
+	ms->subscr.mnc = mnc;
+	ms->subscr.lac = lac;
+	ms->subscr.tmsi = 0xffffffff;
+
+	gsm_subscr_write_loci(ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(network_select, network_select_cmd,
+	"network select MS_NAME MCC MNC [force]",
+	"Select ...\nSelect Network\nName of MS (see \"show ms\")\n"
+	"Mobile Country Code\nMobile Network Code\n"
+	"Force selecting a network that is not in the list")
+{
+	struct osmocom_ms *ms;
+	struct gsm322_plmn *plmn;
+	struct msgb *nmsg;
+	struct gsm322_msg *ngm;
+	struct gsm322_plmn_list *temp;
+	uint16_t mcc = gsm_input_mcc((char *)argv[1]),
+		 mnc = gsm_input_mnc((char *)argv[2]);
+	int found = 0;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+	plmn = &ms->plmn;
+
+	if (ms->settings.plmn_mode != PLMN_MODE_MANUAL) {
+		vty_out(vty, "Not in manual network selection mode%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (mcc == GSM_INPUT_INVALID) {
+		vty_out(vty, "Given MCC invalid%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (mnc == GSM_INPUT_INVALID) {
+		vty_out(vty, "Given MNC invalid%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (argc < 4) {
+		llist_for_each_entry(temp, &plmn->sorted_plmn, entry)
+			if (temp->mcc == mcc &&  temp->mnc == mnc)
+				found = 1;
+		if (!found) {
+			vty_out(vty, "Network not in list!%s", VTY_NEWLINE);
+			vty_out(vty, "To force selecting this network, use "
+				"'force' keyword%s", VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_CHOOSE_PLMN);
+	if (!nmsg)
+		return CMD_WARNING;
+	ngm = (struct gsm322_msg *) nmsg->data;
+	ngm->mcc = mcc;
+	ngm->mnc = mnc;
+	gsm322_plmn_sendmsg(ms, nmsg);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(call, call_cmd, "call MS_NAME (NUMBER|emergency|answer|hangup|hold)",
+	"Make a call\nName of MS (see \"show ms\")\nPhone number to call "
+	"(Use digits '0123456789*#abc', and '+' to dial international)\n"
+	"Make an emergency call\nAnswer an incomming call\nHangup a call\n"
+	"Hold current active call\n")
+{
+	struct osmocom_ms *ms;
+	struct gsm_settings *set;
+	struct gsm_settings_abbrev *abbrev;
+	char *number;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+	set = &ms->settings;
+
+	if (set->ch_cap == GSM_CAP_SDCCH) {
+		vty_out(vty, "Basic call is not supported for SDCCH only "
+			"mobile%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	number = (char *)argv[1];
+	if (!strcmp(number, "emergency"))
+		mncc_call(ms, number);
+	else if (!strcmp(number, "answer"))
+		mncc_answer(ms);
+	else if (!strcmp(number, "hangup"))
+		mncc_hangup(ms);
+	else if (!strcmp(number, "hold"))
+		mncc_hold(ms);
+	else {
+		llist_for_each_entry(abbrev, &set->abbrev, list) {
+			if (!strcmp(number, abbrev->abbrev)) {
+				number = abbrev->number;
+				vty_out(vty, "Dialing number '%s'%s", number,
+					VTY_NEWLINE);
+				break;
+			}
+		}
+		if (vty_check_number(vty, number))
+			return CMD_WARNING;
+		mncc_call(ms, number);
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(call_retr, call_retr_cmd, "call MS_NAME retrieve [NUMBER]",
+	"Make a call\nName of MS (see \"show ms\")\n"
+	"Retrieve call on hold\nNumber of call to retrieve")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	mncc_retrieve(ms, (argc > 1) ? atoi(argv[1]) : 0);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(call_dtmf, call_dtmf_cmd, "call MS_NAME dtmf DIGITS",
+	"Make a call\nName of MS (see \"show ms\")\n"
+	"One or more DTMF digits to transmit")
+{
+	struct osmocom_ms *ms;
+	struct gsm_settings *set;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+	set = &ms->settings;
+
+	if (!set->cc_dtmf) {
+		vty_out(vty, "DTMF not supported, please enable!%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	mncc_dtmf(ms, (char *)argv[1]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(sms, sms_cmd, "sms MS_NAME NUMBER .LINE",
+	"Send an SMS\nName of MS (see \"show ms\")\nPhone number to send SMS "
+	"(Use digits '0123456789*#abc', and '+' to dial international)\n"
+	"SMS text\n")
+{
+	struct osmocom_ms *ms;
+	struct gsm_settings *set;
+	struct gsm_settings_abbrev *abbrev;
+	char *number, *sms_sca = NULL;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+	set = &ms->settings;
+
+	if (!set->sms_ptp) {
+		vty_out(vty, "SMS not supported by this mobile, please enable "
+			"SMS support%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (ms->subscr.sms_sca[0])
+		sms_sca = ms->subscr.sms_sca;
+	else if (set->sms_sca[0])
+		sms_sca = set->sms_sca;
+
+	if (!sms_sca) {
+		vty_out(vty, "SMS sms-service-center not defined on SIM card, "
+			"please define one at settings.%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	number = (char *)argv[1];
+	llist_for_each_entry(abbrev, &set->abbrev, list) {
+		if (!strcmp(number, abbrev->abbrev)) {
+			number = abbrev->number;
+			vty_out(vty, "Using number '%s'%s", number,
+				VTY_NEWLINE);
+			break;
+		}
+	}
+	if (vty_check_number(vty, number))
+		return CMD_WARNING;
+
+	sms_send(ms, sms_sca, number, argv_concat(argv, argc, 2), 42);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(service, service_cmd, "service MS_NAME (*#06#|*#21#|*#67#|*#61#|*#62#"
+	"|*#002#|*#004#|*xx*number#|*xx#|#xx#|##xx#|STRING|hangup)",
+	"Send a Supplementary Service request\nName of MS (see \"show ms\")\n"
+	"Query IMSI\n"
+	"Query Call Forwarding Unconditional (CFU)\n"
+	"Query Call Forwarding when Busy (CFB)\n"
+	"Query Call Forwarding when No Response (CFNR)\n"
+	"Query Call Forwarding when Not Reachable\n"
+	"Query all Call Forwardings\n"
+	"Query all conditional Call Forwardings\n"
+	"Set and activate Call Forwarding (xx = Service Code, see above)\n"
+	"Activate Call Forwarding (xx = Service Code, see above)\n"
+	"Deactivate Call Forwarding (xx = Service Code, see above)\n"
+	"Erase and deactivate Call Forwarding (xx = Service Code, see above)\n"
+	"Service string "
+	"(Example: '*100#' requests account balace on some networks.)\n"
+	"Hangup existing service connection")
+{
+	struct osmocom_ms *ms;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	ss_send(ms, argv[1], 0);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(test_reselection, test_reselection_cmd, "test re-selection NAME",
+	"Manually trigger cell re-selection\nName of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+	struct gsm_settings *set;
+	struct msgb *nmsg;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+	set = &ms->settings;
+
+	if (set->stick) {
+		vty_out(vty, "Cannot trigger cell re-selection, because we "
+			"stick to a cell!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_CELL_RESEL);
+	if (!nmsg)
+		return CMD_WARNING;
+	gsm322_c_event(ms, nmsg);
+
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(delete_forbidden_plmn, delete_forbidden_plmn_cmd,
+	"delete forbidden plmn NAME MCC MNC",
+	"Delete\nForbidden\nplmn\nName of MS (see \"show ms\")\n"
+	"Mobile Country Code\nMobile Network Code")
+{
+	struct osmocom_ms *ms;
+	uint16_t mcc = gsm_input_mcc((char *)argv[1]),
+		 mnc = gsm_input_mnc((char *)argv[2]);
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	if (mcc == GSM_INPUT_INVALID) {
+		vty_out(vty, "Given MCC invalid%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (mnc == GSM_INPUT_INVALID) {
+		vty_out(vty, "Given MNC invalid%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	gsm_subscr_del_forbidden_plmn(&ms->subscr, mcc, mnc);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(network_show, network_show_cmd, "network show MS_NAME",
+	"Network ...\nShow results of network search (again)\n"
+	"Name of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+	struct gsm_settings *set;
+	struct gsm322_plmn *plmn;
+	struct gsm322_plmn_list *temp;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+	set = &ms->settings;
+	plmn = &ms->plmn;
+
+	if (set->plmn_mode != PLMN_MODE_AUTO
+	 && plmn->state != GSM322_M3_NOT_ON_PLMN) {
+		vty_out(vty, "Start network search first!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	llist_for_each_entry(temp, &plmn->sorted_plmn, entry)
+		vty_out(vty, " Network %s, %s (%s, %s)%s",
+			gsm_print_mcc(temp->mcc), gsm_print_mnc(temp->mnc),
+			gsm_get_mcc(temp->mcc),
+			gsm_get_mnc(temp->mcc, temp->mnc), VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(network_search, network_search_cmd, "network search MS_NAME",
+	"Network ...\nTrigger network search\nName of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+	struct msgb *nmsg;
+
+	ms = get_ms(argv[0], vty);
+	if (!ms)
+		return CMD_WARNING;
+
+	nmsg = gsm322_msgb_alloc(GSM322_EVENT_USER_RESEL);
+	if (!nmsg)
+		return CMD_WARNING;
+	gsm322_plmn_sendmsg(ms, nmsg);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_gps_enable, cfg_gps_enable_cmd, "gps enable",
+	"GPS receiver")
+{
+	if (osmo_gps_open()) {
+		g.enable = 1;
+		vty_out(vty, "Failed to open GPS device!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	g.enable = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_gps_enable, cfg_no_gps_enable_cmd, "no gps enable",
+	NO_STR "Disable GPS receiver")
+{
+	if (g.enable)
+		osmo_gps_close();
+	g.enable = 0;
+
+	return CMD_SUCCESS;
+}
+
+#ifdef _HAVE_GPSD
+DEFUN(cfg_gps_host, cfg_gps_host_cmd, "gps host HOST:PORT",
+	"GPS receiver\nSelect gpsd host and port\n"
+	"IP and port (optional) of the host running gpsd")
+{
+	char* colon = strstr(argv[0], ":");
+	if (colon != NULL) {
+		memcpy(g.gpsd_host, argv[0], colon - argv[0]);
+		g.gpsd_host[colon - argv[0]] = '\0';
+		memcpy(g.gpsd_port, colon+1, strlen(colon+1));
+		g.gpsd_port[strlen(colon+1)] = '\0';
+	} else {
+		snprintf(g.gpsd_host, ARRAY_SIZE(g.gpsd_host), "%s", argv[0]);
+		g.gpsd_host[ARRAY_SIZE(g.gpsd_host) - 1] = '\0';
+		snprintf(g.gpsd_port, ARRAY_SIZE(g.gpsd_port), "2947");
+		g.gpsd_port[ARRAY_SIZE(g.gpsd_port) - 1] = '\0';
+	}
+	g.gps_type = GPS_TYPE_GPSD;
+	if (g.enable) {
+		osmo_gps_close();
+		if (osmo_gps_open()) {
+			vty_out(vty, "Failed to connect to gpsd host!%s",
+				VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	return CMD_SUCCESS;
+}
+#endif
+
+DEFUN(cfg_gps_device, cfg_gps_device_cmd, "gps device DEVICE",
+	"GPS receiver\nSelect serial device\n"
+	"Full path of serial device including /dev/")
+{
+	osmo_strlcpy(g.device, argv[0], sizeof(g.device));
+	g.device[sizeof(g.device) - 1] = '\0';
+	g.gps_type = GPS_TYPE_SERIAL;
+	if (g.enable) {
+		osmo_gps_close();
+		if (osmo_gps_open()) {
+			vty_out(vty, "Failed to open GPS device!%s",
+				VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_gps_baud, cfg_gps_baud_cmd, "gps baudrate "
+	"(default|4800|""9600|19200|38400|57600|115200)",
+	"GPS receiver\nSelect baud rate\nDefault, don't modify\n\n\n\n\n\n")
+{
+	if (argv[0][0] == 'd')
+		g.baud = 0;
+	else
+		g.baud = atoi(argv[0]);
+	if (g.enable) {
+		osmo_gps_close();
+		if (osmo_gps_open()) {
+			g.enable = 0;
+			vty_out(vty, "Failed to open GPS device!%s",
+				VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_hide_default, cfg_hide_default_cmd, "hide-default",
+	"Hide most default values in config to make it more compact")
+{
+	hide_default = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_hide_default, cfg_no_hide_default_cmd, "no hide-default",
+	NO_STR "Show default values in config")
+{
+	hide_default = 0;
+
+	return CMD_SUCCESS;
+}
+
+/* per MS config */
+DEFUN(cfg_ms, cfg_ms_cmd, "ms MS_NAME",
+	"Select a mobile station to configure\nName of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+	int found = 0;
+
+	llist_for_each_entry(ms, &ms_list, entity) {
+		if (!strcmp(ms->name, argv[0])) {
+			found = 1;
+			break;
+		}
+	}
+
+	if (!found) {
+		if (!vty_reading) {
+			vty_out(vty, "MS name '%s' does not exits, try "
+				"'ms %s create'%s", argv[0], argv[0],
+				VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		ms = mobile_new((char *)argv[0]);
+		if (!ms) {
+			vty_out(vty, "Failed to add MS name '%s'%s", argv[0],
+				VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	vty->index = ms;
+	vty->node = MS_NODE;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_create, cfg_ms_create_cmd, "ms MS_NAME create",
+	"Select a mobile station to configure\nName of MS (see \"show ms\")\n"
+	"Create if MS does not exists")
+{
+	struct osmocom_ms *ms;
+	int found = 0;
+
+	llist_for_each_entry(ms, &ms_list, entity) {
+		if (!strcmp(ms->name, argv[0])) {
+			found = 1;
+			break;
+		}
+	}
+
+	if (!found) {
+		ms = mobile_new((char *)argv[0]);
+		if (!ms) {
+			vty_out(vty, "Failed to add MS name '%s'%s", argv[0],
+				VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	vty->index = ms;
+	vty->node = MS_NODE;
+
+	vty_out(vty, "MS '%s' created, after configuration, do 'no shutdown'%s",
+		argv[0], VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_rename, cfg_ms_rename_cmd, "ms MS_NAME rename MS_NAME",
+	"Select a mobile station to configure\nName of MS (see \"show ms\")\n"
+	"Rename MS\nNew name of MS")
+{
+	struct osmocom_ms *ms;
+	int found = 0;
+
+	llist_for_each_entry(ms, &ms_list, entity) {
+		if (!strcmp(ms->name, argv[0])) {
+			found = 1;
+			break;
+		}
+	}
+
+	if (!found) {
+		vty_out(vty, "MS name '%s' does not exist%s", argv[0],
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	osmo_talloc_replace_string(ms, &ms->name, argv[1]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_ms, cfg_no_ms_cmd, "no ms MS_NAME",
+	NO_STR "Select a mobile station to remove\n"
+	"Name of MS (see \"show ms\")")
+{
+	struct osmocom_ms *ms;
+	int found = 0;
+
+	llist_for_each_entry(ms, &ms_list, entity) {
+		if (!strcmp(ms->name, argv[0])) {
+			found = 1;
+			break;
+		}
+	}
+
+	if (!found) {
+		vty_out(vty, "MS name '%s' does not exist%s", argv[0],
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	mobile_delete(ms, 1);
+
+	return CMD_SUCCESS;
+}
+
+#define SUP_WRITE(item, cmd) \
+	if (sup->item) \
+		if (!hide_default || !set->item) \
+			vty_out(vty, "  %s%s%s", (set->item) ? "" : "no ", \
+			cmd, VTY_NEWLINE);
+
+static void config_write_ms(struct vty *vty, struct osmocom_ms *ms)
+{
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_support *sup = &ms->support;
+	struct gsm_settings_abbrev *abbrev;
+
+	vty_out(vty, "ms %s%s", ms->name, VTY_NEWLINE);
+	vty_out(vty, " layer2-socket %s%s", set->layer2_socket_path,
+		VTY_NEWLINE);
+	vty_out(vty, " sap-socket %s%s", set->sap_socket_path, VTY_NEWLINE);
+	switch(set->sim_type) {
+		case GSM_SIM_TYPE_NONE:
+		vty_out(vty, " sim none%s", VTY_NEWLINE);
+		break;
+		case GSM_SIM_TYPE_READER:
+		vty_out(vty, " sim reader%s", VTY_NEWLINE);
+		break;
+		case GSM_SIM_TYPE_TEST:
+		vty_out(vty, " sim test%s", VTY_NEWLINE);
+		break;
+		case GSM_SIM_TYPE_SAP:
+		vty_out(vty, " sim sap%s", VTY_NEWLINE);
+		break;
+	}
+	vty_out(vty, " network-selection-mode %s%s", (set->plmn_mode
+			== PLMN_MODE_AUTO) ? "auto" : "manual", VTY_NEWLINE);
+	vty_out(vty, " imei %s %s%s", set->imei,
+		set->imeisv + strlen(set->imei), VTY_NEWLINE);
+	if (set->imei_random)
+		vty_out(vty, " imei-random %d%s", set->imei_random,
+			VTY_NEWLINE);
+	else
+		if (!hide_default)
+			vty_out(vty, " imei-fixed%s", VTY_NEWLINE);
+	if (set->emergency_imsi[0])
+		vty_out(vty, " emergency-imsi %s%s", set->emergency_imsi,
+			VTY_NEWLINE);
+	else
+		if (!hide_default)
+			vty_out(vty, " no emergency-imsi%s", VTY_NEWLINE);
+	if (set->sms_sca[0])
+		vty_out(vty, " sms-service-center %s%s", set->sms_sca,
+			VTY_NEWLINE);
+	else
+		if (!hide_default)
+			vty_out(vty, " no sms-service-center%s", VTY_NEWLINE);
+	if (!hide_default || set->cw)
+		vty_out(vty, " %scall-waiting%s", (set->cw) ? "" : "no ",
+			VTY_NEWLINE);
+	if (!hide_default || set->auto_answer)
+		vty_out(vty, " %sauto-answer%s",
+			(set->auto_answer) ? "" : "no ", VTY_NEWLINE);
+	if (!hide_default || set->force_rekey)
+		vty_out(vty, " %sforce-rekey%s",
+			(set->force_rekey) ? "" : "no ", VTY_NEWLINE);
+	if (!hide_default || set->clip)
+		vty_out(vty, " %sclip%s", (set->clip) ? "" : "no ",
+			VTY_NEWLINE);
+	if (!hide_default || set->clir)
+		vty_out(vty, " %sclir%s", (set->clir) ? "" : "no ",
+			VTY_NEWLINE);
+	if (set->alter_tx_power)
+		if (set->alter_tx_power_value)
+			vty_out(vty, " tx-power %d%s",
+				set->alter_tx_power_value, VTY_NEWLINE);
+		else
+			vty_out(vty, " tx-power full%s", VTY_NEWLINE);
+	else
+		if (!hide_default)
+			vty_out(vty, " tx-power auto%s", VTY_NEWLINE);
+	if (set->alter_delay)
+		vty_out(vty, " simulated-delay %d%s", set->alter_delay,
+			VTY_NEWLINE);
+	else
+		if (!hide_default)
+			vty_out(vty, " no simulated-delay%s", VTY_NEWLINE);
+	if (set->stick)
+		vty_out(vty, " stick %d%s%s", set->stick_arfcn & 1023,
+			(set->stick_arfcn & ARFCN_PCS) ? " pcs" : "",
+			VTY_NEWLINE);
+	else
+		if (!hide_default)
+			vty_out(vty, " no stick%s", VTY_NEWLINE);
+	if (!hide_default || set->no_lupd)
+		vty_out(vty, " %slocation-updating%s",
+			(set->no_lupd) ? "no " : "", VTY_NEWLINE);
+	if (!hide_default || set->no_neighbour)
+		vty_out(vty, " %sneighbour-measurement%s",
+			(set->no_neighbour) ? "no " : "", VTY_NEWLINE);
+	if (set->full_v1 || set->full_v2 || set->full_v3) {
+		/* mandatory anyway */
+		vty_out(vty, " codec full-speed%s%s",
+			(!set->half_prefer) ? " prefer" : "",
+			VTY_NEWLINE);
+	}
+	if (set->half_v1 || set->half_v3) {
+		if (set->half)
+			vty_out(vty, " codec half-speed%s%s",
+				(set->half_prefer) ? " prefer" : "",
+				VTY_NEWLINE);
+		else
+			vty_out(vty, " no codec half-speed%s", VTY_NEWLINE);
+	}
+	if (llist_empty(&set->abbrev)) {
+		if (!hide_default)
+			vty_out(vty, " no abbrev%s", VTY_NEWLINE);
+	} else {
+		llist_for_each_entry(abbrev, &set->abbrev, list)
+			vty_out(vty, " abbrev %s %s%s%s%s", abbrev->abbrev,
+				abbrev->number, (abbrev->name[0]) ? " " : "",
+				abbrev->name, VTY_NEWLINE);
+	}
+	vty_out(vty, " support%s", VTY_NEWLINE);
+	SUP_WRITE(sms_ptp, "sms");
+	SUP_WRITE(a5_1, "a5/1");
+	SUP_WRITE(a5_2, "a5/2");
+	SUP_WRITE(a5_3, "a5/3");
+	SUP_WRITE(a5_4, "a5/4");
+	SUP_WRITE(a5_5, "a5/5");
+	SUP_WRITE(a5_6, "a5/6");
+	SUP_WRITE(a5_7, "a5/7");
+	SUP_WRITE(p_gsm, "p-gsm");
+	SUP_WRITE(e_gsm, "e-gsm");
+	SUP_WRITE(r_gsm, "r-gsm");
+	SUP_WRITE(pcs, "gsm-850");
+	SUP_WRITE(gsm_480, "gsm-480");
+	SUP_WRITE(gsm_450, "gsm-450");
+	SUP_WRITE(dcs, "dcs");
+	SUP_WRITE(pcs, "pcs");
+	if (sup->r_gsm || sup->e_gsm || sup->p_gsm)
+		if (!hide_default || sup->class_900 != set->class_900)
+			vty_out(vty, "  class-900 %d%s", set->class_900,
+				VTY_NEWLINE);
+	if (sup->gsm_850)
+		if (!hide_default || sup->class_850 != set->class_850)
+			vty_out(vty, "  class-850 %d%s", set->class_850,
+				VTY_NEWLINE);
+	if (sup->gsm_480 || sup->gsm_450)
+		if (!hide_default || sup->class_400 != set->class_400)
+			vty_out(vty, "  class-400 %d%s", set->class_400,
+				VTY_NEWLINE);
+	if (sup->dcs)
+		if (!hide_default || sup->class_dcs != set->class_dcs)
+			vty_out(vty, "  class-dcs %d%s", set->class_dcs,
+				VTY_NEWLINE);
+	if (sup->pcs)
+		if (!hide_default || sup->class_pcs != set->class_pcs)
+			vty_out(vty, "  class-pcs %d%s", set->class_pcs,
+				VTY_NEWLINE);
+	if (!hide_default || sup->ch_cap != set->ch_cap) {
+		switch (set->ch_cap) {
+		case GSM_CAP_SDCCH:
+			vty_out(vty, "  channel-capability sdcch%s",
+				VTY_NEWLINE);
+			break;
+		case GSM_CAP_SDCCH_TCHF:
+			vty_out(vty, "  channel-capability sdcch+tchf%s",
+				VTY_NEWLINE);
+			break;
+		case GSM_CAP_SDCCH_TCHF_TCHH:
+			vty_out(vty, "  channel-capability sdcch+tchf+tchh%s",
+				VTY_NEWLINE);
+			break;
+		}
+	}
+	SUP_WRITE(full_v1, "full-speech-v1");
+	SUP_WRITE(full_v2, "full-speech-v2");
+	SUP_WRITE(full_v3, "full-speech-v3");
+	SUP_WRITE(half_v1, "half-speech-v1");
+	SUP_WRITE(half_v3, "half-speech-v3");
+	if (!hide_default || sup->min_rxlev_dbm != set->min_rxlev_dbm)
+		vty_out(vty, "  min-rxlev %d%s", set->min_rxlev_dbm,
+			VTY_NEWLINE);
+	if (!hide_default || sup->dsc_max != set->dsc_max)
+		vty_out(vty, "  dsc-max %d%s", set->dsc_max, VTY_NEWLINE);
+	if (!hide_default || set->skip_max_per_band)
+		vty_out(vty, "  %sskip-max-per-band%s",
+			(set->skip_max_per_band) ? "" : "no ", VTY_NEWLINE);
+	vty_out(vty, " test-sim%s", VTY_NEWLINE);
+	vty_out(vty, "  imsi %s%s", set->test_imsi, VTY_NEWLINE);
+	switch (set->test_ki_type) {
+	case OSMO_AUTH_ALG_XOR:
+		vty_out(vty, "  ki xor %s%s",
+			osmo_hexdump(set->test_ki, 12), VTY_NEWLINE);
+		break;
+	case OSMO_AUTH_ALG_COMP128v1:
+		vty_out(vty, "  ki comp128 %s%s",
+			osmo_hexdump(set->test_ki, 16), VTY_NEWLINE);
+		break;
+	}
+	if (!hide_default || set->test_barr)
+		vty_out(vty, "  %sbarred-access%s",
+			(set->test_barr) ? "" : "no ", VTY_NEWLINE);
+	if (set->test_rplmn_valid) {
+		vty_out(vty, "  rplmn %s %s",
+			gsm_print_mcc(set->test_rplmn_mcc),
+			gsm_print_mnc(set->test_rplmn_mnc));
+		if (set->test_lac > 0x0000 && set->test_lac < 0xfffe) {
+			vty_out(vty, " 0x%04x", set->test_lac);
+			if (set->test_tmsi != 0xffffffff) {
+				vty_out(vty, " 0x%08x", set->test_tmsi);
+				if (set->test_imsi_attached)
+					vty_out(vty, " attached");
+			}
+		}
+		vty_out(vty, "%s", VTY_NEWLINE);
+	} else
+		if (!hide_default)
+			vty_out(vty, "  no rplmn%s", VTY_NEWLINE);
+	if (!hide_default || set->test_always)
+		vty_out(vty, "  hplmn-search %s%s",
+			(set->test_always) ? "everywhere" : "foreign-country",
+			VTY_NEWLINE);
+	if (!hide_default || set->any_timeout != MOB_C7_DEFLT_ANY_TIMEOUT)
+		vty_out(vty, " c7-any-timeout %d%s",
+			set->any_timeout, VTY_NEWLINE);
+
+	/* no shutdown must be written to config, because shutdown is default */
+	vty_out(vty, " %sshutdown%s", (ms->shutdown != MS_SHUTDOWN_NONE) ? "" : "no ",
+		VTY_NEWLINE);
+	if (ms->lua_script)
+		vty_out(vty, " lua-script %s%s", ms->lua_script, VTY_NEWLINE);
+	vty_out(vty, "!%s", VTY_NEWLINE);
+}
+
+static int config_write(struct vty *vty)
+{
+	struct osmocom_ms *ms;
+
+#ifdef _HAVE_GPSD
+	vty_out(vty, "gps host %s:%s%s", g.gpsd_host, g.gpsd_port, VTY_NEWLINE);
+#endif
+	vty_out(vty, "gps device %s%s", g.device, VTY_NEWLINE);
+	if (g.baud)
+		vty_out(vty, "gps baudrate %d%s", g.baud, VTY_NEWLINE);
+	else
+		vty_out(vty, "gps baudrate default%s", VTY_NEWLINE);
+	vty_out(vty, "%sgps enable%s", (g.enable) ? "" : "no ", VTY_NEWLINE);
+	vty_out(vty, "!%s", VTY_NEWLINE);
+
+	vty_out(vty, "%shide-default%s", (hide_default) ? "": "no ",
+		VTY_NEWLINE);
+	vty_out(vty, "!%s", VTY_NEWLINE);
+
+	llist_for_each_entry(ms, &ms_list, entity)
+		config_write_ms(vty, ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_show_this, cfg_ms_show_this_cmd, "show this",
+	SHOW_STR "Show config of this MS")
+{
+	struct osmocom_ms *ms = vty->index;
+
+	config_write_ms(vty, ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_layer2, cfg_ms_layer2_cmd, "layer2-socket PATH",
+	"Define socket path to connect between layer 2 and layer 1\n"
+	"Unix socket, default '/tmp/osmocom_l2'")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	OSMO_STRLCPY_ARRAY(set->layer2_socket_path, argv[0]);
+
+	vty_restart(vty, ms);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sap, cfg_ms_sap_cmd, "sap-socket PATH",
+	"Define socket path to connect to SIM reader\n"
+	"Unix socket, default '/tmp/osmocom_sap'")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	OSMO_STRLCPY_ARRAY(set->sap_socket_path, argv[0]);
+
+	vty_restart(vty, ms);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sim, cfg_ms_sim_cmd, "sim (none|reader|test|sap)",
+	"Set SIM card to attach when powering on\nAttach no SIM\n"
+	"Attach SIM from reader\nAttach bulit in test SIM\n"
+	"Attach SIM over SAP interface")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	switch (argv[0][0]) {
+	case 'n':
+		set->sim_type = GSM_SIM_TYPE_NONE;
+		break;
+	case 'r':
+		set->sim_type = GSM_SIM_TYPE_READER;
+		break;
+	case 't':
+		set->sim_type = GSM_SIM_TYPE_TEST;
+		break;
+	case 's':
+		set->sim_type = GSM_SIM_TYPE_SAP;
+		break;
+	default:
+		vty_out(vty, "unknown SIM type%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	vty_restart_if_started(vty, ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_mode, cfg_ms_mode_cmd, "network-selection-mode (auto|manual)",
+	"Set network selection mode\nAutomatic network selection\n"
+	"Manual network selection")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	struct msgb *nmsg;
+
+	if (!ms->started) {
+		if (argv[0][0] == 'a')
+			set->plmn_mode = PLMN_MODE_AUTO;
+		else
+			set->plmn_mode = PLMN_MODE_MANUAL;
+	} else {
+		if (argv[0][0] == 'a')
+			nmsg = gsm322_msgb_alloc(GSM322_EVENT_SEL_AUTO);
+		else
+			nmsg = gsm322_msgb_alloc(GSM322_EVENT_SEL_MANUAL);
+		if (!nmsg)
+			return CMD_WARNING;
+		gsm322_plmn_sendmsg(ms, nmsg);
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_imei, cfg_ms_imei_cmd, "imei IMEI [SV]",
+	"Set IMEI (enter without control digit)\n15 Digits IMEI\n"
+	"Software version digit")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	char *error, *sv = "0";
+
+	if (argc >= 2)
+		sv = (char *)argv[1];
+
+	error = gsm_check_imei(argv[0], sv);
+	if (error) {
+		vty_out(vty, "%s%s", error, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	strcpy(set->imei, argv[0]);
+	strcpy(set->imeisv, argv[0]);
+	strcpy(set->imeisv + 15, sv);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_imei_fixed, cfg_ms_imei_fixed_cmd, "imei-fixed",
+	"Use fixed IMEI on every power on")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->imei_random = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_imei_random, cfg_ms_imei_random_cmd, "imei-random <0-15>",
+	"Use random IMEI on every power on\n"
+	"Number of trailing digits to randomize")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->imei_random = atoi(argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_emerg_imsi, cfg_ms_emerg_imsi_cmd, "emergency-imsi IMSI",
+	"Use special IMSI for emergency calls\n15 digits IMSI")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	char *error;
+
+	error = gsm_check_imsi(argv[0]);
+	if (error) {
+		vty_out(vty, "%s%s", error, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	strcpy(set->emergency_imsi, argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_no_emerg_imsi, cfg_ms_no_emerg_imsi_cmd, "no emergency-imsi",
+	NO_STR "Use IMSI of SIM or IMEI for emergency calls")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->emergency_imsi[0] = '\0';
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sms_sca, cfg_ms_sms_sca_cmd, "sms-service-center NUMBER",
+	"Use Service center address for outgoing SMS\nNumber of service center "
+	"(Use digits '0123456789*#abc', and '+' to dial international)")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	const char *number = argv[0];
+
+	if ((strlen(number) > 20 && number[0] != '+') || strlen(number) > 21) {
+		vty_out(vty, "Number too long%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (vty_check_number(vty, number))
+		return CMD_WARNING;
+
+	strcpy(set->sms_sca, number);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_no_sms_sca, cfg_ms_no_sms_sca_cmd, "no sms-service-center",
+	NO_STR "Use Service center address for outgoing SMS")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->sms_sca[0] = '\0';
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_no_sms_store, cfg_ms_no_sms_store_cmd, "no sms-store",
+	NO_STR "Store SMS in the home directory")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->store_sms = false;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sms_store, cfg_ms_sms_store_cmd, "sms-store",
+	"Store SMS in the home directory")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->store_sms = true;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_cw, cfg_ms_no_cw_cmd, "no call-waiting",
+	NO_STR "Disallow waiting calls")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->cw = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_cw, cfg_ms_cw_cmd, "call-waiting",
+	"Allow waiting calls")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->cw = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_auto_answer, cfg_ms_no_auto_answer_cmd, "no auto-answer",
+	NO_STR "Disable auto-answering calls")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->auto_answer = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_auto_answer, cfg_ms_auto_answer_cmd, "auto-answer",
+	"Enable auto-answering calls")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->auto_answer = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_force_rekey, cfg_ms_no_force_rekey_cmd, "no force-rekey",
+	NO_STR "Disable key renew forcing after every event")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->force_rekey = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_force_rekey, cfg_ms_force_rekey_cmd, "force-rekey",
+	"Enable key renew forcing after every event")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->force_rekey = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_clip, cfg_ms_clip_cmd, "clip",
+	"Force caller ID presentation")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->clip = 1;
+	set->clir = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_clir, cfg_ms_clir_cmd, "clir",
+	"Force caller ID restriction")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->clip = 0;
+	set->clir = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_clip, cfg_ms_no_clip_cmd, "no clip",
+	NO_STR "Disable forcing of caller ID presentation")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->clip = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_clir, cfg_ms_no_clir_cmd, "no clir",
+	NO_STR "Disable forcing of caller ID restriction")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->clir = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_tx_power, cfg_ms_tx_power_cmd, "tx-power (auto|full)",
+	"Set the way to choose transmit power\nControlled by BTS\n"
+	"Always full power\nFixed GSM power value if supported")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	switch (argv[0][0]) {
+	case 'a':
+		set->alter_tx_power = 0;
+		break;
+	case 'f':
+		set->alter_tx_power = 1;
+		set->alter_tx_power_value = 0;
+		break;
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_tx_power_val, cfg_ms_tx_power_val_cmd, "tx-power <0-31>",
+	"Set the way to choose transmit power\n"
+	"Fixed GSM power value if supported")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->alter_tx_power = 1;
+	set->alter_tx_power_value = atoi(argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sim_delay, cfg_ms_sim_delay_cmd, "simulated-delay <-128-127>",
+	"Simulate a lower or higher distance from the BTS\n"
+	"Delay in half bits (distance in 553.85 meter steps)")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->alter_delay = atoi(argv[0]);
+	gsm48_rr_alter_delay(ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_no_sim_delay, cfg_ms_no_sim_delay_cmd, "no simulated-delay",
+	NO_STR "Do not simulate a lower or higher distance from the BTS")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->alter_delay = 0;
+	gsm48_rr_alter_delay(ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_stick, cfg_ms_stick_cmd, "stick <0-1023> [pcs]",
+	"Stick to the given cell\nARFCN of the cell to stick to\n"
+	"Given frequency is PCS band (1900) rather than DCS band.")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	uint16_t arfcn = atoi(argv[0]);
+
+	if (argc > 1) {
+		if (arfcn < 512 || arfcn > 810) {
+			vty_out(vty, "Given ARFCN not in PCS band%s",
+				VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		arfcn |= ARFCN_PCS;
+	}
+	set->stick = 1;
+	set->stick_arfcn = arfcn;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_no_stick, cfg_ms_no_stick_cmd, "no stick",
+	NO_STR "Do not stick to any cell")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->stick = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_lupd, cfg_ms_lupd_cmd, "location-updating",
+	"Allow location updating")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->no_lupd = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_no_lupd, cfg_ms_no_lupd_cmd, "no location-updating",
+	NO_STR "Do not allow location updating")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->no_lupd = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_codec_full, cfg_ms_codec_full_cmd, "codec full-speed",
+	"Enable codec\nFull speed speech codec")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	if (!set->full_v1 && !set->full_v2 && !set->full_v3) {
+		vty_out(vty, "Full-rate codec not supported%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_codec_full_pref, cfg_ms_codec_full_pref_cmd, "codec full-speed "
+	"prefer",
+	"Enable codec\nFull speed speech codec\nPrefer this codec")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	if (!set->full_v1 && !set->full_v2 && !set->full_v3) {
+		vty_out(vty, "Full-rate codec not supported%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	set->half_prefer = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_codec_half, cfg_ms_codec_half_cmd, "codec half-speed",
+	"Enable codec\nHalf speed speech codec")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	if (!set->half_v1 && !set->half_v3) {
+		vty_out(vty, "Half-rate codec not supported%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	set->half = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_codec_half_pref, cfg_ms_codec_half_pref_cmd, "codec half-speed "
+	"prefer",
+	"Enable codec\nHalf speed speech codec\nPrefer this codec")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	if (!set->half_v1 && !set->half_v3) {
+		vty_out(vty, "Half-rate codec not supported%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	set->half = 1;
+	set->half_prefer = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_codec_half, cfg_ms_no_codec_half_cmd, "no codec half-speed",
+	NO_STR "Disable codec\nHalf speed speech codec")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	if (!set->half_v1 && !set->half_v3) {
+		vty_out(vty, "Half-rate codec not supported%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	set->half = 0;
+	set->half_prefer = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_abbrev, cfg_ms_abbrev_cmd, "abbrev ABBREVIATION NUMBER [NAME]",
+	"Store given abbreviation number\n1-3 digits abbreviation\n"
+	"Number to store for the abbreviation "
+	"(Use digits '0123456789*#abc', and '+' to dial international)\n"
+	"Name of the abbreviation")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_settings_abbrev *abbrev;
+	int i;
+
+	llist_for_each_entry(abbrev, &set->abbrev, list) {
+		if (!strcmp(argv[0], abbrev->abbrev)) {
+			vty_out(vty, "Given abbreviation '%s' already stored, "
+				"delete first!%s", argv[0], VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	if (strlen(argv[0]) >= sizeof(abbrev->abbrev)) {
+		vty_out(vty, "Given abbreviation too long%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	for (i = 0; i < strlen(argv[0]); i++) {
+		if (argv[0][i] < '0' || argv[0][i] > '9') {
+			vty_out(vty, "Given abbreviation must have digits "
+				"0..9 only!%s", VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	if (vty_check_number(vty, argv[1]))
+		return CMD_WARNING;
+
+	abbrev = talloc_zero(ms, struct gsm_settings_abbrev);
+	if (!abbrev) {
+		vty_out(vty, "No Memory!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	llist_add_tail(&abbrev->list, &set->abbrev);
+	OSMO_STRLCPY_ARRAY(abbrev->abbrev, argv[0]);
+	OSMO_STRLCPY_ARRAY(abbrev->number, argv[1]);
+	if (argc >= 3)
+		OSMO_STRLCPY_ARRAY(abbrev->name, argv[2]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_abbrev, cfg_ms_no_abbrev_cmd, "no abbrev [ABBREVIATION]",
+	NO_STR "Remove given abbreviation number or all numbers\n"
+	"Abbreviation number to remove")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_settings_abbrev *abbrev, *abbrev2;
+	uint8_t deleted = 0;
+
+	llist_for_each_entry_safe(abbrev, abbrev2, &set->abbrev, list) {
+		if (argc < 1 || !strcmp(argv[0], abbrev->abbrev)) {
+			llist_del(&abbrev->list);
+			deleted = 1;
+		}
+	}
+
+	if (argc >= 1 && !deleted) {
+		vty_out(vty, "Given abbreviation '%s' not found!%s",
+			argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_neighbour, cfg_ms_neighbour_cmd, "neighbour-measurement",
+	"Allow neighbour cell measurement in idle mode")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->no_neighbour = 0;
+
+	vty_restart_if_started(vty, ms);
+
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_no_neighbour, cfg_ms_no_neighbour_cmd, "no neighbour-measurement",
+	NO_STR "Do not allow neighbour cell measurement in idle mode")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->no_neighbour = 1;
+
+	vty_restart_if_started(vty, ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_any_timeout, cfg_ms_any_timeout_cmd, "c7-any-timeout <0-255>",
+	"Seconds to wait in C7 before doing a PLMN search")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->any_timeout = atoi(argv[0]);
+
+	vty_restart_if_started(vty, ms);
+
+	return CMD_SUCCESS;
+}
+
+static int config_write_dummy(struct vty *vty)
+{
+	return CMD_SUCCESS;
+}
+
+/* per support config */
+DEFUN(cfg_ms_support, cfg_ms_support_cmd, "support",
+	"Define supported features")
+{
+	vty->node = SUPPORT_NODE;
+
+	return CMD_SUCCESS;
+}
+
+#define SUP_EN(cfg, cfg_cmd, item, cmd, desc, restart) \
+DEFUN(cfg, cfg_cmd, cmd, "Enable " desc "support") \
+{ \
+	struct osmocom_ms *ms = vty->index; \
+	struct gsm_settings *set = &ms->settings; \
+	struct gsm_support *sup = &ms->support; \
+	if (!sup->item) { \
+		vty_out(vty, desc " not supported%s", VTY_NEWLINE); \
+		if (vty_reading) \
+			return CMD_SUCCESS; \
+		return CMD_WARNING; \
+	} \
+	if (restart) \
+		vty_restart(vty, ms); \
+	set->item = 1; \
+	return CMD_SUCCESS; \
+}
+
+#define SUP_DI(cfg, cfg_cmd, item, cmd, desc, restart) \
+DEFUN(cfg, cfg_cmd, "no " cmd, NO_STR "Disable " desc " support") \
+{ \
+	struct osmocom_ms *ms = vty->index; \
+	struct gsm_settings *set = &ms->settings; \
+	struct gsm_support *sup = &ms->support; \
+	if (!sup->item) { \
+		vty_out(vty, desc " not supported%s", VTY_NEWLINE); \
+		if (vty_reading) \
+			return CMD_SUCCESS; \
+		return CMD_WARNING; \
+	} \
+	if (restart) \
+		vty_restart(vty, ms); \
+	set->item = 0; \
+	return CMD_SUCCESS; \
+}
+
+#define SET_EN(cfg, cfg_cmd, item, cmd, desc, restart) \
+DEFUN(cfg, cfg_cmd, cmd, "Enable " desc "support") \
+{ \
+	struct osmocom_ms *ms = vty->index; \
+	struct gsm_settings *set = &ms->settings; \
+	if (restart) \
+		vty_restart(vty, ms); \
+	set->item = 1; \
+	return CMD_SUCCESS; \
+}
+
+#define SET_DI(cfg, cfg_cmd, item, cmd, desc, restart) \
+DEFUN(cfg, cfg_cmd, "no " cmd, NO_STR "Disable " desc " support") \
+{ \
+	struct osmocom_ms *ms = vty->index; \
+	struct gsm_settings *set = &ms->settings; \
+	if (restart) \
+		vty_restart(vty, ms); \
+	set->item = 0; \
+	return CMD_SUCCESS; \
+}
+
+SET_EN(cfg_ms_sup_dtmf, cfg_ms_sup_dtmf_cmd, cc_dtmf, "dtmf", "DTMF", 0);
+SET_DI(cfg_ms_sup_no_dtmf, cfg_ms_sup_no_dtmf_cmd, cc_dtmf, "dtmf", "DTMF", 0);
+SUP_EN(cfg_ms_sup_sms, cfg_ms_sup_sms_cmd, sms_ptp, "sms", "SMS", 0);
+SUP_DI(cfg_ms_sup_no_sms, cfg_ms_sup_no_sms_cmd, sms_ptp, "sms", "SMS", 0);
+SUP_EN(cfg_ms_sup_a5_1, cfg_ms_sup_a5_1_cmd, a5_1, "a5/1", "A5/1", 0);
+SUP_DI(cfg_ms_sup_no_a5_1, cfg_ms_sup_no_a5_1_cmd, a5_1, "a5/1", "A5/1", 0);
+SUP_EN(cfg_ms_sup_a5_2, cfg_ms_sup_a5_2_cmd, a5_2, "a5/2", "A5/2", 0);
+SUP_DI(cfg_ms_sup_no_a5_2, cfg_ms_sup_no_a5_2_cmd, a5_2, "a5/2", "A5/2", 0);
+SUP_EN(cfg_ms_sup_a5_3, cfg_ms_sup_a5_3_cmd, a5_3, "a5/3", "A5/3", 0);
+SUP_DI(cfg_ms_sup_no_a5_3, cfg_ms_sup_no_a5_3_cmd, a5_3, "a5/3", "A5/3", 0);
+SUP_EN(cfg_ms_sup_a5_4, cfg_ms_sup_a5_4_cmd, a5_4, "a5/4", "A5/4", 0);
+SUP_DI(cfg_ms_sup_no_a5_4, cfg_ms_sup_no_a5_4_cmd, a5_4, "a5/4", "A5/4", 0);
+SUP_EN(cfg_ms_sup_a5_5, cfg_ms_sup_a5_5_cmd, a5_5, "a5/5", "A5/5", 0);
+SUP_DI(cfg_ms_sup_no_a5_5, cfg_ms_sup_no_a5_5_cmd, a5_5, "a5/5", "A5/5", 0);
+SUP_EN(cfg_ms_sup_a5_6, cfg_ms_sup_a5_6_cmd, a5_6, "a5/6", "A5/6", 0);
+SUP_DI(cfg_ms_sup_no_a5_6, cfg_ms_sup_no_a5_6_cmd, a5_6, "a5/6", "A5/6", 0);
+SUP_EN(cfg_ms_sup_a5_7, cfg_ms_sup_a5_7_cmd, a5_7, "a5/7", "A5/7", 0);
+SUP_DI(cfg_ms_sup_no_a5_7, cfg_ms_sup_no_a5_7_cmd, a5_7, "a5/7", "A5/7", 0);
+SUP_EN(cfg_ms_sup_p_gsm, cfg_ms_sup_p_gsm_cmd, p_gsm, "p-gsm", "P-GSM (900)",
+	1);
+SUP_DI(cfg_ms_sup_no_p_gsm, cfg_ms_sup_no_p_gsm_cmd, p_gsm, "p-gsm",
+	"P-GSM (900)", 1);
+SUP_EN(cfg_ms_sup_e_gsm, cfg_ms_sup_e_gsm_cmd, e_gsm, "e-gsm", "E-GSM (850)",
+	1);
+SUP_DI(cfg_ms_sup_no_e_gsm, cfg_ms_sup_no_e_gsm_cmd, e_gsm, "e-gsm",
+	"E-GSM (850)", 1);
+SUP_EN(cfg_ms_sup_r_gsm, cfg_ms_sup_r_gsm_cmd, r_gsm, "r-gsm", "R-GSM (850)",
+	1);
+SUP_DI(cfg_ms_sup_no_r_gsm, cfg_ms_sup_no_r_gsm_cmd, r_gsm, "r-gsm",
+	"R-GSM (850)", 1);
+SUP_EN(cfg_ms_sup_dcs, cfg_ms_sup_dcs_cmd, dcs, "dcs", "DCS (1800)", 1);
+SUP_DI(cfg_ms_sup_no_dcs, cfg_ms_sup_no_dcs_cmd, dcs, "dcs", "DCS (1800)", 1);
+SUP_EN(cfg_ms_sup_gsm_850, cfg_ms_sup_gsm_850_cmd, gsm_850, "gsm-850",
+	"GSM 850", 1);
+SUP_DI(cfg_ms_sup_no_gsm_850, cfg_ms_sup_no_gsm_850_cmd, gsm_850, "gsm-850",
+	"GSM 850", 1);
+SUP_EN(cfg_ms_sup_pcs, cfg_ms_sup_pcs_cmd, pcs, "pcs", "PCS (1900)", 1);
+SUP_DI(cfg_ms_sup_no_pcs, cfg_ms_sup_no_pcs_cmd, pcs, "pcs", "PCS (1900)", 1);
+SUP_EN(cfg_ms_sup_gsm_480, cfg_ms_sup_gsm_480_cmd, gsm_480, "gsm-480",
+	"GSM 480", 1);
+SUP_DI(cfg_ms_sup_no_gsm_480, cfg_ms_sup_no_gsm_480_cmd, gsm_480, "gsm-480",
+	"GSM 480", 1);
+SUP_EN(cfg_ms_sup_gsm_450, cfg_ms_sup_gsm_450_cmd, gsm_450, "gsm-450",
+	"GSM 450", 1);
+SUP_DI(cfg_ms_sup_no_gsm_450, cfg_ms_sup_no_gsm_450_cmd, gsm_450, "gsm-450",
+	"GSM 450", 1);
+
+DEFUN(cfg_ms_sup_class_900, cfg_ms_sup_class_900_cmd, "class-900 (1|2|3|4|5)",
+	"Select power class for GSM 900\n"
+	"20 Watts\n"
+	"8 Watts\n"
+	"5 Watts\n"
+	"2 Watts\n"
+	"0.8 Watts")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_support *sup = &ms->support;
+
+	set->class_900 = atoi(argv[0]);
+
+	if (set->class_900 < sup->class_900 && !vty_reading)
+		vty_out(vty, "Note: You selected a higher class than supported "
+			" by hardware!%s", VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sup_class_850, cfg_ms_sup_class_850_cmd, "class-850 (1|2|3|4|5)",
+	"Select power class for GSM 850\n"
+	"20 Watts\n"
+	"8 Watts\n"
+	"5 Watts\n"
+	"2 Watts\n"
+	"0.8 Watts")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_support *sup = &ms->support;
+
+	set->class_850 = atoi(argv[0]);
+
+	if (set->class_850 < sup->class_850 && !vty_reading)
+		vty_out(vty, "Note: You selected a higher class than supported "
+			" by hardware!%s", VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sup_class_400, cfg_ms_sup_class_400_cmd, "class-400 (1|2|3|4|5)",
+	"Select power class for GSM 400 (480 and 450)\n"
+	"20 Watts\n"
+	"8 Watts\n"
+	"5 Watts\n"
+	"2 Watts\n"
+	"0.8 Watts")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_support *sup = &ms->support;
+
+	set->class_400 = atoi(argv[0]);
+
+	if (set->class_400 < sup->class_400 && !vty_reading)
+		vty_out(vty, "Note: You selected a higher class than supported "
+			" by hardware!%s", VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sup_class_dcs, cfg_ms_sup_class_dcs_cmd, "class-dcs (1|2|3)",
+	"Select power class for DCS 1800\n"
+	"1 Watt\n"
+	"0.25 Watts\n"
+	"4 Watts")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_support *sup = &ms->support;
+
+	set->class_dcs = atoi(argv[0]);
+
+	if (((set->class_dcs + 1) & 3) < ((sup->class_dcs + 1) & 3)
+	 && !vty_reading)
+		vty_out(vty, "Note: You selected a higher class than supported "
+			" by hardware!%s", VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sup_class_pcs, cfg_ms_sup_class_pcs_cmd, "class-pcs (1|2|3)",
+	"Select power class for PCS 1900\n"
+	"1 Watt\n"
+	"0.25 Watts\n"
+	"2 Watts")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_support *sup = &ms->support;
+
+	set->class_pcs = atoi(argv[0]);
+
+	if (((set->class_pcs + 1) & 3) < ((sup->class_pcs + 1) & 3)
+	 && !vty_reading)
+		vty_out(vty, "Note: You selected a higher class than supported "
+			" by hardware!%s", VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sup_ch_cap, cfg_ms_sup_ch_cap_cmd,
+	"channel-capability (sdcch|sdcch+tchf|sdcch+tchf+tchh)",
+	"Select channel capability\n"
+	"SDCCH only\n"
+	"SDCCH + TCH/F\n"
+	"SDCCH + TCH/F + TCH/H")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	struct gsm_support *sup = &ms->support;
+	uint8_t ch_cap;
+
+	if (!strcmp(argv[0], "sdcch+tchf+tchh"))
+		ch_cap = GSM_CAP_SDCCH_TCHF_TCHH;
+	else if (!strcmp(argv[0], "sdcch+tchf"))
+		ch_cap = GSM_CAP_SDCCH_TCHF;
+	else
+		ch_cap = GSM_CAP_SDCCH;
+
+	if (ch_cap > sup->ch_cap && !vty_reading) {
+		vty_out(vty, "You selected an higher capability than supported "
+			" by hardware!%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (ms->started && ch_cap != set->ch_cap
+	 && (ch_cap == GSM_CAP_SDCCH || set->ch_cap == GSM_CAP_SDCCH))
+		vty_restart_if_started(vty, ms);
+
+	set->ch_cap = ch_cap;
+
+	return CMD_SUCCESS;
+}
+
+SUP_EN(cfg_ms_sup_full_v1, cfg_ms_sup_full_v1_cmd, full_v1, "full-speech-v1",
+	"Full rate speech V1", 0);
+SUP_DI(cfg_ms_sup_no_full_v1, cfg_ms_sup_no_full_v1_cmd, full_v1,
+	"full-speech-v1", "Full rate speech V1", 0);
+SUP_EN(cfg_ms_sup_full_v2, cfg_ms_sup_full_v2_cmd, full_v2, "full-speech-v2",
+	"Full rate speech V2 (EFR)", 0);
+SUP_DI(cfg_ms_sup_no_full_v2, cfg_ms_sup_no_full_v2_cmd, full_v2,
+	"full-speech-v2", "Full rate speech V2 (EFR)", 0);
+SUP_EN(cfg_ms_sup_full_v3, cfg_ms_sup_full_v3_cmd, full_v3, "full-speech-v3",
+	"Full rate speech V3 (AMR)", 0);
+SUP_DI(cfg_ms_sup_no_full_v3, cfg_ms_sup_no_full_v3_cmd, full_v3,
+	"full-speech-v3", "Full rate speech V3 (AMR)", 0);
+SUP_EN(cfg_ms_sup_half_v1, cfg_ms_sup_half_v1_cmd, half_v1, "half-speech-v1",
+	"Half rate speech V1", 0);
+SUP_DI(cfg_ms_sup_no_half_v1, cfg_ms_sup_no_half_v1_cmd, half_v1,
+	"half-speech-v1", "Half rate speech V1", 0);
+SUP_EN(cfg_ms_sup_half_v3, cfg_ms_sup_half_v3_cmd, half_v3, "half-speech-v3",
+	"Half rate speech V3 (AMR)", 0);
+SUP_DI(cfg_ms_sup_no_half_v3, cfg_ms_sup_no_half_v3_cmd, half_v3,
+	"half-speech-v3", "Half rate speech V3 (AMR)", 0);
+
+DEFUN(cfg_ms_sup_min_rxlev, cfg_ms_sup_min_rxlev_cmd, "min-rxlev <-110--47>",
+	"Set the minimum receive level to select a cell\n"
+	"Minimum receive level from -110 dBm to -47 dBm")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->min_rxlev_dbm = atoi(argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sup_dsc_max, cfg_ms_sup_dsc_max_cmd, "dsc-max <90-500>",
+	"Set the maximum DSC value. Standard is 90. Increase to make mobile "
+	"more reliable against bad RX signal. This increase the propability "
+	"of missing a paging requests\n"
+	"DSC initial and maximum value (standard is 90)")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->dsc_max = atoi(argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sup_skip_max_per_band, cfg_ms_sup_skip_max_per_band_cmd,
+	"skip-max-per-band",
+	"Scan all frequencies per band, not only a maximum number")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->skip_max_per_band = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_sup_no_skip_max_per_band, cfg_ms_sup_no_skip_max_per_band_cmd,
+	"no skip-max-per-band",
+	NO_STR "Scan only a maximum number of frequencies per band")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->skip_max_per_band = 0;
+
+	return CMD_SUCCESS;
+}
+
+/* per testsim config */
+DEFUN(cfg_ms_testsim, cfg_ms_testsim_cmd, "test-sim",
+	"Configure test SIM emulation")
+{
+	vty->node = TESTSIM_NODE;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_test_imsi, cfg_test_imsi_cmd, "imsi IMSI",
+	"Set IMSI on test card\n15 digits IMSI")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	char *error = gsm_check_imsi(argv[0]);
+
+	if (error) {
+		vty_out(vty, "%s%s", error, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	strcpy(set->test_imsi, argv[0]);
+
+	vty_restart_if_started(vty, ms);
+
+	return CMD_SUCCESS;
+}
+
+#define HEX_STR "\nByte as two digits hexadecimal"
+DEFUN(cfg_test_ki_xor, cfg_test_ki_xor_cmd, "ki xor HEX HEX HEX HEX HEX HEX "
+	"HEX HEX HEX HEX HEX HEX",
+	"Set Key (Ki) on test card\nUse XOR algorithm" HEX_STR HEX_STR HEX_STR
+	HEX_STR HEX_STR HEX_STR HEX_STR HEX_STR HEX_STR HEX_STR HEX_STR HEX_STR)
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	uint8_t ki[12];
+	const char *p;
+	int i;
+
+	for (i = 0; i < 12; i++) {
+		p = argv[i];
+		if (!strncmp(p, "0x", 2))
+			p += 2;
+		if (strlen(p) != 2) {
+			vty_out(vty, "Expecting two digits hex value (with or "
+				"without 0x in front)%s", VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		ki[i] = strtoul(p, NULL, 16);
+	}
+
+	set->test_ki_type = OSMO_AUTH_ALG_XOR;
+	memcpy(set->test_ki, ki, 12);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_test_ki_comp128, cfg_test_ki_comp128_cmd, "ki comp128 HEX HEX HEX "
+	"HEX HEX HEX HEX HEX HEX HEX HEX HEX HEX HEX HEX HEX",
+	"Set Key (Ki) on test card\nUse XOR algorithm" HEX_STR HEX_STR HEX_STR
+	HEX_STR HEX_STR HEX_STR HEX_STR HEX_STR HEX_STR HEX_STR HEX_STR HEX_STR
+	HEX_STR HEX_STR HEX_STR HEX_STR)
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	uint8_t ki[16];
+	const char *p;
+	int i;
+
+	for (i = 0; i < 16; i++) {
+		p = argv[i];
+		if (!strncmp(p, "0x", 2))
+			p += 2;
+		if (strlen(p) != 2) {
+			vty_out(vty, "Expecting two digits hex value (with or "
+				"without 0x in front)%s", VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		ki[i] = strtoul(p, NULL, 16);
+	}
+
+	set->test_ki_type = OSMO_AUTH_ALG_COMP128v1;
+	memcpy(set->test_ki, ki, 16);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_test_barr, cfg_test_barr_cmd, "barred-access",
+	"Allow access to barred cells")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->test_barr = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_test_no_barr, cfg_test_no_barr_cmd, "no barred-access",
+	NO_STR "Deny access to barred cells")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->test_barr = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_test_no_rplmn, cfg_test_no_rplmn_cmd, "no rplmn",
+	NO_STR "Unset Registered PLMN")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	set->test_rplmn_valid = 0;
+
+	vty_restart_if_started(vty, ms);
+
+	return CMD_SUCCESS;
+}
+
+static int _test_rplmn_cmd(struct vty *vty, int argc, const char *argv[],
+	int attached)
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+	uint16_t mcc = gsm_input_mcc((char *)argv[0]),
+		 mnc = gsm_input_mnc((char *)argv[1]);
+
+	if (mcc == GSM_INPUT_INVALID) {
+		vty_out(vty, "Given MCC invalid%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (mnc == GSM_INPUT_INVALID) {
+		vty_out(vty, "Given MNC invalid%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	set->test_rplmn_valid = 1;
+	set->test_rplmn_mcc = mcc;
+	set->test_rplmn_mnc = mnc;
+
+	if (argc >= 3)
+		set->test_lac = strtoul(argv[2], NULL, 16);
+	else
+		set->test_lac = 0xfffe;
+
+	if (argc >= 4)
+		set->test_tmsi = strtoul(argv[3], NULL, 16);
+	else
+		set->test_tmsi = 0xffffffff;
+
+	if (attached)
+		set->test_imsi_attached = 1;
+	else
+		set->test_imsi_attached = 0;
+
+	vty_restart_if_started(vty, ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_test_rplmn, cfg_test_rplmn_cmd,
+	"rplmn MCC MNC [LAC] [TMSI]",
+	"Set Registered PLMN\nMobile Country Code\nMobile Network Code\n"
+	"Optionally set location area code\n"
+	"Optionally set current assigned TMSI")
+{
+	return _test_rplmn_cmd(vty, argc, argv, 0);
+}
+
+DEFUN(cfg_test_rplmn_att, cfg_test_rplmn_att_cmd,
+	"rplmn MCC MNC LAC TMSI attached",
+	"Set Registered PLMN\nMobile Country Code\nMobile Network Code\n"
+	"Set location area code\nSet current assigned TMSI\n"
+	"Indicate to MM that card is already attached")
+{
+	return _test_rplmn_cmd(vty, argc, argv, 1);
+}
+
+DEFUN(cfg_test_hplmn, cfg_test_hplmn_cmd, "hplmn-search (everywhere|foreign-country)",
+	"Set Home PLMN search mode\n"
+	"Search for HPLMN when on any other network\n"
+	"Search for HPLMN when in a different country")
+{
+	struct osmocom_ms *ms = vty->index;
+	struct gsm_settings *set = &ms->settings;
+
+	switch (argv[0][0]) {
+	case 'e':
+		set->test_always = 1;
+		break;
+	case 'f':
+		set->test_always = 0;
+		break;
+	}
+
+	vty_restart_if_started(vty, ms);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_shutdown, cfg_ms_no_shutdown_cmd, "no shutdown",
+	NO_STR "Activate and run MS")
+{
+	struct osmocom_ms *ms = vty->index;
+	char *other_name = NULL;
+	int rc;
+
+	rc = mobile_start(ms, &other_name);
+	switch (rc) {
+	case -1:
+		vty_out(vty, "Cannot start MS '%s', because MS '%s' "
+			"use the same layer2-socket.%sPlease shutdown "
+			"MS '%s' first.%s", ms->name, other_name,
+			VTY_NEWLINE, other_name, VTY_NEWLINE);
+		return CMD_WARNING;
+	case -2:
+		vty_out(vty, "Cannot start MS '%s', because MS '%s' "
+			"use the same sap-socket.%sPlease shutdown "
+			"MS '%s' first.%s", ms->name, other_name,
+			VTY_NEWLINE, other_name, VTY_NEWLINE);
+		return CMD_WARNING;
+	case -3:
+		vty_out(vty, "Connection to layer 1 failed!%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_shutdown, cfg_ms_shutdown_cmd, "shutdown",
+	"Shut down and deactivate MS")
+{
+	struct osmocom_ms *ms = vty->index;
+	mobile_stop(ms, 0);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_shutdown_force, cfg_ms_shutdown_force_cmd, "shutdown force",
+	"Shut down and deactivate MS\nDo not perform IMSI detach")
+{
+	struct osmocom_ms *ms = vty->index;
+
+	mobile_stop(ms, 1);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_script_load_run, cfg_ms_script_load_run_cmd, "lua-script FILENAME",
+	"Load and execute a LUA script\nFilename for lua script")
+{
+	struct osmocom_ms *ms = vty->index;
+
+	osmo_talloc_replace_string(ms, &ms->lua_script, argv[0]);
+	if (!ms->lua_script)
+		return CMD_WARNING;
+
+	script_lua_load(vty, ms, ms->lua_script);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ms_no_script_load_run, cfg_ms_no_script_load_run_cmd, "no lua-script",
+	NO_STR "Load and execute LUA script")
+{
+	struct osmocom_ms *ms = vty->index;
+
+	script_lua_close(ms);
+	talloc_free(ms->lua_script);
+	ms->lua_script = NULL;
+	return CMD_SUCCESS;
+}
+
+int ms_vty_go_parent(struct vty *vty)
+{
+	switch (vty->node) {
+	case MS_NODE:
+		vty->node = CONFIG_NODE;
+		vty->index = NULL;
+		break;
+	case TESTSIM_NODE:
+	case SUPPORT_NODE:
+		vty->node = MS_NODE;
+		break;
+	default:
+		vty->node = CONFIG_NODE;
+	}
+
+	return vty->node;
+}
+
+DEFUN(off, off_cmd, "off",
+	"Turn mobiles off (shutdown) and exit")
+{
+	osmo_signal_dispatch(SS_GLOBAL, S_GLOBAL_SHUTDOWN, NULL);
+
+	return CMD_SUCCESS;
+}
+
+#define SUP_NODE(item) \
+	install_element(SUPPORT_NODE, &cfg_ms_sup_item_cmd);
+
+int ms_vty_init(void)
+{
+	install_element_ve(&show_ms_cmd);
+	install_element_ve(&show_subscr_cmd);
+	install_element_ve(&show_support_cmd);
+	install_element_ve(&show_cell_cmd);
+	install_element_ve(&show_cell_si_cmd);
+	install_element_ve(&show_nbcells_cmd);
+	install_element_ve(&show_ba_cmd);
+	install_element_ve(&show_forb_la_cmd);
+	install_element_ve(&show_forb_plmn_cmd);
+	install_element_ve(&monitor_network_cmd);
+	install_element_ve(&no_monitor_network_cmd);
+	install_element(ENABLE_NODE, &off_cmd);
+
+	install_element(ENABLE_NODE, &sim_test_cmd);
+	install_element(ENABLE_NODE, &sim_test_att_cmd);
+	install_element(ENABLE_NODE, &sim_sap_cmd);
+	install_element(ENABLE_NODE, &sim_reader_cmd);
+	install_element(ENABLE_NODE, &sim_remove_cmd);
+	install_element(ENABLE_NODE, &sim_pin_cmd);
+	install_element(ENABLE_NODE, &sim_disable_pin_cmd);
+	install_element(ENABLE_NODE, &sim_enable_pin_cmd);
+	install_element(ENABLE_NODE, &sim_change_pin_cmd);
+	install_element(ENABLE_NODE, &sim_unblock_pin_cmd);
+	install_element(ENABLE_NODE, &sim_lai_cmd);
+	install_element(ENABLE_NODE, &network_search_cmd);
+	install_element(ENABLE_NODE, &network_show_cmd);
+	install_element(ENABLE_NODE, &network_select_cmd);
+	install_element(ENABLE_NODE, &call_cmd);
+	install_element(ENABLE_NODE, &call_retr_cmd);
+	install_element(ENABLE_NODE, &call_dtmf_cmd);
+	install_element(ENABLE_NODE, &sms_cmd);
+	install_element(ENABLE_NODE, &service_cmd);
+	install_element(ENABLE_NODE, &test_reselection_cmd);
+	install_element(ENABLE_NODE, &delete_forbidden_plmn_cmd);
+
+#ifdef _HAVE_GPSD
+	install_element(CONFIG_NODE, &cfg_gps_host_cmd);
+#endif
+	install_element(CONFIG_NODE, &cfg_gps_device_cmd);
+	install_element(CONFIG_NODE, &cfg_gps_baud_cmd);
+	install_element(CONFIG_NODE, &cfg_gps_enable_cmd);
+	install_element(CONFIG_NODE, &cfg_no_gps_enable_cmd);
+
+	install_element(CONFIG_NODE, &cfg_hide_default_cmd);
+	install_element(CONFIG_NODE, &cfg_no_hide_default_cmd);
+
+	install_element(CONFIG_NODE, &cfg_ms_cmd);
+	install_element(CONFIG_NODE, &cfg_ms_create_cmd);
+	install_element(CONFIG_NODE, &cfg_ms_rename_cmd);
+	install_element(CONFIG_NODE, &cfg_no_ms_cmd);
+	install_node(&ms_node, config_write);
+	install_element(MS_NODE, &cfg_ms_show_this_cmd);
+	install_element(MS_NODE, &cfg_ms_layer2_cmd);
+	install_element(MS_NODE, &cfg_ms_sap_cmd);
+	install_element(MS_NODE, &cfg_ms_sim_cmd);
+	install_element(MS_NODE, &cfg_ms_mode_cmd);
+	install_element(MS_NODE, &cfg_ms_imei_cmd);
+	install_element(MS_NODE, &cfg_ms_imei_fixed_cmd);
+	install_element(MS_NODE, &cfg_ms_imei_random_cmd);
+	install_element(MS_NODE, &cfg_ms_no_emerg_imsi_cmd);
+	install_element(MS_NODE, &cfg_ms_emerg_imsi_cmd);
+	install_element(MS_NODE, &cfg_ms_no_sms_sca_cmd);
+	install_element(MS_NODE, &cfg_ms_sms_sca_cmd);
+	install_element(MS_NODE, &cfg_ms_cw_cmd);
+	install_element(MS_NODE, &cfg_ms_no_cw_cmd);
+	install_element(MS_NODE, &cfg_ms_auto_answer_cmd);
+	install_element(MS_NODE, &cfg_ms_no_auto_answer_cmd);
+	install_element(MS_NODE, &cfg_ms_force_rekey_cmd);
+	install_element(MS_NODE, &cfg_ms_no_force_rekey_cmd);
+	install_element(MS_NODE, &cfg_ms_clip_cmd);
+	install_element(MS_NODE, &cfg_ms_clir_cmd);
+	install_element(MS_NODE, &cfg_ms_no_clip_cmd);
+	install_element(MS_NODE, &cfg_ms_no_clir_cmd);
+	install_element(MS_NODE, &cfg_ms_tx_power_cmd);
+	install_element(MS_NODE, &cfg_ms_tx_power_val_cmd);
+	install_element(MS_NODE, &cfg_ms_sim_delay_cmd);
+	install_element(MS_NODE, &cfg_ms_no_sim_delay_cmd);
+	install_element(MS_NODE, &cfg_ms_stick_cmd);
+	install_element(MS_NODE, &cfg_ms_no_stick_cmd);
+	install_element(MS_NODE, &cfg_ms_lupd_cmd);
+	install_element(MS_NODE, &cfg_ms_no_lupd_cmd);
+	install_element(MS_NODE, &cfg_ms_codec_full_cmd);
+	install_element(MS_NODE, &cfg_ms_codec_full_pref_cmd);
+	install_element(MS_NODE, &cfg_ms_codec_half_cmd);
+	install_element(MS_NODE, &cfg_ms_codec_half_pref_cmd);
+	install_element(MS_NODE, &cfg_ms_no_codec_half_cmd);
+	install_element(MS_NODE, &cfg_ms_abbrev_cmd);
+	install_element(MS_NODE, &cfg_ms_no_abbrev_cmd);
+	install_element(MS_NODE, &cfg_ms_testsim_cmd);
+	install_element(MS_NODE, &cfg_ms_neighbour_cmd);
+	install_element(MS_NODE, &cfg_ms_no_neighbour_cmd);
+	install_element(MS_NODE, &cfg_ms_any_timeout_cmd);
+	install_element(MS_NODE, &cfg_ms_sms_store_cmd);
+	install_element(MS_NODE, &cfg_ms_no_sms_store_cmd);
+	install_element(MS_NODE, &cfg_ms_support_cmd);
+	install_node(&support_node, config_write_dummy);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_dtmf_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_dtmf_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_sms_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_sms_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_a5_1_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_a5_1_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_a5_2_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_a5_2_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_a5_3_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_a5_3_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_a5_4_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_a5_4_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_a5_5_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_a5_5_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_a5_6_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_a5_6_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_a5_7_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_a5_7_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_p_gsm_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_p_gsm_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_e_gsm_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_e_gsm_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_r_gsm_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_r_gsm_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_dcs_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_dcs_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_gsm_850_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_gsm_850_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_pcs_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_pcs_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_gsm_480_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_gsm_480_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_gsm_450_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_gsm_450_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_class_900_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_class_dcs_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_class_850_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_class_pcs_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_class_400_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_ch_cap_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_full_v1_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_full_v1_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_full_v2_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_full_v2_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_full_v3_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_full_v3_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_half_v1_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_half_v1_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_half_v3_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_half_v3_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_min_rxlev_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_dsc_max_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_skip_max_per_band_cmd);
+	install_element(SUPPORT_NODE, &cfg_ms_sup_no_skip_max_per_band_cmd);
+	install_node(&testsim_node, config_write_dummy);
+	install_element(TESTSIM_NODE, &cfg_test_imsi_cmd);
+	install_element(TESTSIM_NODE, &cfg_test_ki_xor_cmd);
+	install_element(TESTSIM_NODE, &cfg_test_ki_comp128_cmd);
+	install_element(TESTSIM_NODE, &cfg_test_barr_cmd);
+	install_element(TESTSIM_NODE, &cfg_test_no_barr_cmd);
+	install_element(TESTSIM_NODE, &cfg_test_no_rplmn_cmd);
+	install_element(TESTSIM_NODE, &cfg_test_rplmn_cmd);
+	install_element(TESTSIM_NODE, &cfg_test_rplmn_att_cmd);
+	install_element(TESTSIM_NODE, &cfg_test_hplmn_cmd);
+	install_element(MS_NODE, &cfg_ms_shutdown_cmd);
+	install_element(MS_NODE, &cfg_ms_shutdown_force_cmd);
+	install_element(MS_NODE, &cfg_ms_no_shutdown_cmd);
+	install_element(MS_NODE, &cfg_ms_script_load_run_cmd);
+	install_element(MS_NODE, &cfg_ms_no_script_load_run_cmd);
+
+	/* Register the talloc context introspection command */
+	osmo_talloc_vty_add_cmds();
+
+	return 0;
+}
+
+void vty_notify(struct osmocom_ms *ms, const char *fmt, ...)
+{
+	struct telnet_connection *connection;
+	char buffer[1000];
+	va_list args;
+	struct vty *vty;
+
+	if (fmt) {
+		va_start(args, fmt);
+		vsnprintf(buffer, sizeof(buffer) - 1, fmt, args);
+		buffer[sizeof(buffer) - 1] = '\0';
+		va_end(args);
+
+		if (!buffer[0])
+			return;
+	}
+
+	llist_for_each_entry(connection, &active_connections, entry) {
+		vty = connection->vty;
+		if (!vty)
+			continue;
+		if (!fmt) {
+			vty_out(vty, "%s%% (MS %s)%s", VTY_NEWLINE, ms->name,
+				VTY_NEWLINE);
+			continue;
+		}
+		if (buffer[strlen(buffer) - 1] == '\n') {
+			buffer[strlen(buffer) - 1] = '\0';
+			vty_out(vty, "%% %s%s", buffer, VTY_NEWLINE);
+			buffer[strlen(buffer)] = '\n';
+		} else
+			vty_out(vty, "%% %s", buffer);
+	}
+}
+
diff --git a/src/host/osmocon/.gitignore b/src/host/osmocon/.gitignore
new file mode 100644
index 00000000..ad061b7f
--- /dev/null
+++ b/src/host/osmocon/.gitignore
@@ -0,0 +1,36 @@
+# autoreconf by-products
+*.in
+
+aclocal.m4
+autom4te.cache/
+configure
+depcomp
+install-sh
+missing
+
+# configure by-products
+.deps/
+Makefile
+
+config.status
+version.h
+
+# build by-products
+*.o
+
+osmocon
+osmoload
+
+# various
+.version
+.tarball-version
+
+# IDA file
+*.id*
+*.nam
+*.til
+
+# Other test files
+*.dump
+*.bin
+*.log
diff --git a/src/host/osmocon/COPYING b/src/host/osmocon/COPYING
new file mode 100644
index 00000000..d511905c
--- /dev/null
+++ b/src/host/osmocon/COPYING
@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
diff --git a/src/host/osmocon/Makefile.am b/src/host/osmocon/Makefile.am
new file mode 100644
index 00000000..de4e575f
--- /dev/null
+++ b/src/host/osmocon/Makefile.am
@@ -0,0 +1,21 @@
+AUTOMAKE_OPTIONS = foreign dist-bzip2 1.6
+
+# versioning magic
+BUILT_SOURCES = $(top_srcdir)/.version
+$(top_srcdir)/.version:
+	echo $(VERSION) > $@-t && mv $@-t $@
+dist-hook:
+	echo $(VERSION) > $(distdir)/.tarball-version
+
+INCLUDES = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS=-Wall $(LIBOSMOCORE_CFLAGS)
+
+sbin_PROGRAMS = osmocon osmoload
+
+# FIXME: sercomm needs to move into libosmocore or another shared lib
+INCLUDES += -I$(srcdir)/../../target/firmware/include/comm -I$(srcdir)/../../target/firmware/apps -DHOST_BUILD
+osmocon_SOURCES = osmocon.c tpu_debug.c $(srcdir)/../../target/firmware/comm/sercomm.c
+osmocon_LDADD = $(LIBOSMOCORE_LIBS)
+
+osmoload_SOURCE = osmoload.c $(srcdir)/../../target/firmware/comm/sercomm.c
+osmoload_LDADD = $(LIBOSMOCORE_LIBS)
diff --git a/src/host/osmocon/configure.ac b/src/host/osmocon/configure.ac
new file mode 100644
index 00000000..a42f4874
--- /dev/null
+++ b/src/host/osmocon/configure.ac
@@ -0,0 +1,52 @@
+dnl Process this file with autoconf to produce a configure script
+AC_INIT([osmocon],
+	m4_esyscmd([./git-version-gen .tarball-version]),
+	[baseband-devel@lists.osmocom.org])
+
+AM_INIT_AUTOMAKE([dist-bzip2])
+
+dnl kernel style compile messages
+m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+
+dnl checks for programs
+AC_PROG_MAKE_SET
+AC_PROG_CC
+AC_PROG_INSTALL
+
+dnl checks for libraries
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore)
+
+dnl checks for header files
+AC_HEADER_STDC
+
+dnl Checks for typedefs, structures and compiler characteristics
+
+AC_ARG_ENABLE(sanitize,
+		[AS_HELP_STRING([--enable-sanitize], [Compile with address sanitizer enabled], )],
+		[sanitize=$enableval], [sanitize="no"])
+if test x"$sanitize" = x"yes"
+then
+	CFLAGS="$CFLAGS -fsanitize=address -fsanitize=undefined"
+	CPPFLAGS="$CPPFLAGS -fsanitize=address -fsanitize=undefined"
+fi
+
+AC_ARG_ENABLE(werror,
+	[AS_HELP_STRING(
+		[--enable-werror],
+		[Turn all compiler warnings into errors, with exceptions:
+		 a) deprecation (allow upstream to mark deprecation without breaking builds);
+		 b) "#warning" pragmas (allow to remind ourselves of errors without breaking builds)
+		]
+	)],
+	[werror=$enableval], [werror="no"])
+if test x"$werror" = x"yes"
+then
+	WERROR_FLAGS="-Werror"
+	WERROR_FLAGS+=" -Wno-error=deprecated -Wno-error=deprecated-declarations"
+	WERROR_FLAGS+=" -Wno-error=cpp" # "#warning"
+	CFLAGS="$CFLAGS $WERROR_FLAGS"
+	CPPFLAGS="$CPPFLAGS $WERROR_FLAGS"
+fi
+
+AC_OUTPUT(
+    Makefile)
diff --git a/src/host/osmocon/git-version-gen b/src/host/osmocon/git-version-gen
new file mode 100755
index 00000000..652fac68
--- /dev/null
+++ b/src/host/osmocon/git-version-gen
@@ -0,0 +1,151 @@
+#!/bin/sh
+# Print a version string.
+scriptversion=2010-01-28.01
+
+# Copyright (C) 2007-2010 Free Software Foundation, Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# This script is derived from GIT-VERSION-GEN from GIT: http://git.or.cz/.
+# It may be run two ways:
+# - from a git repository in which the "git describe" command below
+#   produces useful output (thus requiring at least one signed tag)
+# - from a non-git-repo directory containing a .tarball-version file, which
+#   presumes this script is invoked like "./git-version-gen .tarball-version".
+
+# In order to use intra-version strings in your project, you will need two
+# separate generated version string files:
+#
+# .tarball-version - present only in a distribution tarball, and not in
+#   a checked-out repository.  Created with contents that were learned at
+#   the last time autoconf was run, and used by git-version-gen.  Must not
+#   be present in either $(srcdir) or $(builddir) for git-version-gen to
+#   give accurate answers during normal development with a checked out tree,
+#   but must be present in a tarball when there is no version control system.
+#   Therefore, it cannot be used in any dependencies.  GNUmakefile has
+#   hooks to force a reconfigure at distribution time to get the value
+#   correct, without penalizing normal development with extra reconfigures.
+#
+# .version - present in a checked-out repository and in a distribution
+#   tarball.  Usable in dependencies, particularly for files that don't
+#   want to depend on config.h but do want to track version changes.
+#   Delete this file prior to any autoconf run where you want to rebuild
+#   files to pick up a version string change; and leave it stale to
+#   minimize rebuild time after unrelated changes to configure sources.
+#
+# It is probably wise to add these two files to .gitignore, so that you
+# don't accidentally commit either generated file.
+#
+# Use the following line in your configure.ac, so that $(VERSION) will
+# automatically be up-to-date each time configure is run (and note that
+# since configure.ac no longer includes a version string, Makefile rules
+# should not depend on configure.ac for version updates).
+#
+# AC_INIT([GNU project],
+#         m4_esyscmd([build-aux/git-version-gen .tarball-version]),
+#         [bug-project@example])
+#
+# Then use the following lines in your Makefile.am, so that .version
+# will be present for dependencies, and so that .tarball-version will
+# exist in distribution tarballs.
+#
+# BUILT_SOURCES = $(top_srcdir)/.version
+# $(top_srcdir)/.version:
+#	echo $(VERSION) > $@-t && mv $@-t $@
+# dist-hook:
+#	echo $(VERSION) > $(distdir)/.tarball-version
+
+case $# in
+    1) ;;
+    *) echo 1>&2 "Usage: $0 \$srcdir/.tarball-version"; exit 1;;
+esac
+
+tarball_version_file=$1
+nl='
+'
+
+# First see if there is a tarball-only version file.
+# then try "git describe", then default.
+if test -f $tarball_version_file
+then
+    v=`cat $tarball_version_file` || exit 1
+    case $v in
+	*$nl*) v= ;; # reject multi-line output
+	[0-9]*) ;;
+	*) v= ;;
+    esac
+    test -z "$v" \
+	&& echo "$0: WARNING: $tarball_version_file seems to be damaged" 1>&2
+fi
+
+if test -n "$v"
+then
+    : # use $v
+elif
+       v=`git describe --abbrev=4 --match='osmocon_v*' HEAD 2>/dev/null \
+	  || git describe --abbrev=4 HEAD 2>/dev/null` \
+    && case $v in
+	 osmocon_[0-9]*) ;;
+	 osmocon_v[0-9]*) ;;
+	 *) (exit 1) ;;
+       esac
+then
+    # Is this a new git that lists number of commits since the last
+    # tag or the previous older version that did not?
+    #   Newer: v6.10-77-g0f8faeb
+    #   Older: v6.10-g0f8faeb
+    case $v in
+	*-*-*) : git describe is okay three part flavor ;;
+	*-*)
+	    : git describe is older two part flavor
+	    # Recreate the number of commits and rewrite such that the
+	    # result is the same as if we were using the newer version
+	    # of git describe.
+	    vtag=`echo "$v" | sed 's/-.*//'`
+	    numcommits=`git rev-list "$vtag"..HEAD | wc -l`
+	    v=`echo "$v" | sed "s/\(.*\)-\(.*\)/\1-$numcommits-\2/"`;
+	    ;;
+    esac
+
+    # Change the first '-' to a '.', so version-comparing tools work properly.
+    # Remove the "g" in git describe's output string, to save a byte.
+    v=`echo "$v" | sed 's/-/./;s/\(.*\)-g/\1-/;s/^osmocon_//'`;
+else
+    v="UNKNOWN"
+fi
+
+v=`echo "$v" |sed 's/^v//'`
+
+# Don't declare a version "dirty" merely because a time stamp has changed.
+git status > /dev/null 2>&1
+
+dirty=`sh -c 'git diff-index --name-only HEAD' 2>/dev/null` || dirty=
+case "$dirty" in
+    '') ;;
+    *) # Append the suffix only if there isn't one already.
+	case $v in
+	  *-dirty) ;;
+	  *) v="$v-dirty" ;;
+	esac ;;
+esac
+
+# Omit the trailing newline, so that m4_esyscmd can use the result directly.
+echo "$v" | tr -d '\012'
+
+# Local variables:
+# eval: (add-hook 'write-file-hooks 'time-stamp)
+# time-stamp-start: "scriptversion="
+# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-end: "$"
+# End:
diff --git a/src/host/osmocon/memdump_convert.pl b/src/host/osmocon/memdump_convert.pl
new file mode 100755
index 00000000..3d18a0b3
--- /dev/null
+++ b/src/host/osmocon/memdump_convert.pl
@@ -0,0 +1,29 @@
+#!/usr/bin/perl
+
+my $num_line = 0;
+my $num_hex = 0;
+my $oldaddr;
+
+while (my $line = <STDIN>) {
+	chomp($line);
+	$num_line++;
+	my (@hex) = $line =~ /(\w{8}): (\w{8}) (\w{8}) (\w{8}) (\w{8})  (\w{8}) (\w{8}) (\w{8}) (\w{8})/;
+	my $addr = hex(shift @hex);
+	if ($addr != 0 && $addr != $oldaddr + 0x20) {
+		printf(STDERR "gap of %u between 0x%08x and 0x%08x\n%s\n",
+			$addr - $oldaddr, $addr, $oldaddr, $line);
+	}
+	foreach my $h (@hex) {
+		$num_hex++;
+		# poor mans endian conversion
+		my ($a, $b, $c, $d) = $h =~/(\w\w)(\w\w)(\w\w)(\w\w)/;
+		my $h_reorder = $d . $c . $b . $a;
+		# convert into actual binary number
+		my $tmp = pack('H8', $h_reorder);
+		syswrite(STDOUT, $tmp, 4);
+	}
+	$oldaddr = $addr;
+}
+
+printf(STDERR "num lines/num hex: %u/%u\n", $num_line, $num_hex);
+
diff --git a/src/host/osmocon/osmocon.c b/src/host/osmocon/osmocon.c
new file mode 100644
index 00000000..26416f76
--- /dev/null
+++ b/src/host/osmocon/osmocon.c
@@ -0,0 +1,1496 @@
+/* osmocon */
+
+/* (C) 2010,2018 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2010 by Steve Markgraf <steve@steve-m.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdint.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <termios.h>
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+
+#include <sercomm.h>
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/serial.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/application.h>
+#include <osmocom/core/socket.h>
+
+#include <arpa/inet.h>
+
+#define MODEM_BAUDRATE		B115200
+#define MAX_DNLOAD_SIZE		0xFFFF
+#define MAX_HDR_SIZE		128
+#define MAGIC_OFFSET		0x3be2
+
+#define DEFAULT_BEACON_INTERVAL	50000
+#define ROMLOAD_INIT_BAUDRATE	B19200
+#define ROMLOAD_DL_BAUDRATE	B115200
+#define ROMLOAD_BLOCK_HDR_LEN	10
+#define ROMLOAD_ADDRESS		0x820000
+
+#define MTK_INIT_BAUDRATE	B19200
+#define MTK_ADDRESS		0x40001400
+#define MTK_BLOCK_SIZE		1024
+
+struct tool_server *tool_server_for_dlci[256];
+
+/**
+ * a connection from some other tool
+ */
+struct tool_connection {
+	struct tool_server *server;
+	struct llist_head entry;
+	struct osmo_fd fd;
+};
+
+/**
+ * server for a tool
+ */
+struct tool_server {
+	struct osmo_fd bfd;
+	uint8_t dlci;
+	struct llist_head connections;
+};
+
+
+enum dnload_state {
+	WAITING_PROMPT1,
+	WAITING_PROMPT2,
+	DOWNLOADING,
+};
+
+enum romload_state {
+	WAITING_IDENTIFICATION,
+	WAITING_PARAM_ACK,
+	SENDING_BLOCKS,
+	SENDING_LAST_BLOCK,
+	LAST_BLOCK_SENT,
+	WAITING_BLOCK_ACK,
+	WAITING_CHECKSUM_ACK,
+	WAITING_BRANCH_ACK,
+	FINISHED,
+};
+
+enum mtk_state {
+	MTK_INIT_1,
+	MTK_INIT_2,
+	MTK_INIT_3,
+	MTK_INIT_4,
+	MTK_WAIT_WRITE_ACK,
+	MTK_WAIT_ADDR_ACK,
+	MTK_WAIT_SIZE_ACK,
+	MTK_SENDING_BLOCKS,
+	MTK_WAIT_BRANCH_CMD_ACK,
+	MTK_WAIT_BRANCH_ADDR_ACK,
+	MTK_FINISHED,
+};
+
+enum dnload_mode {
+	MODE_C123,
+	MODE_C123xor,
+	MODE_C140,
+	MODE_C140xor,
+	MODE_C155,
+	MODE_ROMLOAD,
+	MODE_MTK,
+	MODE_INVALID,
+};
+
+struct dnload {
+	enum dnload_state state;
+	enum romload_state romload_state;
+	enum mtk_state mtk_state;
+	enum dnload_mode mode, previous_mode;
+	struct osmo_fd serial_fd;
+	char *filename;
+
+	int expect_hdlc;
+	int do_chainload;
+
+	int dump_rx;
+	int dump_tx;
+	int beacon_interval;
+
+	/* data to be downloaded */
+	uint8_t *data;
+	int data_len;
+
+	uint8_t *write_ptr;
+
+	/* romload: block to be downloaded */
+	uint8_t *block;
+	int block_len;
+	uint8_t block_number;
+	uint16_t block_payload_size;
+	int romload_dl_checksum;
+	uint8_t *block_ptr;
+	uint8_t load_address[4];
+
+	uint8_t mtk_send_size[4];
+	int block_count;
+	int echo_bytecount;
+
+	struct tool_server layer2_server;
+	struct tool_server loader_server;
+};
+
+
+static struct dnload dnload;
+static struct osmo_timer_list tick_timer;
+
+/* Compal ramloader specific */
+static const uint8_t phone_prompt1[] = { 0x1b, 0xf6, 0x02, 0x00, 0x41, 0x01, 0x40 };
+static const uint8_t dnload_cmd[]    = { 0x1b, 0xf6, 0x02, 0x00, 0x52, 0x01, 0x53 };
+static const uint8_t phone_prompt2[] = { 0x1b, 0xf6, 0x02, 0x00, 0x41, 0x02, 0x43 };
+static const uint8_t phone_ack[]     = { 0x1b, 0xf6, 0x02, 0x00, 0x41, 0x03, 0x42 };
+static const uint8_t phone_nack_magic[]= { 0x1b, 0xf6, 0x02, 0x00, 0x41, 0x03, 0x57 };
+static const uint8_t phone_nack[]    = { 0x1b, 0xf6, 0x02, 0x00, 0x45, 0x53, 0x16 };
+static const uint8_t ftmtool[] = { 0x66, 0x74, 0x6d, 0x74, 0x6f, 0x6f, 0x6c };
+static const uint8_t phone_magic[] = { 0x31, 0x30, 0x30, 0x33 }; /* "1003" */
+
+/* The C123 has a hard-coded check inside the ramloader that requires the
+ * following bytes to be always the first four bytes of the image */
+static const uint8_t data_hdr_c123[]    = { 0xee, 0x4c, 0x9f, 0x63 };
+
+/* The C155 doesn't have some strange restriction on what the first four bytes
+ *  have to be, but it starts the ramloader in THUMB mode. We use the following
+ * four bytes to switch back to ARM mode:
+  800100:       4778            bx      pc
+  800102:       46c0            nop                     ; (mov r8, r8)
+ */
+static const uint8_t data_hdr_c155[]    = { 0x78, 0x47, 0xc0, 0x46 };
+
+/* small loader that enables the bootrom and executes the TI romloader:
+ * _start:
+ *	ldr	r1, =0x000a0000
+ * wait:
+ *	subs	r1, r1, #1
+ *	bne	wait
+ *	ldr	r1, =0xfffffb10
+ *	ldr	r2, =0x100
+ *	strh	r2, [r1]
+ *	ldr	pc, =0x0
+ */
+static const uint8_t chainloader[] = {
+	0x0a, 0x18, 0xa0, 0xe3, 0x01, 0x10, 0x51, 0xe2, 0xfd, 0xff, 0xff,
+	0x1a, 0x08, 0x10, 0x9f, 0xe5, 0x01, 0x2c, 0xa0, 0xe3, 0xb0, 0x20,
+	0xc1, 0xe1, 0x00, 0xf0, 0xa0, 0xe3, 0x10, 0xfb, 0xff, 0xff,
+};
+
+/* Calypso romloader specific */
+static const uint8_t romload_ident_cmd[] =	{ 0x3c, 0x69 };	/* <i */
+static const uint8_t __attribute__((__unused__)) romload_abort_cmd[] =	{ 0x3c, 0x61 };	/* <a */
+static const uint8_t romload_write_cmd[] =	{ 0x3c, 0x77 };	/* <w */
+static const uint8_t romload_checksum_cmd[] =	{ 0x3c, 0x63 };	/* <c */
+static const uint8_t romload_branch_cmd[] =	{ 0x3c, 0x62 };	/* <b */
+static const uint8_t romload_ident_ack[] =	{ 0x3e, 0x69 };	/* >i */
+static const uint8_t romload_param_ack[] =	{ 0x3e, 0x70 };	/* >p */
+static const uint8_t __attribute__((__unused__)) romload_param_nack[] =	{ 0x3e, 0x50 };	/* >P */
+static const uint8_t romload_block_ack[] =	{ 0x3e, 0x77 };	/* >w */
+static const uint8_t romload_block_nack[] =	{ 0x3e, 0x57 };	/* >W */
+static const uint8_t romload_checksum_ack[] =	{ 0x3e, 0x63 };	/* >c */
+static const uint8_t romload_checksum_nack[] =	{ 0x3e, 0x43 };	/* >C */
+static const uint8_t romload_branch_ack[] =	{ 0x3e, 0x62 };	/* >b */
+static const uint8_t romload_branch_nack[] =	{ 0x3e, 0x42 };	/* >B */
+
+/* romload_param: {"<p", uint8_t baudrate, uint8_t dpll, uint16_t memory_config,
+ * uint8_t strobe_af, uint32_t uart_timeout} */
+
+static const uint8_t romload_param[] = { 0x3c, 0x70, 0x00, 0x00, 0x00, 0x04,
+					 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+/* MTK romloader specific */
+static const uint8_t mtk_init_cmd[] =	{ 0xa0, 0x0a, 0x50, 0x05 };
+static const uint8_t mtk_init_resp[] =	{ 0x5f, 0xf5, 0xaf, 0xfa };
+static const uint8_t mtk_command[] =	{ 0xa1, 0xa2, 0xa4, 0xa8 };
+
+static void beacon_timer_cb(void *p)
+{
+	int rc;
+
+	if (dnload.romload_state == WAITING_IDENTIFICATION) {
+		rc = write(dnload.serial_fd.fd, romload_ident_cmd,
+			   sizeof(romload_ident_cmd));
+
+		if (!(rc == sizeof(romload_ident_cmd)))
+			printf("Error sending identification beacon\n");
+
+		osmo_timer_schedule(p, 0, dnload.beacon_interval);
+	}
+}
+
+static void mtk_timer_cb(void *p)
+{
+	int rc;
+
+	if (dnload.mtk_state == MTK_INIT_1) {
+		printf("Sending MTK romloader beacon...\n");
+		rc = write(dnload.serial_fd.fd, &mtk_init_cmd[0], 1);
+
+		if (!(rc == 1))
+			printf("Error sending identification beacon\n");
+
+		osmo_timer_schedule(p, 0, dnload.beacon_interval);
+	}
+}
+
+/* Read the to-be-downloaded file, prepend header and length, append XOR sum */
+int read_file(const char *filename, int chainload)
+{
+	int fd, rc, i;
+	struct stat st;
+	const uint8_t *hdr = NULL;
+	int payload_size;
+	int hdr_len = 0;
+	uint8_t *file_data;
+	uint16_t tot_len;
+	uint8_t nibble;
+	uint8_t running_xor = 0x02;
+
+	if (!chainload) {
+		fd = open(filename, O_RDONLY);
+		if (fd < 0) {
+			perror("opening file");
+			exit(1);
+		}
+
+		rc = fstat(fd, &st);
+		if ((st.st_size > MAX_DNLOAD_SIZE) && (dnload.mode != MODE_ROMLOAD)) {
+			fprintf(stderr, "The maximum file size is 64kBytes (%u bytes)\n",
+				MAX_DNLOAD_SIZE);
+			return -EFBIG;
+		}
+	} else {
+		st.st_size = sizeof(chainloader);
+	}
+
+	free(dnload.data);
+	dnload.data = NULL;
+
+	if (dnload.mode == MODE_C140 || dnload.mode == MODE_C140xor) {
+		if (st.st_size < (MAGIC_OFFSET + sizeof(phone_magic)))
+			payload_size = MAGIC_OFFSET + sizeof(phone_magic);
+		else {
+			printf("\nThe filesize is larger than 15kb, code on "
+				"the magic address will be overwritten!\nUse "
+				"loader.bin and upload the application with "
+				"osmoload instead!\n\n");
+			payload_size = st.st_size;
+		}
+	} else
+		payload_size = st.st_size;
+
+	dnload.data = malloc(MAX_HDR_SIZE + payload_size);
+
+	if (!dnload.data) {
+		if (!chainload)
+			close(fd);
+		fprintf(stderr, "No memory\n");
+		return -ENOMEM;
+	}
+
+	/* copy in the header, if any */
+	switch (dnload.mode) {
+	case MODE_C155:
+		hdr = data_hdr_c155;
+		hdr_len = sizeof(data_hdr_c155);
+		break;
+	case MODE_C140:
+	case MODE_C140xor:
+	case MODE_C123:
+	case MODE_C123xor:
+		hdr = data_hdr_c123;
+		hdr_len = sizeof(data_hdr_c123);
+		break;
+	case MODE_ROMLOAD:
+		break;
+	default:
+		break;
+	}
+
+	if (hdr && hdr_len)
+		memcpy(dnload.data, hdr, hdr_len);
+
+	/* 2 bytes for length + header */
+	file_data = dnload.data + 2 + hdr_len;
+
+	/* write the length, keep running XOR */
+	tot_len = hdr_len + payload_size;
+	nibble = tot_len >> 8;
+	dnload.data[0] = nibble;
+	running_xor ^= nibble;
+	nibble = tot_len & 0xff;
+	dnload.data[1] = nibble;
+	running_xor ^= nibble;
+
+	if (hdr_len && hdr) {
+		memcpy(dnload.data+2, hdr, hdr_len);
+
+		for (i = 0; i < hdr_len; i++)
+			running_xor ^= hdr[i];
+	}
+
+	if (!chainload) {
+		rc = read(fd, file_data, st.st_size);
+		if (rc < 0) {
+			perror("error reading file\n");
+			free(dnload.data);
+			dnload.data = NULL;
+			close(fd);
+			return -EIO;
+		}
+		if (rc < st.st_size) {
+			free(dnload.data);
+			dnload.data = NULL;
+			close(fd);
+			fprintf(stderr, "Short read of file (%d < %d)\n",
+				rc, (int)st.st_size);
+			return -EIO;
+		}
+		close(fd);
+	} else {
+		memcpy(file_data, chainloader, st.st_size);
+	}
+
+	dnload.data_len = (file_data+payload_size) - dnload.data;
+
+	/* fill memory between data end and magic, add magic */
+	if(dnload.mode == MODE_C140 || dnload.mode == MODE_C140xor) {
+		if (st.st_size < MAGIC_OFFSET)
+			memset(file_data + st.st_size, 0x00,
+				payload_size - st.st_size);
+		memcpy(dnload.data + MAGIC_OFFSET, phone_magic,
+			sizeof(phone_magic));
+	}
+
+	/* calculate XOR sum */
+	for (i = 0; i < payload_size; i++)
+		running_xor ^= file_data[i];
+
+	dnload.data[dnload.data_len++] = running_xor;
+
+	/* initialize write pointer to start of data */
+	dnload.write_ptr = dnload.data;
+
+	printf("read_file(%s): file_size=%u, hdr_len=%u, dnload_len=%u\n",
+		chainload ? "chainloader" : filename, (int)st.st_size,
+		hdr_len, dnload.data_len);
+
+	return 0;
+}
+
+static void osmocon_osmo_hexdump(const uint8_t *data, unsigned int len)
+{
+	int n;
+
+	for (n=0; n < len; n++)
+		printf("%02x ", data[n]);
+	printf(" ");
+	for (n=0; n < len; n++)
+		if (isprint(data[n]))
+			putchar(data[n]);
+		else
+			putchar('.');
+	printf("\n");
+}
+
+static int romload_prepare_block(void)
+{
+	int i;
+
+	int block_checksum = 5;
+	int remaining_bytes;
+	int fill_bytes;
+	uint8_t *block_data;
+	uint32_t block_address;
+
+	dnload.block_len = ROMLOAD_BLOCK_HDR_LEN + dnload.block_payload_size;
+
+	/* if first block, allocate memory */
+	if (!dnload.block_number) {
+		dnload.block = malloc(dnload.block_len);
+		if (!dnload.block) {
+			fprintf(stderr, "No memory\n");
+			return -ENOMEM;
+		}
+		dnload.romload_dl_checksum = 0;
+		/* initialize write pointer to start of data */
+		dnload.write_ptr = dnload.data;
+	}
+
+	block_address = ROMLOAD_ADDRESS +
+			(dnload.block_number * dnload.block_payload_size);
+
+	/* prepare our block header (10 bytes) */
+	memcpy(dnload.block, romload_write_cmd, sizeof(romload_write_cmd));
+	dnload.block[2] = 0x01; /* block index */
+	/* should normally be the block number, but hangs when sending !0x01 */
+	dnload.block[3] = 0x01;	/* dnload.block_number+1 */
+	dnload.block[4] = (dnload.block_payload_size >> 8) & 0xff;
+	dnload.block[5] = dnload.block_payload_size & 0xff;
+	dnload.block[6] = (block_address >> 24) & 0xff;
+	dnload.block[7] = (block_address >> 16) & 0xff;
+	dnload.block[8] = (block_address >> 8) & 0xff;
+	dnload.block[9] = block_address & 0xff;
+
+	block_data = dnload.block + ROMLOAD_BLOCK_HDR_LEN;
+	dnload.write_ptr = dnload.data + 2 +
+			(dnload.block_payload_size * dnload.block_number);
+
+	remaining_bytes = dnload.data_len - 3 -
+			(dnload.block_payload_size * dnload.block_number);
+
+	memcpy(block_data, dnload.write_ptr, OSMO_MIN(dnload.block_payload_size, remaining_bytes));
+
+	if (remaining_bytes <= dnload.block_payload_size) {
+		fill_bytes = (dnload.block_payload_size - remaining_bytes);
+		memset(block_data + remaining_bytes, 0x00, fill_bytes);
+		dnload.romload_state = SENDING_LAST_BLOCK;
+	} else {
+		dnload.romload_state = SENDING_BLOCKS;
+	}
+
+	/* block checksum is lsb of ~(5 + block_size_lsb +  all bytes of
+	 * block_address + all data bytes) */
+	for (i = 5; i < ROMLOAD_BLOCK_HDR_LEN + dnload.block_payload_size; i++)
+		block_checksum += dnload.block[i];
+
+	/* checksum is lsb of ~(sum of LSBs of all block checksums) */
+	dnload.romload_dl_checksum += ~(block_checksum) & 0xff;
+
+	/* initialize block pointer to start of block */
+	dnload.block_ptr = dnload.block;
+
+	dnload.block_number++;
+	dnload.serial_fd.when = BSC_FD_READ | BSC_FD_WRITE;
+	return 0;
+}
+
+static int mtk_prepare_block(void)
+{
+	int i;
+	int remaining_bytes;
+	int fill_bytes;
+	uint8_t *block_data;
+	uint8_t tmp_byteswap;
+	uint32_t tmp_size;
+
+	dnload.block_len = MTK_BLOCK_SIZE;
+	dnload.echo_bytecount = 0;
+
+	/* if first block, allocate memory */
+	if (!dnload.block_number) {
+		dnload.block = malloc(dnload.block_len);
+		if (!dnload.block) {
+			fprintf(stderr, "No memory\n");
+			return -ENOMEM;
+		}
+
+		/* calculate the number of blocks we need to send */
+		dnload.block_count = (dnload.data_len-3) / MTK_BLOCK_SIZE;
+		/* add one more block if no multiple of blocksize */
+		if((dnload.data_len-3) % MTK_BLOCK_SIZE)
+			dnload.block_count++;
+
+		/* divide by 2, since we have to tell the mtk loader the size
+		 * as count of uint16 (odd transfer sizes are not possible) */
+		tmp_size = (dnload.block_count * MTK_BLOCK_SIZE)/2;
+		dnload.mtk_send_size[0] = (tmp_size >> 24) & 0xff;
+		dnload.mtk_send_size[1] = (tmp_size >> 16) & 0xff;
+		dnload.mtk_send_size[2] = (tmp_size >> 8) & 0xff;
+		dnload.mtk_send_size[3] = tmp_size & 0xff;
+
+		/* initialize write pointer to start of data */
+		dnload.write_ptr = dnload.data;
+	}
+
+	block_data = dnload.block;
+	dnload.write_ptr = dnload.data + 2 +
+			(dnload.block_len * dnload.block_number);
+
+	remaining_bytes = dnload.data_len - 3 -
+			(dnload.block_len * dnload.block_number);
+
+	memcpy(block_data, dnload.write_ptr, MTK_BLOCK_SIZE);
+
+	if (remaining_bytes <= MTK_BLOCK_SIZE) {
+		fill_bytes = (MTK_BLOCK_SIZE - remaining_bytes);
+		printf("Preparing the last block, filling %i bytes\n",
+			fill_bytes);
+		memset(block_data + remaining_bytes, 0x00, fill_bytes);
+		dnload.romload_state = SENDING_LAST_BLOCK;
+	} else {
+		dnload.romload_state = SENDING_BLOCKS;
+		printf("Preparing block %i\n", dnload.block_number+1);
+	}
+
+	/* for the mtk romloader we need to swap MSB <-> LSB */
+	for (i = 0; i < dnload.block_len; i += 2) {
+		tmp_byteswap = dnload.block[i];
+		dnload.block[i] = dnload.block[i+1];
+		dnload.block[i+1] = tmp_byteswap;
+	}
+
+	/* initialize block pointer to start of block */
+	dnload.block_ptr = dnload.block;
+
+	dnload.block_number++;
+	return 0;
+}
+
+static int handle_write_block(void)
+{
+	int bytes_left, write_len, rc;
+	int progress = 100 * (dnload.block_number * dnload.block_payload_size)
+		       / dnload.data_len;
+
+	if (dnload.block_ptr >= dnload.block + dnload.block_len) {
+		printf("Progress: %i%%\r", progress);
+		fflush(stdout);
+		dnload.write_ptr = dnload.data;
+		dnload.serial_fd.when &= ~BSC_FD_WRITE;
+		if (dnload.romload_state == SENDING_LAST_BLOCK) {
+			dnload.romload_state = LAST_BLOCK_SENT;
+			printf("Finished, sent %i blocks in total\n",
+				dnload.block_number);
+		} else {
+			dnload.romload_state = WAITING_BLOCK_ACK;
+		}
+
+		return 0;
+	}
+
+	/* try to write a maximum of block_len bytes */
+	bytes_left = (dnload.block + dnload.block_len) - dnload.block_ptr;
+	write_len = dnload.block_len;
+	if (bytes_left < dnload.block_len)
+		write_len = bytes_left;
+
+	rc = write(dnload.serial_fd.fd, dnload.block_ptr, write_len);
+	if (rc < 0) {
+		perror("Error during write");
+		return rc;
+	}
+
+	dnload.block_ptr += rc;
+
+	return 0;
+}
+
+#define WRITE_BLOCK	4096
+
+static int handle_write_dnload(void)
+{
+	int bytes_left, write_len, rc;
+	uint8_t xor_init = 0x02;
+
+	printf("handle_write(): ");
+	if (dnload.write_ptr == dnload.data) {
+		/* no bytes have been transferred yet */
+		switch (dnload.mode) {
+		case MODE_C155:
+		case MODE_C140xor:
+		case MODE_C123xor:
+			rc = write(dnload.serial_fd.fd, &xor_init, 1);
+			break;
+		default:
+			break;
+		}
+	} else if (dnload.write_ptr >= dnload.data + dnload.data_len) { 
+		printf("finished\n");
+		dnload.write_ptr = dnload.data;
+		dnload.serial_fd.when &= ~BSC_FD_WRITE;
+		return 1;
+	}
+
+	/* try to write a maximum of WRITE_BLOCK bytes */
+	bytes_left = (dnload.data + dnload.data_len) - dnload.write_ptr;
+	write_len = WRITE_BLOCK;
+	if (bytes_left < WRITE_BLOCK)
+		write_len = bytes_left;
+
+	rc = write(dnload.serial_fd.fd, dnload.write_ptr, write_len);
+	if (rc < 0) {
+		perror("Error during write");
+		return rc;
+	}
+
+	dnload.write_ptr += rc;
+
+	printf("%u bytes (%lu/%u)\n", rc, dnload.write_ptr - dnload.data,
+		dnload.data_len);
+
+	return 0;
+}
+
+static int handle_sercomm_write(void)
+{
+	uint8_t buffer[256];
+	int i, count = 0, end = 0;
+
+	for (i = 0; i < sizeof(buffer); i++) {
+		if (sercomm_drv_pull(&buffer[i]) == 0) {
+			end = 1;
+			break;
+		}
+		count++;
+	}
+
+	if (count) {
+		if (write(dnload.serial_fd.fd, buffer, count) != count)
+			perror("short write");
+	}
+
+	if (end)
+		dnload.serial_fd.when &= ~BSC_FD_WRITE;
+
+	return 0;
+}
+
+static int handle_write(void)
+{
+	/* TODO: simplify this again (global state: downloading, sercomm) */
+	switch (dnload.mode) {
+	case MODE_ROMLOAD:
+		switch (dnload.romload_state) {
+		case SENDING_BLOCKS:
+		case SENDING_LAST_BLOCK:
+			return handle_write_block();
+		default:
+			return handle_sercomm_write();
+		}
+		break;
+	case MODE_MTK:
+		switch (dnload.mtk_state) {
+		case MTK_SENDING_BLOCKS:
+			return handle_write_block();
+		default:
+			return handle_sercomm_write();
+		}
+		break;
+	default:
+		switch (dnload.state) {
+		case DOWNLOADING:
+			return handle_write_dnload();
+		default:
+			return handle_sercomm_write();
+		}
+	}
+
+	return 0;
+}
+
+static uint8_t buffer[sizeof(phone_prompt1)];
+static uint8_t *bufptr = buffer;
+
+static void hdlc_send_to_phone(uint8_t dlci, uint8_t *data, int len)
+{
+	struct msgb *msg;
+	uint8_t *dest;
+
+	if(dnload.dump_tx) {
+		printf("hdlc_send(dlci=%u): ", dlci);
+		osmocon_osmo_hexdump(data, len);
+	}
+
+	if (len > 512) {
+		fprintf(stderr, "Too much data to send. %u\n", len);
+		return;
+	}
+
+	/* push the message into the stack */
+	msg = sercomm_alloc_msgb(512);
+	if (!msg) {
+		fprintf(stderr, "Failed to create data for the frame.\n");
+		return;
+	}
+
+	/* copy the data */
+	dest = msgb_put(msg, len);
+	memcpy(dest, data, len);
+
+	sercomm_sendmsg(dlci, msg);
+
+	dnload.serial_fd.when |= BSC_FD_WRITE;
+}
+
+static void hdlc_console_cb(uint8_t dlci, struct msgb *msg)
+{
+	write(1, msg->data, msg->len);
+	msgb_free(msg);
+}
+
+static void hdlc_tool_cb(uint8_t dlci, struct msgb *msg)
+{
+	struct tool_server *srv = tool_server_for_dlci[dlci];
+
+	if(dnload.dump_rx) {
+		printf("hdlc_recv(dlci=%u): ", dlci);
+		osmocon_osmo_hexdump(msg->data, msg->len);
+	}
+
+	if(srv) {
+		struct tool_connection *con;
+		uint16_t *len;
+
+		len = (uint16_t *) msgb_push(msg, 2);
+		*len = htons(msg->len - sizeof(*len));
+
+		llist_for_each_entry(con, &srv->connections, entry) {
+			if (write(con->fd.fd, msg->data, msg->len) != msg->len) {
+				fprintf(stderr,
+					"Failed to write msg to the socket..\n");
+				continue;
+			}
+		}
+	}
+
+	msgb_free(msg);
+}
+
+static int handle_buffer(int buf_used_len)
+{
+	int nbytes, buf_left, i;
+
+	buf_left = buf_used_len - (bufptr - buffer);
+	if (buf_left <= 0) {
+		memmove(buffer, buffer+1, buf_used_len-1);
+		bufptr -= 1;
+		buf_left = 1;
+	}
+
+	nbytes = read(dnload.serial_fd.fd, bufptr, buf_left);
+	if (nbytes <= 0)
+		return nbytes;
+
+	if (!dnload.expect_hdlc) {
+		printf("got %i bytes from modem, ", nbytes);
+		printf("data looks like: ");
+		osmocon_osmo_hexdump(bufptr, nbytes);
+	} else {
+		for (i = 0; i < nbytes; ++i)
+			if (sercomm_drv_rx_char(bufptr[i]) == 0)
+				printf("Dropping sample '%c'\n", bufptr[i]);
+	}
+
+	return nbytes;
+}
+
+/* Compal ramloader */
+static int handle_read(void)
+{
+	int rc, nbytes;
+
+	nbytes = handle_buffer(sizeof(buffer));
+	if (nbytes <= 0)
+		return nbytes;
+
+	if (!memcmp(buffer, phone_prompt1, sizeof(phone_prompt1))) {
+		printf("Received PROMPT1 from phone, responding with CMD\n");
+		dnload.expect_hdlc = 0;
+		dnload.state = WAITING_PROMPT2;
+		if(dnload.filename) {
+			rc = write(dnload.serial_fd.fd, dnload_cmd, sizeof(dnload_cmd));
+
+			/* re-read file */
+			rc = read_file(dnload.filename, dnload.do_chainload);
+			if (rc < 0) {
+				fprintf(stderr, "read_file(%s) failed with %d\n",
+						dnload.filename, rc);
+				exit(1);
+			}
+		}
+	} else if (!memcmp(buffer, phone_prompt2, sizeof(phone_prompt2))) {
+		printf("Received PROMPT2 from phone, starting download\n");
+		dnload.serial_fd.when = BSC_FD_READ | BSC_FD_WRITE;
+		dnload.state = DOWNLOADING;
+	} else if (!memcmp(buffer, phone_ack, sizeof(phone_ack))) {
+		printf("Received DOWNLOAD ACK from phone, your code is"
+			" running now!\n");
+		dnload.serial_fd.when = BSC_FD_READ;
+		dnload.state = WAITING_PROMPT1;
+		dnload.write_ptr = dnload.data;
+		dnload.expect_hdlc = 1;
+
+		/* check for romloader chainloading mode used as a workaround
+		 * for the magic on the C139/C140 and J100i */
+		if (dnload.do_chainload) {
+			printf("Enabled Compal ramloader -> Calypso romloader"
+				" chainloading mode\n");
+			bufptr = buffer;
+			dnload.previous_mode = dnload.mode;
+			dnload.mode = MODE_ROMLOAD;
+			osmo_serial_set_baudrate(dnload.serial_fd.fd, ROMLOAD_INIT_BAUDRATE);
+			tick_timer.cb = &beacon_timer_cb;
+			tick_timer.data = &tick_timer;
+			osmo_timer_schedule(&tick_timer, 0, dnload.beacon_interval);
+		}
+	} else if (!memcmp(buffer, phone_nack, sizeof(phone_nack))) {
+		printf("Received DOWNLOAD NACK from phone, something went"
+			" wrong :(\n");
+		dnload.serial_fd.when = BSC_FD_READ;
+		dnload.state = WAITING_PROMPT1;
+		dnload.write_ptr = dnload.data;
+	} else if (!memcmp(buffer, phone_nack_magic, sizeof(phone_nack_magic))) {
+		printf("Received MAGIC NACK from phone, you need to"
+			" have \"1003\" at 0x803ce0\n");
+		dnload.serial_fd.when = BSC_FD_READ;
+		dnload.state = WAITING_PROMPT1;
+		dnload.write_ptr = dnload.data;
+	} else if (!memcmp(buffer, ftmtool, sizeof(ftmtool))) {
+		printf("Received FTMTOOL from phone, ramloader has aborted\n");
+		dnload.serial_fd.when = BSC_FD_READ;
+		dnload.state = WAITING_PROMPT1;
+		dnload.write_ptr = dnload.data;
+	}
+	bufptr += nbytes;
+
+	return nbytes;
+}
+
+/* "Calypso non-secure romloader" */
+static int handle_read_romload(void)
+{
+	int rc, nbytes, buf_used_len;
+
+	/* virtually limit buffer length for romloader, since responses
+	 * are shorter and vary in length */
+
+	switch (dnload.romload_state) {
+	case WAITING_PARAM_ACK:
+		buf_used_len = 4;	/* ">p" + uint16_t len */
+		break;
+	case WAITING_CHECKSUM_ACK:
+		buf_used_len = 3;	/* ">c" + uint8_t checksum */
+		break;
+	case FINISHED:
+		buf_used_len = sizeof(buffer);
+		break;
+	default:
+		buf_used_len = 2;	/* ">*" */
+	}
+
+	nbytes = handle_buffer(buf_used_len);
+	if (nbytes <= 0)
+		return nbytes;
+
+	switch (dnload.romload_state) {
+	case WAITING_IDENTIFICATION:
+		if (memcmp(buffer, romload_ident_ack,
+			    sizeof(romload_ident_ack)))
+			break;
+
+		printf("Received ident ack from phone, sending "
+			"parameter sequence\n");
+		dnload.expect_hdlc = 1;
+		dnload.romload_state = WAITING_PARAM_ACK;
+		rc = write(dnload.serial_fd.fd, romload_param,
+			   sizeof(romload_param));
+		/* re-read file */
+		rc = read_file(dnload.filename, 0);
+		if (rc < 0) {
+			fprintf(stderr, "read_file(%s) failed with %d\n",
+				dnload.filename, rc);
+			exit(1);
+		}
+		break;
+	case WAITING_PARAM_ACK:
+		if (memcmp(buffer, romload_param_ack,
+			    sizeof(romload_param_ack)))
+			break;
+
+		printf("Received parameter ack from phone, "
+			"starting download\n");
+		osmo_serial_set_baudrate(dnload.serial_fd.fd, ROMLOAD_DL_BAUDRATE);
+
+		/* using the max blocksize the phone tells us */
+		dnload.block_payload_size = ((buffer[3] << 8) + buffer[2]);
+		dnload.block_payload_size -= ROMLOAD_BLOCK_HDR_LEN;
+		dnload.romload_state = SENDING_BLOCKS;
+		dnload.block_number = 0;
+		romload_prepare_block();
+		bufptr -= 2;
+		break;
+	case WAITING_BLOCK_ACK:
+	case LAST_BLOCK_SENT:
+		if (!memcmp(buffer, romload_block_ack,
+			    sizeof(romload_block_ack))) {
+			if (dnload.romload_state == LAST_BLOCK_SENT) {
+				/* send the checksum */
+				uint8_t final_checksum =
+					(~(dnload.romload_dl_checksum) & 0xff);
+				rc = write(dnload.serial_fd.fd,
+					   romload_checksum_cmd,
+					   sizeof(romload_checksum_cmd));
+				rc = write(dnload.serial_fd.fd,
+					   &final_checksum, 1);
+				dnload.romload_state = WAITING_CHECKSUM_ACK;
+			} else
+				romload_prepare_block();
+		} else if (!memcmp(buffer, romload_block_nack,
+				   sizeof(romload_block_nack))) {
+			printf("Received block nack from phone, "
+				"something went wrong, aborting\n");
+			osmo_serial_set_baudrate(dnload.serial_fd.fd, ROMLOAD_INIT_BAUDRATE);
+			dnload.romload_state = WAITING_IDENTIFICATION;
+			osmo_timer_schedule(&tick_timer, 0, dnload.beacon_interval);
+		}
+		break;
+	case WAITING_CHECKSUM_ACK:
+		if (!memcmp(buffer, romload_checksum_ack,
+			    sizeof(romload_checksum_ack))) {
+
+			rc = write(dnload.serial_fd.fd, romload_branch_cmd,
+				   sizeof(romload_branch_cmd));
+			rc = write(dnload.serial_fd.fd, &dnload.load_address,
+				   sizeof(dnload.load_address));
+			dnload.romload_state = WAITING_BRANCH_ACK;
+			bufptr -= 1;
+		} else if (!memcmp(buffer, romload_checksum_nack,
+				   sizeof(romload_checksum_nack))) {
+			printf("Checksum on phone side (0x%02x) doesn't "
+				"match ours, aborting\n", ~buffer[2]);
+			osmo_serial_set_baudrate(dnload.serial_fd.fd, ROMLOAD_INIT_BAUDRATE);
+			dnload.romload_state = WAITING_IDENTIFICATION;
+			osmo_timer_schedule(&tick_timer, 0, dnload.beacon_interval);
+			bufptr -= 1;
+		}
+		break;
+	case WAITING_BRANCH_ACK:
+		if (!memcmp(buffer, romload_branch_ack,
+			    sizeof(romload_branch_ack))) {
+			printf("Received branch ack, your code is running now!\n");
+			dnload.serial_fd.when = BSC_FD_READ;
+			dnload.romload_state = FINISHED;
+			dnload.write_ptr = dnload.data;
+			dnload.expect_hdlc = 1;
+
+			if (!dnload.do_chainload)
+				break;
+
+			/* if using chainloading mode, switch back to the Compal
+			 * ramloader settings to make sure the auto-reload
+			 * feature works */
+			bufptr = buffer;
+			dnload.mode = dnload.previous_mode;
+			dnload.romload_state = WAITING_IDENTIFICATION;
+			osmo_serial_set_baudrate(dnload.serial_fd.fd, MODEM_BAUDRATE);
+		} else if (!memcmp(buffer, romload_branch_nack,
+			   sizeof(romload_branch_nack))) {
+			printf("Received branch nack, aborting\n");
+			osmo_serial_set_baudrate(dnload.serial_fd.fd, ROMLOAD_INIT_BAUDRATE);
+			dnload.romload_state = WAITING_IDENTIFICATION;
+			osmo_timer_schedule(&tick_timer, 0, dnload.beacon_interval);
+		}
+		break;
+	default:
+		break;
+	}
+
+	bufptr += nbytes;
+	return nbytes;
+}
+
+/* MTK romloader */
+static int handle_read_mtk(void)
+{
+	int rc, nbytes, buf_used_len;
+
+	switch (dnload.mtk_state) {
+	case MTK_WAIT_ADDR_ACK:
+	case MTK_WAIT_SIZE_ACK:
+	case MTK_WAIT_BRANCH_ADDR_ACK:
+		buf_used_len = 4;
+		break;
+	case MTK_FINISHED:
+		buf_used_len = sizeof(buffer);
+		break;
+	default:
+		buf_used_len = 1;
+	}
+
+	nbytes = handle_buffer(buf_used_len);
+	if (nbytes <= 0)
+		return nbytes;
+
+	switch (dnload.mtk_state) {
+	case MTK_INIT_1:
+		if (!(buffer[0] == mtk_init_resp[0]))
+			break;
+		dnload.mtk_state = MTK_INIT_2;
+		printf("Received init magic byte 1\n");
+		rc = write(dnload.serial_fd.fd, &mtk_init_cmd[1], 1);
+		break;
+	case MTK_INIT_2:
+		if (!(buffer[0] == mtk_init_resp[1]))
+			break;
+		dnload.mtk_state = MTK_INIT_3;
+		printf("Received init magic byte 2\n");
+		rc = write(dnload.serial_fd.fd, &mtk_init_cmd[2], 1);
+		break;
+	case MTK_INIT_3:
+		if (!(buffer[0] == mtk_init_resp[2]))
+			break;
+		dnload.mtk_state = MTK_INIT_4;
+		printf("Received init magic byte 3\n");
+		rc = write(dnload.serial_fd.fd, &mtk_init_cmd[3], 1);
+		break;
+	case MTK_INIT_4:
+		if (!(buffer[0] == mtk_init_resp[3]))
+			break;
+		dnload.mtk_state = MTK_WAIT_WRITE_ACK;
+		printf("Received init magic byte 4, requesting write\n");
+		rc = write(dnload.serial_fd.fd, &mtk_command[0], 1);
+		break;
+	case MTK_WAIT_WRITE_ACK:
+		if (!(buffer[0] == mtk_command[0]))
+			break;
+		dnload.mtk_state = MTK_WAIT_ADDR_ACK;
+		printf("Received write ack, sending load address\n");
+
+		rc = write(dnload.serial_fd.fd, &dnload.load_address,
+			   sizeof(dnload.load_address));
+		break;
+	case MTK_WAIT_ADDR_ACK:
+		if (memcmp(buffer, dnload.load_address,
+			    sizeof(dnload.load_address)))
+			break;
+		printf("Received address ack from phone, sending loadsize\n");
+		/* re-read file */
+		rc = read_file(dnload.filename, 0);
+		if (rc < 0) {
+			fprintf(stderr, "read_file(%s) failed with %d\n",
+				dnload.filename, rc);
+			exit(1);
+		}
+		dnload.block_number = 0;
+		mtk_prepare_block();
+		dnload.mtk_state = MTK_WAIT_SIZE_ACK;
+		rc = write(dnload.serial_fd.fd, &dnload.mtk_send_size,
+			   sizeof(dnload.mtk_send_size));
+		break;
+	case MTK_WAIT_SIZE_ACK:
+		if (memcmp(buffer, dnload.mtk_send_size,
+			    sizeof(dnload.mtk_send_size)))
+			break;
+		printf("Received size ack\n");
+		dnload.expect_hdlc = 1;
+		dnload.mtk_state = MTK_SENDING_BLOCKS;
+		dnload.serial_fd.when = BSC_FD_READ | BSC_FD_WRITE;
+		bufptr -= 3;
+		break;
+	case MTK_SENDING_BLOCKS:
+		if (!(buffer[0] == dnload.block[dnload.echo_bytecount]))
+			printf("Warning: Byte %i of Block %i doesn't match,"
+				" check your serial connection!\n",
+				dnload.echo_bytecount, dnload.block_number);
+		dnload.echo_bytecount++;
+
+		if ((dnload.echo_bytecount+1) > MTK_BLOCK_SIZE) {
+			if ( dnload.block_number == dnload.block_count) {
+				rc = write(dnload.serial_fd.fd,
+					   &mtk_command[3], 1);
+				printf("Sending branch command\n");
+				dnload.expect_hdlc = 0;
+				dnload.mtk_state = MTK_WAIT_BRANCH_CMD_ACK;
+				break;
+			}
+			printf("Received Block %i preparing next block\n",
+				dnload.block_number);
+			mtk_prepare_block();
+			dnload.serial_fd.when = BSC_FD_READ | BSC_FD_WRITE;
+		}
+		break;
+	case MTK_WAIT_BRANCH_CMD_ACK:
+		if (!(buffer[0] == mtk_command[3]))
+			break;
+		dnload.mtk_state = MTK_WAIT_BRANCH_ADDR_ACK;
+		printf("Received branch command ack, sending address\n");
+
+		rc = write(dnload.serial_fd.fd, &dnload.load_address,
+			   sizeof(dnload.load_address));
+		break;
+	case MTK_WAIT_BRANCH_ADDR_ACK:
+		if (memcmp(buffer, dnload.load_address,
+			    sizeof(dnload.load_address)))
+			break;
+		printf("Received branch address ack, code should run now\n");
+		osmo_serial_set_baudrate(dnload.serial_fd.fd, MODEM_BAUDRATE);
+		dnload.serial_fd.when = BSC_FD_READ;
+		dnload.mtk_state = MTK_FINISHED;
+		dnload.write_ptr = dnload.data;
+		dnload.expect_hdlc = 1;
+		break;
+	default:
+		break;
+	}
+
+	bufptr += nbytes;
+	return nbytes;
+}
+
+static int serial_read(struct osmo_fd *fd, unsigned int flags)
+{
+	int rc;
+	if (flags & BSC_FD_READ) {
+		switch (dnload.mode) {
+			case MODE_ROMLOAD:
+				while ((rc = handle_read_romload()) > 0);
+				break;
+			case MODE_MTK:
+				while ((rc = handle_read_mtk()) > 0);
+				break;
+			default:
+				while ((rc = handle_read()) > 0);
+				break;
+		}
+		if (rc == 0)
+			exit(2);
+	}
+
+	if (flags & BSC_FD_WRITE) {
+		rc = handle_write();
+		if (rc == 1)
+			dnload.state = WAITING_PROMPT1;
+	}
+	return 0;
+}
+
+static int parse_mode(const char *arg)
+{
+	if (!strcasecmp(arg, "c123"))
+		return MODE_C123;
+	else if (!strcasecmp(arg, "c123xor"))
+		return MODE_C123xor;
+	else if (!strcasecmp(arg, "c140"))
+		return MODE_C140;
+	else if (!strcasecmp(arg, "c140xor"))
+		return MODE_C140xor;
+	else if (!strcasecmp(arg, "c155"))
+		return MODE_C155;
+	else if (!strcasecmp(arg, "romload"))
+		return MODE_ROMLOAD;
+	else if (!strcasecmp(arg, "mtk"))
+		return MODE_MTK;
+
+	return MODE_INVALID;
+}
+
+#define HELP_TEXT \
+	"[ -v | -h ] [ -d [t][r] ] [ -p /dev/ttyXXXX ]\n" \
+	"\t\t [ -c ] (enable chainloading of highram-images)\n" \
+	"\t\t [ -s /tmp/osmocom_l2 ]\n" \
+	"\t\t [ -l /tmp/osmocom_loader ]\n" \
+	"\t\t [ -m {c123,c123xor,c140,c140xor,c155,romload,mtk} ]\n" \
+	"\t\t [ -i beacon-interval (mS) ]\n" \
+	"\t\t  file.bin\n\n" \
+	"* Open serial port /dev/ttyXXXX (connected to your phone)\n" \
+	"* Perform handshaking with the ramloader in the phone\n" \
+	"* Download file.bin to the attached phone (base address 0x00800100)\n"
+
+static int usage(const char *name)
+{
+	printf("Usage: %s ", name);
+	printf(HELP_TEXT);
+	exit(2);
+}
+
+static int version(const char *name)
+{
+	printf("%s version %s\n", name, PACKAGE_VERSION);
+	exit(2);
+}
+
+static int un_tool_read(struct osmo_fd *fd, unsigned int flags)
+{
+	int rc, c;
+	uint16_t length = 0xffff;
+	uint8_t buf[4096];
+	struct tool_connection *con = (struct tool_connection *)fd->data;
+
+	c = 0;
+	while(c < 2) {
+		rc = read(fd->fd, &buf + c, 2 - c);
+		if(rc == 0) {
+			// disconnect
+			goto close;
+		}
+		if(rc < 0) {
+			if(errno == EAGAIN) {
+				continue;
+			}
+			fprintf(stderr, "Err from socket: %s\n", strerror(errno));
+			goto close;
+		}
+		c += rc;
+	}
+
+	memcpy(&length, buf, sizeof length);
+	length = ntohs(length);
+
+	c = 0;
+	while(c < length) {
+		rc = read(fd->fd, &buf + c, length - c);
+		if(rc == 0) {
+			// disconnect
+			goto close;
+		}
+		if(rc < 0) {
+			if(errno == EAGAIN) {
+				continue;
+			}
+			fprintf(stderr, "Err from socket: %s\n", strerror(errno));
+			goto close;
+		}
+		c += rc;
+	}
+
+	hdlc_send_to_phone(con->server->dlci, buf, length);
+
+	return 0;
+close:
+
+	close(fd->fd);
+	osmo_fd_unregister(fd);
+	llist_del(&con->entry);
+	talloc_free(con);
+	return -1;
+}
+
+/* accept a new connection */
+static int tool_accept(struct osmo_fd *fd, unsigned int flags)
+{
+	struct tool_server *srv = (struct tool_server *)fd->data;
+	struct tool_connection *con;
+	struct sockaddr_un un_addr;
+	socklen_t len;
+	int rc;
+
+	len = sizeof(un_addr);
+	rc = accept(fd->fd, (struct sockaddr *) &un_addr, &len);
+	if (rc < 0) {
+		fprintf(stderr, "Failed to accept a new connection.\n");
+		return -1;
+	}
+
+	con = talloc_zero(NULL, struct tool_connection);
+	if (!con) {
+		fprintf(stderr, "Failed to create tool connection.\n");
+		return -1;
+	}
+
+	con->server = srv;
+
+	con->fd.fd = rc;
+	con->fd.when = BSC_FD_READ;
+	con->fd.cb = un_tool_read;
+	con->fd.data = con;
+	if (osmo_fd_register(&con->fd) != 0) {
+		fprintf(stderr, "Failed to register the fd.\n");
+		return -1;
+	}
+
+	llist_add(&con->entry, &srv->connections);
+	return 0;
+}
+
+/*
+ * Register and start a tool server
+ */
+static int register_tool_server(struct tool_server *ts,
+				const char *path,
+				uint8_t dlci)
+{
+	struct osmo_fd *bfd = &ts->bfd;
+	int rc;
+
+	rc = osmo_sock_unix_init_ofd(bfd, SOCK_STREAM, 0, path, OSMO_SOCK_F_BIND);
+	if (rc < 0) {
+		fprintf(stderr, "Failed to create Unix Domain Socket.\n");
+		return -1;
+	}
+
+	bfd->cb = tool_accept;
+	bfd->data = ts;
+
+	ts->dlci = dlci;
+	INIT_LLIST_HEAD(&ts->connections);
+
+	tool_server_for_dlci[dlci] = ts;
+
+	sercomm_register_rx_cb(dlci, hdlc_tool_cb);
+
+	return 0;
+}
+
+extern void hdlc_tpudbg_cb(uint8_t dlci, struct msgb *msg);
+
+void parse_debug(const char *str)
+{
+	while(*str) {
+		switch(*str) {
+		case 't':
+			dnload.dump_tx = 1;
+			break;
+		case 'r':
+			dnload.dump_rx = 1;
+			break;
+		default:
+			printf("Unknown debug flag %c\n", *str);
+			abort();
+			break;
+		}
+		str++;
+	}
+}
+
+int main(int argc, char **argv)
+{
+	int opt, flags;
+	uint32_t tmp_load_address = ROMLOAD_ADDRESS;
+	const char *serial_dev = "/dev/ttyUSB1";
+	const char *layer2_un_path = "/tmp/osmocom_l2";
+	const char *loader_un_path = "/tmp/osmocom_loader";
+
+	dnload.mode = MODE_C123;
+	dnload.beacon_interval = DEFAULT_BEACON_INTERVAL;
+	dnload.do_chainload = 0;
+
+	osmo_init_ignore_signals();
+
+	while ((opt = getopt(argc, argv, "d:hl:p:m:cs:i:v")) != -1) {
+		switch (opt) {
+		case 'p':
+			serial_dev = optarg;
+			break;
+		case 'm':
+			dnload.mode = parse_mode(optarg);
+			if (dnload.mode == MODE_INVALID)
+				usage(argv[0]);
+			break;
+		case 's':
+			layer2_un_path = optarg;
+			break;
+		case 'l':
+			loader_un_path = optarg;
+			break;
+		case 'v':
+			version(argv[0]);
+			break;
+		case 'd':
+			parse_debug(optarg);
+			break;
+		case 'c':
+			dnload.do_chainload = 1;
+			break;
+		case 'i':
+			dnload.beacon_interval = atoi(optarg) * 1000;
+			break;
+		case 'h':
+		default:
+			usage(argv[0]);
+			break;
+		}
+	}
+
+	if (argc <= optind) {
+		dnload.filename = NULL;
+	} else {
+		dnload.filename = argv[optind];
+	}
+
+	dnload.serial_fd.fd = osmo_serial_init(serial_dev, MODEM_BAUDRATE);
+	if (dnload.serial_fd.fd < 0) {
+		fprintf(stderr, "Cannot open serial device %s\n", serial_dev);
+		exit(1);
+	}
+
+	if (osmo_fd_register(&dnload.serial_fd) != 0) {
+		fprintf(stderr, "Failed to register the serial.\n");
+		exit(1);
+	}
+
+	/* Set serial socket to non-blocking mode of operation */
+	flags = fcntl(dnload.serial_fd.fd, F_GETFL);
+	flags |= O_NONBLOCK;
+	fcntl(dnload.serial_fd.fd, F_SETFL, flags);
+
+	dnload.serial_fd.when = BSC_FD_READ;
+	dnload.serial_fd.cb = serial_read;
+
+	/* initialize the HDLC layer */
+	sercomm_init();
+	sercomm_register_rx_cb(SC_DLCI_CONSOLE, hdlc_console_cb);
+	sercomm_register_rx_cb(SC_DLCI_DEBUG, hdlc_tpudbg_cb);
+
+	/* unix domain socket handling */
+	if (register_tool_server(&dnload.layer2_server, layer2_un_path,
+				 SC_DLCI_L1A_L23) != 0)
+		exit(1);
+
+	if (register_tool_server(&dnload.loader_server, loader_un_path,
+				 SC_DLCI_LOADER) != 0)
+		exit(1);
+
+	/* if in romload mode, start our beacon timer */
+	if (dnload.mode == MODE_ROMLOAD) {
+		tmp_load_address = ROMLOAD_ADDRESS;
+		osmo_serial_set_baudrate(dnload.serial_fd.fd, ROMLOAD_INIT_BAUDRATE);
+		tick_timer.cb = &beacon_timer_cb;
+		tick_timer.data = &tick_timer;
+		osmo_timer_schedule(&tick_timer, 0, dnload.beacon_interval);
+	}
+	else if (dnload.mode == MODE_MTK) {
+		tmp_load_address = MTK_ADDRESS;
+		osmo_serial_set_baudrate(dnload.serial_fd.fd, MTK_INIT_BAUDRATE);
+		tick_timer.cb = &mtk_timer_cb;
+		tick_timer.data = &tick_timer;
+		osmo_timer_schedule(&tick_timer, 0, dnload.beacon_interval);
+	}
+
+	dnload.load_address[0] = (tmp_load_address >> 24) & 0xff;
+	dnload.load_address[1] = (tmp_load_address >> 16) & 0xff;
+	dnload.load_address[2] = (tmp_load_address >> 8) & 0xff;
+	dnload.load_address[3] = tmp_load_address & 0xff;
+
+	while (1) {
+		if (osmo_select_main(0) < 0)
+			break;
+	}
+
+	close(dnload.serial_fd.fd);
+
+	exit(0);
+}
diff --git a/src/host/osmocon/osmoload.c b/src/host/osmocon/osmoload.c
new file mode 100644
index 00000000..d320b298
--- /dev/null
+++ b/src/host/osmocon/osmoload.c
@@ -0,0 +1,1201 @@
+/* control utility for the Calypso bootloader */
+
+/* (C) 2010 by Ingo Albrecht <prom@berlin.ccc.de>
+ * (C) 2018 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <getopt.h>
+
+#include <arpa/inet.h>
+
+#include <sys/stat.h>
+
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/crc16.h>
+#include <osmocom/core/socket.h>
+
+#include <loader/protocol.h>
+
+#define MSGB_MAX 256
+
+#define MEM_MSG_MAX (MSGB_MAX - 16)
+
+#define DEFAULT_SOCKET "/tmp/osmocom_loader"
+
+static struct osmo_fd connection;
+
+enum {
+	STATE_INIT,
+	STATE_QUERY_PENDING,
+	STATE_DUMP_IN_PROGRESS,
+	STATE_LOAD_IN_PROGRESS,
+	STATE_FLASHRANGE_GET_INFO,
+	STATE_FLASHRANGE_IN_PROGRESS,
+	STATE_PROGRAM_GET_INFO,
+	STATE_PROGRAM_IN_PROGRESS,
+	STATE_DUMPING,
+};
+
+struct flashblock {
+	uint8_t fb_chip;
+	uint32_t fb_offset;
+	uint32_t fb_addr;
+	uint32_t fb_size;
+};
+
+static struct {
+	/* debug flags */
+	unsigned char print_requests;
+	unsigned char print_replies;
+
+	/* quit flag for main loop */
+	unsigned char quit;
+
+	/* main state machine */
+	int state;
+
+	/* pending query command */
+	uint8_t command;
+
+	/* general timeout */
+	struct osmo_timer_list timeout;
+
+	/* binary i/o for firmware images */
+	FILE *binfile;
+	/* buffer containing binfile data */
+	char *binbuf;
+
+	/* memory operation state */
+	uint8_t  memchip; /* target chip (for flashes) */
+	uint32_t membase; /* target base address of operation */
+	uint32_t memlen;  /* length of entire operation */
+	uint32_t memoff;  /* offset for next request */
+	uint16_t memcrc;  /* crc for current request */
+	uint16_t memreq;  /* length of current request */
+
+	/* array of all flash blocks */
+	uint8_t flashcommand;
+	uint32_t numblocks;
+	struct flashblock blocks[512];
+} osmoload;
+
+static int usage(const char *name)
+{
+	printf("Usage: %s [ -v | -h ] [ -d tr ] [ -m {c123,c155} ] [ -l /tmp/osmocom_loader ] COMMAND ...\n", name);
+
+	puts("\n  Memory commands:");
+	puts("    memget <hex-address> <hex-length>        - Peek at memory");
+	puts("    memput <hex-address> <hex-bytes>         - Poke at memory");
+	puts("    memdump <hex-address> <hex-length> <file>- Dump memory to file");
+	puts("    memload <hex-address> <file>             - Load file into memory");
+
+	puts("\n  Flash commands:");
+	puts("    finfo                             - Information about flash chips");
+	puts("    funlock <address> <length>        - Unlock flash block");
+	puts("    flock <address> <length>          - Lock flash block");
+	puts("    flockdown <address> <length>      - Lock down flash block");
+	puts("    fgetlock <address> <length>       - Get locking state of block");
+	puts("    ferase <address> <length>         - Erase flash range");
+	puts("    fprogram <chip> <address> <file>  - Program file into flash");
+
+	puts("\n  Execution commands:");
+	puts("    jump <hex-address>                 - Jump to address");
+	puts("    jumpflash                          - Jump to flash loader");
+	puts("    jumprom                            - Jump to rom loader");
+
+	puts("\n  Device lifecycle:");
+	puts("    ping                               - Ping the loader");
+	puts("    reset                              - Reset device");
+	puts("    off                                - Power off device");
+
+	puts("\n  Debug:");
+	puts("    dump                               - Dump loader traffic to console");
+
+	exit(2);
+}
+
+static int version(const char *name)
+{
+	//printf("\n%s version %s\n", name, VERSION);
+	exit(2);
+}
+
+static void osmoload_osmo_hexdump(const uint8_t *data, unsigned int len)
+{
+	const uint8_t *bufptr = data;
+	const uint8_t *endptr = bufptr + len;
+	int n, m, i, hexchr;
+
+	for (n=0; n < len; n+=32, bufptr += 32) {
+		hexchr = 0;
+		for(m = 0; m < 32 && bufptr < endptr; m++, bufptr++) {
+			if((m) && !(m%4)) {
+				putchar(' ');
+				hexchr++;
+			}
+			printf("%02x", *bufptr);
+			hexchr+=2;
+		}
+		bufptr -= m;
+		int n = 71 - hexchr;
+		for(i = 0; i < n; i++) {
+			putchar(' ');
+		}
+
+		putchar(' ');
+
+		for(m = 0; m < 32 && bufptr < endptr; m++, bufptr++) {
+			if(isgraph(*bufptr)) {
+				putchar(*bufptr);
+			} else {
+				putchar('.');
+			}
+		}
+		bufptr -= m;
+
+		putchar('\n');
+	}
+}
+
+static void
+loader_send_request(struct msgb *msg) {
+	int rc;
+	uint16_t len = htons(msg->len);
+
+	if(osmoload.print_requests) {
+		printf("Sending %d bytes:\n", msg->len);
+		osmoload_osmo_hexdump(msg->data, msg->len);
+	}
+
+	rc = write(connection.fd, &len, sizeof(len));
+	if(rc != sizeof(len)) {
+		fprintf(stderr, "Error writing.\n");
+		exit(2);
+	}
+
+	rc = write(connection.fd, msg->data, msg->len);
+	if(rc != msg->len) {
+		fprintf(stderr, "Error writing.\n");
+		exit(2);
+	}
+}
+
+static void loader_do_memdump(uint16_t crc, void *address, size_t length);
+static void loader_do_memload();
+static void loader_do_fprogram();
+static void loader_do_flashrange(uint8_t cmd, struct msgb *msg, uint8_t chip, uint32_t address, uint32_t status);
+
+static void memop_timeout(void *dummy) {
+	switch(osmoload.state) {
+	case STATE_LOAD_IN_PROGRESS:
+		printf("Timeout. Repeating.");
+		osmoload.memoff -= osmoload.memreq;
+		loader_do_memload();
+		break;
+	default:
+		break;
+	}
+	return;
+}
+
+static void
+loader_parse_flash_info(struct msgb *msg) {
+	uint8_t nchips;
+
+	nchips = msgb_pull_u8(msg);
+
+	osmoload.numblocks = 0;
+
+	int chip;
+	for(chip = 0; chip < nchips; chip++) {
+
+		uint32_t address;
+		address = msgb_pull_u32(msg);
+
+		uint32_t chipsize;
+		chipsize = msgb_pull_u32(msg);
+
+		uint8_t nregions;
+		nregions = msgb_pull_u8(msg);
+
+		printf("    chip %d at 0x%8.8x of %d bytes in %d regions\n", chip, address, chipsize, nregions);
+
+		uint32_t curoffset = 0;
+		int region;
+		for(region = 0; region < nregions; region++) {
+			uint16_t blockcount = msgb_pull_u32(msg);
+			uint32_t blocksize = msgb_pull_u32(msg);
+
+			printf("      region %d with %d blocks of %d bytes each\n", region, blockcount, blocksize);
+
+			int block;
+			for(block = 0; block < blockcount; block++) {
+				osmoload.blocks[osmoload.numblocks].fb_chip   = chip;
+				osmoload.blocks[osmoload.numblocks].fb_offset = curoffset;
+				osmoload.blocks[osmoload.numblocks].fb_addr   = address + curoffset;
+				osmoload.blocks[osmoload.numblocks].fb_size   = blocksize;
+
+				printf("        block %d with %d bytes at 0x%8.8x on chip %d\n",
+					   osmoload.numblocks, blocksize, address + curoffset, chip);
+
+				curoffset += blocksize;
+
+				osmoload.numblocks++;
+			}
+		}
+	}
+}
+
+
+static void
+loader_handle_reply(struct msgb *msg) {
+	if(osmoload.print_replies) {
+		printf("Received %d bytes:\n", msg->len);
+		osmoload_osmo_hexdump(msg->data, msg->len);
+	}
+
+	uint8_t cmd = msgb_pull_u8(msg);
+
+	uint8_t chip;
+	uint8_t length;
+	uint16_t crc;
+	uint32_t address;
+	uint32_t entrypoint;
+	uint32_t status;
+
+	void *data;
+
+	switch(cmd) {
+	case LOADER_INIT:
+		address = msgb_pull_u32(msg);
+		entrypoint = msgb_pull_u32(msg);
+		printf("Loader at entry %x has been started, requesting load to %x\n", entrypoint, address);
+		break;
+	case LOADER_PING:
+	case LOADER_RESET:
+	case LOADER_POWEROFF:
+	case LOADER_ENTER_ROM_LOADER:
+	case LOADER_ENTER_FLASH_LOADER:
+		break;
+	case LOADER_MEM_READ:
+		length = msgb_pull_u8(msg);
+		crc = msgb_pull_u16(msg);
+		address = msgb_pull_u32(msg);
+		data = msgb_pull(msg, length) - length;
+		break;
+	case LOADER_MEM_WRITE:
+		length = msgb_pull_u8(msg);
+		crc = msgb_pull_u16(msg);
+		address = msgb_pull_u32(msg);
+		break;
+	case LOADER_JUMP:
+		address = msgb_pull_u32(msg);
+		break;
+	case LOADER_FLASH_INFO:
+		break;
+	case LOADER_FLASH_GETLOCK:
+	case LOADER_FLASH_ERASE:
+	case LOADER_FLASH_UNLOCK:
+	case LOADER_FLASH_LOCK:
+	case LOADER_FLASH_LOCKDOWN:
+		chip = msgb_pull_u8(msg);
+		address = msgb_pull_u32(msg);
+		status = msgb_pull_u32(msg);
+		break;
+	case LOADER_FLASH_PROGRAM:
+		length = msgb_pull_u8(msg);
+		crc = msgb_pull_u16(msg);
+		msgb_pull_u8(msg); // XXX align
+		chip = msgb_pull_u8(msg);
+		address = msgb_pull_u32(msg);
+		status = msgb_pull_u32(msg);
+		break;
+	default:
+		printf("Received unknown reply %d:\n", cmd);
+		osmoload_osmo_hexdump(msg->data, msg->len);
+		osmoload.quit = 1;
+		return;
+	}
+
+	switch(osmoload.state) {
+	case STATE_QUERY_PENDING:
+	case STATE_DUMPING:
+		switch(cmd) {
+		case LOADER_PING:
+			printf("Received pong.\n");
+			break;
+		case LOADER_RESET:
+			printf("Reset confirmed.\n");
+			break;
+		case LOADER_POWEROFF:
+			printf("Poweroff confirmed.\n");
+			break;
+		case LOADER_ENTER_ROM_LOADER:
+			printf("Jump to ROM loader confirmed.\n");
+			break;
+		case LOADER_ENTER_FLASH_LOADER:
+			printf("Jump to flash loader confirmed.\n");
+			break;
+		case LOADER_MEM_READ:
+			printf("Received memory dump of %d bytes at 0x%x:\n", length, address);
+			osmoload_osmo_hexdump(data, length);
+			break;
+		case LOADER_MEM_WRITE:
+			printf("Confirmed memory write of %d bytes at 0x%x.\n", length, address);
+			break;
+		case LOADER_JUMP:
+			printf("Confirmed jump to 0x%x.\n", address);
+			break;
+		case LOADER_FLASH_ERASE:
+			printf("Confirmed flash erase of chip %d address 0x%8.8x, status %s\n",
+				   chip, address, status ? "FAILED" : "ok");
+			break;
+		case LOADER_FLASH_GETLOCK:
+			printf("Lock state of chip %d address 0x%8.8x is %s\n",
+				   chip, address, (status == LOADER_FLASH_LOCKED ? "locked"
+								   : (status == LOADER_FLASH_LOCKED_DOWN ? "locked down"
+									  : (status == LOADER_FLASH_UNLOCKED ? "unlocked"
+										 : "UNKNOWN"))));
+			break;
+		case LOADER_FLASH_UNLOCK:
+			printf("Confirmed flash unlock of chip %d address 0x%8.8x, status %s\n",
+				   chip, address, status ? "FAILED" : "ok");
+			break;
+		case LOADER_FLASH_LOCK:
+			printf("Confirmed flash lock of chip %d address 0x%8.8x, status %s\n",
+				   chip, address, status ? "FAILED" : "ok");
+			break;
+		case LOADER_FLASH_LOCKDOWN:
+			printf("Confirmed flash lockdown of chip %d address 0x%8.8x, status %s\n",
+				   chip, address, status ? "FAILED" : "ok");
+			break;
+		case LOADER_FLASH_INFO:
+			loader_parse_flash_info(msg);
+			break;
+		default:
+			break;
+		}
+		if(osmoload.state == STATE_QUERY_PENDING) {
+			if(osmoload.command == cmd) {
+				osmoload.quit = 1;
+			}
+		}
+		break;
+	case STATE_DUMP_IN_PROGRESS:
+		if(cmd == LOADER_MEM_READ) {
+			loader_do_memdump(crc, data, length);
+		}
+		break;
+	case STATE_LOAD_IN_PROGRESS:
+		if(cmd == LOADER_MEM_WRITE) {
+			if(osmoload.memcrc != crc) {
+				osmoload.memoff -= osmoload.memreq;
+				printf("\nbad crc %4.4x (not %4.4x) at offset 0x%8.8x", crc, osmoload.memcrc, osmoload.memoff);
+			} else {
+				putchar('.');
+			}
+			loader_do_memload();
+		}
+		break;
+	case STATE_PROGRAM_GET_INFO:
+	case STATE_PROGRAM_IN_PROGRESS:
+		if(cmd == LOADER_FLASH_PROGRAM) {
+			if(osmoload.memcrc != crc) {
+				osmoload.memoff -= osmoload.memreq;
+				printf("\nbad crc %4.4x (not %4.4x) at offset 0x%8.8x", crc, osmoload.memcrc, osmoload.memoff);
+			} else {
+				putchar('.');
+			}
+			if(((int)status) != 0) {
+				printf("\nstatus %d, aborting\n", status);
+				exit(1);
+			}
+			loader_do_fprogram();
+		}
+		break;
+	case STATE_FLASHRANGE_GET_INFO:
+	case STATE_FLASHRANGE_IN_PROGRESS:
+		loader_do_flashrange(cmd, msg, chip, address, status);
+		break;
+	default:
+		break;
+	}
+
+	fflush(stdout);
+}
+
+static int
+loader_read_cb(struct osmo_fd *fd, unsigned int flags) {
+	struct msgb *msg;
+	uint16_t len;
+	int rc;
+
+	msg = msgb_alloc(MSGB_MAX, "loader");
+	if (!msg) {
+		fprintf(stderr, "Failed to allocate msg.\n");
+		return -1;
+	}
+
+	rc = read(fd->fd, &len, sizeof(len));
+	if (rc < sizeof(len)) {
+		fprintf(stderr, "Short read. Error.\n");
+		exit(2);
+	}
+
+	if (ntohs(len) > MSGB_MAX) {
+		fprintf(stderr, "Length is too big: %u\n", ntohs(len));
+		msgb_free(msg);
+		return -1;
+	}
+
+	/* blocking read for the poor... we can starve in here... */
+	msg->l2h = msgb_put(msg, ntohs(len));
+	rc = read(fd->fd, msg->l2h, msgb_l2len(msg));
+	if (rc != msgb_l2len(msg)) {
+		fprintf(stderr, "Can not read data: rc: %d errno: %d\n", rc, errno);
+		msgb_free(msg);
+		return -1;
+	}
+
+	loader_handle_reply(msg);
+
+	msgb_free(msg);
+
+	return 0;
+}
+
+static void
+loader_connect(const char *socket_path) {
+	int rc;
+	struct osmo_fd *conn = &connection;
+
+	rc = osmo_sock_unix_init_ofd(conn, SOCK_STREAM, 0, socket_path, OSMO_SOCK_F_CONNECT);
+	if (rc < 0) {
+		fprintf(stderr, "Failed to create unix domain socket %s: %s\n",
+			socket_path, strerror(-rc));
+		exit(1);
+	}
+
+	conn->cb = loader_read_cb;
+	conn->data = NULL;
+}
+
+static void
+loader_send_simple(uint8_t command) {
+	struct msgb *msg = msgb_alloc(MSGB_MAX, "loader");
+	msgb_put_u8(msg, command);
+	loader_send_request(msg);
+	msgb_free(msg);
+
+	osmoload.command = command;
+}
+
+static void
+loader_start_query(uint8_t command) {
+	loader_send_simple(command);
+	osmoload.state = STATE_QUERY_PENDING;
+}
+
+static void
+loader_send_flash_query(uint8_t command, uint8_t chip, uint32_t address) {
+	struct msgb *msg = msgb_alloc(MSGB_MAX, "loader");
+	msgb_put_u8(msg, command);
+	msgb_put_u8(msg, chip);
+	msgb_put_u32(msg, address);
+	loader_send_request(msg);
+	msgb_free(msg);
+
+	osmoload.command = command;
+}
+
+static void __attribute__((__unused__))
+loader_start_flash_query(uint8_t command, uint8_t chip, uint32_t address) {
+	loader_send_flash_query(command, chip, address);
+	osmoload.state = STATE_QUERY_PENDING;
+}
+
+static void
+loader_start_memget(uint8_t length, uint32_t address) {
+	struct msgb *msg = msgb_alloc(MSGB_MAX, "loader");
+	msgb_put_u8(msg, LOADER_MEM_READ);
+	msgb_put_u8(msg, length);
+	msgb_put_u32(msg, address);
+	loader_send_request(msg);
+	msgb_free(msg);
+
+	osmoload.state = STATE_QUERY_PENDING;
+	osmoload.command = LOADER_MEM_READ;
+}
+
+static void
+loader_start_memput(uint8_t length, uint32_t address, void *data) {
+	struct msgb *msg = msgb_alloc(MSGB_MAX, "loader");
+	msgb_put_u8(msg, LOADER_MEM_WRITE);
+	msgb_put_u8(msg, length);
+	msgb_put_u16(msg, osmo_crc16(0, data, length));
+	msgb_put_u32(msg, address);
+	memcpy(msgb_put(msg, length), data, length);
+	loader_send_request(msg);
+	msgb_free(msg);
+
+	osmoload.state = STATE_QUERY_PENDING;
+	osmoload.command = LOADER_MEM_WRITE;
+}
+
+static void
+loader_start_jump(uint32_t address) {
+	struct msgb *msg = msgb_alloc(MSGB_MAX, "loader");
+	msgb_put_u8(msg, LOADER_JUMP);
+	msgb_put_u32(msg, address);
+	loader_send_request(msg);
+	msgb_free(msg);
+
+	osmoload.state = STATE_QUERY_PENDING;
+	osmoload.command = LOADER_JUMP;
+}
+
+
+static void
+loader_do_memdump(uint16_t crc, void *data, size_t length) {
+	int rc;
+
+	if(data && length) {
+		osmoload.memcrc = osmo_crc16(0, data, length);
+		if(osmoload.memcrc != crc) {
+			osmoload.memoff -= osmoload.memreq;
+			printf("\nbad crc %4.4x (not %4.4x) at offset 0x%8.8x", crc, osmoload.memcrc, osmoload.memoff);
+		} else {
+			putchar('.');
+		}
+
+		memcpy(osmoload.binbuf + osmoload.memoff, data, length);
+		osmoload.memoff += length;
+	}
+
+	uint32_t rembytes = osmoload.memlen - osmoload.memoff;
+
+	if(!rembytes) {
+		puts("done.");
+		osmoload.quit = 1;
+
+		unsigned c = osmoload.memlen;
+		char *p = osmoload.binbuf;
+		while(c) {
+			rc = fwrite(p, 1, c, osmoload.binfile);
+			if(ferror(osmoload.binfile)) {
+				printf("Could not read from file: %s\n", strerror(errno));
+				exit(1);
+			}
+			c -= rc;
+			p += rc;
+		}
+		fclose(osmoload.binfile);
+		osmoload.binfile = NULL;
+
+		free(osmoload.binbuf);
+
+		return;
+	}
+
+	uint8_t reqbytes = (rembytes < MEM_MSG_MAX) ? rembytes : MEM_MSG_MAX;
+
+	struct msgb *msg = msgb_alloc(MSGB_MAX, "loader");
+
+	msgb_put_u8(msg, LOADER_MEM_READ);
+	msgb_put_u8(msg, reqbytes);
+	msgb_put_u32(msg, osmoload.membase + osmoload.memoff);
+	loader_send_request(msg);
+	msgb_free(msg);
+}
+
+static void
+loader_do_memload() {
+	uint32_t rembytes = osmoload.memlen - osmoload.memoff;
+
+	if(!rembytes) {
+		puts("done.");
+		osmoload.quit = 1;
+		return;
+	}
+
+	osmo_timer_schedule(&osmoload.timeout, 0, 500000);
+
+	uint8_t reqbytes = (rembytes < MEM_MSG_MAX) ? rembytes : MEM_MSG_MAX;
+
+	osmoload.memcrc = osmo_crc16(0, (uint8_t *) osmoload.binbuf + osmoload.memoff, reqbytes);
+	osmoload.memreq = reqbytes;
+
+	struct msgb *msg = msgb_alloc(MSGB_MAX, "loader");
+
+	msgb_put_u8(msg, LOADER_MEM_WRITE);
+	msgb_put_u8(msg, reqbytes);
+	msgb_put_u16(msg, osmoload.memcrc);
+	msgb_put_u32(msg, osmoload.membase + osmoload.memoff);
+
+	unsigned char *p = msgb_put(msg, reqbytes);
+	memcpy(p, osmoload.binbuf + osmoload.memoff, reqbytes);
+
+#if 0
+	printf("Sending %u bytes at offset %u to address %x with crc %x\n",
+		   reqbytes, osmoload.memoff, osmoload.membase + osmoload.memoff,
+		   osmoload.memcrc);
+#endif
+
+	loader_send_request(msg);
+
+	msgb_free(msg);
+
+	osmoload.memoff += reqbytes;
+}
+
+static void
+loader_do_fprogram() {
+	uint32_t rembytes = osmoload.memlen - osmoload.memoff;
+
+	if(!rembytes) {
+		puts("done.");
+		osmoload.quit = 1;
+		return;
+	}
+
+	osmo_timer_schedule(&osmoload.timeout, 0, 10000000);
+
+	uint8_t reqbytes = (rembytes < MEM_MSG_MAX) ? rembytes : MEM_MSG_MAX;
+
+	osmoload.memcrc = osmo_crc16(0, (uint8_t *) osmoload.binbuf + osmoload.memoff, reqbytes);
+	osmoload.memreq = reqbytes;
+
+	struct msgb *msg = msgb_alloc(MSGB_MAX, "loader");
+
+	msgb_put_u8(msg, LOADER_FLASH_PROGRAM);
+	msgb_put_u8(msg, reqbytes);
+	msgb_put_u16(msg, osmoload.memcrc);
+	msgb_put_u8(msg, 0); // XXX: align data to 16bit
+	msgb_put_u8(msg, osmoload.memchip);
+	msgb_put_u32(msg, osmoload.membase + osmoload.memoff);
+
+	unsigned char *p = msgb_put(msg, reqbytes);
+	memcpy(p, osmoload.binbuf + osmoload.memoff, reqbytes);
+
+#if 0
+	printf("Sending %u bytes at offset %u to address %x with crc %x\n",
+		   reqbytes, osmoload.memoff, osmoload.membase + osmoload.memoff,
+		   osmoload.memcrc);
+#endif
+
+	loader_send_request(msg);
+
+	msgb_free(msg);
+
+	osmoload.memoff += reqbytes;
+}
+
+static void
+loader_start_memdump(uint32_t length, uint32_t address, char *file) {
+	printf("Dumping %u bytes of memory at 0x%x to file %s\n", length, address, file);
+
+	osmoload.binbuf = malloc(length);
+	if(!osmoload.binbuf) {
+		printf("Could not allocate %u bytes for %s.\n", length, file);
+		exit(1);
+	}
+
+	osmoload.binfile = fopen(file, "wb");
+	if(!osmoload.binfile) {
+		printf("Could not open %s: %s\n", file, strerror(errno));
+		exit(1);
+	}
+
+	osmoload.membase = address;
+	osmoload.memlen = length;
+	osmoload.memoff = 0;
+
+	osmoload.state = STATE_DUMP_IN_PROGRESS;
+	loader_do_memdump(0, NULL, 0);
+}
+
+static void
+loader_start_memload(uint32_t address, char *file) {
+	int rc;
+	struct stat st;
+
+	rc = stat(file, &st);
+	if(rc < 0) {
+		printf("Could not stat %s: %s\n", file, strerror(errno));
+		exit(1);
+	}
+
+	uint32_t length = st.st_size;
+
+	printf("Loading %u bytes of memory to address 0x%x from file %s\n", length, address, file);
+
+	osmoload.binbuf = malloc(length);
+	if(!osmoload.binbuf) {
+		printf("Could not allocate %u bytes for %s.\n", length, file);
+		exit(1);
+	}
+
+	osmoload.binfile = fopen(file, "rb");
+	if(!osmoload.binfile) {
+		printf("Could not open %s: %s\n", file, strerror(errno));
+		exit(1);
+	}
+
+	unsigned c = length;
+	char *p = osmoload.binbuf;
+	while(c) {
+		rc = fread(p, 1, c, osmoload.binfile);
+		if(ferror(osmoload.binfile)) {
+			printf("Could not read from file: %s\n", strerror(errno));
+			exit(1);
+		}
+		c -= rc;
+		p += rc;
+	}
+	fclose(osmoload.binfile);
+	osmoload.binfile = NULL;
+
+	osmoload.membase = address;
+	osmoload.memlen = length;
+	osmoload.memoff = 0;
+
+	osmoload.state = STATE_LOAD_IN_PROGRESS;
+	loader_do_memload();
+}
+
+static void
+loader_start_flashrange(uint8_t command, uint32_t address, uint32_t length) {
+	switch(command) {
+	case LOADER_FLASH_ERASE:
+		printf("Erasing %u bytes of flash at 0x%x\n", length, address);
+		break;
+	case LOADER_FLASH_LOCK:
+		printf("Locking %u bytes of flash at 0x%x\n", length, address);
+		break;
+	case LOADER_FLASH_LOCKDOWN:
+		printf("Locking down %u bytes of flash at 0x%x\n", length, address);
+		break;
+	case LOADER_FLASH_UNLOCK:
+		printf("Unlocking %u bytes of flash at 0x%x\n", length, address);
+		break;
+	case LOADER_FLASH_GETLOCK:
+		printf("Getlocking %u bytes of flash at 0x%x\n", length, address);
+		break;
+	default:
+		puts("Unknown range command");
+		abort();
+		break;
+	}
+
+	osmoload.flashcommand = command;
+
+	osmoload.membase = address;
+	osmoload.memlen = length;
+	osmoload.memoff = 0;
+
+	printf("  requesting flash info to determine block layout\n");
+
+	osmoload.state = STATE_FLASHRANGE_GET_INFO;
+
+	loader_send_simple(LOADER_FLASH_INFO);
+}
+
+static void
+loader_do_flashrange(uint8_t cmd, struct msgb *msg, uint8_t chip, uint32_t address, uint32_t status) {
+	switch(osmoload.state) {
+	case STATE_FLASHRANGE_GET_INFO:
+		if(cmd == LOADER_FLASH_INFO) {
+			loader_parse_flash_info(msg);
+			osmoload.state = STATE_FLASHRANGE_IN_PROGRESS;
+			loader_do_flashrange(0, NULL, 0, 0, 0);
+		}
+		break;
+	case STATE_FLASHRANGE_IN_PROGRESS:
+		{
+			if(msg) {
+				if(cmd == osmoload.flashcommand) {
+					if(cmd == LOADER_FLASH_GETLOCK) {
+						printf("  lock state of chip %d address 0x%8.8x is %s\n",
+							   chip, address, (status == LOADER_FLASH_LOCKED ? "locked"
+											   : (status == LOADER_FLASH_LOCKED_DOWN ? "locked down"
+												  : (status == LOADER_FLASH_UNLOCKED ? "unlocked"
+													 : "UNKNOWN"))));
+					} else {
+						printf("  confirmed operation on chip %d address 0x%8.8x, status %s\n",
+							   chip, address, status ? "FAILED" : "ok");
+					}
+				} else {
+					break;
+				}
+			}
+
+			uint32_t addr = osmoload.membase + osmoload.memoff;
+
+			if(osmoload.memoff >= osmoload.memlen) {
+				puts("  operation done");
+				osmoload.quit = 1;
+				break;
+			}
+
+			uint8_t found = 0;
+			int i;
+			for(i = 0; i < osmoload.numblocks; i++) {
+				struct flashblock *b = &osmoload.blocks[i];
+				if(b->fb_addr == addr) {
+					loader_send_flash_query(osmoload.flashcommand, b->fb_chip, b->fb_offset);
+					osmoload.memoff += b->fb_size;
+					found = 1;
+					break;
+				}
+			}
+			if(!found) {
+				puts("Oops!? Block not found?"); // XXX message
+				abort();
+			}
+		}
+		break;
+	}
+}
+
+static void
+loader_start_fprogram(uint8_t chip, uint32_t address, char *file) {
+	int rc;
+	struct stat st;
+
+	rc = stat(file, &st);
+	if(rc < 0) {
+		printf("Could not stat %s: %s\n", file, strerror(errno));
+		exit(1);
+	}
+
+	uint32_t length = st.st_size;
+
+	printf("Loading %u bytes of memory at 0x%x in chip %d from file %s\n", length, address, chip, file);
+
+	osmoload.binbuf = malloc(length);
+	if(!osmoload.binbuf) {
+		printf("Could not allocate %u bytes for %s.\n", length, file);
+		exit(1);
+	}
+
+	osmoload.binfile = fopen(file, "rb");
+	if(!osmoload.binfile) {
+		printf("Could not open %s: %s\n", file, strerror(errno));
+		exit(1);
+	}
+
+	unsigned c = length;
+	char *p = osmoload.binbuf;
+	while(c) {
+		rc = fread(p, 1, c, osmoload.binfile);
+		if(ferror(osmoload.binfile)) {
+			printf("Could not read from file: %s\n", strerror(errno));
+			exit(1);
+		}
+		c -= rc;
+		p += rc;
+	}
+	fclose(osmoload.binfile);
+	osmoload.binfile = NULL;
+
+	osmoload.memchip = chip;
+	osmoload.membase = address;
+	osmoload.memlen = length;
+	osmoload.memoff = 0;
+
+	osmoload.state = STATE_PROGRAM_IN_PROGRESS;
+
+	loader_do_fprogram();
+}
+
+static void
+query_timeout(void *dummy) {
+	puts("Query timed out.");
+	exit(2);
+}
+
+static void
+loader_command(char *name, int cmdc, char **cmdv) {
+	if(!cmdc) {
+		usage(name);
+	}
+
+	char *cmd = cmdv[0];
+
+	char buf[MEM_MSG_MAX];
+	memset(buf, 23, sizeof(buf));
+
+	if(!strcmp(cmd, "dump")) {
+		osmoload.state = STATE_DUMPING;
+	} else if(!strcmp(cmd, "ping")) {
+		loader_start_query(LOADER_PING);
+	} else if(!strcmp(cmd, "off")) {
+		loader_start_query(LOADER_POWEROFF);
+	} else if(!strcmp(cmd, "reset")) {
+		loader_start_query(LOADER_RESET);
+	} else if(!strcmp(cmd, "jumprom")) {
+		loader_start_query(LOADER_ENTER_ROM_LOADER);
+	} else if(!strcmp(cmd, "jumpflash")) {
+		loader_start_query(LOADER_ENTER_FLASH_LOADER);
+	} else if(!strcmp(cmd, "finfo")) {
+		puts("Requesting flash layout info");
+		loader_start_query(LOADER_FLASH_INFO);
+	} else if(!strcmp(cmd, "memput")) {
+		uint32_t address;
+
+		if(cmdc < 3) {
+			usage(name);
+		}
+
+		address = strtoul(cmdv[1], NULL, 16);
+
+		unsigned int i;
+		char *hex = cmdv[2];
+		if(strlen(hex)&1) {
+			puts("Invalid hex string.");
+			exit(2);
+		}
+		for(i = 0; i <= sizeof(buf) && i < strlen(hex)/2; i++) {
+			if(i >= sizeof(buf)) {
+				puts("Value too long for single message");
+				exit(2);
+			}
+			unsigned int byte;
+			int count = sscanf(hex + i * 2, "%02x", &byte);
+			if(count != 1) {
+				puts("Invalid hex string.");
+				exit(2);
+			}
+			buf[i] = byte & 0xFF;
+		}
+
+		loader_start_memput(i & 0xFF, address, buf);
+	} else if(!strcmp(cmd, "memget")) {
+		uint32_t address;
+		uint8_t length;
+
+		if(cmdc < 3) {
+			usage(name);
+		}
+
+		address = strtoul(cmdv[1], NULL, 16);
+		length = strtoul(cmdv[2], NULL, 16);
+
+		if(length > MEM_MSG_MAX) {
+			puts("Too many bytes");
+			exit(2);
+		}
+
+		loader_start_memget(length, address);
+	} else if(!strcmp(cmd, "jump")) {
+		uint32_t address;
+
+		if(cmdc < 2) {
+			usage(name);
+		}
+
+		address = strtoul(cmdv[1], NULL, 16);
+
+		loader_start_jump(address);
+	} else if(!strcmp(cmd, "memdump")) {
+		uint32_t address;
+		uint32_t length;
+
+		if(cmdc < 4) {
+			usage(name);
+		}
+
+		address = strtoul(cmdv[1], NULL, 16);
+		length = strtoul(cmdv[2], NULL, 16);
+
+		loader_start_memdump(length, address, cmdv[3]);
+	} else if(!strcmp(cmd, "memload")) {
+		uint32_t address;
+
+		if(cmdc < 3) {
+			usage(name);
+		}
+
+		address = strtoul(cmdv[1], NULL, 16);
+
+		loader_start_memload(address, cmdv[2]);
+	} else if(!strcmp(cmd, "fprogram")) {
+		uint8_t chip;
+		uint32_t address;
+
+		if(cmdc < 4) {
+			usage(name);
+		}
+
+		chip = strtoul(cmdv[1], NULL, 10);
+		address = strtoul(cmdv[2], NULL, 16);
+
+		loader_start_fprogram(chip, address, cmdv[3]);
+	} else if(!strcmp(cmd, "ferase")) {
+		uint32_t address;
+		uint32_t length;
+
+		if(cmdc < 3) {
+			usage(name);
+		}
+
+		address = strtoul(cmdv[1], NULL, 16);
+		length = strtoul(cmdv[2], NULL, 16);
+
+		loader_start_flashrange(LOADER_FLASH_ERASE, address, length);
+	} else if(!strcmp(cmd, "flock")) {
+		uint32_t address;
+		uint32_t length;
+
+		if(cmdc < 3) {
+			usage(name);
+		}
+
+		address = strtoul(cmdv[1], NULL, 16);
+		length = strtoul(cmdv[2], NULL, 16);
+
+		loader_start_flashrange(LOADER_FLASH_LOCK, address, length);
+	} else if(!strcmp(cmd, "flockdown")) {
+		uint32_t address;
+		uint32_t length;
+
+		if(cmdc < 3) {
+			usage(name);
+		}
+
+		address = strtoul(cmdv[1], NULL, 16);
+		length = strtoul(cmdv[2], NULL, 16);
+
+		loader_start_flashrange(LOADER_FLASH_LOCKDOWN, address, length);
+	} else if(!strcmp(cmd, "funlock")) {
+		uint32_t address;
+		uint32_t length;
+
+		if(cmdc < 3) {
+			usage(name);
+		}
+
+		address = strtoul(cmdv[1], NULL, 16);
+		length = strtoul(cmdv[2], NULL, 16);
+
+		loader_start_flashrange(LOADER_FLASH_UNLOCK, address, length);
+	} else if(!strcmp(cmd, "fgetlock")) {
+		uint32_t address;
+		uint32_t length;
+
+		if(cmdc < 3) {
+			usage(name);
+		}
+
+		address = strtoul(cmdv[1], NULL, 16);
+		length = strtoul(cmdv[2], NULL, 16);
+
+		loader_start_flashrange(LOADER_FLASH_GETLOCK, address, length);
+	} else if(!strcmp(cmd, "help")) {
+		usage(name);
+	} else {
+		printf("Unknown command '%s'\n", cmd);
+		usage(name);
+	}
+
+	if(osmoload.state == STATE_QUERY_PENDING) {
+		osmoload.timeout.cb = &query_timeout;
+		osmo_timer_schedule(&osmoload.timeout, 0, 5000000);
+	}
+	if(osmoload.state == STATE_LOAD_IN_PROGRESS) {
+		osmoload.timeout.cb = &memop_timeout;
+	}
+
+}
+
+void
+setdebug(const char *name, char c) {
+	switch(c) {
+	case 't':
+		osmoload.print_requests = 1;
+		break;
+	case 'r':
+		osmoload.print_replies = 1;
+		break;
+	default:
+		usage(name);
+		break;
+	}
+}
+
+int
+main(int argc, char **argv) {
+	int opt;
+	char *loader_un_path = "/tmp/osmocom_loader";
+	const char *debugopt;
+
+	while((opt = getopt(argc, argv, "d:hl:m:v")) != -1) {
+		switch(opt) {
+		case 'd':
+			debugopt = optarg;
+			while(*debugopt) {
+				setdebug(argv[0], *debugopt);
+				debugopt++;
+			}
+			break;
+		case 'l':
+			loader_un_path = optarg;
+			break;
+		case 'm':
+			puts("model selection not implemented");
+			exit(2);
+			break;
+		case 'v':
+			version(argv[0]);
+			break;
+		case 'h':
+		default:
+			usage(argv[0]);
+			break;
+		}
+	}
+
+	osmoload.quit = 0;
+
+	loader_connect(loader_un_path);
+
+	loader_command(argv[0], argc - optind, argv + optind);
+
+	while(!osmoload.quit) {
+		osmo_select_main(0);
+	}
+
+	if(osmoload.binfile) {
+		fclose(osmoload.binfile);
+	}
+
+	return 0;
+}
diff --git a/src/host/osmocon/tpu_debug.c b/src/host/osmocon/tpu_debug.c
new file mode 100644
index 00000000..c9dac903
--- /dev/null
+++ b/src/host/osmocon/tpu_debug.c
@@ -0,0 +1,138 @@
+/* Calypso TPU debugger, displays and decodes TPU instruction RAM */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#include <osmocom/core/msgb.h>
+
+/* TPU disassembler begin */
+
+static const char *tpu_instr_name[] = {
+	[0]	= "SLEEP",
+	[1]	= "AT",
+	[2]	= "OFFSET",
+	[3]	= "SYNCHRO",
+	[4]	= "MOVE",
+	[5]	= "WAIT",
+	[6]	= "UNDEFINED6",
+	[7]	= "UNDEFINED7",
+};
+
+static const char *tpu_addr_name[0x1f] = {
+	[0]	= "TSP_CTLR1",
+	[1]	= "TSP_CTRL2",
+	[4]	= "TSP_TX_1",
+	[3]	= "TSP_TX_2",
+	[2]	= "TSP_TX_3",
+	[5]	= "TSP_TX_4",
+	[6]	= "TSPACT_L",
+	[7]	= "TSPACT_H",
+	[9]	= "TSP_SET1",
+	[0xa]	= "TSP_SET2",
+	[0xb]	= "TSP_SET3",
+	[0x10]	= "DSP_INT_PG",
+	[0x11]	= "GAUGING_EN",
+};
+
+static uint8_t tpu_reg_cache[0x1f];
+static uint16_t tpu_qbit;
+
+static void tpu_show_instr(uint16_t tpu)
+{
+	uint16_t instr = tpu >> 13;
+	uint16_t param = tpu & 0x1fff;
+	uint16_t addr, data, bitlen;
+	uint32_t tsp_data;
+
+	tpu_qbit++;
+
+	printf("\t %04u %04x %s ", tpu_qbit, tpu, tpu_instr_name[instr]);
+	switch (instr) {
+	case 0:
+		tpu_qbit = 0;
+	default:
+		break;
+	case 1:
+		tpu_qbit = param;
+		printf("%u ", param);
+		break;
+	case 5:
+		tpu_qbit += param;
+		printf("%u ", param);
+		break;
+	case 2:
+	case 3:
+		printf("%u ", param);
+		break;
+	case 4:
+		addr = param & 0x1f;
+		data = param >> 5;
+		tpu_reg_cache[addr] = data;
+		printf("%10s=0x%04x ", tpu_addr_name[addr], data);
+		switch (addr) {
+		case 0:
+			bitlen = (data & 0x1f) + 1;
+			printf("DEV_IDX=%u, BITLEN=%u ", data >> 5, bitlen);
+			if (bitlen <= 8) {
+				tsp_data = tpu_reg_cache[4];
+				printf(" TSP_DATA=0x%02x ", tsp_data);
+			} else if (bitlen <= 16) {
+				tsp_data = tpu_reg_cache[3];
+				tsp_data |= tpu_reg_cache[4] << 8;
+				printf(" TSP_DATA=0x%04x ", tsp_data);
+			} else if (bitlen <= 24) {
+				tsp_data = tpu_reg_cache[2];
+				tsp_data |= tpu_reg_cache[3] << 8;
+				tsp_data |= tpu_reg_cache[4] << 16;
+				printf(" TSP_DATA=0x%06x ", tsp_data);
+			} else {
+				tsp_data = tpu_reg_cache[5];
+				tsp_data |= tpu_reg_cache[2] << 8;
+				tsp_data |= tpu_reg_cache[3] << 16;
+				tsp_data |= tpu_reg_cache[4] << 24;
+				printf(" TSP_DATA=0x%08x ", tsp_data);
+			}
+			break;
+		case 1:
+			if (data & 0x01)
+				printf("READ ");
+			if (data & 0x02)
+				printf("WRITE ");
+			break;
+		}
+	}
+	printf("\n");
+}
+
+void hdlc_tpudbg_cb(uint8_t dlci, struct msgb *msg)
+{
+	uint32_t *fn = (uint32_t *) msg->data;
+	uint16_t *tpu;
+
+	printf("TPU FN %u\n", *fn);
+	for (tpu = (uint16_t *) (msg->data + 4); tpu < (uint16_t *) msg->tail; tpu++)
+		tpu_show_instr(*tpu);
+
+	msgb_free(msg);
+}
diff --git a/src/host/rita_pll/mtk_pll.pl b/src/host/rita_pll/mtk_pll.pl
new file mode 100755
index 00000000..ff931c5c
--- /dev/null
+++ b/src/host/rita_pll/mtk_pll.pl
@@ -0,0 +1,79 @@
+#!/usr/bin/perl
+
+# Rx Mode and Tx Mode:
+#	N = Nint + (Nfrac / 130) = (0.5*Fvco) / 26M
+#		where 0 <= Nfrac < 130
+#		where 0 <= Ninit <= 127 (as Nint is 7 bit)
+# where Fvco = 4 * Fch (GSM 850/900), Fvco = 2 * Fch (GSM 1800/1900)
+
+# (Nint + (Nfrac / 130)) * 52 MHz = Fvco
+
+sub mtk_fvco($$) {
+	my ($nint, $nfrac) = @_;
+	return ($nint + ($nfrac / 130)) * (26 * 2)
+}
+
+sub hr() {
+	printf("======================================================================\n");
+}
+
+sub vco_print($$$)
+{
+	my ($nint, $nfrac, $hiband) = @_;
+	my $fvco = mtk_fvco($nint, $nfrac);
+	my $mult;
+
+	if ($hiband == 1) {
+		$mult = 2;
+	} else {
+		$mult = 4;
+	}
+	
+	printf("Fch=%4.2f (Fvco=%4.2f, Nint=%03u, Nfrac=%03u)\n",
+		$fvco/$mult, $fvco, $nint, $nfrac);
+}
+
+#for (my $nint = 0; $nint <= 127; $nint++) {
+#	for (my $nfrac = 0; $nfrac <= 130; $nfrac++) {
+#		vco_print($nint, $nfrac);
+#	}
+#}
+
+printf("PLL Rx Low Band:\n");
+for (my $nint = 68; $nint <= 73; $nint++) {
+#for GSM 810
+#for (my $b = 132; $b <= 150; $b++) {
+	for (my $nfrac = 0; $nfrac <= 130; $nfrac++) {
+		vco_print($nint, $nfrac, 0);
+	}
+}
+
+hr();
+printf("PLL Rx High Band:\n");
+for (my $nint = 69; $nint <= 79; $nint++) {
+	for (my $nfrac = 0; $nfrac <= 130; $nfrac++) {
+		vco_print($nint, $nfrac, 1);
+	}
+}
+
+hr();
+printf("PLL Tx Low Band:\n");
+for (my $nint = 63; $nint <= 70; $nint++) {
+	for (my $nfrac = 0; $nfrac <= 130; $nfrac++) {
+		vco_print($nint, $nfrac, 0);
+	}
+}
+
+
+hr();
+printf("PLL Tx High Band\n");
+for (my $nint = 65; $nint <= 73; $nint++) {
+	for (my $nfrac = 0; $nfrac <= 130; $nfrac++) {
+		vco_print($nint, $nfrac, 1);
+	}
+}
+
+
+
+exit(0);
+
diff --git a/src/host/rita_pll/mtk_pll.txt b/src/host/rita_pll/mtk_pll.txt
new file mode 100644
index 00000000..a008656f
--- /dev/null
+++ b/src/host/rita_pll/mtk_pll.txt
@@ -0,0 +1,4461 @@
+PLL Rx Low Band:
+Fch=884.00 (Fvco=3536.00, Nint=068, Nfrac=000)
+Fch=884.10 (Fvco=3536.40, Nint=068, Nfrac=001)
+Fch=884.20 (Fvco=3536.80, Nint=068, Nfrac=002)
+Fch=884.30 (Fvco=3537.20, Nint=068, Nfrac=003)
+Fch=884.40 (Fvco=3537.60, Nint=068, Nfrac=004)
+Fch=884.50 (Fvco=3538.00, Nint=068, Nfrac=005)
+Fch=884.60 (Fvco=3538.40, Nint=068, Nfrac=006)
+Fch=884.70 (Fvco=3538.80, Nint=068, Nfrac=007)
+Fch=884.80 (Fvco=3539.20, Nint=068, Nfrac=008)
+Fch=884.90 (Fvco=3539.60, Nint=068, Nfrac=009)
+Fch=885.00 (Fvco=3540.00, Nint=068, Nfrac=010)
+Fch=885.10 (Fvco=3540.40, Nint=068, Nfrac=011)
+Fch=885.20 (Fvco=3540.80, Nint=068, Nfrac=012)
+Fch=885.30 (Fvco=3541.20, Nint=068, Nfrac=013)
+Fch=885.40 (Fvco=3541.60, Nint=068, Nfrac=014)
+Fch=885.50 (Fvco=3542.00, Nint=068, Nfrac=015)
+Fch=885.60 (Fvco=3542.40, Nint=068, Nfrac=016)
+Fch=885.70 (Fvco=3542.80, Nint=068, Nfrac=017)
+Fch=885.80 (Fvco=3543.20, Nint=068, Nfrac=018)
+Fch=885.90 (Fvco=3543.60, Nint=068, Nfrac=019)
+Fch=886.00 (Fvco=3544.00, Nint=068, Nfrac=020)
+Fch=886.10 (Fvco=3544.40, Nint=068, Nfrac=021)
+Fch=886.20 (Fvco=3544.80, Nint=068, Nfrac=022)
+Fch=886.30 (Fvco=3545.20, Nint=068, Nfrac=023)
+Fch=886.40 (Fvco=3545.60, Nint=068, Nfrac=024)
+Fch=886.50 (Fvco=3546.00, Nint=068, Nfrac=025)
+Fch=886.60 (Fvco=3546.40, Nint=068, Nfrac=026)
+Fch=886.70 (Fvco=3546.80, Nint=068, Nfrac=027)
+Fch=886.80 (Fvco=3547.20, Nint=068, Nfrac=028)
+Fch=886.90 (Fvco=3547.60, Nint=068, Nfrac=029)
+Fch=887.00 (Fvco=3548.00, Nint=068, Nfrac=030)
+Fch=887.10 (Fvco=3548.40, Nint=068, Nfrac=031)
+Fch=887.20 (Fvco=3548.80, Nint=068, Nfrac=032)
+Fch=887.30 (Fvco=3549.20, Nint=068, Nfrac=033)
+Fch=887.40 (Fvco=3549.60, Nint=068, Nfrac=034)
+Fch=887.50 (Fvco=3550.00, Nint=068, Nfrac=035)
+Fch=887.60 (Fvco=3550.40, Nint=068, Nfrac=036)
+Fch=887.70 (Fvco=3550.80, Nint=068, Nfrac=037)
+Fch=887.80 (Fvco=3551.20, Nint=068, Nfrac=038)
+Fch=887.90 (Fvco=3551.60, Nint=068, Nfrac=039)
+Fch=888.00 (Fvco=3552.00, Nint=068, Nfrac=040)
+Fch=888.10 (Fvco=3552.40, Nint=068, Nfrac=041)
+Fch=888.20 (Fvco=3552.80, Nint=068, Nfrac=042)
+Fch=888.30 (Fvco=3553.20, Nint=068, Nfrac=043)
+Fch=888.40 (Fvco=3553.60, Nint=068, Nfrac=044)
+Fch=888.50 (Fvco=3554.00, Nint=068, Nfrac=045)
+Fch=888.60 (Fvco=3554.40, Nint=068, Nfrac=046)
+Fch=888.70 (Fvco=3554.80, Nint=068, Nfrac=047)
+Fch=888.80 (Fvco=3555.20, Nint=068, Nfrac=048)
+Fch=888.90 (Fvco=3555.60, Nint=068, Nfrac=049)
+Fch=889.00 (Fvco=3556.00, Nint=068, Nfrac=050)
+Fch=889.10 (Fvco=3556.40, Nint=068, Nfrac=051)
+Fch=889.20 (Fvco=3556.80, Nint=068, Nfrac=052)
+Fch=889.30 (Fvco=3557.20, Nint=068, Nfrac=053)
+Fch=889.40 (Fvco=3557.60, Nint=068, Nfrac=054)
+Fch=889.50 (Fvco=3558.00, Nint=068, Nfrac=055)
+Fch=889.60 (Fvco=3558.40, Nint=068, Nfrac=056)
+Fch=889.70 (Fvco=3558.80, Nint=068, Nfrac=057)
+Fch=889.80 (Fvco=3559.20, Nint=068, Nfrac=058)
+Fch=889.90 (Fvco=3559.60, Nint=068, Nfrac=059)
+Fch=890.00 (Fvco=3560.00, Nint=068, Nfrac=060)
+Fch=890.10 (Fvco=3560.40, Nint=068, Nfrac=061)
+Fch=890.20 (Fvco=3560.80, Nint=068, Nfrac=062)
+Fch=890.30 (Fvco=3561.20, Nint=068, Nfrac=063)
+Fch=890.40 (Fvco=3561.60, Nint=068, Nfrac=064)
+Fch=890.50 (Fvco=3562.00, Nint=068, Nfrac=065)
+Fch=890.60 (Fvco=3562.40, Nint=068, Nfrac=066)
+Fch=890.70 (Fvco=3562.80, Nint=068, Nfrac=067)
+Fch=890.80 (Fvco=3563.20, Nint=068, Nfrac=068)
+Fch=890.90 (Fvco=3563.60, Nint=068, Nfrac=069)
+Fch=891.00 (Fvco=3564.00, Nint=068, Nfrac=070)
+Fch=891.10 (Fvco=3564.40, Nint=068, Nfrac=071)
+Fch=891.20 (Fvco=3564.80, Nint=068, Nfrac=072)
+Fch=891.30 (Fvco=3565.20, Nint=068, Nfrac=073)
+Fch=891.40 (Fvco=3565.60, Nint=068, Nfrac=074)
+Fch=891.50 (Fvco=3566.00, Nint=068, Nfrac=075)
+Fch=891.60 (Fvco=3566.40, Nint=068, Nfrac=076)
+Fch=891.70 (Fvco=3566.80, Nint=068, Nfrac=077)
+Fch=891.80 (Fvco=3567.20, Nint=068, Nfrac=078)
+Fch=891.90 (Fvco=3567.60, Nint=068, Nfrac=079)
+Fch=892.00 (Fvco=3568.00, Nint=068, Nfrac=080)
+Fch=892.10 (Fvco=3568.40, Nint=068, Nfrac=081)
+Fch=892.20 (Fvco=3568.80, Nint=068, Nfrac=082)
+Fch=892.30 (Fvco=3569.20, Nint=068, Nfrac=083)
+Fch=892.40 (Fvco=3569.60, Nint=068, Nfrac=084)
+Fch=892.50 (Fvco=3570.00, Nint=068, Nfrac=085)
+Fch=892.60 (Fvco=3570.40, Nint=068, Nfrac=086)
+Fch=892.70 (Fvco=3570.80, Nint=068, Nfrac=087)
+Fch=892.80 (Fvco=3571.20, Nint=068, Nfrac=088)
+Fch=892.90 (Fvco=3571.60, Nint=068, Nfrac=089)
+Fch=893.00 (Fvco=3572.00, Nint=068, Nfrac=090)
+Fch=893.10 (Fvco=3572.40, Nint=068, Nfrac=091)
+Fch=893.20 (Fvco=3572.80, Nint=068, Nfrac=092)
+Fch=893.30 (Fvco=3573.20, Nint=068, Nfrac=093)
+Fch=893.40 (Fvco=3573.60, Nint=068, Nfrac=094)
+Fch=893.50 (Fvco=3574.00, Nint=068, Nfrac=095)
+Fch=893.60 (Fvco=3574.40, Nint=068, Nfrac=096)
+Fch=893.70 (Fvco=3574.80, Nint=068, Nfrac=097)
+Fch=893.80 (Fvco=3575.20, Nint=068, Nfrac=098)
+Fch=893.90 (Fvco=3575.60, Nint=068, Nfrac=099)
+Fch=894.00 (Fvco=3576.00, Nint=068, Nfrac=100)
+Fch=894.10 (Fvco=3576.40, Nint=068, Nfrac=101)
+Fch=894.20 (Fvco=3576.80, Nint=068, Nfrac=102)
+Fch=894.30 (Fvco=3577.20, Nint=068, Nfrac=103)
+Fch=894.40 (Fvco=3577.60, Nint=068, Nfrac=104)
+Fch=894.50 (Fvco=3578.00, Nint=068, Nfrac=105)
+Fch=894.60 (Fvco=3578.40, Nint=068, Nfrac=106)
+Fch=894.70 (Fvco=3578.80, Nint=068, Nfrac=107)
+Fch=894.80 (Fvco=3579.20, Nint=068, Nfrac=108)
+Fch=894.90 (Fvco=3579.60, Nint=068, Nfrac=109)
+Fch=895.00 (Fvco=3580.00, Nint=068, Nfrac=110)
+Fch=895.10 (Fvco=3580.40, Nint=068, Nfrac=111)
+Fch=895.20 (Fvco=3580.80, Nint=068, Nfrac=112)
+Fch=895.30 (Fvco=3581.20, Nint=068, Nfrac=113)
+Fch=895.40 (Fvco=3581.60, Nint=068, Nfrac=114)
+Fch=895.50 (Fvco=3582.00, Nint=068, Nfrac=115)
+Fch=895.60 (Fvco=3582.40, Nint=068, Nfrac=116)
+Fch=895.70 (Fvco=3582.80, Nint=068, Nfrac=117)
+Fch=895.80 (Fvco=3583.20, Nint=068, Nfrac=118)
+Fch=895.90 (Fvco=3583.60, Nint=068, Nfrac=119)
+Fch=896.00 (Fvco=3584.00, Nint=068, Nfrac=120)
+Fch=896.10 (Fvco=3584.40, Nint=068, Nfrac=121)
+Fch=896.20 (Fvco=3584.80, Nint=068, Nfrac=122)
+Fch=896.30 (Fvco=3585.20, Nint=068, Nfrac=123)
+Fch=896.40 (Fvco=3585.60, Nint=068, Nfrac=124)
+Fch=896.50 (Fvco=3586.00, Nint=068, Nfrac=125)
+Fch=896.60 (Fvco=3586.40, Nint=068, Nfrac=126)
+Fch=896.70 (Fvco=3586.80, Nint=068, Nfrac=127)
+Fch=896.80 (Fvco=3587.20, Nint=068, Nfrac=128)
+Fch=896.90 (Fvco=3587.60, Nint=068, Nfrac=129)
+Fch=897.00 (Fvco=3588.00, Nint=068, Nfrac=130)
+Fch=897.00 (Fvco=3588.00, Nint=069, Nfrac=000)
+Fch=897.10 (Fvco=3588.40, Nint=069, Nfrac=001)
+Fch=897.20 (Fvco=3588.80, Nint=069, Nfrac=002)
+Fch=897.30 (Fvco=3589.20, Nint=069, Nfrac=003)
+Fch=897.40 (Fvco=3589.60, Nint=069, Nfrac=004)
+Fch=897.50 (Fvco=3590.00, Nint=069, Nfrac=005)
+Fch=897.60 (Fvco=3590.40, Nint=069, Nfrac=006)
+Fch=897.70 (Fvco=3590.80, Nint=069, Nfrac=007)
+Fch=897.80 (Fvco=3591.20, Nint=069, Nfrac=008)
+Fch=897.90 (Fvco=3591.60, Nint=069, Nfrac=009)
+Fch=898.00 (Fvco=3592.00, Nint=069, Nfrac=010)
+Fch=898.10 (Fvco=3592.40, Nint=069, Nfrac=011)
+Fch=898.20 (Fvco=3592.80, Nint=069, Nfrac=012)
+Fch=898.30 (Fvco=3593.20, Nint=069, Nfrac=013)
+Fch=898.40 (Fvco=3593.60, Nint=069, Nfrac=014)
+Fch=898.50 (Fvco=3594.00, Nint=069, Nfrac=015)
+Fch=898.60 (Fvco=3594.40, Nint=069, Nfrac=016)
+Fch=898.70 (Fvco=3594.80, Nint=069, Nfrac=017)
+Fch=898.80 (Fvco=3595.20, Nint=069, Nfrac=018)
+Fch=898.90 (Fvco=3595.60, Nint=069, Nfrac=019)
+Fch=899.00 (Fvco=3596.00, Nint=069, Nfrac=020)
+Fch=899.10 (Fvco=3596.40, Nint=069, Nfrac=021)
+Fch=899.20 (Fvco=3596.80, Nint=069, Nfrac=022)
+Fch=899.30 (Fvco=3597.20, Nint=069, Nfrac=023)
+Fch=899.40 (Fvco=3597.60, Nint=069, Nfrac=024)
+Fch=899.50 (Fvco=3598.00, Nint=069, Nfrac=025)
+Fch=899.60 (Fvco=3598.40, Nint=069, Nfrac=026)
+Fch=899.70 (Fvco=3598.80, Nint=069, Nfrac=027)
+Fch=899.80 (Fvco=3599.20, Nint=069, Nfrac=028)
+Fch=899.90 (Fvco=3599.60, Nint=069, Nfrac=029)
+Fch=900.00 (Fvco=3600.00, Nint=069, Nfrac=030)
+Fch=900.10 (Fvco=3600.40, Nint=069, Nfrac=031)
+Fch=900.20 (Fvco=3600.80, Nint=069, Nfrac=032)
+Fch=900.30 (Fvco=3601.20, Nint=069, Nfrac=033)
+Fch=900.40 (Fvco=3601.60, Nint=069, Nfrac=034)
+Fch=900.50 (Fvco=3602.00, Nint=069, Nfrac=035)
+Fch=900.60 (Fvco=3602.40, Nint=069, Nfrac=036)
+Fch=900.70 (Fvco=3602.80, Nint=069, Nfrac=037)
+Fch=900.80 (Fvco=3603.20, Nint=069, Nfrac=038)
+Fch=900.90 (Fvco=3603.60, Nint=069, Nfrac=039)
+Fch=901.00 (Fvco=3604.00, Nint=069, Nfrac=040)
+Fch=901.10 (Fvco=3604.40, Nint=069, Nfrac=041)
+Fch=901.20 (Fvco=3604.80, Nint=069, Nfrac=042)
+Fch=901.30 (Fvco=3605.20, Nint=069, Nfrac=043)
+Fch=901.40 (Fvco=3605.60, Nint=069, Nfrac=044)
+Fch=901.50 (Fvco=3606.00, Nint=069, Nfrac=045)
+Fch=901.60 (Fvco=3606.40, Nint=069, Nfrac=046)
+Fch=901.70 (Fvco=3606.80, Nint=069, Nfrac=047)
+Fch=901.80 (Fvco=3607.20, Nint=069, Nfrac=048)
+Fch=901.90 (Fvco=3607.60, Nint=069, Nfrac=049)
+Fch=902.00 (Fvco=3608.00, Nint=069, Nfrac=050)
+Fch=902.10 (Fvco=3608.40, Nint=069, Nfrac=051)
+Fch=902.20 (Fvco=3608.80, Nint=069, Nfrac=052)
+Fch=902.30 (Fvco=3609.20, Nint=069, Nfrac=053)
+Fch=902.40 (Fvco=3609.60, Nint=069, Nfrac=054)
+Fch=902.50 (Fvco=3610.00, Nint=069, Nfrac=055)
+Fch=902.60 (Fvco=3610.40, Nint=069, Nfrac=056)
+Fch=902.70 (Fvco=3610.80, Nint=069, Nfrac=057)
+Fch=902.80 (Fvco=3611.20, Nint=069, Nfrac=058)
+Fch=902.90 (Fvco=3611.60, Nint=069, Nfrac=059)
+Fch=903.00 (Fvco=3612.00, Nint=069, Nfrac=060)
+Fch=903.10 (Fvco=3612.40, Nint=069, Nfrac=061)
+Fch=903.20 (Fvco=3612.80, Nint=069, Nfrac=062)
+Fch=903.30 (Fvco=3613.20, Nint=069, Nfrac=063)
+Fch=903.40 (Fvco=3613.60, Nint=069, Nfrac=064)
+Fch=903.50 (Fvco=3614.00, Nint=069, Nfrac=065)
+Fch=903.60 (Fvco=3614.40, Nint=069, Nfrac=066)
+Fch=903.70 (Fvco=3614.80, Nint=069, Nfrac=067)
+Fch=903.80 (Fvco=3615.20, Nint=069, Nfrac=068)
+Fch=903.90 (Fvco=3615.60, Nint=069, Nfrac=069)
+Fch=904.00 (Fvco=3616.00, Nint=069, Nfrac=070)
+Fch=904.10 (Fvco=3616.40, Nint=069, Nfrac=071)
+Fch=904.20 (Fvco=3616.80, Nint=069, Nfrac=072)
+Fch=904.30 (Fvco=3617.20, Nint=069, Nfrac=073)
+Fch=904.40 (Fvco=3617.60, Nint=069, Nfrac=074)
+Fch=904.50 (Fvco=3618.00, Nint=069, Nfrac=075)
+Fch=904.60 (Fvco=3618.40, Nint=069, Nfrac=076)
+Fch=904.70 (Fvco=3618.80, Nint=069, Nfrac=077)
+Fch=904.80 (Fvco=3619.20, Nint=069, Nfrac=078)
+Fch=904.90 (Fvco=3619.60, Nint=069, Nfrac=079)
+Fch=905.00 (Fvco=3620.00, Nint=069, Nfrac=080)
+Fch=905.10 (Fvco=3620.40, Nint=069, Nfrac=081)
+Fch=905.20 (Fvco=3620.80, Nint=069, Nfrac=082)
+Fch=905.30 (Fvco=3621.20, Nint=069, Nfrac=083)
+Fch=905.40 (Fvco=3621.60, Nint=069, Nfrac=084)
+Fch=905.50 (Fvco=3622.00, Nint=069, Nfrac=085)
+Fch=905.60 (Fvco=3622.40, Nint=069, Nfrac=086)
+Fch=905.70 (Fvco=3622.80, Nint=069, Nfrac=087)
+Fch=905.80 (Fvco=3623.20, Nint=069, Nfrac=088)
+Fch=905.90 (Fvco=3623.60, Nint=069, Nfrac=089)
+Fch=906.00 (Fvco=3624.00, Nint=069, Nfrac=090)
+Fch=906.10 (Fvco=3624.40, Nint=069, Nfrac=091)
+Fch=906.20 (Fvco=3624.80, Nint=069, Nfrac=092)
+Fch=906.30 (Fvco=3625.20, Nint=069, Nfrac=093)
+Fch=906.40 (Fvco=3625.60, Nint=069, Nfrac=094)
+Fch=906.50 (Fvco=3626.00, Nint=069, Nfrac=095)
+Fch=906.60 (Fvco=3626.40, Nint=069, Nfrac=096)
+Fch=906.70 (Fvco=3626.80, Nint=069, Nfrac=097)
+Fch=906.80 (Fvco=3627.20, Nint=069, Nfrac=098)
+Fch=906.90 (Fvco=3627.60, Nint=069, Nfrac=099)
+Fch=907.00 (Fvco=3628.00, Nint=069, Nfrac=100)
+Fch=907.10 (Fvco=3628.40, Nint=069, Nfrac=101)
+Fch=907.20 (Fvco=3628.80, Nint=069, Nfrac=102)
+Fch=907.30 (Fvco=3629.20, Nint=069, Nfrac=103)
+Fch=907.40 (Fvco=3629.60, Nint=069, Nfrac=104)
+Fch=907.50 (Fvco=3630.00, Nint=069, Nfrac=105)
+Fch=907.60 (Fvco=3630.40, Nint=069, Nfrac=106)
+Fch=907.70 (Fvco=3630.80, Nint=069, Nfrac=107)
+Fch=907.80 (Fvco=3631.20, Nint=069, Nfrac=108)
+Fch=907.90 (Fvco=3631.60, Nint=069, Nfrac=109)
+Fch=908.00 (Fvco=3632.00, Nint=069, Nfrac=110)
+Fch=908.10 (Fvco=3632.40, Nint=069, Nfrac=111)
+Fch=908.20 (Fvco=3632.80, Nint=069, Nfrac=112)
+Fch=908.30 (Fvco=3633.20, Nint=069, Nfrac=113)
+Fch=908.40 (Fvco=3633.60, Nint=069, Nfrac=114)
+Fch=908.50 (Fvco=3634.00, Nint=069, Nfrac=115)
+Fch=908.60 (Fvco=3634.40, Nint=069, Nfrac=116)
+Fch=908.70 (Fvco=3634.80, Nint=069, Nfrac=117)
+Fch=908.80 (Fvco=3635.20, Nint=069, Nfrac=118)
+Fch=908.90 (Fvco=3635.60, Nint=069, Nfrac=119)
+Fch=909.00 (Fvco=3636.00, Nint=069, Nfrac=120)
+Fch=909.10 (Fvco=3636.40, Nint=069, Nfrac=121)
+Fch=909.20 (Fvco=3636.80, Nint=069, Nfrac=122)
+Fch=909.30 (Fvco=3637.20, Nint=069, Nfrac=123)
+Fch=909.40 (Fvco=3637.60, Nint=069, Nfrac=124)
+Fch=909.50 (Fvco=3638.00, Nint=069, Nfrac=125)
+Fch=909.60 (Fvco=3638.40, Nint=069, Nfrac=126)
+Fch=909.70 (Fvco=3638.80, Nint=069, Nfrac=127)
+Fch=909.80 (Fvco=3639.20, Nint=069, Nfrac=128)
+Fch=909.90 (Fvco=3639.60, Nint=069, Nfrac=129)
+Fch=910.00 (Fvco=3640.00, Nint=069, Nfrac=130)
+Fch=910.00 (Fvco=3640.00, Nint=070, Nfrac=000)
+Fch=910.10 (Fvco=3640.40, Nint=070, Nfrac=001)
+Fch=910.20 (Fvco=3640.80, Nint=070, Nfrac=002)
+Fch=910.30 (Fvco=3641.20, Nint=070, Nfrac=003)
+Fch=910.40 (Fvco=3641.60, Nint=070, Nfrac=004)
+Fch=910.50 (Fvco=3642.00, Nint=070, Nfrac=005)
+Fch=910.60 (Fvco=3642.40, Nint=070, Nfrac=006)
+Fch=910.70 (Fvco=3642.80, Nint=070, Nfrac=007)
+Fch=910.80 (Fvco=3643.20, Nint=070, Nfrac=008)
+Fch=910.90 (Fvco=3643.60, Nint=070, Nfrac=009)
+Fch=911.00 (Fvco=3644.00, Nint=070, Nfrac=010)
+Fch=911.10 (Fvco=3644.40, Nint=070, Nfrac=011)
+Fch=911.20 (Fvco=3644.80, Nint=070, Nfrac=012)
+Fch=911.30 (Fvco=3645.20, Nint=070, Nfrac=013)
+Fch=911.40 (Fvco=3645.60, Nint=070, Nfrac=014)
+Fch=911.50 (Fvco=3646.00, Nint=070, Nfrac=015)
+Fch=911.60 (Fvco=3646.40, Nint=070, Nfrac=016)
+Fch=911.70 (Fvco=3646.80, Nint=070, Nfrac=017)
+Fch=911.80 (Fvco=3647.20, Nint=070, Nfrac=018)
+Fch=911.90 (Fvco=3647.60, Nint=070, Nfrac=019)
+Fch=912.00 (Fvco=3648.00, Nint=070, Nfrac=020)
+Fch=912.10 (Fvco=3648.40, Nint=070, Nfrac=021)
+Fch=912.20 (Fvco=3648.80, Nint=070, Nfrac=022)
+Fch=912.30 (Fvco=3649.20, Nint=070, Nfrac=023)
+Fch=912.40 (Fvco=3649.60, Nint=070, Nfrac=024)
+Fch=912.50 (Fvco=3650.00, Nint=070, Nfrac=025)
+Fch=912.60 (Fvco=3650.40, Nint=070, Nfrac=026)
+Fch=912.70 (Fvco=3650.80, Nint=070, Nfrac=027)
+Fch=912.80 (Fvco=3651.20, Nint=070, Nfrac=028)
+Fch=912.90 (Fvco=3651.60, Nint=070, Nfrac=029)
+Fch=913.00 (Fvco=3652.00, Nint=070, Nfrac=030)
+Fch=913.10 (Fvco=3652.40, Nint=070, Nfrac=031)
+Fch=913.20 (Fvco=3652.80, Nint=070, Nfrac=032)
+Fch=913.30 (Fvco=3653.20, Nint=070, Nfrac=033)
+Fch=913.40 (Fvco=3653.60, Nint=070, Nfrac=034)
+Fch=913.50 (Fvco=3654.00, Nint=070, Nfrac=035)
+Fch=913.60 (Fvco=3654.40, Nint=070, Nfrac=036)
+Fch=913.70 (Fvco=3654.80, Nint=070, Nfrac=037)
+Fch=913.80 (Fvco=3655.20, Nint=070, Nfrac=038)
+Fch=913.90 (Fvco=3655.60, Nint=070, Nfrac=039)
+Fch=914.00 (Fvco=3656.00, Nint=070, Nfrac=040)
+Fch=914.10 (Fvco=3656.40, Nint=070, Nfrac=041)
+Fch=914.20 (Fvco=3656.80, Nint=070, Nfrac=042)
+Fch=914.30 (Fvco=3657.20, Nint=070, Nfrac=043)
+Fch=914.40 (Fvco=3657.60, Nint=070, Nfrac=044)
+Fch=914.50 (Fvco=3658.00, Nint=070, Nfrac=045)
+Fch=914.60 (Fvco=3658.40, Nint=070, Nfrac=046)
+Fch=914.70 (Fvco=3658.80, Nint=070, Nfrac=047)
+Fch=914.80 (Fvco=3659.20, Nint=070, Nfrac=048)
+Fch=914.90 (Fvco=3659.60, Nint=070, Nfrac=049)
+Fch=915.00 (Fvco=3660.00, Nint=070, Nfrac=050)
+Fch=915.10 (Fvco=3660.40, Nint=070, Nfrac=051)
+Fch=915.20 (Fvco=3660.80, Nint=070, Nfrac=052)
+Fch=915.30 (Fvco=3661.20, Nint=070, Nfrac=053)
+Fch=915.40 (Fvco=3661.60, Nint=070, Nfrac=054)
+Fch=915.50 (Fvco=3662.00, Nint=070, Nfrac=055)
+Fch=915.60 (Fvco=3662.40, Nint=070, Nfrac=056)
+Fch=915.70 (Fvco=3662.80, Nint=070, Nfrac=057)
+Fch=915.80 (Fvco=3663.20, Nint=070, Nfrac=058)
+Fch=915.90 (Fvco=3663.60, Nint=070, Nfrac=059)
+Fch=916.00 (Fvco=3664.00, Nint=070, Nfrac=060)
+Fch=916.10 (Fvco=3664.40, Nint=070, Nfrac=061)
+Fch=916.20 (Fvco=3664.80, Nint=070, Nfrac=062)
+Fch=916.30 (Fvco=3665.20, Nint=070, Nfrac=063)
+Fch=916.40 (Fvco=3665.60, Nint=070, Nfrac=064)
+Fch=916.50 (Fvco=3666.00, Nint=070, Nfrac=065)
+Fch=916.60 (Fvco=3666.40, Nint=070, Nfrac=066)
+Fch=916.70 (Fvco=3666.80, Nint=070, Nfrac=067)
+Fch=916.80 (Fvco=3667.20, Nint=070, Nfrac=068)
+Fch=916.90 (Fvco=3667.60, Nint=070, Nfrac=069)
+Fch=917.00 (Fvco=3668.00, Nint=070, Nfrac=070)
+Fch=917.10 (Fvco=3668.40, Nint=070, Nfrac=071)
+Fch=917.20 (Fvco=3668.80, Nint=070, Nfrac=072)
+Fch=917.30 (Fvco=3669.20, Nint=070, Nfrac=073)
+Fch=917.40 (Fvco=3669.60, Nint=070, Nfrac=074)
+Fch=917.50 (Fvco=3670.00, Nint=070, Nfrac=075)
+Fch=917.60 (Fvco=3670.40, Nint=070, Nfrac=076)
+Fch=917.70 (Fvco=3670.80, Nint=070, Nfrac=077)
+Fch=917.80 (Fvco=3671.20, Nint=070, Nfrac=078)
+Fch=917.90 (Fvco=3671.60, Nint=070, Nfrac=079)
+Fch=918.00 (Fvco=3672.00, Nint=070, Nfrac=080)
+Fch=918.10 (Fvco=3672.40, Nint=070, Nfrac=081)
+Fch=918.20 (Fvco=3672.80, Nint=070, Nfrac=082)
+Fch=918.30 (Fvco=3673.20, Nint=070, Nfrac=083)
+Fch=918.40 (Fvco=3673.60, Nint=070, Nfrac=084)
+Fch=918.50 (Fvco=3674.00, Nint=070, Nfrac=085)
+Fch=918.60 (Fvco=3674.40, Nint=070, Nfrac=086)
+Fch=918.70 (Fvco=3674.80, Nint=070, Nfrac=087)
+Fch=918.80 (Fvco=3675.20, Nint=070, Nfrac=088)
+Fch=918.90 (Fvco=3675.60, Nint=070, Nfrac=089)
+Fch=919.00 (Fvco=3676.00, Nint=070, Nfrac=090)
+Fch=919.10 (Fvco=3676.40, Nint=070, Nfrac=091)
+Fch=919.20 (Fvco=3676.80, Nint=070, Nfrac=092)
+Fch=919.30 (Fvco=3677.20, Nint=070, Nfrac=093)
+Fch=919.40 (Fvco=3677.60, Nint=070, Nfrac=094)
+Fch=919.50 (Fvco=3678.00, Nint=070, Nfrac=095)
+Fch=919.60 (Fvco=3678.40, Nint=070, Nfrac=096)
+Fch=919.70 (Fvco=3678.80, Nint=070, Nfrac=097)
+Fch=919.80 (Fvco=3679.20, Nint=070, Nfrac=098)
+Fch=919.90 (Fvco=3679.60, Nint=070, Nfrac=099)
+Fch=920.00 (Fvco=3680.00, Nint=070, Nfrac=100)
+Fch=920.10 (Fvco=3680.40, Nint=070, Nfrac=101)
+Fch=920.20 (Fvco=3680.80, Nint=070, Nfrac=102)
+Fch=920.30 (Fvco=3681.20, Nint=070, Nfrac=103)
+Fch=920.40 (Fvco=3681.60, Nint=070, Nfrac=104)
+Fch=920.50 (Fvco=3682.00, Nint=070, Nfrac=105)
+Fch=920.60 (Fvco=3682.40, Nint=070, Nfrac=106)
+Fch=920.70 (Fvco=3682.80, Nint=070, Nfrac=107)
+Fch=920.80 (Fvco=3683.20, Nint=070, Nfrac=108)
+Fch=920.90 (Fvco=3683.60, Nint=070, Nfrac=109)
+Fch=921.00 (Fvco=3684.00, Nint=070, Nfrac=110)
+Fch=921.10 (Fvco=3684.40, Nint=070, Nfrac=111)
+Fch=921.20 (Fvco=3684.80, Nint=070, Nfrac=112)
+Fch=921.30 (Fvco=3685.20, Nint=070, Nfrac=113)
+Fch=921.40 (Fvco=3685.60, Nint=070, Nfrac=114)
+Fch=921.50 (Fvco=3686.00, Nint=070, Nfrac=115)
+Fch=921.60 (Fvco=3686.40, Nint=070, Nfrac=116)
+Fch=921.70 (Fvco=3686.80, Nint=070, Nfrac=117)
+Fch=921.80 (Fvco=3687.20, Nint=070, Nfrac=118)
+Fch=921.90 (Fvco=3687.60, Nint=070, Nfrac=119)
+Fch=922.00 (Fvco=3688.00, Nint=070, Nfrac=120)
+Fch=922.10 (Fvco=3688.40, Nint=070, Nfrac=121)
+Fch=922.20 (Fvco=3688.80, Nint=070, Nfrac=122)
+Fch=922.30 (Fvco=3689.20, Nint=070, Nfrac=123)
+Fch=922.40 (Fvco=3689.60, Nint=070, Nfrac=124)
+Fch=922.50 (Fvco=3690.00, Nint=070, Nfrac=125)
+Fch=922.60 (Fvco=3690.40, Nint=070, Nfrac=126)
+Fch=922.70 (Fvco=3690.80, Nint=070, Nfrac=127)
+Fch=922.80 (Fvco=3691.20, Nint=070, Nfrac=128)
+Fch=922.90 (Fvco=3691.60, Nint=070, Nfrac=129)
+Fch=923.00 (Fvco=3692.00, Nint=070, Nfrac=130)
+Fch=923.00 (Fvco=3692.00, Nint=071, Nfrac=000)
+Fch=923.10 (Fvco=3692.40, Nint=071, Nfrac=001)
+Fch=923.20 (Fvco=3692.80, Nint=071, Nfrac=002)
+Fch=923.30 (Fvco=3693.20, Nint=071, Nfrac=003)
+Fch=923.40 (Fvco=3693.60, Nint=071, Nfrac=004)
+Fch=923.50 (Fvco=3694.00, Nint=071, Nfrac=005)
+Fch=923.60 (Fvco=3694.40, Nint=071, Nfrac=006)
+Fch=923.70 (Fvco=3694.80, Nint=071, Nfrac=007)
+Fch=923.80 (Fvco=3695.20, Nint=071, Nfrac=008)
+Fch=923.90 (Fvco=3695.60, Nint=071, Nfrac=009)
+Fch=924.00 (Fvco=3696.00, Nint=071, Nfrac=010)
+Fch=924.10 (Fvco=3696.40, Nint=071, Nfrac=011)
+Fch=924.20 (Fvco=3696.80, Nint=071, Nfrac=012)
+Fch=924.30 (Fvco=3697.20, Nint=071, Nfrac=013)
+Fch=924.40 (Fvco=3697.60, Nint=071, Nfrac=014)
+Fch=924.50 (Fvco=3698.00, Nint=071, Nfrac=015)
+Fch=924.60 (Fvco=3698.40, Nint=071, Nfrac=016)
+Fch=924.70 (Fvco=3698.80, Nint=071, Nfrac=017)
+Fch=924.80 (Fvco=3699.20, Nint=071, Nfrac=018)
+Fch=924.90 (Fvco=3699.60, Nint=071, Nfrac=019)
+Fch=925.00 (Fvco=3700.00, Nint=071, Nfrac=020)
+Fch=925.10 (Fvco=3700.40, Nint=071, Nfrac=021)
+Fch=925.20 (Fvco=3700.80, Nint=071, Nfrac=022)
+Fch=925.30 (Fvco=3701.20, Nint=071, Nfrac=023)
+Fch=925.40 (Fvco=3701.60, Nint=071, Nfrac=024)
+Fch=925.50 (Fvco=3702.00, Nint=071, Nfrac=025)
+Fch=925.60 (Fvco=3702.40, Nint=071, Nfrac=026)
+Fch=925.70 (Fvco=3702.80, Nint=071, Nfrac=027)
+Fch=925.80 (Fvco=3703.20, Nint=071, Nfrac=028)
+Fch=925.90 (Fvco=3703.60, Nint=071, Nfrac=029)
+Fch=926.00 (Fvco=3704.00, Nint=071, Nfrac=030)
+Fch=926.10 (Fvco=3704.40, Nint=071, Nfrac=031)
+Fch=926.20 (Fvco=3704.80, Nint=071, Nfrac=032)
+Fch=926.30 (Fvco=3705.20, Nint=071, Nfrac=033)
+Fch=926.40 (Fvco=3705.60, Nint=071, Nfrac=034)
+Fch=926.50 (Fvco=3706.00, Nint=071, Nfrac=035)
+Fch=926.60 (Fvco=3706.40, Nint=071, Nfrac=036)
+Fch=926.70 (Fvco=3706.80, Nint=071, Nfrac=037)
+Fch=926.80 (Fvco=3707.20, Nint=071, Nfrac=038)
+Fch=926.90 (Fvco=3707.60, Nint=071, Nfrac=039)
+Fch=927.00 (Fvco=3708.00, Nint=071, Nfrac=040)
+Fch=927.10 (Fvco=3708.40, Nint=071, Nfrac=041)
+Fch=927.20 (Fvco=3708.80, Nint=071, Nfrac=042)
+Fch=927.30 (Fvco=3709.20, Nint=071, Nfrac=043)
+Fch=927.40 (Fvco=3709.60, Nint=071, Nfrac=044)
+Fch=927.50 (Fvco=3710.00, Nint=071, Nfrac=045)
+Fch=927.60 (Fvco=3710.40, Nint=071, Nfrac=046)
+Fch=927.70 (Fvco=3710.80, Nint=071, Nfrac=047)
+Fch=927.80 (Fvco=3711.20, Nint=071, Nfrac=048)
+Fch=927.90 (Fvco=3711.60, Nint=071, Nfrac=049)
+Fch=928.00 (Fvco=3712.00, Nint=071, Nfrac=050)
+Fch=928.10 (Fvco=3712.40, Nint=071, Nfrac=051)
+Fch=928.20 (Fvco=3712.80, Nint=071, Nfrac=052)
+Fch=928.30 (Fvco=3713.20, Nint=071, Nfrac=053)
+Fch=928.40 (Fvco=3713.60, Nint=071, Nfrac=054)
+Fch=928.50 (Fvco=3714.00, Nint=071, Nfrac=055)
+Fch=928.60 (Fvco=3714.40, Nint=071, Nfrac=056)
+Fch=928.70 (Fvco=3714.80, Nint=071, Nfrac=057)
+Fch=928.80 (Fvco=3715.20, Nint=071, Nfrac=058)
+Fch=928.90 (Fvco=3715.60, Nint=071, Nfrac=059)
+Fch=929.00 (Fvco=3716.00, Nint=071, Nfrac=060)
+Fch=929.10 (Fvco=3716.40, Nint=071, Nfrac=061)
+Fch=929.20 (Fvco=3716.80, Nint=071, Nfrac=062)
+Fch=929.30 (Fvco=3717.20, Nint=071, Nfrac=063)
+Fch=929.40 (Fvco=3717.60, Nint=071, Nfrac=064)
+Fch=929.50 (Fvco=3718.00, Nint=071, Nfrac=065)
+Fch=929.60 (Fvco=3718.40, Nint=071, Nfrac=066)
+Fch=929.70 (Fvco=3718.80, Nint=071, Nfrac=067)
+Fch=929.80 (Fvco=3719.20, Nint=071, Nfrac=068)
+Fch=929.90 (Fvco=3719.60, Nint=071, Nfrac=069)
+Fch=930.00 (Fvco=3720.00, Nint=071, Nfrac=070)
+Fch=930.10 (Fvco=3720.40, Nint=071, Nfrac=071)
+Fch=930.20 (Fvco=3720.80, Nint=071, Nfrac=072)
+Fch=930.30 (Fvco=3721.20, Nint=071, Nfrac=073)
+Fch=930.40 (Fvco=3721.60, Nint=071, Nfrac=074)
+Fch=930.50 (Fvco=3722.00, Nint=071, Nfrac=075)
+Fch=930.60 (Fvco=3722.40, Nint=071, Nfrac=076)
+Fch=930.70 (Fvco=3722.80, Nint=071, Nfrac=077)
+Fch=930.80 (Fvco=3723.20, Nint=071, Nfrac=078)
+Fch=930.90 (Fvco=3723.60, Nint=071, Nfrac=079)
+Fch=931.00 (Fvco=3724.00, Nint=071, Nfrac=080)
+Fch=931.10 (Fvco=3724.40, Nint=071, Nfrac=081)
+Fch=931.20 (Fvco=3724.80, Nint=071, Nfrac=082)
+Fch=931.30 (Fvco=3725.20, Nint=071, Nfrac=083)
+Fch=931.40 (Fvco=3725.60, Nint=071, Nfrac=084)
+Fch=931.50 (Fvco=3726.00, Nint=071, Nfrac=085)
+Fch=931.60 (Fvco=3726.40, Nint=071, Nfrac=086)
+Fch=931.70 (Fvco=3726.80, Nint=071, Nfrac=087)
+Fch=931.80 (Fvco=3727.20, Nint=071, Nfrac=088)
+Fch=931.90 (Fvco=3727.60, Nint=071, Nfrac=089)
+Fch=932.00 (Fvco=3728.00, Nint=071, Nfrac=090)
+Fch=932.10 (Fvco=3728.40, Nint=071, Nfrac=091)
+Fch=932.20 (Fvco=3728.80, Nint=071, Nfrac=092)
+Fch=932.30 (Fvco=3729.20, Nint=071, Nfrac=093)
+Fch=932.40 (Fvco=3729.60, Nint=071, Nfrac=094)
+Fch=932.50 (Fvco=3730.00, Nint=071, Nfrac=095)
+Fch=932.60 (Fvco=3730.40, Nint=071, Nfrac=096)
+Fch=932.70 (Fvco=3730.80, Nint=071, Nfrac=097)
+Fch=932.80 (Fvco=3731.20, Nint=071, Nfrac=098)
+Fch=932.90 (Fvco=3731.60, Nint=071, Nfrac=099)
+Fch=933.00 (Fvco=3732.00, Nint=071, Nfrac=100)
+Fch=933.10 (Fvco=3732.40, Nint=071, Nfrac=101)
+Fch=933.20 (Fvco=3732.80, Nint=071, Nfrac=102)
+Fch=933.30 (Fvco=3733.20, Nint=071, Nfrac=103)
+Fch=933.40 (Fvco=3733.60, Nint=071, Nfrac=104)
+Fch=933.50 (Fvco=3734.00, Nint=071, Nfrac=105)
+Fch=933.60 (Fvco=3734.40, Nint=071, Nfrac=106)
+Fch=933.70 (Fvco=3734.80, Nint=071, Nfrac=107)
+Fch=933.80 (Fvco=3735.20, Nint=071, Nfrac=108)
+Fch=933.90 (Fvco=3735.60, Nint=071, Nfrac=109)
+Fch=934.00 (Fvco=3736.00, Nint=071, Nfrac=110)
+Fch=934.10 (Fvco=3736.40, Nint=071, Nfrac=111)
+Fch=934.20 (Fvco=3736.80, Nint=071, Nfrac=112)
+Fch=934.30 (Fvco=3737.20, Nint=071, Nfrac=113)
+Fch=934.40 (Fvco=3737.60, Nint=071, Nfrac=114)
+Fch=934.50 (Fvco=3738.00, Nint=071, Nfrac=115)
+Fch=934.60 (Fvco=3738.40, Nint=071, Nfrac=116)
+Fch=934.70 (Fvco=3738.80, Nint=071, Nfrac=117)
+Fch=934.80 (Fvco=3739.20, Nint=071, Nfrac=118)
+Fch=934.90 (Fvco=3739.60, Nint=071, Nfrac=119)
+Fch=935.00 (Fvco=3740.00, Nint=071, Nfrac=120)
+Fch=935.10 (Fvco=3740.40, Nint=071, Nfrac=121)
+Fch=935.20 (Fvco=3740.80, Nint=071, Nfrac=122)
+Fch=935.30 (Fvco=3741.20, Nint=071, Nfrac=123)
+Fch=935.40 (Fvco=3741.60, Nint=071, Nfrac=124)
+Fch=935.50 (Fvco=3742.00, Nint=071, Nfrac=125)
+Fch=935.60 (Fvco=3742.40, Nint=071, Nfrac=126)
+Fch=935.70 (Fvco=3742.80, Nint=071, Nfrac=127)
+Fch=935.80 (Fvco=3743.20, Nint=071, Nfrac=128)
+Fch=935.90 (Fvco=3743.60, Nint=071, Nfrac=129)
+Fch=936.00 (Fvco=3744.00, Nint=071, Nfrac=130)
+Fch=936.00 (Fvco=3744.00, Nint=072, Nfrac=000)
+Fch=936.10 (Fvco=3744.40, Nint=072, Nfrac=001)
+Fch=936.20 (Fvco=3744.80, Nint=072, Nfrac=002)
+Fch=936.30 (Fvco=3745.20, Nint=072, Nfrac=003)
+Fch=936.40 (Fvco=3745.60, Nint=072, Nfrac=004)
+Fch=936.50 (Fvco=3746.00, Nint=072, Nfrac=005)
+Fch=936.60 (Fvco=3746.40, Nint=072, Nfrac=006)
+Fch=936.70 (Fvco=3746.80, Nint=072, Nfrac=007)
+Fch=936.80 (Fvco=3747.20, Nint=072, Nfrac=008)
+Fch=936.90 (Fvco=3747.60, Nint=072, Nfrac=009)
+Fch=937.00 (Fvco=3748.00, Nint=072, Nfrac=010)
+Fch=937.10 (Fvco=3748.40, Nint=072, Nfrac=011)
+Fch=937.20 (Fvco=3748.80, Nint=072, Nfrac=012)
+Fch=937.30 (Fvco=3749.20, Nint=072, Nfrac=013)
+Fch=937.40 (Fvco=3749.60, Nint=072, Nfrac=014)
+Fch=937.50 (Fvco=3750.00, Nint=072, Nfrac=015)
+Fch=937.60 (Fvco=3750.40, Nint=072, Nfrac=016)
+Fch=937.70 (Fvco=3750.80, Nint=072, Nfrac=017)
+Fch=937.80 (Fvco=3751.20, Nint=072, Nfrac=018)
+Fch=937.90 (Fvco=3751.60, Nint=072, Nfrac=019)
+Fch=938.00 (Fvco=3752.00, Nint=072, Nfrac=020)
+Fch=938.10 (Fvco=3752.40, Nint=072, Nfrac=021)
+Fch=938.20 (Fvco=3752.80, Nint=072, Nfrac=022)
+Fch=938.30 (Fvco=3753.20, Nint=072, Nfrac=023)
+Fch=938.40 (Fvco=3753.60, Nint=072, Nfrac=024)
+Fch=938.50 (Fvco=3754.00, Nint=072, Nfrac=025)
+Fch=938.60 (Fvco=3754.40, Nint=072, Nfrac=026)
+Fch=938.70 (Fvco=3754.80, Nint=072, Nfrac=027)
+Fch=938.80 (Fvco=3755.20, Nint=072, Nfrac=028)
+Fch=938.90 (Fvco=3755.60, Nint=072, Nfrac=029)
+Fch=939.00 (Fvco=3756.00, Nint=072, Nfrac=030)
+Fch=939.10 (Fvco=3756.40, Nint=072, Nfrac=031)
+Fch=939.20 (Fvco=3756.80, Nint=072, Nfrac=032)
+Fch=939.30 (Fvco=3757.20, Nint=072, Nfrac=033)
+Fch=939.40 (Fvco=3757.60, Nint=072, Nfrac=034)
+Fch=939.50 (Fvco=3758.00, Nint=072, Nfrac=035)
+Fch=939.60 (Fvco=3758.40, Nint=072, Nfrac=036)
+Fch=939.70 (Fvco=3758.80, Nint=072, Nfrac=037)
+Fch=939.80 (Fvco=3759.20, Nint=072, Nfrac=038)
+Fch=939.90 (Fvco=3759.60, Nint=072, Nfrac=039)
+Fch=940.00 (Fvco=3760.00, Nint=072, Nfrac=040)
+Fch=940.10 (Fvco=3760.40, Nint=072, Nfrac=041)
+Fch=940.20 (Fvco=3760.80, Nint=072, Nfrac=042)
+Fch=940.30 (Fvco=3761.20, Nint=072, Nfrac=043)
+Fch=940.40 (Fvco=3761.60, Nint=072, Nfrac=044)
+Fch=940.50 (Fvco=3762.00, Nint=072, Nfrac=045)
+Fch=940.60 (Fvco=3762.40, Nint=072, Nfrac=046)
+Fch=940.70 (Fvco=3762.80, Nint=072, Nfrac=047)
+Fch=940.80 (Fvco=3763.20, Nint=072, Nfrac=048)
+Fch=940.90 (Fvco=3763.60, Nint=072, Nfrac=049)
+Fch=941.00 (Fvco=3764.00, Nint=072, Nfrac=050)
+Fch=941.10 (Fvco=3764.40, Nint=072, Nfrac=051)
+Fch=941.20 (Fvco=3764.80, Nint=072, Nfrac=052)
+Fch=941.30 (Fvco=3765.20, Nint=072, Nfrac=053)
+Fch=941.40 (Fvco=3765.60, Nint=072, Nfrac=054)
+Fch=941.50 (Fvco=3766.00, Nint=072, Nfrac=055)
+Fch=941.60 (Fvco=3766.40, Nint=072, Nfrac=056)
+Fch=941.70 (Fvco=3766.80, Nint=072, Nfrac=057)
+Fch=941.80 (Fvco=3767.20, Nint=072, Nfrac=058)
+Fch=941.90 (Fvco=3767.60, Nint=072, Nfrac=059)
+Fch=942.00 (Fvco=3768.00, Nint=072, Nfrac=060)
+Fch=942.10 (Fvco=3768.40, Nint=072, Nfrac=061)
+Fch=942.20 (Fvco=3768.80, Nint=072, Nfrac=062)
+Fch=942.30 (Fvco=3769.20, Nint=072, Nfrac=063)
+Fch=942.40 (Fvco=3769.60, Nint=072, Nfrac=064)
+Fch=942.50 (Fvco=3770.00, Nint=072, Nfrac=065)
+Fch=942.60 (Fvco=3770.40, Nint=072, Nfrac=066)
+Fch=942.70 (Fvco=3770.80, Nint=072, Nfrac=067)
+Fch=942.80 (Fvco=3771.20, Nint=072, Nfrac=068)
+Fch=942.90 (Fvco=3771.60, Nint=072, Nfrac=069)
+Fch=943.00 (Fvco=3772.00, Nint=072, Nfrac=070)
+Fch=943.10 (Fvco=3772.40, Nint=072, Nfrac=071)
+Fch=943.20 (Fvco=3772.80, Nint=072, Nfrac=072)
+Fch=943.30 (Fvco=3773.20, Nint=072, Nfrac=073)
+Fch=943.40 (Fvco=3773.60, Nint=072, Nfrac=074)
+Fch=943.50 (Fvco=3774.00, Nint=072, Nfrac=075)
+Fch=943.60 (Fvco=3774.40, Nint=072, Nfrac=076)
+Fch=943.70 (Fvco=3774.80, Nint=072, Nfrac=077)
+Fch=943.80 (Fvco=3775.20, Nint=072, Nfrac=078)
+Fch=943.90 (Fvco=3775.60, Nint=072, Nfrac=079)
+Fch=944.00 (Fvco=3776.00, Nint=072, Nfrac=080)
+Fch=944.10 (Fvco=3776.40, Nint=072, Nfrac=081)
+Fch=944.20 (Fvco=3776.80, Nint=072, Nfrac=082)
+Fch=944.30 (Fvco=3777.20, Nint=072, Nfrac=083)
+Fch=944.40 (Fvco=3777.60, Nint=072, Nfrac=084)
+Fch=944.50 (Fvco=3778.00, Nint=072, Nfrac=085)
+Fch=944.60 (Fvco=3778.40, Nint=072, Nfrac=086)
+Fch=944.70 (Fvco=3778.80, Nint=072, Nfrac=087)
+Fch=944.80 (Fvco=3779.20, Nint=072, Nfrac=088)
+Fch=944.90 (Fvco=3779.60, Nint=072, Nfrac=089)
+Fch=945.00 (Fvco=3780.00, Nint=072, Nfrac=090)
+Fch=945.10 (Fvco=3780.40, Nint=072, Nfrac=091)
+Fch=945.20 (Fvco=3780.80, Nint=072, Nfrac=092)
+Fch=945.30 (Fvco=3781.20, Nint=072, Nfrac=093)
+Fch=945.40 (Fvco=3781.60, Nint=072, Nfrac=094)
+Fch=945.50 (Fvco=3782.00, Nint=072, Nfrac=095)
+Fch=945.60 (Fvco=3782.40, Nint=072, Nfrac=096)
+Fch=945.70 (Fvco=3782.80, Nint=072, Nfrac=097)
+Fch=945.80 (Fvco=3783.20, Nint=072, Nfrac=098)
+Fch=945.90 (Fvco=3783.60, Nint=072, Nfrac=099)
+Fch=946.00 (Fvco=3784.00, Nint=072, Nfrac=100)
+Fch=946.10 (Fvco=3784.40, Nint=072, Nfrac=101)
+Fch=946.20 (Fvco=3784.80, Nint=072, Nfrac=102)
+Fch=946.30 (Fvco=3785.20, Nint=072, Nfrac=103)
+Fch=946.40 (Fvco=3785.60, Nint=072, Nfrac=104)
+Fch=946.50 (Fvco=3786.00, Nint=072, Nfrac=105)
+Fch=946.60 (Fvco=3786.40, Nint=072, Nfrac=106)
+Fch=946.70 (Fvco=3786.80, Nint=072, Nfrac=107)
+Fch=946.80 (Fvco=3787.20, Nint=072, Nfrac=108)
+Fch=946.90 (Fvco=3787.60, Nint=072, Nfrac=109)
+Fch=947.00 (Fvco=3788.00, Nint=072, Nfrac=110)
+Fch=947.10 (Fvco=3788.40, Nint=072, Nfrac=111)
+Fch=947.20 (Fvco=3788.80, Nint=072, Nfrac=112)
+Fch=947.30 (Fvco=3789.20, Nint=072, Nfrac=113)
+Fch=947.40 (Fvco=3789.60, Nint=072, Nfrac=114)
+Fch=947.50 (Fvco=3790.00, Nint=072, Nfrac=115)
+Fch=947.60 (Fvco=3790.40, Nint=072, Nfrac=116)
+Fch=947.70 (Fvco=3790.80, Nint=072, Nfrac=117)
+Fch=947.80 (Fvco=3791.20, Nint=072, Nfrac=118)
+Fch=947.90 (Fvco=3791.60, Nint=072, Nfrac=119)
+Fch=948.00 (Fvco=3792.00, Nint=072, Nfrac=120)
+Fch=948.10 (Fvco=3792.40, Nint=072, Nfrac=121)
+Fch=948.20 (Fvco=3792.80, Nint=072, Nfrac=122)
+Fch=948.30 (Fvco=3793.20, Nint=072, Nfrac=123)
+Fch=948.40 (Fvco=3793.60, Nint=072, Nfrac=124)
+Fch=948.50 (Fvco=3794.00, Nint=072, Nfrac=125)
+Fch=948.60 (Fvco=3794.40, Nint=072, Nfrac=126)
+Fch=948.70 (Fvco=3794.80, Nint=072, Nfrac=127)
+Fch=948.80 (Fvco=3795.20, Nint=072, Nfrac=128)
+Fch=948.90 (Fvco=3795.60, Nint=072, Nfrac=129)
+Fch=949.00 (Fvco=3796.00, Nint=072, Nfrac=130)
+Fch=949.00 (Fvco=3796.00, Nint=073, Nfrac=000)
+Fch=949.10 (Fvco=3796.40, Nint=073, Nfrac=001)
+Fch=949.20 (Fvco=3796.80, Nint=073, Nfrac=002)
+Fch=949.30 (Fvco=3797.20, Nint=073, Nfrac=003)
+Fch=949.40 (Fvco=3797.60, Nint=073, Nfrac=004)
+Fch=949.50 (Fvco=3798.00, Nint=073, Nfrac=005)
+Fch=949.60 (Fvco=3798.40, Nint=073, Nfrac=006)
+Fch=949.70 (Fvco=3798.80, Nint=073, Nfrac=007)
+Fch=949.80 (Fvco=3799.20, Nint=073, Nfrac=008)
+Fch=949.90 (Fvco=3799.60, Nint=073, Nfrac=009)
+Fch=950.00 (Fvco=3800.00, Nint=073, Nfrac=010)
+Fch=950.10 (Fvco=3800.40, Nint=073, Nfrac=011)
+Fch=950.20 (Fvco=3800.80, Nint=073, Nfrac=012)
+Fch=950.30 (Fvco=3801.20, Nint=073, Nfrac=013)
+Fch=950.40 (Fvco=3801.60, Nint=073, Nfrac=014)
+Fch=950.50 (Fvco=3802.00, Nint=073, Nfrac=015)
+Fch=950.60 (Fvco=3802.40, Nint=073, Nfrac=016)
+Fch=950.70 (Fvco=3802.80, Nint=073, Nfrac=017)
+Fch=950.80 (Fvco=3803.20, Nint=073, Nfrac=018)
+Fch=950.90 (Fvco=3803.60, Nint=073, Nfrac=019)
+Fch=951.00 (Fvco=3804.00, Nint=073, Nfrac=020)
+Fch=951.10 (Fvco=3804.40, Nint=073, Nfrac=021)
+Fch=951.20 (Fvco=3804.80, Nint=073, Nfrac=022)
+Fch=951.30 (Fvco=3805.20, Nint=073, Nfrac=023)
+Fch=951.40 (Fvco=3805.60, Nint=073, Nfrac=024)
+Fch=951.50 (Fvco=3806.00, Nint=073, Nfrac=025)
+Fch=951.60 (Fvco=3806.40, Nint=073, Nfrac=026)
+Fch=951.70 (Fvco=3806.80, Nint=073, Nfrac=027)
+Fch=951.80 (Fvco=3807.20, Nint=073, Nfrac=028)
+Fch=951.90 (Fvco=3807.60, Nint=073, Nfrac=029)
+Fch=952.00 (Fvco=3808.00, Nint=073, Nfrac=030)
+Fch=952.10 (Fvco=3808.40, Nint=073, Nfrac=031)
+Fch=952.20 (Fvco=3808.80, Nint=073, Nfrac=032)
+Fch=952.30 (Fvco=3809.20, Nint=073, Nfrac=033)
+Fch=952.40 (Fvco=3809.60, Nint=073, Nfrac=034)
+Fch=952.50 (Fvco=3810.00, Nint=073, Nfrac=035)
+Fch=952.60 (Fvco=3810.40, Nint=073, Nfrac=036)
+Fch=952.70 (Fvco=3810.80, Nint=073, Nfrac=037)
+Fch=952.80 (Fvco=3811.20, Nint=073, Nfrac=038)
+Fch=952.90 (Fvco=3811.60, Nint=073, Nfrac=039)
+Fch=953.00 (Fvco=3812.00, Nint=073, Nfrac=040)
+Fch=953.10 (Fvco=3812.40, Nint=073, Nfrac=041)
+Fch=953.20 (Fvco=3812.80, Nint=073, Nfrac=042)
+Fch=953.30 (Fvco=3813.20, Nint=073, Nfrac=043)
+Fch=953.40 (Fvco=3813.60, Nint=073, Nfrac=044)
+Fch=953.50 (Fvco=3814.00, Nint=073, Nfrac=045)
+Fch=953.60 (Fvco=3814.40, Nint=073, Nfrac=046)
+Fch=953.70 (Fvco=3814.80, Nint=073, Nfrac=047)
+Fch=953.80 (Fvco=3815.20, Nint=073, Nfrac=048)
+Fch=953.90 (Fvco=3815.60, Nint=073, Nfrac=049)
+Fch=954.00 (Fvco=3816.00, Nint=073, Nfrac=050)
+Fch=954.10 (Fvco=3816.40, Nint=073, Nfrac=051)
+Fch=954.20 (Fvco=3816.80, Nint=073, Nfrac=052)
+Fch=954.30 (Fvco=3817.20, Nint=073, Nfrac=053)
+Fch=954.40 (Fvco=3817.60, Nint=073, Nfrac=054)
+Fch=954.50 (Fvco=3818.00, Nint=073, Nfrac=055)
+Fch=954.60 (Fvco=3818.40, Nint=073, Nfrac=056)
+Fch=954.70 (Fvco=3818.80, Nint=073, Nfrac=057)
+Fch=954.80 (Fvco=3819.20, Nint=073, Nfrac=058)
+Fch=954.90 (Fvco=3819.60, Nint=073, Nfrac=059)
+Fch=955.00 (Fvco=3820.00, Nint=073, Nfrac=060)
+Fch=955.10 (Fvco=3820.40, Nint=073, Nfrac=061)
+Fch=955.20 (Fvco=3820.80, Nint=073, Nfrac=062)
+Fch=955.30 (Fvco=3821.20, Nint=073, Nfrac=063)
+Fch=955.40 (Fvco=3821.60, Nint=073, Nfrac=064)
+Fch=955.50 (Fvco=3822.00, Nint=073, Nfrac=065)
+Fch=955.60 (Fvco=3822.40, Nint=073, Nfrac=066)
+Fch=955.70 (Fvco=3822.80, Nint=073, Nfrac=067)
+Fch=955.80 (Fvco=3823.20, Nint=073, Nfrac=068)
+Fch=955.90 (Fvco=3823.60, Nint=073, Nfrac=069)
+Fch=956.00 (Fvco=3824.00, Nint=073, Nfrac=070)
+Fch=956.10 (Fvco=3824.40, Nint=073, Nfrac=071)
+Fch=956.20 (Fvco=3824.80, Nint=073, Nfrac=072)
+Fch=956.30 (Fvco=3825.20, Nint=073, Nfrac=073)
+Fch=956.40 (Fvco=3825.60, Nint=073, Nfrac=074)
+Fch=956.50 (Fvco=3826.00, Nint=073, Nfrac=075)
+Fch=956.60 (Fvco=3826.40, Nint=073, Nfrac=076)
+Fch=956.70 (Fvco=3826.80, Nint=073, Nfrac=077)
+Fch=956.80 (Fvco=3827.20, Nint=073, Nfrac=078)
+Fch=956.90 (Fvco=3827.60, Nint=073, Nfrac=079)
+Fch=957.00 (Fvco=3828.00, Nint=073, Nfrac=080)
+Fch=957.10 (Fvco=3828.40, Nint=073, Nfrac=081)
+Fch=957.20 (Fvco=3828.80, Nint=073, Nfrac=082)
+Fch=957.30 (Fvco=3829.20, Nint=073, Nfrac=083)
+Fch=957.40 (Fvco=3829.60, Nint=073, Nfrac=084)
+Fch=957.50 (Fvco=3830.00, Nint=073, Nfrac=085)
+Fch=957.60 (Fvco=3830.40, Nint=073, Nfrac=086)
+Fch=957.70 (Fvco=3830.80, Nint=073, Nfrac=087)
+Fch=957.80 (Fvco=3831.20, Nint=073, Nfrac=088)
+Fch=957.90 (Fvco=3831.60, Nint=073, Nfrac=089)
+Fch=958.00 (Fvco=3832.00, Nint=073, Nfrac=090)
+Fch=958.10 (Fvco=3832.40, Nint=073, Nfrac=091)
+Fch=958.20 (Fvco=3832.80, Nint=073, Nfrac=092)
+Fch=958.30 (Fvco=3833.20, Nint=073, Nfrac=093)
+Fch=958.40 (Fvco=3833.60, Nint=073, Nfrac=094)
+Fch=958.50 (Fvco=3834.00, Nint=073, Nfrac=095)
+Fch=958.60 (Fvco=3834.40, Nint=073, Nfrac=096)
+Fch=958.70 (Fvco=3834.80, Nint=073, Nfrac=097)
+Fch=958.80 (Fvco=3835.20, Nint=073, Nfrac=098)
+Fch=958.90 (Fvco=3835.60, Nint=073, Nfrac=099)
+Fch=959.00 (Fvco=3836.00, Nint=073, Nfrac=100)
+Fch=959.10 (Fvco=3836.40, Nint=073, Nfrac=101)
+Fch=959.20 (Fvco=3836.80, Nint=073, Nfrac=102)
+Fch=959.30 (Fvco=3837.20, Nint=073, Nfrac=103)
+Fch=959.40 (Fvco=3837.60, Nint=073, Nfrac=104)
+Fch=959.50 (Fvco=3838.00, Nint=073, Nfrac=105)
+Fch=959.60 (Fvco=3838.40, Nint=073, Nfrac=106)
+Fch=959.70 (Fvco=3838.80, Nint=073, Nfrac=107)
+Fch=959.80 (Fvco=3839.20, Nint=073, Nfrac=108)
+Fch=959.90 (Fvco=3839.60, Nint=073, Nfrac=109)
+Fch=960.00 (Fvco=3840.00, Nint=073, Nfrac=110)
+Fch=960.10 (Fvco=3840.40, Nint=073, Nfrac=111)
+Fch=960.20 (Fvco=3840.80, Nint=073, Nfrac=112)
+Fch=960.30 (Fvco=3841.20, Nint=073, Nfrac=113)
+Fch=960.40 (Fvco=3841.60, Nint=073, Nfrac=114)
+Fch=960.50 (Fvco=3842.00, Nint=073, Nfrac=115)
+Fch=960.60 (Fvco=3842.40, Nint=073, Nfrac=116)
+Fch=960.70 (Fvco=3842.80, Nint=073, Nfrac=117)
+Fch=960.80 (Fvco=3843.20, Nint=073, Nfrac=118)
+Fch=960.90 (Fvco=3843.60, Nint=073, Nfrac=119)
+Fch=961.00 (Fvco=3844.00, Nint=073, Nfrac=120)
+Fch=961.10 (Fvco=3844.40, Nint=073, Nfrac=121)
+Fch=961.20 (Fvco=3844.80, Nint=073, Nfrac=122)
+Fch=961.30 (Fvco=3845.20, Nint=073, Nfrac=123)
+Fch=961.40 (Fvco=3845.60, Nint=073, Nfrac=124)
+Fch=961.50 (Fvco=3846.00, Nint=073, Nfrac=125)
+Fch=961.60 (Fvco=3846.40, Nint=073, Nfrac=126)
+Fch=961.70 (Fvco=3846.80, Nint=073, Nfrac=127)
+Fch=961.80 (Fvco=3847.20, Nint=073, Nfrac=128)
+Fch=961.90 (Fvco=3847.60, Nint=073, Nfrac=129)
+Fch=962.00 (Fvco=3848.00, Nint=073, Nfrac=130)
+======================================================================
+PLL Rx High Band:
+Fch=1794.00 (Fvco=3588.00, Nint=069, Nfrac=000)
+Fch=1794.20 (Fvco=3588.40, Nint=069, Nfrac=001)
+Fch=1794.40 (Fvco=3588.80, Nint=069, Nfrac=002)
+Fch=1794.60 (Fvco=3589.20, Nint=069, Nfrac=003)
+Fch=1794.80 (Fvco=3589.60, Nint=069, Nfrac=004)
+Fch=1795.00 (Fvco=3590.00, Nint=069, Nfrac=005)
+Fch=1795.20 (Fvco=3590.40, Nint=069, Nfrac=006)
+Fch=1795.40 (Fvco=3590.80, Nint=069, Nfrac=007)
+Fch=1795.60 (Fvco=3591.20, Nint=069, Nfrac=008)
+Fch=1795.80 (Fvco=3591.60, Nint=069, Nfrac=009)
+Fch=1796.00 (Fvco=3592.00, Nint=069, Nfrac=010)
+Fch=1796.20 (Fvco=3592.40, Nint=069, Nfrac=011)
+Fch=1796.40 (Fvco=3592.80, Nint=069, Nfrac=012)
+Fch=1796.60 (Fvco=3593.20, Nint=069, Nfrac=013)
+Fch=1796.80 (Fvco=3593.60, Nint=069, Nfrac=014)
+Fch=1797.00 (Fvco=3594.00, Nint=069, Nfrac=015)
+Fch=1797.20 (Fvco=3594.40, Nint=069, Nfrac=016)
+Fch=1797.40 (Fvco=3594.80, Nint=069, Nfrac=017)
+Fch=1797.60 (Fvco=3595.20, Nint=069, Nfrac=018)
+Fch=1797.80 (Fvco=3595.60, Nint=069, Nfrac=019)
+Fch=1798.00 (Fvco=3596.00, Nint=069, Nfrac=020)
+Fch=1798.20 (Fvco=3596.40, Nint=069, Nfrac=021)
+Fch=1798.40 (Fvco=3596.80, Nint=069, Nfrac=022)
+Fch=1798.60 (Fvco=3597.20, Nint=069, Nfrac=023)
+Fch=1798.80 (Fvco=3597.60, Nint=069, Nfrac=024)
+Fch=1799.00 (Fvco=3598.00, Nint=069, Nfrac=025)
+Fch=1799.20 (Fvco=3598.40, Nint=069, Nfrac=026)
+Fch=1799.40 (Fvco=3598.80, Nint=069, Nfrac=027)
+Fch=1799.60 (Fvco=3599.20, Nint=069, Nfrac=028)
+Fch=1799.80 (Fvco=3599.60, Nint=069, Nfrac=029)
+Fch=1800.00 (Fvco=3600.00, Nint=069, Nfrac=030)
+Fch=1800.20 (Fvco=3600.40, Nint=069, Nfrac=031)
+Fch=1800.40 (Fvco=3600.80, Nint=069, Nfrac=032)
+Fch=1800.60 (Fvco=3601.20, Nint=069, Nfrac=033)
+Fch=1800.80 (Fvco=3601.60, Nint=069, Nfrac=034)
+Fch=1801.00 (Fvco=3602.00, Nint=069, Nfrac=035)
+Fch=1801.20 (Fvco=3602.40, Nint=069, Nfrac=036)
+Fch=1801.40 (Fvco=3602.80, Nint=069, Nfrac=037)
+Fch=1801.60 (Fvco=3603.20, Nint=069, Nfrac=038)
+Fch=1801.80 (Fvco=3603.60, Nint=069, Nfrac=039)
+Fch=1802.00 (Fvco=3604.00, Nint=069, Nfrac=040)
+Fch=1802.20 (Fvco=3604.40, Nint=069, Nfrac=041)
+Fch=1802.40 (Fvco=3604.80, Nint=069, Nfrac=042)
+Fch=1802.60 (Fvco=3605.20, Nint=069, Nfrac=043)
+Fch=1802.80 (Fvco=3605.60, Nint=069, Nfrac=044)
+Fch=1803.00 (Fvco=3606.00, Nint=069, Nfrac=045)
+Fch=1803.20 (Fvco=3606.40, Nint=069, Nfrac=046)
+Fch=1803.40 (Fvco=3606.80, Nint=069, Nfrac=047)
+Fch=1803.60 (Fvco=3607.20, Nint=069, Nfrac=048)
+Fch=1803.80 (Fvco=3607.60, Nint=069, Nfrac=049)
+Fch=1804.00 (Fvco=3608.00, Nint=069, Nfrac=050)
+Fch=1804.20 (Fvco=3608.40, Nint=069, Nfrac=051)
+Fch=1804.40 (Fvco=3608.80, Nint=069, Nfrac=052)
+Fch=1804.60 (Fvco=3609.20, Nint=069, Nfrac=053)
+Fch=1804.80 (Fvco=3609.60, Nint=069, Nfrac=054)
+Fch=1805.00 (Fvco=3610.00, Nint=069, Nfrac=055)
+Fch=1805.20 (Fvco=3610.40, Nint=069, Nfrac=056)
+Fch=1805.40 (Fvco=3610.80, Nint=069, Nfrac=057)
+Fch=1805.60 (Fvco=3611.20, Nint=069, Nfrac=058)
+Fch=1805.80 (Fvco=3611.60, Nint=069, Nfrac=059)
+Fch=1806.00 (Fvco=3612.00, Nint=069, Nfrac=060)
+Fch=1806.20 (Fvco=3612.40, Nint=069, Nfrac=061)
+Fch=1806.40 (Fvco=3612.80, Nint=069, Nfrac=062)
+Fch=1806.60 (Fvco=3613.20, Nint=069, Nfrac=063)
+Fch=1806.80 (Fvco=3613.60, Nint=069, Nfrac=064)
+Fch=1807.00 (Fvco=3614.00, Nint=069, Nfrac=065)
+Fch=1807.20 (Fvco=3614.40, Nint=069, Nfrac=066)
+Fch=1807.40 (Fvco=3614.80, Nint=069, Nfrac=067)
+Fch=1807.60 (Fvco=3615.20, Nint=069, Nfrac=068)
+Fch=1807.80 (Fvco=3615.60, Nint=069, Nfrac=069)
+Fch=1808.00 (Fvco=3616.00, Nint=069, Nfrac=070)
+Fch=1808.20 (Fvco=3616.40, Nint=069, Nfrac=071)
+Fch=1808.40 (Fvco=3616.80, Nint=069, Nfrac=072)
+Fch=1808.60 (Fvco=3617.20, Nint=069, Nfrac=073)
+Fch=1808.80 (Fvco=3617.60, Nint=069, Nfrac=074)
+Fch=1809.00 (Fvco=3618.00, Nint=069, Nfrac=075)
+Fch=1809.20 (Fvco=3618.40, Nint=069, Nfrac=076)
+Fch=1809.40 (Fvco=3618.80, Nint=069, Nfrac=077)
+Fch=1809.60 (Fvco=3619.20, Nint=069, Nfrac=078)
+Fch=1809.80 (Fvco=3619.60, Nint=069, Nfrac=079)
+Fch=1810.00 (Fvco=3620.00, Nint=069, Nfrac=080)
+Fch=1810.20 (Fvco=3620.40, Nint=069, Nfrac=081)
+Fch=1810.40 (Fvco=3620.80, Nint=069, Nfrac=082)
+Fch=1810.60 (Fvco=3621.20, Nint=069, Nfrac=083)
+Fch=1810.80 (Fvco=3621.60, Nint=069, Nfrac=084)
+Fch=1811.00 (Fvco=3622.00, Nint=069, Nfrac=085)
+Fch=1811.20 (Fvco=3622.40, Nint=069, Nfrac=086)
+Fch=1811.40 (Fvco=3622.80, Nint=069, Nfrac=087)
+Fch=1811.60 (Fvco=3623.20, Nint=069, Nfrac=088)
+Fch=1811.80 (Fvco=3623.60, Nint=069, Nfrac=089)
+Fch=1812.00 (Fvco=3624.00, Nint=069, Nfrac=090)
+Fch=1812.20 (Fvco=3624.40, Nint=069, Nfrac=091)
+Fch=1812.40 (Fvco=3624.80, Nint=069, Nfrac=092)
+Fch=1812.60 (Fvco=3625.20, Nint=069, Nfrac=093)
+Fch=1812.80 (Fvco=3625.60, Nint=069, Nfrac=094)
+Fch=1813.00 (Fvco=3626.00, Nint=069, Nfrac=095)
+Fch=1813.20 (Fvco=3626.40, Nint=069, Nfrac=096)
+Fch=1813.40 (Fvco=3626.80, Nint=069, Nfrac=097)
+Fch=1813.60 (Fvco=3627.20, Nint=069, Nfrac=098)
+Fch=1813.80 (Fvco=3627.60, Nint=069, Nfrac=099)
+Fch=1814.00 (Fvco=3628.00, Nint=069, Nfrac=100)
+Fch=1814.20 (Fvco=3628.40, Nint=069, Nfrac=101)
+Fch=1814.40 (Fvco=3628.80, Nint=069, Nfrac=102)
+Fch=1814.60 (Fvco=3629.20, Nint=069, Nfrac=103)
+Fch=1814.80 (Fvco=3629.60, Nint=069, Nfrac=104)
+Fch=1815.00 (Fvco=3630.00, Nint=069, Nfrac=105)
+Fch=1815.20 (Fvco=3630.40, Nint=069, Nfrac=106)
+Fch=1815.40 (Fvco=3630.80, Nint=069, Nfrac=107)
+Fch=1815.60 (Fvco=3631.20, Nint=069, Nfrac=108)
+Fch=1815.80 (Fvco=3631.60, Nint=069, Nfrac=109)
+Fch=1816.00 (Fvco=3632.00, Nint=069, Nfrac=110)
+Fch=1816.20 (Fvco=3632.40, Nint=069, Nfrac=111)
+Fch=1816.40 (Fvco=3632.80, Nint=069, Nfrac=112)
+Fch=1816.60 (Fvco=3633.20, Nint=069, Nfrac=113)
+Fch=1816.80 (Fvco=3633.60, Nint=069, Nfrac=114)
+Fch=1817.00 (Fvco=3634.00, Nint=069, Nfrac=115)
+Fch=1817.20 (Fvco=3634.40, Nint=069, Nfrac=116)
+Fch=1817.40 (Fvco=3634.80, Nint=069, Nfrac=117)
+Fch=1817.60 (Fvco=3635.20, Nint=069, Nfrac=118)
+Fch=1817.80 (Fvco=3635.60, Nint=069, Nfrac=119)
+Fch=1818.00 (Fvco=3636.00, Nint=069, Nfrac=120)
+Fch=1818.20 (Fvco=3636.40, Nint=069, Nfrac=121)
+Fch=1818.40 (Fvco=3636.80, Nint=069, Nfrac=122)
+Fch=1818.60 (Fvco=3637.20, Nint=069, Nfrac=123)
+Fch=1818.80 (Fvco=3637.60, Nint=069, Nfrac=124)
+Fch=1819.00 (Fvco=3638.00, Nint=069, Nfrac=125)
+Fch=1819.20 (Fvco=3638.40, Nint=069, Nfrac=126)
+Fch=1819.40 (Fvco=3638.80, Nint=069, Nfrac=127)
+Fch=1819.60 (Fvco=3639.20, Nint=069, Nfrac=128)
+Fch=1819.80 (Fvco=3639.60, Nint=069, Nfrac=129)
+Fch=1820.00 (Fvco=3640.00, Nint=069, Nfrac=130)
+Fch=1820.00 (Fvco=3640.00, Nint=070, Nfrac=000)
+Fch=1820.20 (Fvco=3640.40, Nint=070, Nfrac=001)
+Fch=1820.40 (Fvco=3640.80, Nint=070, Nfrac=002)
+Fch=1820.60 (Fvco=3641.20, Nint=070, Nfrac=003)
+Fch=1820.80 (Fvco=3641.60, Nint=070, Nfrac=004)
+Fch=1821.00 (Fvco=3642.00, Nint=070, Nfrac=005)
+Fch=1821.20 (Fvco=3642.40, Nint=070, Nfrac=006)
+Fch=1821.40 (Fvco=3642.80, Nint=070, Nfrac=007)
+Fch=1821.60 (Fvco=3643.20, Nint=070, Nfrac=008)
+Fch=1821.80 (Fvco=3643.60, Nint=070, Nfrac=009)
+Fch=1822.00 (Fvco=3644.00, Nint=070, Nfrac=010)
+Fch=1822.20 (Fvco=3644.40, Nint=070, Nfrac=011)
+Fch=1822.40 (Fvco=3644.80, Nint=070, Nfrac=012)
+Fch=1822.60 (Fvco=3645.20, Nint=070, Nfrac=013)
+Fch=1822.80 (Fvco=3645.60, Nint=070, Nfrac=014)
+Fch=1823.00 (Fvco=3646.00, Nint=070, Nfrac=015)
+Fch=1823.20 (Fvco=3646.40, Nint=070, Nfrac=016)
+Fch=1823.40 (Fvco=3646.80, Nint=070, Nfrac=017)
+Fch=1823.60 (Fvco=3647.20, Nint=070, Nfrac=018)
+Fch=1823.80 (Fvco=3647.60, Nint=070, Nfrac=019)
+Fch=1824.00 (Fvco=3648.00, Nint=070, Nfrac=020)
+Fch=1824.20 (Fvco=3648.40, Nint=070, Nfrac=021)
+Fch=1824.40 (Fvco=3648.80, Nint=070, Nfrac=022)
+Fch=1824.60 (Fvco=3649.20, Nint=070, Nfrac=023)
+Fch=1824.80 (Fvco=3649.60, Nint=070, Nfrac=024)
+Fch=1825.00 (Fvco=3650.00, Nint=070, Nfrac=025)
+Fch=1825.20 (Fvco=3650.40, Nint=070, Nfrac=026)
+Fch=1825.40 (Fvco=3650.80, Nint=070, Nfrac=027)
+Fch=1825.60 (Fvco=3651.20, Nint=070, Nfrac=028)
+Fch=1825.80 (Fvco=3651.60, Nint=070, Nfrac=029)
+Fch=1826.00 (Fvco=3652.00, Nint=070, Nfrac=030)
+Fch=1826.20 (Fvco=3652.40, Nint=070, Nfrac=031)
+Fch=1826.40 (Fvco=3652.80, Nint=070, Nfrac=032)
+Fch=1826.60 (Fvco=3653.20, Nint=070, Nfrac=033)
+Fch=1826.80 (Fvco=3653.60, Nint=070, Nfrac=034)
+Fch=1827.00 (Fvco=3654.00, Nint=070, Nfrac=035)
+Fch=1827.20 (Fvco=3654.40, Nint=070, Nfrac=036)
+Fch=1827.40 (Fvco=3654.80, Nint=070, Nfrac=037)
+Fch=1827.60 (Fvco=3655.20, Nint=070, Nfrac=038)
+Fch=1827.80 (Fvco=3655.60, Nint=070, Nfrac=039)
+Fch=1828.00 (Fvco=3656.00, Nint=070, Nfrac=040)
+Fch=1828.20 (Fvco=3656.40, Nint=070, Nfrac=041)
+Fch=1828.40 (Fvco=3656.80, Nint=070, Nfrac=042)
+Fch=1828.60 (Fvco=3657.20, Nint=070, Nfrac=043)
+Fch=1828.80 (Fvco=3657.60, Nint=070, Nfrac=044)
+Fch=1829.00 (Fvco=3658.00, Nint=070, Nfrac=045)
+Fch=1829.20 (Fvco=3658.40, Nint=070, Nfrac=046)
+Fch=1829.40 (Fvco=3658.80, Nint=070, Nfrac=047)
+Fch=1829.60 (Fvco=3659.20, Nint=070, Nfrac=048)
+Fch=1829.80 (Fvco=3659.60, Nint=070, Nfrac=049)
+Fch=1830.00 (Fvco=3660.00, Nint=070, Nfrac=050)
+Fch=1830.20 (Fvco=3660.40, Nint=070, Nfrac=051)
+Fch=1830.40 (Fvco=3660.80, Nint=070, Nfrac=052)
+Fch=1830.60 (Fvco=3661.20, Nint=070, Nfrac=053)
+Fch=1830.80 (Fvco=3661.60, Nint=070, Nfrac=054)
+Fch=1831.00 (Fvco=3662.00, Nint=070, Nfrac=055)
+Fch=1831.20 (Fvco=3662.40, Nint=070, Nfrac=056)
+Fch=1831.40 (Fvco=3662.80, Nint=070, Nfrac=057)
+Fch=1831.60 (Fvco=3663.20, Nint=070, Nfrac=058)
+Fch=1831.80 (Fvco=3663.60, Nint=070, Nfrac=059)
+Fch=1832.00 (Fvco=3664.00, Nint=070, Nfrac=060)
+Fch=1832.20 (Fvco=3664.40, Nint=070, Nfrac=061)
+Fch=1832.40 (Fvco=3664.80, Nint=070, Nfrac=062)
+Fch=1832.60 (Fvco=3665.20, Nint=070, Nfrac=063)
+Fch=1832.80 (Fvco=3665.60, Nint=070, Nfrac=064)
+Fch=1833.00 (Fvco=3666.00, Nint=070, Nfrac=065)
+Fch=1833.20 (Fvco=3666.40, Nint=070, Nfrac=066)
+Fch=1833.40 (Fvco=3666.80, Nint=070, Nfrac=067)
+Fch=1833.60 (Fvco=3667.20, Nint=070, Nfrac=068)
+Fch=1833.80 (Fvco=3667.60, Nint=070, Nfrac=069)
+Fch=1834.00 (Fvco=3668.00, Nint=070, Nfrac=070)
+Fch=1834.20 (Fvco=3668.40, Nint=070, Nfrac=071)
+Fch=1834.40 (Fvco=3668.80, Nint=070, Nfrac=072)
+Fch=1834.60 (Fvco=3669.20, Nint=070, Nfrac=073)
+Fch=1834.80 (Fvco=3669.60, Nint=070, Nfrac=074)
+Fch=1835.00 (Fvco=3670.00, Nint=070, Nfrac=075)
+Fch=1835.20 (Fvco=3670.40, Nint=070, Nfrac=076)
+Fch=1835.40 (Fvco=3670.80, Nint=070, Nfrac=077)
+Fch=1835.60 (Fvco=3671.20, Nint=070, Nfrac=078)
+Fch=1835.80 (Fvco=3671.60, Nint=070, Nfrac=079)
+Fch=1836.00 (Fvco=3672.00, Nint=070, Nfrac=080)
+Fch=1836.20 (Fvco=3672.40, Nint=070, Nfrac=081)
+Fch=1836.40 (Fvco=3672.80, Nint=070, Nfrac=082)
+Fch=1836.60 (Fvco=3673.20, Nint=070, Nfrac=083)
+Fch=1836.80 (Fvco=3673.60, Nint=070, Nfrac=084)
+Fch=1837.00 (Fvco=3674.00, Nint=070, Nfrac=085)
+Fch=1837.20 (Fvco=3674.40, Nint=070, Nfrac=086)
+Fch=1837.40 (Fvco=3674.80, Nint=070, Nfrac=087)
+Fch=1837.60 (Fvco=3675.20, Nint=070, Nfrac=088)
+Fch=1837.80 (Fvco=3675.60, Nint=070, Nfrac=089)
+Fch=1838.00 (Fvco=3676.00, Nint=070, Nfrac=090)
+Fch=1838.20 (Fvco=3676.40, Nint=070, Nfrac=091)
+Fch=1838.40 (Fvco=3676.80, Nint=070, Nfrac=092)
+Fch=1838.60 (Fvco=3677.20, Nint=070, Nfrac=093)
+Fch=1838.80 (Fvco=3677.60, Nint=070, Nfrac=094)
+Fch=1839.00 (Fvco=3678.00, Nint=070, Nfrac=095)
+Fch=1839.20 (Fvco=3678.40, Nint=070, Nfrac=096)
+Fch=1839.40 (Fvco=3678.80, Nint=070, Nfrac=097)
+Fch=1839.60 (Fvco=3679.20, Nint=070, Nfrac=098)
+Fch=1839.80 (Fvco=3679.60, Nint=070, Nfrac=099)
+Fch=1840.00 (Fvco=3680.00, Nint=070, Nfrac=100)
+Fch=1840.20 (Fvco=3680.40, Nint=070, Nfrac=101)
+Fch=1840.40 (Fvco=3680.80, Nint=070, Nfrac=102)
+Fch=1840.60 (Fvco=3681.20, Nint=070, Nfrac=103)
+Fch=1840.80 (Fvco=3681.60, Nint=070, Nfrac=104)
+Fch=1841.00 (Fvco=3682.00, Nint=070, Nfrac=105)
+Fch=1841.20 (Fvco=3682.40, Nint=070, Nfrac=106)
+Fch=1841.40 (Fvco=3682.80, Nint=070, Nfrac=107)
+Fch=1841.60 (Fvco=3683.20, Nint=070, Nfrac=108)
+Fch=1841.80 (Fvco=3683.60, Nint=070, Nfrac=109)
+Fch=1842.00 (Fvco=3684.00, Nint=070, Nfrac=110)
+Fch=1842.20 (Fvco=3684.40, Nint=070, Nfrac=111)
+Fch=1842.40 (Fvco=3684.80, Nint=070, Nfrac=112)
+Fch=1842.60 (Fvco=3685.20, Nint=070, Nfrac=113)
+Fch=1842.80 (Fvco=3685.60, Nint=070, Nfrac=114)
+Fch=1843.00 (Fvco=3686.00, Nint=070, Nfrac=115)
+Fch=1843.20 (Fvco=3686.40, Nint=070, Nfrac=116)
+Fch=1843.40 (Fvco=3686.80, Nint=070, Nfrac=117)
+Fch=1843.60 (Fvco=3687.20, Nint=070, Nfrac=118)
+Fch=1843.80 (Fvco=3687.60, Nint=070, Nfrac=119)
+Fch=1844.00 (Fvco=3688.00, Nint=070, Nfrac=120)
+Fch=1844.20 (Fvco=3688.40, Nint=070, Nfrac=121)
+Fch=1844.40 (Fvco=3688.80, Nint=070, Nfrac=122)
+Fch=1844.60 (Fvco=3689.20, Nint=070, Nfrac=123)
+Fch=1844.80 (Fvco=3689.60, Nint=070, Nfrac=124)
+Fch=1845.00 (Fvco=3690.00, Nint=070, Nfrac=125)
+Fch=1845.20 (Fvco=3690.40, Nint=070, Nfrac=126)
+Fch=1845.40 (Fvco=3690.80, Nint=070, Nfrac=127)
+Fch=1845.60 (Fvco=3691.20, Nint=070, Nfrac=128)
+Fch=1845.80 (Fvco=3691.60, Nint=070, Nfrac=129)
+Fch=1846.00 (Fvco=3692.00, Nint=070, Nfrac=130)
+Fch=1846.00 (Fvco=3692.00, Nint=071, Nfrac=000)
+Fch=1846.20 (Fvco=3692.40, Nint=071, Nfrac=001)
+Fch=1846.40 (Fvco=3692.80, Nint=071, Nfrac=002)
+Fch=1846.60 (Fvco=3693.20, Nint=071, Nfrac=003)
+Fch=1846.80 (Fvco=3693.60, Nint=071, Nfrac=004)
+Fch=1847.00 (Fvco=3694.00, Nint=071, Nfrac=005)
+Fch=1847.20 (Fvco=3694.40, Nint=071, Nfrac=006)
+Fch=1847.40 (Fvco=3694.80, Nint=071, Nfrac=007)
+Fch=1847.60 (Fvco=3695.20, Nint=071, Nfrac=008)
+Fch=1847.80 (Fvco=3695.60, Nint=071, Nfrac=009)
+Fch=1848.00 (Fvco=3696.00, Nint=071, Nfrac=010)
+Fch=1848.20 (Fvco=3696.40, Nint=071, Nfrac=011)
+Fch=1848.40 (Fvco=3696.80, Nint=071, Nfrac=012)
+Fch=1848.60 (Fvco=3697.20, Nint=071, Nfrac=013)
+Fch=1848.80 (Fvco=3697.60, Nint=071, Nfrac=014)
+Fch=1849.00 (Fvco=3698.00, Nint=071, Nfrac=015)
+Fch=1849.20 (Fvco=3698.40, Nint=071, Nfrac=016)
+Fch=1849.40 (Fvco=3698.80, Nint=071, Nfrac=017)
+Fch=1849.60 (Fvco=3699.20, Nint=071, Nfrac=018)
+Fch=1849.80 (Fvco=3699.60, Nint=071, Nfrac=019)
+Fch=1850.00 (Fvco=3700.00, Nint=071, Nfrac=020)
+Fch=1850.20 (Fvco=3700.40, Nint=071, Nfrac=021)
+Fch=1850.40 (Fvco=3700.80, Nint=071, Nfrac=022)
+Fch=1850.60 (Fvco=3701.20, Nint=071, Nfrac=023)
+Fch=1850.80 (Fvco=3701.60, Nint=071, Nfrac=024)
+Fch=1851.00 (Fvco=3702.00, Nint=071, Nfrac=025)
+Fch=1851.20 (Fvco=3702.40, Nint=071, Nfrac=026)
+Fch=1851.40 (Fvco=3702.80, Nint=071, Nfrac=027)
+Fch=1851.60 (Fvco=3703.20, Nint=071, Nfrac=028)
+Fch=1851.80 (Fvco=3703.60, Nint=071, Nfrac=029)
+Fch=1852.00 (Fvco=3704.00, Nint=071, Nfrac=030)
+Fch=1852.20 (Fvco=3704.40, Nint=071, Nfrac=031)
+Fch=1852.40 (Fvco=3704.80, Nint=071, Nfrac=032)
+Fch=1852.60 (Fvco=3705.20, Nint=071, Nfrac=033)
+Fch=1852.80 (Fvco=3705.60, Nint=071, Nfrac=034)
+Fch=1853.00 (Fvco=3706.00, Nint=071, Nfrac=035)
+Fch=1853.20 (Fvco=3706.40, Nint=071, Nfrac=036)
+Fch=1853.40 (Fvco=3706.80, Nint=071, Nfrac=037)
+Fch=1853.60 (Fvco=3707.20, Nint=071, Nfrac=038)
+Fch=1853.80 (Fvco=3707.60, Nint=071, Nfrac=039)
+Fch=1854.00 (Fvco=3708.00, Nint=071, Nfrac=040)
+Fch=1854.20 (Fvco=3708.40, Nint=071, Nfrac=041)
+Fch=1854.40 (Fvco=3708.80, Nint=071, Nfrac=042)
+Fch=1854.60 (Fvco=3709.20, Nint=071, Nfrac=043)
+Fch=1854.80 (Fvco=3709.60, Nint=071, Nfrac=044)
+Fch=1855.00 (Fvco=3710.00, Nint=071, Nfrac=045)
+Fch=1855.20 (Fvco=3710.40, Nint=071, Nfrac=046)
+Fch=1855.40 (Fvco=3710.80, Nint=071, Nfrac=047)
+Fch=1855.60 (Fvco=3711.20, Nint=071, Nfrac=048)
+Fch=1855.80 (Fvco=3711.60, Nint=071, Nfrac=049)
+Fch=1856.00 (Fvco=3712.00, Nint=071, Nfrac=050)
+Fch=1856.20 (Fvco=3712.40, Nint=071, Nfrac=051)
+Fch=1856.40 (Fvco=3712.80, Nint=071, Nfrac=052)
+Fch=1856.60 (Fvco=3713.20, Nint=071, Nfrac=053)
+Fch=1856.80 (Fvco=3713.60, Nint=071, Nfrac=054)
+Fch=1857.00 (Fvco=3714.00, Nint=071, Nfrac=055)
+Fch=1857.20 (Fvco=3714.40, Nint=071, Nfrac=056)
+Fch=1857.40 (Fvco=3714.80, Nint=071, Nfrac=057)
+Fch=1857.60 (Fvco=3715.20, Nint=071, Nfrac=058)
+Fch=1857.80 (Fvco=3715.60, Nint=071, Nfrac=059)
+Fch=1858.00 (Fvco=3716.00, Nint=071, Nfrac=060)
+Fch=1858.20 (Fvco=3716.40, Nint=071, Nfrac=061)
+Fch=1858.40 (Fvco=3716.80, Nint=071, Nfrac=062)
+Fch=1858.60 (Fvco=3717.20, Nint=071, Nfrac=063)
+Fch=1858.80 (Fvco=3717.60, Nint=071, Nfrac=064)
+Fch=1859.00 (Fvco=3718.00, Nint=071, Nfrac=065)
+Fch=1859.20 (Fvco=3718.40, Nint=071, Nfrac=066)
+Fch=1859.40 (Fvco=3718.80, Nint=071, Nfrac=067)
+Fch=1859.60 (Fvco=3719.20, Nint=071, Nfrac=068)
+Fch=1859.80 (Fvco=3719.60, Nint=071, Nfrac=069)
+Fch=1860.00 (Fvco=3720.00, Nint=071, Nfrac=070)
+Fch=1860.20 (Fvco=3720.40, Nint=071, Nfrac=071)
+Fch=1860.40 (Fvco=3720.80, Nint=071, Nfrac=072)
+Fch=1860.60 (Fvco=3721.20, Nint=071, Nfrac=073)
+Fch=1860.80 (Fvco=3721.60, Nint=071, Nfrac=074)
+Fch=1861.00 (Fvco=3722.00, Nint=071, Nfrac=075)
+Fch=1861.20 (Fvco=3722.40, Nint=071, Nfrac=076)
+Fch=1861.40 (Fvco=3722.80, Nint=071, Nfrac=077)
+Fch=1861.60 (Fvco=3723.20, Nint=071, Nfrac=078)
+Fch=1861.80 (Fvco=3723.60, Nint=071, Nfrac=079)
+Fch=1862.00 (Fvco=3724.00, Nint=071, Nfrac=080)
+Fch=1862.20 (Fvco=3724.40, Nint=071, Nfrac=081)
+Fch=1862.40 (Fvco=3724.80, Nint=071, Nfrac=082)
+Fch=1862.60 (Fvco=3725.20, Nint=071, Nfrac=083)
+Fch=1862.80 (Fvco=3725.60, Nint=071, Nfrac=084)
+Fch=1863.00 (Fvco=3726.00, Nint=071, Nfrac=085)
+Fch=1863.20 (Fvco=3726.40, Nint=071, Nfrac=086)
+Fch=1863.40 (Fvco=3726.80, Nint=071, Nfrac=087)
+Fch=1863.60 (Fvco=3727.20, Nint=071, Nfrac=088)
+Fch=1863.80 (Fvco=3727.60, Nint=071, Nfrac=089)
+Fch=1864.00 (Fvco=3728.00, Nint=071, Nfrac=090)
+Fch=1864.20 (Fvco=3728.40, Nint=071, Nfrac=091)
+Fch=1864.40 (Fvco=3728.80, Nint=071, Nfrac=092)
+Fch=1864.60 (Fvco=3729.20, Nint=071, Nfrac=093)
+Fch=1864.80 (Fvco=3729.60, Nint=071, Nfrac=094)
+Fch=1865.00 (Fvco=3730.00, Nint=071, Nfrac=095)
+Fch=1865.20 (Fvco=3730.40, Nint=071, Nfrac=096)
+Fch=1865.40 (Fvco=3730.80, Nint=071, Nfrac=097)
+Fch=1865.60 (Fvco=3731.20, Nint=071, Nfrac=098)
+Fch=1865.80 (Fvco=3731.60, Nint=071, Nfrac=099)
+Fch=1866.00 (Fvco=3732.00, Nint=071, Nfrac=100)
+Fch=1866.20 (Fvco=3732.40, Nint=071, Nfrac=101)
+Fch=1866.40 (Fvco=3732.80, Nint=071, Nfrac=102)
+Fch=1866.60 (Fvco=3733.20, Nint=071, Nfrac=103)
+Fch=1866.80 (Fvco=3733.60, Nint=071, Nfrac=104)
+Fch=1867.00 (Fvco=3734.00, Nint=071, Nfrac=105)
+Fch=1867.20 (Fvco=3734.40, Nint=071, Nfrac=106)
+Fch=1867.40 (Fvco=3734.80, Nint=071, Nfrac=107)
+Fch=1867.60 (Fvco=3735.20, Nint=071, Nfrac=108)
+Fch=1867.80 (Fvco=3735.60, Nint=071, Nfrac=109)
+Fch=1868.00 (Fvco=3736.00, Nint=071, Nfrac=110)
+Fch=1868.20 (Fvco=3736.40, Nint=071, Nfrac=111)
+Fch=1868.40 (Fvco=3736.80, Nint=071, Nfrac=112)
+Fch=1868.60 (Fvco=3737.20, Nint=071, Nfrac=113)
+Fch=1868.80 (Fvco=3737.60, Nint=071, Nfrac=114)
+Fch=1869.00 (Fvco=3738.00, Nint=071, Nfrac=115)
+Fch=1869.20 (Fvco=3738.40, Nint=071, Nfrac=116)
+Fch=1869.40 (Fvco=3738.80, Nint=071, Nfrac=117)
+Fch=1869.60 (Fvco=3739.20, Nint=071, Nfrac=118)
+Fch=1869.80 (Fvco=3739.60, Nint=071, Nfrac=119)
+Fch=1870.00 (Fvco=3740.00, Nint=071, Nfrac=120)
+Fch=1870.20 (Fvco=3740.40, Nint=071, Nfrac=121)
+Fch=1870.40 (Fvco=3740.80, Nint=071, Nfrac=122)
+Fch=1870.60 (Fvco=3741.20, Nint=071, Nfrac=123)
+Fch=1870.80 (Fvco=3741.60, Nint=071, Nfrac=124)
+Fch=1871.00 (Fvco=3742.00, Nint=071, Nfrac=125)
+Fch=1871.20 (Fvco=3742.40, Nint=071, Nfrac=126)
+Fch=1871.40 (Fvco=3742.80, Nint=071, Nfrac=127)
+Fch=1871.60 (Fvco=3743.20, Nint=071, Nfrac=128)
+Fch=1871.80 (Fvco=3743.60, Nint=071, Nfrac=129)
+Fch=1872.00 (Fvco=3744.00, Nint=071, Nfrac=130)
+Fch=1872.00 (Fvco=3744.00, Nint=072, Nfrac=000)
+Fch=1872.20 (Fvco=3744.40, Nint=072, Nfrac=001)
+Fch=1872.40 (Fvco=3744.80, Nint=072, Nfrac=002)
+Fch=1872.60 (Fvco=3745.20, Nint=072, Nfrac=003)
+Fch=1872.80 (Fvco=3745.60, Nint=072, Nfrac=004)
+Fch=1873.00 (Fvco=3746.00, Nint=072, Nfrac=005)
+Fch=1873.20 (Fvco=3746.40, Nint=072, Nfrac=006)
+Fch=1873.40 (Fvco=3746.80, Nint=072, Nfrac=007)
+Fch=1873.60 (Fvco=3747.20, Nint=072, Nfrac=008)
+Fch=1873.80 (Fvco=3747.60, Nint=072, Nfrac=009)
+Fch=1874.00 (Fvco=3748.00, Nint=072, Nfrac=010)
+Fch=1874.20 (Fvco=3748.40, Nint=072, Nfrac=011)
+Fch=1874.40 (Fvco=3748.80, Nint=072, Nfrac=012)
+Fch=1874.60 (Fvco=3749.20, Nint=072, Nfrac=013)
+Fch=1874.80 (Fvco=3749.60, Nint=072, Nfrac=014)
+Fch=1875.00 (Fvco=3750.00, Nint=072, Nfrac=015)
+Fch=1875.20 (Fvco=3750.40, Nint=072, Nfrac=016)
+Fch=1875.40 (Fvco=3750.80, Nint=072, Nfrac=017)
+Fch=1875.60 (Fvco=3751.20, Nint=072, Nfrac=018)
+Fch=1875.80 (Fvco=3751.60, Nint=072, Nfrac=019)
+Fch=1876.00 (Fvco=3752.00, Nint=072, Nfrac=020)
+Fch=1876.20 (Fvco=3752.40, Nint=072, Nfrac=021)
+Fch=1876.40 (Fvco=3752.80, Nint=072, Nfrac=022)
+Fch=1876.60 (Fvco=3753.20, Nint=072, Nfrac=023)
+Fch=1876.80 (Fvco=3753.60, Nint=072, Nfrac=024)
+Fch=1877.00 (Fvco=3754.00, Nint=072, Nfrac=025)
+Fch=1877.20 (Fvco=3754.40, Nint=072, Nfrac=026)
+Fch=1877.40 (Fvco=3754.80, Nint=072, Nfrac=027)
+Fch=1877.60 (Fvco=3755.20, Nint=072, Nfrac=028)
+Fch=1877.80 (Fvco=3755.60, Nint=072, Nfrac=029)
+Fch=1878.00 (Fvco=3756.00, Nint=072, Nfrac=030)
+Fch=1878.20 (Fvco=3756.40, Nint=072, Nfrac=031)
+Fch=1878.40 (Fvco=3756.80, Nint=072, Nfrac=032)
+Fch=1878.60 (Fvco=3757.20, Nint=072, Nfrac=033)
+Fch=1878.80 (Fvco=3757.60, Nint=072, Nfrac=034)
+Fch=1879.00 (Fvco=3758.00, Nint=072, Nfrac=035)
+Fch=1879.20 (Fvco=3758.40, Nint=072, Nfrac=036)
+Fch=1879.40 (Fvco=3758.80, Nint=072, Nfrac=037)
+Fch=1879.60 (Fvco=3759.20, Nint=072, Nfrac=038)
+Fch=1879.80 (Fvco=3759.60, Nint=072, Nfrac=039)
+Fch=1880.00 (Fvco=3760.00, Nint=072, Nfrac=040)
+Fch=1880.20 (Fvco=3760.40, Nint=072, Nfrac=041)
+Fch=1880.40 (Fvco=3760.80, Nint=072, Nfrac=042)
+Fch=1880.60 (Fvco=3761.20, Nint=072, Nfrac=043)
+Fch=1880.80 (Fvco=3761.60, Nint=072, Nfrac=044)
+Fch=1881.00 (Fvco=3762.00, Nint=072, Nfrac=045)
+Fch=1881.20 (Fvco=3762.40, Nint=072, Nfrac=046)
+Fch=1881.40 (Fvco=3762.80, Nint=072, Nfrac=047)
+Fch=1881.60 (Fvco=3763.20, Nint=072, Nfrac=048)
+Fch=1881.80 (Fvco=3763.60, Nint=072, Nfrac=049)
+Fch=1882.00 (Fvco=3764.00, Nint=072, Nfrac=050)
+Fch=1882.20 (Fvco=3764.40, Nint=072, Nfrac=051)
+Fch=1882.40 (Fvco=3764.80, Nint=072, Nfrac=052)
+Fch=1882.60 (Fvco=3765.20, Nint=072, Nfrac=053)
+Fch=1882.80 (Fvco=3765.60, Nint=072, Nfrac=054)
+Fch=1883.00 (Fvco=3766.00, Nint=072, Nfrac=055)
+Fch=1883.20 (Fvco=3766.40, Nint=072, Nfrac=056)
+Fch=1883.40 (Fvco=3766.80, Nint=072, Nfrac=057)
+Fch=1883.60 (Fvco=3767.20, Nint=072, Nfrac=058)
+Fch=1883.80 (Fvco=3767.60, Nint=072, Nfrac=059)
+Fch=1884.00 (Fvco=3768.00, Nint=072, Nfrac=060)
+Fch=1884.20 (Fvco=3768.40, Nint=072, Nfrac=061)
+Fch=1884.40 (Fvco=3768.80, Nint=072, Nfrac=062)
+Fch=1884.60 (Fvco=3769.20, Nint=072, Nfrac=063)
+Fch=1884.80 (Fvco=3769.60, Nint=072, Nfrac=064)
+Fch=1885.00 (Fvco=3770.00, Nint=072, Nfrac=065)
+Fch=1885.20 (Fvco=3770.40, Nint=072, Nfrac=066)
+Fch=1885.40 (Fvco=3770.80, Nint=072, Nfrac=067)
+Fch=1885.60 (Fvco=3771.20, Nint=072, Nfrac=068)
+Fch=1885.80 (Fvco=3771.60, Nint=072, Nfrac=069)
+Fch=1886.00 (Fvco=3772.00, Nint=072, Nfrac=070)
+Fch=1886.20 (Fvco=3772.40, Nint=072, Nfrac=071)
+Fch=1886.40 (Fvco=3772.80, Nint=072, Nfrac=072)
+Fch=1886.60 (Fvco=3773.20, Nint=072, Nfrac=073)
+Fch=1886.80 (Fvco=3773.60, Nint=072, Nfrac=074)
+Fch=1887.00 (Fvco=3774.00, Nint=072, Nfrac=075)
+Fch=1887.20 (Fvco=3774.40, Nint=072, Nfrac=076)
+Fch=1887.40 (Fvco=3774.80, Nint=072, Nfrac=077)
+Fch=1887.60 (Fvco=3775.20, Nint=072, Nfrac=078)
+Fch=1887.80 (Fvco=3775.60, Nint=072, Nfrac=079)
+Fch=1888.00 (Fvco=3776.00, Nint=072, Nfrac=080)
+Fch=1888.20 (Fvco=3776.40, Nint=072, Nfrac=081)
+Fch=1888.40 (Fvco=3776.80, Nint=072, Nfrac=082)
+Fch=1888.60 (Fvco=3777.20, Nint=072, Nfrac=083)
+Fch=1888.80 (Fvco=3777.60, Nint=072, Nfrac=084)
+Fch=1889.00 (Fvco=3778.00, Nint=072, Nfrac=085)
+Fch=1889.20 (Fvco=3778.40, Nint=072, Nfrac=086)
+Fch=1889.40 (Fvco=3778.80, Nint=072, Nfrac=087)
+Fch=1889.60 (Fvco=3779.20, Nint=072, Nfrac=088)
+Fch=1889.80 (Fvco=3779.60, Nint=072, Nfrac=089)
+Fch=1890.00 (Fvco=3780.00, Nint=072, Nfrac=090)
+Fch=1890.20 (Fvco=3780.40, Nint=072, Nfrac=091)
+Fch=1890.40 (Fvco=3780.80, Nint=072, Nfrac=092)
+Fch=1890.60 (Fvco=3781.20, Nint=072, Nfrac=093)
+Fch=1890.80 (Fvco=3781.60, Nint=072, Nfrac=094)
+Fch=1891.00 (Fvco=3782.00, Nint=072, Nfrac=095)
+Fch=1891.20 (Fvco=3782.40, Nint=072, Nfrac=096)
+Fch=1891.40 (Fvco=3782.80, Nint=072, Nfrac=097)
+Fch=1891.60 (Fvco=3783.20, Nint=072, Nfrac=098)
+Fch=1891.80 (Fvco=3783.60, Nint=072, Nfrac=099)
+Fch=1892.00 (Fvco=3784.00, Nint=072, Nfrac=100)
+Fch=1892.20 (Fvco=3784.40, Nint=072, Nfrac=101)
+Fch=1892.40 (Fvco=3784.80, Nint=072, Nfrac=102)
+Fch=1892.60 (Fvco=3785.20, Nint=072, Nfrac=103)
+Fch=1892.80 (Fvco=3785.60, Nint=072, Nfrac=104)
+Fch=1893.00 (Fvco=3786.00, Nint=072, Nfrac=105)
+Fch=1893.20 (Fvco=3786.40, Nint=072, Nfrac=106)
+Fch=1893.40 (Fvco=3786.80, Nint=072, Nfrac=107)
+Fch=1893.60 (Fvco=3787.20, Nint=072, Nfrac=108)
+Fch=1893.80 (Fvco=3787.60, Nint=072, Nfrac=109)
+Fch=1894.00 (Fvco=3788.00, Nint=072, Nfrac=110)
+Fch=1894.20 (Fvco=3788.40, Nint=072, Nfrac=111)
+Fch=1894.40 (Fvco=3788.80, Nint=072, Nfrac=112)
+Fch=1894.60 (Fvco=3789.20, Nint=072, Nfrac=113)
+Fch=1894.80 (Fvco=3789.60, Nint=072, Nfrac=114)
+Fch=1895.00 (Fvco=3790.00, Nint=072, Nfrac=115)
+Fch=1895.20 (Fvco=3790.40, Nint=072, Nfrac=116)
+Fch=1895.40 (Fvco=3790.80, Nint=072, Nfrac=117)
+Fch=1895.60 (Fvco=3791.20, Nint=072, Nfrac=118)
+Fch=1895.80 (Fvco=3791.60, Nint=072, Nfrac=119)
+Fch=1896.00 (Fvco=3792.00, Nint=072, Nfrac=120)
+Fch=1896.20 (Fvco=3792.40, Nint=072, Nfrac=121)
+Fch=1896.40 (Fvco=3792.80, Nint=072, Nfrac=122)
+Fch=1896.60 (Fvco=3793.20, Nint=072, Nfrac=123)
+Fch=1896.80 (Fvco=3793.60, Nint=072, Nfrac=124)
+Fch=1897.00 (Fvco=3794.00, Nint=072, Nfrac=125)
+Fch=1897.20 (Fvco=3794.40, Nint=072, Nfrac=126)
+Fch=1897.40 (Fvco=3794.80, Nint=072, Nfrac=127)
+Fch=1897.60 (Fvco=3795.20, Nint=072, Nfrac=128)
+Fch=1897.80 (Fvco=3795.60, Nint=072, Nfrac=129)
+Fch=1898.00 (Fvco=3796.00, Nint=072, Nfrac=130)
+Fch=1898.00 (Fvco=3796.00, Nint=073, Nfrac=000)
+Fch=1898.20 (Fvco=3796.40, Nint=073, Nfrac=001)
+Fch=1898.40 (Fvco=3796.80, Nint=073, Nfrac=002)
+Fch=1898.60 (Fvco=3797.20, Nint=073, Nfrac=003)
+Fch=1898.80 (Fvco=3797.60, Nint=073, Nfrac=004)
+Fch=1899.00 (Fvco=3798.00, Nint=073, Nfrac=005)
+Fch=1899.20 (Fvco=3798.40, Nint=073, Nfrac=006)
+Fch=1899.40 (Fvco=3798.80, Nint=073, Nfrac=007)
+Fch=1899.60 (Fvco=3799.20, Nint=073, Nfrac=008)
+Fch=1899.80 (Fvco=3799.60, Nint=073, Nfrac=009)
+Fch=1900.00 (Fvco=3800.00, Nint=073, Nfrac=010)
+Fch=1900.20 (Fvco=3800.40, Nint=073, Nfrac=011)
+Fch=1900.40 (Fvco=3800.80, Nint=073, Nfrac=012)
+Fch=1900.60 (Fvco=3801.20, Nint=073, Nfrac=013)
+Fch=1900.80 (Fvco=3801.60, Nint=073, Nfrac=014)
+Fch=1901.00 (Fvco=3802.00, Nint=073, Nfrac=015)
+Fch=1901.20 (Fvco=3802.40, Nint=073, Nfrac=016)
+Fch=1901.40 (Fvco=3802.80, Nint=073, Nfrac=017)
+Fch=1901.60 (Fvco=3803.20, Nint=073, Nfrac=018)
+Fch=1901.80 (Fvco=3803.60, Nint=073, Nfrac=019)
+Fch=1902.00 (Fvco=3804.00, Nint=073, Nfrac=020)
+Fch=1902.20 (Fvco=3804.40, Nint=073, Nfrac=021)
+Fch=1902.40 (Fvco=3804.80, Nint=073, Nfrac=022)
+Fch=1902.60 (Fvco=3805.20, Nint=073, Nfrac=023)
+Fch=1902.80 (Fvco=3805.60, Nint=073, Nfrac=024)
+Fch=1903.00 (Fvco=3806.00, Nint=073, Nfrac=025)
+Fch=1903.20 (Fvco=3806.40, Nint=073, Nfrac=026)
+Fch=1903.40 (Fvco=3806.80, Nint=073, Nfrac=027)
+Fch=1903.60 (Fvco=3807.20, Nint=073, Nfrac=028)
+Fch=1903.80 (Fvco=3807.60, Nint=073, Nfrac=029)
+Fch=1904.00 (Fvco=3808.00, Nint=073, Nfrac=030)
+Fch=1904.20 (Fvco=3808.40, Nint=073, Nfrac=031)
+Fch=1904.40 (Fvco=3808.80, Nint=073, Nfrac=032)
+Fch=1904.60 (Fvco=3809.20, Nint=073, Nfrac=033)
+Fch=1904.80 (Fvco=3809.60, Nint=073, Nfrac=034)
+Fch=1905.00 (Fvco=3810.00, Nint=073, Nfrac=035)
+Fch=1905.20 (Fvco=3810.40, Nint=073, Nfrac=036)
+Fch=1905.40 (Fvco=3810.80, Nint=073, Nfrac=037)
+Fch=1905.60 (Fvco=3811.20, Nint=073, Nfrac=038)
+Fch=1905.80 (Fvco=3811.60, Nint=073, Nfrac=039)
+Fch=1906.00 (Fvco=3812.00, Nint=073, Nfrac=040)
+Fch=1906.20 (Fvco=3812.40, Nint=073, Nfrac=041)
+Fch=1906.40 (Fvco=3812.80, Nint=073, Nfrac=042)
+Fch=1906.60 (Fvco=3813.20, Nint=073, Nfrac=043)
+Fch=1906.80 (Fvco=3813.60, Nint=073, Nfrac=044)
+Fch=1907.00 (Fvco=3814.00, Nint=073, Nfrac=045)
+Fch=1907.20 (Fvco=3814.40, Nint=073, Nfrac=046)
+Fch=1907.40 (Fvco=3814.80, Nint=073, Nfrac=047)
+Fch=1907.60 (Fvco=3815.20, Nint=073, Nfrac=048)
+Fch=1907.80 (Fvco=3815.60, Nint=073, Nfrac=049)
+Fch=1908.00 (Fvco=3816.00, Nint=073, Nfrac=050)
+Fch=1908.20 (Fvco=3816.40, Nint=073, Nfrac=051)
+Fch=1908.40 (Fvco=3816.80, Nint=073, Nfrac=052)
+Fch=1908.60 (Fvco=3817.20, Nint=073, Nfrac=053)
+Fch=1908.80 (Fvco=3817.60, Nint=073, Nfrac=054)
+Fch=1909.00 (Fvco=3818.00, Nint=073, Nfrac=055)
+Fch=1909.20 (Fvco=3818.40, Nint=073, Nfrac=056)
+Fch=1909.40 (Fvco=3818.80, Nint=073, Nfrac=057)
+Fch=1909.60 (Fvco=3819.20, Nint=073, Nfrac=058)
+Fch=1909.80 (Fvco=3819.60, Nint=073, Nfrac=059)
+Fch=1910.00 (Fvco=3820.00, Nint=073, Nfrac=060)
+Fch=1910.20 (Fvco=3820.40, Nint=073, Nfrac=061)
+Fch=1910.40 (Fvco=3820.80, Nint=073, Nfrac=062)
+Fch=1910.60 (Fvco=3821.20, Nint=073, Nfrac=063)
+Fch=1910.80 (Fvco=3821.60, Nint=073, Nfrac=064)
+Fch=1911.00 (Fvco=3822.00, Nint=073, Nfrac=065)
+Fch=1911.20 (Fvco=3822.40, Nint=073, Nfrac=066)
+Fch=1911.40 (Fvco=3822.80, Nint=073, Nfrac=067)
+Fch=1911.60 (Fvco=3823.20, Nint=073, Nfrac=068)
+Fch=1911.80 (Fvco=3823.60, Nint=073, Nfrac=069)
+Fch=1912.00 (Fvco=3824.00, Nint=073, Nfrac=070)
+Fch=1912.20 (Fvco=3824.40, Nint=073, Nfrac=071)
+Fch=1912.40 (Fvco=3824.80, Nint=073, Nfrac=072)
+Fch=1912.60 (Fvco=3825.20, Nint=073, Nfrac=073)
+Fch=1912.80 (Fvco=3825.60, Nint=073, Nfrac=074)
+Fch=1913.00 (Fvco=3826.00, Nint=073, Nfrac=075)
+Fch=1913.20 (Fvco=3826.40, Nint=073, Nfrac=076)
+Fch=1913.40 (Fvco=3826.80, Nint=073, Nfrac=077)
+Fch=1913.60 (Fvco=3827.20, Nint=073, Nfrac=078)
+Fch=1913.80 (Fvco=3827.60, Nint=073, Nfrac=079)
+Fch=1914.00 (Fvco=3828.00, Nint=073, Nfrac=080)
+Fch=1914.20 (Fvco=3828.40, Nint=073, Nfrac=081)
+Fch=1914.40 (Fvco=3828.80, Nint=073, Nfrac=082)
+Fch=1914.60 (Fvco=3829.20, Nint=073, Nfrac=083)
+Fch=1914.80 (Fvco=3829.60, Nint=073, Nfrac=084)
+Fch=1915.00 (Fvco=3830.00, Nint=073, Nfrac=085)
+Fch=1915.20 (Fvco=3830.40, Nint=073, Nfrac=086)
+Fch=1915.40 (Fvco=3830.80, Nint=073, Nfrac=087)
+Fch=1915.60 (Fvco=3831.20, Nint=073, Nfrac=088)
+Fch=1915.80 (Fvco=3831.60, Nint=073, Nfrac=089)
+Fch=1916.00 (Fvco=3832.00, Nint=073, Nfrac=090)
+Fch=1916.20 (Fvco=3832.40, Nint=073, Nfrac=091)
+Fch=1916.40 (Fvco=3832.80, Nint=073, Nfrac=092)
+Fch=1916.60 (Fvco=3833.20, Nint=073, Nfrac=093)
+Fch=1916.80 (Fvco=3833.60, Nint=073, Nfrac=094)
+Fch=1917.00 (Fvco=3834.00, Nint=073, Nfrac=095)
+Fch=1917.20 (Fvco=3834.40, Nint=073, Nfrac=096)
+Fch=1917.40 (Fvco=3834.80, Nint=073, Nfrac=097)
+Fch=1917.60 (Fvco=3835.20, Nint=073, Nfrac=098)
+Fch=1917.80 (Fvco=3835.60, Nint=073, Nfrac=099)
+Fch=1918.00 (Fvco=3836.00, Nint=073, Nfrac=100)
+Fch=1918.20 (Fvco=3836.40, Nint=073, Nfrac=101)
+Fch=1918.40 (Fvco=3836.80, Nint=073, Nfrac=102)
+Fch=1918.60 (Fvco=3837.20, Nint=073, Nfrac=103)
+Fch=1918.80 (Fvco=3837.60, Nint=073, Nfrac=104)
+Fch=1919.00 (Fvco=3838.00, Nint=073, Nfrac=105)
+Fch=1919.20 (Fvco=3838.40, Nint=073, Nfrac=106)
+Fch=1919.40 (Fvco=3838.80, Nint=073, Nfrac=107)
+Fch=1919.60 (Fvco=3839.20, Nint=073, Nfrac=108)
+Fch=1919.80 (Fvco=3839.60, Nint=073, Nfrac=109)
+Fch=1920.00 (Fvco=3840.00, Nint=073, Nfrac=110)
+Fch=1920.20 (Fvco=3840.40, Nint=073, Nfrac=111)
+Fch=1920.40 (Fvco=3840.80, Nint=073, Nfrac=112)
+Fch=1920.60 (Fvco=3841.20, Nint=073, Nfrac=113)
+Fch=1920.80 (Fvco=3841.60, Nint=073, Nfrac=114)
+Fch=1921.00 (Fvco=3842.00, Nint=073, Nfrac=115)
+Fch=1921.20 (Fvco=3842.40, Nint=073, Nfrac=116)
+Fch=1921.40 (Fvco=3842.80, Nint=073, Nfrac=117)
+Fch=1921.60 (Fvco=3843.20, Nint=073, Nfrac=118)
+Fch=1921.80 (Fvco=3843.60, Nint=073, Nfrac=119)
+Fch=1922.00 (Fvco=3844.00, Nint=073, Nfrac=120)
+Fch=1922.20 (Fvco=3844.40, Nint=073, Nfrac=121)
+Fch=1922.40 (Fvco=3844.80, Nint=073, Nfrac=122)
+Fch=1922.60 (Fvco=3845.20, Nint=073, Nfrac=123)
+Fch=1922.80 (Fvco=3845.60, Nint=073, Nfrac=124)
+Fch=1923.00 (Fvco=3846.00, Nint=073, Nfrac=125)
+Fch=1923.20 (Fvco=3846.40, Nint=073, Nfrac=126)
+Fch=1923.40 (Fvco=3846.80, Nint=073, Nfrac=127)
+Fch=1923.60 (Fvco=3847.20, Nint=073, Nfrac=128)
+Fch=1923.80 (Fvco=3847.60, Nint=073, Nfrac=129)
+Fch=1924.00 (Fvco=3848.00, Nint=073, Nfrac=130)
+Fch=1924.00 (Fvco=3848.00, Nint=074, Nfrac=000)
+Fch=1924.20 (Fvco=3848.40, Nint=074, Nfrac=001)
+Fch=1924.40 (Fvco=3848.80, Nint=074, Nfrac=002)
+Fch=1924.60 (Fvco=3849.20, Nint=074, Nfrac=003)
+Fch=1924.80 (Fvco=3849.60, Nint=074, Nfrac=004)
+Fch=1925.00 (Fvco=3850.00, Nint=074, Nfrac=005)
+Fch=1925.20 (Fvco=3850.40, Nint=074, Nfrac=006)
+Fch=1925.40 (Fvco=3850.80, Nint=074, Nfrac=007)
+Fch=1925.60 (Fvco=3851.20, Nint=074, Nfrac=008)
+Fch=1925.80 (Fvco=3851.60, Nint=074, Nfrac=009)
+Fch=1926.00 (Fvco=3852.00, Nint=074, Nfrac=010)
+Fch=1926.20 (Fvco=3852.40, Nint=074, Nfrac=011)
+Fch=1926.40 (Fvco=3852.80, Nint=074, Nfrac=012)
+Fch=1926.60 (Fvco=3853.20, Nint=074, Nfrac=013)
+Fch=1926.80 (Fvco=3853.60, Nint=074, Nfrac=014)
+Fch=1927.00 (Fvco=3854.00, Nint=074, Nfrac=015)
+Fch=1927.20 (Fvco=3854.40, Nint=074, Nfrac=016)
+Fch=1927.40 (Fvco=3854.80, Nint=074, Nfrac=017)
+Fch=1927.60 (Fvco=3855.20, Nint=074, Nfrac=018)
+Fch=1927.80 (Fvco=3855.60, Nint=074, Nfrac=019)
+Fch=1928.00 (Fvco=3856.00, Nint=074, Nfrac=020)
+Fch=1928.20 (Fvco=3856.40, Nint=074, Nfrac=021)
+Fch=1928.40 (Fvco=3856.80, Nint=074, Nfrac=022)
+Fch=1928.60 (Fvco=3857.20, Nint=074, Nfrac=023)
+Fch=1928.80 (Fvco=3857.60, Nint=074, Nfrac=024)
+Fch=1929.00 (Fvco=3858.00, Nint=074, Nfrac=025)
+Fch=1929.20 (Fvco=3858.40, Nint=074, Nfrac=026)
+Fch=1929.40 (Fvco=3858.80, Nint=074, Nfrac=027)
+Fch=1929.60 (Fvco=3859.20, Nint=074, Nfrac=028)
+Fch=1929.80 (Fvco=3859.60, Nint=074, Nfrac=029)
+Fch=1930.00 (Fvco=3860.00, Nint=074, Nfrac=030)
+Fch=1930.20 (Fvco=3860.40, Nint=074, Nfrac=031)
+Fch=1930.40 (Fvco=3860.80, Nint=074, Nfrac=032)
+Fch=1930.60 (Fvco=3861.20, Nint=074, Nfrac=033)
+Fch=1930.80 (Fvco=3861.60, Nint=074, Nfrac=034)
+Fch=1931.00 (Fvco=3862.00, Nint=074, Nfrac=035)
+Fch=1931.20 (Fvco=3862.40, Nint=074, Nfrac=036)
+Fch=1931.40 (Fvco=3862.80, Nint=074, Nfrac=037)
+Fch=1931.60 (Fvco=3863.20, Nint=074, Nfrac=038)
+Fch=1931.80 (Fvco=3863.60, Nint=074, Nfrac=039)
+Fch=1932.00 (Fvco=3864.00, Nint=074, Nfrac=040)
+Fch=1932.20 (Fvco=3864.40, Nint=074, Nfrac=041)
+Fch=1932.40 (Fvco=3864.80, Nint=074, Nfrac=042)
+Fch=1932.60 (Fvco=3865.20, Nint=074, Nfrac=043)
+Fch=1932.80 (Fvco=3865.60, Nint=074, Nfrac=044)
+Fch=1933.00 (Fvco=3866.00, Nint=074, Nfrac=045)
+Fch=1933.20 (Fvco=3866.40, Nint=074, Nfrac=046)
+Fch=1933.40 (Fvco=3866.80, Nint=074, Nfrac=047)
+Fch=1933.60 (Fvco=3867.20, Nint=074, Nfrac=048)
+Fch=1933.80 (Fvco=3867.60, Nint=074, Nfrac=049)
+Fch=1934.00 (Fvco=3868.00, Nint=074, Nfrac=050)
+Fch=1934.20 (Fvco=3868.40, Nint=074, Nfrac=051)
+Fch=1934.40 (Fvco=3868.80, Nint=074, Nfrac=052)
+Fch=1934.60 (Fvco=3869.20, Nint=074, Nfrac=053)
+Fch=1934.80 (Fvco=3869.60, Nint=074, Nfrac=054)
+Fch=1935.00 (Fvco=3870.00, Nint=074, Nfrac=055)
+Fch=1935.20 (Fvco=3870.40, Nint=074, Nfrac=056)
+Fch=1935.40 (Fvco=3870.80, Nint=074, Nfrac=057)
+Fch=1935.60 (Fvco=3871.20, Nint=074, Nfrac=058)
+Fch=1935.80 (Fvco=3871.60, Nint=074, Nfrac=059)
+Fch=1936.00 (Fvco=3872.00, Nint=074, Nfrac=060)
+Fch=1936.20 (Fvco=3872.40, Nint=074, Nfrac=061)
+Fch=1936.40 (Fvco=3872.80, Nint=074, Nfrac=062)
+Fch=1936.60 (Fvco=3873.20, Nint=074, Nfrac=063)
+Fch=1936.80 (Fvco=3873.60, Nint=074, Nfrac=064)
+Fch=1937.00 (Fvco=3874.00, Nint=074, Nfrac=065)
+Fch=1937.20 (Fvco=3874.40, Nint=074, Nfrac=066)
+Fch=1937.40 (Fvco=3874.80, Nint=074, Nfrac=067)
+Fch=1937.60 (Fvco=3875.20, Nint=074, Nfrac=068)
+Fch=1937.80 (Fvco=3875.60, Nint=074, Nfrac=069)
+Fch=1938.00 (Fvco=3876.00, Nint=074, Nfrac=070)
+Fch=1938.20 (Fvco=3876.40, Nint=074, Nfrac=071)
+Fch=1938.40 (Fvco=3876.80, Nint=074, Nfrac=072)
+Fch=1938.60 (Fvco=3877.20, Nint=074, Nfrac=073)
+Fch=1938.80 (Fvco=3877.60, Nint=074, Nfrac=074)
+Fch=1939.00 (Fvco=3878.00, Nint=074, Nfrac=075)
+Fch=1939.20 (Fvco=3878.40, Nint=074, Nfrac=076)
+Fch=1939.40 (Fvco=3878.80, Nint=074, Nfrac=077)
+Fch=1939.60 (Fvco=3879.20, Nint=074, Nfrac=078)
+Fch=1939.80 (Fvco=3879.60, Nint=074, Nfrac=079)
+Fch=1940.00 (Fvco=3880.00, Nint=074, Nfrac=080)
+Fch=1940.20 (Fvco=3880.40, Nint=074, Nfrac=081)
+Fch=1940.40 (Fvco=3880.80, Nint=074, Nfrac=082)
+Fch=1940.60 (Fvco=3881.20, Nint=074, Nfrac=083)
+Fch=1940.80 (Fvco=3881.60, Nint=074, Nfrac=084)
+Fch=1941.00 (Fvco=3882.00, Nint=074, Nfrac=085)
+Fch=1941.20 (Fvco=3882.40, Nint=074, Nfrac=086)
+Fch=1941.40 (Fvco=3882.80, Nint=074, Nfrac=087)
+Fch=1941.60 (Fvco=3883.20, Nint=074, Nfrac=088)
+Fch=1941.80 (Fvco=3883.60, Nint=074, Nfrac=089)
+Fch=1942.00 (Fvco=3884.00, Nint=074, Nfrac=090)
+Fch=1942.20 (Fvco=3884.40, Nint=074, Nfrac=091)
+Fch=1942.40 (Fvco=3884.80, Nint=074, Nfrac=092)
+Fch=1942.60 (Fvco=3885.20, Nint=074, Nfrac=093)
+Fch=1942.80 (Fvco=3885.60, Nint=074, Nfrac=094)
+Fch=1943.00 (Fvco=3886.00, Nint=074, Nfrac=095)
+Fch=1943.20 (Fvco=3886.40, Nint=074, Nfrac=096)
+Fch=1943.40 (Fvco=3886.80, Nint=074, Nfrac=097)
+Fch=1943.60 (Fvco=3887.20, Nint=074, Nfrac=098)
+Fch=1943.80 (Fvco=3887.60, Nint=074, Nfrac=099)
+Fch=1944.00 (Fvco=3888.00, Nint=074, Nfrac=100)
+Fch=1944.20 (Fvco=3888.40, Nint=074, Nfrac=101)
+Fch=1944.40 (Fvco=3888.80, Nint=074, Nfrac=102)
+Fch=1944.60 (Fvco=3889.20, Nint=074, Nfrac=103)
+Fch=1944.80 (Fvco=3889.60, Nint=074, Nfrac=104)
+Fch=1945.00 (Fvco=3890.00, Nint=074, Nfrac=105)
+Fch=1945.20 (Fvco=3890.40, Nint=074, Nfrac=106)
+Fch=1945.40 (Fvco=3890.80, Nint=074, Nfrac=107)
+Fch=1945.60 (Fvco=3891.20, Nint=074, Nfrac=108)
+Fch=1945.80 (Fvco=3891.60, Nint=074, Nfrac=109)
+Fch=1946.00 (Fvco=3892.00, Nint=074, Nfrac=110)
+Fch=1946.20 (Fvco=3892.40, Nint=074, Nfrac=111)
+Fch=1946.40 (Fvco=3892.80, Nint=074, Nfrac=112)
+Fch=1946.60 (Fvco=3893.20, Nint=074, Nfrac=113)
+Fch=1946.80 (Fvco=3893.60, Nint=074, Nfrac=114)
+Fch=1947.00 (Fvco=3894.00, Nint=074, Nfrac=115)
+Fch=1947.20 (Fvco=3894.40, Nint=074, Nfrac=116)
+Fch=1947.40 (Fvco=3894.80, Nint=074, Nfrac=117)
+Fch=1947.60 (Fvco=3895.20, Nint=074, Nfrac=118)
+Fch=1947.80 (Fvco=3895.60, Nint=074, Nfrac=119)
+Fch=1948.00 (Fvco=3896.00, Nint=074, Nfrac=120)
+Fch=1948.20 (Fvco=3896.40, Nint=074, Nfrac=121)
+Fch=1948.40 (Fvco=3896.80, Nint=074, Nfrac=122)
+Fch=1948.60 (Fvco=3897.20, Nint=074, Nfrac=123)
+Fch=1948.80 (Fvco=3897.60, Nint=074, Nfrac=124)
+Fch=1949.00 (Fvco=3898.00, Nint=074, Nfrac=125)
+Fch=1949.20 (Fvco=3898.40, Nint=074, Nfrac=126)
+Fch=1949.40 (Fvco=3898.80, Nint=074, Nfrac=127)
+Fch=1949.60 (Fvco=3899.20, Nint=074, Nfrac=128)
+Fch=1949.80 (Fvco=3899.60, Nint=074, Nfrac=129)
+Fch=1950.00 (Fvco=3900.00, Nint=074, Nfrac=130)
+Fch=1950.00 (Fvco=3900.00, Nint=075, Nfrac=000)
+Fch=1950.20 (Fvco=3900.40, Nint=075, Nfrac=001)
+Fch=1950.40 (Fvco=3900.80, Nint=075, Nfrac=002)
+Fch=1950.60 (Fvco=3901.20, Nint=075, Nfrac=003)
+Fch=1950.80 (Fvco=3901.60, Nint=075, Nfrac=004)
+Fch=1951.00 (Fvco=3902.00, Nint=075, Nfrac=005)
+Fch=1951.20 (Fvco=3902.40, Nint=075, Nfrac=006)
+Fch=1951.40 (Fvco=3902.80, Nint=075, Nfrac=007)
+Fch=1951.60 (Fvco=3903.20, Nint=075, Nfrac=008)
+Fch=1951.80 (Fvco=3903.60, Nint=075, Nfrac=009)
+Fch=1952.00 (Fvco=3904.00, Nint=075, Nfrac=010)
+Fch=1952.20 (Fvco=3904.40, Nint=075, Nfrac=011)
+Fch=1952.40 (Fvco=3904.80, Nint=075, Nfrac=012)
+Fch=1952.60 (Fvco=3905.20, Nint=075, Nfrac=013)
+Fch=1952.80 (Fvco=3905.60, Nint=075, Nfrac=014)
+Fch=1953.00 (Fvco=3906.00, Nint=075, Nfrac=015)
+Fch=1953.20 (Fvco=3906.40, Nint=075, Nfrac=016)
+Fch=1953.40 (Fvco=3906.80, Nint=075, Nfrac=017)
+Fch=1953.60 (Fvco=3907.20, Nint=075, Nfrac=018)
+Fch=1953.80 (Fvco=3907.60, Nint=075, Nfrac=019)
+Fch=1954.00 (Fvco=3908.00, Nint=075, Nfrac=020)
+Fch=1954.20 (Fvco=3908.40, Nint=075, Nfrac=021)
+Fch=1954.40 (Fvco=3908.80, Nint=075, Nfrac=022)
+Fch=1954.60 (Fvco=3909.20, Nint=075, Nfrac=023)
+Fch=1954.80 (Fvco=3909.60, Nint=075, Nfrac=024)
+Fch=1955.00 (Fvco=3910.00, Nint=075, Nfrac=025)
+Fch=1955.20 (Fvco=3910.40, Nint=075, Nfrac=026)
+Fch=1955.40 (Fvco=3910.80, Nint=075, Nfrac=027)
+Fch=1955.60 (Fvco=3911.20, Nint=075, Nfrac=028)
+Fch=1955.80 (Fvco=3911.60, Nint=075, Nfrac=029)
+Fch=1956.00 (Fvco=3912.00, Nint=075, Nfrac=030)
+Fch=1956.20 (Fvco=3912.40, Nint=075, Nfrac=031)
+Fch=1956.40 (Fvco=3912.80, Nint=075, Nfrac=032)
+Fch=1956.60 (Fvco=3913.20, Nint=075, Nfrac=033)
+Fch=1956.80 (Fvco=3913.60, Nint=075, Nfrac=034)
+Fch=1957.00 (Fvco=3914.00, Nint=075, Nfrac=035)
+Fch=1957.20 (Fvco=3914.40, Nint=075, Nfrac=036)
+Fch=1957.40 (Fvco=3914.80, Nint=075, Nfrac=037)
+Fch=1957.60 (Fvco=3915.20, Nint=075, Nfrac=038)
+Fch=1957.80 (Fvco=3915.60, Nint=075, Nfrac=039)
+Fch=1958.00 (Fvco=3916.00, Nint=075, Nfrac=040)
+Fch=1958.20 (Fvco=3916.40, Nint=075, Nfrac=041)
+Fch=1958.40 (Fvco=3916.80, Nint=075, Nfrac=042)
+Fch=1958.60 (Fvco=3917.20, Nint=075, Nfrac=043)
+Fch=1958.80 (Fvco=3917.60, Nint=075, Nfrac=044)
+Fch=1959.00 (Fvco=3918.00, Nint=075, Nfrac=045)
+Fch=1959.20 (Fvco=3918.40, Nint=075, Nfrac=046)
+Fch=1959.40 (Fvco=3918.80, Nint=075, Nfrac=047)
+Fch=1959.60 (Fvco=3919.20, Nint=075, Nfrac=048)
+Fch=1959.80 (Fvco=3919.60, Nint=075, Nfrac=049)
+Fch=1960.00 (Fvco=3920.00, Nint=075, Nfrac=050)
+Fch=1960.20 (Fvco=3920.40, Nint=075, Nfrac=051)
+Fch=1960.40 (Fvco=3920.80, Nint=075, Nfrac=052)
+Fch=1960.60 (Fvco=3921.20, Nint=075, Nfrac=053)
+Fch=1960.80 (Fvco=3921.60, Nint=075, Nfrac=054)
+Fch=1961.00 (Fvco=3922.00, Nint=075, Nfrac=055)
+Fch=1961.20 (Fvco=3922.40, Nint=075, Nfrac=056)
+Fch=1961.40 (Fvco=3922.80, Nint=075, Nfrac=057)
+Fch=1961.60 (Fvco=3923.20, Nint=075, Nfrac=058)
+Fch=1961.80 (Fvco=3923.60, Nint=075, Nfrac=059)
+Fch=1962.00 (Fvco=3924.00, Nint=075, Nfrac=060)
+Fch=1962.20 (Fvco=3924.40, Nint=075, Nfrac=061)
+Fch=1962.40 (Fvco=3924.80, Nint=075, Nfrac=062)
+Fch=1962.60 (Fvco=3925.20, Nint=075, Nfrac=063)
+Fch=1962.80 (Fvco=3925.60, Nint=075, Nfrac=064)
+Fch=1963.00 (Fvco=3926.00, Nint=075, Nfrac=065)
+Fch=1963.20 (Fvco=3926.40, Nint=075, Nfrac=066)
+Fch=1963.40 (Fvco=3926.80, Nint=075, Nfrac=067)
+Fch=1963.60 (Fvco=3927.20, Nint=075, Nfrac=068)
+Fch=1963.80 (Fvco=3927.60, Nint=075, Nfrac=069)
+Fch=1964.00 (Fvco=3928.00, Nint=075, Nfrac=070)
+Fch=1964.20 (Fvco=3928.40, Nint=075, Nfrac=071)
+Fch=1964.40 (Fvco=3928.80, Nint=075, Nfrac=072)
+Fch=1964.60 (Fvco=3929.20, Nint=075, Nfrac=073)
+Fch=1964.80 (Fvco=3929.60, Nint=075, Nfrac=074)
+Fch=1965.00 (Fvco=3930.00, Nint=075, Nfrac=075)
+Fch=1965.20 (Fvco=3930.40, Nint=075, Nfrac=076)
+Fch=1965.40 (Fvco=3930.80, Nint=075, Nfrac=077)
+Fch=1965.60 (Fvco=3931.20, Nint=075, Nfrac=078)
+Fch=1965.80 (Fvco=3931.60, Nint=075, Nfrac=079)
+Fch=1966.00 (Fvco=3932.00, Nint=075, Nfrac=080)
+Fch=1966.20 (Fvco=3932.40, Nint=075, Nfrac=081)
+Fch=1966.40 (Fvco=3932.80, Nint=075, Nfrac=082)
+Fch=1966.60 (Fvco=3933.20, Nint=075, Nfrac=083)
+Fch=1966.80 (Fvco=3933.60, Nint=075, Nfrac=084)
+Fch=1967.00 (Fvco=3934.00, Nint=075, Nfrac=085)
+Fch=1967.20 (Fvco=3934.40, Nint=075, Nfrac=086)
+Fch=1967.40 (Fvco=3934.80, Nint=075, Nfrac=087)
+Fch=1967.60 (Fvco=3935.20, Nint=075, Nfrac=088)
+Fch=1967.80 (Fvco=3935.60, Nint=075, Nfrac=089)
+Fch=1968.00 (Fvco=3936.00, Nint=075, Nfrac=090)
+Fch=1968.20 (Fvco=3936.40, Nint=075, Nfrac=091)
+Fch=1968.40 (Fvco=3936.80, Nint=075, Nfrac=092)
+Fch=1968.60 (Fvco=3937.20, Nint=075, Nfrac=093)
+Fch=1968.80 (Fvco=3937.60, Nint=075, Nfrac=094)
+Fch=1969.00 (Fvco=3938.00, Nint=075, Nfrac=095)
+Fch=1969.20 (Fvco=3938.40, Nint=075, Nfrac=096)
+Fch=1969.40 (Fvco=3938.80, Nint=075, Nfrac=097)
+Fch=1969.60 (Fvco=3939.20, Nint=075, Nfrac=098)
+Fch=1969.80 (Fvco=3939.60, Nint=075, Nfrac=099)
+Fch=1970.00 (Fvco=3940.00, Nint=075, Nfrac=100)
+Fch=1970.20 (Fvco=3940.40, Nint=075, Nfrac=101)
+Fch=1970.40 (Fvco=3940.80, Nint=075, Nfrac=102)
+Fch=1970.60 (Fvco=3941.20, Nint=075, Nfrac=103)
+Fch=1970.80 (Fvco=3941.60, Nint=075, Nfrac=104)
+Fch=1971.00 (Fvco=3942.00, Nint=075, Nfrac=105)
+Fch=1971.20 (Fvco=3942.40, Nint=075, Nfrac=106)
+Fch=1971.40 (Fvco=3942.80, Nint=075, Nfrac=107)
+Fch=1971.60 (Fvco=3943.20, Nint=075, Nfrac=108)
+Fch=1971.80 (Fvco=3943.60, Nint=075, Nfrac=109)
+Fch=1972.00 (Fvco=3944.00, Nint=075, Nfrac=110)
+Fch=1972.20 (Fvco=3944.40, Nint=075, Nfrac=111)
+Fch=1972.40 (Fvco=3944.80, Nint=075, Nfrac=112)
+Fch=1972.60 (Fvco=3945.20, Nint=075, Nfrac=113)
+Fch=1972.80 (Fvco=3945.60, Nint=075, Nfrac=114)
+Fch=1973.00 (Fvco=3946.00, Nint=075, Nfrac=115)
+Fch=1973.20 (Fvco=3946.40, Nint=075, Nfrac=116)
+Fch=1973.40 (Fvco=3946.80, Nint=075, Nfrac=117)
+Fch=1973.60 (Fvco=3947.20, Nint=075, Nfrac=118)
+Fch=1973.80 (Fvco=3947.60, Nint=075, Nfrac=119)
+Fch=1974.00 (Fvco=3948.00, Nint=075, Nfrac=120)
+Fch=1974.20 (Fvco=3948.40, Nint=075, Nfrac=121)
+Fch=1974.40 (Fvco=3948.80, Nint=075, Nfrac=122)
+Fch=1974.60 (Fvco=3949.20, Nint=075, Nfrac=123)
+Fch=1974.80 (Fvco=3949.60, Nint=075, Nfrac=124)
+Fch=1975.00 (Fvco=3950.00, Nint=075, Nfrac=125)
+Fch=1975.20 (Fvco=3950.40, Nint=075, Nfrac=126)
+Fch=1975.40 (Fvco=3950.80, Nint=075, Nfrac=127)
+Fch=1975.60 (Fvco=3951.20, Nint=075, Nfrac=128)
+Fch=1975.80 (Fvco=3951.60, Nint=075, Nfrac=129)
+Fch=1976.00 (Fvco=3952.00, Nint=075, Nfrac=130)
+Fch=1976.00 (Fvco=3952.00, Nint=076, Nfrac=000)
+Fch=1976.20 (Fvco=3952.40, Nint=076, Nfrac=001)
+Fch=1976.40 (Fvco=3952.80, Nint=076, Nfrac=002)
+Fch=1976.60 (Fvco=3953.20, Nint=076, Nfrac=003)
+Fch=1976.80 (Fvco=3953.60, Nint=076, Nfrac=004)
+Fch=1977.00 (Fvco=3954.00, Nint=076, Nfrac=005)
+Fch=1977.20 (Fvco=3954.40, Nint=076, Nfrac=006)
+Fch=1977.40 (Fvco=3954.80, Nint=076, Nfrac=007)
+Fch=1977.60 (Fvco=3955.20, Nint=076, Nfrac=008)
+Fch=1977.80 (Fvco=3955.60, Nint=076, Nfrac=009)
+Fch=1978.00 (Fvco=3956.00, Nint=076, Nfrac=010)
+Fch=1978.20 (Fvco=3956.40, Nint=076, Nfrac=011)
+Fch=1978.40 (Fvco=3956.80, Nint=076, Nfrac=012)
+Fch=1978.60 (Fvco=3957.20, Nint=076, Nfrac=013)
+Fch=1978.80 (Fvco=3957.60, Nint=076, Nfrac=014)
+Fch=1979.00 (Fvco=3958.00, Nint=076, Nfrac=015)
+Fch=1979.20 (Fvco=3958.40, Nint=076, Nfrac=016)
+Fch=1979.40 (Fvco=3958.80, Nint=076, Nfrac=017)
+Fch=1979.60 (Fvco=3959.20, Nint=076, Nfrac=018)
+Fch=1979.80 (Fvco=3959.60, Nint=076, Nfrac=019)
+Fch=1980.00 (Fvco=3960.00, Nint=076, Nfrac=020)
+Fch=1980.20 (Fvco=3960.40, Nint=076, Nfrac=021)
+Fch=1980.40 (Fvco=3960.80, Nint=076, Nfrac=022)
+Fch=1980.60 (Fvco=3961.20, Nint=076, Nfrac=023)
+Fch=1980.80 (Fvco=3961.60, Nint=076, Nfrac=024)
+Fch=1981.00 (Fvco=3962.00, Nint=076, Nfrac=025)
+Fch=1981.20 (Fvco=3962.40, Nint=076, Nfrac=026)
+Fch=1981.40 (Fvco=3962.80, Nint=076, Nfrac=027)
+Fch=1981.60 (Fvco=3963.20, Nint=076, Nfrac=028)
+Fch=1981.80 (Fvco=3963.60, Nint=076, Nfrac=029)
+Fch=1982.00 (Fvco=3964.00, Nint=076, Nfrac=030)
+Fch=1982.20 (Fvco=3964.40, Nint=076, Nfrac=031)
+Fch=1982.40 (Fvco=3964.80, Nint=076, Nfrac=032)
+Fch=1982.60 (Fvco=3965.20, Nint=076, Nfrac=033)
+Fch=1982.80 (Fvco=3965.60, Nint=076, Nfrac=034)
+Fch=1983.00 (Fvco=3966.00, Nint=076, Nfrac=035)
+Fch=1983.20 (Fvco=3966.40, Nint=076, Nfrac=036)
+Fch=1983.40 (Fvco=3966.80, Nint=076, Nfrac=037)
+Fch=1983.60 (Fvco=3967.20, Nint=076, Nfrac=038)
+Fch=1983.80 (Fvco=3967.60, Nint=076, Nfrac=039)
+Fch=1984.00 (Fvco=3968.00, Nint=076, Nfrac=040)
+Fch=1984.20 (Fvco=3968.40, Nint=076, Nfrac=041)
+Fch=1984.40 (Fvco=3968.80, Nint=076, Nfrac=042)
+Fch=1984.60 (Fvco=3969.20, Nint=076, Nfrac=043)
+Fch=1984.80 (Fvco=3969.60, Nint=076, Nfrac=044)
+Fch=1985.00 (Fvco=3970.00, Nint=076, Nfrac=045)
+Fch=1985.20 (Fvco=3970.40, Nint=076, Nfrac=046)
+Fch=1985.40 (Fvco=3970.80, Nint=076, Nfrac=047)
+Fch=1985.60 (Fvco=3971.20, Nint=076, Nfrac=048)
+Fch=1985.80 (Fvco=3971.60, Nint=076, Nfrac=049)
+Fch=1986.00 (Fvco=3972.00, Nint=076, Nfrac=050)
+Fch=1986.20 (Fvco=3972.40, Nint=076, Nfrac=051)
+Fch=1986.40 (Fvco=3972.80, Nint=076, Nfrac=052)
+Fch=1986.60 (Fvco=3973.20, Nint=076, Nfrac=053)
+Fch=1986.80 (Fvco=3973.60, Nint=076, Nfrac=054)
+Fch=1987.00 (Fvco=3974.00, Nint=076, Nfrac=055)
+Fch=1987.20 (Fvco=3974.40, Nint=076, Nfrac=056)
+Fch=1987.40 (Fvco=3974.80, Nint=076, Nfrac=057)
+Fch=1987.60 (Fvco=3975.20, Nint=076, Nfrac=058)
+Fch=1987.80 (Fvco=3975.60, Nint=076, Nfrac=059)
+Fch=1988.00 (Fvco=3976.00, Nint=076, Nfrac=060)
+Fch=1988.20 (Fvco=3976.40, Nint=076, Nfrac=061)
+Fch=1988.40 (Fvco=3976.80, Nint=076, Nfrac=062)
+Fch=1988.60 (Fvco=3977.20, Nint=076, Nfrac=063)
+Fch=1988.80 (Fvco=3977.60, Nint=076, Nfrac=064)
+Fch=1989.00 (Fvco=3978.00, Nint=076, Nfrac=065)
+Fch=1989.20 (Fvco=3978.40, Nint=076, Nfrac=066)
+Fch=1989.40 (Fvco=3978.80, Nint=076, Nfrac=067)
+Fch=1989.60 (Fvco=3979.20, Nint=076, Nfrac=068)
+Fch=1989.80 (Fvco=3979.60, Nint=076, Nfrac=069)
+Fch=1990.00 (Fvco=3980.00, Nint=076, Nfrac=070)
+Fch=1990.20 (Fvco=3980.40, Nint=076, Nfrac=071)
+Fch=1990.40 (Fvco=3980.80, Nint=076, Nfrac=072)
+Fch=1990.60 (Fvco=3981.20, Nint=076, Nfrac=073)
+Fch=1990.80 (Fvco=3981.60, Nint=076, Nfrac=074)
+Fch=1991.00 (Fvco=3982.00, Nint=076, Nfrac=075)
+Fch=1991.20 (Fvco=3982.40, Nint=076, Nfrac=076)
+Fch=1991.40 (Fvco=3982.80, Nint=076, Nfrac=077)
+Fch=1991.60 (Fvco=3983.20, Nint=076, Nfrac=078)
+Fch=1991.80 (Fvco=3983.60, Nint=076, Nfrac=079)
+Fch=1992.00 (Fvco=3984.00, Nint=076, Nfrac=080)
+Fch=1992.20 (Fvco=3984.40, Nint=076, Nfrac=081)
+Fch=1992.40 (Fvco=3984.80, Nint=076, Nfrac=082)
+Fch=1992.60 (Fvco=3985.20, Nint=076, Nfrac=083)
+Fch=1992.80 (Fvco=3985.60, Nint=076, Nfrac=084)
+Fch=1993.00 (Fvco=3986.00, Nint=076, Nfrac=085)
+Fch=1993.20 (Fvco=3986.40, Nint=076, Nfrac=086)
+Fch=1993.40 (Fvco=3986.80, Nint=076, Nfrac=087)
+Fch=1993.60 (Fvco=3987.20, Nint=076, Nfrac=088)
+Fch=1993.80 (Fvco=3987.60, Nint=076, Nfrac=089)
+Fch=1994.00 (Fvco=3988.00, Nint=076, Nfrac=090)
+Fch=1994.20 (Fvco=3988.40, Nint=076, Nfrac=091)
+Fch=1994.40 (Fvco=3988.80, Nint=076, Nfrac=092)
+Fch=1994.60 (Fvco=3989.20, Nint=076, Nfrac=093)
+Fch=1994.80 (Fvco=3989.60, Nint=076, Nfrac=094)
+Fch=1995.00 (Fvco=3990.00, Nint=076, Nfrac=095)
+Fch=1995.20 (Fvco=3990.40, Nint=076, Nfrac=096)
+Fch=1995.40 (Fvco=3990.80, Nint=076, Nfrac=097)
+Fch=1995.60 (Fvco=3991.20, Nint=076, Nfrac=098)
+Fch=1995.80 (Fvco=3991.60, Nint=076, Nfrac=099)
+Fch=1996.00 (Fvco=3992.00, Nint=076, Nfrac=100)
+Fch=1996.20 (Fvco=3992.40, Nint=076, Nfrac=101)
+Fch=1996.40 (Fvco=3992.80, Nint=076, Nfrac=102)
+Fch=1996.60 (Fvco=3993.20, Nint=076, Nfrac=103)
+Fch=1996.80 (Fvco=3993.60, Nint=076, Nfrac=104)
+Fch=1997.00 (Fvco=3994.00, Nint=076, Nfrac=105)
+Fch=1997.20 (Fvco=3994.40, Nint=076, Nfrac=106)
+Fch=1997.40 (Fvco=3994.80, Nint=076, Nfrac=107)
+Fch=1997.60 (Fvco=3995.20, Nint=076, Nfrac=108)
+Fch=1997.80 (Fvco=3995.60, Nint=076, Nfrac=109)
+Fch=1998.00 (Fvco=3996.00, Nint=076, Nfrac=110)
+Fch=1998.20 (Fvco=3996.40, Nint=076, Nfrac=111)
+Fch=1998.40 (Fvco=3996.80, Nint=076, Nfrac=112)
+Fch=1998.60 (Fvco=3997.20, Nint=076, Nfrac=113)
+Fch=1998.80 (Fvco=3997.60, Nint=076, Nfrac=114)
+Fch=1999.00 (Fvco=3998.00, Nint=076, Nfrac=115)
+Fch=1999.20 (Fvco=3998.40, Nint=076, Nfrac=116)
+Fch=1999.40 (Fvco=3998.80, Nint=076, Nfrac=117)
+Fch=1999.60 (Fvco=3999.20, Nint=076, Nfrac=118)
+Fch=1999.80 (Fvco=3999.60, Nint=076, Nfrac=119)
+Fch=2000.00 (Fvco=4000.00, Nint=076, Nfrac=120)
+Fch=2000.20 (Fvco=4000.40, Nint=076, Nfrac=121)
+Fch=2000.40 (Fvco=4000.80, Nint=076, Nfrac=122)
+Fch=2000.60 (Fvco=4001.20, Nint=076, Nfrac=123)
+Fch=2000.80 (Fvco=4001.60, Nint=076, Nfrac=124)
+Fch=2001.00 (Fvco=4002.00, Nint=076, Nfrac=125)
+Fch=2001.20 (Fvco=4002.40, Nint=076, Nfrac=126)
+Fch=2001.40 (Fvco=4002.80, Nint=076, Nfrac=127)
+Fch=2001.60 (Fvco=4003.20, Nint=076, Nfrac=128)
+Fch=2001.80 (Fvco=4003.60, Nint=076, Nfrac=129)
+Fch=2002.00 (Fvco=4004.00, Nint=076, Nfrac=130)
+Fch=2002.00 (Fvco=4004.00, Nint=077, Nfrac=000)
+Fch=2002.20 (Fvco=4004.40, Nint=077, Nfrac=001)
+Fch=2002.40 (Fvco=4004.80, Nint=077, Nfrac=002)
+Fch=2002.60 (Fvco=4005.20, Nint=077, Nfrac=003)
+Fch=2002.80 (Fvco=4005.60, Nint=077, Nfrac=004)
+Fch=2003.00 (Fvco=4006.00, Nint=077, Nfrac=005)
+Fch=2003.20 (Fvco=4006.40, Nint=077, Nfrac=006)
+Fch=2003.40 (Fvco=4006.80, Nint=077, Nfrac=007)
+Fch=2003.60 (Fvco=4007.20, Nint=077, Nfrac=008)
+Fch=2003.80 (Fvco=4007.60, Nint=077, Nfrac=009)
+Fch=2004.00 (Fvco=4008.00, Nint=077, Nfrac=010)
+Fch=2004.20 (Fvco=4008.40, Nint=077, Nfrac=011)
+Fch=2004.40 (Fvco=4008.80, Nint=077, Nfrac=012)
+Fch=2004.60 (Fvco=4009.20, Nint=077, Nfrac=013)
+Fch=2004.80 (Fvco=4009.60, Nint=077, Nfrac=014)
+Fch=2005.00 (Fvco=4010.00, Nint=077, Nfrac=015)
+Fch=2005.20 (Fvco=4010.40, Nint=077, Nfrac=016)
+Fch=2005.40 (Fvco=4010.80, Nint=077, Nfrac=017)
+Fch=2005.60 (Fvco=4011.20, Nint=077, Nfrac=018)
+Fch=2005.80 (Fvco=4011.60, Nint=077, Nfrac=019)
+Fch=2006.00 (Fvco=4012.00, Nint=077, Nfrac=020)
+Fch=2006.20 (Fvco=4012.40, Nint=077, Nfrac=021)
+Fch=2006.40 (Fvco=4012.80, Nint=077, Nfrac=022)
+Fch=2006.60 (Fvco=4013.20, Nint=077, Nfrac=023)
+Fch=2006.80 (Fvco=4013.60, Nint=077, Nfrac=024)
+Fch=2007.00 (Fvco=4014.00, Nint=077, Nfrac=025)
+Fch=2007.20 (Fvco=4014.40, Nint=077, Nfrac=026)
+Fch=2007.40 (Fvco=4014.80, Nint=077, Nfrac=027)
+Fch=2007.60 (Fvco=4015.20, Nint=077, Nfrac=028)
+Fch=2007.80 (Fvco=4015.60, Nint=077, Nfrac=029)
+Fch=2008.00 (Fvco=4016.00, Nint=077, Nfrac=030)
+Fch=2008.20 (Fvco=4016.40, Nint=077, Nfrac=031)
+Fch=2008.40 (Fvco=4016.80, Nint=077, Nfrac=032)
+Fch=2008.60 (Fvco=4017.20, Nint=077, Nfrac=033)
+Fch=2008.80 (Fvco=4017.60, Nint=077, Nfrac=034)
+Fch=2009.00 (Fvco=4018.00, Nint=077, Nfrac=035)
+Fch=2009.20 (Fvco=4018.40, Nint=077, Nfrac=036)
+Fch=2009.40 (Fvco=4018.80, Nint=077, Nfrac=037)
+Fch=2009.60 (Fvco=4019.20, Nint=077, Nfrac=038)
+Fch=2009.80 (Fvco=4019.60, Nint=077, Nfrac=039)
+Fch=2010.00 (Fvco=4020.00, Nint=077, Nfrac=040)
+Fch=2010.20 (Fvco=4020.40, Nint=077, Nfrac=041)
+Fch=2010.40 (Fvco=4020.80, Nint=077, Nfrac=042)
+Fch=2010.60 (Fvco=4021.20, Nint=077, Nfrac=043)
+Fch=2010.80 (Fvco=4021.60, Nint=077, Nfrac=044)
+Fch=2011.00 (Fvco=4022.00, Nint=077, Nfrac=045)
+Fch=2011.20 (Fvco=4022.40, Nint=077, Nfrac=046)
+Fch=2011.40 (Fvco=4022.80, Nint=077, Nfrac=047)
+Fch=2011.60 (Fvco=4023.20, Nint=077, Nfrac=048)
+Fch=2011.80 (Fvco=4023.60, Nint=077, Nfrac=049)
+Fch=2012.00 (Fvco=4024.00, Nint=077, Nfrac=050)
+Fch=2012.20 (Fvco=4024.40, Nint=077, Nfrac=051)
+Fch=2012.40 (Fvco=4024.80, Nint=077, Nfrac=052)
+Fch=2012.60 (Fvco=4025.20, Nint=077, Nfrac=053)
+Fch=2012.80 (Fvco=4025.60, Nint=077, Nfrac=054)
+Fch=2013.00 (Fvco=4026.00, Nint=077, Nfrac=055)
+Fch=2013.20 (Fvco=4026.40, Nint=077, Nfrac=056)
+Fch=2013.40 (Fvco=4026.80, Nint=077, Nfrac=057)
+Fch=2013.60 (Fvco=4027.20, Nint=077, Nfrac=058)
+Fch=2013.80 (Fvco=4027.60, Nint=077, Nfrac=059)
+Fch=2014.00 (Fvco=4028.00, Nint=077, Nfrac=060)
+Fch=2014.20 (Fvco=4028.40, Nint=077, Nfrac=061)
+Fch=2014.40 (Fvco=4028.80, Nint=077, Nfrac=062)
+Fch=2014.60 (Fvco=4029.20, Nint=077, Nfrac=063)
+Fch=2014.80 (Fvco=4029.60, Nint=077, Nfrac=064)
+Fch=2015.00 (Fvco=4030.00, Nint=077, Nfrac=065)
+Fch=2015.20 (Fvco=4030.40, Nint=077, Nfrac=066)
+Fch=2015.40 (Fvco=4030.80, Nint=077, Nfrac=067)
+Fch=2015.60 (Fvco=4031.20, Nint=077, Nfrac=068)
+Fch=2015.80 (Fvco=4031.60, Nint=077, Nfrac=069)
+Fch=2016.00 (Fvco=4032.00, Nint=077, Nfrac=070)
+Fch=2016.20 (Fvco=4032.40, Nint=077, Nfrac=071)
+Fch=2016.40 (Fvco=4032.80, Nint=077, Nfrac=072)
+Fch=2016.60 (Fvco=4033.20, Nint=077, Nfrac=073)
+Fch=2016.80 (Fvco=4033.60, Nint=077, Nfrac=074)
+Fch=2017.00 (Fvco=4034.00, Nint=077, Nfrac=075)
+Fch=2017.20 (Fvco=4034.40, Nint=077, Nfrac=076)
+Fch=2017.40 (Fvco=4034.80, Nint=077, Nfrac=077)
+Fch=2017.60 (Fvco=4035.20, Nint=077, Nfrac=078)
+Fch=2017.80 (Fvco=4035.60, Nint=077, Nfrac=079)
+Fch=2018.00 (Fvco=4036.00, Nint=077, Nfrac=080)
+Fch=2018.20 (Fvco=4036.40, Nint=077, Nfrac=081)
+Fch=2018.40 (Fvco=4036.80, Nint=077, Nfrac=082)
+Fch=2018.60 (Fvco=4037.20, Nint=077, Nfrac=083)
+Fch=2018.80 (Fvco=4037.60, Nint=077, Nfrac=084)
+Fch=2019.00 (Fvco=4038.00, Nint=077, Nfrac=085)
+Fch=2019.20 (Fvco=4038.40, Nint=077, Nfrac=086)
+Fch=2019.40 (Fvco=4038.80, Nint=077, Nfrac=087)
+Fch=2019.60 (Fvco=4039.20, Nint=077, Nfrac=088)
+Fch=2019.80 (Fvco=4039.60, Nint=077, Nfrac=089)
+Fch=2020.00 (Fvco=4040.00, Nint=077, Nfrac=090)
+Fch=2020.20 (Fvco=4040.40, Nint=077, Nfrac=091)
+Fch=2020.40 (Fvco=4040.80, Nint=077, Nfrac=092)
+Fch=2020.60 (Fvco=4041.20, Nint=077, Nfrac=093)
+Fch=2020.80 (Fvco=4041.60, Nint=077, Nfrac=094)
+Fch=2021.00 (Fvco=4042.00, Nint=077, Nfrac=095)
+Fch=2021.20 (Fvco=4042.40, Nint=077, Nfrac=096)
+Fch=2021.40 (Fvco=4042.80, Nint=077, Nfrac=097)
+Fch=2021.60 (Fvco=4043.20, Nint=077, Nfrac=098)
+Fch=2021.80 (Fvco=4043.60, Nint=077, Nfrac=099)
+Fch=2022.00 (Fvco=4044.00, Nint=077, Nfrac=100)
+Fch=2022.20 (Fvco=4044.40, Nint=077, Nfrac=101)
+Fch=2022.40 (Fvco=4044.80, Nint=077, Nfrac=102)
+Fch=2022.60 (Fvco=4045.20, Nint=077, Nfrac=103)
+Fch=2022.80 (Fvco=4045.60, Nint=077, Nfrac=104)
+Fch=2023.00 (Fvco=4046.00, Nint=077, Nfrac=105)
+Fch=2023.20 (Fvco=4046.40, Nint=077, Nfrac=106)
+Fch=2023.40 (Fvco=4046.80, Nint=077, Nfrac=107)
+Fch=2023.60 (Fvco=4047.20, Nint=077, Nfrac=108)
+Fch=2023.80 (Fvco=4047.60, Nint=077, Nfrac=109)
+Fch=2024.00 (Fvco=4048.00, Nint=077, Nfrac=110)
+Fch=2024.20 (Fvco=4048.40, Nint=077, Nfrac=111)
+Fch=2024.40 (Fvco=4048.80, Nint=077, Nfrac=112)
+Fch=2024.60 (Fvco=4049.20, Nint=077, Nfrac=113)
+Fch=2024.80 (Fvco=4049.60, Nint=077, Nfrac=114)
+Fch=2025.00 (Fvco=4050.00, Nint=077, Nfrac=115)
+Fch=2025.20 (Fvco=4050.40, Nint=077, Nfrac=116)
+Fch=2025.40 (Fvco=4050.80, Nint=077, Nfrac=117)
+Fch=2025.60 (Fvco=4051.20, Nint=077, Nfrac=118)
+Fch=2025.80 (Fvco=4051.60, Nint=077, Nfrac=119)
+Fch=2026.00 (Fvco=4052.00, Nint=077, Nfrac=120)
+Fch=2026.20 (Fvco=4052.40, Nint=077, Nfrac=121)
+Fch=2026.40 (Fvco=4052.80, Nint=077, Nfrac=122)
+Fch=2026.60 (Fvco=4053.20, Nint=077, Nfrac=123)
+Fch=2026.80 (Fvco=4053.60, Nint=077, Nfrac=124)
+Fch=2027.00 (Fvco=4054.00, Nint=077, Nfrac=125)
+Fch=2027.20 (Fvco=4054.40, Nint=077, Nfrac=126)
+Fch=2027.40 (Fvco=4054.80, Nint=077, Nfrac=127)
+Fch=2027.60 (Fvco=4055.20, Nint=077, Nfrac=128)
+Fch=2027.80 (Fvco=4055.60, Nint=077, Nfrac=129)
+Fch=2028.00 (Fvco=4056.00, Nint=077, Nfrac=130)
+Fch=2028.00 (Fvco=4056.00, Nint=078, Nfrac=000)
+Fch=2028.20 (Fvco=4056.40, Nint=078, Nfrac=001)
+Fch=2028.40 (Fvco=4056.80, Nint=078, Nfrac=002)
+Fch=2028.60 (Fvco=4057.20, Nint=078, Nfrac=003)
+Fch=2028.80 (Fvco=4057.60, Nint=078, Nfrac=004)
+Fch=2029.00 (Fvco=4058.00, Nint=078, Nfrac=005)
+Fch=2029.20 (Fvco=4058.40, Nint=078, Nfrac=006)
+Fch=2029.40 (Fvco=4058.80, Nint=078, Nfrac=007)
+Fch=2029.60 (Fvco=4059.20, Nint=078, Nfrac=008)
+Fch=2029.80 (Fvco=4059.60, Nint=078, Nfrac=009)
+Fch=2030.00 (Fvco=4060.00, Nint=078, Nfrac=010)
+Fch=2030.20 (Fvco=4060.40, Nint=078, Nfrac=011)
+Fch=2030.40 (Fvco=4060.80, Nint=078, Nfrac=012)
+Fch=2030.60 (Fvco=4061.20, Nint=078, Nfrac=013)
+Fch=2030.80 (Fvco=4061.60, Nint=078, Nfrac=014)
+Fch=2031.00 (Fvco=4062.00, Nint=078, Nfrac=015)
+Fch=2031.20 (Fvco=4062.40, Nint=078, Nfrac=016)
+Fch=2031.40 (Fvco=4062.80, Nint=078, Nfrac=017)
+Fch=2031.60 (Fvco=4063.20, Nint=078, Nfrac=018)
+Fch=2031.80 (Fvco=4063.60, Nint=078, Nfrac=019)
+Fch=2032.00 (Fvco=4064.00, Nint=078, Nfrac=020)
+Fch=2032.20 (Fvco=4064.40, Nint=078, Nfrac=021)
+Fch=2032.40 (Fvco=4064.80, Nint=078, Nfrac=022)
+Fch=2032.60 (Fvco=4065.20, Nint=078, Nfrac=023)
+Fch=2032.80 (Fvco=4065.60, Nint=078, Nfrac=024)
+Fch=2033.00 (Fvco=4066.00, Nint=078, Nfrac=025)
+Fch=2033.20 (Fvco=4066.40, Nint=078, Nfrac=026)
+Fch=2033.40 (Fvco=4066.80, Nint=078, Nfrac=027)
+Fch=2033.60 (Fvco=4067.20, Nint=078, Nfrac=028)
+Fch=2033.80 (Fvco=4067.60, Nint=078, Nfrac=029)
+Fch=2034.00 (Fvco=4068.00, Nint=078, Nfrac=030)
+Fch=2034.20 (Fvco=4068.40, Nint=078, Nfrac=031)
+Fch=2034.40 (Fvco=4068.80, Nint=078, Nfrac=032)
+Fch=2034.60 (Fvco=4069.20, Nint=078, Nfrac=033)
+Fch=2034.80 (Fvco=4069.60, Nint=078, Nfrac=034)
+Fch=2035.00 (Fvco=4070.00, Nint=078, Nfrac=035)
+Fch=2035.20 (Fvco=4070.40, Nint=078, Nfrac=036)
+Fch=2035.40 (Fvco=4070.80, Nint=078, Nfrac=037)
+Fch=2035.60 (Fvco=4071.20, Nint=078, Nfrac=038)
+Fch=2035.80 (Fvco=4071.60, Nint=078, Nfrac=039)
+Fch=2036.00 (Fvco=4072.00, Nint=078, Nfrac=040)
+Fch=2036.20 (Fvco=4072.40, Nint=078, Nfrac=041)
+Fch=2036.40 (Fvco=4072.80, Nint=078, Nfrac=042)
+Fch=2036.60 (Fvco=4073.20, Nint=078, Nfrac=043)
+Fch=2036.80 (Fvco=4073.60, Nint=078, Nfrac=044)
+Fch=2037.00 (Fvco=4074.00, Nint=078, Nfrac=045)
+Fch=2037.20 (Fvco=4074.40, Nint=078, Nfrac=046)
+Fch=2037.40 (Fvco=4074.80, Nint=078, Nfrac=047)
+Fch=2037.60 (Fvco=4075.20, Nint=078, Nfrac=048)
+Fch=2037.80 (Fvco=4075.60, Nint=078, Nfrac=049)
+Fch=2038.00 (Fvco=4076.00, Nint=078, Nfrac=050)
+Fch=2038.20 (Fvco=4076.40, Nint=078, Nfrac=051)
+Fch=2038.40 (Fvco=4076.80, Nint=078, Nfrac=052)
+Fch=2038.60 (Fvco=4077.20, Nint=078, Nfrac=053)
+Fch=2038.80 (Fvco=4077.60, Nint=078, Nfrac=054)
+Fch=2039.00 (Fvco=4078.00, Nint=078, Nfrac=055)
+Fch=2039.20 (Fvco=4078.40, Nint=078, Nfrac=056)
+Fch=2039.40 (Fvco=4078.80, Nint=078, Nfrac=057)
+Fch=2039.60 (Fvco=4079.20, Nint=078, Nfrac=058)
+Fch=2039.80 (Fvco=4079.60, Nint=078, Nfrac=059)
+Fch=2040.00 (Fvco=4080.00, Nint=078, Nfrac=060)
+Fch=2040.20 (Fvco=4080.40, Nint=078, Nfrac=061)
+Fch=2040.40 (Fvco=4080.80, Nint=078, Nfrac=062)
+Fch=2040.60 (Fvco=4081.20, Nint=078, Nfrac=063)
+Fch=2040.80 (Fvco=4081.60, Nint=078, Nfrac=064)
+Fch=2041.00 (Fvco=4082.00, Nint=078, Nfrac=065)
+Fch=2041.20 (Fvco=4082.40, Nint=078, Nfrac=066)
+Fch=2041.40 (Fvco=4082.80, Nint=078, Nfrac=067)
+Fch=2041.60 (Fvco=4083.20, Nint=078, Nfrac=068)
+Fch=2041.80 (Fvco=4083.60, Nint=078, Nfrac=069)
+Fch=2042.00 (Fvco=4084.00, Nint=078, Nfrac=070)
+Fch=2042.20 (Fvco=4084.40, Nint=078, Nfrac=071)
+Fch=2042.40 (Fvco=4084.80, Nint=078, Nfrac=072)
+Fch=2042.60 (Fvco=4085.20, Nint=078, Nfrac=073)
+Fch=2042.80 (Fvco=4085.60, Nint=078, Nfrac=074)
+Fch=2043.00 (Fvco=4086.00, Nint=078, Nfrac=075)
+Fch=2043.20 (Fvco=4086.40, Nint=078, Nfrac=076)
+Fch=2043.40 (Fvco=4086.80, Nint=078, Nfrac=077)
+Fch=2043.60 (Fvco=4087.20, Nint=078, Nfrac=078)
+Fch=2043.80 (Fvco=4087.60, Nint=078, Nfrac=079)
+Fch=2044.00 (Fvco=4088.00, Nint=078, Nfrac=080)
+Fch=2044.20 (Fvco=4088.40, Nint=078, Nfrac=081)
+Fch=2044.40 (Fvco=4088.80, Nint=078, Nfrac=082)
+Fch=2044.60 (Fvco=4089.20, Nint=078, Nfrac=083)
+Fch=2044.80 (Fvco=4089.60, Nint=078, Nfrac=084)
+Fch=2045.00 (Fvco=4090.00, Nint=078, Nfrac=085)
+Fch=2045.20 (Fvco=4090.40, Nint=078, Nfrac=086)
+Fch=2045.40 (Fvco=4090.80, Nint=078, Nfrac=087)
+Fch=2045.60 (Fvco=4091.20, Nint=078, Nfrac=088)
+Fch=2045.80 (Fvco=4091.60, Nint=078, Nfrac=089)
+Fch=2046.00 (Fvco=4092.00, Nint=078, Nfrac=090)
+Fch=2046.20 (Fvco=4092.40, Nint=078, Nfrac=091)
+Fch=2046.40 (Fvco=4092.80, Nint=078, Nfrac=092)
+Fch=2046.60 (Fvco=4093.20, Nint=078, Nfrac=093)
+Fch=2046.80 (Fvco=4093.60, Nint=078, Nfrac=094)
+Fch=2047.00 (Fvco=4094.00, Nint=078, Nfrac=095)
+Fch=2047.20 (Fvco=4094.40, Nint=078, Nfrac=096)
+Fch=2047.40 (Fvco=4094.80, Nint=078, Nfrac=097)
+Fch=2047.60 (Fvco=4095.20, Nint=078, Nfrac=098)
+Fch=2047.80 (Fvco=4095.60, Nint=078, Nfrac=099)
+Fch=2048.00 (Fvco=4096.00, Nint=078, Nfrac=100)
+Fch=2048.20 (Fvco=4096.40, Nint=078, Nfrac=101)
+Fch=2048.40 (Fvco=4096.80, Nint=078, Nfrac=102)
+Fch=2048.60 (Fvco=4097.20, Nint=078, Nfrac=103)
+Fch=2048.80 (Fvco=4097.60, Nint=078, Nfrac=104)
+Fch=2049.00 (Fvco=4098.00, Nint=078, Nfrac=105)
+Fch=2049.20 (Fvco=4098.40, Nint=078, Nfrac=106)
+Fch=2049.40 (Fvco=4098.80, Nint=078, Nfrac=107)
+Fch=2049.60 (Fvco=4099.20, Nint=078, Nfrac=108)
+Fch=2049.80 (Fvco=4099.60, Nint=078, Nfrac=109)
+Fch=2050.00 (Fvco=4100.00, Nint=078, Nfrac=110)
+Fch=2050.20 (Fvco=4100.40, Nint=078, Nfrac=111)
+Fch=2050.40 (Fvco=4100.80, Nint=078, Nfrac=112)
+Fch=2050.60 (Fvco=4101.20, Nint=078, Nfrac=113)
+Fch=2050.80 (Fvco=4101.60, Nint=078, Nfrac=114)
+Fch=2051.00 (Fvco=4102.00, Nint=078, Nfrac=115)
+Fch=2051.20 (Fvco=4102.40, Nint=078, Nfrac=116)
+Fch=2051.40 (Fvco=4102.80, Nint=078, Nfrac=117)
+Fch=2051.60 (Fvco=4103.20, Nint=078, Nfrac=118)
+Fch=2051.80 (Fvco=4103.60, Nint=078, Nfrac=119)
+Fch=2052.00 (Fvco=4104.00, Nint=078, Nfrac=120)
+Fch=2052.20 (Fvco=4104.40, Nint=078, Nfrac=121)
+Fch=2052.40 (Fvco=4104.80, Nint=078, Nfrac=122)
+Fch=2052.60 (Fvco=4105.20, Nint=078, Nfrac=123)
+Fch=2052.80 (Fvco=4105.60, Nint=078, Nfrac=124)
+Fch=2053.00 (Fvco=4106.00, Nint=078, Nfrac=125)
+Fch=2053.20 (Fvco=4106.40, Nint=078, Nfrac=126)
+Fch=2053.40 (Fvco=4106.80, Nint=078, Nfrac=127)
+Fch=2053.60 (Fvco=4107.20, Nint=078, Nfrac=128)
+Fch=2053.80 (Fvco=4107.60, Nint=078, Nfrac=129)
+Fch=2054.00 (Fvco=4108.00, Nint=078, Nfrac=130)
+Fch=2054.00 (Fvco=4108.00, Nint=079, Nfrac=000)
+Fch=2054.20 (Fvco=4108.40, Nint=079, Nfrac=001)
+Fch=2054.40 (Fvco=4108.80, Nint=079, Nfrac=002)
+Fch=2054.60 (Fvco=4109.20, Nint=079, Nfrac=003)
+Fch=2054.80 (Fvco=4109.60, Nint=079, Nfrac=004)
+Fch=2055.00 (Fvco=4110.00, Nint=079, Nfrac=005)
+Fch=2055.20 (Fvco=4110.40, Nint=079, Nfrac=006)
+Fch=2055.40 (Fvco=4110.80, Nint=079, Nfrac=007)
+Fch=2055.60 (Fvco=4111.20, Nint=079, Nfrac=008)
+Fch=2055.80 (Fvco=4111.60, Nint=079, Nfrac=009)
+Fch=2056.00 (Fvco=4112.00, Nint=079, Nfrac=010)
+Fch=2056.20 (Fvco=4112.40, Nint=079, Nfrac=011)
+Fch=2056.40 (Fvco=4112.80, Nint=079, Nfrac=012)
+Fch=2056.60 (Fvco=4113.20, Nint=079, Nfrac=013)
+Fch=2056.80 (Fvco=4113.60, Nint=079, Nfrac=014)
+Fch=2057.00 (Fvco=4114.00, Nint=079, Nfrac=015)
+Fch=2057.20 (Fvco=4114.40, Nint=079, Nfrac=016)
+Fch=2057.40 (Fvco=4114.80, Nint=079, Nfrac=017)
+Fch=2057.60 (Fvco=4115.20, Nint=079, Nfrac=018)
+Fch=2057.80 (Fvco=4115.60, Nint=079, Nfrac=019)
+Fch=2058.00 (Fvco=4116.00, Nint=079, Nfrac=020)
+Fch=2058.20 (Fvco=4116.40, Nint=079, Nfrac=021)
+Fch=2058.40 (Fvco=4116.80, Nint=079, Nfrac=022)
+Fch=2058.60 (Fvco=4117.20, Nint=079, Nfrac=023)
+Fch=2058.80 (Fvco=4117.60, Nint=079, Nfrac=024)
+Fch=2059.00 (Fvco=4118.00, Nint=079, Nfrac=025)
+Fch=2059.20 (Fvco=4118.40, Nint=079, Nfrac=026)
+Fch=2059.40 (Fvco=4118.80, Nint=079, Nfrac=027)
+Fch=2059.60 (Fvco=4119.20, Nint=079, Nfrac=028)
+Fch=2059.80 (Fvco=4119.60, Nint=079, Nfrac=029)
+Fch=2060.00 (Fvco=4120.00, Nint=079, Nfrac=030)
+Fch=2060.20 (Fvco=4120.40, Nint=079, Nfrac=031)
+Fch=2060.40 (Fvco=4120.80, Nint=079, Nfrac=032)
+Fch=2060.60 (Fvco=4121.20, Nint=079, Nfrac=033)
+Fch=2060.80 (Fvco=4121.60, Nint=079, Nfrac=034)
+Fch=2061.00 (Fvco=4122.00, Nint=079, Nfrac=035)
+Fch=2061.20 (Fvco=4122.40, Nint=079, Nfrac=036)
+Fch=2061.40 (Fvco=4122.80, Nint=079, Nfrac=037)
+Fch=2061.60 (Fvco=4123.20, Nint=079, Nfrac=038)
+Fch=2061.80 (Fvco=4123.60, Nint=079, Nfrac=039)
+Fch=2062.00 (Fvco=4124.00, Nint=079, Nfrac=040)
+Fch=2062.20 (Fvco=4124.40, Nint=079, Nfrac=041)
+Fch=2062.40 (Fvco=4124.80, Nint=079, Nfrac=042)
+Fch=2062.60 (Fvco=4125.20, Nint=079, Nfrac=043)
+Fch=2062.80 (Fvco=4125.60, Nint=079, Nfrac=044)
+Fch=2063.00 (Fvco=4126.00, Nint=079, Nfrac=045)
+Fch=2063.20 (Fvco=4126.40, Nint=079, Nfrac=046)
+Fch=2063.40 (Fvco=4126.80, Nint=079, Nfrac=047)
+Fch=2063.60 (Fvco=4127.20, Nint=079, Nfrac=048)
+Fch=2063.80 (Fvco=4127.60, Nint=079, Nfrac=049)
+Fch=2064.00 (Fvco=4128.00, Nint=079, Nfrac=050)
+Fch=2064.20 (Fvco=4128.40, Nint=079, Nfrac=051)
+Fch=2064.40 (Fvco=4128.80, Nint=079, Nfrac=052)
+Fch=2064.60 (Fvco=4129.20, Nint=079, Nfrac=053)
+Fch=2064.80 (Fvco=4129.60, Nint=079, Nfrac=054)
+Fch=2065.00 (Fvco=4130.00, Nint=079, Nfrac=055)
+Fch=2065.20 (Fvco=4130.40, Nint=079, Nfrac=056)
+Fch=2065.40 (Fvco=4130.80, Nint=079, Nfrac=057)
+Fch=2065.60 (Fvco=4131.20, Nint=079, Nfrac=058)
+Fch=2065.80 (Fvco=4131.60, Nint=079, Nfrac=059)
+Fch=2066.00 (Fvco=4132.00, Nint=079, Nfrac=060)
+Fch=2066.20 (Fvco=4132.40, Nint=079, Nfrac=061)
+Fch=2066.40 (Fvco=4132.80, Nint=079, Nfrac=062)
+Fch=2066.60 (Fvco=4133.20, Nint=079, Nfrac=063)
+Fch=2066.80 (Fvco=4133.60, Nint=079, Nfrac=064)
+Fch=2067.00 (Fvco=4134.00, Nint=079, Nfrac=065)
+Fch=2067.20 (Fvco=4134.40, Nint=079, Nfrac=066)
+Fch=2067.40 (Fvco=4134.80, Nint=079, Nfrac=067)
+Fch=2067.60 (Fvco=4135.20, Nint=079, Nfrac=068)
+Fch=2067.80 (Fvco=4135.60, Nint=079, Nfrac=069)
+Fch=2068.00 (Fvco=4136.00, Nint=079, Nfrac=070)
+Fch=2068.20 (Fvco=4136.40, Nint=079, Nfrac=071)
+Fch=2068.40 (Fvco=4136.80, Nint=079, Nfrac=072)
+Fch=2068.60 (Fvco=4137.20, Nint=079, Nfrac=073)
+Fch=2068.80 (Fvco=4137.60, Nint=079, Nfrac=074)
+Fch=2069.00 (Fvco=4138.00, Nint=079, Nfrac=075)
+Fch=2069.20 (Fvco=4138.40, Nint=079, Nfrac=076)
+Fch=2069.40 (Fvco=4138.80, Nint=079, Nfrac=077)
+Fch=2069.60 (Fvco=4139.20, Nint=079, Nfrac=078)
+Fch=2069.80 (Fvco=4139.60, Nint=079, Nfrac=079)
+Fch=2070.00 (Fvco=4140.00, Nint=079, Nfrac=080)
+Fch=2070.20 (Fvco=4140.40, Nint=079, Nfrac=081)
+Fch=2070.40 (Fvco=4140.80, Nint=079, Nfrac=082)
+Fch=2070.60 (Fvco=4141.20, Nint=079, Nfrac=083)
+Fch=2070.80 (Fvco=4141.60, Nint=079, Nfrac=084)
+Fch=2071.00 (Fvco=4142.00, Nint=079, Nfrac=085)
+Fch=2071.20 (Fvco=4142.40, Nint=079, Nfrac=086)
+Fch=2071.40 (Fvco=4142.80, Nint=079, Nfrac=087)
+Fch=2071.60 (Fvco=4143.20, Nint=079, Nfrac=088)
+Fch=2071.80 (Fvco=4143.60, Nint=079, Nfrac=089)
+Fch=2072.00 (Fvco=4144.00, Nint=079, Nfrac=090)
+Fch=2072.20 (Fvco=4144.40, Nint=079, Nfrac=091)
+Fch=2072.40 (Fvco=4144.80, Nint=079, Nfrac=092)
+Fch=2072.60 (Fvco=4145.20, Nint=079, Nfrac=093)
+Fch=2072.80 (Fvco=4145.60, Nint=079, Nfrac=094)
+Fch=2073.00 (Fvco=4146.00, Nint=079, Nfrac=095)
+Fch=2073.20 (Fvco=4146.40, Nint=079, Nfrac=096)
+Fch=2073.40 (Fvco=4146.80, Nint=079, Nfrac=097)
+Fch=2073.60 (Fvco=4147.20, Nint=079, Nfrac=098)
+Fch=2073.80 (Fvco=4147.60, Nint=079, Nfrac=099)
+Fch=2074.00 (Fvco=4148.00, Nint=079, Nfrac=100)
+Fch=2074.20 (Fvco=4148.40, Nint=079, Nfrac=101)
+Fch=2074.40 (Fvco=4148.80, Nint=079, Nfrac=102)
+Fch=2074.60 (Fvco=4149.20, Nint=079, Nfrac=103)
+Fch=2074.80 (Fvco=4149.60, Nint=079, Nfrac=104)
+Fch=2075.00 (Fvco=4150.00, Nint=079, Nfrac=105)
+Fch=2075.20 (Fvco=4150.40, Nint=079, Nfrac=106)
+Fch=2075.40 (Fvco=4150.80, Nint=079, Nfrac=107)
+Fch=2075.60 (Fvco=4151.20, Nint=079, Nfrac=108)
+Fch=2075.80 (Fvco=4151.60, Nint=079, Nfrac=109)
+Fch=2076.00 (Fvco=4152.00, Nint=079, Nfrac=110)
+Fch=2076.20 (Fvco=4152.40, Nint=079, Nfrac=111)
+Fch=2076.40 (Fvco=4152.80, Nint=079, Nfrac=112)
+Fch=2076.60 (Fvco=4153.20, Nint=079, Nfrac=113)
+Fch=2076.80 (Fvco=4153.60, Nint=079, Nfrac=114)
+Fch=2077.00 (Fvco=4154.00, Nint=079, Nfrac=115)
+Fch=2077.20 (Fvco=4154.40, Nint=079, Nfrac=116)
+Fch=2077.40 (Fvco=4154.80, Nint=079, Nfrac=117)
+Fch=2077.60 (Fvco=4155.20, Nint=079, Nfrac=118)
+Fch=2077.80 (Fvco=4155.60, Nint=079, Nfrac=119)
+Fch=2078.00 (Fvco=4156.00, Nint=079, Nfrac=120)
+Fch=2078.20 (Fvco=4156.40, Nint=079, Nfrac=121)
+Fch=2078.40 (Fvco=4156.80, Nint=079, Nfrac=122)
+Fch=2078.60 (Fvco=4157.20, Nint=079, Nfrac=123)
+Fch=2078.80 (Fvco=4157.60, Nint=079, Nfrac=124)
+Fch=2079.00 (Fvco=4158.00, Nint=079, Nfrac=125)
+Fch=2079.20 (Fvco=4158.40, Nint=079, Nfrac=126)
+Fch=2079.40 (Fvco=4158.80, Nint=079, Nfrac=127)
+Fch=2079.60 (Fvco=4159.20, Nint=079, Nfrac=128)
+Fch=2079.80 (Fvco=4159.60, Nint=079, Nfrac=129)
+Fch=2080.00 (Fvco=4160.00, Nint=079, Nfrac=130)
+======================================================================
+PLL Tx Low Band:
+Fch=819.00 (Fvco=3276.00, Nint=063, Nfrac=000)
+Fch=819.10 (Fvco=3276.40, Nint=063, Nfrac=001)
+Fch=819.20 (Fvco=3276.80, Nint=063, Nfrac=002)
+Fch=819.30 (Fvco=3277.20, Nint=063, Nfrac=003)
+Fch=819.40 (Fvco=3277.60, Nint=063, Nfrac=004)
+Fch=819.50 (Fvco=3278.00, Nint=063, Nfrac=005)
+Fch=819.60 (Fvco=3278.40, Nint=063, Nfrac=006)
+Fch=819.70 (Fvco=3278.80, Nint=063, Nfrac=007)
+Fch=819.80 (Fvco=3279.20, Nint=063, Nfrac=008)
+Fch=819.90 (Fvco=3279.60, Nint=063, Nfrac=009)
+Fch=820.00 (Fvco=3280.00, Nint=063, Nfrac=010)
+Fch=820.10 (Fvco=3280.40, Nint=063, Nfrac=011)
+Fch=820.20 (Fvco=3280.80, Nint=063, Nfrac=012)
+Fch=820.30 (Fvco=3281.20, Nint=063, Nfrac=013)
+Fch=820.40 (Fvco=3281.60, Nint=063, Nfrac=014)
+Fch=820.50 (Fvco=3282.00, Nint=063, Nfrac=015)
+Fch=820.60 (Fvco=3282.40, Nint=063, Nfrac=016)
+Fch=820.70 (Fvco=3282.80, Nint=063, Nfrac=017)
+Fch=820.80 (Fvco=3283.20, Nint=063, Nfrac=018)
+Fch=820.90 (Fvco=3283.60, Nint=063, Nfrac=019)
+Fch=821.00 (Fvco=3284.00, Nint=063, Nfrac=020)
+Fch=821.10 (Fvco=3284.40, Nint=063, Nfrac=021)
+Fch=821.20 (Fvco=3284.80, Nint=063, Nfrac=022)
+Fch=821.30 (Fvco=3285.20, Nint=063, Nfrac=023)
+Fch=821.40 (Fvco=3285.60, Nint=063, Nfrac=024)
+Fch=821.50 (Fvco=3286.00, Nint=063, Nfrac=025)
+Fch=821.60 (Fvco=3286.40, Nint=063, Nfrac=026)
+Fch=821.70 (Fvco=3286.80, Nint=063, Nfrac=027)
+Fch=821.80 (Fvco=3287.20, Nint=063, Nfrac=028)
+Fch=821.90 (Fvco=3287.60, Nint=063, Nfrac=029)
+Fch=822.00 (Fvco=3288.00, Nint=063, Nfrac=030)
+Fch=822.10 (Fvco=3288.40, Nint=063, Nfrac=031)
+Fch=822.20 (Fvco=3288.80, Nint=063, Nfrac=032)
+Fch=822.30 (Fvco=3289.20, Nint=063, Nfrac=033)
+Fch=822.40 (Fvco=3289.60, Nint=063, Nfrac=034)
+Fch=822.50 (Fvco=3290.00, Nint=063, Nfrac=035)
+Fch=822.60 (Fvco=3290.40, Nint=063, Nfrac=036)
+Fch=822.70 (Fvco=3290.80, Nint=063, Nfrac=037)
+Fch=822.80 (Fvco=3291.20, Nint=063, Nfrac=038)
+Fch=822.90 (Fvco=3291.60, Nint=063, Nfrac=039)
+Fch=823.00 (Fvco=3292.00, Nint=063, Nfrac=040)
+Fch=823.10 (Fvco=3292.40, Nint=063, Nfrac=041)
+Fch=823.20 (Fvco=3292.80, Nint=063, Nfrac=042)
+Fch=823.30 (Fvco=3293.20, Nint=063, Nfrac=043)
+Fch=823.40 (Fvco=3293.60, Nint=063, Nfrac=044)
+Fch=823.50 (Fvco=3294.00, Nint=063, Nfrac=045)
+Fch=823.60 (Fvco=3294.40, Nint=063, Nfrac=046)
+Fch=823.70 (Fvco=3294.80, Nint=063, Nfrac=047)
+Fch=823.80 (Fvco=3295.20, Nint=063, Nfrac=048)
+Fch=823.90 (Fvco=3295.60, Nint=063, Nfrac=049)
+Fch=824.00 (Fvco=3296.00, Nint=063, Nfrac=050)
+Fch=824.10 (Fvco=3296.40, Nint=063, Nfrac=051)
+Fch=824.20 (Fvco=3296.80, Nint=063, Nfrac=052)
+Fch=824.30 (Fvco=3297.20, Nint=063, Nfrac=053)
+Fch=824.40 (Fvco=3297.60, Nint=063, Nfrac=054)
+Fch=824.50 (Fvco=3298.00, Nint=063, Nfrac=055)
+Fch=824.60 (Fvco=3298.40, Nint=063, Nfrac=056)
+Fch=824.70 (Fvco=3298.80, Nint=063, Nfrac=057)
+Fch=824.80 (Fvco=3299.20, Nint=063, Nfrac=058)
+Fch=824.90 (Fvco=3299.60, Nint=063, Nfrac=059)
+Fch=825.00 (Fvco=3300.00, Nint=063, Nfrac=060)
+Fch=825.10 (Fvco=3300.40, Nint=063, Nfrac=061)
+Fch=825.20 (Fvco=3300.80, Nint=063, Nfrac=062)
+Fch=825.30 (Fvco=3301.20, Nint=063, Nfrac=063)
+Fch=825.40 (Fvco=3301.60, Nint=063, Nfrac=064)
+Fch=825.50 (Fvco=3302.00, Nint=063, Nfrac=065)
+Fch=825.60 (Fvco=3302.40, Nint=063, Nfrac=066)
+Fch=825.70 (Fvco=3302.80, Nint=063, Nfrac=067)
+Fch=825.80 (Fvco=3303.20, Nint=063, Nfrac=068)
+Fch=825.90 (Fvco=3303.60, Nint=063, Nfrac=069)
+Fch=826.00 (Fvco=3304.00, Nint=063, Nfrac=070)
+Fch=826.10 (Fvco=3304.40, Nint=063, Nfrac=071)
+Fch=826.20 (Fvco=3304.80, Nint=063, Nfrac=072)
+Fch=826.30 (Fvco=3305.20, Nint=063, Nfrac=073)
+Fch=826.40 (Fvco=3305.60, Nint=063, Nfrac=074)
+Fch=826.50 (Fvco=3306.00, Nint=063, Nfrac=075)
+Fch=826.60 (Fvco=3306.40, Nint=063, Nfrac=076)
+Fch=826.70 (Fvco=3306.80, Nint=063, Nfrac=077)
+Fch=826.80 (Fvco=3307.20, Nint=063, Nfrac=078)
+Fch=826.90 (Fvco=3307.60, Nint=063, Nfrac=079)
+Fch=827.00 (Fvco=3308.00, Nint=063, Nfrac=080)
+Fch=827.10 (Fvco=3308.40, Nint=063, Nfrac=081)
+Fch=827.20 (Fvco=3308.80, Nint=063, Nfrac=082)
+Fch=827.30 (Fvco=3309.20, Nint=063, Nfrac=083)
+Fch=827.40 (Fvco=3309.60, Nint=063, Nfrac=084)
+Fch=827.50 (Fvco=3310.00, Nint=063, Nfrac=085)
+Fch=827.60 (Fvco=3310.40, Nint=063, Nfrac=086)
+Fch=827.70 (Fvco=3310.80, Nint=063, Nfrac=087)
+Fch=827.80 (Fvco=3311.20, Nint=063, Nfrac=088)
+Fch=827.90 (Fvco=3311.60, Nint=063, Nfrac=089)
+Fch=828.00 (Fvco=3312.00, Nint=063, Nfrac=090)
+Fch=828.10 (Fvco=3312.40, Nint=063, Nfrac=091)
+Fch=828.20 (Fvco=3312.80, Nint=063, Nfrac=092)
+Fch=828.30 (Fvco=3313.20, Nint=063, Nfrac=093)
+Fch=828.40 (Fvco=3313.60, Nint=063, Nfrac=094)
+Fch=828.50 (Fvco=3314.00, Nint=063, Nfrac=095)
+Fch=828.60 (Fvco=3314.40, Nint=063, Nfrac=096)
+Fch=828.70 (Fvco=3314.80, Nint=063, Nfrac=097)
+Fch=828.80 (Fvco=3315.20, Nint=063, Nfrac=098)
+Fch=828.90 (Fvco=3315.60, Nint=063, Nfrac=099)
+Fch=829.00 (Fvco=3316.00, Nint=063, Nfrac=100)
+Fch=829.10 (Fvco=3316.40, Nint=063, Nfrac=101)
+Fch=829.20 (Fvco=3316.80, Nint=063, Nfrac=102)
+Fch=829.30 (Fvco=3317.20, Nint=063, Nfrac=103)
+Fch=829.40 (Fvco=3317.60, Nint=063, Nfrac=104)
+Fch=829.50 (Fvco=3318.00, Nint=063, Nfrac=105)
+Fch=829.60 (Fvco=3318.40, Nint=063, Nfrac=106)
+Fch=829.70 (Fvco=3318.80, Nint=063, Nfrac=107)
+Fch=829.80 (Fvco=3319.20, Nint=063, Nfrac=108)
+Fch=829.90 (Fvco=3319.60, Nint=063, Nfrac=109)
+Fch=830.00 (Fvco=3320.00, Nint=063, Nfrac=110)
+Fch=830.10 (Fvco=3320.40, Nint=063, Nfrac=111)
+Fch=830.20 (Fvco=3320.80, Nint=063, Nfrac=112)
+Fch=830.30 (Fvco=3321.20, Nint=063, Nfrac=113)
+Fch=830.40 (Fvco=3321.60, Nint=063, Nfrac=114)
+Fch=830.50 (Fvco=3322.00, Nint=063, Nfrac=115)
+Fch=830.60 (Fvco=3322.40, Nint=063, Nfrac=116)
+Fch=830.70 (Fvco=3322.80, Nint=063, Nfrac=117)
+Fch=830.80 (Fvco=3323.20, Nint=063, Nfrac=118)
+Fch=830.90 (Fvco=3323.60, Nint=063, Nfrac=119)
+Fch=831.00 (Fvco=3324.00, Nint=063, Nfrac=120)
+Fch=831.10 (Fvco=3324.40, Nint=063, Nfrac=121)
+Fch=831.20 (Fvco=3324.80, Nint=063, Nfrac=122)
+Fch=831.30 (Fvco=3325.20, Nint=063, Nfrac=123)
+Fch=831.40 (Fvco=3325.60, Nint=063, Nfrac=124)
+Fch=831.50 (Fvco=3326.00, Nint=063, Nfrac=125)
+Fch=831.60 (Fvco=3326.40, Nint=063, Nfrac=126)
+Fch=831.70 (Fvco=3326.80, Nint=063, Nfrac=127)
+Fch=831.80 (Fvco=3327.20, Nint=063, Nfrac=128)
+Fch=831.90 (Fvco=3327.60, Nint=063, Nfrac=129)
+Fch=832.00 (Fvco=3328.00, Nint=063, Nfrac=130)
+Fch=832.00 (Fvco=3328.00, Nint=064, Nfrac=000)
+Fch=832.10 (Fvco=3328.40, Nint=064, Nfrac=001)
+Fch=832.20 (Fvco=3328.80, Nint=064, Nfrac=002)
+Fch=832.30 (Fvco=3329.20, Nint=064, Nfrac=003)
+Fch=832.40 (Fvco=3329.60, Nint=064, Nfrac=004)
+Fch=832.50 (Fvco=3330.00, Nint=064, Nfrac=005)
+Fch=832.60 (Fvco=3330.40, Nint=064, Nfrac=006)
+Fch=832.70 (Fvco=3330.80, Nint=064, Nfrac=007)
+Fch=832.80 (Fvco=3331.20, Nint=064, Nfrac=008)
+Fch=832.90 (Fvco=3331.60, Nint=064, Nfrac=009)
+Fch=833.00 (Fvco=3332.00, Nint=064, Nfrac=010)
+Fch=833.10 (Fvco=3332.40, Nint=064, Nfrac=011)
+Fch=833.20 (Fvco=3332.80, Nint=064, Nfrac=012)
+Fch=833.30 (Fvco=3333.20, Nint=064, Nfrac=013)
+Fch=833.40 (Fvco=3333.60, Nint=064, Nfrac=014)
+Fch=833.50 (Fvco=3334.00, Nint=064, Nfrac=015)
+Fch=833.60 (Fvco=3334.40, Nint=064, Nfrac=016)
+Fch=833.70 (Fvco=3334.80, Nint=064, Nfrac=017)
+Fch=833.80 (Fvco=3335.20, Nint=064, Nfrac=018)
+Fch=833.90 (Fvco=3335.60, Nint=064, Nfrac=019)
+Fch=834.00 (Fvco=3336.00, Nint=064, Nfrac=020)
+Fch=834.10 (Fvco=3336.40, Nint=064, Nfrac=021)
+Fch=834.20 (Fvco=3336.80, Nint=064, Nfrac=022)
+Fch=834.30 (Fvco=3337.20, Nint=064, Nfrac=023)
+Fch=834.40 (Fvco=3337.60, Nint=064, Nfrac=024)
+Fch=834.50 (Fvco=3338.00, Nint=064, Nfrac=025)
+Fch=834.60 (Fvco=3338.40, Nint=064, Nfrac=026)
+Fch=834.70 (Fvco=3338.80, Nint=064, Nfrac=027)
+Fch=834.80 (Fvco=3339.20, Nint=064, Nfrac=028)
+Fch=834.90 (Fvco=3339.60, Nint=064, Nfrac=029)
+Fch=835.00 (Fvco=3340.00, Nint=064, Nfrac=030)
+Fch=835.10 (Fvco=3340.40, Nint=064, Nfrac=031)
+Fch=835.20 (Fvco=3340.80, Nint=064, Nfrac=032)
+Fch=835.30 (Fvco=3341.20, Nint=064, Nfrac=033)
+Fch=835.40 (Fvco=3341.60, Nint=064, Nfrac=034)
+Fch=835.50 (Fvco=3342.00, Nint=064, Nfrac=035)
+Fch=835.60 (Fvco=3342.40, Nint=064, Nfrac=036)
+Fch=835.70 (Fvco=3342.80, Nint=064, Nfrac=037)
+Fch=835.80 (Fvco=3343.20, Nint=064, Nfrac=038)
+Fch=835.90 (Fvco=3343.60, Nint=064, Nfrac=039)
+Fch=836.00 (Fvco=3344.00, Nint=064, Nfrac=040)
+Fch=836.10 (Fvco=3344.40, Nint=064, Nfrac=041)
+Fch=836.20 (Fvco=3344.80, Nint=064, Nfrac=042)
+Fch=836.30 (Fvco=3345.20, Nint=064, Nfrac=043)
+Fch=836.40 (Fvco=3345.60, Nint=064, Nfrac=044)
+Fch=836.50 (Fvco=3346.00, Nint=064, Nfrac=045)
+Fch=836.60 (Fvco=3346.40, Nint=064, Nfrac=046)
+Fch=836.70 (Fvco=3346.80, Nint=064, Nfrac=047)
+Fch=836.80 (Fvco=3347.20, Nint=064, Nfrac=048)
+Fch=836.90 (Fvco=3347.60, Nint=064, Nfrac=049)
+Fch=837.00 (Fvco=3348.00, Nint=064, Nfrac=050)
+Fch=837.10 (Fvco=3348.40, Nint=064, Nfrac=051)
+Fch=837.20 (Fvco=3348.80, Nint=064, Nfrac=052)
+Fch=837.30 (Fvco=3349.20, Nint=064, Nfrac=053)
+Fch=837.40 (Fvco=3349.60, Nint=064, Nfrac=054)
+Fch=837.50 (Fvco=3350.00, Nint=064, Nfrac=055)
+Fch=837.60 (Fvco=3350.40, Nint=064, Nfrac=056)
+Fch=837.70 (Fvco=3350.80, Nint=064, Nfrac=057)
+Fch=837.80 (Fvco=3351.20, Nint=064, Nfrac=058)
+Fch=837.90 (Fvco=3351.60, Nint=064, Nfrac=059)
+Fch=838.00 (Fvco=3352.00, Nint=064, Nfrac=060)
+Fch=838.10 (Fvco=3352.40, Nint=064, Nfrac=061)
+Fch=838.20 (Fvco=3352.80, Nint=064, Nfrac=062)
+Fch=838.30 (Fvco=3353.20, Nint=064, Nfrac=063)
+Fch=838.40 (Fvco=3353.60, Nint=064, Nfrac=064)
+Fch=838.50 (Fvco=3354.00, Nint=064, Nfrac=065)
+Fch=838.60 (Fvco=3354.40, Nint=064, Nfrac=066)
+Fch=838.70 (Fvco=3354.80, Nint=064, Nfrac=067)
+Fch=838.80 (Fvco=3355.20, Nint=064, Nfrac=068)
+Fch=838.90 (Fvco=3355.60, Nint=064, Nfrac=069)
+Fch=839.00 (Fvco=3356.00, Nint=064, Nfrac=070)
+Fch=839.10 (Fvco=3356.40, Nint=064, Nfrac=071)
+Fch=839.20 (Fvco=3356.80, Nint=064, Nfrac=072)
+Fch=839.30 (Fvco=3357.20, Nint=064, Nfrac=073)
+Fch=839.40 (Fvco=3357.60, Nint=064, Nfrac=074)
+Fch=839.50 (Fvco=3358.00, Nint=064, Nfrac=075)
+Fch=839.60 (Fvco=3358.40, Nint=064, Nfrac=076)
+Fch=839.70 (Fvco=3358.80, Nint=064, Nfrac=077)
+Fch=839.80 (Fvco=3359.20, Nint=064, Nfrac=078)
+Fch=839.90 (Fvco=3359.60, Nint=064, Nfrac=079)
+Fch=840.00 (Fvco=3360.00, Nint=064, Nfrac=080)
+Fch=840.10 (Fvco=3360.40, Nint=064, Nfrac=081)
+Fch=840.20 (Fvco=3360.80, Nint=064, Nfrac=082)
+Fch=840.30 (Fvco=3361.20, Nint=064, Nfrac=083)
+Fch=840.40 (Fvco=3361.60, Nint=064, Nfrac=084)
+Fch=840.50 (Fvco=3362.00, Nint=064, Nfrac=085)
+Fch=840.60 (Fvco=3362.40, Nint=064, Nfrac=086)
+Fch=840.70 (Fvco=3362.80, Nint=064, Nfrac=087)
+Fch=840.80 (Fvco=3363.20, Nint=064, Nfrac=088)
+Fch=840.90 (Fvco=3363.60, Nint=064, Nfrac=089)
+Fch=841.00 (Fvco=3364.00, Nint=064, Nfrac=090)
+Fch=841.10 (Fvco=3364.40, Nint=064, Nfrac=091)
+Fch=841.20 (Fvco=3364.80, Nint=064, Nfrac=092)
+Fch=841.30 (Fvco=3365.20, Nint=064, Nfrac=093)
+Fch=841.40 (Fvco=3365.60, Nint=064, Nfrac=094)
+Fch=841.50 (Fvco=3366.00, Nint=064, Nfrac=095)
+Fch=841.60 (Fvco=3366.40, Nint=064, Nfrac=096)
+Fch=841.70 (Fvco=3366.80, Nint=064, Nfrac=097)
+Fch=841.80 (Fvco=3367.20, Nint=064, Nfrac=098)
+Fch=841.90 (Fvco=3367.60, Nint=064, Nfrac=099)
+Fch=842.00 (Fvco=3368.00, Nint=064, Nfrac=100)
+Fch=842.10 (Fvco=3368.40, Nint=064, Nfrac=101)
+Fch=842.20 (Fvco=3368.80, Nint=064, Nfrac=102)
+Fch=842.30 (Fvco=3369.20, Nint=064, Nfrac=103)
+Fch=842.40 (Fvco=3369.60, Nint=064, Nfrac=104)
+Fch=842.50 (Fvco=3370.00, Nint=064, Nfrac=105)
+Fch=842.60 (Fvco=3370.40, Nint=064, Nfrac=106)
+Fch=842.70 (Fvco=3370.80, Nint=064, Nfrac=107)
+Fch=842.80 (Fvco=3371.20, Nint=064, Nfrac=108)
+Fch=842.90 (Fvco=3371.60, Nint=064, Nfrac=109)
+Fch=843.00 (Fvco=3372.00, Nint=064, Nfrac=110)
+Fch=843.10 (Fvco=3372.40, Nint=064, Nfrac=111)
+Fch=843.20 (Fvco=3372.80, Nint=064, Nfrac=112)
+Fch=843.30 (Fvco=3373.20, Nint=064, Nfrac=113)
+Fch=843.40 (Fvco=3373.60, Nint=064, Nfrac=114)
+Fch=843.50 (Fvco=3374.00, Nint=064, Nfrac=115)
+Fch=843.60 (Fvco=3374.40, Nint=064, Nfrac=116)
+Fch=843.70 (Fvco=3374.80, Nint=064, Nfrac=117)
+Fch=843.80 (Fvco=3375.20, Nint=064, Nfrac=118)
+Fch=843.90 (Fvco=3375.60, Nint=064, Nfrac=119)
+Fch=844.00 (Fvco=3376.00, Nint=064, Nfrac=120)
+Fch=844.10 (Fvco=3376.40, Nint=064, Nfrac=121)
+Fch=844.20 (Fvco=3376.80, Nint=064, Nfrac=122)
+Fch=844.30 (Fvco=3377.20, Nint=064, Nfrac=123)
+Fch=844.40 (Fvco=3377.60, Nint=064, Nfrac=124)
+Fch=844.50 (Fvco=3378.00, Nint=064, Nfrac=125)
+Fch=844.60 (Fvco=3378.40, Nint=064, Nfrac=126)
+Fch=844.70 (Fvco=3378.80, Nint=064, Nfrac=127)
+Fch=844.80 (Fvco=3379.20, Nint=064, Nfrac=128)
+Fch=844.90 (Fvco=3379.60, Nint=064, Nfrac=129)
+Fch=845.00 (Fvco=3380.00, Nint=064, Nfrac=130)
+Fch=845.00 (Fvco=3380.00, Nint=065, Nfrac=000)
+Fch=845.10 (Fvco=3380.40, Nint=065, Nfrac=001)
+Fch=845.20 (Fvco=3380.80, Nint=065, Nfrac=002)
+Fch=845.30 (Fvco=3381.20, Nint=065, Nfrac=003)
+Fch=845.40 (Fvco=3381.60, Nint=065, Nfrac=004)
+Fch=845.50 (Fvco=3382.00, Nint=065, Nfrac=005)
+Fch=845.60 (Fvco=3382.40, Nint=065, Nfrac=006)
+Fch=845.70 (Fvco=3382.80, Nint=065, Nfrac=007)
+Fch=845.80 (Fvco=3383.20, Nint=065, Nfrac=008)
+Fch=845.90 (Fvco=3383.60, Nint=065, Nfrac=009)
+Fch=846.00 (Fvco=3384.00, Nint=065, Nfrac=010)
+Fch=846.10 (Fvco=3384.40, Nint=065, Nfrac=011)
+Fch=846.20 (Fvco=3384.80, Nint=065, Nfrac=012)
+Fch=846.30 (Fvco=3385.20, Nint=065, Nfrac=013)
+Fch=846.40 (Fvco=3385.60, Nint=065, Nfrac=014)
+Fch=846.50 (Fvco=3386.00, Nint=065, Nfrac=015)
+Fch=846.60 (Fvco=3386.40, Nint=065, Nfrac=016)
+Fch=846.70 (Fvco=3386.80, Nint=065, Nfrac=017)
+Fch=846.80 (Fvco=3387.20, Nint=065, Nfrac=018)
+Fch=846.90 (Fvco=3387.60, Nint=065, Nfrac=019)
+Fch=847.00 (Fvco=3388.00, Nint=065, Nfrac=020)
+Fch=847.10 (Fvco=3388.40, Nint=065, Nfrac=021)
+Fch=847.20 (Fvco=3388.80, Nint=065, Nfrac=022)
+Fch=847.30 (Fvco=3389.20, Nint=065, Nfrac=023)
+Fch=847.40 (Fvco=3389.60, Nint=065, Nfrac=024)
+Fch=847.50 (Fvco=3390.00, Nint=065, Nfrac=025)
+Fch=847.60 (Fvco=3390.40, Nint=065, Nfrac=026)
+Fch=847.70 (Fvco=3390.80, Nint=065, Nfrac=027)
+Fch=847.80 (Fvco=3391.20, Nint=065, Nfrac=028)
+Fch=847.90 (Fvco=3391.60, Nint=065, Nfrac=029)
+Fch=848.00 (Fvco=3392.00, Nint=065, Nfrac=030)
+Fch=848.10 (Fvco=3392.40, Nint=065, Nfrac=031)
+Fch=848.20 (Fvco=3392.80, Nint=065, Nfrac=032)
+Fch=848.30 (Fvco=3393.20, Nint=065, Nfrac=033)
+Fch=848.40 (Fvco=3393.60, Nint=065, Nfrac=034)
+Fch=848.50 (Fvco=3394.00, Nint=065, Nfrac=035)
+Fch=848.60 (Fvco=3394.40, Nint=065, Nfrac=036)
+Fch=848.70 (Fvco=3394.80, Nint=065, Nfrac=037)
+Fch=848.80 (Fvco=3395.20, Nint=065, Nfrac=038)
+Fch=848.90 (Fvco=3395.60, Nint=065, Nfrac=039)
+Fch=849.00 (Fvco=3396.00, Nint=065, Nfrac=040)
+Fch=849.10 (Fvco=3396.40, Nint=065, Nfrac=041)
+Fch=849.20 (Fvco=3396.80, Nint=065, Nfrac=042)
+Fch=849.30 (Fvco=3397.20, Nint=065, Nfrac=043)
+Fch=849.40 (Fvco=3397.60, Nint=065, Nfrac=044)
+Fch=849.50 (Fvco=3398.00, Nint=065, Nfrac=045)
+Fch=849.60 (Fvco=3398.40, Nint=065, Nfrac=046)
+Fch=849.70 (Fvco=3398.80, Nint=065, Nfrac=047)
+Fch=849.80 (Fvco=3399.20, Nint=065, Nfrac=048)
+Fch=849.90 (Fvco=3399.60, Nint=065, Nfrac=049)
+Fch=850.00 (Fvco=3400.00, Nint=065, Nfrac=050)
+Fch=850.10 (Fvco=3400.40, Nint=065, Nfrac=051)
+Fch=850.20 (Fvco=3400.80, Nint=065, Nfrac=052)
+Fch=850.30 (Fvco=3401.20, Nint=065, Nfrac=053)
+Fch=850.40 (Fvco=3401.60, Nint=065, Nfrac=054)
+Fch=850.50 (Fvco=3402.00, Nint=065, Nfrac=055)
+Fch=850.60 (Fvco=3402.40, Nint=065, Nfrac=056)
+Fch=850.70 (Fvco=3402.80, Nint=065, Nfrac=057)
+Fch=850.80 (Fvco=3403.20, Nint=065, Nfrac=058)
+Fch=850.90 (Fvco=3403.60, Nint=065, Nfrac=059)
+Fch=851.00 (Fvco=3404.00, Nint=065, Nfrac=060)
+Fch=851.10 (Fvco=3404.40, Nint=065, Nfrac=061)
+Fch=851.20 (Fvco=3404.80, Nint=065, Nfrac=062)
+Fch=851.30 (Fvco=3405.20, Nint=065, Nfrac=063)
+Fch=851.40 (Fvco=3405.60, Nint=065, Nfrac=064)
+Fch=851.50 (Fvco=3406.00, Nint=065, Nfrac=065)
+Fch=851.60 (Fvco=3406.40, Nint=065, Nfrac=066)
+Fch=851.70 (Fvco=3406.80, Nint=065, Nfrac=067)
+Fch=851.80 (Fvco=3407.20, Nint=065, Nfrac=068)
+Fch=851.90 (Fvco=3407.60, Nint=065, Nfrac=069)
+Fch=852.00 (Fvco=3408.00, Nint=065, Nfrac=070)
+Fch=852.10 (Fvco=3408.40, Nint=065, Nfrac=071)
+Fch=852.20 (Fvco=3408.80, Nint=065, Nfrac=072)
+Fch=852.30 (Fvco=3409.20, Nint=065, Nfrac=073)
+Fch=852.40 (Fvco=3409.60, Nint=065, Nfrac=074)
+Fch=852.50 (Fvco=3410.00, Nint=065, Nfrac=075)
+Fch=852.60 (Fvco=3410.40, Nint=065, Nfrac=076)
+Fch=852.70 (Fvco=3410.80, Nint=065, Nfrac=077)
+Fch=852.80 (Fvco=3411.20, Nint=065, Nfrac=078)
+Fch=852.90 (Fvco=3411.60, Nint=065, Nfrac=079)
+Fch=853.00 (Fvco=3412.00, Nint=065, Nfrac=080)
+Fch=853.10 (Fvco=3412.40, Nint=065, Nfrac=081)
+Fch=853.20 (Fvco=3412.80, Nint=065, Nfrac=082)
+Fch=853.30 (Fvco=3413.20, Nint=065, Nfrac=083)
+Fch=853.40 (Fvco=3413.60, Nint=065, Nfrac=084)
+Fch=853.50 (Fvco=3414.00, Nint=065, Nfrac=085)
+Fch=853.60 (Fvco=3414.40, Nint=065, Nfrac=086)
+Fch=853.70 (Fvco=3414.80, Nint=065, Nfrac=087)
+Fch=853.80 (Fvco=3415.20, Nint=065, Nfrac=088)
+Fch=853.90 (Fvco=3415.60, Nint=065, Nfrac=089)
+Fch=854.00 (Fvco=3416.00, Nint=065, Nfrac=090)
+Fch=854.10 (Fvco=3416.40, Nint=065, Nfrac=091)
+Fch=854.20 (Fvco=3416.80, Nint=065, Nfrac=092)
+Fch=854.30 (Fvco=3417.20, Nint=065, Nfrac=093)
+Fch=854.40 (Fvco=3417.60, Nint=065, Nfrac=094)
+Fch=854.50 (Fvco=3418.00, Nint=065, Nfrac=095)
+Fch=854.60 (Fvco=3418.40, Nint=065, Nfrac=096)
+Fch=854.70 (Fvco=3418.80, Nint=065, Nfrac=097)
+Fch=854.80 (Fvco=3419.20, Nint=065, Nfrac=098)
+Fch=854.90 (Fvco=3419.60, Nint=065, Nfrac=099)
+Fch=855.00 (Fvco=3420.00, Nint=065, Nfrac=100)
+Fch=855.10 (Fvco=3420.40, Nint=065, Nfrac=101)
+Fch=855.20 (Fvco=3420.80, Nint=065, Nfrac=102)
+Fch=855.30 (Fvco=3421.20, Nint=065, Nfrac=103)
+Fch=855.40 (Fvco=3421.60, Nint=065, Nfrac=104)
+Fch=855.50 (Fvco=3422.00, Nint=065, Nfrac=105)
+Fch=855.60 (Fvco=3422.40, Nint=065, Nfrac=106)
+Fch=855.70 (Fvco=3422.80, Nint=065, Nfrac=107)
+Fch=855.80 (Fvco=3423.20, Nint=065, Nfrac=108)
+Fch=855.90 (Fvco=3423.60, Nint=065, Nfrac=109)
+Fch=856.00 (Fvco=3424.00, Nint=065, Nfrac=110)
+Fch=856.10 (Fvco=3424.40, Nint=065, Nfrac=111)
+Fch=856.20 (Fvco=3424.80, Nint=065, Nfrac=112)
+Fch=856.30 (Fvco=3425.20, Nint=065, Nfrac=113)
+Fch=856.40 (Fvco=3425.60, Nint=065, Nfrac=114)
+Fch=856.50 (Fvco=3426.00, Nint=065, Nfrac=115)
+Fch=856.60 (Fvco=3426.40, Nint=065, Nfrac=116)
+Fch=856.70 (Fvco=3426.80, Nint=065, Nfrac=117)
+Fch=856.80 (Fvco=3427.20, Nint=065, Nfrac=118)
+Fch=856.90 (Fvco=3427.60, Nint=065, Nfrac=119)
+Fch=857.00 (Fvco=3428.00, Nint=065, Nfrac=120)
+Fch=857.10 (Fvco=3428.40, Nint=065, Nfrac=121)
+Fch=857.20 (Fvco=3428.80, Nint=065, Nfrac=122)
+Fch=857.30 (Fvco=3429.20, Nint=065, Nfrac=123)
+Fch=857.40 (Fvco=3429.60, Nint=065, Nfrac=124)
+Fch=857.50 (Fvco=3430.00, Nint=065, Nfrac=125)
+Fch=857.60 (Fvco=3430.40, Nint=065, Nfrac=126)
+Fch=857.70 (Fvco=3430.80, Nint=065, Nfrac=127)
+Fch=857.80 (Fvco=3431.20, Nint=065, Nfrac=128)
+Fch=857.90 (Fvco=3431.60, Nint=065, Nfrac=129)
+Fch=858.00 (Fvco=3432.00, Nint=065, Nfrac=130)
+Fch=858.00 (Fvco=3432.00, Nint=066, Nfrac=000)
+Fch=858.10 (Fvco=3432.40, Nint=066, Nfrac=001)
+Fch=858.20 (Fvco=3432.80, Nint=066, Nfrac=002)
+Fch=858.30 (Fvco=3433.20, Nint=066, Nfrac=003)
+Fch=858.40 (Fvco=3433.60, Nint=066, Nfrac=004)
+Fch=858.50 (Fvco=3434.00, Nint=066, Nfrac=005)
+Fch=858.60 (Fvco=3434.40, Nint=066, Nfrac=006)
+Fch=858.70 (Fvco=3434.80, Nint=066, Nfrac=007)
+Fch=858.80 (Fvco=3435.20, Nint=066, Nfrac=008)
+Fch=858.90 (Fvco=3435.60, Nint=066, Nfrac=009)
+Fch=859.00 (Fvco=3436.00, Nint=066, Nfrac=010)
+Fch=859.10 (Fvco=3436.40, Nint=066, Nfrac=011)
+Fch=859.20 (Fvco=3436.80, Nint=066, Nfrac=012)
+Fch=859.30 (Fvco=3437.20, Nint=066, Nfrac=013)
+Fch=859.40 (Fvco=3437.60, Nint=066, Nfrac=014)
+Fch=859.50 (Fvco=3438.00, Nint=066, Nfrac=015)
+Fch=859.60 (Fvco=3438.40, Nint=066, Nfrac=016)
+Fch=859.70 (Fvco=3438.80, Nint=066, Nfrac=017)
+Fch=859.80 (Fvco=3439.20, Nint=066, Nfrac=018)
+Fch=859.90 (Fvco=3439.60, Nint=066, Nfrac=019)
+Fch=860.00 (Fvco=3440.00, Nint=066, Nfrac=020)
+Fch=860.10 (Fvco=3440.40, Nint=066, Nfrac=021)
+Fch=860.20 (Fvco=3440.80, Nint=066, Nfrac=022)
+Fch=860.30 (Fvco=3441.20, Nint=066, Nfrac=023)
+Fch=860.40 (Fvco=3441.60, Nint=066, Nfrac=024)
+Fch=860.50 (Fvco=3442.00, Nint=066, Nfrac=025)
+Fch=860.60 (Fvco=3442.40, Nint=066, Nfrac=026)
+Fch=860.70 (Fvco=3442.80, Nint=066, Nfrac=027)
+Fch=860.80 (Fvco=3443.20, Nint=066, Nfrac=028)
+Fch=860.90 (Fvco=3443.60, Nint=066, Nfrac=029)
+Fch=861.00 (Fvco=3444.00, Nint=066, Nfrac=030)
+Fch=861.10 (Fvco=3444.40, Nint=066, Nfrac=031)
+Fch=861.20 (Fvco=3444.80, Nint=066, Nfrac=032)
+Fch=861.30 (Fvco=3445.20, Nint=066, Nfrac=033)
+Fch=861.40 (Fvco=3445.60, Nint=066, Nfrac=034)
+Fch=861.50 (Fvco=3446.00, Nint=066, Nfrac=035)
+Fch=861.60 (Fvco=3446.40, Nint=066, Nfrac=036)
+Fch=861.70 (Fvco=3446.80, Nint=066, Nfrac=037)
+Fch=861.80 (Fvco=3447.20, Nint=066, Nfrac=038)
+Fch=861.90 (Fvco=3447.60, Nint=066, Nfrac=039)
+Fch=862.00 (Fvco=3448.00, Nint=066, Nfrac=040)
+Fch=862.10 (Fvco=3448.40, Nint=066, Nfrac=041)
+Fch=862.20 (Fvco=3448.80, Nint=066, Nfrac=042)
+Fch=862.30 (Fvco=3449.20, Nint=066, Nfrac=043)
+Fch=862.40 (Fvco=3449.60, Nint=066, Nfrac=044)
+Fch=862.50 (Fvco=3450.00, Nint=066, Nfrac=045)
+Fch=862.60 (Fvco=3450.40, Nint=066, Nfrac=046)
+Fch=862.70 (Fvco=3450.80, Nint=066, Nfrac=047)
+Fch=862.80 (Fvco=3451.20, Nint=066, Nfrac=048)
+Fch=862.90 (Fvco=3451.60, Nint=066, Nfrac=049)
+Fch=863.00 (Fvco=3452.00, Nint=066, Nfrac=050)
+Fch=863.10 (Fvco=3452.40, Nint=066, Nfrac=051)
+Fch=863.20 (Fvco=3452.80, Nint=066, Nfrac=052)
+Fch=863.30 (Fvco=3453.20, Nint=066, Nfrac=053)
+Fch=863.40 (Fvco=3453.60, Nint=066, Nfrac=054)
+Fch=863.50 (Fvco=3454.00, Nint=066, Nfrac=055)
+Fch=863.60 (Fvco=3454.40, Nint=066, Nfrac=056)
+Fch=863.70 (Fvco=3454.80, Nint=066, Nfrac=057)
+Fch=863.80 (Fvco=3455.20, Nint=066, Nfrac=058)
+Fch=863.90 (Fvco=3455.60, Nint=066, Nfrac=059)
+Fch=864.00 (Fvco=3456.00, Nint=066, Nfrac=060)
+Fch=864.10 (Fvco=3456.40, Nint=066, Nfrac=061)
+Fch=864.20 (Fvco=3456.80, Nint=066, Nfrac=062)
+Fch=864.30 (Fvco=3457.20, Nint=066, Nfrac=063)
+Fch=864.40 (Fvco=3457.60, Nint=066, Nfrac=064)
+Fch=864.50 (Fvco=3458.00, Nint=066, Nfrac=065)
+Fch=864.60 (Fvco=3458.40, Nint=066, Nfrac=066)
+Fch=864.70 (Fvco=3458.80, Nint=066, Nfrac=067)
+Fch=864.80 (Fvco=3459.20, Nint=066, Nfrac=068)
+Fch=864.90 (Fvco=3459.60, Nint=066, Nfrac=069)
+Fch=865.00 (Fvco=3460.00, Nint=066, Nfrac=070)
+Fch=865.10 (Fvco=3460.40, Nint=066, Nfrac=071)
+Fch=865.20 (Fvco=3460.80, Nint=066, Nfrac=072)
+Fch=865.30 (Fvco=3461.20, Nint=066, Nfrac=073)
+Fch=865.40 (Fvco=3461.60, Nint=066, Nfrac=074)
+Fch=865.50 (Fvco=3462.00, Nint=066, Nfrac=075)
+Fch=865.60 (Fvco=3462.40, Nint=066, Nfrac=076)
+Fch=865.70 (Fvco=3462.80, Nint=066, Nfrac=077)
+Fch=865.80 (Fvco=3463.20, Nint=066, Nfrac=078)
+Fch=865.90 (Fvco=3463.60, Nint=066, Nfrac=079)
+Fch=866.00 (Fvco=3464.00, Nint=066, Nfrac=080)
+Fch=866.10 (Fvco=3464.40, Nint=066, Nfrac=081)
+Fch=866.20 (Fvco=3464.80, Nint=066, Nfrac=082)
+Fch=866.30 (Fvco=3465.20, Nint=066, Nfrac=083)
+Fch=866.40 (Fvco=3465.60, Nint=066, Nfrac=084)
+Fch=866.50 (Fvco=3466.00, Nint=066, Nfrac=085)
+Fch=866.60 (Fvco=3466.40, Nint=066, Nfrac=086)
+Fch=866.70 (Fvco=3466.80, Nint=066, Nfrac=087)
+Fch=866.80 (Fvco=3467.20, Nint=066, Nfrac=088)
+Fch=866.90 (Fvco=3467.60, Nint=066, Nfrac=089)
+Fch=867.00 (Fvco=3468.00, Nint=066, Nfrac=090)
+Fch=867.10 (Fvco=3468.40, Nint=066, Nfrac=091)
+Fch=867.20 (Fvco=3468.80, Nint=066, Nfrac=092)
+Fch=867.30 (Fvco=3469.20, Nint=066, Nfrac=093)
+Fch=867.40 (Fvco=3469.60, Nint=066, Nfrac=094)
+Fch=867.50 (Fvco=3470.00, Nint=066, Nfrac=095)
+Fch=867.60 (Fvco=3470.40, Nint=066, Nfrac=096)
+Fch=867.70 (Fvco=3470.80, Nint=066, Nfrac=097)
+Fch=867.80 (Fvco=3471.20, Nint=066, Nfrac=098)
+Fch=867.90 (Fvco=3471.60, Nint=066, Nfrac=099)
+Fch=868.00 (Fvco=3472.00, Nint=066, Nfrac=100)
+Fch=868.10 (Fvco=3472.40, Nint=066, Nfrac=101)
+Fch=868.20 (Fvco=3472.80, Nint=066, Nfrac=102)
+Fch=868.30 (Fvco=3473.20, Nint=066, Nfrac=103)
+Fch=868.40 (Fvco=3473.60, Nint=066, Nfrac=104)
+Fch=868.50 (Fvco=3474.00, Nint=066, Nfrac=105)
+Fch=868.60 (Fvco=3474.40, Nint=066, Nfrac=106)
+Fch=868.70 (Fvco=3474.80, Nint=066, Nfrac=107)
+Fch=868.80 (Fvco=3475.20, Nint=066, Nfrac=108)
+Fch=868.90 (Fvco=3475.60, Nint=066, Nfrac=109)
+Fch=869.00 (Fvco=3476.00, Nint=066, Nfrac=110)
+Fch=869.10 (Fvco=3476.40, Nint=066, Nfrac=111)
+Fch=869.20 (Fvco=3476.80, Nint=066, Nfrac=112)
+Fch=869.30 (Fvco=3477.20, Nint=066, Nfrac=113)
+Fch=869.40 (Fvco=3477.60, Nint=066, Nfrac=114)
+Fch=869.50 (Fvco=3478.00, Nint=066, Nfrac=115)
+Fch=869.60 (Fvco=3478.40, Nint=066, Nfrac=116)
+Fch=869.70 (Fvco=3478.80, Nint=066, Nfrac=117)
+Fch=869.80 (Fvco=3479.20, Nint=066, Nfrac=118)
+Fch=869.90 (Fvco=3479.60, Nint=066, Nfrac=119)
+Fch=870.00 (Fvco=3480.00, Nint=066, Nfrac=120)
+Fch=870.10 (Fvco=3480.40, Nint=066, Nfrac=121)
+Fch=870.20 (Fvco=3480.80, Nint=066, Nfrac=122)
+Fch=870.30 (Fvco=3481.20, Nint=066, Nfrac=123)
+Fch=870.40 (Fvco=3481.60, Nint=066, Nfrac=124)
+Fch=870.50 (Fvco=3482.00, Nint=066, Nfrac=125)
+Fch=870.60 (Fvco=3482.40, Nint=066, Nfrac=126)
+Fch=870.70 (Fvco=3482.80, Nint=066, Nfrac=127)
+Fch=870.80 (Fvco=3483.20, Nint=066, Nfrac=128)
+Fch=870.90 (Fvco=3483.60, Nint=066, Nfrac=129)
+Fch=871.00 (Fvco=3484.00, Nint=066, Nfrac=130)
+Fch=871.00 (Fvco=3484.00, Nint=067, Nfrac=000)
+Fch=871.10 (Fvco=3484.40, Nint=067, Nfrac=001)
+Fch=871.20 (Fvco=3484.80, Nint=067, Nfrac=002)
+Fch=871.30 (Fvco=3485.20, Nint=067, Nfrac=003)
+Fch=871.40 (Fvco=3485.60, Nint=067, Nfrac=004)
+Fch=871.50 (Fvco=3486.00, Nint=067, Nfrac=005)
+Fch=871.60 (Fvco=3486.40, Nint=067, Nfrac=006)
+Fch=871.70 (Fvco=3486.80, Nint=067, Nfrac=007)
+Fch=871.80 (Fvco=3487.20, Nint=067, Nfrac=008)
+Fch=871.90 (Fvco=3487.60, Nint=067, Nfrac=009)
+Fch=872.00 (Fvco=3488.00, Nint=067, Nfrac=010)
+Fch=872.10 (Fvco=3488.40, Nint=067, Nfrac=011)
+Fch=872.20 (Fvco=3488.80, Nint=067, Nfrac=012)
+Fch=872.30 (Fvco=3489.20, Nint=067, Nfrac=013)
+Fch=872.40 (Fvco=3489.60, Nint=067, Nfrac=014)
+Fch=872.50 (Fvco=3490.00, Nint=067, Nfrac=015)
+Fch=872.60 (Fvco=3490.40, Nint=067, Nfrac=016)
+Fch=872.70 (Fvco=3490.80, Nint=067, Nfrac=017)
+Fch=872.80 (Fvco=3491.20, Nint=067, Nfrac=018)
+Fch=872.90 (Fvco=3491.60, Nint=067, Nfrac=019)
+Fch=873.00 (Fvco=3492.00, Nint=067, Nfrac=020)
+Fch=873.10 (Fvco=3492.40, Nint=067, Nfrac=021)
+Fch=873.20 (Fvco=3492.80, Nint=067, Nfrac=022)
+Fch=873.30 (Fvco=3493.20, Nint=067, Nfrac=023)
+Fch=873.40 (Fvco=3493.60, Nint=067, Nfrac=024)
+Fch=873.50 (Fvco=3494.00, Nint=067, Nfrac=025)
+Fch=873.60 (Fvco=3494.40, Nint=067, Nfrac=026)
+Fch=873.70 (Fvco=3494.80, Nint=067, Nfrac=027)
+Fch=873.80 (Fvco=3495.20, Nint=067, Nfrac=028)
+Fch=873.90 (Fvco=3495.60, Nint=067, Nfrac=029)
+Fch=874.00 (Fvco=3496.00, Nint=067, Nfrac=030)
+Fch=874.10 (Fvco=3496.40, Nint=067, Nfrac=031)
+Fch=874.20 (Fvco=3496.80, Nint=067, Nfrac=032)
+Fch=874.30 (Fvco=3497.20, Nint=067, Nfrac=033)
+Fch=874.40 (Fvco=3497.60, Nint=067, Nfrac=034)
+Fch=874.50 (Fvco=3498.00, Nint=067, Nfrac=035)
+Fch=874.60 (Fvco=3498.40, Nint=067, Nfrac=036)
+Fch=874.70 (Fvco=3498.80, Nint=067, Nfrac=037)
+Fch=874.80 (Fvco=3499.20, Nint=067, Nfrac=038)
+Fch=874.90 (Fvco=3499.60, Nint=067, Nfrac=039)
+Fch=875.00 (Fvco=3500.00, Nint=067, Nfrac=040)
+Fch=875.10 (Fvco=3500.40, Nint=067, Nfrac=041)
+Fch=875.20 (Fvco=3500.80, Nint=067, Nfrac=042)
+Fch=875.30 (Fvco=3501.20, Nint=067, Nfrac=043)
+Fch=875.40 (Fvco=3501.60, Nint=067, Nfrac=044)
+Fch=875.50 (Fvco=3502.00, Nint=067, Nfrac=045)
+Fch=875.60 (Fvco=3502.40, Nint=067, Nfrac=046)
+Fch=875.70 (Fvco=3502.80, Nint=067, Nfrac=047)
+Fch=875.80 (Fvco=3503.20, Nint=067, Nfrac=048)
+Fch=875.90 (Fvco=3503.60, Nint=067, Nfrac=049)
+Fch=876.00 (Fvco=3504.00, Nint=067, Nfrac=050)
+Fch=876.10 (Fvco=3504.40, Nint=067, Nfrac=051)
+Fch=876.20 (Fvco=3504.80, Nint=067, Nfrac=052)
+Fch=876.30 (Fvco=3505.20, Nint=067, Nfrac=053)
+Fch=876.40 (Fvco=3505.60, Nint=067, Nfrac=054)
+Fch=876.50 (Fvco=3506.00, Nint=067, Nfrac=055)
+Fch=876.60 (Fvco=3506.40, Nint=067, Nfrac=056)
+Fch=876.70 (Fvco=3506.80, Nint=067, Nfrac=057)
+Fch=876.80 (Fvco=3507.20, Nint=067, Nfrac=058)
+Fch=876.90 (Fvco=3507.60, Nint=067, Nfrac=059)
+Fch=877.00 (Fvco=3508.00, Nint=067, Nfrac=060)
+Fch=877.10 (Fvco=3508.40, Nint=067, Nfrac=061)
+Fch=877.20 (Fvco=3508.80, Nint=067, Nfrac=062)
+Fch=877.30 (Fvco=3509.20, Nint=067, Nfrac=063)
+Fch=877.40 (Fvco=3509.60, Nint=067, Nfrac=064)
+Fch=877.50 (Fvco=3510.00, Nint=067, Nfrac=065)
+Fch=877.60 (Fvco=3510.40, Nint=067, Nfrac=066)
+Fch=877.70 (Fvco=3510.80, Nint=067, Nfrac=067)
+Fch=877.80 (Fvco=3511.20, Nint=067, Nfrac=068)
+Fch=877.90 (Fvco=3511.60, Nint=067, Nfrac=069)
+Fch=878.00 (Fvco=3512.00, Nint=067, Nfrac=070)
+Fch=878.10 (Fvco=3512.40, Nint=067, Nfrac=071)
+Fch=878.20 (Fvco=3512.80, Nint=067, Nfrac=072)
+Fch=878.30 (Fvco=3513.20, Nint=067, Nfrac=073)
+Fch=878.40 (Fvco=3513.60, Nint=067, Nfrac=074)
+Fch=878.50 (Fvco=3514.00, Nint=067, Nfrac=075)
+Fch=878.60 (Fvco=3514.40, Nint=067, Nfrac=076)
+Fch=878.70 (Fvco=3514.80, Nint=067, Nfrac=077)
+Fch=878.80 (Fvco=3515.20, Nint=067, Nfrac=078)
+Fch=878.90 (Fvco=3515.60, Nint=067, Nfrac=079)
+Fch=879.00 (Fvco=3516.00, Nint=067, Nfrac=080)
+Fch=879.10 (Fvco=3516.40, Nint=067, Nfrac=081)
+Fch=879.20 (Fvco=3516.80, Nint=067, Nfrac=082)
+Fch=879.30 (Fvco=3517.20, Nint=067, Nfrac=083)
+Fch=879.40 (Fvco=3517.60, Nint=067, Nfrac=084)
+Fch=879.50 (Fvco=3518.00, Nint=067, Nfrac=085)
+Fch=879.60 (Fvco=3518.40, Nint=067, Nfrac=086)
+Fch=879.70 (Fvco=3518.80, Nint=067, Nfrac=087)
+Fch=879.80 (Fvco=3519.20, Nint=067, Nfrac=088)
+Fch=879.90 (Fvco=3519.60, Nint=067, Nfrac=089)
+Fch=880.00 (Fvco=3520.00, Nint=067, Nfrac=090)
+Fch=880.10 (Fvco=3520.40, Nint=067, Nfrac=091)
+Fch=880.20 (Fvco=3520.80, Nint=067, Nfrac=092)
+Fch=880.30 (Fvco=3521.20, Nint=067, Nfrac=093)
+Fch=880.40 (Fvco=3521.60, Nint=067, Nfrac=094)
+Fch=880.50 (Fvco=3522.00, Nint=067, Nfrac=095)
+Fch=880.60 (Fvco=3522.40, Nint=067, Nfrac=096)
+Fch=880.70 (Fvco=3522.80, Nint=067, Nfrac=097)
+Fch=880.80 (Fvco=3523.20, Nint=067, Nfrac=098)
+Fch=880.90 (Fvco=3523.60, Nint=067, Nfrac=099)
+Fch=881.00 (Fvco=3524.00, Nint=067, Nfrac=100)
+Fch=881.10 (Fvco=3524.40, Nint=067, Nfrac=101)
+Fch=881.20 (Fvco=3524.80, Nint=067, Nfrac=102)
+Fch=881.30 (Fvco=3525.20, Nint=067, Nfrac=103)
+Fch=881.40 (Fvco=3525.60, Nint=067, Nfrac=104)
+Fch=881.50 (Fvco=3526.00, Nint=067, Nfrac=105)
+Fch=881.60 (Fvco=3526.40, Nint=067, Nfrac=106)
+Fch=881.70 (Fvco=3526.80, Nint=067, Nfrac=107)
+Fch=881.80 (Fvco=3527.20, Nint=067, Nfrac=108)
+Fch=881.90 (Fvco=3527.60, Nint=067, Nfrac=109)
+Fch=882.00 (Fvco=3528.00, Nint=067, Nfrac=110)
+Fch=882.10 (Fvco=3528.40, Nint=067, Nfrac=111)
+Fch=882.20 (Fvco=3528.80, Nint=067, Nfrac=112)
+Fch=882.30 (Fvco=3529.20, Nint=067, Nfrac=113)
+Fch=882.40 (Fvco=3529.60, Nint=067, Nfrac=114)
+Fch=882.50 (Fvco=3530.00, Nint=067, Nfrac=115)
+Fch=882.60 (Fvco=3530.40, Nint=067, Nfrac=116)
+Fch=882.70 (Fvco=3530.80, Nint=067, Nfrac=117)
+Fch=882.80 (Fvco=3531.20, Nint=067, Nfrac=118)
+Fch=882.90 (Fvco=3531.60, Nint=067, Nfrac=119)
+Fch=883.00 (Fvco=3532.00, Nint=067, Nfrac=120)
+Fch=883.10 (Fvco=3532.40, Nint=067, Nfrac=121)
+Fch=883.20 (Fvco=3532.80, Nint=067, Nfrac=122)
+Fch=883.30 (Fvco=3533.20, Nint=067, Nfrac=123)
+Fch=883.40 (Fvco=3533.60, Nint=067, Nfrac=124)
+Fch=883.50 (Fvco=3534.00, Nint=067, Nfrac=125)
+Fch=883.60 (Fvco=3534.40, Nint=067, Nfrac=126)
+Fch=883.70 (Fvco=3534.80, Nint=067, Nfrac=127)
+Fch=883.80 (Fvco=3535.20, Nint=067, Nfrac=128)
+Fch=883.90 (Fvco=3535.60, Nint=067, Nfrac=129)
+Fch=884.00 (Fvco=3536.00, Nint=067, Nfrac=130)
+Fch=884.00 (Fvco=3536.00, Nint=068, Nfrac=000)
+Fch=884.10 (Fvco=3536.40, Nint=068, Nfrac=001)
+Fch=884.20 (Fvco=3536.80, Nint=068, Nfrac=002)
+Fch=884.30 (Fvco=3537.20, Nint=068, Nfrac=003)
+Fch=884.40 (Fvco=3537.60, Nint=068, Nfrac=004)
+Fch=884.50 (Fvco=3538.00, Nint=068, Nfrac=005)
+Fch=884.60 (Fvco=3538.40, Nint=068, Nfrac=006)
+Fch=884.70 (Fvco=3538.80, Nint=068, Nfrac=007)
+Fch=884.80 (Fvco=3539.20, Nint=068, Nfrac=008)
+Fch=884.90 (Fvco=3539.60, Nint=068, Nfrac=009)
+Fch=885.00 (Fvco=3540.00, Nint=068, Nfrac=010)
+Fch=885.10 (Fvco=3540.40, Nint=068, Nfrac=011)
+Fch=885.20 (Fvco=3540.80, Nint=068, Nfrac=012)
+Fch=885.30 (Fvco=3541.20, Nint=068, Nfrac=013)
+Fch=885.40 (Fvco=3541.60, Nint=068, Nfrac=014)
+Fch=885.50 (Fvco=3542.00, Nint=068, Nfrac=015)
+Fch=885.60 (Fvco=3542.40, Nint=068, Nfrac=016)
+Fch=885.70 (Fvco=3542.80, Nint=068, Nfrac=017)
+Fch=885.80 (Fvco=3543.20, Nint=068, Nfrac=018)
+Fch=885.90 (Fvco=3543.60, Nint=068, Nfrac=019)
+Fch=886.00 (Fvco=3544.00, Nint=068, Nfrac=020)
+Fch=886.10 (Fvco=3544.40, Nint=068, Nfrac=021)
+Fch=886.20 (Fvco=3544.80, Nint=068, Nfrac=022)
+Fch=886.30 (Fvco=3545.20, Nint=068, Nfrac=023)
+Fch=886.40 (Fvco=3545.60, Nint=068, Nfrac=024)
+Fch=886.50 (Fvco=3546.00, Nint=068, Nfrac=025)
+Fch=886.60 (Fvco=3546.40, Nint=068, Nfrac=026)
+Fch=886.70 (Fvco=3546.80, Nint=068, Nfrac=027)
+Fch=886.80 (Fvco=3547.20, Nint=068, Nfrac=028)
+Fch=886.90 (Fvco=3547.60, Nint=068, Nfrac=029)
+Fch=887.00 (Fvco=3548.00, Nint=068, Nfrac=030)
+Fch=887.10 (Fvco=3548.40, Nint=068, Nfrac=031)
+Fch=887.20 (Fvco=3548.80, Nint=068, Nfrac=032)
+Fch=887.30 (Fvco=3549.20, Nint=068, Nfrac=033)
+Fch=887.40 (Fvco=3549.60, Nint=068, Nfrac=034)
+Fch=887.50 (Fvco=3550.00, Nint=068, Nfrac=035)
+Fch=887.60 (Fvco=3550.40, Nint=068, Nfrac=036)
+Fch=887.70 (Fvco=3550.80, Nint=068, Nfrac=037)
+Fch=887.80 (Fvco=3551.20, Nint=068, Nfrac=038)
+Fch=887.90 (Fvco=3551.60, Nint=068, Nfrac=039)
+Fch=888.00 (Fvco=3552.00, Nint=068, Nfrac=040)
+Fch=888.10 (Fvco=3552.40, Nint=068, Nfrac=041)
+Fch=888.20 (Fvco=3552.80, Nint=068, Nfrac=042)
+Fch=888.30 (Fvco=3553.20, Nint=068, Nfrac=043)
+Fch=888.40 (Fvco=3553.60, Nint=068, Nfrac=044)
+Fch=888.50 (Fvco=3554.00, Nint=068, Nfrac=045)
+Fch=888.60 (Fvco=3554.40, Nint=068, Nfrac=046)
+Fch=888.70 (Fvco=3554.80, Nint=068, Nfrac=047)
+Fch=888.80 (Fvco=3555.20, Nint=068, Nfrac=048)
+Fch=888.90 (Fvco=3555.60, Nint=068, Nfrac=049)
+Fch=889.00 (Fvco=3556.00, Nint=068, Nfrac=050)
+Fch=889.10 (Fvco=3556.40, Nint=068, Nfrac=051)
+Fch=889.20 (Fvco=3556.80, Nint=068, Nfrac=052)
+Fch=889.30 (Fvco=3557.20, Nint=068, Nfrac=053)
+Fch=889.40 (Fvco=3557.60, Nint=068, Nfrac=054)
+Fch=889.50 (Fvco=3558.00, Nint=068, Nfrac=055)
+Fch=889.60 (Fvco=3558.40, Nint=068, Nfrac=056)
+Fch=889.70 (Fvco=3558.80, Nint=068, Nfrac=057)
+Fch=889.80 (Fvco=3559.20, Nint=068, Nfrac=058)
+Fch=889.90 (Fvco=3559.60, Nint=068, Nfrac=059)
+Fch=890.00 (Fvco=3560.00, Nint=068, Nfrac=060)
+Fch=890.10 (Fvco=3560.40, Nint=068, Nfrac=061)
+Fch=890.20 (Fvco=3560.80, Nint=068, Nfrac=062)
+Fch=890.30 (Fvco=3561.20, Nint=068, Nfrac=063)
+Fch=890.40 (Fvco=3561.60, Nint=068, Nfrac=064)
+Fch=890.50 (Fvco=3562.00, Nint=068, Nfrac=065)
+Fch=890.60 (Fvco=3562.40, Nint=068, Nfrac=066)
+Fch=890.70 (Fvco=3562.80, Nint=068, Nfrac=067)
+Fch=890.80 (Fvco=3563.20, Nint=068, Nfrac=068)
+Fch=890.90 (Fvco=3563.60, Nint=068, Nfrac=069)
+Fch=891.00 (Fvco=3564.00, Nint=068, Nfrac=070)
+Fch=891.10 (Fvco=3564.40, Nint=068, Nfrac=071)
+Fch=891.20 (Fvco=3564.80, Nint=068, Nfrac=072)
+Fch=891.30 (Fvco=3565.20, Nint=068, Nfrac=073)
+Fch=891.40 (Fvco=3565.60, Nint=068, Nfrac=074)
+Fch=891.50 (Fvco=3566.00, Nint=068, Nfrac=075)
+Fch=891.60 (Fvco=3566.40, Nint=068, Nfrac=076)
+Fch=891.70 (Fvco=3566.80, Nint=068, Nfrac=077)
+Fch=891.80 (Fvco=3567.20, Nint=068, Nfrac=078)
+Fch=891.90 (Fvco=3567.60, Nint=068, Nfrac=079)
+Fch=892.00 (Fvco=3568.00, Nint=068, Nfrac=080)
+Fch=892.10 (Fvco=3568.40, Nint=068, Nfrac=081)
+Fch=892.20 (Fvco=3568.80, Nint=068, Nfrac=082)
+Fch=892.30 (Fvco=3569.20, Nint=068, Nfrac=083)
+Fch=892.40 (Fvco=3569.60, Nint=068, Nfrac=084)
+Fch=892.50 (Fvco=3570.00, Nint=068, Nfrac=085)
+Fch=892.60 (Fvco=3570.40, Nint=068, Nfrac=086)
+Fch=892.70 (Fvco=3570.80, Nint=068, Nfrac=087)
+Fch=892.80 (Fvco=3571.20, Nint=068, Nfrac=088)
+Fch=892.90 (Fvco=3571.60, Nint=068, Nfrac=089)
+Fch=893.00 (Fvco=3572.00, Nint=068, Nfrac=090)
+Fch=893.10 (Fvco=3572.40, Nint=068, Nfrac=091)
+Fch=893.20 (Fvco=3572.80, Nint=068, Nfrac=092)
+Fch=893.30 (Fvco=3573.20, Nint=068, Nfrac=093)
+Fch=893.40 (Fvco=3573.60, Nint=068, Nfrac=094)
+Fch=893.50 (Fvco=3574.00, Nint=068, Nfrac=095)
+Fch=893.60 (Fvco=3574.40, Nint=068, Nfrac=096)
+Fch=893.70 (Fvco=3574.80, Nint=068, Nfrac=097)
+Fch=893.80 (Fvco=3575.20, Nint=068, Nfrac=098)
+Fch=893.90 (Fvco=3575.60, Nint=068, Nfrac=099)
+Fch=894.00 (Fvco=3576.00, Nint=068, Nfrac=100)
+Fch=894.10 (Fvco=3576.40, Nint=068, Nfrac=101)
+Fch=894.20 (Fvco=3576.80, Nint=068, Nfrac=102)
+Fch=894.30 (Fvco=3577.20, Nint=068, Nfrac=103)
+Fch=894.40 (Fvco=3577.60, Nint=068, Nfrac=104)
+Fch=894.50 (Fvco=3578.00, Nint=068, Nfrac=105)
+Fch=894.60 (Fvco=3578.40, Nint=068, Nfrac=106)
+Fch=894.70 (Fvco=3578.80, Nint=068, Nfrac=107)
+Fch=894.80 (Fvco=3579.20, Nint=068, Nfrac=108)
+Fch=894.90 (Fvco=3579.60, Nint=068, Nfrac=109)
+Fch=895.00 (Fvco=3580.00, Nint=068, Nfrac=110)
+Fch=895.10 (Fvco=3580.40, Nint=068, Nfrac=111)
+Fch=895.20 (Fvco=3580.80, Nint=068, Nfrac=112)
+Fch=895.30 (Fvco=3581.20, Nint=068, Nfrac=113)
+Fch=895.40 (Fvco=3581.60, Nint=068, Nfrac=114)
+Fch=895.50 (Fvco=3582.00, Nint=068, Nfrac=115)
+Fch=895.60 (Fvco=3582.40, Nint=068, Nfrac=116)
+Fch=895.70 (Fvco=3582.80, Nint=068, Nfrac=117)
+Fch=895.80 (Fvco=3583.20, Nint=068, Nfrac=118)
+Fch=895.90 (Fvco=3583.60, Nint=068, Nfrac=119)
+Fch=896.00 (Fvco=3584.00, Nint=068, Nfrac=120)
+Fch=896.10 (Fvco=3584.40, Nint=068, Nfrac=121)
+Fch=896.20 (Fvco=3584.80, Nint=068, Nfrac=122)
+Fch=896.30 (Fvco=3585.20, Nint=068, Nfrac=123)
+Fch=896.40 (Fvco=3585.60, Nint=068, Nfrac=124)
+Fch=896.50 (Fvco=3586.00, Nint=068, Nfrac=125)
+Fch=896.60 (Fvco=3586.40, Nint=068, Nfrac=126)
+Fch=896.70 (Fvco=3586.80, Nint=068, Nfrac=127)
+Fch=896.80 (Fvco=3587.20, Nint=068, Nfrac=128)
+Fch=896.90 (Fvco=3587.60, Nint=068, Nfrac=129)
+Fch=897.00 (Fvco=3588.00, Nint=068, Nfrac=130)
+Fch=897.00 (Fvco=3588.00, Nint=069, Nfrac=000)
+Fch=897.10 (Fvco=3588.40, Nint=069, Nfrac=001)
+Fch=897.20 (Fvco=3588.80, Nint=069, Nfrac=002)
+Fch=897.30 (Fvco=3589.20, Nint=069, Nfrac=003)
+Fch=897.40 (Fvco=3589.60, Nint=069, Nfrac=004)
+Fch=897.50 (Fvco=3590.00, Nint=069, Nfrac=005)
+Fch=897.60 (Fvco=3590.40, Nint=069, Nfrac=006)
+Fch=897.70 (Fvco=3590.80, Nint=069, Nfrac=007)
+Fch=897.80 (Fvco=3591.20, Nint=069, Nfrac=008)
+Fch=897.90 (Fvco=3591.60, Nint=069, Nfrac=009)
+Fch=898.00 (Fvco=3592.00, Nint=069, Nfrac=010)
+Fch=898.10 (Fvco=3592.40, Nint=069, Nfrac=011)
+Fch=898.20 (Fvco=3592.80, Nint=069, Nfrac=012)
+Fch=898.30 (Fvco=3593.20, Nint=069, Nfrac=013)
+Fch=898.40 (Fvco=3593.60, Nint=069, Nfrac=014)
+Fch=898.50 (Fvco=3594.00, Nint=069, Nfrac=015)
+Fch=898.60 (Fvco=3594.40, Nint=069, Nfrac=016)
+Fch=898.70 (Fvco=3594.80, Nint=069, Nfrac=017)
+Fch=898.80 (Fvco=3595.20, Nint=069, Nfrac=018)
+Fch=898.90 (Fvco=3595.60, Nint=069, Nfrac=019)
+Fch=899.00 (Fvco=3596.00, Nint=069, Nfrac=020)
+Fch=899.10 (Fvco=3596.40, Nint=069, Nfrac=021)
+Fch=899.20 (Fvco=3596.80, Nint=069, Nfrac=022)
+Fch=899.30 (Fvco=3597.20, Nint=069, Nfrac=023)
+Fch=899.40 (Fvco=3597.60, Nint=069, Nfrac=024)
+Fch=899.50 (Fvco=3598.00, Nint=069, Nfrac=025)
+Fch=899.60 (Fvco=3598.40, Nint=069, Nfrac=026)
+Fch=899.70 (Fvco=3598.80, Nint=069, Nfrac=027)
+Fch=899.80 (Fvco=3599.20, Nint=069, Nfrac=028)
+Fch=899.90 (Fvco=3599.60, Nint=069, Nfrac=029)
+Fch=900.00 (Fvco=3600.00, Nint=069, Nfrac=030)
+Fch=900.10 (Fvco=3600.40, Nint=069, Nfrac=031)
+Fch=900.20 (Fvco=3600.80, Nint=069, Nfrac=032)
+Fch=900.30 (Fvco=3601.20, Nint=069, Nfrac=033)
+Fch=900.40 (Fvco=3601.60, Nint=069, Nfrac=034)
+Fch=900.50 (Fvco=3602.00, Nint=069, Nfrac=035)
+Fch=900.60 (Fvco=3602.40, Nint=069, Nfrac=036)
+Fch=900.70 (Fvco=3602.80, Nint=069, Nfrac=037)
+Fch=900.80 (Fvco=3603.20, Nint=069, Nfrac=038)
+Fch=900.90 (Fvco=3603.60, Nint=069, Nfrac=039)
+Fch=901.00 (Fvco=3604.00, Nint=069, Nfrac=040)
+Fch=901.10 (Fvco=3604.40, Nint=069, Nfrac=041)
+Fch=901.20 (Fvco=3604.80, Nint=069, Nfrac=042)
+Fch=901.30 (Fvco=3605.20, Nint=069, Nfrac=043)
+Fch=901.40 (Fvco=3605.60, Nint=069, Nfrac=044)
+Fch=901.50 (Fvco=3606.00, Nint=069, Nfrac=045)
+Fch=901.60 (Fvco=3606.40, Nint=069, Nfrac=046)
+Fch=901.70 (Fvco=3606.80, Nint=069, Nfrac=047)
+Fch=901.80 (Fvco=3607.20, Nint=069, Nfrac=048)
+Fch=901.90 (Fvco=3607.60, Nint=069, Nfrac=049)
+Fch=902.00 (Fvco=3608.00, Nint=069, Nfrac=050)
+Fch=902.10 (Fvco=3608.40, Nint=069, Nfrac=051)
+Fch=902.20 (Fvco=3608.80, Nint=069, Nfrac=052)
+Fch=902.30 (Fvco=3609.20, Nint=069, Nfrac=053)
+Fch=902.40 (Fvco=3609.60, Nint=069, Nfrac=054)
+Fch=902.50 (Fvco=3610.00, Nint=069, Nfrac=055)
+Fch=902.60 (Fvco=3610.40, Nint=069, Nfrac=056)
+Fch=902.70 (Fvco=3610.80, Nint=069, Nfrac=057)
+Fch=902.80 (Fvco=3611.20, Nint=069, Nfrac=058)
+Fch=902.90 (Fvco=3611.60, Nint=069, Nfrac=059)
+Fch=903.00 (Fvco=3612.00, Nint=069, Nfrac=060)
+Fch=903.10 (Fvco=3612.40, Nint=069, Nfrac=061)
+Fch=903.20 (Fvco=3612.80, Nint=069, Nfrac=062)
+Fch=903.30 (Fvco=3613.20, Nint=069, Nfrac=063)
+Fch=903.40 (Fvco=3613.60, Nint=069, Nfrac=064)
+Fch=903.50 (Fvco=3614.00, Nint=069, Nfrac=065)
+Fch=903.60 (Fvco=3614.40, Nint=069, Nfrac=066)
+Fch=903.70 (Fvco=3614.80, Nint=069, Nfrac=067)
+Fch=903.80 (Fvco=3615.20, Nint=069, Nfrac=068)
+Fch=903.90 (Fvco=3615.60, Nint=069, Nfrac=069)
+Fch=904.00 (Fvco=3616.00, Nint=069, Nfrac=070)
+Fch=904.10 (Fvco=3616.40, Nint=069, Nfrac=071)
+Fch=904.20 (Fvco=3616.80, Nint=069, Nfrac=072)
+Fch=904.30 (Fvco=3617.20, Nint=069, Nfrac=073)
+Fch=904.40 (Fvco=3617.60, Nint=069, Nfrac=074)
+Fch=904.50 (Fvco=3618.00, Nint=069, Nfrac=075)
+Fch=904.60 (Fvco=3618.40, Nint=069, Nfrac=076)
+Fch=904.70 (Fvco=3618.80, Nint=069, Nfrac=077)
+Fch=904.80 (Fvco=3619.20, Nint=069, Nfrac=078)
+Fch=904.90 (Fvco=3619.60, Nint=069, Nfrac=079)
+Fch=905.00 (Fvco=3620.00, Nint=069, Nfrac=080)
+Fch=905.10 (Fvco=3620.40, Nint=069, Nfrac=081)
+Fch=905.20 (Fvco=3620.80, Nint=069, Nfrac=082)
+Fch=905.30 (Fvco=3621.20, Nint=069, Nfrac=083)
+Fch=905.40 (Fvco=3621.60, Nint=069, Nfrac=084)
+Fch=905.50 (Fvco=3622.00, Nint=069, Nfrac=085)
+Fch=905.60 (Fvco=3622.40, Nint=069, Nfrac=086)
+Fch=905.70 (Fvco=3622.80, Nint=069, Nfrac=087)
+Fch=905.80 (Fvco=3623.20, Nint=069, Nfrac=088)
+Fch=905.90 (Fvco=3623.60, Nint=069, Nfrac=089)
+Fch=906.00 (Fvco=3624.00, Nint=069, Nfrac=090)
+Fch=906.10 (Fvco=3624.40, Nint=069, Nfrac=091)
+Fch=906.20 (Fvco=3624.80, Nint=069, Nfrac=092)
+Fch=906.30 (Fvco=3625.20, Nint=069, Nfrac=093)
+Fch=906.40 (Fvco=3625.60, Nint=069, Nfrac=094)
+Fch=906.50 (Fvco=3626.00, Nint=069, Nfrac=095)
+Fch=906.60 (Fvco=3626.40, Nint=069, Nfrac=096)
+Fch=906.70 (Fvco=3626.80, Nint=069, Nfrac=097)
+Fch=906.80 (Fvco=3627.20, Nint=069, Nfrac=098)
+Fch=906.90 (Fvco=3627.60, Nint=069, Nfrac=099)
+Fch=907.00 (Fvco=3628.00, Nint=069, Nfrac=100)
+Fch=907.10 (Fvco=3628.40, Nint=069, Nfrac=101)
+Fch=907.20 (Fvco=3628.80, Nint=069, Nfrac=102)
+Fch=907.30 (Fvco=3629.20, Nint=069, Nfrac=103)
+Fch=907.40 (Fvco=3629.60, Nint=069, Nfrac=104)
+Fch=907.50 (Fvco=3630.00, Nint=069, Nfrac=105)
+Fch=907.60 (Fvco=3630.40, Nint=069, Nfrac=106)
+Fch=907.70 (Fvco=3630.80, Nint=069, Nfrac=107)
+Fch=907.80 (Fvco=3631.20, Nint=069, Nfrac=108)
+Fch=907.90 (Fvco=3631.60, Nint=069, Nfrac=109)
+Fch=908.00 (Fvco=3632.00, Nint=069, Nfrac=110)
+Fch=908.10 (Fvco=3632.40, Nint=069, Nfrac=111)
+Fch=908.20 (Fvco=3632.80, Nint=069, Nfrac=112)
+Fch=908.30 (Fvco=3633.20, Nint=069, Nfrac=113)
+Fch=908.40 (Fvco=3633.60, Nint=069, Nfrac=114)
+Fch=908.50 (Fvco=3634.00, Nint=069, Nfrac=115)
+Fch=908.60 (Fvco=3634.40, Nint=069, Nfrac=116)
+Fch=908.70 (Fvco=3634.80, Nint=069, Nfrac=117)
+Fch=908.80 (Fvco=3635.20, Nint=069, Nfrac=118)
+Fch=908.90 (Fvco=3635.60, Nint=069, Nfrac=119)
+Fch=909.00 (Fvco=3636.00, Nint=069, Nfrac=120)
+Fch=909.10 (Fvco=3636.40, Nint=069, Nfrac=121)
+Fch=909.20 (Fvco=3636.80, Nint=069, Nfrac=122)
+Fch=909.30 (Fvco=3637.20, Nint=069, Nfrac=123)
+Fch=909.40 (Fvco=3637.60, Nint=069, Nfrac=124)
+Fch=909.50 (Fvco=3638.00, Nint=069, Nfrac=125)
+Fch=909.60 (Fvco=3638.40, Nint=069, Nfrac=126)
+Fch=909.70 (Fvco=3638.80, Nint=069, Nfrac=127)
+Fch=909.80 (Fvco=3639.20, Nint=069, Nfrac=128)
+Fch=909.90 (Fvco=3639.60, Nint=069, Nfrac=129)
+Fch=910.00 (Fvco=3640.00, Nint=069, Nfrac=130)
+Fch=910.00 (Fvco=3640.00, Nint=070, Nfrac=000)
+Fch=910.10 (Fvco=3640.40, Nint=070, Nfrac=001)
+Fch=910.20 (Fvco=3640.80, Nint=070, Nfrac=002)
+Fch=910.30 (Fvco=3641.20, Nint=070, Nfrac=003)
+Fch=910.40 (Fvco=3641.60, Nint=070, Nfrac=004)
+Fch=910.50 (Fvco=3642.00, Nint=070, Nfrac=005)
+Fch=910.60 (Fvco=3642.40, Nint=070, Nfrac=006)
+Fch=910.70 (Fvco=3642.80, Nint=070, Nfrac=007)
+Fch=910.80 (Fvco=3643.20, Nint=070, Nfrac=008)
+Fch=910.90 (Fvco=3643.60, Nint=070, Nfrac=009)
+Fch=911.00 (Fvco=3644.00, Nint=070, Nfrac=010)
+Fch=911.10 (Fvco=3644.40, Nint=070, Nfrac=011)
+Fch=911.20 (Fvco=3644.80, Nint=070, Nfrac=012)
+Fch=911.30 (Fvco=3645.20, Nint=070, Nfrac=013)
+Fch=911.40 (Fvco=3645.60, Nint=070, Nfrac=014)
+Fch=911.50 (Fvco=3646.00, Nint=070, Nfrac=015)
+Fch=911.60 (Fvco=3646.40, Nint=070, Nfrac=016)
+Fch=911.70 (Fvco=3646.80, Nint=070, Nfrac=017)
+Fch=911.80 (Fvco=3647.20, Nint=070, Nfrac=018)
+Fch=911.90 (Fvco=3647.60, Nint=070, Nfrac=019)
+Fch=912.00 (Fvco=3648.00, Nint=070, Nfrac=020)
+Fch=912.10 (Fvco=3648.40, Nint=070, Nfrac=021)
+Fch=912.20 (Fvco=3648.80, Nint=070, Nfrac=022)
+Fch=912.30 (Fvco=3649.20, Nint=070, Nfrac=023)
+Fch=912.40 (Fvco=3649.60, Nint=070, Nfrac=024)
+Fch=912.50 (Fvco=3650.00, Nint=070, Nfrac=025)
+Fch=912.60 (Fvco=3650.40, Nint=070, Nfrac=026)
+Fch=912.70 (Fvco=3650.80, Nint=070, Nfrac=027)
+Fch=912.80 (Fvco=3651.20, Nint=070, Nfrac=028)
+Fch=912.90 (Fvco=3651.60, Nint=070, Nfrac=029)
+Fch=913.00 (Fvco=3652.00, Nint=070, Nfrac=030)
+Fch=913.10 (Fvco=3652.40, Nint=070, Nfrac=031)
+Fch=913.20 (Fvco=3652.80, Nint=070, Nfrac=032)
+Fch=913.30 (Fvco=3653.20, Nint=070, Nfrac=033)
+Fch=913.40 (Fvco=3653.60, Nint=070, Nfrac=034)
+Fch=913.50 (Fvco=3654.00, Nint=070, Nfrac=035)
+Fch=913.60 (Fvco=3654.40, Nint=070, Nfrac=036)
+Fch=913.70 (Fvco=3654.80, Nint=070, Nfrac=037)
+Fch=913.80 (Fvco=3655.20, Nint=070, Nfrac=038)
+Fch=913.90 (Fvco=3655.60, Nint=070, Nfrac=039)
+Fch=914.00 (Fvco=3656.00, Nint=070, Nfrac=040)
+Fch=914.10 (Fvco=3656.40, Nint=070, Nfrac=041)
+Fch=914.20 (Fvco=3656.80, Nint=070, Nfrac=042)
+Fch=914.30 (Fvco=3657.20, Nint=070, Nfrac=043)
+Fch=914.40 (Fvco=3657.60, Nint=070, Nfrac=044)
+Fch=914.50 (Fvco=3658.00, Nint=070, Nfrac=045)
+Fch=914.60 (Fvco=3658.40, Nint=070, Nfrac=046)
+Fch=914.70 (Fvco=3658.80, Nint=070, Nfrac=047)
+Fch=914.80 (Fvco=3659.20, Nint=070, Nfrac=048)
+Fch=914.90 (Fvco=3659.60, Nint=070, Nfrac=049)
+Fch=915.00 (Fvco=3660.00, Nint=070, Nfrac=050)
+Fch=915.10 (Fvco=3660.40, Nint=070, Nfrac=051)
+Fch=915.20 (Fvco=3660.80, Nint=070, Nfrac=052)
+Fch=915.30 (Fvco=3661.20, Nint=070, Nfrac=053)
+Fch=915.40 (Fvco=3661.60, Nint=070, Nfrac=054)
+Fch=915.50 (Fvco=3662.00, Nint=070, Nfrac=055)
+Fch=915.60 (Fvco=3662.40, Nint=070, Nfrac=056)
+Fch=915.70 (Fvco=3662.80, Nint=070, Nfrac=057)
+Fch=915.80 (Fvco=3663.20, Nint=070, Nfrac=058)
+Fch=915.90 (Fvco=3663.60, Nint=070, Nfrac=059)
+Fch=916.00 (Fvco=3664.00, Nint=070, Nfrac=060)
+Fch=916.10 (Fvco=3664.40, Nint=070, Nfrac=061)
+Fch=916.20 (Fvco=3664.80, Nint=070, Nfrac=062)
+Fch=916.30 (Fvco=3665.20, Nint=070, Nfrac=063)
+Fch=916.40 (Fvco=3665.60, Nint=070, Nfrac=064)
+Fch=916.50 (Fvco=3666.00, Nint=070, Nfrac=065)
+Fch=916.60 (Fvco=3666.40, Nint=070, Nfrac=066)
+Fch=916.70 (Fvco=3666.80, Nint=070, Nfrac=067)
+Fch=916.80 (Fvco=3667.20, Nint=070, Nfrac=068)
+Fch=916.90 (Fvco=3667.60, Nint=070, Nfrac=069)
+Fch=917.00 (Fvco=3668.00, Nint=070, Nfrac=070)
+Fch=917.10 (Fvco=3668.40, Nint=070, Nfrac=071)
+Fch=917.20 (Fvco=3668.80, Nint=070, Nfrac=072)
+Fch=917.30 (Fvco=3669.20, Nint=070, Nfrac=073)
+Fch=917.40 (Fvco=3669.60, Nint=070, Nfrac=074)
+Fch=917.50 (Fvco=3670.00, Nint=070, Nfrac=075)
+Fch=917.60 (Fvco=3670.40, Nint=070, Nfrac=076)
+Fch=917.70 (Fvco=3670.80, Nint=070, Nfrac=077)
+Fch=917.80 (Fvco=3671.20, Nint=070, Nfrac=078)
+Fch=917.90 (Fvco=3671.60, Nint=070, Nfrac=079)
+Fch=918.00 (Fvco=3672.00, Nint=070, Nfrac=080)
+Fch=918.10 (Fvco=3672.40, Nint=070, Nfrac=081)
+Fch=918.20 (Fvco=3672.80, Nint=070, Nfrac=082)
+Fch=918.30 (Fvco=3673.20, Nint=070, Nfrac=083)
+Fch=918.40 (Fvco=3673.60, Nint=070, Nfrac=084)
+Fch=918.50 (Fvco=3674.00, Nint=070, Nfrac=085)
+Fch=918.60 (Fvco=3674.40, Nint=070, Nfrac=086)
+Fch=918.70 (Fvco=3674.80, Nint=070, Nfrac=087)
+Fch=918.80 (Fvco=3675.20, Nint=070, Nfrac=088)
+Fch=918.90 (Fvco=3675.60, Nint=070, Nfrac=089)
+Fch=919.00 (Fvco=3676.00, Nint=070, Nfrac=090)
+Fch=919.10 (Fvco=3676.40, Nint=070, Nfrac=091)
+Fch=919.20 (Fvco=3676.80, Nint=070, Nfrac=092)
+Fch=919.30 (Fvco=3677.20, Nint=070, Nfrac=093)
+Fch=919.40 (Fvco=3677.60, Nint=070, Nfrac=094)
+Fch=919.50 (Fvco=3678.00, Nint=070, Nfrac=095)
+Fch=919.60 (Fvco=3678.40, Nint=070, Nfrac=096)
+Fch=919.70 (Fvco=3678.80, Nint=070, Nfrac=097)
+Fch=919.80 (Fvco=3679.20, Nint=070, Nfrac=098)
+Fch=919.90 (Fvco=3679.60, Nint=070, Nfrac=099)
+Fch=920.00 (Fvco=3680.00, Nint=070, Nfrac=100)
+Fch=920.10 (Fvco=3680.40, Nint=070, Nfrac=101)
+Fch=920.20 (Fvco=3680.80, Nint=070, Nfrac=102)
+Fch=920.30 (Fvco=3681.20, Nint=070, Nfrac=103)
+Fch=920.40 (Fvco=3681.60, Nint=070, Nfrac=104)
+Fch=920.50 (Fvco=3682.00, Nint=070, Nfrac=105)
+Fch=920.60 (Fvco=3682.40, Nint=070, Nfrac=106)
+Fch=920.70 (Fvco=3682.80, Nint=070, Nfrac=107)
+Fch=920.80 (Fvco=3683.20, Nint=070, Nfrac=108)
+Fch=920.90 (Fvco=3683.60, Nint=070, Nfrac=109)
+Fch=921.00 (Fvco=3684.00, Nint=070, Nfrac=110)
+Fch=921.10 (Fvco=3684.40, Nint=070, Nfrac=111)
+Fch=921.20 (Fvco=3684.80, Nint=070, Nfrac=112)
+Fch=921.30 (Fvco=3685.20, Nint=070, Nfrac=113)
+Fch=921.40 (Fvco=3685.60, Nint=070, Nfrac=114)
+Fch=921.50 (Fvco=3686.00, Nint=070, Nfrac=115)
+Fch=921.60 (Fvco=3686.40, Nint=070, Nfrac=116)
+Fch=921.70 (Fvco=3686.80, Nint=070, Nfrac=117)
+Fch=921.80 (Fvco=3687.20, Nint=070, Nfrac=118)
+Fch=921.90 (Fvco=3687.60, Nint=070, Nfrac=119)
+Fch=922.00 (Fvco=3688.00, Nint=070, Nfrac=120)
+Fch=922.10 (Fvco=3688.40, Nint=070, Nfrac=121)
+Fch=922.20 (Fvco=3688.80, Nint=070, Nfrac=122)
+Fch=922.30 (Fvco=3689.20, Nint=070, Nfrac=123)
+Fch=922.40 (Fvco=3689.60, Nint=070, Nfrac=124)
+Fch=922.50 (Fvco=3690.00, Nint=070, Nfrac=125)
+Fch=922.60 (Fvco=3690.40, Nint=070, Nfrac=126)
+Fch=922.70 (Fvco=3690.80, Nint=070, Nfrac=127)
+Fch=922.80 (Fvco=3691.20, Nint=070, Nfrac=128)
+Fch=922.90 (Fvco=3691.60, Nint=070, Nfrac=129)
+Fch=923.00 (Fvco=3692.00, Nint=070, Nfrac=130)
+======================================================================
+PLL Tx High Band
+Fch=1690.00 (Fvco=3380.00, Nint=065, Nfrac=000)
+Fch=1690.20 (Fvco=3380.40, Nint=065, Nfrac=001)
+Fch=1690.40 (Fvco=3380.80, Nint=065, Nfrac=002)
+Fch=1690.60 (Fvco=3381.20, Nint=065, Nfrac=003)
+Fch=1690.80 (Fvco=3381.60, Nint=065, Nfrac=004)
+Fch=1691.00 (Fvco=3382.00, Nint=065, Nfrac=005)
+Fch=1691.20 (Fvco=3382.40, Nint=065, Nfrac=006)
+Fch=1691.40 (Fvco=3382.80, Nint=065, Nfrac=007)
+Fch=1691.60 (Fvco=3383.20, Nint=065, Nfrac=008)
+Fch=1691.80 (Fvco=3383.60, Nint=065, Nfrac=009)
+Fch=1692.00 (Fvco=3384.00, Nint=065, Nfrac=010)
+Fch=1692.20 (Fvco=3384.40, Nint=065, Nfrac=011)
+Fch=1692.40 (Fvco=3384.80, Nint=065, Nfrac=012)
+Fch=1692.60 (Fvco=3385.20, Nint=065, Nfrac=013)
+Fch=1692.80 (Fvco=3385.60, Nint=065, Nfrac=014)
+Fch=1693.00 (Fvco=3386.00, Nint=065, Nfrac=015)
+Fch=1693.20 (Fvco=3386.40, Nint=065, Nfrac=016)
+Fch=1693.40 (Fvco=3386.80, Nint=065, Nfrac=017)
+Fch=1693.60 (Fvco=3387.20, Nint=065, Nfrac=018)
+Fch=1693.80 (Fvco=3387.60, Nint=065, Nfrac=019)
+Fch=1694.00 (Fvco=3388.00, Nint=065, Nfrac=020)
+Fch=1694.20 (Fvco=3388.40, Nint=065, Nfrac=021)
+Fch=1694.40 (Fvco=3388.80, Nint=065, Nfrac=022)
+Fch=1694.60 (Fvco=3389.20, Nint=065, Nfrac=023)
+Fch=1694.80 (Fvco=3389.60, Nint=065, Nfrac=024)
+Fch=1695.00 (Fvco=3390.00, Nint=065, Nfrac=025)
+Fch=1695.20 (Fvco=3390.40, Nint=065, Nfrac=026)
+Fch=1695.40 (Fvco=3390.80, Nint=065, Nfrac=027)
+Fch=1695.60 (Fvco=3391.20, Nint=065, Nfrac=028)
+Fch=1695.80 (Fvco=3391.60, Nint=065, Nfrac=029)
+Fch=1696.00 (Fvco=3392.00, Nint=065, Nfrac=030)
+Fch=1696.20 (Fvco=3392.40, Nint=065, Nfrac=031)
+Fch=1696.40 (Fvco=3392.80, Nint=065, Nfrac=032)
+Fch=1696.60 (Fvco=3393.20, Nint=065, Nfrac=033)
+Fch=1696.80 (Fvco=3393.60, Nint=065, Nfrac=034)
+Fch=1697.00 (Fvco=3394.00, Nint=065, Nfrac=035)
+Fch=1697.20 (Fvco=3394.40, Nint=065, Nfrac=036)
+Fch=1697.40 (Fvco=3394.80, Nint=065, Nfrac=037)
+Fch=1697.60 (Fvco=3395.20, Nint=065, Nfrac=038)
+Fch=1697.80 (Fvco=3395.60, Nint=065, Nfrac=039)
+Fch=1698.00 (Fvco=3396.00, Nint=065, Nfrac=040)
+Fch=1698.20 (Fvco=3396.40, Nint=065, Nfrac=041)
+Fch=1698.40 (Fvco=3396.80, Nint=065, Nfrac=042)
+Fch=1698.60 (Fvco=3397.20, Nint=065, Nfrac=043)
+Fch=1698.80 (Fvco=3397.60, Nint=065, Nfrac=044)
+Fch=1699.00 (Fvco=3398.00, Nint=065, Nfrac=045)
+Fch=1699.20 (Fvco=3398.40, Nint=065, Nfrac=046)
+Fch=1699.40 (Fvco=3398.80, Nint=065, Nfrac=047)
+Fch=1699.60 (Fvco=3399.20, Nint=065, Nfrac=048)
+Fch=1699.80 (Fvco=3399.60, Nint=065, Nfrac=049)
+Fch=1700.00 (Fvco=3400.00, Nint=065, Nfrac=050)
+Fch=1700.20 (Fvco=3400.40, Nint=065, Nfrac=051)
+Fch=1700.40 (Fvco=3400.80, Nint=065, Nfrac=052)
+Fch=1700.60 (Fvco=3401.20, Nint=065, Nfrac=053)
+Fch=1700.80 (Fvco=3401.60, Nint=065, Nfrac=054)
+Fch=1701.00 (Fvco=3402.00, Nint=065, Nfrac=055)
+Fch=1701.20 (Fvco=3402.40, Nint=065, Nfrac=056)
+Fch=1701.40 (Fvco=3402.80, Nint=065, Nfrac=057)
+Fch=1701.60 (Fvco=3403.20, Nint=065, Nfrac=058)
+Fch=1701.80 (Fvco=3403.60, Nint=065, Nfrac=059)
+Fch=1702.00 (Fvco=3404.00, Nint=065, Nfrac=060)
+Fch=1702.20 (Fvco=3404.40, Nint=065, Nfrac=061)
+Fch=1702.40 (Fvco=3404.80, Nint=065, Nfrac=062)
+Fch=1702.60 (Fvco=3405.20, Nint=065, Nfrac=063)
+Fch=1702.80 (Fvco=3405.60, Nint=065, Nfrac=064)
+Fch=1703.00 (Fvco=3406.00, Nint=065, Nfrac=065)
+Fch=1703.20 (Fvco=3406.40, Nint=065, Nfrac=066)
+Fch=1703.40 (Fvco=3406.80, Nint=065, Nfrac=067)
+Fch=1703.60 (Fvco=3407.20, Nint=065, Nfrac=068)
+Fch=1703.80 (Fvco=3407.60, Nint=065, Nfrac=069)
+Fch=1704.00 (Fvco=3408.00, Nint=065, Nfrac=070)
+Fch=1704.20 (Fvco=3408.40, Nint=065, Nfrac=071)
+Fch=1704.40 (Fvco=3408.80, Nint=065, Nfrac=072)
+Fch=1704.60 (Fvco=3409.20, Nint=065, Nfrac=073)
+Fch=1704.80 (Fvco=3409.60, Nint=065, Nfrac=074)
+Fch=1705.00 (Fvco=3410.00, Nint=065, Nfrac=075)
+Fch=1705.20 (Fvco=3410.40, Nint=065, Nfrac=076)
+Fch=1705.40 (Fvco=3410.80, Nint=065, Nfrac=077)
+Fch=1705.60 (Fvco=3411.20, Nint=065, Nfrac=078)
+Fch=1705.80 (Fvco=3411.60, Nint=065, Nfrac=079)
+Fch=1706.00 (Fvco=3412.00, Nint=065, Nfrac=080)
+Fch=1706.20 (Fvco=3412.40, Nint=065, Nfrac=081)
+Fch=1706.40 (Fvco=3412.80, Nint=065, Nfrac=082)
+Fch=1706.60 (Fvco=3413.20, Nint=065, Nfrac=083)
+Fch=1706.80 (Fvco=3413.60, Nint=065, Nfrac=084)
+Fch=1707.00 (Fvco=3414.00, Nint=065, Nfrac=085)
+Fch=1707.20 (Fvco=3414.40, Nint=065, Nfrac=086)
+Fch=1707.40 (Fvco=3414.80, Nint=065, Nfrac=087)
+Fch=1707.60 (Fvco=3415.20, Nint=065, Nfrac=088)
+Fch=1707.80 (Fvco=3415.60, Nint=065, Nfrac=089)
+Fch=1708.00 (Fvco=3416.00, Nint=065, Nfrac=090)
+Fch=1708.20 (Fvco=3416.40, Nint=065, Nfrac=091)
+Fch=1708.40 (Fvco=3416.80, Nint=065, Nfrac=092)
+Fch=1708.60 (Fvco=3417.20, Nint=065, Nfrac=093)
+Fch=1708.80 (Fvco=3417.60, Nint=065, Nfrac=094)
+Fch=1709.00 (Fvco=3418.00, Nint=065, Nfrac=095)
+Fch=1709.20 (Fvco=3418.40, Nint=065, Nfrac=096)
+Fch=1709.40 (Fvco=3418.80, Nint=065, Nfrac=097)
+Fch=1709.60 (Fvco=3419.20, Nint=065, Nfrac=098)
+Fch=1709.80 (Fvco=3419.60, Nint=065, Nfrac=099)
+Fch=1710.00 (Fvco=3420.00, Nint=065, Nfrac=100)
+Fch=1710.20 (Fvco=3420.40, Nint=065, Nfrac=101)
+Fch=1710.40 (Fvco=3420.80, Nint=065, Nfrac=102)
+Fch=1710.60 (Fvco=3421.20, Nint=065, Nfrac=103)
+Fch=1710.80 (Fvco=3421.60, Nint=065, Nfrac=104)
+Fch=1711.00 (Fvco=3422.00, Nint=065, Nfrac=105)
+Fch=1711.20 (Fvco=3422.40, Nint=065, Nfrac=106)
+Fch=1711.40 (Fvco=3422.80, Nint=065, Nfrac=107)
+Fch=1711.60 (Fvco=3423.20, Nint=065, Nfrac=108)
+Fch=1711.80 (Fvco=3423.60, Nint=065, Nfrac=109)
+Fch=1712.00 (Fvco=3424.00, Nint=065, Nfrac=110)
+Fch=1712.20 (Fvco=3424.40, Nint=065, Nfrac=111)
+Fch=1712.40 (Fvco=3424.80, Nint=065, Nfrac=112)
+Fch=1712.60 (Fvco=3425.20, Nint=065, Nfrac=113)
+Fch=1712.80 (Fvco=3425.60, Nint=065, Nfrac=114)
+Fch=1713.00 (Fvco=3426.00, Nint=065, Nfrac=115)
+Fch=1713.20 (Fvco=3426.40, Nint=065, Nfrac=116)
+Fch=1713.40 (Fvco=3426.80, Nint=065, Nfrac=117)
+Fch=1713.60 (Fvco=3427.20, Nint=065, Nfrac=118)
+Fch=1713.80 (Fvco=3427.60, Nint=065, Nfrac=119)
+Fch=1714.00 (Fvco=3428.00, Nint=065, Nfrac=120)
+Fch=1714.20 (Fvco=3428.40, Nint=065, Nfrac=121)
+Fch=1714.40 (Fvco=3428.80, Nint=065, Nfrac=122)
+Fch=1714.60 (Fvco=3429.20, Nint=065, Nfrac=123)
+Fch=1714.80 (Fvco=3429.60, Nint=065, Nfrac=124)
+Fch=1715.00 (Fvco=3430.00, Nint=065, Nfrac=125)
+Fch=1715.20 (Fvco=3430.40, Nint=065, Nfrac=126)
+Fch=1715.40 (Fvco=3430.80, Nint=065, Nfrac=127)
+Fch=1715.60 (Fvco=3431.20, Nint=065, Nfrac=128)
+Fch=1715.80 (Fvco=3431.60, Nint=065, Nfrac=129)
+Fch=1716.00 (Fvco=3432.00, Nint=065, Nfrac=130)
+Fch=1716.00 (Fvco=3432.00, Nint=066, Nfrac=000)
+Fch=1716.20 (Fvco=3432.40, Nint=066, Nfrac=001)
+Fch=1716.40 (Fvco=3432.80, Nint=066, Nfrac=002)
+Fch=1716.60 (Fvco=3433.20, Nint=066, Nfrac=003)
+Fch=1716.80 (Fvco=3433.60, Nint=066, Nfrac=004)
+Fch=1717.00 (Fvco=3434.00, Nint=066, Nfrac=005)
+Fch=1717.20 (Fvco=3434.40, Nint=066, Nfrac=006)
+Fch=1717.40 (Fvco=3434.80, Nint=066, Nfrac=007)
+Fch=1717.60 (Fvco=3435.20, Nint=066, Nfrac=008)
+Fch=1717.80 (Fvco=3435.60, Nint=066, Nfrac=009)
+Fch=1718.00 (Fvco=3436.00, Nint=066, Nfrac=010)
+Fch=1718.20 (Fvco=3436.40, Nint=066, Nfrac=011)
+Fch=1718.40 (Fvco=3436.80, Nint=066, Nfrac=012)
+Fch=1718.60 (Fvco=3437.20, Nint=066, Nfrac=013)
+Fch=1718.80 (Fvco=3437.60, Nint=066, Nfrac=014)
+Fch=1719.00 (Fvco=3438.00, Nint=066, Nfrac=015)
+Fch=1719.20 (Fvco=3438.40, Nint=066, Nfrac=016)
+Fch=1719.40 (Fvco=3438.80, Nint=066, Nfrac=017)
+Fch=1719.60 (Fvco=3439.20, Nint=066, Nfrac=018)
+Fch=1719.80 (Fvco=3439.60, Nint=066, Nfrac=019)
+Fch=1720.00 (Fvco=3440.00, Nint=066, Nfrac=020)
+Fch=1720.20 (Fvco=3440.40, Nint=066, Nfrac=021)
+Fch=1720.40 (Fvco=3440.80, Nint=066, Nfrac=022)
+Fch=1720.60 (Fvco=3441.20, Nint=066, Nfrac=023)
+Fch=1720.80 (Fvco=3441.60, Nint=066, Nfrac=024)
+Fch=1721.00 (Fvco=3442.00, Nint=066, Nfrac=025)
+Fch=1721.20 (Fvco=3442.40, Nint=066, Nfrac=026)
+Fch=1721.40 (Fvco=3442.80, Nint=066, Nfrac=027)
+Fch=1721.60 (Fvco=3443.20, Nint=066, Nfrac=028)
+Fch=1721.80 (Fvco=3443.60, Nint=066, Nfrac=029)
+Fch=1722.00 (Fvco=3444.00, Nint=066, Nfrac=030)
+Fch=1722.20 (Fvco=3444.40, Nint=066, Nfrac=031)
+Fch=1722.40 (Fvco=3444.80, Nint=066, Nfrac=032)
+Fch=1722.60 (Fvco=3445.20, Nint=066, Nfrac=033)
+Fch=1722.80 (Fvco=3445.60, Nint=066, Nfrac=034)
+Fch=1723.00 (Fvco=3446.00, Nint=066, Nfrac=035)
+Fch=1723.20 (Fvco=3446.40, Nint=066, Nfrac=036)
+Fch=1723.40 (Fvco=3446.80, Nint=066, Nfrac=037)
+Fch=1723.60 (Fvco=3447.20, Nint=066, Nfrac=038)
+Fch=1723.80 (Fvco=3447.60, Nint=066, Nfrac=039)
+Fch=1724.00 (Fvco=3448.00, Nint=066, Nfrac=040)
+Fch=1724.20 (Fvco=3448.40, Nint=066, Nfrac=041)
+Fch=1724.40 (Fvco=3448.80, Nint=066, Nfrac=042)
+Fch=1724.60 (Fvco=3449.20, Nint=066, Nfrac=043)
+Fch=1724.80 (Fvco=3449.60, Nint=066, Nfrac=044)
+Fch=1725.00 (Fvco=3450.00, Nint=066, Nfrac=045)
+Fch=1725.20 (Fvco=3450.40, Nint=066, Nfrac=046)
+Fch=1725.40 (Fvco=3450.80, Nint=066, Nfrac=047)
+Fch=1725.60 (Fvco=3451.20, Nint=066, Nfrac=048)
+Fch=1725.80 (Fvco=3451.60, Nint=066, Nfrac=049)
+Fch=1726.00 (Fvco=3452.00, Nint=066, Nfrac=050)
+Fch=1726.20 (Fvco=3452.40, Nint=066, Nfrac=051)
+Fch=1726.40 (Fvco=3452.80, Nint=066, Nfrac=052)
+Fch=1726.60 (Fvco=3453.20, Nint=066, Nfrac=053)
+Fch=1726.80 (Fvco=3453.60, Nint=066, Nfrac=054)
+Fch=1727.00 (Fvco=3454.00, Nint=066, Nfrac=055)
+Fch=1727.20 (Fvco=3454.40, Nint=066, Nfrac=056)
+Fch=1727.40 (Fvco=3454.80, Nint=066, Nfrac=057)
+Fch=1727.60 (Fvco=3455.20, Nint=066, Nfrac=058)
+Fch=1727.80 (Fvco=3455.60, Nint=066, Nfrac=059)
+Fch=1728.00 (Fvco=3456.00, Nint=066, Nfrac=060)
+Fch=1728.20 (Fvco=3456.40, Nint=066, Nfrac=061)
+Fch=1728.40 (Fvco=3456.80, Nint=066, Nfrac=062)
+Fch=1728.60 (Fvco=3457.20, Nint=066, Nfrac=063)
+Fch=1728.80 (Fvco=3457.60, Nint=066, Nfrac=064)
+Fch=1729.00 (Fvco=3458.00, Nint=066, Nfrac=065)
+Fch=1729.20 (Fvco=3458.40, Nint=066, Nfrac=066)
+Fch=1729.40 (Fvco=3458.80, Nint=066, Nfrac=067)
+Fch=1729.60 (Fvco=3459.20, Nint=066, Nfrac=068)
+Fch=1729.80 (Fvco=3459.60, Nint=066, Nfrac=069)
+Fch=1730.00 (Fvco=3460.00, Nint=066, Nfrac=070)
+Fch=1730.20 (Fvco=3460.40, Nint=066, Nfrac=071)
+Fch=1730.40 (Fvco=3460.80, Nint=066, Nfrac=072)
+Fch=1730.60 (Fvco=3461.20, Nint=066, Nfrac=073)
+Fch=1730.80 (Fvco=3461.60, Nint=066, Nfrac=074)
+Fch=1731.00 (Fvco=3462.00, Nint=066, Nfrac=075)
+Fch=1731.20 (Fvco=3462.40, Nint=066, Nfrac=076)
+Fch=1731.40 (Fvco=3462.80, Nint=066, Nfrac=077)
+Fch=1731.60 (Fvco=3463.20, Nint=066, Nfrac=078)
+Fch=1731.80 (Fvco=3463.60, Nint=066, Nfrac=079)
+Fch=1732.00 (Fvco=3464.00, Nint=066, Nfrac=080)
+Fch=1732.20 (Fvco=3464.40, Nint=066, Nfrac=081)
+Fch=1732.40 (Fvco=3464.80, Nint=066, Nfrac=082)
+Fch=1732.60 (Fvco=3465.20, Nint=066, Nfrac=083)
+Fch=1732.80 (Fvco=3465.60, Nint=066, Nfrac=084)
+Fch=1733.00 (Fvco=3466.00, Nint=066, Nfrac=085)
+Fch=1733.20 (Fvco=3466.40, Nint=066, Nfrac=086)
+Fch=1733.40 (Fvco=3466.80, Nint=066, Nfrac=087)
+Fch=1733.60 (Fvco=3467.20, Nint=066, Nfrac=088)
+Fch=1733.80 (Fvco=3467.60, Nint=066, Nfrac=089)
+Fch=1734.00 (Fvco=3468.00, Nint=066, Nfrac=090)
+Fch=1734.20 (Fvco=3468.40, Nint=066, Nfrac=091)
+Fch=1734.40 (Fvco=3468.80, Nint=066, Nfrac=092)
+Fch=1734.60 (Fvco=3469.20, Nint=066, Nfrac=093)
+Fch=1734.80 (Fvco=3469.60, Nint=066, Nfrac=094)
+Fch=1735.00 (Fvco=3470.00, Nint=066, Nfrac=095)
+Fch=1735.20 (Fvco=3470.40, Nint=066, Nfrac=096)
+Fch=1735.40 (Fvco=3470.80, Nint=066, Nfrac=097)
+Fch=1735.60 (Fvco=3471.20, Nint=066, Nfrac=098)
+Fch=1735.80 (Fvco=3471.60, Nint=066, Nfrac=099)
+Fch=1736.00 (Fvco=3472.00, Nint=066, Nfrac=100)
+Fch=1736.20 (Fvco=3472.40, Nint=066, Nfrac=101)
+Fch=1736.40 (Fvco=3472.80, Nint=066, Nfrac=102)
+Fch=1736.60 (Fvco=3473.20, Nint=066, Nfrac=103)
+Fch=1736.80 (Fvco=3473.60, Nint=066, Nfrac=104)
+Fch=1737.00 (Fvco=3474.00, Nint=066, Nfrac=105)
+Fch=1737.20 (Fvco=3474.40, Nint=066, Nfrac=106)
+Fch=1737.40 (Fvco=3474.80, Nint=066, Nfrac=107)
+Fch=1737.60 (Fvco=3475.20, Nint=066, Nfrac=108)
+Fch=1737.80 (Fvco=3475.60, Nint=066, Nfrac=109)
+Fch=1738.00 (Fvco=3476.00, Nint=066, Nfrac=110)
+Fch=1738.20 (Fvco=3476.40, Nint=066, Nfrac=111)
+Fch=1738.40 (Fvco=3476.80, Nint=066, Nfrac=112)
+Fch=1738.60 (Fvco=3477.20, Nint=066, Nfrac=113)
+Fch=1738.80 (Fvco=3477.60, Nint=066, Nfrac=114)
+Fch=1739.00 (Fvco=3478.00, Nint=066, Nfrac=115)
+Fch=1739.20 (Fvco=3478.40, Nint=066, Nfrac=116)
+Fch=1739.40 (Fvco=3478.80, Nint=066, Nfrac=117)
+Fch=1739.60 (Fvco=3479.20, Nint=066, Nfrac=118)
+Fch=1739.80 (Fvco=3479.60, Nint=066, Nfrac=119)
+Fch=1740.00 (Fvco=3480.00, Nint=066, Nfrac=120)
+Fch=1740.20 (Fvco=3480.40, Nint=066, Nfrac=121)
+Fch=1740.40 (Fvco=3480.80, Nint=066, Nfrac=122)
+Fch=1740.60 (Fvco=3481.20, Nint=066, Nfrac=123)
+Fch=1740.80 (Fvco=3481.60, Nint=066, Nfrac=124)
+Fch=1741.00 (Fvco=3482.00, Nint=066, Nfrac=125)
+Fch=1741.20 (Fvco=3482.40, Nint=066, Nfrac=126)
+Fch=1741.40 (Fvco=3482.80, Nint=066, Nfrac=127)
+Fch=1741.60 (Fvco=3483.20, Nint=066, Nfrac=128)
+Fch=1741.80 (Fvco=3483.60, Nint=066, Nfrac=129)
+Fch=1742.00 (Fvco=3484.00, Nint=066, Nfrac=130)
+Fch=1742.00 (Fvco=3484.00, Nint=067, Nfrac=000)
+Fch=1742.20 (Fvco=3484.40, Nint=067, Nfrac=001)
+Fch=1742.40 (Fvco=3484.80, Nint=067, Nfrac=002)
+Fch=1742.60 (Fvco=3485.20, Nint=067, Nfrac=003)
+Fch=1742.80 (Fvco=3485.60, Nint=067, Nfrac=004)
+Fch=1743.00 (Fvco=3486.00, Nint=067, Nfrac=005)
+Fch=1743.20 (Fvco=3486.40, Nint=067, Nfrac=006)
+Fch=1743.40 (Fvco=3486.80, Nint=067, Nfrac=007)
+Fch=1743.60 (Fvco=3487.20, Nint=067, Nfrac=008)
+Fch=1743.80 (Fvco=3487.60, Nint=067, Nfrac=009)
+Fch=1744.00 (Fvco=3488.00, Nint=067, Nfrac=010)
+Fch=1744.20 (Fvco=3488.40, Nint=067, Nfrac=011)
+Fch=1744.40 (Fvco=3488.80, Nint=067, Nfrac=012)
+Fch=1744.60 (Fvco=3489.20, Nint=067, Nfrac=013)
+Fch=1744.80 (Fvco=3489.60, Nint=067, Nfrac=014)
+Fch=1745.00 (Fvco=3490.00, Nint=067, Nfrac=015)
+Fch=1745.20 (Fvco=3490.40, Nint=067, Nfrac=016)
+Fch=1745.40 (Fvco=3490.80, Nint=067, Nfrac=017)
+Fch=1745.60 (Fvco=3491.20, Nint=067, Nfrac=018)
+Fch=1745.80 (Fvco=3491.60, Nint=067, Nfrac=019)
+Fch=1746.00 (Fvco=3492.00, Nint=067, Nfrac=020)
+Fch=1746.20 (Fvco=3492.40, Nint=067, Nfrac=021)
+Fch=1746.40 (Fvco=3492.80, Nint=067, Nfrac=022)
+Fch=1746.60 (Fvco=3493.20, Nint=067, Nfrac=023)
+Fch=1746.80 (Fvco=3493.60, Nint=067, Nfrac=024)
+Fch=1747.00 (Fvco=3494.00, Nint=067, Nfrac=025)
+Fch=1747.20 (Fvco=3494.40, Nint=067, Nfrac=026)
+Fch=1747.40 (Fvco=3494.80, Nint=067, Nfrac=027)
+Fch=1747.60 (Fvco=3495.20, Nint=067, Nfrac=028)
+Fch=1747.80 (Fvco=3495.60, Nint=067, Nfrac=029)
+Fch=1748.00 (Fvco=3496.00, Nint=067, Nfrac=030)
+Fch=1748.20 (Fvco=3496.40, Nint=067, Nfrac=031)
+Fch=1748.40 (Fvco=3496.80, Nint=067, Nfrac=032)
+Fch=1748.60 (Fvco=3497.20, Nint=067, Nfrac=033)
+Fch=1748.80 (Fvco=3497.60, Nint=067, Nfrac=034)
+Fch=1749.00 (Fvco=3498.00, Nint=067, Nfrac=035)
+Fch=1749.20 (Fvco=3498.40, Nint=067, Nfrac=036)
+Fch=1749.40 (Fvco=3498.80, Nint=067, Nfrac=037)
+Fch=1749.60 (Fvco=3499.20, Nint=067, Nfrac=038)
+Fch=1749.80 (Fvco=3499.60, Nint=067, Nfrac=039)
+Fch=1750.00 (Fvco=3500.00, Nint=067, Nfrac=040)
+Fch=1750.20 (Fvco=3500.40, Nint=067, Nfrac=041)
+Fch=1750.40 (Fvco=3500.80, Nint=067, Nfrac=042)
+Fch=1750.60 (Fvco=3501.20, Nint=067, Nfrac=043)
+Fch=1750.80 (Fvco=3501.60, Nint=067, Nfrac=044)
+Fch=1751.00 (Fvco=3502.00, Nint=067, Nfrac=045)
+Fch=1751.20 (Fvco=3502.40, Nint=067, Nfrac=046)
+Fch=1751.40 (Fvco=3502.80, Nint=067, Nfrac=047)
+Fch=1751.60 (Fvco=3503.20, Nint=067, Nfrac=048)
+Fch=1751.80 (Fvco=3503.60, Nint=067, Nfrac=049)
+Fch=1752.00 (Fvco=3504.00, Nint=067, Nfrac=050)
+Fch=1752.20 (Fvco=3504.40, Nint=067, Nfrac=051)
+Fch=1752.40 (Fvco=3504.80, Nint=067, Nfrac=052)
+Fch=1752.60 (Fvco=3505.20, Nint=067, Nfrac=053)
+Fch=1752.80 (Fvco=3505.60, Nint=067, Nfrac=054)
+Fch=1753.00 (Fvco=3506.00, Nint=067, Nfrac=055)
+Fch=1753.20 (Fvco=3506.40, Nint=067, Nfrac=056)
+Fch=1753.40 (Fvco=3506.80, Nint=067, Nfrac=057)
+Fch=1753.60 (Fvco=3507.20, Nint=067, Nfrac=058)
+Fch=1753.80 (Fvco=3507.60, Nint=067, Nfrac=059)
+Fch=1754.00 (Fvco=3508.00, Nint=067, Nfrac=060)
+Fch=1754.20 (Fvco=3508.40, Nint=067, Nfrac=061)
+Fch=1754.40 (Fvco=3508.80, Nint=067, Nfrac=062)
+Fch=1754.60 (Fvco=3509.20, Nint=067, Nfrac=063)
+Fch=1754.80 (Fvco=3509.60, Nint=067, Nfrac=064)
+Fch=1755.00 (Fvco=3510.00, Nint=067, Nfrac=065)
+Fch=1755.20 (Fvco=3510.40, Nint=067, Nfrac=066)
+Fch=1755.40 (Fvco=3510.80, Nint=067, Nfrac=067)
+Fch=1755.60 (Fvco=3511.20, Nint=067, Nfrac=068)
+Fch=1755.80 (Fvco=3511.60, Nint=067, Nfrac=069)
+Fch=1756.00 (Fvco=3512.00, Nint=067, Nfrac=070)
+Fch=1756.20 (Fvco=3512.40, Nint=067, Nfrac=071)
+Fch=1756.40 (Fvco=3512.80, Nint=067, Nfrac=072)
+Fch=1756.60 (Fvco=3513.20, Nint=067, Nfrac=073)
+Fch=1756.80 (Fvco=3513.60, Nint=067, Nfrac=074)
+Fch=1757.00 (Fvco=3514.00, Nint=067, Nfrac=075)
+Fch=1757.20 (Fvco=3514.40, Nint=067, Nfrac=076)
+Fch=1757.40 (Fvco=3514.80, Nint=067, Nfrac=077)
+Fch=1757.60 (Fvco=3515.20, Nint=067, Nfrac=078)
+Fch=1757.80 (Fvco=3515.60, Nint=067, Nfrac=079)
+Fch=1758.00 (Fvco=3516.00, Nint=067, Nfrac=080)
+Fch=1758.20 (Fvco=3516.40, Nint=067, Nfrac=081)
+Fch=1758.40 (Fvco=3516.80, Nint=067, Nfrac=082)
+Fch=1758.60 (Fvco=3517.20, Nint=067, Nfrac=083)
+Fch=1758.80 (Fvco=3517.60, Nint=067, Nfrac=084)
+Fch=1759.00 (Fvco=3518.00, Nint=067, Nfrac=085)
+Fch=1759.20 (Fvco=3518.40, Nint=067, Nfrac=086)
+Fch=1759.40 (Fvco=3518.80, Nint=067, Nfrac=087)
+Fch=1759.60 (Fvco=3519.20, Nint=067, Nfrac=088)
+Fch=1759.80 (Fvco=3519.60, Nint=067, Nfrac=089)
+Fch=1760.00 (Fvco=3520.00, Nint=067, Nfrac=090)
+Fch=1760.20 (Fvco=3520.40, Nint=067, Nfrac=091)
+Fch=1760.40 (Fvco=3520.80, Nint=067, Nfrac=092)
+Fch=1760.60 (Fvco=3521.20, Nint=067, Nfrac=093)
+Fch=1760.80 (Fvco=3521.60, Nint=067, Nfrac=094)
+Fch=1761.00 (Fvco=3522.00, Nint=067, Nfrac=095)
+Fch=1761.20 (Fvco=3522.40, Nint=067, Nfrac=096)
+Fch=1761.40 (Fvco=3522.80, Nint=067, Nfrac=097)
+Fch=1761.60 (Fvco=3523.20, Nint=067, Nfrac=098)
+Fch=1761.80 (Fvco=3523.60, Nint=067, Nfrac=099)
+Fch=1762.00 (Fvco=3524.00, Nint=067, Nfrac=100)
+Fch=1762.20 (Fvco=3524.40, Nint=067, Nfrac=101)
+Fch=1762.40 (Fvco=3524.80, Nint=067, Nfrac=102)
+Fch=1762.60 (Fvco=3525.20, Nint=067, Nfrac=103)
+Fch=1762.80 (Fvco=3525.60, Nint=067, Nfrac=104)
+Fch=1763.00 (Fvco=3526.00, Nint=067, Nfrac=105)
+Fch=1763.20 (Fvco=3526.40, Nint=067, Nfrac=106)
+Fch=1763.40 (Fvco=3526.80, Nint=067, Nfrac=107)
+Fch=1763.60 (Fvco=3527.20, Nint=067, Nfrac=108)
+Fch=1763.80 (Fvco=3527.60, Nint=067, Nfrac=109)
+Fch=1764.00 (Fvco=3528.00, Nint=067, Nfrac=110)
+Fch=1764.20 (Fvco=3528.40, Nint=067, Nfrac=111)
+Fch=1764.40 (Fvco=3528.80, Nint=067, Nfrac=112)
+Fch=1764.60 (Fvco=3529.20, Nint=067, Nfrac=113)
+Fch=1764.80 (Fvco=3529.60, Nint=067, Nfrac=114)
+Fch=1765.00 (Fvco=3530.00, Nint=067, Nfrac=115)
+Fch=1765.20 (Fvco=3530.40, Nint=067, Nfrac=116)
+Fch=1765.40 (Fvco=3530.80, Nint=067, Nfrac=117)
+Fch=1765.60 (Fvco=3531.20, Nint=067, Nfrac=118)
+Fch=1765.80 (Fvco=3531.60, Nint=067, Nfrac=119)
+Fch=1766.00 (Fvco=3532.00, Nint=067, Nfrac=120)
+Fch=1766.20 (Fvco=3532.40, Nint=067, Nfrac=121)
+Fch=1766.40 (Fvco=3532.80, Nint=067, Nfrac=122)
+Fch=1766.60 (Fvco=3533.20, Nint=067, Nfrac=123)
+Fch=1766.80 (Fvco=3533.60, Nint=067, Nfrac=124)
+Fch=1767.00 (Fvco=3534.00, Nint=067, Nfrac=125)
+Fch=1767.20 (Fvco=3534.40, Nint=067, Nfrac=126)
+Fch=1767.40 (Fvco=3534.80, Nint=067, Nfrac=127)
+Fch=1767.60 (Fvco=3535.20, Nint=067, Nfrac=128)
+Fch=1767.80 (Fvco=3535.60, Nint=067, Nfrac=129)
+Fch=1768.00 (Fvco=3536.00, Nint=067, Nfrac=130)
+Fch=1768.00 (Fvco=3536.00, Nint=068, Nfrac=000)
+Fch=1768.20 (Fvco=3536.40, Nint=068, Nfrac=001)
+Fch=1768.40 (Fvco=3536.80, Nint=068, Nfrac=002)
+Fch=1768.60 (Fvco=3537.20, Nint=068, Nfrac=003)
+Fch=1768.80 (Fvco=3537.60, Nint=068, Nfrac=004)
+Fch=1769.00 (Fvco=3538.00, Nint=068, Nfrac=005)
+Fch=1769.20 (Fvco=3538.40, Nint=068, Nfrac=006)
+Fch=1769.40 (Fvco=3538.80, Nint=068, Nfrac=007)
+Fch=1769.60 (Fvco=3539.20, Nint=068, Nfrac=008)
+Fch=1769.80 (Fvco=3539.60, Nint=068, Nfrac=009)
+Fch=1770.00 (Fvco=3540.00, Nint=068, Nfrac=010)
+Fch=1770.20 (Fvco=3540.40, Nint=068, Nfrac=011)
+Fch=1770.40 (Fvco=3540.80, Nint=068, Nfrac=012)
+Fch=1770.60 (Fvco=3541.20, Nint=068, Nfrac=013)
+Fch=1770.80 (Fvco=3541.60, Nint=068, Nfrac=014)
+Fch=1771.00 (Fvco=3542.00, Nint=068, Nfrac=015)
+Fch=1771.20 (Fvco=3542.40, Nint=068, Nfrac=016)
+Fch=1771.40 (Fvco=3542.80, Nint=068, Nfrac=017)
+Fch=1771.60 (Fvco=3543.20, Nint=068, Nfrac=018)
+Fch=1771.80 (Fvco=3543.60, Nint=068, Nfrac=019)
+Fch=1772.00 (Fvco=3544.00, Nint=068, Nfrac=020)
+Fch=1772.20 (Fvco=3544.40, Nint=068, Nfrac=021)
+Fch=1772.40 (Fvco=3544.80, Nint=068, Nfrac=022)
+Fch=1772.60 (Fvco=3545.20, Nint=068, Nfrac=023)
+Fch=1772.80 (Fvco=3545.60, Nint=068, Nfrac=024)
+Fch=1773.00 (Fvco=3546.00, Nint=068, Nfrac=025)
+Fch=1773.20 (Fvco=3546.40, Nint=068, Nfrac=026)
+Fch=1773.40 (Fvco=3546.80, Nint=068, Nfrac=027)
+Fch=1773.60 (Fvco=3547.20, Nint=068, Nfrac=028)
+Fch=1773.80 (Fvco=3547.60, Nint=068, Nfrac=029)
+Fch=1774.00 (Fvco=3548.00, Nint=068, Nfrac=030)
+Fch=1774.20 (Fvco=3548.40, Nint=068, Nfrac=031)
+Fch=1774.40 (Fvco=3548.80, Nint=068, Nfrac=032)
+Fch=1774.60 (Fvco=3549.20, Nint=068, Nfrac=033)
+Fch=1774.80 (Fvco=3549.60, Nint=068, Nfrac=034)
+Fch=1775.00 (Fvco=3550.00, Nint=068, Nfrac=035)
+Fch=1775.20 (Fvco=3550.40, Nint=068, Nfrac=036)
+Fch=1775.40 (Fvco=3550.80, Nint=068, Nfrac=037)
+Fch=1775.60 (Fvco=3551.20, Nint=068, Nfrac=038)
+Fch=1775.80 (Fvco=3551.60, Nint=068, Nfrac=039)
+Fch=1776.00 (Fvco=3552.00, Nint=068, Nfrac=040)
+Fch=1776.20 (Fvco=3552.40, Nint=068, Nfrac=041)
+Fch=1776.40 (Fvco=3552.80, Nint=068, Nfrac=042)
+Fch=1776.60 (Fvco=3553.20, Nint=068, Nfrac=043)
+Fch=1776.80 (Fvco=3553.60, Nint=068, Nfrac=044)
+Fch=1777.00 (Fvco=3554.00, Nint=068, Nfrac=045)
+Fch=1777.20 (Fvco=3554.40, Nint=068, Nfrac=046)
+Fch=1777.40 (Fvco=3554.80, Nint=068, Nfrac=047)
+Fch=1777.60 (Fvco=3555.20, Nint=068, Nfrac=048)
+Fch=1777.80 (Fvco=3555.60, Nint=068, Nfrac=049)
+Fch=1778.00 (Fvco=3556.00, Nint=068, Nfrac=050)
+Fch=1778.20 (Fvco=3556.40, Nint=068, Nfrac=051)
+Fch=1778.40 (Fvco=3556.80, Nint=068, Nfrac=052)
+Fch=1778.60 (Fvco=3557.20, Nint=068, Nfrac=053)
+Fch=1778.80 (Fvco=3557.60, Nint=068, Nfrac=054)
+Fch=1779.00 (Fvco=3558.00, Nint=068, Nfrac=055)
+Fch=1779.20 (Fvco=3558.40, Nint=068, Nfrac=056)
+Fch=1779.40 (Fvco=3558.80, Nint=068, Nfrac=057)
+Fch=1779.60 (Fvco=3559.20, Nint=068, Nfrac=058)
+Fch=1779.80 (Fvco=3559.60, Nint=068, Nfrac=059)
+Fch=1780.00 (Fvco=3560.00, Nint=068, Nfrac=060)
+Fch=1780.20 (Fvco=3560.40, Nint=068, Nfrac=061)
+Fch=1780.40 (Fvco=3560.80, Nint=068, Nfrac=062)
+Fch=1780.60 (Fvco=3561.20, Nint=068, Nfrac=063)
+Fch=1780.80 (Fvco=3561.60, Nint=068, Nfrac=064)
+Fch=1781.00 (Fvco=3562.00, Nint=068, Nfrac=065)
+Fch=1781.20 (Fvco=3562.40, Nint=068, Nfrac=066)
+Fch=1781.40 (Fvco=3562.80, Nint=068, Nfrac=067)
+Fch=1781.60 (Fvco=3563.20, Nint=068, Nfrac=068)
+Fch=1781.80 (Fvco=3563.60, Nint=068, Nfrac=069)
+Fch=1782.00 (Fvco=3564.00, Nint=068, Nfrac=070)
+Fch=1782.20 (Fvco=3564.40, Nint=068, Nfrac=071)
+Fch=1782.40 (Fvco=3564.80, Nint=068, Nfrac=072)
+Fch=1782.60 (Fvco=3565.20, Nint=068, Nfrac=073)
+Fch=1782.80 (Fvco=3565.60, Nint=068, Nfrac=074)
+Fch=1783.00 (Fvco=3566.00, Nint=068, Nfrac=075)
+Fch=1783.20 (Fvco=3566.40, Nint=068, Nfrac=076)
+Fch=1783.40 (Fvco=3566.80, Nint=068, Nfrac=077)
+Fch=1783.60 (Fvco=3567.20, Nint=068, Nfrac=078)
+Fch=1783.80 (Fvco=3567.60, Nint=068, Nfrac=079)
+Fch=1784.00 (Fvco=3568.00, Nint=068, Nfrac=080)
+Fch=1784.20 (Fvco=3568.40, Nint=068, Nfrac=081)
+Fch=1784.40 (Fvco=3568.80, Nint=068, Nfrac=082)
+Fch=1784.60 (Fvco=3569.20, Nint=068, Nfrac=083)
+Fch=1784.80 (Fvco=3569.60, Nint=068, Nfrac=084)
+Fch=1785.00 (Fvco=3570.00, Nint=068, Nfrac=085)
+Fch=1785.20 (Fvco=3570.40, Nint=068, Nfrac=086)
+Fch=1785.40 (Fvco=3570.80, Nint=068, Nfrac=087)
+Fch=1785.60 (Fvco=3571.20, Nint=068, Nfrac=088)
+Fch=1785.80 (Fvco=3571.60, Nint=068, Nfrac=089)
+Fch=1786.00 (Fvco=3572.00, Nint=068, Nfrac=090)
+Fch=1786.20 (Fvco=3572.40, Nint=068, Nfrac=091)
+Fch=1786.40 (Fvco=3572.80, Nint=068, Nfrac=092)
+Fch=1786.60 (Fvco=3573.20, Nint=068, Nfrac=093)
+Fch=1786.80 (Fvco=3573.60, Nint=068, Nfrac=094)
+Fch=1787.00 (Fvco=3574.00, Nint=068, Nfrac=095)
+Fch=1787.20 (Fvco=3574.40, Nint=068, Nfrac=096)
+Fch=1787.40 (Fvco=3574.80, Nint=068, Nfrac=097)
+Fch=1787.60 (Fvco=3575.20, Nint=068, Nfrac=098)
+Fch=1787.80 (Fvco=3575.60, Nint=068, Nfrac=099)
+Fch=1788.00 (Fvco=3576.00, Nint=068, Nfrac=100)
+Fch=1788.20 (Fvco=3576.40, Nint=068, Nfrac=101)
+Fch=1788.40 (Fvco=3576.80, Nint=068, Nfrac=102)
+Fch=1788.60 (Fvco=3577.20, Nint=068, Nfrac=103)
+Fch=1788.80 (Fvco=3577.60, Nint=068, Nfrac=104)
+Fch=1789.00 (Fvco=3578.00, Nint=068, Nfrac=105)
+Fch=1789.20 (Fvco=3578.40, Nint=068, Nfrac=106)
+Fch=1789.40 (Fvco=3578.80, Nint=068, Nfrac=107)
+Fch=1789.60 (Fvco=3579.20, Nint=068, Nfrac=108)
+Fch=1789.80 (Fvco=3579.60, Nint=068, Nfrac=109)
+Fch=1790.00 (Fvco=3580.00, Nint=068, Nfrac=110)
+Fch=1790.20 (Fvco=3580.40, Nint=068, Nfrac=111)
+Fch=1790.40 (Fvco=3580.80, Nint=068, Nfrac=112)
+Fch=1790.60 (Fvco=3581.20, Nint=068, Nfrac=113)
+Fch=1790.80 (Fvco=3581.60, Nint=068, Nfrac=114)
+Fch=1791.00 (Fvco=3582.00, Nint=068, Nfrac=115)
+Fch=1791.20 (Fvco=3582.40, Nint=068, Nfrac=116)
+Fch=1791.40 (Fvco=3582.80, Nint=068, Nfrac=117)
+Fch=1791.60 (Fvco=3583.20, Nint=068, Nfrac=118)
+Fch=1791.80 (Fvco=3583.60, Nint=068, Nfrac=119)
+Fch=1792.00 (Fvco=3584.00, Nint=068, Nfrac=120)
+Fch=1792.20 (Fvco=3584.40, Nint=068, Nfrac=121)
+Fch=1792.40 (Fvco=3584.80, Nint=068, Nfrac=122)
+Fch=1792.60 (Fvco=3585.20, Nint=068, Nfrac=123)
+Fch=1792.80 (Fvco=3585.60, Nint=068, Nfrac=124)
+Fch=1793.00 (Fvco=3586.00, Nint=068, Nfrac=125)
+Fch=1793.20 (Fvco=3586.40, Nint=068, Nfrac=126)
+Fch=1793.40 (Fvco=3586.80, Nint=068, Nfrac=127)
+Fch=1793.60 (Fvco=3587.20, Nint=068, Nfrac=128)
+Fch=1793.80 (Fvco=3587.60, Nint=068, Nfrac=129)
+Fch=1794.00 (Fvco=3588.00, Nint=068, Nfrac=130)
+Fch=1794.00 (Fvco=3588.00, Nint=069, Nfrac=000)
+Fch=1794.20 (Fvco=3588.40, Nint=069, Nfrac=001)
+Fch=1794.40 (Fvco=3588.80, Nint=069, Nfrac=002)
+Fch=1794.60 (Fvco=3589.20, Nint=069, Nfrac=003)
+Fch=1794.80 (Fvco=3589.60, Nint=069, Nfrac=004)
+Fch=1795.00 (Fvco=3590.00, Nint=069, Nfrac=005)
+Fch=1795.20 (Fvco=3590.40, Nint=069, Nfrac=006)
+Fch=1795.40 (Fvco=3590.80, Nint=069, Nfrac=007)
+Fch=1795.60 (Fvco=3591.20, Nint=069, Nfrac=008)
+Fch=1795.80 (Fvco=3591.60, Nint=069, Nfrac=009)
+Fch=1796.00 (Fvco=3592.00, Nint=069, Nfrac=010)
+Fch=1796.20 (Fvco=3592.40, Nint=069, Nfrac=011)
+Fch=1796.40 (Fvco=3592.80, Nint=069, Nfrac=012)
+Fch=1796.60 (Fvco=3593.20, Nint=069, Nfrac=013)
+Fch=1796.80 (Fvco=3593.60, Nint=069, Nfrac=014)
+Fch=1797.00 (Fvco=3594.00, Nint=069, Nfrac=015)
+Fch=1797.20 (Fvco=3594.40, Nint=069, Nfrac=016)
+Fch=1797.40 (Fvco=3594.80, Nint=069, Nfrac=017)
+Fch=1797.60 (Fvco=3595.20, Nint=069, Nfrac=018)
+Fch=1797.80 (Fvco=3595.60, Nint=069, Nfrac=019)
+Fch=1798.00 (Fvco=3596.00, Nint=069, Nfrac=020)
+Fch=1798.20 (Fvco=3596.40, Nint=069, Nfrac=021)
+Fch=1798.40 (Fvco=3596.80, Nint=069, Nfrac=022)
+Fch=1798.60 (Fvco=3597.20, Nint=069, Nfrac=023)
+Fch=1798.80 (Fvco=3597.60, Nint=069, Nfrac=024)
+Fch=1799.00 (Fvco=3598.00, Nint=069, Nfrac=025)
+Fch=1799.20 (Fvco=3598.40, Nint=069, Nfrac=026)
+Fch=1799.40 (Fvco=3598.80, Nint=069, Nfrac=027)
+Fch=1799.60 (Fvco=3599.20, Nint=069, Nfrac=028)
+Fch=1799.80 (Fvco=3599.60, Nint=069, Nfrac=029)
+Fch=1800.00 (Fvco=3600.00, Nint=069, Nfrac=030)
+Fch=1800.20 (Fvco=3600.40, Nint=069, Nfrac=031)
+Fch=1800.40 (Fvco=3600.80, Nint=069, Nfrac=032)
+Fch=1800.60 (Fvco=3601.20, Nint=069, Nfrac=033)
+Fch=1800.80 (Fvco=3601.60, Nint=069, Nfrac=034)
+Fch=1801.00 (Fvco=3602.00, Nint=069, Nfrac=035)
+Fch=1801.20 (Fvco=3602.40, Nint=069, Nfrac=036)
+Fch=1801.40 (Fvco=3602.80, Nint=069, Nfrac=037)
+Fch=1801.60 (Fvco=3603.20, Nint=069, Nfrac=038)
+Fch=1801.80 (Fvco=3603.60, Nint=069, Nfrac=039)
+Fch=1802.00 (Fvco=3604.00, Nint=069, Nfrac=040)
+Fch=1802.20 (Fvco=3604.40, Nint=069, Nfrac=041)
+Fch=1802.40 (Fvco=3604.80, Nint=069, Nfrac=042)
+Fch=1802.60 (Fvco=3605.20, Nint=069, Nfrac=043)
+Fch=1802.80 (Fvco=3605.60, Nint=069, Nfrac=044)
+Fch=1803.00 (Fvco=3606.00, Nint=069, Nfrac=045)
+Fch=1803.20 (Fvco=3606.40, Nint=069, Nfrac=046)
+Fch=1803.40 (Fvco=3606.80, Nint=069, Nfrac=047)
+Fch=1803.60 (Fvco=3607.20, Nint=069, Nfrac=048)
+Fch=1803.80 (Fvco=3607.60, Nint=069, Nfrac=049)
+Fch=1804.00 (Fvco=3608.00, Nint=069, Nfrac=050)
+Fch=1804.20 (Fvco=3608.40, Nint=069, Nfrac=051)
+Fch=1804.40 (Fvco=3608.80, Nint=069, Nfrac=052)
+Fch=1804.60 (Fvco=3609.20, Nint=069, Nfrac=053)
+Fch=1804.80 (Fvco=3609.60, Nint=069, Nfrac=054)
+Fch=1805.00 (Fvco=3610.00, Nint=069, Nfrac=055)
+Fch=1805.20 (Fvco=3610.40, Nint=069, Nfrac=056)
+Fch=1805.40 (Fvco=3610.80, Nint=069, Nfrac=057)
+Fch=1805.60 (Fvco=3611.20, Nint=069, Nfrac=058)
+Fch=1805.80 (Fvco=3611.60, Nint=069, Nfrac=059)
+Fch=1806.00 (Fvco=3612.00, Nint=069, Nfrac=060)
+Fch=1806.20 (Fvco=3612.40, Nint=069, Nfrac=061)
+Fch=1806.40 (Fvco=3612.80, Nint=069, Nfrac=062)
+Fch=1806.60 (Fvco=3613.20, Nint=069, Nfrac=063)
+Fch=1806.80 (Fvco=3613.60, Nint=069, Nfrac=064)
+Fch=1807.00 (Fvco=3614.00, Nint=069, Nfrac=065)
+Fch=1807.20 (Fvco=3614.40, Nint=069, Nfrac=066)
+Fch=1807.40 (Fvco=3614.80, Nint=069, Nfrac=067)
+Fch=1807.60 (Fvco=3615.20, Nint=069, Nfrac=068)
+Fch=1807.80 (Fvco=3615.60, Nint=069, Nfrac=069)
+Fch=1808.00 (Fvco=3616.00, Nint=069, Nfrac=070)
+Fch=1808.20 (Fvco=3616.40, Nint=069, Nfrac=071)
+Fch=1808.40 (Fvco=3616.80, Nint=069, Nfrac=072)
+Fch=1808.60 (Fvco=3617.20, Nint=069, Nfrac=073)
+Fch=1808.80 (Fvco=3617.60, Nint=069, Nfrac=074)
+Fch=1809.00 (Fvco=3618.00, Nint=069, Nfrac=075)
+Fch=1809.20 (Fvco=3618.40, Nint=069, Nfrac=076)
+Fch=1809.40 (Fvco=3618.80, Nint=069, Nfrac=077)
+Fch=1809.60 (Fvco=3619.20, Nint=069, Nfrac=078)
+Fch=1809.80 (Fvco=3619.60, Nint=069, Nfrac=079)
+Fch=1810.00 (Fvco=3620.00, Nint=069, Nfrac=080)
+Fch=1810.20 (Fvco=3620.40, Nint=069, Nfrac=081)
+Fch=1810.40 (Fvco=3620.80, Nint=069, Nfrac=082)
+Fch=1810.60 (Fvco=3621.20, Nint=069, Nfrac=083)
+Fch=1810.80 (Fvco=3621.60, Nint=069, Nfrac=084)
+Fch=1811.00 (Fvco=3622.00, Nint=069, Nfrac=085)
+Fch=1811.20 (Fvco=3622.40, Nint=069, Nfrac=086)
+Fch=1811.40 (Fvco=3622.80, Nint=069, Nfrac=087)
+Fch=1811.60 (Fvco=3623.20, Nint=069, Nfrac=088)
+Fch=1811.80 (Fvco=3623.60, Nint=069, Nfrac=089)
+Fch=1812.00 (Fvco=3624.00, Nint=069, Nfrac=090)
+Fch=1812.20 (Fvco=3624.40, Nint=069, Nfrac=091)
+Fch=1812.40 (Fvco=3624.80, Nint=069, Nfrac=092)
+Fch=1812.60 (Fvco=3625.20, Nint=069, Nfrac=093)
+Fch=1812.80 (Fvco=3625.60, Nint=069, Nfrac=094)
+Fch=1813.00 (Fvco=3626.00, Nint=069, Nfrac=095)
+Fch=1813.20 (Fvco=3626.40, Nint=069, Nfrac=096)
+Fch=1813.40 (Fvco=3626.80, Nint=069, Nfrac=097)
+Fch=1813.60 (Fvco=3627.20, Nint=069, Nfrac=098)
+Fch=1813.80 (Fvco=3627.60, Nint=069, Nfrac=099)
+Fch=1814.00 (Fvco=3628.00, Nint=069, Nfrac=100)
+Fch=1814.20 (Fvco=3628.40, Nint=069, Nfrac=101)
+Fch=1814.40 (Fvco=3628.80, Nint=069, Nfrac=102)
+Fch=1814.60 (Fvco=3629.20, Nint=069, Nfrac=103)
+Fch=1814.80 (Fvco=3629.60, Nint=069, Nfrac=104)
+Fch=1815.00 (Fvco=3630.00, Nint=069, Nfrac=105)
+Fch=1815.20 (Fvco=3630.40, Nint=069, Nfrac=106)
+Fch=1815.40 (Fvco=3630.80, Nint=069, Nfrac=107)
+Fch=1815.60 (Fvco=3631.20, Nint=069, Nfrac=108)
+Fch=1815.80 (Fvco=3631.60, Nint=069, Nfrac=109)
+Fch=1816.00 (Fvco=3632.00, Nint=069, Nfrac=110)
+Fch=1816.20 (Fvco=3632.40, Nint=069, Nfrac=111)
+Fch=1816.40 (Fvco=3632.80, Nint=069, Nfrac=112)
+Fch=1816.60 (Fvco=3633.20, Nint=069, Nfrac=113)
+Fch=1816.80 (Fvco=3633.60, Nint=069, Nfrac=114)
+Fch=1817.00 (Fvco=3634.00, Nint=069, Nfrac=115)
+Fch=1817.20 (Fvco=3634.40, Nint=069, Nfrac=116)
+Fch=1817.40 (Fvco=3634.80, Nint=069, Nfrac=117)
+Fch=1817.60 (Fvco=3635.20, Nint=069, Nfrac=118)
+Fch=1817.80 (Fvco=3635.60, Nint=069, Nfrac=119)
+Fch=1818.00 (Fvco=3636.00, Nint=069, Nfrac=120)
+Fch=1818.20 (Fvco=3636.40, Nint=069, Nfrac=121)
+Fch=1818.40 (Fvco=3636.80, Nint=069, Nfrac=122)
+Fch=1818.60 (Fvco=3637.20, Nint=069, Nfrac=123)
+Fch=1818.80 (Fvco=3637.60, Nint=069, Nfrac=124)
+Fch=1819.00 (Fvco=3638.00, Nint=069, Nfrac=125)
+Fch=1819.20 (Fvco=3638.40, Nint=069, Nfrac=126)
+Fch=1819.40 (Fvco=3638.80, Nint=069, Nfrac=127)
+Fch=1819.60 (Fvco=3639.20, Nint=069, Nfrac=128)
+Fch=1819.80 (Fvco=3639.60, Nint=069, Nfrac=129)
+Fch=1820.00 (Fvco=3640.00, Nint=069, Nfrac=130)
+Fch=1820.00 (Fvco=3640.00, Nint=070, Nfrac=000)
+Fch=1820.20 (Fvco=3640.40, Nint=070, Nfrac=001)
+Fch=1820.40 (Fvco=3640.80, Nint=070, Nfrac=002)
+Fch=1820.60 (Fvco=3641.20, Nint=070, Nfrac=003)
+Fch=1820.80 (Fvco=3641.60, Nint=070, Nfrac=004)
+Fch=1821.00 (Fvco=3642.00, Nint=070, Nfrac=005)
+Fch=1821.20 (Fvco=3642.40, Nint=070, Nfrac=006)
+Fch=1821.40 (Fvco=3642.80, Nint=070, Nfrac=007)
+Fch=1821.60 (Fvco=3643.20, Nint=070, Nfrac=008)
+Fch=1821.80 (Fvco=3643.60, Nint=070, Nfrac=009)
+Fch=1822.00 (Fvco=3644.00, Nint=070, Nfrac=010)
+Fch=1822.20 (Fvco=3644.40, Nint=070, Nfrac=011)
+Fch=1822.40 (Fvco=3644.80, Nint=070, Nfrac=012)
+Fch=1822.60 (Fvco=3645.20, Nint=070, Nfrac=013)
+Fch=1822.80 (Fvco=3645.60, Nint=070, Nfrac=014)
+Fch=1823.00 (Fvco=3646.00, Nint=070, Nfrac=015)
+Fch=1823.20 (Fvco=3646.40, Nint=070, Nfrac=016)
+Fch=1823.40 (Fvco=3646.80, Nint=070, Nfrac=017)
+Fch=1823.60 (Fvco=3647.20, Nint=070, Nfrac=018)
+Fch=1823.80 (Fvco=3647.60, Nint=070, Nfrac=019)
+Fch=1824.00 (Fvco=3648.00, Nint=070, Nfrac=020)
+Fch=1824.20 (Fvco=3648.40, Nint=070, Nfrac=021)
+Fch=1824.40 (Fvco=3648.80, Nint=070, Nfrac=022)
+Fch=1824.60 (Fvco=3649.20, Nint=070, Nfrac=023)
+Fch=1824.80 (Fvco=3649.60, Nint=070, Nfrac=024)
+Fch=1825.00 (Fvco=3650.00, Nint=070, Nfrac=025)
+Fch=1825.20 (Fvco=3650.40, Nint=070, Nfrac=026)
+Fch=1825.40 (Fvco=3650.80, Nint=070, Nfrac=027)
+Fch=1825.60 (Fvco=3651.20, Nint=070, Nfrac=028)
+Fch=1825.80 (Fvco=3651.60, Nint=070, Nfrac=029)
+Fch=1826.00 (Fvco=3652.00, Nint=070, Nfrac=030)
+Fch=1826.20 (Fvco=3652.40, Nint=070, Nfrac=031)
+Fch=1826.40 (Fvco=3652.80, Nint=070, Nfrac=032)
+Fch=1826.60 (Fvco=3653.20, Nint=070, Nfrac=033)
+Fch=1826.80 (Fvco=3653.60, Nint=070, Nfrac=034)
+Fch=1827.00 (Fvco=3654.00, Nint=070, Nfrac=035)
+Fch=1827.20 (Fvco=3654.40, Nint=070, Nfrac=036)
+Fch=1827.40 (Fvco=3654.80, Nint=070, Nfrac=037)
+Fch=1827.60 (Fvco=3655.20, Nint=070, Nfrac=038)
+Fch=1827.80 (Fvco=3655.60, Nint=070, Nfrac=039)
+Fch=1828.00 (Fvco=3656.00, Nint=070, Nfrac=040)
+Fch=1828.20 (Fvco=3656.40, Nint=070, Nfrac=041)
+Fch=1828.40 (Fvco=3656.80, Nint=070, Nfrac=042)
+Fch=1828.60 (Fvco=3657.20, Nint=070, Nfrac=043)
+Fch=1828.80 (Fvco=3657.60, Nint=070, Nfrac=044)
+Fch=1829.00 (Fvco=3658.00, Nint=070, Nfrac=045)
+Fch=1829.20 (Fvco=3658.40, Nint=070, Nfrac=046)
+Fch=1829.40 (Fvco=3658.80, Nint=070, Nfrac=047)
+Fch=1829.60 (Fvco=3659.20, Nint=070, Nfrac=048)
+Fch=1829.80 (Fvco=3659.60, Nint=070, Nfrac=049)
+Fch=1830.00 (Fvco=3660.00, Nint=070, Nfrac=050)
+Fch=1830.20 (Fvco=3660.40, Nint=070, Nfrac=051)
+Fch=1830.40 (Fvco=3660.80, Nint=070, Nfrac=052)
+Fch=1830.60 (Fvco=3661.20, Nint=070, Nfrac=053)
+Fch=1830.80 (Fvco=3661.60, Nint=070, Nfrac=054)
+Fch=1831.00 (Fvco=3662.00, Nint=070, Nfrac=055)
+Fch=1831.20 (Fvco=3662.40, Nint=070, Nfrac=056)
+Fch=1831.40 (Fvco=3662.80, Nint=070, Nfrac=057)
+Fch=1831.60 (Fvco=3663.20, Nint=070, Nfrac=058)
+Fch=1831.80 (Fvco=3663.60, Nint=070, Nfrac=059)
+Fch=1832.00 (Fvco=3664.00, Nint=070, Nfrac=060)
+Fch=1832.20 (Fvco=3664.40, Nint=070, Nfrac=061)
+Fch=1832.40 (Fvco=3664.80, Nint=070, Nfrac=062)
+Fch=1832.60 (Fvco=3665.20, Nint=070, Nfrac=063)
+Fch=1832.80 (Fvco=3665.60, Nint=070, Nfrac=064)
+Fch=1833.00 (Fvco=3666.00, Nint=070, Nfrac=065)
+Fch=1833.20 (Fvco=3666.40, Nint=070, Nfrac=066)
+Fch=1833.40 (Fvco=3666.80, Nint=070, Nfrac=067)
+Fch=1833.60 (Fvco=3667.20, Nint=070, Nfrac=068)
+Fch=1833.80 (Fvco=3667.60, Nint=070, Nfrac=069)
+Fch=1834.00 (Fvco=3668.00, Nint=070, Nfrac=070)
+Fch=1834.20 (Fvco=3668.40, Nint=070, Nfrac=071)
+Fch=1834.40 (Fvco=3668.80, Nint=070, Nfrac=072)
+Fch=1834.60 (Fvco=3669.20, Nint=070, Nfrac=073)
+Fch=1834.80 (Fvco=3669.60, Nint=070, Nfrac=074)
+Fch=1835.00 (Fvco=3670.00, Nint=070, Nfrac=075)
+Fch=1835.20 (Fvco=3670.40, Nint=070, Nfrac=076)
+Fch=1835.40 (Fvco=3670.80, Nint=070, Nfrac=077)
+Fch=1835.60 (Fvco=3671.20, Nint=070, Nfrac=078)
+Fch=1835.80 (Fvco=3671.60, Nint=070, Nfrac=079)
+Fch=1836.00 (Fvco=3672.00, Nint=070, Nfrac=080)
+Fch=1836.20 (Fvco=3672.40, Nint=070, Nfrac=081)
+Fch=1836.40 (Fvco=3672.80, Nint=070, Nfrac=082)
+Fch=1836.60 (Fvco=3673.20, Nint=070, Nfrac=083)
+Fch=1836.80 (Fvco=3673.60, Nint=070, Nfrac=084)
+Fch=1837.00 (Fvco=3674.00, Nint=070, Nfrac=085)
+Fch=1837.20 (Fvco=3674.40, Nint=070, Nfrac=086)
+Fch=1837.40 (Fvco=3674.80, Nint=070, Nfrac=087)
+Fch=1837.60 (Fvco=3675.20, Nint=070, Nfrac=088)
+Fch=1837.80 (Fvco=3675.60, Nint=070, Nfrac=089)
+Fch=1838.00 (Fvco=3676.00, Nint=070, Nfrac=090)
+Fch=1838.20 (Fvco=3676.40, Nint=070, Nfrac=091)
+Fch=1838.40 (Fvco=3676.80, Nint=070, Nfrac=092)
+Fch=1838.60 (Fvco=3677.20, Nint=070, Nfrac=093)
+Fch=1838.80 (Fvco=3677.60, Nint=070, Nfrac=094)
+Fch=1839.00 (Fvco=3678.00, Nint=070, Nfrac=095)
+Fch=1839.20 (Fvco=3678.40, Nint=070, Nfrac=096)
+Fch=1839.40 (Fvco=3678.80, Nint=070, Nfrac=097)
+Fch=1839.60 (Fvco=3679.20, Nint=070, Nfrac=098)
+Fch=1839.80 (Fvco=3679.60, Nint=070, Nfrac=099)
+Fch=1840.00 (Fvco=3680.00, Nint=070, Nfrac=100)
+Fch=1840.20 (Fvco=3680.40, Nint=070, Nfrac=101)
+Fch=1840.40 (Fvco=3680.80, Nint=070, Nfrac=102)
+Fch=1840.60 (Fvco=3681.20, Nint=070, Nfrac=103)
+Fch=1840.80 (Fvco=3681.60, Nint=070, Nfrac=104)
+Fch=1841.00 (Fvco=3682.00, Nint=070, Nfrac=105)
+Fch=1841.20 (Fvco=3682.40, Nint=070, Nfrac=106)
+Fch=1841.40 (Fvco=3682.80, Nint=070, Nfrac=107)
+Fch=1841.60 (Fvco=3683.20, Nint=070, Nfrac=108)
+Fch=1841.80 (Fvco=3683.60, Nint=070, Nfrac=109)
+Fch=1842.00 (Fvco=3684.00, Nint=070, Nfrac=110)
+Fch=1842.20 (Fvco=3684.40, Nint=070, Nfrac=111)
+Fch=1842.40 (Fvco=3684.80, Nint=070, Nfrac=112)
+Fch=1842.60 (Fvco=3685.20, Nint=070, Nfrac=113)
+Fch=1842.80 (Fvco=3685.60, Nint=070, Nfrac=114)
+Fch=1843.00 (Fvco=3686.00, Nint=070, Nfrac=115)
+Fch=1843.20 (Fvco=3686.40, Nint=070, Nfrac=116)
+Fch=1843.40 (Fvco=3686.80, Nint=070, Nfrac=117)
+Fch=1843.60 (Fvco=3687.20, Nint=070, Nfrac=118)
+Fch=1843.80 (Fvco=3687.60, Nint=070, Nfrac=119)
+Fch=1844.00 (Fvco=3688.00, Nint=070, Nfrac=120)
+Fch=1844.20 (Fvco=3688.40, Nint=070, Nfrac=121)
+Fch=1844.40 (Fvco=3688.80, Nint=070, Nfrac=122)
+Fch=1844.60 (Fvco=3689.20, Nint=070, Nfrac=123)
+Fch=1844.80 (Fvco=3689.60, Nint=070, Nfrac=124)
+Fch=1845.00 (Fvco=3690.00, Nint=070, Nfrac=125)
+Fch=1845.20 (Fvco=3690.40, Nint=070, Nfrac=126)
+Fch=1845.40 (Fvco=3690.80, Nint=070, Nfrac=127)
+Fch=1845.60 (Fvco=3691.20, Nint=070, Nfrac=128)
+Fch=1845.80 (Fvco=3691.60, Nint=070, Nfrac=129)
+Fch=1846.00 (Fvco=3692.00, Nint=070, Nfrac=130)
+Fch=1846.00 (Fvco=3692.00, Nint=071, Nfrac=000)
+Fch=1846.20 (Fvco=3692.40, Nint=071, Nfrac=001)
+Fch=1846.40 (Fvco=3692.80, Nint=071, Nfrac=002)
+Fch=1846.60 (Fvco=3693.20, Nint=071, Nfrac=003)
+Fch=1846.80 (Fvco=3693.60, Nint=071, Nfrac=004)
+Fch=1847.00 (Fvco=3694.00, Nint=071, Nfrac=005)
+Fch=1847.20 (Fvco=3694.40, Nint=071, Nfrac=006)
+Fch=1847.40 (Fvco=3694.80, Nint=071, Nfrac=007)
+Fch=1847.60 (Fvco=3695.20, Nint=071, Nfrac=008)
+Fch=1847.80 (Fvco=3695.60, Nint=071, Nfrac=009)
+Fch=1848.00 (Fvco=3696.00, Nint=071, Nfrac=010)
+Fch=1848.20 (Fvco=3696.40, Nint=071, Nfrac=011)
+Fch=1848.40 (Fvco=3696.80, Nint=071, Nfrac=012)
+Fch=1848.60 (Fvco=3697.20, Nint=071, Nfrac=013)
+Fch=1848.80 (Fvco=3697.60, Nint=071, Nfrac=014)
+Fch=1849.00 (Fvco=3698.00, Nint=071, Nfrac=015)
+Fch=1849.20 (Fvco=3698.40, Nint=071, Nfrac=016)
+Fch=1849.40 (Fvco=3698.80, Nint=071, Nfrac=017)
+Fch=1849.60 (Fvco=3699.20, Nint=071, Nfrac=018)
+Fch=1849.80 (Fvco=3699.60, Nint=071, Nfrac=019)
+Fch=1850.00 (Fvco=3700.00, Nint=071, Nfrac=020)
+Fch=1850.20 (Fvco=3700.40, Nint=071, Nfrac=021)
+Fch=1850.40 (Fvco=3700.80, Nint=071, Nfrac=022)
+Fch=1850.60 (Fvco=3701.20, Nint=071, Nfrac=023)
+Fch=1850.80 (Fvco=3701.60, Nint=071, Nfrac=024)
+Fch=1851.00 (Fvco=3702.00, Nint=071, Nfrac=025)
+Fch=1851.20 (Fvco=3702.40, Nint=071, Nfrac=026)
+Fch=1851.40 (Fvco=3702.80, Nint=071, Nfrac=027)
+Fch=1851.60 (Fvco=3703.20, Nint=071, Nfrac=028)
+Fch=1851.80 (Fvco=3703.60, Nint=071, Nfrac=029)
+Fch=1852.00 (Fvco=3704.00, Nint=071, Nfrac=030)
+Fch=1852.20 (Fvco=3704.40, Nint=071, Nfrac=031)
+Fch=1852.40 (Fvco=3704.80, Nint=071, Nfrac=032)
+Fch=1852.60 (Fvco=3705.20, Nint=071, Nfrac=033)
+Fch=1852.80 (Fvco=3705.60, Nint=071, Nfrac=034)
+Fch=1853.00 (Fvco=3706.00, Nint=071, Nfrac=035)
+Fch=1853.20 (Fvco=3706.40, Nint=071, Nfrac=036)
+Fch=1853.40 (Fvco=3706.80, Nint=071, Nfrac=037)
+Fch=1853.60 (Fvco=3707.20, Nint=071, Nfrac=038)
+Fch=1853.80 (Fvco=3707.60, Nint=071, Nfrac=039)
+Fch=1854.00 (Fvco=3708.00, Nint=071, Nfrac=040)
+Fch=1854.20 (Fvco=3708.40, Nint=071, Nfrac=041)
+Fch=1854.40 (Fvco=3708.80, Nint=071, Nfrac=042)
+Fch=1854.60 (Fvco=3709.20, Nint=071, Nfrac=043)
+Fch=1854.80 (Fvco=3709.60, Nint=071, Nfrac=044)
+Fch=1855.00 (Fvco=3710.00, Nint=071, Nfrac=045)
+Fch=1855.20 (Fvco=3710.40, Nint=071, Nfrac=046)
+Fch=1855.40 (Fvco=3710.80, Nint=071, Nfrac=047)
+Fch=1855.60 (Fvco=3711.20, Nint=071, Nfrac=048)
+Fch=1855.80 (Fvco=3711.60, Nint=071, Nfrac=049)
+Fch=1856.00 (Fvco=3712.00, Nint=071, Nfrac=050)
+Fch=1856.20 (Fvco=3712.40, Nint=071, Nfrac=051)
+Fch=1856.40 (Fvco=3712.80, Nint=071, Nfrac=052)
+Fch=1856.60 (Fvco=3713.20, Nint=071, Nfrac=053)
+Fch=1856.80 (Fvco=3713.60, Nint=071, Nfrac=054)
+Fch=1857.00 (Fvco=3714.00, Nint=071, Nfrac=055)
+Fch=1857.20 (Fvco=3714.40, Nint=071, Nfrac=056)
+Fch=1857.40 (Fvco=3714.80, Nint=071, Nfrac=057)
+Fch=1857.60 (Fvco=3715.20, Nint=071, Nfrac=058)
+Fch=1857.80 (Fvco=3715.60, Nint=071, Nfrac=059)
+Fch=1858.00 (Fvco=3716.00, Nint=071, Nfrac=060)
+Fch=1858.20 (Fvco=3716.40, Nint=071, Nfrac=061)
+Fch=1858.40 (Fvco=3716.80, Nint=071, Nfrac=062)
+Fch=1858.60 (Fvco=3717.20, Nint=071, Nfrac=063)
+Fch=1858.80 (Fvco=3717.60, Nint=071, Nfrac=064)
+Fch=1859.00 (Fvco=3718.00, Nint=071, Nfrac=065)
+Fch=1859.20 (Fvco=3718.40, Nint=071, Nfrac=066)
+Fch=1859.40 (Fvco=3718.80, Nint=071, Nfrac=067)
+Fch=1859.60 (Fvco=3719.20, Nint=071, Nfrac=068)
+Fch=1859.80 (Fvco=3719.60, Nint=071, Nfrac=069)
+Fch=1860.00 (Fvco=3720.00, Nint=071, Nfrac=070)
+Fch=1860.20 (Fvco=3720.40, Nint=071, Nfrac=071)
+Fch=1860.40 (Fvco=3720.80, Nint=071, Nfrac=072)
+Fch=1860.60 (Fvco=3721.20, Nint=071, Nfrac=073)
+Fch=1860.80 (Fvco=3721.60, Nint=071, Nfrac=074)
+Fch=1861.00 (Fvco=3722.00, Nint=071, Nfrac=075)
+Fch=1861.20 (Fvco=3722.40, Nint=071, Nfrac=076)
+Fch=1861.40 (Fvco=3722.80, Nint=071, Nfrac=077)
+Fch=1861.60 (Fvco=3723.20, Nint=071, Nfrac=078)
+Fch=1861.80 (Fvco=3723.60, Nint=071, Nfrac=079)
+Fch=1862.00 (Fvco=3724.00, Nint=071, Nfrac=080)
+Fch=1862.20 (Fvco=3724.40, Nint=071, Nfrac=081)
+Fch=1862.40 (Fvco=3724.80, Nint=071, Nfrac=082)
+Fch=1862.60 (Fvco=3725.20, Nint=071, Nfrac=083)
+Fch=1862.80 (Fvco=3725.60, Nint=071, Nfrac=084)
+Fch=1863.00 (Fvco=3726.00, Nint=071, Nfrac=085)
+Fch=1863.20 (Fvco=3726.40, Nint=071, Nfrac=086)
+Fch=1863.40 (Fvco=3726.80, Nint=071, Nfrac=087)
+Fch=1863.60 (Fvco=3727.20, Nint=071, Nfrac=088)
+Fch=1863.80 (Fvco=3727.60, Nint=071, Nfrac=089)
+Fch=1864.00 (Fvco=3728.00, Nint=071, Nfrac=090)
+Fch=1864.20 (Fvco=3728.40, Nint=071, Nfrac=091)
+Fch=1864.40 (Fvco=3728.80, Nint=071, Nfrac=092)
+Fch=1864.60 (Fvco=3729.20, Nint=071, Nfrac=093)
+Fch=1864.80 (Fvco=3729.60, Nint=071, Nfrac=094)
+Fch=1865.00 (Fvco=3730.00, Nint=071, Nfrac=095)
+Fch=1865.20 (Fvco=3730.40, Nint=071, Nfrac=096)
+Fch=1865.40 (Fvco=3730.80, Nint=071, Nfrac=097)
+Fch=1865.60 (Fvco=3731.20, Nint=071, Nfrac=098)
+Fch=1865.80 (Fvco=3731.60, Nint=071, Nfrac=099)
+Fch=1866.00 (Fvco=3732.00, Nint=071, Nfrac=100)
+Fch=1866.20 (Fvco=3732.40, Nint=071, Nfrac=101)
+Fch=1866.40 (Fvco=3732.80, Nint=071, Nfrac=102)
+Fch=1866.60 (Fvco=3733.20, Nint=071, Nfrac=103)
+Fch=1866.80 (Fvco=3733.60, Nint=071, Nfrac=104)
+Fch=1867.00 (Fvco=3734.00, Nint=071, Nfrac=105)
+Fch=1867.20 (Fvco=3734.40, Nint=071, Nfrac=106)
+Fch=1867.40 (Fvco=3734.80, Nint=071, Nfrac=107)
+Fch=1867.60 (Fvco=3735.20, Nint=071, Nfrac=108)
+Fch=1867.80 (Fvco=3735.60, Nint=071, Nfrac=109)
+Fch=1868.00 (Fvco=3736.00, Nint=071, Nfrac=110)
+Fch=1868.20 (Fvco=3736.40, Nint=071, Nfrac=111)
+Fch=1868.40 (Fvco=3736.80, Nint=071, Nfrac=112)
+Fch=1868.60 (Fvco=3737.20, Nint=071, Nfrac=113)
+Fch=1868.80 (Fvco=3737.60, Nint=071, Nfrac=114)
+Fch=1869.00 (Fvco=3738.00, Nint=071, Nfrac=115)
+Fch=1869.20 (Fvco=3738.40, Nint=071, Nfrac=116)
+Fch=1869.40 (Fvco=3738.80, Nint=071, Nfrac=117)
+Fch=1869.60 (Fvco=3739.20, Nint=071, Nfrac=118)
+Fch=1869.80 (Fvco=3739.60, Nint=071, Nfrac=119)
+Fch=1870.00 (Fvco=3740.00, Nint=071, Nfrac=120)
+Fch=1870.20 (Fvco=3740.40, Nint=071, Nfrac=121)
+Fch=1870.40 (Fvco=3740.80, Nint=071, Nfrac=122)
+Fch=1870.60 (Fvco=3741.20, Nint=071, Nfrac=123)
+Fch=1870.80 (Fvco=3741.60, Nint=071, Nfrac=124)
+Fch=1871.00 (Fvco=3742.00, Nint=071, Nfrac=125)
+Fch=1871.20 (Fvco=3742.40, Nint=071, Nfrac=126)
+Fch=1871.40 (Fvco=3742.80, Nint=071, Nfrac=127)
+Fch=1871.60 (Fvco=3743.20, Nint=071, Nfrac=128)
+Fch=1871.80 (Fvco=3743.60, Nint=071, Nfrac=129)
+Fch=1872.00 (Fvco=3744.00, Nint=071, Nfrac=130)
+Fch=1872.00 (Fvco=3744.00, Nint=072, Nfrac=000)
+Fch=1872.20 (Fvco=3744.40, Nint=072, Nfrac=001)
+Fch=1872.40 (Fvco=3744.80, Nint=072, Nfrac=002)
+Fch=1872.60 (Fvco=3745.20, Nint=072, Nfrac=003)
+Fch=1872.80 (Fvco=3745.60, Nint=072, Nfrac=004)
+Fch=1873.00 (Fvco=3746.00, Nint=072, Nfrac=005)
+Fch=1873.20 (Fvco=3746.40, Nint=072, Nfrac=006)
+Fch=1873.40 (Fvco=3746.80, Nint=072, Nfrac=007)
+Fch=1873.60 (Fvco=3747.20, Nint=072, Nfrac=008)
+Fch=1873.80 (Fvco=3747.60, Nint=072, Nfrac=009)
+Fch=1874.00 (Fvco=3748.00, Nint=072, Nfrac=010)
+Fch=1874.20 (Fvco=3748.40, Nint=072, Nfrac=011)
+Fch=1874.40 (Fvco=3748.80, Nint=072, Nfrac=012)
+Fch=1874.60 (Fvco=3749.20, Nint=072, Nfrac=013)
+Fch=1874.80 (Fvco=3749.60, Nint=072, Nfrac=014)
+Fch=1875.00 (Fvco=3750.00, Nint=072, Nfrac=015)
+Fch=1875.20 (Fvco=3750.40, Nint=072, Nfrac=016)
+Fch=1875.40 (Fvco=3750.80, Nint=072, Nfrac=017)
+Fch=1875.60 (Fvco=3751.20, Nint=072, Nfrac=018)
+Fch=1875.80 (Fvco=3751.60, Nint=072, Nfrac=019)
+Fch=1876.00 (Fvco=3752.00, Nint=072, Nfrac=020)
+Fch=1876.20 (Fvco=3752.40, Nint=072, Nfrac=021)
+Fch=1876.40 (Fvco=3752.80, Nint=072, Nfrac=022)
+Fch=1876.60 (Fvco=3753.20, Nint=072, Nfrac=023)
+Fch=1876.80 (Fvco=3753.60, Nint=072, Nfrac=024)
+Fch=1877.00 (Fvco=3754.00, Nint=072, Nfrac=025)
+Fch=1877.20 (Fvco=3754.40, Nint=072, Nfrac=026)
+Fch=1877.40 (Fvco=3754.80, Nint=072, Nfrac=027)
+Fch=1877.60 (Fvco=3755.20, Nint=072, Nfrac=028)
+Fch=1877.80 (Fvco=3755.60, Nint=072, Nfrac=029)
+Fch=1878.00 (Fvco=3756.00, Nint=072, Nfrac=030)
+Fch=1878.20 (Fvco=3756.40, Nint=072, Nfrac=031)
+Fch=1878.40 (Fvco=3756.80, Nint=072, Nfrac=032)
+Fch=1878.60 (Fvco=3757.20, Nint=072, Nfrac=033)
+Fch=1878.80 (Fvco=3757.60, Nint=072, Nfrac=034)
+Fch=1879.00 (Fvco=3758.00, Nint=072, Nfrac=035)
+Fch=1879.20 (Fvco=3758.40, Nint=072, Nfrac=036)
+Fch=1879.40 (Fvco=3758.80, Nint=072, Nfrac=037)
+Fch=1879.60 (Fvco=3759.20, Nint=072, Nfrac=038)
+Fch=1879.80 (Fvco=3759.60, Nint=072, Nfrac=039)
+Fch=1880.00 (Fvco=3760.00, Nint=072, Nfrac=040)
+Fch=1880.20 (Fvco=3760.40, Nint=072, Nfrac=041)
+Fch=1880.40 (Fvco=3760.80, Nint=072, Nfrac=042)
+Fch=1880.60 (Fvco=3761.20, Nint=072, Nfrac=043)
+Fch=1880.80 (Fvco=3761.60, Nint=072, Nfrac=044)
+Fch=1881.00 (Fvco=3762.00, Nint=072, Nfrac=045)
+Fch=1881.20 (Fvco=3762.40, Nint=072, Nfrac=046)
+Fch=1881.40 (Fvco=3762.80, Nint=072, Nfrac=047)
+Fch=1881.60 (Fvco=3763.20, Nint=072, Nfrac=048)
+Fch=1881.80 (Fvco=3763.60, Nint=072, Nfrac=049)
+Fch=1882.00 (Fvco=3764.00, Nint=072, Nfrac=050)
+Fch=1882.20 (Fvco=3764.40, Nint=072, Nfrac=051)
+Fch=1882.40 (Fvco=3764.80, Nint=072, Nfrac=052)
+Fch=1882.60 (Fvco=3765.20, Nint=072, Nfrac=053)
+Fch=1882.80 (Fvco=3765.60, Nint=072, Nfrac=054)
+Fch=1883.00 (Fvco=3766.00, Nint=072, Nfrac=055)
+Fch=1883.20 (Fvco=3766.40, Nint=072, Nfrac=056)
+Fch=1883.40 (Fvco=3766.80, Nint=072, Nfrac=057)
+Fch=1883.60 (Fvco=3767.20, Nint=072, Nfrac=058)
+Fch=1883.80 (Fvco=3767.60, Nint=072, Nfrac=059)
+Fch=1884.00 (Fvco=3768.00, Nint=072, Nfrac=060)
+Fch=1884.20 (Fvco=3768.40, Nint=072, Nfrac=061)
+Fch=1884.40 (Fvco=3768.80, Nint=072, Nfrac=062)
+Fch=1884.60 (Fvco=3769.20, Nint=072, Nfrac=063)
+Fch=1884.80 (Fvco=3769.60, Nint=072, Nfrac=064)
+Fch=1885.00 (Fvco=3770.00, Nint=072, Nfrac=065)
+Fch=1885.20 (Fvco=3770.40, Nint=072, Nfrac=066)
+Fch=1885.40 (Fvco=3770.80, Nint=072, Nfrac=067)
+Fch=1885.60 (Fvco=3771.20, Nint=072, Nfrac=068)
+Fch=1885.80 (Fvco=3771.60, Nint=072, Nfrac=069)
+Fch=1886.00 (Fvco=3772.00, Nint=072, Nfrac=070)
+Fch=1886.20 (Fvco=3772.40, Nint=072, Nfrac=071)
+Fch=1886.40 (Fvco=3772.80, Nint=072, Nfrac=072)
+Fch=1886.60 (Fvco=3773.20, Nint=072, Nfrac=073)
+Fch=1886.80 (Fvco=3773.60, Nint=072, Nfrac=074)
+Fch=1887.00 (Fvco=3774.00, Nint=072, Nfrac=075)
+Fch=1887.20 (Fvco=3774.40, Nint=072, Nfrac=076)
+Fch=1887.40 (Fvco=3774.80, Nint=072, Nfrac=077)
+Fch=1887.60 (Fvco=3775.20, Nint=072, Nfrac=078)
+Fch=1887.80 (Fvco=3775.60, Nint=072, Nfrac=079)
+Fch=1888.00 (Fvco=3776.00, Nint=072, Nfrac=080)
+Fch=1888.20 (Fvco=3776.40, Nint=072, Nfrac=081)
+Fch=1888.40 (Fvco=3776.80, Nint=072, Nfrac=082)
+Fch=1888.60 (Fvco=3777.20, Nint=072, Nfrac=083)
+Fch=1888.80 (Fvco=3777.60, Nint=072, Nfrac=084)
+Fch=1889.00 (Fvco=3778.00, Nint=072, Nfrac=085)
+Fch=1889.20 (Fvco=3778.40, Nint=072, Nfrac=086)
+Fch=1889.40 (Fvco=3778.80, Nint=072, Nfrac=087)
+Fch=1889.60 (Fvco=3779.20, Nint=072, Nfrac=088)
+Fch=1889.80 (Fvco=3779.60, Nint=072, Nfrac=089)
+Fch=1890.00 (Fvco=3780.00, Nint=072, Nfrac=090)
+Fch=1890.20 (Fvco=3780.40, Nint=072, Nfrac=091)
+Fch=1890.40 (Fvco=3780.80, Nint=072, Nfrac=092)
+Fch=1890.60 (Fvco=3781.20, Nint=072, Nfrac=093)
+Fch=1890.80 (Fvco=3781.60, Nint=072, Nfrac=094)
+Fch=1891.00 (Fvco=3782.00, Nint=072, Nfrac=095)
+Fch=1891.20 (Fvco=3782.40, Nint=072, Nfrac=096)
+Fch=1891.40 (Fvco=3782.80, Nint=072, Nfrac=097)
+Fch=1891.60 (Fvco=3783.20, Nint=072, Nfrac=098)
+Fch=1891.80 (Fvco=3783.60, Nint=072, Nfrac=099)
+Fch=1892.00 (Fvco=3784.00, Nint=072, Nfrac=100)
+Fch=1892.20 (Fvco=3784.40, Nint=072, Nfrac=101)
+Fch=1892.40 (Fvco=3784.80, Nint=072, Nfrac=102)
+Fch=1892.60 (Fvco=3785.20, Nint=072, Nfrac=103)
+Fch=1892.80 (Fvco=3785.60, Nint=072, Nfrac=104)
+Fch=1893.00 (Fvco=3786.00, Nint=072, Nfrac=105)
+Fch=1893.20 (Fvco=3786.40, Nint=072, Nfrac=106)
+Fch=1893.40 (Fvco=3786.80, Nint=072, Nfrac=107)
+Fch=1893.60 (Fvco=3787.20, Nint=072, Nfrac=108)
+Fch=1893.80 (Fvco=3787.60, Nint=072, Nfrac=109)
+Fch=1894.00 (Fvco=3788.00, Nint=072, Nfrac=110)
+Fch=1894.20 (Fvco=3788.40, Nint=072, Nfrac=111)
+Fch=1894.40 (Fvco=3788.80, Nint=072, Nfrac=112)
+Fch=1894.60 (Fvco=3789.20, Nint=072, Nfrac=113)
+Fch=1894.80 (Fvco=3789.60, Nint=072, Nfrac=114)
+Fch=1895.00 (Fvco=3790.00, Nint=072, Nfrac=115)
+Fch=1895.20 (Fvco=3790.40, Nint=072, Nfrac=116)
+Fch=1895.40 (Fvco=3790.80, Nint=072, Nfrac=117)
+Fch=1895.60 (Fvco=3791.20, Nint=072, Nfrac=118)
+Fch=1895.80 (Fvco=3791.60, Nint=072, Nfrac=119)
+Fch=1896.00 (Fvco=3792.00, Nint=072, Nfrac=120)
+Fch=1896.20 (Fvco=3792.40, Nint=072, Nfrac=121)
+Fch=1896.40 (Fvco=3792.80, Nint=072, Nfrac=122)
+Fch=1896.60 (Fvco=3793.20, Nint=072, Nfrac=123)
+Fch=1896.80 (Fvco=3793.60, Nint=072, Nfrac=124)
+Fch=1897.00 (Fvco=3794.00, Nint=072, Nfrac=125)
+Fch=1897.20 (Fvco=3794.40, Nint=072, Nfrac=126)
+Fch=1897.40 (Fvco=3794.80, Nint=072, Nfrac=127)
+Fch=1897.60 (Fvco=3795.20, Nint=072, Nfrac=128)
+Fch=1897.80 (Fvco=3795.60, Nint=072, Nfrac=129)
+Fch=1898.00 (Fvco=3796.00, Nint=072, Nfrac=130)
+Fch=1898.00 (Fvco=3796.00, Nint=073, Nfrac=000)
+Fch=1898.20 (Fvco=3796.40, Nint=073, Nfrac=001)
+Fch=1898.40 (Fvco=3796.80, Nint=073, Nfrac=002)
+Fch=1898.60 (Fvco=3797.20, Nint=073, Nfrac=003)
+Fch=1898.80 (Fvco=3797.60, Nint=073, Nfrac=004)
+Fch=1899.00 (Fvco=3798.00, Nint=073, Nfrac=005)
+Fch=1899.20 (Fvco=3798.40, Nint=073, Nfrac=006)
+Fch=1899.40 (Fvco=3798.80, Nint=073, Nfrac=007)
+Fch=1899.60 (Fvco=3799.20, Nint=073, Nfrac=008)
+Fch=1899.80 (Fvco=3799.60, Nint=073, Nfrac=009)
+Fch=1900.00 (Fvco=3800.00, Nint=073, Nfrac=010)
+Fch=1900.20 (Fvco=3800.40, Nint=073, Nfrac=011)
+Fch=1900.40 (Fvco=3800.80, Nint=073, Nfrac=012)
+Fch=1900.60 (Fvco=3801.20, Nint=073, Nfrac=013)
+Fch=1900.80 (Fvco=3801.60, Nint=073, Nfrac=014)
+Fch=1901.00 (Fvco=3802.00, Nint=073, Nfrac=015)
+Fch=1901.20 (Fvco=3802.40, Nint=073, Nfrac=016)
+Fch=1901.40 (Fvco=3802.80, Nint=073, Nfrac=017)
+Fch=1901.60 (Fvco=3803.20, Nint=073, Nfrac=018)
+Fch=1901.80 (Fvco=3803.60, Nint=073, Nfrac=019)
+Fch=1902.00 (Fvco=3804.00, Nint=073, Nfrac=020)
+Fch=1902.20 (Fvco=3804.40, Nint=073, Nfrac=021)
+Fch=1902.40 (Fvco=3804.80, Nint=073, Nfrac=022)
+Fch=1902.60 (Fvco=3805.20, Nint=073, Nfrac=023)
+Fch=1902.80 (Fvco=3805.60, Nint=073, Nfrac=024)
+Fch=1903.00 (Fvco=3806.00, Nint=073, Nfrac=025)
+Fch=1903.20 (Fvco=3806.40, Nint=073, Nfrac=026)
+Fch=1903.40 (Fvco=3806.80, Nint=073, Nfrac=027)
+Fch=1903.60 (Fvco=3807.20, Nint=073, Nfrac=028)
+Fch=1903.80 (Fvco=3807.60, Nint=073, Nfrac=029)
+Fch=1904.00 (Fvco=3808.00, Nint=073, Nfrac=030)
+Fch=1904.20 (Fvco=3808.40, Nint=073, Nfrac=031)
+Fch=1904.40 (Fvco=3808.80, Nint=073, Nfrac=032)
+Fch=1904.60 (Fvco=3809.20, Nint=073, Nfrac=033)
+Fch=1904.80 (Fvco=3809.60, Nint=073, Nfrac=034)
+Fch=1905.00 (Fvco=3810.00, Nint=073, Nfrac=035)
+Fch=1905.20 (Fvco=3810.40, Nint=073, Nfrac=036)
+Fch=1905.40 (Fvco=3810.80, Nint=073, Nfrac=037)
+Fch=1905.60 (Fvco=3811.20, Nint=073, Nfrac=038)
+Fch=1905.80 (Fvco=3811.60, Nint=073, Nfrac=039)
+Fch=1906.00 (Fvco=3812.00, Nint=073, Nfrac=040)
+Fch=1906.20 (Fvco=3812.40, Nint=073, Nfrac=041)
+Fch=1906.40 (Fvco=3812.80, Nint=073, Nfrac=042)
+Fch=1906.60 (Fvco=3813.20, Nint=073, Nfrac=043)
+Fch=1906.80 (Fvco=3813.60, Nint=073, Nfrac=044)
+Fch=1907.00 (Fvco=3814.00, Nint=073, Nfrac=045)
+Fch=1907.20 (Fvco=3814.40, Nint=073, Nfrac=046)
+Fch=1907.40 (Fvco=3814.80, Nint=073, Nfrac=047)
+Fch=1907.60 (Fvco=3815.20, Nint=073, Nfrac=048)
+Fch=1907.80 (Fvco=3815.60, Nint=073, Nfrac=049)
+Fch=1908.00 (Fvco=3816.00, Nint=073, Nfrac=050)
+Fch=1908.20 (Fvco=3816.40, Nint=073, Nfrac=051)
+Fch=1908.40 (Fvco=3816.80, Nint=073, Nfrac=052)
+Fch=1908.60 (Fvco=3817.20, Nint=073, Nfrac=053)
+Fch=1908.80 (Fvco=3817.60, Nint=073, Nfrac=054)
+Fch=1909.00 (Fvco=3818.00, Nint=073, Nfrac=055)
+Fch=1909.20 (Fvco=3818.40, Nint=073, Nfrac=056)
+Fch=1909.40 (Fvco=3818.80, Nint=073, Nfrac=057)
+Fch=1909.60 (Fvco=3819.20, Nint=073, Nfrac=058)
+Fch=1909.80 (Fvco=3819.60, Nint=073, Nfrac=059)
+Fch=1910.00 (Fvco=3820.00, Nint=073, Nfrac=060)
+Fch=1910.20 (Fvco=3820.40, Nint=073, Nfrac=061)
+Fch=1910.40 (Fvco=3820.80, Nint=073, Nfrac=062)
+Fch=1910.60 (Fvco=3821.20, Nint=073, Nfrac=063)
+Fch=1910.80 (Fvco=3821.60, Nint=073, Nfrac=064)
+Fch=1911.00 (Fvco=3822.00, Nint=073, Nfrac=065)
+Fch=1911.20 (Fvco=3822.40, Nint=073, Nfrac=066)
+Fch=1911.40 (Fvco=3822.80, Nint=073, Nfrac=067)
+Fch=1911.60 (Fvco=3823.20, Nint=073, Nfrac=068)
+Fch=1911.80 (Fvco=3823.60, Nint=073, Nfrac=069)
+Fch=1912.00 (Fvco=3824.00, Nint=073, Nfrac=070)
+Fch=1912.20 (Fvco=3824.40, Nint=073, Nfrac=071)
+Fch=1912.40 (Fvco=3824.80, Nint=073, Nfrac=072)
+Fch=1912.60 (Fvco=3825.20, Nint=073, Nfrac=073)
+Fch=1912.80 (Fvco=3825.60, Nint=073, Nfrac=074)
+Fch=1913.00 (Fvco=3826.00, Nint=073, Nfrac=075)
+Fch=1913.20 (Fvco=3826.40, Nint=073, Nfrac=076)
+Fch=1913.40 (Fvco=3826.80, Nint=073, Nfrac=077)
+Fch=1913.60 (Fvco=3827.20, Nint=073, Nfrac=078)
+Fch=1913.80 (Fvco=3827.60, Nint=073, Nfrac=079)
+Fch=1914.00 (Fvco=3828.00, Nint=073, Nfrac=080)
+Fch=1914.20 (Fvco=3828.40, Nint=073, Nfrac=081)
+Fch=1914.40 (Fvco=3828.80, Nint=073, Nfrac=082)
+Fch=1914.60 (Fvco=3829.20, Nint=073, Nfrac=083)
+Fch=1914.80 (Fvco=3829.60, Nint=073, Nfrac=084)
+Fch=1915.00 (Fvco=3830.00, Nint=073, Nfrac=085)
+Fch=1915.20 (Fvco=3830.40, Nint=073, Nfrac=086)
+Fch=1915.40 (Fvco=3830.80, Nint=073, Nfrac=087)
+Fch=1915.60 (Fvco=3831.20, Nint=073, Nfrac=088)
+Fch=1915.80 (Fvco=3831.60, Nint=073, Nfrac=089)
+Fch=1916.00 (Fvco=3832.00, Nint=073, Nfrac=090)
+Fch=1916.20 (Fvco=3832.40, Nint=073, Nfrac=091)
+Fch=1916.40 (Fvco=3832.80, Nint=073, Nfrac=092)
+Fch=1916.60 (Fvco=3833.20, Nint=073, Nfrac=093)
+Fch=1916.80 (Fvco=3833.60, Nint=073, Nfrac=094)
+Fch=1917.00 (Fvco=3834.00, Nint=073, Nfrac=095)
+Fch=1917.20 (Fvco=3834.40, Nint=073, Nfrac=096)
+Fch=1917.40 (Fvco=3834.80, Nint=073, Nfrac=097)
+Fch=1917.60 (Fvco=3835.20, Nint=073, Nfrac=098)
+Fch=1917.80 (Fvco=3835.60, Nint=073, Nfrac=099)
+Fch=1918.00 (Fvco=3836.00, Nint=073, Nfrac=100)
+Fch=1918.20 (Fvco=3836.40, Nint=073, Nfrac=101)
+Fch=1918.40 (Fvco=3836.80, Nint=073, Nfrac=102)
+Fch=1918.60 (Fvco=3837.20, Nint=073, Nfrac=103)
+Fch=1918.80 (Fvco=3837.60, Nint=073, Nfrac=104)
+Fch=1919.00 (Fvco=3838.00, Nint=073, Nfrac=105)
+Fch=1919.20 (Fvco=3838.40, Nint=073, Nfrac=106)
+Fch=1919.40 (Fvco=3838.80, Nint=073, Nfrac=107)
+Fch=1919.60 (Fvco=3839.20, Nint=073, Nfrac=108)
+Fch=1919.80 (Fvco=3839.60, Nint=073, Nfrac=109)
+Fch=1920.00 (Fvco=3840.00, Nint=073, Nfrac=110)
+Fch=1920.20 (Fvco=3840.40, Nint=073, Nfrac=111)
+Fch=1920.40 (Fvco=3840.80, Nint=073, Nfrac=112)
+Fch=1920.60 (Fvco=3841.20, Nint=073, Nfrac=113)
+Fch=1920.80 (Fvco=3841.60, Nint=073, Nfrac=114)
+Fch=1921.00 (Fvco=3842.00, Nint=073, Nfrac=115)
+Fch=1921.20 (Fvco=3842.40, Nint=073, Nfrac=116)
+Fch=1921.40 (Fvco=3842.80, Nint=073, Nfrac=117)
+Fch=1921.60 (Fvco=3843.20, Nint=073, Nfrac=118)
+Fch=1921.80 (Fvco=3843.60, Nint=073, Nfrac=119)
+Fch=1922.00 (Fvco=3844.00, Nint=073, Nfrac=120)
+Fch=1922.20 (Fvco=3844.40, Nint=073, Nfrac=121)
+Fch=1922.40 (Fvco=3844.80, Nint=073, Nfrac=122)
+Fch=1922.60 (Fvco=3845.20, Nint=073, Nfrac=123)
+Fch=1922.80 (Fvco=3845.60, Nint=073, Nfrac=124)
+Fch=1923.00 (Fvco=3846.00, Nint=073, Nfrac=125)
+Fch=1923.20 (Fvco=3846.40, Nint=073, Nfrac=126)
+Fch=1923.40 (Fvco=3846.80, Nint=073, Nfrac=127)
+Fch=1923.60 (Fvco=3847.20, Nint=073, Nfrac=128)
+Fch=1923.80 (Fvco=3847.60, Nint=073, Nfrac=129)
+Fch=1924.00 (Fvco=3848.00, Nint=073, Nfrac=130)
diff --git a/src/host/rita_pll/rita_pll.pl b/src/host/rita_pll/rita_pll.pl
new file mode 100755
index 00000000..b5b09443
--- /dev/null
+++ b/src/host/rita_pll/rita_pll.pl
@@ -0,0 +1,115 @@
+#!/usr/bin/perl
+
+sub pll_rx($$$$$) {
+	my ($a, $b, $p, $r, $l) = @_;
+
+	return (($b*$p+$a)/($r*$l))*26;
+}
+
+sub pll_rx_low_band($$) {
+	my ($a, $b) = @_;
+	my $p = 64; my $r = 65; my $l = 4;
+	return pll_rx($a, $b, $p, $r, $l);
+}
+
+sub pll_rx_high_band($$) {
+	my ($a, $b) = @_;
+	my $p = 64; my $r = 65; my $l = 2;
+	return pll_rx($a, $b, $p, $r, $l);
+}
+
+sub pll_tx_gsm850_1($$) {
+	my ($a, $b) = @_;
+	my $p = 64; my $r = 55; my $l = 4; my $m = 26;
+
+	my $left = ((1/$l) - (1/$m));
+	my $right = (($b*$p+$a)/$r);
+
+	return $left * $right * 26;
+}
+
+sub pll_tx_gsm850_2($$) {
+	my ($a, $b) = @_;
+	my $p = 64; my $r = 30; my $l = 4; my $m = 52;
+
+	my $left = ((1/$l) - (1/$m));
+	my $right = (($b*$p+$a)/$r);
+
+	return $left * $right * 26;
+}
+
+sub pll_tx_gsm900($$) {
+	my ($a, $b) = @_;
+	my $p = 64; my $r = 35; my $l = 4; my $m = 52;
+
+	my $left = ((1/$l) + (1/$m));
+	my $right = (($b*$p+$a)/$r);
+
+	return $left * $right * 26;
+}
+
+sub pll_tx_high($$) {
+	my ($a, $b) = @_;
+	my $p = 64; my $r = 70; my $l = 2; my $m = 26;
+
+	my $left = ((1/$l) + (1/$m));
+	my $right = (($b*$p+$a)/$r);
+
+	return $left * $right * 26;
+}
+
+sub hr() {
+	printf("======================================================================\n");
+}
+
+printf("PLL Rx Low Band:\n");
+for (my $b = 135; $b <= 150; $b++) {
+#for GSM 810
+#for (my $b = 132; $b <= 150; $b++) {
+	for (my $a = 0; $a <= 62; $a++) {
+		printf("Fout=%4.2f (A=%03u, B=%03u)\n", pll_rx_low_band($a, $b), $a, $b);
+	}
+}
+
+hr();
+printf("PLL Rx High Band:\n");
+for (my $b = 141; $b <= 155; $b++) {
+	for (my $a = 0; $a <= 62; $a++) {
+		printf("Fout=%4.2f (A=%03u, B=%03u)\n", pll_rx_high_band($a, $b), $a, $b);
+	}
+}
+
+hr();
+printf("PLL Tx GSM850_1\n");
+for (my $b = 128; $b <= 130; $b++) {
+#for GSM 810
+#for (my $b = 125; $b <= 130; $b++) {
+	for (my $a = 0; $a <= 62; $a++) {
+		printf("Fout=%4.2f (A=%03u, B=%03u)\n", pll_tx_gsm850_1($a, $b), $a, $b);
+	}
+}
+
+hr();
+printf("PLL Tx GSM850_2\n");
+for (my $b = 65; $b <= 66; $b++) {
+	for (my $a = 0; $a <= 63; $a++) {
+		printf("Fout=%4.2f (A=%03u, B=%03u)\n", pll_tx_gsm850_2($a, $b), $a, $b);
+	}
+}
+
+hr();
+printf("PLL Tx GSM900\n");
+for (my $b = 68; $b <= 71; $b++) {
+	for (my $a = 0; $a <= 63; $a++) {
+		printf("Fout=%4.2f (A=%03u, B=%03u)\n", pll_tx_gsm900($a, $b), $a, $b);
+	}
+}
+
+hr();
+printf("PLL Tx GSM1800/1900\n");
+for (my $b = 133; $b <= 149; $b++) {
+	for (my $a = 0; $a <= 63; $a++) {
+		printf("Fout=%4.2f (A=%03u, B=%03u)\n", pll_tx_high($a, $b), $a, $b);
+	}
+}
+
diff --git a/src/host/rita_pll/rita_pll.txt b/src/host/rita_pll/rita_pll.txt
new file mode 100644
index 00000000..cac2cac2
--- /dev/null
+++ b/src/host/rita_pll/rita_pll.txt
@@ -0,0 +1,3625 @@
+PLL Rx Low Band:
+Fout=864.00 (A=000, B=135)
+Fout=864.10 (A=001, B=135)
+Fout=864.20 (A=002, B=135)
+Fout=864.30 (A=003, B=135)
+Fout=864.40 (A=004, B=135)
+Fout=864.50 (A=005, B=135)
+Fout=864.60 (A=006, B=135)
+Fout=864.70 (A=007, B=135)
+Fout=864.80 (A=008, B=135)
+Fout=864.90 (A=009, B=135)
+Fout=865.00 (A=010, B=135)
+Fout=865.10 (A=011, B=135)
+Fout=865.20 (A=012, B=135)
+Fout=865.30 (A=013, B=135)
+Fout=865.40 (A=014, B=135)
+Fout=865.50 (A=015, B=135)
+Fout=865.60 (A=016, B=135)
+Fout=865.70 (A=017, B=135)
+Fout=865.80 (A=018, B=135)
+Fout=865.90 (A=019, B=135)
+Fout=866.00 (A=020, B=135)
+Fout=866.10 (A=021, B=135)
+Fout=866.20 (A=022, B=135)
+Fout=866.30 (A=023, B=135)
+Fout=866.40 (A=024, B=135)
+Fout=866.50 (A=025, B=135)
+Fout=866.60 (A=026, B=135)
+Fout=866.70 (A=027, B=135)
+Fout=866.80 (A=028, B=135)
+Fout=866.90 (A=029, B=135)
+Fout=867.00 (A=030, B=135)
+Fout=867.10 (A=031, B=135)
+Fout=867.20 (A=032, B=135)
+Fout=867.30 (A=033, B=135)
+Fout=867.40 (A=034, B=135)
+Fout=867.50 (A=035, B=135)
+Fout=867.60 (A=036, B=135)
+Fout=867.70 (A=037, B=135)
+Fout=867.80 (A=038, B=135)
+Fout=867.90 (A=039, B=135)
+Fout=868.00 (A=040, B=135)
+Fout=868.10 (A=041, B=135)
+Fout=868.20 (A=042, B=135)
+Fout=868.30 (A=043, B=135)
+Fout=868.40 (A=044, B=135)
+Fout=868.50 (A=045, B=135)
+Fout=868.60 (A=046, B=135)
+Fout=868.70 (A=047, B=135)
+Fout=868.80 (A=048, B=135)
+Fout=868.90 (A=049, B=135)
+Fout=869.00 (A=050, B=135)
+Fout=869.10 (A=051, B=135)
+Fout=869.20 (A=052, B=135)
+Fout=869.30 (A=053, B=135)
+Fout=869.40 (A=054, B=135)
+Fout=869.50 (A=055, B=135)
+Fout=869.60 (A=056, B=135)
+Fout=869.70 (A=057, B=135)
+Fout=869.80 (A=058, B=135)
+Fout=869.90 (A=059, B=135)
+Fout=870.00 (A=060, B=135)
+Fout=870.10 (A=061, B=135)
+Fout=870.20 (A=062, B=135)
+Fout=870.40 (A=000, B=136)
+Fout=870.50 (A=001, B=136)
+Fout=870.60 (A=002, B=136)
+Fout=870.70 (A=003, B=136)
+Fout=870.80 (A=004, B=136)
+Fout=870.90 (A=005, B=136)
+Fout=871.00 (A=006, B=136)
+Fout=871.10 (A=007, B=136)
+Fout=871.20 (A=008, B=136)
+Fout=871.30 (A=009, B=136)
+Fout=871.40 (A=010, B=136)
+Fout=871.50 (A=011, B=136)
+Fout=871.60 (A=012, B=136)
+Fout=871.70 (A=013, B=136)
+Fout=871.80 (A=014, B=136)
+Fout=871.90 (A=015, B=136)
+Fout=872.00 (A=016, B=136)
+Fout=872.10 (A=017, B=136)
+Fout=872.20 (A=018, B=136)
+Fout=872.30 (A=019, B=136)
+Fout=872.40 (A=020, B=136)
+Fout=872.50 (A=021, B=136)
+Fout=872.60 (A=022, B=136)
+Fout=872.70 (A=023, B=136)
+Fout=872.80 (A=024, B=136)
+Fout=872.90 (A=025, B=136)
+Fout=873.00 (A=026, B=136)
+Fout=873.10 (A=027, B=136)
+Fout=873.20 (A=028, B=136)
+Fout=873.30 (A=029, B=136)
+Fout=873.40 (A=030, B=136)
+Fout=873.50 (A=031, B=136)
+Fout=873.60 (A=032, B=136)
+Fout=873.70 (A=033, B=136)
+Fout=873.80 (A=034, B=136)
+Fout=873.90 (A=035, B=136)
+Fout=874.00 (A=036, B=136)
+Fout=874.10 (A=037, B=136)
+Fout=874.20 (A=038, B=136)
+Fout=874.30 (A=039, B=136)
+Fout=874.40 (A=040, B=136)
+Fout=874.50 (A=041, B=136)
+Fout=874.60 (A=042, B=136)
+Fout=874.70 (A=043, B=136)
+Fout=874.80 (A=044, B=136)
+Fout=874.90 (A=045, B=136)
+Fout=875.00 (A=046, B=136)
+Fout=875.10 (A=047, B=136)
+Fout=875.20 (A=048, B=136)
+Fout=875.30 (A=049, B=136)
+Fout=875.40 (A=050, B=136)
+Fout=875.50 (A=051, B=136)
+Fout=875.60 (A=052, B=136)
+Fout=875.70 (A=053, B=136)
+Fout=875.80 (A=054, B=136)
+Fout=875.90 (A=055, B=136)
+Fout=876.00 (A=056, B=136)
+Fout=876.10 (A=057, B=136)
+Fout=876.20 (A=058, B=136)
+Fout=876.30 (A=059, B=136)
+Fout=876.40 (A=060, B=136)
+Fout=876.50 (A=061, B=136)
+Fout=876.60 (A=062, B=136)
+Fout=876.80 (A=000, B=137)
+Fout=876.90 (A=001, B=137)
+Fout=877.00 (A=002, B=137)
+Fout=877.10 (A=003, B=137)
+Fout=877.20 (A=004, B=137)
+Fout=877.30 (A=005, B=137)
+Fout=877.40 (A=006, B=137)
+Fout=877.50 (A=007, B=137)
+Fout=877.60 (A=008, B=137)
+Fout=877.70 (A=009, B=137)
+Fout=877.80 (A=010, B=137)
+Fout=877.90 (A=011, B=137)
+Fout=878.00 (A=012, B=137)
+Fout=878.10 (A=013, B=137)
+Fout=878.20 (A=014, B=137)
+Fout=878.30 (A=015, B=137)
+Fout=878.40 (A=016, B=137)
+Fout=878.50 (A=017, B=137)
+Fout=878.60 (A=018, B=137)
+Fout=878.70 (A=019, B=137)
+Fout=878.80 (A=020, B=137)
+Fout=878.90 (A=021, B=137)
+Fout=879.00 (A=022, B=137)
+Fout=879.10 (A=023, B=137)
+Fout=879.20 (A=024, B=137)
+Fout=879.30 (A=025, B=137)
+Fout=879.40 (A=026, B=137)
+Fout=879.50 (A=027, B=137)
+Fout=879.60 (A=028, B=137)
+Fout=879.70 (A=029, B=137)
+Fout=879.80 (A=030, B=137)
+Fout=879.90 (A=031, B=137)
+Fout=880.00 (A=032, B=137)
+Fout=880.10 (A=033, B=137)
+Fout=880.20 (A=034, B=137)
+Fout=880.30 (A=035, B=137)
+Fout=880.40 (A=036, B=137)
+Fout=880.50 (A=037, B=137)
+Fout=880.60 (A=038, B=137)
+Fout=880.70 (A=039, B=137)
+Fout=880.80 (A=040, B=137)
+Fout=880.90 (A=041, B=137)
+Fout=881.00 (A=042, B=137)
+Fout=881.10 (A=043, B=137)
+Fout=881.20 (A=044, B=137)
+Fout=881.30 (A=045, B=137)
+Fout=881.40 (A=046, B=137)
+Fout=881.50 (A=047, B=137)
+Fout=881.60 (A=048, B=137)
+Fout=881.70 (A=049, B=137)
+Fout=881.80 (A=050, B=137)
+Fout=881.90 (A=051, B=137)
+Fout=882.00 (A=052, B=137)
+Fout=882.10 (A=053, B=137)
+Fout=882.20 (A=054, B=137)
+Fout=882.30 (A=055, B=137)
+Fout=882.40 (A=056, B=137)
+Fout=882.50 (A=057, B=137)
+Fout=882.60 (A=058, B=137)
+Fout=882.70 (A=059, B=137)
+Fout=882.80 (A=060, B=137)
+Fout=882.90 (A=061, B=137)
+Fout=883.00 (A=062, B=137)
+Fout=883.20 (A=000, B=138)
+Fout=883.30 (A=001, B=138)
+Fout=883.40 (A=002, B=138)
+Fout=883.50 (A=003, B=138)
+Fout=883.60 (A=004, B=138)
+Fout=883.70 (A=005, B=138)
+Fout=883.80 (A=006, B=138)
+Fout=883.90 (A=007, B=138)
+Fout=884.00 (A=008, B=138)
+Fout=884.10 (A=009, B=138)
+Fout=884.20 (A=010, B=138)
+Fout=884.30 (A=011, B=138)
+Fout=884.40 (A=012, B=138)
+Fout=884.50 (A=013, B=138)
+Fout=884.60 (A=014, B=138)
+Fout=884.70 (A=015, B=138)
+Fout=884.80 (A=016, B=138)
+Fout=884.90 (A=017, B=138)
+Fout=885.00 (A=018, B=138)
+Fout=885.10 (A=019, B=138)
+Fout=885.20 (A=020, B=138)
+Fout=885.30 (A=021, B=138)
+Fout=885.40 (A=022, B=138)
+Fout=885.50 (A=023, B=138)
+Fout=885.60 (A=024, B=138)
+Fout=885.70 (A=025, B=138)
+Fout=885.80 (A=026, B=138)
+Fout=885.90 (A=027, B=138)
+Fout=886.00 (A=028, B=138)
+Fout=886.10 (A=029, B=138)
+Fout=886.20 (A=030, B=138)
+Fout=886.30 (A=031, B=138)
+Fout=886.40 (A=032, B=138)
+Fout=886.50 (A=033, B=138)
+Fout=886.60 (A=034, B=138)
+Fout=886.70 (A=035, B=138)
+Fout=886.80 (A=036, B=138)
+Fout=886.90 (A=037, B=138)
+Fout=887.00 (A=038, B=138)
+Fout=887.10 (A=039, B=138)
+Fout=887.20 (A=040, B=138)
+Fout=887.30 (A=041, B=138)
+Fout=887.40 (A=042, B=138)
+Fout=887.50 (A=043, B=138)
+Fout=887.60 (A=044, B=138)
+Fout=887.70 (A=045, B=138)
+Fout=887.80 (A=046, B=138)
+Fout=887.90 (A=047, B=138)
+Fout=888.00 (A=048, B=138)
+Fout=888.10 (A=049, B=138)
+Fout=888.20 (A=050, B=138)
+Fout=888.30 (A=051, B=138)
+Fout=888.40 (A=052, B=138)
+Fout=888.50 (A=053, B=138)
+Fout=888.60 (A=054, B=138)
+Fout=888.70 (A=055, B=138)
+Fout=888.80 (A=056, B=138)
+Fout=888.90 (A=057, B=138)
+Fout=889.00 (A=058, B=138)
+Fout=889.10 (A=059, B=138)
+Fout=889.20 (A=060, B=138)
+Fout=889.30 (A=061, B=138)
+Fout=889.40 (A=062, B=138)
+Fout=889.60 (A=000, B=139)
+Fout=889.70 (A=001, B=139)
+Fout=889.80 (A=002, B=139)
+Fout=889.90 (A=003, B=139)
+Fout=890.00 (A=004, B=139)
+Fout=890.10 (A=005, B=139)
+Fout=890.20 (A=006, B=139)
+Fout=890.30 (A=007, B=139)
+Fout=890.40 (A=008, B=139)
+Fout=890.50 (A=009, B=139)
+Fout=890.60 (A=010, B=139)
+Fout=890.70 (A=011, B=139)
+Fout=890.80 (A=012, B=139)
+Fout=890.90 (A=013, B=139)
+Fout=891.00 (A=014, B=139)
+Fout=891.10 (A=015, B=139)
+Fout=891.20 (A=016, B=139)
+Fout=891.30 (A=017, B=139)
+Fout=891.40 (A=018, B=139)
+Fout=891.50 (A=019, B=139)
+Fout=891.60 (A=020, B=139)
+Fout=891.70 (A=021, B=139)
+Fout=891.80 (A=022, B=139)
+Fout=891.90 (A=023, B=139)
+Fout=892.00 (A=024, B=139)
+Fout=892.10 (A=025, B=139)
+Fout=892.20 (A=026, B=139)
+Fout=892.30 (A=027, B=139)
+Fout=892.40 (A=028, B=139)
+Fout=892.50 (A=029, B=139)
+Fout=892.60 (A=030, B=139)
+Fout=892.70 (A=031, B=139)
+Fout=892.80 (A=032, B=139)
+Fout=892.90 (A=033, B=139)
+Fout=893.00 (A=034, B=139)
+Fout=893.10 (A=035, B=139)
+Fout=893.20 (A=036, B=139)
+Fout=893.30 (A=037, B=139)
+Fout=893.40 (A=038, B=139)
+Fout=893.50 (A=039, B=139)
+Fout=893.60 (A=040, B=139)
+Fout=893.70 (A=041, B=139)
+Fout=893.80 (A=042, B=139)
+Fout=893.90 (A=043, B=139)
+Fout=894.00 (A=044, B=139)
+Fout=894.10 (A=045, B=139)
+Fout=894.20 (A=046, B=139)
+Fout=894.30 (A=047, B=139)
+Fout=894.40 (A=048, B=139)
+Fout=894.50 (A=049, B=139)
+Fout=894.60 (A=050, B=139)
+Fout=894.70 (A=051, B=139)
+Fout=894.80 (A=052, B=139)
+Fout=894.90 (A=053, B=139)
+Fout=895.00 (A=054, B=139)
+Fout=895.10 (A=055, B=139)
+Fout=895.20 (A=056, B=139)
+Fout=895.30 (A=057, B=139)
+Fout=895.40 (A=058, B=139)
+Fout=895.50 (A=059, B=139)
+Fout=895.60 (A=060, B=139)
+Fout=895.70 (A=061, B=139)
+Fout=895.80 (A=062, B=139)
+Fout=896.00 (A=000, B=140)
+Fout=896.10 (A=001, B=140)
+Fout=896.20 (A=002, B=140)
+Fout=896.30 (A=003, B=140)
+Fout=896.40 (A=004, B=140)
+Fout=896.50 (A=005, B=140)
+Fout=896.60 (A=006, B=140)
+Fout=896.70 (A=007, B=140)
+Fout=896.80 (A=008, B=140)
+Fout=896.90 (A=009, B=140)
+Fout=897.00 (A=010, B=140)
+Fout=897.10 (A=011, B=140)
+Fout=897.20 (A=012, B=140)
+Fout=897.30 (A=013, B=140)
+Fout=897.40 (A=014, B=140)
+Fout=897.50 (A=015, B=140)
+Fout=897.60 (A=016, B=140)
+Fout=897.70 (A=017, B=140)
+Fout=897.80 (A=018, B=140)
+Fout=897.90 (A=019, B=140)
+Fout=898.00 (A=020, B=140)
+Fout=898.10 (A=021, B=140)
+Fout=898.20 (A=022, B=140)
+Fout=898.30 (A=023, B=140)
+Fout=898.40 (A=024, B=140)
+Fout=898.50 (A=025, B=140)
+Fout=898.60 (A=026, B=140)
+Fout=898.70 (A=027, B=140)
+Fout=898.80 (A=028, B=140)
+Fout=898.90 (A=029, B=140)
+Fout=899.00 (A=030, B=140)
+Fout=899.10 (A=031, B=140)
+Fout=899.20 (A=032, B=140)
+Fout=899.30 (A=033, B=140)
+Fout=899.40 (A=034, B=140)
+Fout=899.50 (A=035, B=140)
+Fout=899.60 (A=036, B=140)
+Fout=899.70 (A=037, B=140)
+Fout=899.80 (A=038, B=140)
+Fout=899.90 (A=039, B=140)
+Fout=900.00 (A=040, B=140)
+Fout=900.10 (A=041, B=140)
+Fout=900.20 (A=042, B=140)
+Fout=900.30 (A=043, B=140)
+Fout=900.40 (A=044, B=140)
+Fout=900.50 (A=045, B=140)
+Fout=900.60 (A=046, B=140)
+Fout=900.70 (A=047, B=140)
+Fout=900.80 (A=048, B=140)
+Fout=900.90 (A=049, B=140)
+Fout=901.00 (A=050, B=140)
+Fout=901.10 (A=051, B=140)
+Fout=901.20 (A=052, B=140)
+Fout=901.30 (A=053, B=140)
+Fout=901.40 (A=054, B=140)
+Fout=901.50 (A=055, B=140)
+Fout=901.60 (A=056, B=140)
+Fout=901.70 (A=057, B=140)
+Fout=901.80 (A=058, B=140)
+Fout=901.90 (A=059, B=140)
+Fout=902.00 (A=060, B=140)
+Fout=902.10 (A=061, B=140)
+Fout=902.20 (A=062, B=140)
+Fout=902.40 (A=000, B=141)
+Fout=902.50 (A=001, B=141)
+Fout=902.60 (A=002, B=141)
+Fout=902.70 (A=003, B=141)
+Fout=902.80 (A=004, B=141)
+Fout=902.90 (A=005, B=141)
+Fout=903.00 (A=006, B=141)
+Fout=903.10 (A=007, B=141)
+Fout=903.20 (A=008, B=141)
+Fout=903.30 (A=009, B=141)
+Fout=903.40 (A=010, B=141)
+Fout=903.50 (A=011, B=141)
+Fout=903.60 (A=012, B=141)
+Fout=903.70 (A=013, B=141)
+Fout=903.80 (A=014, B=141)
+Fout=903.90 (A=015, B=141)
+Fout=904.00 (A=016, B=141)
+Fout=904.10 (A=017, B=141)
+Fout=904.20 (A=018, B=141)
+Fout=904.30 (A=019, B=141)
+Fout=904.40 (A=020, B=141)
+Fout=904.50 (A=021, B=141)
+Fout=904.60 (A=022, B=141)
+Fout=904.70 (A=023, B=141)
+Fout=904.80 (A=024, B=141)
+Fout=904.90 (A=025, B=141)
+Fout=905.00 (A=026, B=141)
+Fout=905.10 (A=027, B=141)
+Fout=905.20 (A=028, B=141)
+Fout=905.30 (A=029, B=141)
+Fout=905.40 (A=030, B=141)
+Fout=905.50 (A=031, B=141)
+Fout=905.60 (A=032, B=141)
+Fout=905.70 (A=033, B=141)
+Fout=905.80 (A=034, B=141)
+Fout=905.90 (A=035, B=141)
+Fout=906.00 (A=036, B=141)
+Fout=906.10 (A=037, B=141)
+Fout=906.20 (A=038, B=141)
+Fout=906.30 (A=039, B=141)
+Fout=906.40 (A=040, B=141)
+Fout=906.50 (A=041, B=141)
+Fout=906.60 (A=042, B=141)
+Fout=906.70 (A=043, B=141)
+Fout=906.80 (A=044, B=141)
+Fout=906.90 (A=045, B=141)
+Fout=907.00 (A=046, B=141)
+Fout=907.10 (A=047, B=141)
+Fout=907.20 (A=048, B=141)
+Fout=907.30 (A=049, B=141)
+Fout=907.40 (A=050, B=141)
+Fout=907.50 (A=051, B=141)
+Fout=907.60 (A=052, B=141)
+Fout=907.70 (A=053, B=141)
+Fout=907.80 (A=054, B=141)
+Fout=907.90 (A=055, B=141)
+Fout=908.00 (A=056, B=141)
+Fout=908.10 (A=057, B=141)
+Fout=908.20 (A=058, B=141)
+Fout=908.30 (A=059, B=141)
+Fout=908.40 (A=060, B=141)
+Fout=908.50 (A=061, B=141)
+Fout=908.60 (A=062, B=141)
+Fout=908.80 (A=000, B=142)
+Fout=908.90 (A=001, B=142)
+Fout=909.00 (A=002, B=142)
+Fout=909.10 (A=003, B=142)
+Fout=909.20 (A=004, B=142)
+Fout=909.30 (A=005, B=142)
+Fout=909.40 (A=006, B=142)
+Fout=909.50 (A=007, B=142)
+Fout=909.60 (A=008, B=142)
+Fout=909.70 (A=009, B=142)
+Fout=909.80 (A=010, B=142)
+Fout=909.90 (A=011, B=142)
+Fout=910.00 (A=012, B=142)
+Fout=910.10 (A=013, B=142)
+Fout=910.20 (A=014, B=142)
+Fout=910.30 (A=015, B=142)
+Fout=910.40 (A=016, B=142)
+Fout=910.50 (A=017, B=142)
+Fout=910.60 (A=018, B=142)
+Fout=910.70 (A=019, B=142)
+Fout=910.80 (A=020, B=142)
+Fout=910.90 (A=021, B=142)
+Fout=911.00 (A=022, B=142)
+Fout=911.10 (A=023, B=142)
+Fout=911.20 (A=024, B=142)
+Fout=911.30 (A=025, B=142)
+Fout=911.40 (A=026, B=142)
+Fout=911.50 (A=027, B=142)
+Fout=911.60 (A=028, B=142)
+Fout=911.70 (A=029, B=142)
+Fout=911.80 (A=030, B=142)
+Fout=911.90 (A=031, B=142)
+Fout=912.00 (A=032, B=142)
+Fout=912.10 (A=033, B=142)
+Fout=912.20 (A=034, B=142)
+Fout=912.30 (A=035, B=142)
+Fout=912.40 (A=036, B=142)
+Fout=912.50 (A=037, B=142)
+Fout=912.60 (A=038, B=142)
+Fout=912.70 (A=039, B=142)
+Fout=912.80 (A=040, B=142)
+Fout=912.90 (A=041, B=142)
+Fout=913.00 (A=042, B=142)
+Fout=913.10 (A=043, B=142)
+Fout=913.20 (A=044, B=142)
+Fout=913.30 (A=045, B=142)
+Fout=913.40 (A=046, B=142)
+Fout=913.50 (A=047, B=142)
+Fout=913.60 (A=048, B=142)
+Fout=913.70 (A=049, B=142)
+Fout=913.80 (A=050, B=142)
+Fout=913.90 (A=051, B=142)
+Fout=914.00 (A=052, B=142)
+Fout=914.10 (A=053, B=142)
+Fout=914.20 (A=054, B=142)
+Fout=914.30 (A=055, B=142)
+Fout=914.40 (A=056, B=142)
+Fout=914.50 (A=057, B=142)
+Fout=914.60 (A=058, B=142)
+Fout=914.70 (A=059, B=142)
+Fout=914.80 (A=060, B=142)
+Fout=914.90 (A=061, B=142)
+Fout=915.00 (A=062, B=142)
+Fout=915.20 (A=000, B=143)
+Fout=915.30 (A=001, B=143)
+Fout=915.40 (A=002, B=143)
+Fout=915.50 (A=003, B=143)
+Fout=915.60 (A=004, B=143)
+Fout=915.70 (A=005, B=143)
+Fout=915.80 (A=006, B=143)
+Fout=915.90 (A=007, B=143)
+Fout=916.00 (A=008, B=143)
+Fout=916.10 (A=009, B=143)
+Fout=916.20 (A=010, B=143)
+Fout=916.30 (A=011, B=143)
+Fout=916.40 (A=012, B=143)
+Fout=916.50 (A=013, B=143)
+Fout=916.60 (A=014, B=143)
+Fout=916.70 (A=015, B=143)
+Fout=916.80 (A=016, B=143)
+Fout=916.90 (A=017, B=143)
+Fout=917.00 (A=018, B=143)
+Fout=917.10 (A=019, B=143)
+Fout=917.20 (A=020, B=143)
+Fout=917.30 (A=021, B=143)
+Fout=917.40 (A=022, B=143)
+Fout=917.50 (A=023, B=143)
+Fout=917.60 (A=024, B=143)
+Fout=917.70 (A=025, B=143)
+Fout=917.80 (A=026, B=143)
+Fout=917.90 (A=027, B=143)
+Fout=918.00 (A=028, B=143)
+Fout=918.10 (A=029, B=143)
+Fout=918.20 (A=030, B=143)
+Fout=918.30 (A=031, B=143)
+Fout=918.40 (A=032, B=143)
+Fout=918.50 (A=033, B=143)
+Fout=918.60 (A=034, B=143)
+Fout=918.70 (A=035, B=143)
+Fout=918.80 (A=036, B=143)
+Fout=918.90 (A=037, B=143)
+Fout=919.00 (A=038, B=143)
+Fout=919.10 (A=039, B=143)
+Fout=919.20 (A=040, B=143)
+Fout=919.30 (A=041, B=143)
+Fout=919.40 (A=042, B=143)
+Fout=919.50 (A=043, B=143)
+Fout=919.60 (A=044, B=143)
+Fout=919.70 (A=045, B=143)
+Fout=919.80 (A=046, B=143)
+Fout=919.90 (A=047, B=143)
+Fout=920.00 (A=048, B=143)
+Fout=920.10 (A=049, B=143)
+Fout=920.20 (A=050, B=143)
+Fout=920.30 (A=051, B=143)
+Fout=920.40 (A=052, B=143)
+Fout=920.50 (A=053, B=143)
+Fout=920.60 (A=054, B=143)
+Fout=920.70 (A=055, B=143)
+Fout=920.80 (A=056, B=143)
+Fout=920.90 (A=057, B=143)
+Fout=921.00 (A=058, B=143)
+Fout=921.10 (A=059, B=143)
+Fout=921.20 (A=060, B=143)
+Fout=921.30 (A=061, B=143)
+Fout=921.40 (A=062, B=143)
+Fout=921.60 (A=000, B=144)
+Fout=921.70 (A=001, B=144)
+Fout=921.80 (A=002, B=144)
+Fout=921.90 (A=003, B=144)
+Fout=922.00 (A=004, B=144)
+Fout=922.10 (A=005, B=144)
+Fout=922.20 (A=006, B=144)
+Fout=922.30 (A=007, B=144)
+Fout=922.40 (A=008, B=144)
+Fout=922.50 (A=009, B=144)
+Fout=922.60 (A=010, B=144)
+Fout=922.70 (A=011, B=144)
+Fout=922.80 (A=012, B=144)
+Fout=922.90 (A=013, B=144)
+Fout=923.00 (A=014, B=144)
+Fout=923.10 (A=015, B=144)
+Fout=923.20 (A=016, B=144)
+Fout=923.30 (A=017, B=144)
+Fout=923.40 (A=018, B=144)
+Fout=923.50 (A=019, B=144)
+Fout=923.60 (A=020, B=144)
+Fout=923.70 (A=021, B=144)
+Fout=923.80 (A=022, B=144)
+Fout=923.90 (A=023, B=144)
+Fout=924.00 (A=024, B=144)
+Fout=924.10 (A=025, B=144)
+Fout=924.20 (A=026, B=144)
+Fout=924.30 (A=027, B=144)
+Fout=924.40 (A=028, B=144)
+Fout=924.50 (A=029, B=144)
+Fout=924.60 (A=030, B=144)
+Fout=924.70 (A=031, B=144)
+Fout=924.80 (A=032, B=144)
+Fout=924.90 (A=033, B=144)
+Fout=925.00 (A=034, B=144)
+Fout=925.10 (A=035, B=144)
+Fout=925.20 (A=036, B=144)
+Fout=925.30 (A=037, B=144)
+Fout=925.40 (A=038, B=144)
+Fout=925.50 (A=039, B=144)
+Fout=925.60 (A=040, B=144)
+Fout=925.70 (A=041, B=144)
+Fout=925.80 (A=042, B=144)
+Fout=925.90 (A=043, B=144)
+Fout=926.00 (A=044, B=144)
+Fout=926.10 (A=045, B=144)
+Fout=926.20 (A=046, B=144)
+Fout=926.30 (A=047, B=144)
+Fout=926.40 (A=048, B=144)
+Fout=926.50 (A=049, B=144)
+Fout=926.60 (A=050, B=144)
+Fout=926.70 (A=051, B=144)
+Fout=926.80 (A=052, B=144)
+Fout=926.90 (A=053, B=144)
+Fout=927.00 (A=054, B=144)
+Fout=927.10 (A=055, B=144)
+Fout=927.20 (A=056, B=144)
+Fout=927.30 (A=057, B=144)
+Fout=927.40 (A=058, B=144)
+Fout=927.50 (A=059, B=144)
+Fout=927.60 (A=060, B=144)
+Fout=927.70 (A=061, B=144)
+Fout=927.80 (A=062, B=144)
+Fout=928.00 (A=000, B=145)
+Fout=928.10 (A=001, B=145)
+Fout=928.20 (A=002, B=145)
+Fout=928.30 (A=003, B=145)
+Fout=928.40 (A=004, B=145)
+Fout=928.50 (A=005, B=145)
+Fout=928.60 (A=006, B=145)
+Fout=928.70 (A=007, B=145)
+Fout=928.80 (A=008, B=145)
+Fout=928.90 (A=009, B=145)
+Fout=929.00 (A=010, B=145)
+Fout=929.10 (A=011, B=145)
+Fout=929.20 (A=012, B=145)
+Fout=929.30 (A=013, B=145)
+Fout=929.40 (A=014, B=145)
+Fout=929.50 (A=015, B=145)
+Fout=929.60 (A=016, B=145)
+Fout=929.70 (A=017, B=145)
+Fout=929.80 (A=018, B=145)
+Fout=929.90 (A=019, B=145)
+Fout=930.00 (A=020, B=145)
+Fout=930.10 (A=021, B=145)
+Fout=930.20 (A=022, B=145)
+Fout=930.30 (A=023, B=145)
+Fout=930.40 (A=024, B=145)
+Fout=930.50 (A=025, B=145)
+Fout=930.60 (A=026, B=145)
+Fout=930.70 (A=027, B=145)
+Fout=930.80 (A=028, B=145)
+Fout=930.90 (A=029, B=145)
+Fout=931.00 (A=030, B=145)
+Fout=931.10 (A=031, B=145)
+Fout=931.20 (A=032, B=145)
+Fout=931.30 (A=033, B=145)
+Fout=931.40 (A=034, B=145)
+Fout=931.50 (A=035, B=145)
+Fout=931.60 (A=036, B=145)
+Fout=931.70 (A=037, B=145)
+Fout=931.80 (A=038, B=145)
+Fout=931.90 (A=039, B=145)
+Fout=932.00 (A=040, B=145)
+Fout=932.10 (A=041, B=145)
+Fout=932.20 (A=042, B=145)
+Fout=932.30 (A=043, B=145)
+Fout=932.40 (A=044, B=145)
+Fout=932.50 (A=045, B=145)
+Fout=932.60 (A=046, B=145)
+Fout=932.70 (A=047, B=145)
+Fout=932.80 (A=048, B=145)
+Fout=932.90 (A=049, B=145)
+Fout=933.00 (A=050, B=145)
+Fout=933.10 (A=051, B=145)
+Fout=933.20 (A=052, B=145)
+Fout=933.30 (A=053, B=145)
+Fout=933.40 (A=054, B=145)
+Fout=933.50 (A=055, B=145)
+Fout=933.60 (A=056, B=145)
+Fout=933.70 (A=057, B=145)
+Fout=933.80 (A=058, B=145)
+Fout=933.90 (A=059, B=145)
+Fout=934.00 (A=060, B=145)
+Fout=934.10 (A=061, B=145)
+Fout=934.20 (A=062, B=145)
+Fout=934.40 (A=000, B=146)
+Fout=934.50 (A=001, B=146)
+Fout=934.60 (A=002, B=146)
+Fout=934.70 (A=003, B=146)
+Fout=934.80 (A=004, B=146)
+Fout=934.90 (A=005, B=146)
+Fout=935.00 (A=006, B=146)
+Fout=935.10 (A=007, B=146)
+Fout=935.20 (A=008, B=146)
+Fout=935.30 (A=009, B=146)
+Fout=935.40 (A=010, B=146)
+Fout=935.50 (A=011, B=146)
+Fout=935.60 (A=012, B=146)
+Fout=935.70 (A=013, B=146)
+Fout=935.80 (A=014, B=146)
+Fout=935.90 (A=015, B=146)
+Fout=936.00 (A=016, B=146)
+Fout=936.10 (A=017, B=146)
+Fout=936.20 (A=018, B=146)
+Fout=936.30 (A=019, B=146)
+Fout=936.40 (A=020, B=146)
+Fout=936.50 (A=021, B=146)
+Fout=936.60 (A=022, B=146)
+Fout=936.70 (A=023, B=146)
+Fout=936.80 (A=024, B=146)
+Fout=936.90 (A=025, B=146)
+Fout=937.00 (A=026, B=146)
+Fout=937.10 (A=027, B=146)
+Fout=937.20 (A=028, B=146)
+Fout=937.30 (A=029, B=146)
+Fout=937.40 (A=030, B=146)
+Fout=937.50 (A=031, B=146)
+Fout=937.60 (A=032, B=146)
+Fout=937.70 (A=033, B=146)
+Fout=937.80 (A=034, B=146)
+Fout=937.90 (A=035, B=146)
+Fout=938.00 (A=036, B=146)
+Fout=938.10 (A=037, B=146)
+Fout=938.20 (A=038, B=146)
+Fout=938.30 (A=039, B=146)
+Fout=938.40 (A=040, B=146)
+Fout=938.50 (A=041, B=146)
+Fout=938.60 (A=042, B=146)
+Fout=938.70 (A=043, B=146)
+Fout=938.80 (A=044, B=146)
+Fout=938.90 (A=045, B=146)
+Fout=939.00 (A=046, B=146)
+Fout=939.10 (A=047, B=146)
+Fout=939.20 (A=048, B=146)
+Fout=939.30 (A=049, B=146)
+Fout=939.40 (A=050, B=146)
+Fout=939.50 (A=051, B=146)
+Fout=939.60 (A=052, B=146)
+Fout=939.70 (A=053, B=146)
+Fout=939.80 (A=054, B=146)
+Fout=939.90 (A=055, B=146)
+Fout=940.00 (A=056, B=146)
+Fout=940.10 (A=057, B=146)
+Fout=940.20 (A=058, B=146)
+Fout=940.30 (A=059, B=146)
+Fout=940.40 (A=060, B=146)
+Fout=940.50 (A=061, B=146)
+Fout=940.60 (A=062, B=146)
+Fout=940.80 (A=000, B=147)
+Fout=940.90 (A=001, B=147)
+Fout=941.00 (A=002, B=147)
+Fout=941.10 (A=003, B=147)
+Fout=941.20 (A=004, B=147)
+Fout=941.30 (A=005, B=147)
+Fout=941.40 (A=006, B=147)
+Fout=941.50 (A=007, B=147)
+Fout=941.60 (A=008, B=147)
+Fout=941.70 (A=009, B=147)
+Fout=941.80 (A=010, B=147)
+Fout=941.90 (A=011, B=147)
+Fout=942.00 (A=012, B=147)
+Fout=942.10 (A=013, B=147)
+Fout=942.20 (A=014, B=147)
+Fout=942.30 (A=015, B=147)
+Fout=942.40 (A=016, B=147)
+Fout=942.50 (A=017, B=147)
+Fout=942.60 (A=018, B=147)
+Fout=942.70 (A=019, B=147)
+Fout=942.80 (A=020, B=147)
+Fout=942.90 (A=021, B=147)
+Fout=943.00 (A=022, B=147)
+Fout=943.10 (A=023, B=147)
+Fout=943.20 (A=024, B=147)
+Fout=943.30 (A=025, B=147)
+Fout=943.40 (A=026, B=147)
+Fout=943.50 (A=027, B=147)
+Fout=943.60 (A=028, B=147)
+Fout=943.70 (A=029, B=147)
+Fout=943.80 (A=030, B=147)
+Fout=943.90 (A=031, B=147)
+Fout=944.00 (A=032, B=147)
+Fout=944.10 (A=033, B=147)
+Fout=944.20 (A=034, B=147)
+Fout=944.30 (A=035, B=147)
+Fout=944.40 (A=036, B=147)
+Fout=944.50 (A=037, B=147)
+Fout=944.60 (A=038, B=147)
+Fout=944.70 (A=039, B=147)
+Fout=944.80 (A=040, B=147)
+Fout=944.90 (A=041, B=147)
+Fout=945.00 (A=042, B=147)
+Fout=945.10 (A=043, B=147)
+Fout=945.20 (A=044, B=147)
+Fout=945.30 (A=045, B=147)
+Fout=945.40 (A=046, B=147)
+Fout=945.50 (A=047, B=147)
+Fout=945.60 (A=048, B=147)
+Fout=945.70 (A=049, B=147)
+Fout=945.80 (A=050, B=147)
+Fout=945.90 (A=051, B=147)
+Fout=946.00 (A=052, B=147)
+Fout=946.10 (A=053, B=147)
+Fout=946.20 (A=054, B=147)
+Fout=946.30 (A=055, B=147)
+Fout=946.40 (A=056, B=147)
+Fout=946.50 (A=057, B=147)
+Fout=946.60 (A=058, B=147)
+Fout=946.70 (A=059, B=147)
+Fout=946.80 (A=060, B=147)
+Fout=946.90 (A=061, B=147)
+Fout=947.00 (A=062, B=147)
+Fout=947.20 (A=000, B=148)
+Fout=947.30 (A=001, B=148)
+Fout=947.40 (A=002, B=148)
+Fout=947.50 (A=003, B=148)
+Fout=947.60 (A=004, B=148)
+Fout=947.70 (A=005, B=148)
+Fout=947.80 (A=006, B=148)
+Fout=947.90 (A=007, B=148)
+Fout=948.00 (A=008, B=148)
+Fout=948.10 (A=009, B=148)
+Fout=948.20 (A=010, B=148)
+Fout=948.30 (A=011, B=148)
+Fout=948.40 (A=012, B=148)
+Fout=948.50 (A=013, B=148)
+Fout=948.60 (A=014, B=148)
+Fout=948.70 (A=015, B=148)
+Fout=948.80 (A=016, B=148)
+Fout=948.90 (A=017, B=148)
+Fout=949.00 (A=018, B=148)
+Fout=949.10 (A=019, B=148)
+Fout=949.20 (A=020, B=148)
+Fout=949.30 (A=021, B=148)
+Fout=949.40 (A=022, B=148)
+Fout=949.50 (A=023, B=148)
+Fout=949.60 (A=024, B=148)
+Fout=949.70 (A=025, B=148)
+Fout=949.80 (A=026, B=148)
+Fout=949.90 (A=027, B=148)
+Fout=950.00 (A=028, B=148)
+Fout=950.10 (A=029, B=148)
+Fout=950.20 (A=030, B=148)
+Fout=950.30 (A=031, B=148)
+Fout=950.40 (A=032, B=148)
+Fout=950.50 (A=033, B=148)
+Fout=950.60 (A=034, B=148)
+Fout=950.70 (A=035, B=148)
+Fout=950.80 (A=036, B=148)
+Fout=950.90 (A=037, B=148)
+Fout=951.00 (A=038, B=148)
+Fout=951.10 (A=039, B=148)
+Fout=951.20 (A=040, B=148)
+Fout=951.30 (A=041, B=148)
+Fout=951.40 (A=042, B=148)
+Fout=951.50 (A=043, B=148)
+Fout=951.60 (A=044, B=148)
+Fout=951.70 (A=045, B=148)
+Fout=951.80 (A=046, B=148)
+Fout=951.90 (A=047, B=148)
+Fout=952.00 (A=048, B=148)
+Fout=952.10 (A=049, B=148)
+Fout=952.20 (A=050, B=148)
+Fout=952.30 (A=051, B=148)
+Fout=952.40 (A=052, B=148)
+Fout=952.50 (A=053, B=148)
+Fout=952.60 (A=054, B=148)
+Fout=952.70 (A=055, B=148)
+Fout=952.80 (A=056, B=148)
+Fout=952.90 (A=057, B=148)
+Fout=953.00 (A=058, B=148)
+Fout=953.10 (A=059, B=148)
+Fout=953.20 (A=060, B=148)
+Fout=953.30 (A=061, B=148)
+Fout=953.40 (A=062, B=148)
+Fout=953.60 (A=000, B=149)
+Fout=953.70 (A=001, B=149)
+Fout=953.80 (A=002, B=149)
+Fout=953.90 (A=003, B=149)
+Fout=954.00 (A=004, B=149)
+Fout=954.10 (A=005, B=149)
+Fout=954.20 (A=006, B=149)
+Fout=954.30 (A=007, B=149)
+Fout=954.40 (A=008, B=149)
+Fout=954.50 (A=009, B=149)
+Fout=954.60 (A=010, B=149)
+Fout=954.70 (A=011, B=149)
+Fout=954.80 (A=012, B=149)
+Fout=954.90 (A=013, B=149)
+Fout=955.00 (A=014, B=149)
+Fout=955.10 (A=015, B=149)
+Fout=955.20 (A=016, B=149)
+Fout=955.30 (A=017, B=149)
+Fout=955.40 (A=018, B=149)
+Fout=955.50 (A=019, B=149)
+Fout=955.60 (A=020, B=149)
+Fout=955.70 (A=021, B=149)
+Fout=955.80 (A=022, B=149)
+Fout=955.90 (A=023, B=149)
+Fout=956.00 (A=024, B=149)
+Fout=956.10 (A=025, B=149)
+Fout=956.20 (A=026, B=149)
+Fout=956.30 (A=027, B=149)
+Fout=956.40 (A=028, B=149)
+Fout=956.50 (A=029, B=149)
+Fout=956.60 (A=030, B=149)
+Fout=956.70 (A=031, B=149)
+Fout=956.80 (A=032, B=149)
+Fout=956.90 (A=033, B=149)
+Fout=957.00 (A=034, B=149)
+Fout=957.10 (A=035, B=149)
+Fout=957.20 (A=036, B=149)
+Fout=957.30 (A=037, B=149)
+Fout=957.40 (A=038, B=149)
+Fout=957.50 (A=039, B=149)
+Fout=957.60 (A=040, B=149)
+Fout=957.70 (A=041, B=149)
+Fout=957.80 (A=042, B=149)
+Fout=957.90 (A=043, B=149)
+Fout=958.00 (A=044, B=149)
+Fout=958.10 (A=045, B=149)
+Fout=958.20 (A=046, B=149)
+Fout=958.30 (A=047, B=149)
+Fout=958.40 (A=048, B=149)
+Fout=958.50 (A=049, B=149)
+Fout=958.60 (A=050, B=149)
+Fout=958.70 (A=051, B=149)
+Fout=958.80 (A=052, B=149)
+Fout=958.90 (A=053, B=149)
+Fout=959.00 (A=054, B=149)
+Fout=959.10 (A=055, B=149)
+Fout=959.20 (A=056, B=149)
+Fout=959.30 (A=057, B=149)
+Fout=959.40 (A=058, B=149)
+Fout=959.50 (A=059, B=149)
+Fout=959.60 (A=060, B=149)
+Fout=959.70 (A=061, B=149)
+Fout=959.80 (A=062, B=149)
+Fout=960.00 (A=000, B=150)
+Fout=960.10 (A=001, B=150)
+Fout=960.20 (A=002, B=150)
+Fout=960.30 (A=003, B=150)
+Fout=960.40 (A=004, B=150)
+Fout=960.50 (A=005, B=150)
+Fout=960.60 (A=006, B=150)
+Fout=960.70 (A=007, B=150)
+Fout=960.80 (A=008, B=150)
+Fout=960.90 (A=009, B=150)
+Fout=961.00 (A=010, B=150)
+Fout=961.10 (A=011, B=150)
+Fout=961.20 (A=012, B=150)
+Fout=961.30 (A=013, B=150)
+Fout=961.40 (A=014, B=150)
+Fout=961.50 (A=015, B=150)
+Fout=961.60 (A=016, B=150)
+Fout=961.70 (A=017, B=150)
+Fout=961.80 (A=018, B=150)
+Fout=961.90 (A=019, B=150)
+Fout=962.00 (A=020, B=150)
+Fout=962.10 (A=021, B=150)
+Fout=962.20 (A=022, B=150)
+Fout=962.30 (A=023, B=150)
+Fout=962.40 (A=024, B=150)
+Fout=962.50 (A=025, B=150)
+Fout=962.60 (A=026, B=150)
+Fout=962.70 (A=027, B=150)
+Fout=962.80 (A=028, B=150)
+Fout=962.90 (A=029, B=150)
+Fout=963.00 (A=030, B=150)
+Fout=963.10 (A=031, B=150)
+Fout=963.20 (A=032, B=150)
+Fout=963.30 (A=033, B=150)
+Fout=963.40 (A=034, B=150)
+Fout=963.50 (A=035, B=150)
+Fout=963.60 (A=036, B=150)
+Fout=963.70 (A=037, B=150)
+Fout=963.80 (A=038, B=150)
+Fout=963.90 (A=039, B=150)
+Fout=964.00 (A=040, B=150)
+Fout=964.10 (A=041, B=150)
+Fout=964.20 (A=042, B=150)
+Fout=964.30 (A=043, B=150)
+Fout=964.40 (A=044, B=150)
+Fout=964.50 (A=045, B=150)
+Fout=964.60 (A=046, B=150)
+Fout=964.70 (A=047, B=150)
+Fout=964.80 (A=048, B=150)
+Fout=964.90 (A=049, B=150)
+Fout=965.00 (A=050, B=150)
+Fout=965.10 (A=051, B=150)
+Fout=965.20 (A=052, B=150)
+Fout=965.30 (A=053, B=150)
+Fout=965.40 (A=054, B=150)
+Fout=965.50 (A=055, B=150)
+Fout=965.60 (A=056, B=150)
+Fout=965.70 (A=057, B=150)
+Fout=965.80 (A=058, B=150)
+Fout=965.90 (A=059, B=150)
+Fout=966.00 (A=060, B=150)
+Fout=966.10 (A=061, B=150)
+Fout=966.20 (A=062, B=150)
+======================================================================
+PLL Rx High Band:
+Fout=1804.80 (A=000, B=141)
+Fout=1805.00 (A=001, B=141)
+Fout=1805.20 (A=002, B=141)
+Fout=1805.40 (A=003, B=141)
+Fout=1805.60 (A=004, B=141)
+Fout=1805.80 (A=005, B=141)
+Fout=1806.00 (A=006, B=141)
+Fout=1806.20 (A=007, B=141)
+Fout=1806.40 (A=008, B=141)
+Fout=1806.60 (A=009, B=141)
+Fout=1806.80 (A=010, B=141)
+Fout=1807.00 (A=011, B=141)
+Fout=1807.20 (A=012, B=141)
+Fout=1807.40 (A=013, B=141)
+Fout=1807.60 (A=014, B=141)
+Fout=1807.80 (A=015, B=141)
+Fout=1808.00 (A=016, B=141)
+Fout=1808.20 (A=017, B=141)
+Fout=1808.40 (A=018, B=141)
+Fout=1808.60 (A=019, B=141)
+Fout=1808.80 (A=020, B=141)
+Fout=1809.00 (A=021, B=141)
+Fout=1809.20 (A=022, B=141)
+Fout=1809.40 (A=023, B=141)
+Fout=1809.60 (A=024, B=141)
+Fout=1809.80 (A=025, B=141)
+Fout=1810.00 (A=026, B=141)
+Fout=1810.20 (A=027, B=141)
+Fout=1810.40 (A=028, B=141)
+Fout=1810.60 (A=029, B=141)
+Fout=1810.80 (A=030, B=141)
+Fout=1811.00 (A=031, B=141)
+Fout=1811.20 (A=032, B=141)
+Fout=1811.40 (A=033, B=141)
+Fout=1811.60 (A=034, B=141)
+Fout=1811.80 (A=035, B=141)
+Fout=1812.00 (A=036, B=141)
+Fout=1812.20 (A=037, B=141)
+Fout=1812.40 (A=038, B=141)
+Fout=1812.60 (A=039, B=141)
+Fout=1812.80 (A=040, B=141)
+Fout=1813.00 (A=041, B=141)
+Fout=1813.20 (A=042, B=141)
+Fout=1813.40 (A=043, B=141)
+Fout=1813.60 (A=044, B=141)
+Fout=1813.80 (A=045, B=141)
+Fout=1814.00 (A=046, B=141)
+Fout=1814.20 (A=047, B=141)
+Fout=1814.40 (A=048, B=141)
+Fout=1814.60 (A=049, B=141)
+Fout=1814.80 (A=050, B=141)
+Fout=1815.00 (A=051, B=141)
+Fout=1815.20 (A=052, B=141)
+Fout=1815.40 (A=053, B=141)
+Fout=1815.60 (A=054, B=141)
+Fout=1815.80 (A=055, B=141)
+Fout=1816.00 (A=056, B=141)
+Fout=1816.20 (A=057, B=141)
+Fout=1816.40 (A=058, B=141)
+Fout=1816.60 (A=059, B=141)
+Fout=1816.80 (A=060, B=141)
+Fout=1817.00 (A=061, B=141)
+Fout=1817.20 (A=062, B=141)
+Fout=1817.60 (A=000, B=142)
+Fout=1817.80 (A=001, B=142)
+Fout=1818.00 (A=002, B=142)
+Fout=1818.20 (A=003, B=142)
+Fout=1818.40 (A=004, B=142)
+Fout=1818.60 (A=005, B=142)
+Fout=1818.80 (A=006, B=142)
+Fout=1819.00 (A=007, B=142)
+Fout=1819.20 (A=008, B=142)
+Fout=1819.40 (A=009, B=142)
+Fout=1819.60 (A=010, B=142)
+Fout=1819.80 (A=011, B=142)
+Fout=1820.00 (A=012, B=142)
+Fout=1820.20 (A=013, B=142)
+Fout=1820.40 (A=014, B=142)
+Fout=1820.60 (A=015, B=142)
+Fout=1820.80 (A=016, B=142)
+Fout=1821.00 (A=017, B=142)
+Fout=1821.20 (A=018, B=142)
+Fout=1821.40 (A=019, B=142)
+Fout=1821.60 (A=020, B=142)
+Fout=1821.80 (A=021, B=142)
+Fout=1822.00 (A=022, B=142)
+Fout=1822.20 (A=023, B=142)
+Fout=1822.40 (A=024, B=142)
+Fout=1822.60 (A=025, B=142)
+Fout=1822.80 (A=026, B=142)
+Fout=1823.00 (A=027, B=142)
+Fout=1823.20 (A=028, B=142)
+Fout=1823.40 (A=029, B=142)
+Fout=1823.60 (A=030, B=142)
+Fout=1823.80 (A=031, B=142)
+Fout=1824.00 (A=032, B=142)
+Fout=1824.20 (A=033, B=142)
+Fout=1824.40 (A=034, B=142)
+Fout=1824.60 (A=035, B=142)
+Fout=1824.80 (A=036, B=142)
+Fout=1825.00 (A=037, B=142)
+Fout=1825.20 (A=038, B=142)
+Fout=1825.40 (A=039, B=142)
+Fout=1825.60 (A=040, B=142)
+Fout=1825.80 (A=041, B=142)
+Fout=1826.00 (A=042, B=142)
+Fout=1826.20 (A=043, B=142)
+Fout=1826.40 (A=044, B=142)
+Fout=1826.60 (A=045, B=142)
+Fout=1826.80 (A=046, B=142)
+Fout=1827.00 (A=047, B=142)
+Fout=1827.20 (A=048, B=142)
+Fout=1827.40 (A=049, B=142)
+Fout=1827.60 (A=050, B=142)
+Fout=1827.80 (A=051, B=142)
+Fout=1828.00 (A=052, B=142)
+Fout=1828.20 (A=053, B=142)
+Fout=1828.40 (A=054, B=142)
+Fout=1828.60 (A=055, B=142)
+Fout=1828.80 (A=056, B=142)
+Fout=1829.00 (A=057, B=142)
+Fout=1829.20 (A=058, B=142)
+Fout=1829.40 (A=059, B=142)
+Fout=1829.60 (A=060, B=142)
+Fout=1829.80 (A=061, B=142)
+Fout=1830.00 (A=062, B=142)
+Fout=1830.40 (A=000, B=143)
+Fout=1830.60 (A=001, B=143)
+Fout=1830.80 (A=002, B=143)
+Fout=1831.00 (A=003, B=143)
+Fout=1831.20 (A=004, B=143)
+Fout=1831.40 (A=005, B=143)
+Fout=1831.60 (A=006, B=143)
+Fout=1831.80 (A=007, B=143)
+Fout=1832.00 (A=008, B=143)
+Fout=1832.20 (A=009, B=143)
+Fout=1832.40 (A=010, B=143)
+Fout=1832.60 (A=011, B=143)
+Fout=1832.80 (A=012, B=143)
+Fout=1833.00 (A=013, B=143)
+Fout=1833.20 (A=014, B=143)
+Fout=1833.40 (A=015, B=143)
+Fout=1833.60 (A=016, B=143)
+Fout=1833.80 (A=017, B=143)
+Fout=1834.00 (A=018, B=143)
+Fout=1834.20 (A=019, B=143)
+Fout=1834.40 (A=020, B=143)
+Fout=1834.60 (A=021, B=143)
+Fout=1834.80 (A=022, B=143)
+Fout=1835.00 (A=023, B=143)
+Fout=1835.20 (A=024, B=143)
+Fout=1835.40 (A=025, B=143)
+Fout=1835.60 (A=026, B=143)
+Fout=1835.80 (A=027, B=143)
+Fout=1836.00 (A=028, B=143)
+Fout=1836.20 (A=029, B=143)
+Fout=1836.40 (A=030, B=143)
+Fout=1836.60 (A=031, B=143)
+Fout=1836.80 (A=032, B=143)
+Fout=1837.00 (A=033, B=143)
+Fout=1837.20 (A=034, B=143)
+Fout=1837.40 (A=035, B=143)
+Fout=1837.60 (A=036, B=143)
+Fout=1837.80 (A=037, B=143)
+Fout=1838.00 (A=038, B=143)
+Fout=1838.20 (A=039, B=143)
+Fout=1838.40 (A=040, B=143)
+Fout=1838.60 (A=041, B=143)
+Fout=1838.80 (A=042, B=143)
+Fout=1839.00 (A=043, B=143)
+Fout=1839.20 (A=044, B=143)
+Fout=1839.40 (A=045, B=143)
+Fout=1839.60 (A=046, B=143)
+Fout=1839.80 (A=047, B=143)
+Fout=1840.00 (A=048, B=143)
+Fout=1840.20 (A=049, B=143)
+Fout=1840.40 (A=050, B=143)
+Fout=1840.60 (A=051, B=143)
+Fout=1840.80 (A=052, B=143)
+Fout=1841.00 (A=053, B=143)
+Fout=1841.20 (A=054, B=143)
+Fout=1841.40 (A=055, B=143)
+Fout=1841.60 (A=056, B=143)
+Fout=1841.80 (A=057, B=143)
+Fout=1842.00 (A=058, B=143)
+Fout=1842.20 (A=059, B=143)
+Fout=1842.40 (A=060, B=143)
+Fout=1842.60 (A=061, B=143)
+Fout=1842.80 (A=062, B=143)
+Fout=1843.20 (A=000, B=144)
+Fout=1843.40 (A=001, B=144)
+Fout=1843.60 (A=002, B=144)
+Fout=1843.80 (A=003, B=144)
+Fout=1844.00 (A=004, B=144)
+Fout=1844.20 (A=005, B=144)
+Fout=1844.40 (A=006, B=144)
+Fout=1844.60 (A=007, B=144)
+Fout=1844.80 (A=008, B=144)
+Fout=1845.00 (A=009, B=144)
+Fout=1845.20 (A=010, B=144)
+Fout=1845.40 (A=011, B=144)
+Fout=1845.60 (A=012, B=144)
+Fout=1845.80 (A=013, B=144)
+Fout=1846.00 (A=014, B=144)
+Fout=1846.20 (A=015, B=144)
+Fout=1846.40 (A=016, B=144)
+Fout=1846.60 (A=017, B=144)
+Fout=1846.80 (A=018, B=144)
+Fout=1847.00 (A=019, B=144)
+Fout=1847.20 (A=020, B=144)
+Fout=1847.40 (A=021, B=144)
+Fout=1847.60 (A=022, B=144)
+Fout=1847.80 (A=023, B=144)
+Fout=1848.00 (A=024, B=144)
+Fout=1848.20 (A=025, B=144)
+Fout=1848.40 (A=026, B=144)
+Fout=1848.60 (A=027, B=144)
+Fout=1848.80 (A=028, B=144)
+Fout=1849.00 (A=029, B=144)
+Fout=1849.20 (A=030, B=144)
+Fout=1849.40 (A=031, B=144)
+Fout=1849.60 (A=032, B=144)
+Fout=1849.80 (A=033, B=144)
+Fout=1850.00 (A=034, B=144)
+Fout=1850.20 (A=035, B=144)
+Fout=1850.40 (A=036, B=144)
+Fout=1850.60 (A=037, B=144)
+Fout=1850.80 (A=038, B=144)
+Fout=1851.00 (A=039, B=144)
+Fout=1851.20 (A=040, B=144)
+Fout=1851.40 (A=041, B=144)
+Fout=1851.60 (A=042, B=144)
+Fout=1851.80 (A=043, B=144)
+Fout=1852.00 (A=044, B=144)
+Fout=1852.20 (A=045, B=144)
+Fout=1852.40 (A=046, B=144)
+Fout=1852.60 (A=047, B=144)
+Fout=1852.80 (A=048, B=144)
+Fout=1853.00 (A=049, B=144)
+Fout=1853.20 (A=050, B=144)
+Fout=1853.40 (A=051, B=144)
+Fout=1853.60 (A=052, B=144)
+Fout=1853.80 (A=053, B=144)
+Fout=1854.00 (A=054, B=144)
+Fout=1854.20 (A=055, B=144)
+Fout=1854.40 (A=056, B=144)
+Fout=1854.60 (A=057, B=144)
+Fout=1854.80 (A=058, B=144)
+Fout=1855.00 (A=059, B=144)
+Fout=1855.20 (A=060, B=144)
+Fout=1855.40 (A=061, B=144)
+Fout=1855.60 (A=062, B=144)
+Fout=1856.00 (A=000, B=145)
+Fout=1856.20 (A=001, B=145)
+Fout=1856.40 (A=002, B=145)
+Fout=1856.60 (A=003, B=145)
+Fout=1856.80 (A=004, B=145)
+Fout=1857.00 (A=005, B=145)
+Fout=1857.20 (A=006, B=145)
+Fout=1857.40 (A=007, B=145)
+Fout=1857.60 (A=008, B=145)
+Fout=1857.80 (A=009, B=145)
+Fout=1858.00 (A=010, B=145)
+Fout=1858.20 (A=011, B=145)
+Fout=1858.40 (A=012, B=145)
+Fout=1858.60 (A=013, B=145)
+Fout=1858.80 (A=014, B=145)
+Fout=1859.00 (A=015, B=145)
+Fout=1859.20 (A=016, B=145)
+Fout=1859.40 (A=017, B=145)
+Fout=1859.60 (A=018, B=145)
+Fout=1859.80 (A=019, B=145)
+Fout=1860.00 (A=020, B=145)
+Fout=1860.20 (A=021, B=145)
+Fout=1860.40 (A=022, B=145)
+Fout=1860.60 (A=023, B=145)
+Fout=1860.80 (A=024, B=145)
+Fout=1861.00 (A=025, B=145)
+Fout=1861.20 (A=026, B=145)
+Fout=1861.40 (A=027, B=145)
+Fout=1861.60 (A=028, B=145)
+Fout=1861.80 (A=029, B=145)
+Fout=1862.00 (A=030, B=145)
+Fout=1862.20 (A=031, B=145)
+Fout=1862.40 (A=032, B=145)
+Fout=1862.60 (A=033, B=145)
+Fout=1862.80 (A=034, B=145)
+Fout=1863.00 (A=035, B=145)
+Fout=1863.20 (A=036, B=145)
+Fout=1863.40 (A=037, B=145)
+Fout=1863.60 (A=038, B=145)
+Fout=1863.80 (A=039, B=145)
+Fout=1864.00 (A=040, B=145)
+Fout=1864.20 (A=041, B=145)
+Fout=1864.40 (A=042, B=145)
+Fout=1864.60 (A=043, B=145)
+Fout=1864.80 (A=044, B=145)
+Fout=1865.00 (A=045, B=145)
+Fout=1865.20 (A=046, B=145)
+Fout=1865.40 (A=047, B=145)
+Fout=1865.60 (A=048, B=145)
+Fout=1865.80 (A=049, B=145)
+Fout=1866.00 (A=050, B=145)
+Fout=1866.20 (A=051, B=145)
+Fout=1866.40 (A=052, B=145)
+Fout=1866.60 (A=053, B=145)
+Fout=1866.80 (A=054, B=145)
+Fout=1867.00 (A=055, B=145)
+Fout=1867.20 (A=056, B=145)
+Fout=1867.40 (A=057, B=145)
+Fout=1867.60 (A=058, B=145)
+Fout=1867.80 (A=059, B=145)
+Fout=1868.00 (A=060, B=145)
+Fout=1868.20 (A=061, B=145)
+Fout=1868.40 (A=062, B=145)
+Fout=1868.80 (A=000, B=146)
+Fout=1869.00 (A=001, B=146)
+Fout=1869.20 (A=002, B=146)
+Fout=1869.40 (A=003, B=146)
+Fout=1869.60 (A=004, B=146)
+Fout=1869.80 (A=005, B=146)
+Fout=1870.00 (A=006, B=146)
+Fout=1870.20 (A=007, B=146)
+Fout=1870.40 (A=008, B=146)
+Fout=1870.60 (A=009, B=146)
+Fout=1870.80 (A=010, B=146)
+Fout=1871.00 (A=011, B=146)
+Fout=1871.20 (A=012, B=146)
+Fout=1871.40 (A=013, B=146)
+Fout=1871.60 (A=014, B=146)
+Fout=1871.80 (A=015, B=146)
+Fout=1872.00 (A=016, B=146)
+Fout=1872.20 (A=017, B=146)
+Fout=1872.40 (A=018, B=146)
+Fout=1872.60 (A=019, B=146)
+Fout=1872.80 (A=020, B=146)
+Fout=1873.00 (A=021, B=146)
+Fout=1873.20 (A=022, B=146)
+Fout=1873.40 (A=023, B=146)
+Fout=1873.60 (A=024, B=146)
+Fout=1873.80 (A=025, B=146)
+Fout=1874.00 (A=026, B=146)
+Fout=1874.20 (A=027, B=146)
+Fout=1874.40 (A=028, B=146)
+Fout=1874.60 (A=029, B=146)
+Fout=1874.80 (A=030, B=146)
+Fout=1875.00 (A=031, B=146)
+Fout=1875.20 (A=032, B=146)
+Fout=1875.40 (A=033, B=146)
+Fout=1875.60 (A=034, B=146)
+Fout=1875.80 (A=035, B=146)
+Fout=1876.00 (A=036, B=146)
+Fout=1876.20 (A=037, B=146)
+Fout=1876.40 (A=038, B=146)
+Fout=1876.60 (A=039, B=146)
+Fout=1876.80 (A=040, B=146)
+Fout=1877.00 (A=041, B=146)
+Fout=1877.20 (A=042, B=146)
+Fout=1877.40 (A=043, B=146)
+Fout=1877.60 (A=044, B=146)
+Fout=1877.80 (A=045, B=146)
+Fout=1878.00 (A=046, B=146)
+Fout=1878.20 (A=047, B=146)
+Fout=1878.40 (A=048, B=146)
+Fout=1878.60 (A=049, B=146)
+Fout=1878.80 (A=050, B=146)
+Fout=1879.00 (A=051, B=146)
+Fout=1879.20 (A=052, B=146)
+Fout=1879.40 (A=053, B=146)
+Fout=1879.60 (A=054, B=146)
+Fout=1879.80 (A=055, B=146)
+Fout=1880.00 (A=056, B=146)
+Fout=1880.20 (A=057, B=146)
+Fout=1880.40 (A=058, B=146)
+Fout=1880.60 (A=059, B=146)
+Fout=1880.80 (A=060, B=146)
+Fout=1881.00 (A=061, B=146)
+Fout=1881.20 (A=062, B=146)
+Fout=1881.60 (A=000, B=147)
+Fout=1881.80 (A=001, B=147)
+Fout=1882.00 (A=002, B=147)
+Fout=1882.20 (A=003, B=147)
+Fout=1882.40 (A=004, B=147)
+Fout=1882.60 (A=005, B=147)
+Fout=1882.80 (A=006, B=147)
+Fout=1883.00 (A=007, B=147)
+Fout=1883.20 (A=008, B=147)
+Fout=1883.40 (A=009, B=147)
+Fout=1883.60 (A=010, B=147)
+Fout=1883.80 (A=011, B=147)
+Fout=1884.00 (A=012, B=147)
+Fout=1884.20 (A=013, B=147)
+Fout=1884.40 (A=014, B=147)
+Fout=1884.60 (A=015, B=147)
+Fout=1884.80 (A=016, B=147)
+Fout=1885.00 (A=017, B=147)
+Fout=1885.20 (A=018, B=147)
+Fout=1885.40 (A=019, B=147)
+Fout=1885.60 (A=020, B=147)
+Fout=1885.80 (A=021, B=147)
+Fout=1886.00 (A=022, B=147)
+Fout=1886.20 (A=023, B=147)
+Fout=1886.40 (A=024, B=147)
+Fout=1886.60 (A=025, B=147)
+Fout=1886.80 (A=026, B=147)
+Fout=1887.00 (A=027, B=147)
+Fout=1887.20 (A=028, B=147)
+Fout=1887.40 (A=029, B=147)
+Fout=1887.60 (A=030, B=147)
+Fout=1887.80 (A=031, B=147)
+Fout=1888.00 (A=032, B=147)
+Fout=1888.20 (A=033, B=147)
+Fout=1888.40 (A=034, B=147)
+Fout=1888.60 (A=035, B=147)
+Fout=1888.80 (A=036, B=147)
+Fout=1889.00 (A=037, B=147)
+Fout=1889.20 (A=038, B=147)
+Fout=1889.40 (A=039, B=147)
+Fout=1889.60 (A=040, B=147)
+Fout=1889.80 (A=041, B=147)
+Fout=1890.00 (A=042, B=147)
+Fout=1890.20 (A=043, B=147)
+Fout=1890.40 (A=044, B=147)
+Fout=1890.60 (A=045, B=147)
+Fout=1890.80 (A=046, B=147)
+Fout=1891.00 (A=047, B=147)
+Fout=1891.20 (A=048, B=147)
+Fout=1891.40 (A=049, B=147)
+Fout=1891.60 (A=050, B=147)
+Fout=1891.80 (A=051, B=147)
+Fout=1892.00 (A=052, B=147)
+Fout=1892.20 (A=053, B=147)
+Fout=1892.40 (A=054, B=147)
+Fout=1892.60 (A=055, B=147)
+Fout=1892.80 (A=056, B=147)
+Fout=1893.00 (A=057, B=147)
+Fout=1893.20 (A=058, B=147)
+Fout=1893.40 (A=059, B=147)
+Fout=1893.60 (A=060, B=147)
+Fout=1893.80 (A=061, B=147)
+Fout=1894.00 (A=062, B=147)
+Fout=1894.40 (A=000, B=148)
+Fout=1894.60 (A=001, B=148)
+Fout=1894.80 (A=002, B=148)
+Fout=1895.00 (A=003, B=148)
+Fout=1895.20 (A=004, B=148)
+Fout=1895.40 (A=005, B=148)
+Fout=1895.60 (A=006, B=148)
+Fout=1895.80 (A=007, B=148)
+Fout=1896.00 (A=008, B=148)
+Fout=1896.20 (A=009, B=148)
+Fout=1896.40 (A=010, B=148)
+Fout=1896.60 (A=011, B=148)
+Fout=1896.80 (A=012, B=148)
+Fout=1897.00 (A=013, B=148)
+Fout=1897.20 (A=014, B=148)
+Fout=1897.40 (A=015, B=148)
+Fout=1897.60 (A=016, B=148)
+Fout=1897.80 (A=017, B=148)
+Fout=1898.00 (A=018, B=148)
+Fout=1898.20 (A=019, B=148)
+Fout=1898.40 (A=020, B=148)
+Fout=1898.60 (A=021, B=148)
+Fout=1898.80 (A=022, B=148)
+Fout=1899.00 (A=023, B=148)
+Fout=1899.20 (A=024, B=148)
+Fout=1899.40 (A=025, B=148)
+Fout=1899.60 (A=026, B=148)
+Fout=1899.80 (A=027, B=148)
+Fout=1900.00 (A=028, B=148)
+Fout=1900.20 (A=029, B=148)
+Fout=1900.40 (A=030, B=148)
+Fout=1900.60 (A=031, B=148)
+Fout=1900.80 (A=032, B=148)
+Fout=1901.00 (A=033, B=148)
+Fout=1901.20 (A=034, B=148)
+Fout=1901.40 (A=035, B=148)
+Fout=1901.60 (A=036, B=148)
+Fout=1901.80 (A=037, B=148)
+Fout=1902.00 (A=038, B=148)
+Fout=1902.20 (A=039, B=148)
+Fout=1902.40 (A=040, B=148)
+Fout=1902.60 (A=041, B=148)
+Fout=1902.80 (A=042, B=148)
+Fout=1903.00 (A=043, B=148)
+Fout=1903.20 (A=044, B=148)
+Fout=1903.40 (A=045, B=148)
+Fout=1903.60 (A=046, B=148)
+Fout=1903.80 (A=047, B=148)
+Fout=1904.00 (A=048, B=148)
+Fout=1904.20 (A=049, B=148)
+Fout=1904.40 (A=050, B=148)
+Fout=1904.60 (A=051, B=148)
+Fout=1904.80 (A=052, B=148)
+Fout=1905.00 (A=053, B=148)
+Fout=1905.20 (A=054, B=148)
+Fout=1905.40 (A=055, B=148)
+Fout=1905.60 (A=056, B=148)
+Fout=1905.80 (A=057, B=148)
+Fout=1906.00 (A=058, B=148)
+Fout=1906.20 (A=059, B=148)
+Fout=1906.40 (A=060, B=148)
+Fout=1906.60 (A=061, B=148)
+Fout=1906.80 (A=062, B=148)
+Fout=1907.20 (A=000, B=149)
+Fout=1907.40 (A=001, B=149)
+Fout=1907.60 (A=002, B=149)
+Fout=1907.80 (A=003, B=149)
+Fout=1908.00 (A=004, B=149)
+Fout=1908.20 (A=005, B=149)
+Fout=1908.40 (A=006, B=149)
+Fout=1908.60 (A=007, B=149)
+Fout=1908.80 (A=008, B=149)
+Fout=1909.00 (A=009, B=149)
+Fout=1909.20 (A=010, B=149)
+Fout=1909.40 (A=011, B=149)
+Fout=1909.60 (A=012, B=149)
+Fout=1909.80 (A=013, B=149)
+Fout=1910.00 (A=014, B=149)
+Fout=1910.20 (A=015, B=149)
+Fout=1910.40 (A=016, B=149)
+Fout=1910.60 (A=017, B=149)
+Fout=1910.80 (A=018, B=149)
+Fout=1911.00 (A=019, B=149)
+Fout=1911.20 (A=020, B=149)
+Fout=1911.40 (A=021, B=149)
+Fout=1911.60 (A=022, B=149)
+Fout=1911.80 (A=023, B=149)
+Fout=1912.00 (A=024, B=149)
+Fout=1912.20 (A=025, B=149)
+Fout=1912.40 (A=026, B=149)
+Fout=1912.60 (A=027, B=149)
+Fout=1912.80 (A=028, B=149)
+Fout=1913.00 (A=029, B=149)
+Fout=1913.20 (A=030, B=149)
+Fout=1913.40 (A=031, B=149)
+Fout=1913.60 (A=032, B=149)
+Fout=1913.80 (A=033, B=149)
+Fout=1914.00 (A=034, B=149)
+Fout=1914.20 (A=035, B=149)
+Fout=1914.40 (A=036, B=149)
+Fout=1914.60 (A=037, B=149)
+Fout=1914.80 (A=038, B=149)
+Fout=1915.00 (A=039, B=149)
+Fout=1915.20 (A=040, B=149)
+Fout=1915.40 (A=041, B=149)
+Fout=1915.60 (A=042, B=149)
+Fout=1915.80 (A=043, B=149)
+Fout=1916.00 (A=044, B=149)
+Fout=1916.20 (A=045, B=149)
+Fout=1916.40 (A=046, B=149)
+Fout=1916.60 (A=047, B=149)
+Fout=1916.80 (A=048, B=149)
+Fout=1917.00 (A=049, B=149)
+Fout=1917.20 (A=050, B=149)
+Fout=1917.40 (A=051, B=149)
+Fout=1917.60 (A=052, B=149)
+Fout=1917.80 (A=053, B=149)
+Fout=1918.00 (A=054, B=149)
+Fout=1918.20 (A=055, B=149)
+Fout=1918.40 (A=056, B=149)
+Fout=1918.60 (A=057, B=149)
+Fout=1918.80 (A=058, B=149)
+Fout=1919.00 (A=059, B=149)
+Fout=1919.20 (A=060, B=149)
+Fout=1919.40 (A=061, B=149)
+Fout=1919.60 (A=062, B=149)
+Fout=1920.00 (A=000, B=150)
+Fout=1920.20 (A=001, B=150)
+Fout=1920.40 (A=002, B=150)
+Fout=1920.60 (A=003, B=150)
+Fout=1920.80 (A=004, B=150)
+Fout=1921.00 (A=005, B=150)
+Fout=1921.20 (A=006, B=150)
+Fout=1921.40 (A=007, B=150)
+Fout=1921.60 (A=008, B=150)
+Fout=1921.80 (A=009, B=150)
+Fout=1922.00 (A=010, B=150)
+Fout=1922.20 (A=011, B=150)
+Fout=1922.40 (A=012, B=150)
+Fout=1922.60 (A=013, B=150)
+Fout=1922.80 (A=014, B=150)
+Fout=1923.00 (A=015, B=150)
+Fout=1923.20 (A=016, B=150)
+Fout=1923.40 (A=017, B=150)
+Fout=1923.60 (A=018, B=150)
+Fout=1923.80 (A=019, B=150)
+Fout=1924.00 (A=020, B=150)
+Fout=1924.20 (A=021, B=150)
+Fout=1924.40 (A=022, B=150)
+Fout=1924.60 (A=023, B=150)
+Fout=1924.80 (A=024, B=150)
+Fout=1925.00 (A=025, B=150)
+Fout=1925.20 (A=026, B=150)
+Fout=1925.40 (A=027, B=150)
+Fout=1925.60 (A=028, B=150)
+Fout=1925.80 (A=029, B=150)
+Fout=1926.00 (A=030, B=150)
+Fout=1926.20 (A=031, B=150)
+Fout=1926.40 (A=032, B=150)
+Fout=1926.60 (A=033, B=150)
+Fout=1926.80 (A=034, B=150)
+Fout=1927.00 (A=035, B=150)
+Fout=1927.20 (A=036, B=150)
+Fout=1927.40 (A=037, B=150)
+Fout=1927.60 (A=038, B=150)
+Fout=1927.80 (A=039, B=150)
+Fout=1928.00 (A=040, B=150)
+Fout=1928.20 (A=041, B=150)
+Fout=1928.40 (A=042, B=150)
+Fout=1928.60 (A=043, B=150)
+Fout=1928.80 (A=044, B=150)
+Fout=1929.00 (A=045, B=150)
+Fout=1929.20 (A=046, B=150)
+Fout=1929.40 (A=047, B=150)
+Fout=1929.60 (A=048, B=150)
+Fout=1929.80 (A=049, B=150)
+Fout=1930.00 (A=050, B=150)
+Fout=1930.20 (A=051, B=150)
+Fout=1930.40 (A=052, B=150)
+Fout=1930.60 (A=053, B=150)
+Fout=1930.80 (A=054, B=150)
+Fout=1931.00 (A=055, B=150)
+Fout=1931.20 (A=056, B=150)
+Fout=1931.40 (A=057, B=150)
+Fout=1931.60 (A=058, B=150)
+Fout=1931.80 (A=059, B=150)
+Fout=1932.00 (A=060, B=150)
+Fout=1932.20 (A=061, B=150)
+Fout=1932.40 (A=062, B=150)
+Fout=1932.80 (A=000, B=151)
+Fout=1933.00 (A=001, B=151)
+Fout=1933.20 (A=002, B=151)
+Fout=1933.40 (A=003, B=151)
+Fout=1933.60 (A=004, B=151)
+Fout=1933.80 (A=005, B=151)
+Fout=1934.00 (A=006, B=151)
+Fout=1934.20 (A=007, B=151)
+Fout=1934.40 (A=008, B=151)
+Fout=1934.60 (A=009, B=151)
+Fout=1934.80 (A=010, B=151)
+Fout=1935.00 (A=011, B=151)
+Fout=1935.20 (A=012, B=151)
+Fout=1935.40 (A=013, B=151)
+Fout=1935.60 (A=014, B=151)
+Fout=1935.80 (A=015, B=151)
+Fout=1936.00 (A=016, B=151)
+Fout=1936.20 (A=017, B=151)
+Fout=1936.40 (A=018, B=151)
+Fout=1936.60 (A=019, B=151)
+Fout=1936.80 (A=020, B=151)
+Fout=1937.00 (A=021, B=151)
+Fout=1937.20 (A=022, B=151)
+Fout=1937.40 (A=023, B=151)
+Fout=1937.60 (A=024, B=151)
+Fout=1937.80 (A=025, B=151)
+Fout=1938.00 (A=026, B=151)
+Fout=1938.20 (A=027, B=151)
+Fout=1938.40 (A=028, B=151)
+Fout=1938.60 (A=029, B=151)
+Fout=1938.80 (A=030, B=151)
+Fout=1939.00 (A=031, B=151)
+Fout=1939.20 (A=032, B=151)
+Fout=1939.40 (A=033, B=151)
+Fout=1939.60 (A=034, B=151)
+Fout=1939.80 (A=035, B=151)
+Fout=1940.00 (A=036, B=151)
+Fout=1940.20 (A=037, B=151)
+Fout=1940.40 (A=038, B=151)
+Fout=1940.60 (A=039, B=151)
+Fout=1940.80 (A=040, B=151)
+Fout=1941.00 (A=041, B=151)
+Fout=1941.20 (A=042, B=151)
+Fout=1941.40 (A=043, B=151)
+Fout=1941.60 (A=044, B=151)
+Fout=1941.80 (A=045, B=151)
+Fout=1942.00 (A=046, B=151)
+Fout=1942.20 (A=047, B=151)
+Fout=1942.40 (A=048, B=151)
+Fout=1942.60 (A=049, B=151)
+Fout=1942.80 (A=050, B=151)
+Fout=1943.00 (A=051, B=151)
+Fout=1943.20 (A=052, B=151)
+Fout=1943.40 (A=053, B=151)
+Fout=1943.60 (A=054, B=151)
+Fout=1943.80 (A=055, B=151)
+Fout=1944.00 (A=056, B=151)
+Fout=1944.20 (A=057, B=151)
+Fout=1944.40 (A=058, B=151)
+Fout=1944.60 (A=059, B=151)
+Fout=1944.80 (A=060, B=151)
+Fout=1945.00 (A=061, B=151)
+Fout=1945.20 (A=062, B=151)
+Fout=1945.60 (A=000, B=152)
+Fout=1945.80 (A=001, B=152)
+Fout=1946.00 (A=002, B=152)
+Fout=1946.20 (A=003, B=152)
+Fout=1946.40 (A=004, B=152)
+Fout=1946.60 (A=005, B=152)
+Fout=1946.80 (A=006, B=152)
+Fout=1947.00 (A=007, B=152)
+Fout=1947.20 (A=008, B=152)
+Fout=1947.40 (A=009, B=152)
+Fout=1947.60 (A=010, B=152)
+Fout=1947.80 (A=011, B=152)
+Fout=1948.00 (A=012, B=152)
+Fout=1948.20 (A=013, B=152)
+Fout=1948.40 (A=014, B=152)
+Fout=1948.60 (A=015, B=152)
+Fout=1948.80 (A=016, B=152)
+Fout=1949.00 (A=017, B=152)
+Fout=1949.20 (A=018, B=152)
+Fout=1949.40 (A=019, B=152)
+Fout=1949.60 (A=020, B=152)
+Fout=1949.80 (A=021, B=152)
+Fout=1950.00 (A=022, B=152)
+Fout=1950.20 (A=023, B=152)
+Fout=1950.40 (A=024, B=152)
+Fout=1950.60 (A=025, B=152)
+Fout=1950.80 (A=026, B=152)
+Fout=1951.00 (A=027, B=152)
+Fout=1951.20 (A=028, B=152)
+Fout=1951.40 (A=029, B=152)
+Fout=1951.60 (A=030, B=152)
+Fout=1951.80 (A=031, B=152)
+Fout=1952.00 (A=032, B=152)
+Fout=1952.20 (A=033, B=152)
+Fout=1952.40 (A=034, B=152)
+Fout=1952.60 (A=035, B=152)
+Fout=1952.80 (A=036, B=152)
+Fout=1953.00 (A=037, B=152)
+Fout=1953.20 (A=038, B=152)
+Fout=1953.40 (A=039, B=152)
+Fout=1953.60 (A=040, B=152)
+Fout=1953.80 (A=041, B=152)
+Fout=1954.00 (A=042, B=152)
+Fout=1954.20 (A=043, B=152)
+Fout=1954.40 (A=044, B=152)
+Fout=1954.60 (A=045, B=152)
+Fout=1954.80 (A=046, B=152)
+Fout=1955.00 (A=047, B=152)
+Fout=1955.20 (A=048, B=152)
+Fout=1955.40 (A=049, B=152)
+Fout=1955.60 (A=050, B=152)
+Fout=1955.80 (A=051, B=152)
+Fout=1956.00 (A=052, B=152)
+Fout=1956.20 (A=053, B=152)
+Fout=1956.40 (A=054, B=152)
+Fout=1956.60 (A=055, B=152)
+Fout=1956.80 (A=056, B=152)
+Fout=1957.00 (A=057, B=152)
+Fout=1957.20 (A=058, B=152)
+Fout=1957.40 (A=059, B=152)
+Fout=1957.60 (A=060, B=152)
+Fout=1957.80 (A=061, B=152)
+Fout=1958.00 (A=062, B=152)
+Fout=1958.40 (A=000, B=153)
+Fout=1958.60 (A=001, B=153)
+Fout=1958.80 (A=002, B=153)
+Fout=1959.00 (A=003, B=153)
+Fout=1959.20 (A=004, B=153)
+Fout=1959.40 (A=005, B=153)
+Fout=1959.60 (A=006, B=153)
+Fout=1959.80 (A=007, B=153)
+Fout=1960.00 (A=008, B=153)
+Fout=1960.20 (A=009, B=153)
+Fout=1960.40 (A=010, B=153)
+Fout=1960.60 (A=011, B=153)
+Fout=1960.80 (A=012, B=153)
+Fout=1961.00 (A=013, B=153)
+Fout=1961.20 (A=014, B=153)
+Fout=1961.40 (A=015, B=153)
+Fout=1961.60 (A=016, B=153)
+Fout=1961.80 (A=017, B=153)
+Fout=1962.00 (A=018, B=153)
+Fout=1962.20 (A=019, B=153)
+Fout=1962.40 (A=020, B=153)
+Fout=1962.60 (A=021, B=153)
+Fout=1962.80 (A=022, B=153)
+Fout=1963.00 (A=023, B=153)
+Fout=1963.20 (A=024, B=153)
+Fout=1963.40 (A=025, B=153)
+Fout=1963.60 (A=026, B=153)
+Fout=1963.80 (A=027, B=153)
+Fout=1964.00 (A=028, B=153)
+Fout=1964.20 (A=029, B=153)
+Fout=1964.40 (A=030, B=153)
+Fout=1964.60 (A=031, B=153)
+Fout=1964.80 (A=032, B=153)
+Fout=1965.00 (A=033, B=153)
+Fout=1965.20 (A=034, B=153)
+Fout=1965.40 (A=035, B=153)
+Fout=1965.60 (A=036, B=153)
+Fout=1965.80 (A=037, B=153)
+Fout=1966.00 (A=038, B=153)
+Fout=1966.20 (A=039, B=153)
+Fout=1966.40 (A=040, B=153)
+Fout=1966.60 (A=041, B=153)
+Fout=1966.80 (A=042, B=153)
+Fout=1967.00 (A=043, B=153)
+Fout=1967.20 (A=044, B=153)
+Fout=1967.40 (A=045, B=153)
+Fout=1967.60 (A=046, B=153)
+Fout=1967.80 (A=047, B=153)
+Fout=1968.00 (A=048, B=153)
+Fout=1968.20 (A=049, B=153)
+Fout=1968.40 (A=050, B=153)
+Fout=1968.60 (A=051, B=153)
+Fout=1968.80 (A=052, B=153)
+Fout=1969.00 (A=053, B=153)
+Fout=1969.20 (A=054, B=153)
+Fout=1969.40 (A=055, B=153)
+Fout=1969.60 (A=056, B=153)
+Fout=1969.80 (A=057, B=153)
+Fout=1970.00 (A=058, B=153)
+Fout=1970.20 (A=059, B=153)
+Fout=1970.40 (A=060, B=153)
+Fout=1970.60 (A=061, B=153)
+Fout=1970.80 (A=062, B=153)
+Fout=1971.20 (A=000, B=154)
+Fout=1971.40 (A=001, B=154)
+Fout=1971.60 (A=002, B=154)
+Fout=1971.80 (A=003, B=154)
+Fout=1972.00 (A=004, B=154)
+Fout=1972.20 (A=005, B=154)
+Fout=1972.40 (A=006, B=154)
+Fout=1972.60 (A=007, B=154)
+Fout=1972.80 (A=008, B=154)
+Fout=1973.00 (A=009, B=154)
+Fout=1973.20 (A=010, B=154)
+Fout=1973.40 (A=011, B=154)
+Fout=1973.60 (A=012, B=154)
+Fout=1973.80 (A=013, B=154)
+Fout=1974.00 (A=014, B=154)
+Fout=1974.20 (A=015, B=154)
+Fout=1974.40 (A=016, B=154)
+Fout=1974.60 (A=017, B=154)
+Fout=1974.80 (A=018, B=154)
+Fout=1975.00 (A=019, B=154)
+Fout=1975.20 (A=020, B=154)
+Fout=1975.40 (A=021, B=154)
+Fout=1975.60 (A=022, B=154)
+Fout=1975.80 (A=023, B=154)
+Fout=1976.00 (A=024, B=154)
+Fout=1976.20 (A=025, B=154)
+Fout=1976.40 (A=026, B=154)
+Fout=1976.60 (A=027, B=154)
+Fout=1976.80 (A=028, B=154)
+Fout=1977.00 (A=029, B=154)
+Fout=1977.20 (A=030, B=154)
+Fout=1977.40 (A=031, B=154)
+Fout=1977.60 (A=032, B=154)
+Fout=1977.80 (A=033, B=154)
+Fout=1978.00 (A=034, B=154)
+Fout=1978.20 (A=035, B=154)
+Fout=1978.40 (A=036, B=154)
+Fout=1978.60 (A=037, B=154)
+Fout=1978.80 (A=038, B=154)
+Fout=1979.00 (A=039, B=154)
+Fout=1979.20 (A=040, B=154)
+Fout=1979.40 (A=041, B=154)
+Fout=1979.60 (A=042, B=154)
+Fout=1979.80 (A=043, B=154)
+Fout=1980.00 (A=044, B=154)
+Fout=1980.20 (A=045, B=154)
+Fout=1980.40 (A=046, B=154)
+Fout=1980.60 (A=047, B=154)
+Fout=1980.80 (A=048, B=154)
+Fout=1981.00 (A=049, B=154)
+Fout=1981.20 (A=050, B=154)
+Fout=1981.40 (A=051, B=154)
+Fout=1981.60 (A=052, B=154)
+Fout=1981.80 (A=053, B=154)
+Fout=1982.00 (A=054, B=154)
+Fout=1982.20 (A=055, B=154)
+Fout=1982.40 (A=056, B=154)
+Fout=1982.60 (A=057, B=154)
+Fout=1982.80 (A=058, B=154)
+Fout=1983.00 (A=059, B=154)
+Fout=1983.20 (A=060, B=154)
+Fout=1983.40 (A=061, B=154)
+Fout=1983.60 (A=062, B=154)
+Fout=1984.00 (A=000, B=155)
+Fout=1984.20 (A=001, B=155)
+Fout=1984.40 (A=002, B=155)
+Fout=1984.60 (A=003, B=155)
+Fout=1984.80 (A=004, B=155)
+Fout=1985.00 (A=005, B=155)
+Fout=1985.20 (A=006, B=155)
+Fout=1985.40 (A=007, B=155)
+Fout=1985.60 (A=008, B=155)
+Fout=1985.80 (A=009, B=155)
+Fout=1986.00 (A=010, B=155)
+Fout=1986.20 (A=011, B=155)
+Fout=1986.40 (A=012, B=155)
+Fout=1986.60 (A=013, B=155)
+Fout=1986.80 (A=014, B=155)
+Fout=1987.00 (A=015, B=155)
+Fout=1987.20 (A=016, B=155)
+Fout=1987.40 (A=017, B=155)
+Fout=1987.60 (A=018, B=155)
+Fout=1987.80 (A=019, B=155)
+Fout=1988.00 (A=020, B=155)
+Fout=1988.20 (A=021, B=155)
+Fout=1988.40 (A=022, B=155)
+Fout=1988.60 (A=023, B=155)
+Fout=1988.80 (A=024, B=155)
+Fout=1989.00 (A=025, B=155)
+Fout=1989.20 (A=026, B=155)
+Fout=1989.40 (A=027, B=155)
+Fout=1989.60 (A=028, B=155)
+Fout=1989.80 (A=029, B=155)
+Fout=1990.00 (A=030, B=155)
+Fout=1990.20 (A=031, B=155)
+Fout=1990.40 (A=032, B=155)
+Fout=1990.60 (A=033, B=155)
+Fout=1990.80 (A=034, B=155)
+Fout=1991.00 (A=035, B=155)
+Fout=1991.20 (A=036, B=155)
+Fout=1991.40 (A=037, B=155)
+Fout=1991.60 (A=038, B=155)
+Fout=1991.80 (A=039, B=155)
+Fout=1992.00 (A=040, B=155)
+Fout=1992.20 (A=041, B=155)
+Fout=1992.40 (A=042, B=155)
+Fout=1992.60 (A=043, B=155)
+Fout=1992.80 (A=044, B=155)
+Fout=1993.00 (A=045, B=155)
+Fout=1993.20 (A=046, B=155)
+Fout=1993.40 (A=047, B=155)
+Fout=1993.60 (A=048, B=155)
+Fout=1993.80 (A=049, B=155)
+Fout=1994.00 (A=050, B=155)
+Fout=1994.20 (A=051, B=155)
+Fout=1994.40 (A=052, B=155)
+Fout=1994.60 (A=053, B=155)
+Fout=1994.80 (A=054, B=155)
+Fout=1995.00 (A=055, B=155)
+Fout=1995.20 (A=056, B=155)
+Fout=1995.40 (A=057, B=155)
+Fout=1995.60 (A=058, B=155)
+Fout=1995.80 (A=059, B=155)
+Fout=1996.00 (A=060, B=155)
+Fout=1996.20 (A=061, B=155)
+Fout=1996.40 (A=062, B=155)
+======================================================================
+PLL Tx GSM850_1
+Fout=819.20 (A=000, B=128)
+Fout=819.30 (A=001, B=128)
+Fout=819.40 (A=002, B=128)
+Fout=819.50 (A=003, B=128)
+Fout=819.60 (A=004, B=128)
+Fout=819.70 (A=005, B=128)
+Fout=819.80 (A=006, B=128)
+Fout=819.90 (A=007, B=128)
+Fout=820.00 (A=008, B=128)
+Fout=820.10 (A=009, B=128)
+Fout=820.20 (A=010, B=128)
+Fout=820.30 (A=011, B=128)
+Fout=820.40 (A=012, B=128)
+Fout=820.50 (A=013, B=128)
+Fout=820.60 (A=014, B=128)
+Fout=820.70 (A=015, B=128)
+Fout=820.80 (A=016, B=128)
+Fout=820.90 (A=017, B=128)
+Fout=821.00 (A=018, B=128)
+Fout=821.10 (A=019, B=128)
+Fout=821.20 (A=020, B=128)
+Fout=821.30 (A=021, B=128)
+Fout=821.40 (A=022, B=128)
+Fout=821.50 (A=023, B=128)
+Fout=821.60 (A=024, B=128)
+Fout=821.70 (A=025, B=128)
+Fout=821.80 (A=026, B=128)
+Fout=821.90 (A=027, B=128)
+Fout=822.00 (A=028, B=128)
+Fout=822.10 (A=029, B=128)
+Fout=822.20 (A=030, B=128)
+Fout=822.30 (A=031, B=128)
+Fout=822.40 (A=032, B=128)
+Fout=822.50 (A=033, B=128)
+Fout=822.60 (A=034, B=128)
+Fout=822.70 (A=035, B=128)
+Fout=822.80 (A=036, B=128)
+Fout=822.90 (A=037, B=128)
+Fout=823.00 (A=038, B=128)
+Fout=823.10 (A=039, B=128)
+Fout=823.20 (A=040, B=128)
+Fout=823.30 (A=041, B=128)
+Fout=823.40 (A=042, B=128)
+Fout=823.50 (A=043, B=128)
+Fout=823.60 (A=044, B=128)
+Fout=823.70 (A=045, B=128)
+Fout=823.80 (A=046, B=128)
+Fout=823.90 (A=047, B=128)
+Fout=824.00 (A=048, B=128)
+Fout=824.10 (A=049, B=128)
+Fout=824.20 (A=050, B=128)
+Fout=824.30 (A=051, B=128)
+Fout=824.40 (A=052, B=128)
+Fout=824.50 (A=053, B=128)
+Fout=824.60 (A=054, B=128)
+Fout=824.70 (A=055, B=128)
+Fout=824.80 (A=056, B=128)
+Fout=824.90 (A=057, B=128)
+Fout=825.00 (A=058, B=128)
+Fout=825.10 (A=059, B=128)
+Fout=825.20 (A=060, B=128)
+Fout=825.30 (A=061, B=128)
+Fout=825.40 (A=062, B=128)
+Fout=825.60 (A=000, B=129)
+Fout=825.70 (A=001, B=129)
+Fout=825.80 (A=002, B=129)
+Fout=825.90 (A=003, B=129)
+Fout=826.00 (A=004, B=129)
+Fout=826.10 (A=005, B=129)
+Fout=826.20 (A=006, B=129)
+Fout=826.30 (A=007, B=129)
+Fout=826.40 (A=008, B=129)
+Fout=826.50 (A=009, B=129)
+Fout=826.60 (A=010, B=129)
+Fout=826.70 (A=011, B=129)
+Fout=826.80 (A=012, B=129)
+Fout=826.90 (A=013, B=129)
+Fout=827.00 (A=014, B=129)
+Fout=827.10 (A=015, B=129)
+Fout=827.20 (A=016, B=129)
+Fout=827.30 (A=017, B=129)
+Fout=827.40 (A=018, B=129)
+Fout=827.50 (A=019, B=129)
+Fout=827.60 (A=020, B=129)
+Fout=827.70 (A=021, B=129)
+Fout=827.80 (A=022, B=129)
+Fout=827.90 (A=023, B=129)
+Fout=828.00 (A=024, B=129)
+Fout=828.10 (A=025, B=129)
+Fout=828.20 (A=026, B=129)
+Fout=828.30 (A=027, B=129)
+Fout=828.40 (A=028, B=129)
+Fout=828.50 (A=029, B=129)
+Fout=828.60 (A=030, B=129)
+Fout=828.70 (A=031, B=129)
+Fout=828.80 (A=032, B=129)
+Fout=828.90 (A=033, B=129)
+Fout=829.00 (A=034, B=129)
+Fout=829.10 (A=035, B=129)
+Fout=829.20 (A=036, B=129)
+Fout=829.30 (A=037, B=129)
+Fout=829.40 (A=038, B=129)
+Fout=829.50 (A=039, B=129)
+Fout=829.60 (A=040, B=129)
+Fout=829.70 (A=041, B=129)
+Fout=829.80 (A=042, B=129)
+Fout=829.90 (A=043, B=129)
+Fout=830.00 (A=044, B=129)
+Fout=830.10 (A=045, B=129)
+Fout=830.20 (A=046, B=129)
+Fout=830.30 (A=047, B=129)
+Fout=830.40 (A=048, B=129)
+Fout=830.50 (A=049, B=129)
+Fout=830.60 (A=050, B=129)
+Fout=830.70 (A=051, B=129)
+Fout=830.80 (A=052, B=129)
+Fout=830.90 (A=053, B=129)
+Fout=831.00 (A=054, B=129)
+Fout=831.10 (A=055, B=129)
+Fout=831.20 (A=056, B=129)
+Fout=831.30 (A=057, B=129)
+Fout=831.40 (A=058, B=129)
+Fout=831.50 (A=059, B=129)
+Fout=831.60 (A=060, B=129)
+Fout=831.70 (A=061, B=129)
+Fout=831.80 (A=062, B=129)
+Fout=832.00 (A=000, B=130)
+Fout=832.10 (A=001, B=130)
+Fout=832.20 (A=002, B=130)
+Fout=832.30 (A=003, B=130)
+Fout=832.40 (A=004, B=130)
+Fout=832.50 (A=005, B=130)
+Fout=832.60 (A=006, B=130)
+Fout=832.70 (A=007, B=130)
+Fout=832.80 (A=008, B=130)
+Fout=832.90 (A=009, B=130)
+Fout=833.00 (A=010, B=130)
+Fout=833.10 (A=011, B=130)
+Fout=833.20 (A=012, B=130)
+Fout=833.30 (A=013, B=130)
+Fout=833.40 (A=014, B=130)
+Fout=833.50 (A=015, B=130)
+Fout=833.60 (A=016, B=130)
+Fout=833.70 (A=017, B=130)
+Fout=833.80 (A=018, B=130)
+Fout=833.90 (A=019, B=130)
+Fout=834.00 (A=020, B=130)
+Fout=834.10 (A=021, B=130)
+Fout=834.20 (A=022, B=130)
+Fout=834.30 (A=023, B=130)
+Fout=834.40 (A=024, B=130)
+Fout=834.50 (A=025, B=130)
+Fout=834.60 (A=026, B=130)
+Fout=834.70 (A=027, B=130)
+Fout=834.80 (A=028, B=130)
+Fout=834.90 (A=029, B=130)
+Fout=835.00 (A=030, B=130)
+Fout=835.10 (A=031, B=130)
+Fout=835.20 (A=032, B=130)
+Fout=835.30 (A=033, B=130)
+Fout=835.40 (A=034, B=130)
+Fout=835.50 (A=035, B=130)
+Fout=835.60 (A=036, B=130)
+Fout=835.70 (A=037, B=130)
+Fout=835.80 (A=038, B=130)
+Fout=835.90 (A=039, B=130)
+Fout=836.00 (A=040, B=130)
+Fout=836.10 (A=041, B=130)
+Fout=836.20 (A=042, B=130)
+Fout=836.30 (A=043, B=130)
+Fout=836.40 (A=044, B=130)
+Fout=836.50 (A=045, B=130)
+Fout=836.60 (A=046, B=130)
+Fout=836.70 (A=047, B=130)
+Fout=836.80 (A=048, B=130)
+Fout=836.90 (A=049, B=130)
+Fout=837.00 (A=050, B=130)
+Fout=837.10 (A=051, B=130)
+Fout=837.20 (A=052, B=130)
+Fout=837.30 (A=053, B=130)
+Fout=837.40 (A=054, B=130)
+Fout=837.50 (A=055, B=130)
+Fout=837.60 (A=056, B=130)
+Fout=837.70 (A=057, B=130)
+Fout=837.80 (A=058, B=130)
+Fout=837.90 (A=059, B=130)
+Fout=838.00 (A=060, B=130)
+Fout=838.10 (A=061, B=130)
+Fout=838.20 (A=062, B=130)
+======================================================================
+PLL Tx GSM850_2
+Fout=832.00 (A=000, B=065)
+Fout=832.20 (A=001, B=065)
+Fout=832.40 (A=002, B=065)
+Fout=832.60 (A=003, B=065)
+Fout=832.80 (A=004, B=065)
+Fout=833.00 (A=005, B=065)
+Fout=833.20 (A=006, B=065)
+Fout=833.40 (A=007, B=065)
+Fout=833.60 (A=008, B=065)
+Fout=833.80 (A=009, B=065)
+Fout=834.00 (A=010, B=065)
+Fout=834.20 (A=011, B=065)
+Fout=834.40 (A=012, B=065)
+Fout=834.60 (A=013, B=065)
+Fout=834.80 (A=014, B=065)
+Fout=835.00 (A=015, B=065)
+Fout=835.20 (A=016, B=065)
+Fout=835.40 (A=017, B=065)
+Fout=835.60 (A=018, B=065)
+Fout=835.80 (A=019, B=065)
+Fout=836.00 (A=020, B=065)
+Fout=836.20 (A=021, B=065)
+Fout=836.40 (A=022, B=065)
+Fout=836.60 (A=023, B=065)
+Fout=836.80 (A=024, B=065)
+Fout=837.00 (A=025, B=065)
+Fout=837.20 (A=026, B=065)
+Fout=837.40 (A=027, B=065)
+Fout=837.60 (A=028, B=065)
+Fout=837.80 (A=029, B=065)
+Fout=838.00 (A=030, B=065)
+Fout=838.20 (A=031, B=065)
+Fout=838.40 (A=032, B=065)
+Fout=838.60 (A=033, B=065)
+Fout=838.80 (A=034, B=065)
+Fout=839.00 (A=035, B=065)
+Fout=839.20 (A=036, B=065)
+Fout=839.40 (A=037, B=065)
+Fout=839.60 (A=038, B=065)
+Fout=839.80 (A=039, B=065)
+Fout=840.00 (A=040, B=065)
+Fout=840.20 (A=041, B=065)
+Fout=840.40 (A=042, B=065)
+Fout=840.60 (A=043, B=065)
+Fout=840.80 (A=044, B=065)
+Fout=841.00 (A=045, B=065)
+Fout=841.20 (A=046, B=065)
+Fout=841.40 (A=047, B=065)
+Fout=841.60 (A=048, B=065)
+Fout=841.80 (A=049, B=065)
+Fout=842.00 (A=050, B=065)
+Fout=842.20 (A=051, B=065)
+Fout=842.40 (A=052, B=065)
+Fout=842.60 (A=053, B=065)
+Fout=842.80 (A=054, B=065)
+Fout=843.00 (A=055, B=065)
+Fout=843.20 (A=056, B=065)
+Fout=843.40 (A=057, B=065)
+Fout=843.60 (A=058, B=065)
+Fout=843.80 (A=059, B=065)
+Fout=844.00 (A=060, B=065)
+Fout=844.20 (A=061, B=065)
+Fout=844.40 (A=062, B=065)
+Fout=844.60 (A=063, B=065)
+Fout=844.80 (A=000, B=066)
+Fout=845.00 (A=001, B=066)
+Fout=845.20 (A=002, B=066)
+Fout=845.40 (A=003, B=066)
+Fout=845.60 (A=004, B=066)
+Fout=845.80 (A=005, B=066)
+Fout=846.00 (A=006, B=066)
+Fout=846.20 (A=007, B=066)
+Fout=846.40 (A=008, B=066)
+Fout=846.60 (A=009, B=066)
+Fout=846.80 (A=010, B=066)
+Fout=847.00 (A=011, B=066)
+Fout=847.20 (A=012, B=066)
+Fout=847.40 (A=013, B=066)
+Fout=847.60 (A=014, B=066)
+Fout=847.80 (A=015, B=066)
+Fout=848.00 (A=016, B=066)
+Fout=848.20 (A=017, B=066)
+Fout=848.40 (A=018, B=066)
+Fout=848.60 (A=019, B=066)
+Fout=848.80 (A=020, B=066)
+Fout=849.00 (A=021, B=066)
+Fout=849.20 (A=022, B=066)
+Fout=849.40 (A=023, B=066)
+Fout=849.60 (A=024, B=066)
+Fout=849.80 (A=025, B=066)
+Fout=850.00 (A=026, B=066)
+Fout=850.20 (A=027, B=066)
+Fout=850.40 (A=028, B=066)
+Fout=850.60 (A=029, B=066)
+Fout=850.80 (A=030, B=066)
+Fout=851.00 (A=031, B=066)
+Fout=851.20 (A=032, B=066)
+Fout=851.40 (A=033, B=066)
+Fout=851.60 (A=034, B=066)
+Fout=851.80 (A=035, B=066)
+Fout=852.00 (A=036, B=066)
+Fout=852.20 (A=037, B=066)
+Fout=852.40 (A=038, B=066)
+Fout=852.60 (A=039, B=066)
+Fout=852.80 (A=040, B=066)
+Fout=853.00 (A=041, B=066)
+Fout=853.20 (A=042, B=066)
+Fout=853.40 (A=043, B=066)
+Fout=853.60 (A=044, B=066)
+Fout=853.80 (A=045, B=066)
+Fout=854.00 (A=046, B=066)
+Fout=854.20 (A=047, B=066)
+Fout=854.40 (A=048, B=066)
+Fout=854.60 (A=049, B=066)
+Fout=854.80 (A=050, B=066)
+Fout=855.00 (A=051, B=066)
+Fout=855.20 (A=052, B=066)
+Fout=855.40 (A=053, B=066)
+Fout=855.60 (A=054, B=066)
+Fout=855.80 (A=055, B=066)
+Fout=856.00 (A=056, B=066)
+Fout=856.20 (A=057, B=066)
+Fout=856.40 (A=058, B=066)
+Fout=856.60 (A=059, B=066)
+Fout=856.80 (A=060, B=066)
+Fout=857.00 (A=061, B=066)
+Fout=857.20 (A=062, B=066)
+Fout=857.40 (A=063, B=066)
+======================================================================
+PLL Tx GSM900
+Fout=870.40 (A=000, B=068)
+Fout=870.60 (A=001, B=068)
+Fout=870.80 (A=002, B=068)
+Fout=871.00 (A=003, B=068)
+Fout=871.20 (A=004, B=068)
+Fout=871.40 (A=005, B=068)
+Fout=871.60 (A=006, B=068)
+Fout=871.80 (A=007, B=068)
+Fout=872.00 (A=008, B=068)
+Fout=872.20 (A=009, B=068)
+Fout=872.40 (A=010, B=068)
+Fout=872.60 (A=011, B=068)
+Fout=872.80 (A=012, B=068)
+Fout=873.00 (A=013, B=068)
+Fout=873.20 (A=014, B=068)
+Fout=873.40 (A=015, B=068)
+Fout=873.60 (A=016, B=068)
+Fout=873.80 (A=017, B=068)
+Fout=874.00 (A=018, B=068)
+Fout=874.20 (A=019, B=068)
+Fout=874.40 (A=020, B=068)
+Fout=874.60 (A=021, B=068)
+Fout=874.80 (A=022, B=068)
+Fout=875.00 (A=023, B=068)
+Fout=875.20 (A=024, B=068)
+Fout=875.40 (A=025, B=068)
+Fout=875.60 (A=026, B=068)
+Fout=875.80 (A=027, B=068)
+Fout=876.00 (A=028, B=068)
+Fout=876.20 (A=029, B=068)
+Fout=876.40 (A=030, B=068)
+Fout=876.60 (A=031, B=068)
+Fout=876.80 (A=032, B=068)
+Fout=877.00 (A=033, B=068)
+Fout=877.20 (A=034, B=068)
+Fout=877.40 (A=035, B=068)
+Fout=877.60 (A=036, B=068)
+Fout=877.80 (A=037, B=068)
+Fout=878.00 (A=038, B=068)
+Fout=878.20 (A=039, B=068)
+Fout=878.40 (A=040, B=068)
+Fout=878.60 (A=041, B=068)
+Fout=878.80 (A=042, B=068)
+Fout=879.00 (A=043, B=068)
+Fout=879.20 (A=044, B=068)
+Fout=879.40 (A=045, B=068)
+Fout=879.60 (A=046, B=068)
+Fout=879.80 (A=047, B=068)
+Fout=880.00 (A=048, B=068)
+Fout=880.20 (A=049, B=068)
+Fout=880.40 (A=050, B=068)
+Fout=880.60 (A=051, B=068)
+Fout=880.80 (A=052, B=068)
+Fout=881.00 (A=053, B=068)
+Fout=881.20 (A=054, B=068)
+Fout=881.40 (A=055, B=068)
+Fout=881.60 (A=056, B=068)
+Fout=881.80 (A=057, B=068)
+Fout=882.00 (A=058, B=068)
+Fout=882.20 (A=059, B=068)
+Fout=882.40 (A=060, B=068)
+Fout=882.60 (A=061, B=068)
+Fout=882.80 (A=062, B=068)
+Fout=883.00 (A=063, B=068)
+Fout=883.20 (A=000, B=069)
+Fout=883.40 (A=001, B=069)
+Fout=883.60 (A=002, B=069)
+Fout=883.80 (A=003, B=069)
+Fout=884.00 (A=004, B=069)
+Fout=884.20 (A=005, B=069)
+Fout=884.40 (A=006, B=069)
+Fout=884.60 (A=007, B=069)
+Fout=884.80 (A=008, B=069)
+Fout=885.00 (A=009, B=069)
+Fout=885.20 (A=010, B=069)
+Fout=885.40 (A=011, B=069)
+Fout=885.60 (A=012, B=069)
+Fout=885.80 (A=013, B=069)
+Fout=886.00 (A=014, B=069)
+Fout=886.20 (A=015, B=069)
+Fout=886.40 (A=016, B=069)
+Fout=886.60 (A=017, B=069)
+Fout=886.80 (A=018, B=069)
+Fout=887.00 (A=019, B=069)
+Fout=887.20 (A=020, B=069)
+Fout=887.40 (A=021, B=069)
+Fout=887.60 (A=022, B=069)
+Fout=887.80 (A=023, B=069)
+Fout=888.00 (A=024, B=069)
+Fout=888.20 (A=025, B=069)
+Fout=888.40 (A=026, B=069)
+Fout=888.60 (A=027, B=069)
+Fout=888.80 (A=028, B=069)
+Fout=889.00 (A=029, B=069)
+Fout=889.20 (A=030, B=069)
+Fout=889.40 (A=031, B=069)
+Fout=889.60 (A=032, B=069)
+Fout=889.80 (A=033, B=069)
+Fout=890.00 (A=034, B=069)
+Fout=890.20 (A=035, B=069)
+Fout=890.40 (A=036, B=069)
+Fout=890.60 (A=037, B=069)
+Fout=890.80 (A=038, B=069)
+Fout=891.00 (A=039, B=069)
+Fout=891.20 (A=040, B=069)
+Fout=891.40 (A=041, B=069)
+Fout=891.60 (A=042, B=069)
+Fout=891.80 (A=043, B=069)
+Fout=892.00 (A=044, B=069)
+Fout=892.20 (A=045, B=069)
+Fout=892.40 (A=046, B=069)
+Fout=892.60 (A=047, B=069)
+Fout=892.80 (A=048, B=069)
+Fout=893.00 (A=049, B=069)
+Fout=893.20 (A=050, B=069)
+Fout=893.40 (A=051, B=069)
+Fout=893.60 (A=052, B=069)
+Fout=893.80 (A=053, B=069)
+Fout=894.00 (A=054, B=069)
+Fout=894.20 (A=055, B=069)
+Fout=894.40 (A=056, B=069)
+Fout=894.60 (A=057, B=069)
+Fout=894.80 (A=058, B=069)
+Fout=895.00 (A=059, B=069)
+Fout=895.20 (A=060, B=069)
+Fout=895.40 (A=061, B=069)
+Fout=895.60 (A=062, B=069)
+Fout=895.80 (A=063, B=069)
+Fout=896.00 (A=000, B=070)
+Fout=896.20 (A=001, B=070)
+Fout=896.40 (A=002, B=070)
+Fout=896.60 (A=003, B=070)
+Fout=896.80 (A=004, B=070)
+Fout=897.00 (A=005, B=070)
+Fout=897.20 (A=006, B=070)
+Fout=897.40 (A=007, B=070)
+Fout=897.60 (A=008, B=070)
+Fout=897.80 (A=009, B=070)
+Fout=898.00 (A=010, B=070)
+Fout=898.20 (A=011, B=070)
+Fout=898.40 (A=012, B=070)
+Fout=898.60 (A=013, B=070)
+Fout=898.80 (A=014, B=070)
+Fout=899.00 (A=015, B=070)
+Fout=899.20 (A=016, B=070)
+Fout=899.40 (A=017, B=070)
+Fout=899.60 (A=018, B=070)
+Fout=899.80 (A=019, B=070)
+Fout=900.00 (A=020, B=070)
+Fout=900.20 (A=021, B=070)
+Fout=900.40 (A=022, B=070)
+Fout=900.60 (A=023, B=070)
+Fout=900.80 (A=024, B=070)
+Fout=901.00 (A=025, B=070)
+Fout=901.20 (A=026, B=070)
+Fout=901.40 (A=027, B=070)
+Fout=901.60 (A=028, B=070)
+Fout=901.80 (A=029, B=070)
+Fout=902.00 (A=030, B=070)
+Fout=902.20 (A=031, B=070)
+Fout=902.40 (A=032, B=070)
+Fout=902.60 (A=033, B=070)
+Fout=902.80 (A=034, B=070)
+Fout=903.00 (A=035, B=070)
+Fout=903.20 (A=036, B=070)
+Fout=903.40 (A=037, B=070)
+Fout=903.60 (A=038, B=070)
+Fout=903.80 (A=039, B=070)
+Fout=904.00 (A=040, B=070)
+Fout=904.20 (A=041, B=070)
+Fout=904.40 (A=042, B=070)
+Fout=904.60 (A=043, B=070)
+Fout=904.80 (A=044, B=070)
+Fout=905.00 (A=045, B=070)
+Fout=905.20 (A=046, B=070)
+Fout=905.40 (A=047, B=070)
+Fout=905.60 (A=048, B=070)
+Fout=905.80 (A=049, B=070)
+Fout=906.00 (A=050, B=070)
+Fout=906.20 (A=051, B=070)
+Fout=906.40 (A=052, B=070)
+Fout=906.60 (A=053, B=070)
+Fout=906.80 (A=054, B=070)
+Fout=907.00 (A=055, B=070)
+Fout=907.20 (A=056, B=070)
+Fout=907.40 (A=057, B=070)
+Fout=907.60 (A=058, B=070)
+Fout=907.80 (A=059, B=070)
+Fout=908.00 (A=060, B=070)
+Fout=908.20 (A=061, B=070)
+Fout=908.40 (A=062, B=070)
+Fout=908.60 (A=063, B=070)
+Fout=908.80 (A=000, B=071)
+Fout=909.00 (A=001, B=071)
+Fout=909.20 (A=002, B=071)
+Fout=909.40 (A=003, B=071)
+Fout=909.60 (A=004, B=071)
+Fout=909.80 (A=005, B=071)
+Fout=910.00 (A=006, B=071)
+Fout=910.20 (A=007, B=071)
+Fout=910.40 (A=008, B=071)
+Fout=910.60 (A=009, B=071)
+Fout=910.80 (A=010, B=071)
+Fout=911.00 (A=011, B=071)
+Fout=911.20 (A=012, B=071)
+Fout=911.40 (A=013, B=071)
+Fout=911.60 (A=014, B=071)
+Fout=911.80 (A=015, B=071)
+Fout=912.00 (A=016, B=071)
+Fout=912.20 (A=017, B=071)
+Fout=912.40 (A=018, B=071)
+Fout=912.60 (A=019, B=071)
+Fout=912.80 (A=020, B=071)
+Fout=913.00 (A=021, B=071)
+Fout=913.20 (A=022, B=071)
+Fout=913.40 (A=023, B=071)
+Fout=913.60 (A=024, B=071)
+Fout=913.80 (A=025, B=071)
+Fout=914.00 (A=026, B=071)
+Fout=914.20 (A=027, B=071)
+Fout=914.40 (A=028, B=071)
+Fout=914.60 (A=029, B=071)
+Fout=914.80 (A=030, B=071)
+Fout=915.00 (A=031, B=071)
+Fout=915.20 (A=032, B=071)
+Fout=915.40 (A=033, B=071)
+Fout=915.60 (A=034, B=071)
+Fout=915.80 (A=035, B=071)
+Fout=916.00 (A=036, B=071)
+Fout=916.20 (A=037, B=071)
+Fout=916.40 (A=038, B=071)
+Fout=916.60 (A=039, B=071)
+Fout=916.80 (A=040, B=071)
+Fout=917.00 (A=041, B=071)
+Fout=917.20 (A=042, B=071)
+Fout=917.40 (A=043, B=071)
+Fout=917.60 (A=044, B=071)
+Fout=917.80 (A=045, B=071)
+Fout=918.00 (A=046, B=071)
+Fout=918.20 (A=047, B=071)
+Fout=918.40 (A=048, B=071)
+Fout=918.60 (A=049, B=071)
+Fout=918.80 (A=050, B=071)
+Fout=919.00 (A=051, B=071)
+Fout=919.20 (A=052, B=071)
+Fout=919.40 (A=053, B=071)
+Fout=919.60 (A=054, B=071)
+Fout=919.80 (A=055, B=071)
+Fout=920.00 (A=056, B=071)
+Fout=920.20 (A=057, B=071)
+Fout=920.40 (A=058, B=071)
+Fout=920.60 (A=059, B=071)
+Fout=920.80 (A=060, B=071)
+Fout=921.00 (A=061, B=071)
+Fout=921.20 (A=062, B=071)
+Fout=921.40 (A=063, B=071)
+======================================================================
+PLL Tx GSM1800/1900
+Fout=1702.40 (A=000, B=133)
+Fout=1702.60 (A=001, B=133)
+Fout=1702.80 (A=002, B=133)
+Fout=1703.00 (A=003, B=133)
+Fout=1703.20 (A=004, B=133)
+Fout=1703.40 (A=005, B=133)
+Fout=1703.60 (A=006, B=133)
+Fout=1703.80 (A=007, B=133)
+Fout=1704.00 (A=008, B=133)
+Fout=1704.20 (A=009, B=133)
+Fout=1704.40 (A=010, B=133)
+Fout=1704.60 (A=011, B=133)
+Fout=1704.80 (A=012, B=133)
+Fout=1705.00 (A=013, B=133)
+Fout=1705.20 (A=014, B=133)
+Fout=1705.40 (A=015, B=133)
+Fout=1705.60 (A=016, B=133)
+Fout=1705.80 (A=017, B=133)
+Fout=1706.00 (A=018, B=133)
+Fout=1706.20 (A=019, B=133)
+Fout=1706.40 (A=020, B=133)
+Fout=1706.60 (A=021, B=133)
+Fout=1706.80 (A=022, B=133)
+Fout=1707.00 (A=023, B=133)
+Fout=1707.20 (A=024, B=133)
+Fout=1707.40 (A=025, B=133)
+Fout=1707.60 (A=026, B=133)
+Fout=1707.80 (A=027, B=133)
+Fout=1708.00 (A=028, B=133)
+Fout=1708.20 (A=029, B=133)
+Fout=1708.40 (A=030, B=133)
+Fout=1708.60 (A=031, B=133)
+Fout=1708.80 (A=032, B=133)
+Fout=1709.00 (A=033, B=133)
+Fout=1709.20 (A=034, B=133)
+Fout=1709.40 (A=035, B=133)
+Fout=1709.60 (A=036, B=133)
+Fout=1709.80 (A=037, B=133)
+Fout=1710.00 (A=038, B=133)
+Fout=1710.20 (A=039, B=133)
+Fout=1710.40 (A=040, B=133)
+Fout=1710.60 (A=041, B=133)
+Fout=1710.80 (A=042, B=133)
+Fout=1711.00 (A=043, B=133)
+Fout=1711.20 (A=044, B=133)
+Fout=1711.40 (A=045, B=133)
+Fout=1711.60 (A=046, B=133)
+Fout=1711.80 (A=047, B=133)
+Fout=1712.00 (A=048, B=133)
+Fout=1712.20 (A=049, B=133)
+Fout=1712.40 (A=050, B=133)
+Fout=1712.60 (A=051, B=133)
+Fout=1712.80 (A=052, B=133)
+Fout=1713.00 (A=053, B=133)
+Fout=1713.20 (A=054, B=133)
+Fout=1713.40 (A=055, B=133)
+Fout=1713.60 (A=056, B=133)
+Fout=1713.80 (A=057, B=133)
+Fout=1714.00 (A=058, B=133)
+Fout=1714.20 (A=059, B=133)
+Fout=1714.40 (A=060, B=133)
+Fout=1714.60 (A=061, B=133)
+Fout=1714.80 (A=062, B=133)
+Fout=1715.00 (A=063, B=133)
+Fout=1715.20 (A=000, B=134)
+Fout=1715.40 (A=001, B=134)
+Fout=1715.60 (A=002, B=134)
+Fout=1715.80 (A=003, B=134)
+Fout=1716.00 (A=004, B=134)
+Fout=1716.20 (A=005, B=134)
+Fout=1716.40 (A=006, B=134)
+Fout=1716.60 (A=007, B=134)
+Fout=1716.80 (A=008, B=134)
+Fout=1717.00 (A=009, B=134)
+Fout=1717.20 (A=010, B=134)
+Fout=1717.40 (A=011, B=134)
+Fout=1717.60 (A=012, B=134)
+Fout=1717.80 (A=013, B=134)
+Fout=1718.00 (A=014, B=134)
+Fout=1718.20 (A=015, B=134)
+Fout=1718.40 (A=016, B=134)
+Fout=1718.60 (A=017, B=134)
+Fout=1718.80 (A=018, B=134)
+Fout=1719.00 (A=019, B=134)
+Fout=1719.20 (A=020, B=134)
+Fout=1719.40 (A=021, B=134)
+Fout=1719.60 (A=022, B=134)
+Fout=1719.80 (A=023, B=134)
+Fout=1720.00 (A=024, B=134)
+Fout=1720.20 (A=025, B=134)
+Fout=1720.40 (A=026, B=134)
+Fout=1720.60 (A=027, B=134)
+Fout=1720.80 (A=028, B=134)
+Fout=1721.00 (A=029, B=134)
+Fout=1721.20 (A=030, B=134)
+Fout=1721.40 (A=031, B=134)
+Fout=1721.60 (A=032, B=134)
+Fout=1721.80 (A=033, B=134)
+Fout=1722.00 (A=034, B=134)
+Fout=1722.20 (A=035, B=134)
+Fout=1722.40 (A=036, B=134)
+Fout=1722.60 (A=037, B=134)
+Fout=1722.80 (A=038, B=134)
+Fout=1723.00 (A=039, B=134)
+Fout=1723.20 (A=040, B=134)
+Fout=1723.40 (A=041, B=134)
+Fout=1723.60 (A=042, B=134)
+Fout=1723.80 (A=043, B=134)
+Fout=1724.00 (A=044, B=134)
+Fout=1724.20 (A=045, B=134)
+Fout=1724.40 (A=046, B=134)
+Fout=1724.60 (A=047, B=134)
+Fout=1724.80 (A=048, B=134)
+Fout=1725.00 (A=049, B=134)
+Fout=1725.20 (A=050, B=134)
+Fout=1725.40 (A=051, B=134)
+Fout=1725.60 (A=052, B=134)
+Fout=1725.80 (A=053, B=134)
+Fout=1726.00 (A=054, B=134)
+Fout=1726.20 (A=055, B=134)
+Fout=1726.40 (A=056, B=134)
+Fout=1726.60 (A=057, B=134)
+Fout=1726.80 (A=058, B=134)
+Fout=1727.00 (A=059, B=134)
+Fout=1727.20 (A=060, B=134)
+Fout=1727.40 (A=061, B=134)
+Fout=1727.60 (A=062, B=134)
+Fout=1727.80 (A=063, B=134)
+Fout=1728.00 (A=000, B=135)
+Fout=1728.20 (A=001, B=135)
+Fout=1728.40 (A=002, B=135)
+Fout=1728.60 (A=003, B=135)
+Fout=1728.80 (A=004, B=135)
+Fout=1729.00 (A=005, B=135)
+Fout=1729.20 (A=006, B=135)
+Fout=1729.40 (A=007, B=135)
+Fout=1729.60 (A=008, B=135)
+Fout=1729.80 (A=009, B=135)
+Fout=1730.00 (A=010, B=135)
+Fout=1730.20 (A=011, B=135)
+Fout=1730.40 (A=012, B=135)
+Fout=1730.60 (A=013, B=135)
+Fout=1730.80 (A=014, B=135)
+Fout=1731.00 (A=015, B=135)
+Fout=1731.20 (A=016, B=135)
+Fout=1731.40 (A=017, B=135)
+Fout=1731.60 (A=018, B=135)
+Fout=1731.80 (A=019, B=135)
+Fout=1732.00 (A=020, B=135)
+Fout=1732.20 (A=021, B=135)
+Fout=1732.40 (A=022, B=135)
+Fout=1732.60 (A=023, B=135)
+Fout=1732.80 (A=024, B=135)
+Fout=1733.00 (A=025, B=135)
+Fout=1733.20 (A=026, B=135)
+Fout=1733.40 (A=027, B=135)
+Fout=1733.60 (A=028, B=135)
+Fout=1733.80 (A=029, B=135)
+Fout=1734.00 (A=030, B=135)
+Fout=1734.20 (A=031, B=135)
+Fout=1734.40 (A=032, B=135)
+Fout=1734.60 (A=033, B=135)
+Fout=1734.80 (A=034, B=135)
+Fout=1735.00 (A=035, B=135)
+Fout=1735.20 (A=036, B=135)
+Fout=1735.40 (A=037, B=135)
+Fout=1735.60 (A=038, B=135)
+Fout=1735.80 (A=039, B=135)
+Fout=1736.00 (A=040, B=135)
+Fout=1736.20 (A=041, B=135)
+Fout=1736.40 (A=042, B=135)
+Fout=1736.60 (A=043, B=135)
+Fout=1736.80 (A=044, B=135)
+Fout=1737.00 (A=045, B=135)
+Fout=1737.20 (A=046, B=135)
+Fout=1737.40 (A=047, B=135)
+Fout=1737.60 (A=048, B=135)
+Fout=1737.80 (A=049, B=135)
+Fout=1738.00 (A=050, B=135)
+Fout=1738.20 (A=051, B=135)
+Fout=1738.40 (A=052, B=135)
+Fout=1738.60 (A=053, B=135)
+Fout=1738.80 (A=054, B=135)
+Fout=1739.00 (A=055, B=135)
+Fout=1739.20 (A=056, B=135)
+Fout=1739.40 (A=057, B=135)
+Fout=1739.60 (A=058, B=135)
+Fout=1739.80 (A=059, B=135)
+Fout=1740.00 (A=060, B=135)
+Fout=1740.20 (A=061, B=135)
+Fout=1740.40 (A=062, B=135)
+Fout=1740.60 (A=063, B=135)
+Fout=1740.80 (A=000, B=136)
+Fout=1741.00 (A=001, B=136)
+Fout=1741.20 (A=002, B=136)
+Fout=1741.40 (A=003, B=136)
+Fout=1741.60 (A=004, B=136)
+Fout=1741.80 (A=005, B=136)
+Fout=1742.00 (A=006, B=136)
+Fout=1742.20 (A=007, B=136)
+Fout=1742.40 (A=008, B=136)
+Fout=1742.60 (A=009, B=136)
+Fout=1742.80 (A=010, B=136)
+Fout=1743.00 (A=011, B=136)
+Fout=1743.20 (A=012, B=136)
+Fout=1743.40 (A=013, B=136)
+Fout=1743.60 (A=014, B=136)
+Fout=1743.80 (A=015, B=136)
+Fout=1744.00 (A=016, B=136)
+Fout=1744.20 (A=017, B=136)
+Fout=1744.40 (A=018, B=136)
+Fout=1744.60 (A=019, B=136)
+Fout=1744.80 (A=020, B=136)
+Fout=1745.00 (A=021, B=136)
+Fout=1745.20 (A=022, B=136)
+Fout=1745.40 (A=023, B=136)
+Fout=1745.60 (A=024, B=136)
+Fout=1745.80 (A=025, B=136)
+Fout=1746.00 (A=026, B=136)
+Fout=1746.20 (A=027, B=136)
+Fout=1746.40 (A=028, B=136)
+Fout=1746.60 (A=029, B=136)
+Fout=1746.80 (A=030, B=136)
+Fout=1747.00 (A=031, B=136)
+Fout=1747.20 (A=032, B=136)
+Fout=1747.40 (A=033, B=136)
+Fout=1747.60 (A=034, B=136)
+Fout=1747.80 (A=035, B=136)
+Fout=1748.00 (A=036, B=136)
+Fout=1748.20 (A=037, B=136)
+Fout=1748.40 (A=038, B=136)
+Fout=1748.60 (A=039, B=136)
+Fout=1748.80 (A=040, B=136)
+Fout=1749.00 (A=041, B=136)
+Fout=1749.20 (A=042, B=136)
+Fout=1749.40 (A=043, B=136)
+Fout=1749.60 (A=044, B=136)
+Fout=1749.80 (A=045, B=136)
+Fout=1750.00 (A=046, B=136)
+Fout=1750.20 (A=047, B=136)
+Fout=1750.40 (A=048, B=136)
+Fout=1750.60 (A=049, B=136)
+Fout=1750.80 (A=050, B=136)
+Fout=1751.00 (A=051, B=136)
+Fout=1751.20 (A=052, B=136)
+Fout=1751.40 (A=053, B=136)
+Fout=1751.60 (A=054, B=136)
+Fout=1751.80 (A=055, B=136)
+Fout=1752.00 (A=056, B=136)
+Fout=1752.20 (A=057, B=136)
+Fout=1752.40 (A=058, B=136)
+Fout=1752.60 (A=059, B=136)
+Fout=1752.80 (A=060, B=136)
+Fout=1753.00 (A=061, B=136)
+Fout=1753.20 (A=062, B=136)
+Fout=1753.40 (A=063, B=136)
+Fout=1753.60 (A=000, B=137)
+Fout=1753.80 (A=001, B=137)
+Fout=1754.00 (A=002, B=137)
+Fout=1754.20 (A=003, B=137)
+Fout=1754.40 (A=004, B=137)
+Fout=1754.60 (A=005, B=137)
+Fout=1754.80 (A=006, B=137)
+Fout=1755.00 (A=007, B=137)
+Fout=1755.20 (A=008, B=137)
+Fout=1755.40 (A=009, B=137)
+Fout=1755.60 (A=010, B=137)
+Fout=1755.80 (A=011, B=137)
+Fout=1756.00 (A=012, B=137)
+Fout=1756.20 (A=013, B=137)
+Fout=1756.40 (A=014, B=137)
+Fout=1756.60 (A=015, B=137)
+Fout=1756.80 (A=016, B=137)
+Fout=1757.00 (A=017, B=137)
+Fout=1757.20 (A=018, B=137)
+Fout=1757.40 (A=019, B=137)
+Fout=1757.60 (A=020, B=137)
+Fout=1757.80 (A=021, B=137)
+Fout=1758.00 (A=022, B=137)
+Fout=1758.20 (A=023, B=137)
+Fout=1758.40 (A=024, B=137)
+Fout=1758.60 (A=025, B=137)
+Fout=1758.80 (A=026, B=137)
+Fout=1759.00 (A=027, B=137)
+Fout=1759.20 (A=028, B=137)
+Fout=1759.40 (A=029, B=137)
+Fout=1759.60 (A=030, B=137)
+Fout=1759.80 (A=031, B=137)
+Fout=1760.00 (A=032, B=137)
+Fout=1760.20 (A=033, B=137)
+Fout=1760.40 (A=034, B=137)
+Fout=1760.60 (A=035, B=137)
+Fout=1760.80 (A=036, B=137)
+Fout=1761.00 (A=037, B=137)
+Fout=1761.20 (A=038, B=137)
+Fout=1761.40 (A=039, B=137)
+Fout=1761.60 (A=040, B=137)
+Fout=1761.80 (A=041, B=137)
+Fout=1762.00 (A=042, B=137)
+Fout=1762.20 (A=043, B=137)
+Fout=1762.40 (A=044, B=137)
+Fout=1762.60 (A=045, B=137)
+Fout=1762.80 (A=046, B=137)
+Fout=1763.00 (A=047, B=137)
+Fout=1763.20 (A=048, B=137)
+Fout=1763.40 (A=049, B=137)
+Fout=1763.60 (A=050, B=137)
+Fout=1763.80 (A=051, B=137)
+Fout=1764.00 (A=052, B=137)
+Fout=1764.20 (A=053, B=137)
+Fout=1764.40 (A=054, B=137)
+Fout=1764.60 (A=055, B=137)
+Fout=1764.80 (A=056, B=137)
+Fout=1765.00 (A=057, B=137)
+Fout=1765.20 (A=058, B=137)
+Fout=1765.40 (A=059, B=137)
+Fout=1765.60 (A=060, B=137)
+Fout=1765.80 (A=061, B=137)
+Fout=1766.00 (A=062, B=137)
+Fout=1766.20 (A=063, B=137)
+Fout=1766.40 (A=000, B=138)
+Fout=1766.60 (A=001, B=138)
+Fout=1766.80 (A=002, B=138)
+Fout=1767.00 (A=003, B=138)
+Fout=1767.20 (A=004, B=138)
+Fout=1767.40 (A=005, B=138)
+Fout=1767.60 (A=006, B=138)
+Fout=1767.80 (A=007, B=138)
+Fout=1768.00 (A=008, B=138)
+Fout=1768.20 (A=009, B=138)
+Fout=1768.40 (A=010, B=138)
+Fout=1768.60 (A=011, B=138)
+Fout=1768.80 (A=012, B=138)
+Fout=1769.00 (A=013, B=138)
+Fout=1769.20 (A=014, B=138)
+Fout=1769.40 (A=015, B=138)
+Fout=1769.60 (A=016, B=138)
+Fout=1769.80 (A=017, B=138)
+Fout=1770.00 (A=018, B=138)
+Fout=1770.20 (A=019, B=138)
+Fout=1770.40 (A=020, B=138)
+Fout=1770.60 (A=021, B=138)
+Fout=1770.80 (A=022, B=138)
+Fout=1771.00 (A=023, B=138)
+Fout=1771.20 (A=024, B=138)
+Fout=1771.40 (A=025, B=138)
+Fout=1771.60 (A=026, B=138)
+Fout=1771.80 (A=027, B=138)
+Fout=1772.00 (A=028, B=138)
+Fout=1772.20 (A=029, B=138)
+Fout=1772.40 (A=030, B=138)
+Fout=1772.60 (A=031, B=138)
+Fout=1772.80 (A=032, B=138)
+Fout=1773.00 (A=033, B=138)
+Fout=1773.20 (A=034, B=138)
+Fout=1773.40 (A=035, B=138)
+Fout=1773.60 (A=036, B=138)
+Fout=1773.80 (A=037, B=138)
+Fout=1774.00 (A=038, B=138)
+Fout=1774.20 (A=039, B=138)
+Fout=1774.40 (A=040, B=138)
+Fout=1774.60 (A=041, B=138)
+Fout=1774.80 (A=042, B=138)
+Fout=1775.00 (A=043, B=138)
+Fout=1775.20 (A=044, B=138)
+Fout=1775.40 (A=045, B=138)
+Fout=1775.60 (A=046, B=138)
+Fout=1775.80 (A=047, B=138)
+Fout=1776.00 (A=048, B=138)
+Fout=1776.20 (A=049, B=138)
+Fout=1776.40 (A=050, B=138)
+Fout=1776.60 (A=051, B=138)
+Fout=1776.80 (A=052, B=138)
+Fout=1777.00 (A=053, B=138)
+Fout=1777.20 (A=054, B=138)
+Fout=1777.40 (A=055, B=138)
+Fout=1777.60 (A=056, B=138)
+Fout=1777.80 (A=057, B=138)
+Fout=1778.00 (A=058, B=138)
+Fout=1778.20 (A=059, B=138)
+Fout=1778.40 (A=060, B=138)
+Fout=1778.60 (A=061, B=138)
+Fout=1778.80 (A=062, B=138)
+Fout=1779.00 (A=063, B=138)
+Fout=1779.20 (A=000, B=139)
+Fout=1779.40 (A=001, B=139)
+Fout=1779.60 (A=002, B=139)
+Fout=1779.80 (A=003, B=139)
+Fout=1780.00 (A=004, B=139)
+Fout=1780.20 (A=005, B=139)
+Fout=1780.40 (A=006, B=139)
+Fout=1780.60 (A=007, B=139)
+Fout=1780.80 (A=008, B=139)
+Fout=1781.00 (A=009, B=139)
+Fout=1781.20 (A=010, B=139)
+Fout=1781.40 (A=011, B=139)
+Fout=1781.60 (A=012, B=139)
+Fout=1781.80 (A=013, B=139)
+Fout=1782.00 (A=014, B=139)
+Fout=1782.20 (A=015, B=139)
+Fout=1782.40 (A=016, B=139)
+Fout=1782.60 (A=017, B=139)
+Fout=1782.80 (A=018, B=139)
+Fout=1783.00 (A=019, B=139)
+Fout=1783.20 (A=020, B=139)
+Fout=1783.40 (A=021, B=139)
+Fout=1783.60 (A=022, B=139)
+Fout=1783.80 (A=023, B=139)
+Fout=1784.00 (A=024, B=139)
+Fout=1784.20 (A=025, B=139)
+Fout=1784.40 (A=026, B=139)
+Fout=1784.60 (A=027, B=139)
+Fout=1784.80 (A=028, B=139)
+Fout=1785.00 (A=029, B=139)
+Fout=1785.20 (A=030, B=139)
+Fout=1785.40 (A=031, B=139)
+Fout=1785.60 (A=032, B=139)
+Fout=1785.80 (A=033, B=139)
+Fout=1786.00 (A=034, B=139)
+Fout=1786.20 (A=035, B=139)
+Fout=1786.40 (A=036, B=139)
+Fout=1786.60 (A=037, B=139)
+Fout=1786.80 (A=038, B=139)
+Fout=1787.00 (A=039, B=139)
+Fout=1787.20 (A=040, B=139)
+Fout=1787.40 (A=041, B=139)
+Fout=1787.60 (A=042, B=139)
+Fout=1787.80 (A=043, B=139)
+Fout=1788.00 (A=044, B=139)
+Fout=1788.20 (A=045, B=139)
+Fout=1788.40 (A=046, B=139)
+Fout=1788.60 (A=047, B=139)
+Fout=1788.80 (A=048, B=139)
+Fout=1789.00 (A=049, B=139)
+Fout=1789.20 (A=050, B=139)
+Fout=1789.40 (A=051, B=139)
+Fout=1789.60 (A=052, B=139)
+Fout=1789.80 (A=053, B=139)
+Fout=1790.00 (A=054, B=139)
+Fout=1790.20 (A=055, B=139)
+Fout=1790.40 (A=056, B=139)
+Fout=1790.60 (A=057, B=139)
+Fout=1790.80 (A=058, B=139)
+Fout=1791.00 (A=059, B=139)
+Fout=1791.20 (A=060, B=139)
+Fout=1791.40 (A=061, B=139)
+Fout=1791.60 (A=062, B=139)
+Fout=1791.80 (A=063, B=139)
+Fout=1792.00 (A=000, B=140)
+Fout=1792.20 (A=001, B=140)
+Fout=1792.40 (A=002, B=140)
+Fout=1792.60 (A=003, B=140)
+Fout=1792.80 (A=004, B=140)
+Fout=1793.00 (A=005, B=140)
+Fout=1793.20 (A=006, B=140)
+Fout=1793.40 (A=007, B=140)
+Fout=1793.60 (A=008, B=140)
+Fout=1793.80 (A=009, B=140)
+Fout=1794.00 (A=010, B=140)
+Fout=1794.20 (A=011, B=140)
+Fout=1794.40 (A=012, B=140)
+Fout=1794.60 (A=013, B=140)
+Fout=1794.80 (A=014, B=140)
+Fout=1795.00 (A=015, B=140)
+Fout=1795.20 (A=016, B=140)
+Fout=1795.40 (A=017, B=140)
+Fout=1795.60 (A=018, B=140)
+Fout=1795.80 (A=019, B=140)
+Fout=1796.00 (A=020, B=140)
+Fout=1796.20 (A=021, B=140)
+Fout=1796.40 (A=022, B=140)
+Fout=1796.60 (A=023, B=140)
+Fout=1796.80 (A=024, B=140)
+Fout=1797.00 (A=025, B=140)
+Fout=1797.20 (A=026, B=140)
+Fout=1797.40 (A=027, B=140)
+Fout=1797.60 (A=028, B=140)
+Fout=1797.80 (A=029, B=140)
+Fout=1798.00 (A=030, B=140)
+Fout=1798.20 (A=031, B=140)
+Fout=1798.40 (A=032, B=140)
+Fout=1798.60 (A=033, B=140)
+Fout=1798.80 (A=034, B=140)
+Fout=1799.00 (A=035, B=140)
+Fout=1799.20 (A=036, B=140)
+Fout=1799.40 (A=037, B=140)
+Fout=1799.60 (A=038, B=140)
+Fout=1799.80 (A=039, B=140)
+Fout=1800.00 (A=040, B=140)
+Fout=1800.20 (A=041, B=140)
+Fout=1800.40 (A=042, B=140)
+Fout=1800.60 (A=043, B=140)
+Fout=1800.80 (A=044, B=140)
+Fout=1801.00 (A=045, B=140)
+Fout=1801.20 (A=046, B=140)
+Fout=1801.40 (A=047, B=140)
+Fout=1801.60 (A=048, B=140)
+Fout=1801.80 (A=049, B=140)
+Fout=1802.00 (A=050, B=140)
+Fout=1802.20 (A=051, B=140)
+Fout=1802.40 (A=052, B=140)
+Fout=1802.60 (A=053, B=140)
+Fout=1802.80 (A=054, B=140)
+Fout=1803.00 (A=055, B=140)
+Fout=1803.20 (A=056, B=140)
+Fout=1803.40 (A=057, B=140)
+Fout=1803.60 (A=058, B=140)
+Fout=1803.80 (A=059, B=140)
+Fout=1804.00 (A=060, B=140)
+Fout=1804.20 (A=061, B=140)
+Fout=1804.40 (A=062, B=140)
+Fout=1804.60 (A=063, B=140)
+Fout=1804.80 (A=000, B=141)
+Fout=1805.00 (A=001, B=141)
+Fout=1805.20 (A=002, B=141)
+Fout=1805.40 (A=003, B=141)
+Fout=1805.60 (A=004, B=141)
+Fout=1805.80 (A=005, B=141)
+Fout=1806.00 (A=006, B=141)
+Fout=1806.20 (A=007, B=141)
+Fout=1806.40 (A=008, B=141)
+Fout=1806.60 (A=009, B=141)
+Fout=1806.80 (A=010, B=141)
+Fout=1807.00 (A=011, B=141)
+Fout=1807.20 (A=012, B=141)
+Fout=1807.40 (A=013, B=141)
+Fout=1807.60 (A=014, B=141)
+Fout=1807.80 (A=015, B=141)
+Fout=1808.00 (A=016, B=141)
+Fout=1808.20 (A=017, B=141)
+Fout=1808.40 (A=018, B=141)
+Fout=1808.60 (A=019, B=141)
+Fout=1808.80 (A=020, B=141)
+Fout=1809.00 (A=021, B=141)
+Fout=1809.20 (A=022, B=141)
+Fout=1809.40 (A=023, B=141)
+Fout=1809.60 (A=024, B=141)
+Fout=1809.80 (A=025, B=141)
+Fout=1810.00 (A=026, B=141)
+Fout=1810.20 (A=027, B=141)
+Fout=1810.40 (A=028, B=141)
+Fout=1810.60 (A=029, B=141)
+Fout=1810.80 (A=030, B=141)
+Fout=1811.00 (A=031, B=141)
+Fout=1811.20 (A=032, B=141)
+Fout=1811.40 (A=033, B=141)
+Fout=1811.60 (A=034, B=141)
+Fout=1811.80 (A=035, B=141)
+Fout=1812.00 (A=036, B=141)
+Fout=1812.20 (A=037, B=141)
+Fout=1812.40 (A=038, B=141)
+Fout=1812.60 (A=039, B=141)
+Fout=1812.80 (A=040, B=141)
+Fout=1813.00 (A=041, B=141)
+Fout=1813.20 (A=042, B=141)
+Fout=1813.40 (A=043, B=141)
+Fout=1813.60 (A=044, B=141)
+Fout=1813.80 (A=045, B=141)
+Fout=1814.00 (A=046, B=141)
+Fout=1814.20 (A=047, B=141)
+Fout=1814.40 (A=048, B=141)
+Fout=1814.60 (A=049, B=141)
+Fout=1814.80 (A=050, B=141)
+Fout=1815.00 (A=051, B=141)
+Fout=1815.20 (A=052, B=141)
+Fout=1815.40 (A=053, B=141)
+Fout=1815.60 (A=054, B=141)
+Fout=1815.80 (A=055, B=141)
+Fout=1816.00 (A=056, B=141)
+Fout=1816.20 (A=057, B=141)
+Fout=1816.40 (A=058, B=141)
+Fout=1816.60 (A=059, B=141)
+Fout=1816.80 (A=060, B=141)
+Fout=1817.00 (A=061, B=141)
+Fout=1817.20 (A=062, B=141)
+Fout=1817.40 (A=063, B=141)
+Fout=1817.60 (A=000, B=142)
+Fout=1817.80 (A=001, B=142)
+Fout=1818.00 (A=002, B=142)
+Fout=1818.20 (A=003, B=142)
+Fout=1818.40 (A=004, B=142)
+Fout=1818.60 (A=005, B=142)
+Fout=1818.80 (A=006, B=142)
+Fout=1819.00 (A=007, B=142)
+Fout=1819.20 (A=008, B=142)
+Fout=1819.40 (A=009, B=142)
+Fout=1819.60 (A=010, B=142)
+Fout=1819.80 (A=011, B=142)
+Fout=1820.00 (A=012, B=142)
+Fout=1820.20 (A=013, B=142)
+Fout=1820.40 (A=014, B=142)
+Fout=1820.60 (A=015, B=142)
+Fout=1820.80 (A=016, B=142)
+Fout=1821.00 (A=017, B=142)
+Fout=1821.20 (A=018, B=142)
+Fout=1821.40 (A=019, B=142)
+Fout=1821.60 (A=020, B=142)
+Fout=1821.80 (A=021, B=142)
+Fout=1822.00 (A=022, B=142)
+Fout=1822.20 (A=023, B=142)
+Fout=1822.40 (A=024, B=142)
+Fout=1822.60 (A=025, B=142)
+Fout=1822.80 (A=026, B=142)
+Fout=1823.00 (A=027, B=142)
+Fout=1823.20 (A=028, B=142)
+Fout=1823.40 (A=029, B=142)
+Fout=1823.60 (A=030, B=142)
+Fout=1823.80 (A=031, B=142)
+Fout=1824.00 (A=032, B=142)
+Fout=1824.20 (A=033, B=142)
+Fout=1824.40 (A=034, B=142)
+Fout=1824.60 (A=035, B=142)
+Fout=1824.80 (A=036, B=142)
+Fout=1825.00 (A=037, B=142)
+Fout=1825.20 (A=038, B=142)
+Fout=1825.40 (A=039, B=142)
+Fout=1825.60 (A=040, B=142)
+Fout=1825.80 (A=041, B=142)
+Fout=1826.00 (A=042, B=142)
+Fout=1826.20 (A=043, B=142)
+Fout=1826.40 (A=044, B=142)
+Fout=1826.60 (A=045, B=142)
+Fout=1826.80 (A=046, B=142)
+Fout=1827.00 (A=047, B=142)
+Fout=1827.20 (A=048, B=142)
+Fout=1827.40 (A=049, B=142)
+Fout=1827.60 (A=050, B=142)
+Fout=1827.80 (A=051, B=142)
+Fout=1828.00 (A=052, B=142)
+Fout=1828.20 (A=053, B=142)
+Fout=1828.40 (A=054, B=142)
+Fout=1828.60 (A=055, B=142)
+Fout=1828.80 (A=056, B=142)
+Fout=1829.00 (A=057, B=142)
+Fout=1829.20 (A=058, B=142)
+Fout=1829.40 (A=059, B=142)
+Fout=1829.60 (A=060, B=142)
+Fout=1829.80 (A=061, B=142)
+Fout=1830.00 (A=062, B=142)
+Fout=1830.20 (A=063, B=142)
+Fout=1830.40 (A=000, B=143)
+Fout=1830.60 (A=001, B=143)
+Fout=1830.80 (A=002, B=143)
+Fout=1831.00 (A=003, B=143)
+Fout=1831.20 (A=004, B=143)
+Fout=1831.40 (A=005, B=143)
+Fout=1831.60 (A=006, B=143)
+Fout=1831.80 (A=007, B=143)
+Fout=1832.00 (A=008, B=143)
+Fout=1832.20 (A=009, B=143)
+Fout=1832.40 (A=010, B=143)
+Fout=1832.60 (A=011, B=143)
+Fout=1832.80 (A=012, B=143)
+Fout=1833.00 (A=013, B=143)
+Fout=1833.20 (A=014, B=143)
+Fout=1833.40 (A=015, B=143)
+Fout=1833.60 (A=016, B=143)
+Fout=1833.80 (A=017, B=143)
+Fout=1834.00 (A=018, B=143)
+Fout=1834.20 (A=019, B=143)
+Fout=1834.40 (A=020, B=143)
+Fout=1834.60 (A=021, B=143)
+Fout=1834.80 (A=022, B=143)
+Fout=1835.00 (A=023, B=143)
+Fout=1835.20 (A=024, B=143)
+Fout=1835.40 (A=025, B=143)
+Fout=1835.60 (A=026, B=143)
+Fout=1835.80 (A=027, B=143)
+Fout=1836.00 (A=028, B=143)
+Fout=1836.20 (A=029, B=143)
+Fout=1836.40 (A=030, B=143)
+Fout=1836.60 (A=031, B=143)
+Fout=1836.80 (A=032, B=143)
+Fout=1837.00 (A=033, B=143)
+Fout=1837.20 (A=034, B=143)
+Fout=1837.40 (A=035, B=143)
+Fout=1837.60 (A=036, B=143)
+Fout=1837.80 (A=037, B=143)
+Fout=1838.00 (A=038, B=143)
+Fout=1838.20 (A=039, B=143)
+Fout=1838.40 (A=040, B=143)
+Fout=1838.60 (A=041, B=143)
+Fout=1838.80 (A=042, B=143)
+Fout=1839.00 (A=043, B=143)
+Fout=1839.20 (A=044, B=143)
+Fout=1839.40 (A=045, B=143)
+Fout=1839.60 (A=046, B=143)
+Fout=1839.80 (A=047, B=143)
+Fout=1840.00 (A=048, B=143)
+Fout=1840.20 (A=049, B=143)
+Fout=1840.40 (A=050, B=143)
+Fout=1840.60 (A=051, B=143)
+Fout=1840.80 (A=052, B=143)
+Fout=1841.00 (A=053, B=143)
+Fout=1841.20 (A=054, B=143)
+Fout=1841.40 (A=055, B=143)
+Fout=1841.60 (A=056, B=143)
+Fout=1841.80 (A=057, B=143)
+Fout=1842.00 (A=058, B=143)
+Fout=1842.20 (A=059, B=143)
+Fout=1842.40 (A=060, B=143)
+Fout=1842.60 (A=061, B=143)
+Fout=1842.80 (A=062, B=143)
+Fout=1843.00 (A=063, B=143)
+Fout=1843.20 (A=000, B=144)
+Fout=1843.40 (A=001, B=144)
+Fout=1843.60 (A=002, B=144)
+Fout=1843.80 (A=003, B=144)
+Fout=1844.00 (A=004, B=144)
+Fout=1844.20 (A=005, B=144)
+Fout=1844.40 (A=006, B=144)
+Fout=1844.60 (A=007, B=144)
+Fout=1844.80 (A=008, B=144)
+Fout=1845.00 (A=009, B=144)
+Fout=1845.20 (A=010, B=144)
+Fout=1845.40 (A=011, B=144)
+Fout=1845.60 (A=012, B=144)
+Fout=1845.80 (A=013, B=144)
+Fout=1846.00 (A=014, B=144)
+Fout=1846.20 (A=015, B=144)
+Fout=1846.40 (A=016, B=144)
+Fout=1846.60 (A=017, B=144)
+Fout=1846.80 (A=018, B=144)
+Fout=1847.00 (A=019, B=144)
+Fout=1847.20 (A=020, B=144)
+Fout=1847.40 (A=021, B=144)
+Fout=1847.60 (A=022, B=144)
+Fout=1847.80 (A=023, B=144)
+Fout=1848.00 (A=024, B=144)
+Fout=1848.20 (A=025, B=144)
+Fout=1848.40 (A=026, B=144)
+Fout=1848.60 (A=027, B=144)
+Fout=1848.80 (A=028, B=144)
+Fout=1849.00 (A=029, B=144)
+Fout=1849.20 (A=030, B=144)
+Fout=1849.40 (A=031, B=144)
+Fout=1849.60 (A=032, B=144)
+Fout=1849.80 (A=033, B=144)
+Fout=1850.00 (A=034, B=144)
+Fout=1850.20 (A=035, B=144)
+Fout=1850.40 (A=036, B=144)
+Fout=1850.60 (A=037, B=144)
+Fout=1850.80 (A=038, B=144)
+Fout=1851.00 (A=039, B=144)
+Fout=1851.20 (A=040, B=144)
+Fout=1851.40 (A=041, B=144)
+Fout=1851.60 (A=042, B=144)
+Fout=1851.80 (A=043, B=144)
+Fout=1852.00 (A=044, B=144)
+Fout=1852.20 (A=045, B=144)
+Fout=1852.40 (A=046, B=144)
+Fout=1852.60 (A=047, B=144)
+Fout=1852.80 (A=048, B=144)
+Fout=1853.00 (A=049, B=144)
+Fout=1853.20 (A=050, B=144)
+Fout=1853.40 (A=051, B=144)
+Fout=1853.60 (A=052, B=144)
+Fout=1853.80 (A=053, B=144)
+Fout=1854.00 (A=054, B=144)
+Fout=1854.20 (A=055, B=144)
+Fout=1854.40 (A=056, B=144)
+Fout=1854.60 (A=057, B=144)
+Fout=1854.80 (A=058, B=144)
+Fout=1855.00 (A=059, B=144)
+Fout=1855.20 (A=060, B=144)
+Fout=1855.40 (A=061, B=144)
+Fout=1855.60 (A=062, B=144)
+Fout=1855.80 (A=063, B=144)
+Fout=1856.00 (A=000, B=145)
+Fout=1856.20 (A=001, B=145)
+Fout=1856.40 (A=002, B=145)
+Fout=1856.60 (A=003, B=145)
+Fout=1856.80 (A=004, B=145)
+Fout=1857.00 (A=005, B=145)
+Fout=1857.20 (A=006, B=145)
+Fout=1857.40 (A=007, B=145)
+Fout=1857.60 (A=008, B=145)
+Fout=1857.80 (A=009, B=145)
+Fout=1858.00 (A=010, B=145)
+Fout=1858.20 (A=011, B=145)
+Fout=1858.40 (A=012, B=145)
+Fout=1858.60 (A=013, B=145)
+Fout=1858.80 (A=014, B=145)
+Fout=1859.00 (A=015, B=145)
+Fout=1859.20 (A=016, B=145)
+Fout=1859.40 (A=017, B=145)
+Fout=1859.60 (A=018, B=145)
+Fout=1859.80 (A=019, B=145)
+Fout=1860.00 (A=020, B=145)
+Fout=1860.20 (A=021, B=145)
+Fout=1860.40 (A=022, B=145)
+Fout=1860.60 (A=023, B=145)
+Fout=1860.80 (A=024, B=145)
+Fout=1861.00 (A=025, B=145)
+Fout=1861.20 (A=026, B=145)
+Fout=1861.40 (A=027, B=145)
+Fout=1861.60 (A=028, B=145)
+Fout=1861.80 (A=029, B=145)
+Fout=1862.00 (A=030, B=145)
+Fout=1862.20 (A=031, B=145)
+Fout=1862.40 (A=032, B=145)
+Fout=1862.60 (A=033, B=145)
+Fout=1862.80 (A=034, B=145)
+Fout=1863.00 (A=035, B=145)
+Fout=1863.20 (A=036, B=145)
+Fout=1863.40 (A=037, B=145)
+Fout=1863.60 (A=038, B=145)
+Fout=1863.80 (A=039, B=145)
+Fout=1864.00 (A=040, B=145)
+Fout=1864.20 (A=041, B=145)
+Fout=1864.40 (A=042, B=145)
+Fout=1864.60 (A=043, B=145)
+Fout=1864.80 (A=044, B=145)
+Fout=1865.00 (A=045, B=145)
+Fout=1865.20 (A=046, B=145)
+Fout=1865.40 (A=047, B=145)
+Fout=1865.60 (A=048, B=145)
+Fout=1865.80 (A=049, B=145)
+Fout=1866.00 (A=050, B=145)
+Fout=1866.20 (A=051, B=145)
+Fout=1866.40 (A=052, B=145)
+Fout=1866.60 (A=053, B=145)
+Fout=1866.80 (A=054, B=145)
+Fout=1867.00 (A=055, B=145)
+Fout=1867.20 (A=056, B=145)
+Fout=1867.40 (A=057, B=145)
+Fout=1867.60 (A=058, B=145)
+Fout=1867.80 (A=059, B=145)
+Fout=1868.00 (A=060, B=145)
+Fout=1868.20 (A=061, B=145)
+Fout=1868.40 (A=062, B=145)
+Fout=1868.60 (A=063, B=145)
+Fout=1868.80 (A=000, B=146)
+Fout=1869.00 (A=001, B=146)
+Fout=1869.20 (A=002, B=146)
+Fout=1869.40 (A=003, B=146)
+Fout=1869.60 (A=004, B=146)
+Fout=1869.80 (A=005, B=146)
+Fout=1870.00 (A=006, B=146)
+Fout=1870.20 (A=007, B=146)
+Fout=1870.40 (A=008, B=146)
+Fout=1870.60 (A=009, B=146)
+Fout=1870.80 (A=010, B=146)
+Fout=1871.00 (A=011, B=146)
+Fout=1871.20 (A=012, B=146)
+Fout=1871.40 (A=013, B=146)
+Fout=1871.60 (A=014, B=146)
+Fout=1871.80 (A=015, B=146)
+Fout=1872.00 (A=016, B=146)
+Fout=1872.20 (A=017, B=146)
+Fout=1872.40 (A=018, B=146)
+Fout=1872.60 (A=019, B=146)
+Fout=1872.80 (A=020, B=146)
+Fout=1873.00 (A=021, B=146)
+Fout=1873.20 (A=022, B=146)
+Fout=1873.40 (A=023, B=146)
+Fout=1873.60 (A=024, B=146)
+Fout=1873.80 (A=025, B=146)
+Fout=1874.00 (A=026, B=146)
+Fout=1874.20 (A=027, B=146)
+Fout=1874.40 (A=028, B=146)
+Fout=1874.60 (A=029, B=146)
+Fout=1874.80 (A=030, B=146)
+Fout=1875.00 (A=031, B=146)
+Fout=1875.20 (A=032, B=146)
+Fout=1875.40 (A=033, B=146)
+Fout=1875.60 (A=034, B=146)
+Fout=1875.80 (A=035, B=146)
+Fout=1876.00 (A=036, B=146)
+Fout=1876.20 (A=037, B=146)
+Fout=1876.40 (A=038, B=146)
+Fout=1876.60 (A=039, B=146)
+Fout=1876.80 (A=040, B=146)
+Fout=1877.00 (A=041, B=146)
+Fout=1877.20 (A=042, B=146)
+Fout=1877.40 (A=043, B=146)
+Fout=1877.60 (A=044, B=146)
+Fout=1877.80 (A=045, B=146)
+Fout=1878.00 (A=046, B=146)
+Fout=1878.20 (A=047, B=146)
+Fout=1878.40 (A=048, B=146)
+Fout=1878.60 (A=049, B=146)
+Fout=1878.80 (A=050, B=146)
+Fout=1879.00 (A=051, B=146)
+Fout=1879.20 (A=052, B=146)
+Fout=1879.40 (A=053, B=146)
+Fout=1879.60 (A=054, B=146)
+Fout=1879.80 (A=055, B=146)
+Fout=1880.00 (A=056, B=146)
+Fout=1880.20 (A=057, B=146)
+Fout=1880.40 (A=058, B=146)
+Fout=1880.60 (A=059, B=146)
+Fout=1880.80 (A=060, B=146)
+Fout=1881.00 (A=061, B=146)
+Fout=1881.20 (A=062, B=146)
+Fout=1881.40 (A=063, B=146)
+Fout=1881.60 (A=000, B=147)
+Fout=1881.80 (A=001, B=147)
+Fout=1882.00 (A=002, B=147)
+Fout=1882.20 (A=003, B=147)
+Fout=1882.40 (A=004, B=147)
+Fout=1882.60 (A=005, B=147)
+Fout=1882.80 (A=006, B=147)
+Fout=1883.00 (A=007, B=147)
+Fout=1883.20 (A=008, B=147)
+Fout=1883.40 (A=009, B=147)
+Fout=1883.60 (A=010, B=147)
+Fout=1883.80 (A=011, B=147)
+Fout=1884.00 (A=012, B=147)
+Fout=1884.20 (A=013, B=147)
+Fout=1884.40 (A=014, B=147)
+Fout=1884.60 (A=015, B=147)
+Fout=1884.80 (A=016, B=147)
+Fout=1885.00 (A=017, B=147)
+Fout=1885.20 (A=018, B=147)
+Fout=1885.40 (A=019, B=147)
+Fout=1885.60 (A=020, B=147)
+Fout=1885.80 (A=021, B=147)
+Fout=1886.00 (A=022, B=147)
+Fout=1886.20 (A=023, B=147)
+Fout=1886.40 (A=024, B=147)
+Fout=1886.60 (A=025, B=147)
+Fout=1886.80 (A=026, B=147)
+Fout=1887.00 (A=027, B=147)
+Fout=1887.20 (A=028, B=147)
+Fout=1887.40 (A=029, B=147)
+Fout=1887.60 (A=030, B=147)
+Fout=1887.80 (A=031, B=147)
+Fout=1888.00 (A=032, B=147)
+Fout=1888.20 (A=033, B=147)
+Fout=1888.40 (A=034, B=147)
+Fout=1888.60 (A=035, B=147)
+Fout=1888.80 (A=036, B=147)
+Fout=1889.00 (A=037, B=147)
+Fout=1889.20 (A=038, B=147)
+Fout=1889.40 (A=039, B=147)
+Fout=1889.60 (A=040, B=147)
+Fout=1889.80 (A=041, B=147)
+Fout=1890.00 (A=042, B=147)
+Fout=1890.20 (A=043, B=147)
+Fout=1890.40 (A=044, B=147)
+Fout=1890.60 (A=045, B=147)
+Fout=1890.80 (A=046, B=147)
+Fout=1891.00 (A=047, B=147)
+Fout=1891.20 (A=048, B=147)
+Fout=1891.40 (A=049, B=147)
+Fout=1891.60 (A=050, B=147)
+Fout=1891.80 (A=051, B=147)
+Fout=1892.00 (A=052, B=147)
+Fout=1892.20 (A=053, B=147)
+Fout=1892.40 (A=054, B=147)
+Fout=1892.60 (A=055, B=147)
+Fout=1892.80 (A=056, B=147)
+Fout=1893.00 (A=057, B=147)
+Fout=1893.20 (A=058, B=147)
+Fout=1893.40 (A=059, B=147)
+Fout=1893.60 (A=060, B=147)
+Fout=1893.80 (A=061, B=147)
+Fout=1894.00 (A=062, B=147)
+Fout=1894.20 (A=063, B=147)
+Fout=1894.40 (A=000, B=148)
+Fout=1894.60 (A=001, B=148)
+Fout=1894.80 (A=002, B=148)
+Fout=1895.00 (A=003, B=148)
+Fout=1895.20 (A=004, B=148)
+Fout=1895.40 (A=005, B=148)
+Fout=1895.60 (A=006, B=148)
+Fout=1895.80 (A=007, B=148)
+Fout=1896.00 (A=008, B=148)
+Fout=1896.20 (A=009, B=148)
+Fout=1896.40 (A=010, B=148)
+Fout=1896.60 (A=011, B=148)
+Fout=1896.80 (A=012, B=148)
+Fout=1897.00 (A=013, B=148)
+Fout=1897.20 (A=014, B=148)
+Fout=1897.40 (A=015, B=148)
+Fout=1897.60 (A=016, B=148)
+Fout=1897.80 (A=017, B=148)
+Fout=1898.00 (A=018, B=148)
+Fout=1898.20 (A=019, B=148)
+Fout=1898.40 (A=020, B=148)
+Fout=1898.60 (A=021, B=148)
+Fout=1898.80 (A=022, B=148)
+Fout=1899.00 (A=023, B=148)
+Fout=1899.20 (A=024, B=148)
+Fout=1899.40 (A=025, B=148)
+Fout=1899.60 (A=026, B=148)
+Fout=1899.80 (A=027, B=148)
+Fout=1900.00 (A=028, B=148)
+Fout=1900.20 (A=029, B=148)
+Fout=1900.40 (A=030, B=148)
+Fout=1900.60 (A=031, B=148)
+Fout=1900.80 (A=032, B=148)
+Fout=1901.00 (A=033, B=148)
+Fout=1901.20 (A=034, B=148)
+Fout=1901.40 (A=035, B=148)
+Fout=1901.60 (A=036, B=148)
+Fout=1901.80 (A=037, B=148)
+Fout=1902.00 (A=038, B=148)
+Fout=1902.20 (A=039, B=148)
+Fout=1902.40 (A=040, B=148)
+Fout=1902.60 (A=041, B=148)
+Fout=1902.80 (A=042, B=148)
+Fout=1903.00 (A=043, B=148)
+Fout=1903.20 (A=044, B=148)
+Fout=1903.40 (A=045, B=148)
+Fout=1903.60 (A=046, B=148)
+Fout=1903.80 (A=047, B=148)
+Fout=1904.00 (A=048, B=148)
+Fout=1904.20 (A=049, B=148)
+Fout=1904.40 (A=050, B=148)
+Fout=1904.60 (A=051, B=148)
+Fout=1904.80 (A=052, B=148)
+Fout=1905.00 (A=053, B=148)
+Fout=1905.20 (A=054, B=148)
+Fout=1905.40 (A=055, B=148)
+Fout=1905.60 (A=056, B=148)
+Fout=1905.80 (A=057, B=148)
+Fout=1906.00 (A=058, B=148)
+Fout=1906.20 (A=059, B=148)
+Fout=1906.40 (A=060, B=148)
+Fout=1906.60 (A=061, B=148)
+Fout=1906.80 (A=062, B=148)
+Fout=1907.00 (A=063, B=148)
+Fout=1907.20 (A=000, B=149)
+Fout=1907.40 (A=001, B=149)
+Fout=1907.60 (A=002, B=149)
+Fout=1907.80 (A=003, B=149)
+Fout=1908.00 (A=004, B=149)
+Fout=1908.20 (A=005, B=149)
+Fout=1908.40 (A=006, B=149)
+Fout=1908.60 (A=007, B=149)
+Fout=1908.80 (A=008, B=149)
+Fout=1909.00 (A=009, B=149)
+Fout=1909.20 (A=010, B=149)
+Fout=1909.40 (A=011, B=149)
+Fout=1909.60 (A=012, B=149)
+Fout=1909.80 (A=013, B=149)
+Fout=1910.00 (A=014, B=149)
+Fout=1910.20 (A=015, B=149)
+Fout=1910.40 (A=016, B=149)
+Fout=1910.60 (A=017, B=149)
+Fout=1910.80 (A=018, B=149)
+Fout=1911.00 (A=019, B=149)
+Fout=1911.20 (A=020, B=149)
+Fout=1911.40 (A=021, B=149)
+Fout=1911.60 (A=022, B=149)
+Fout=1911.80 (A=023, B=149)
+Fout=1912.00 (A=024, B=149)
+Fout=1912.20 (A=025, B=149)
+Fout=1912.40 (A=026, B=149)
+Fout=1912.60 (A=027, B=149)
+Fout=1912.80 (A=028, B=149)
+Fout=1913.00 (A=029, B=149)
+Fout=1913.20 (A=030, B=149)
+Fout=1913.40 (A=031, B=149)
+Fout=1913.60 (A=032, B=149)
+Fout=1913.80 (A=033, B=149)
+Fout=1914.00 (A=034, B=149)
+Fout=1914.20 (A=035, B=149)
+Fout=1914.40 (A=036, B=149)
+Fout=1914.60 (A=037, B=149)
+Fout=1914.80 (A=038, B=149)
+Fout=1915.00 (A=039, B=149)
+Fout=1915.20 (A=040, B=149)
+Fout=1915.40 (A=041, B=149)
+Fout=1915.60 (A=042, B=149)
+Fout=1915.80 (A=043, B=149)
+Fout=1916.00 (A=044, B=149)
+Fout=1916.20 (A=045, B=149)
+Fout=1916.40 (A=046, B=149)
+Fout=1916.60 (A=047, B=149)
+Fout=1916.80 (A=048, B=149)
+Fout=1917.00 (A=049, B=149)
+Fout=1917.20 (A=050, B=149)
+Fout=1917.40 (A=051, B=149)
+Fout=1917.60 (A=052, B=149)
+Fout=1917.80 (A=053, B=149)
+Fout=1918.00 (A=054, B=149)
+Fout=1918.20 (A=055, B=149)
+Fout=1918.40 (A=056, B=149)
+Fout=1918.60 (A=057, B=149)
+Fout=1918.80 (A=058, B=149)
+Fout=1919.00 (A=059, B=149)
+Fout=1919.20 (A=060, B=149)
+Fout=1919.40 (A=061, B=149)
+Fout=1919.60 (A=062, B=149)
+Fout=1919.80 (A=063, B=149)
diff --git a/src/host/rita_pll/rita_pll_notes.txt b/src/host/rita_pll/rita_pll_notes.txt
new file mode 100644
index 00000000..7df03f5e
--- /dev/null
+++ b/src/host/rita_pll/rita_pll_notes.txt
@@ -0,0 +1,19 @@
+
+Regular Operation as per DS			GSM SPEC
+
+GSM900 Tx: 870.4 ... 921.4 MHz			880.0 ... 914.8	
+GSM900 Rx: 864.4 ... 966.2 MHz			925.0 ... 959.8
+
+GSM1800 Tx: 1702.4 ... 1919.8 MHz		1710.2 ... 1784.8
+GSM1800 Rx: 1804.8 ... 1996.4 MHz		1805.2 ... 1879.8
+
+GSM850 Tx:  
+
+[824.2 ~ 837.0 MHz]
+[837.2 ~ 848.8 MHz]
+
+
+GSM810 Tx: 					806.0 ... 821.0
+* modify B value to go down to 125 (A = 60)
+GSM810 Rx:					851.0 ... 866.0
+* modify B value to go down to 132 (A = 62)
diff --git a/src/host/trxcon/.gitignore b/src/host/trxcon/.gitignore
new file mode 100644
index 00000000..fe90e43c
--- /dev/null
+++ b/src/host/trxcon/.gitignore
@@ -0,0 +1,27 @@
+# autoreconf by-products
+*.in
+
+aclocal.m4
+autom4te.cache/
+configure
+depcomp
+install-sh
+missing
+compile
+
+# configure by-products
+.deps/
+Makefile
+
+config.status
+version.h
+
+# build by-products
+*.o
+*.a
+
+trxcon
+
+# various
+.version
+.tarball-version
diff --git a/src/host/trxcon/Makefile.am b/src/host/trxcon/Makefile.am
new file mode 100644
index 00000000..b51db02f
--- /dev/null
+++ b/src/host/trxcon/Makefile.am
@@ -0,0 +1,52 @@
+AUTOMAKE_OPTIONS = foreign dist-bzip2 1.6
+
+# versioning magic
+BUILT_SOURCES = $(top_srcdir)/.version
+$(top_srcdir)/.version:
+	echo $(VERSION) > $@-t && mv $@-t $@
+dist-hook:
+	echo $(VERSION) > $(distdir)/.tarball-version
+
+AM_CPPFLAGS = \
+	$(all_includes) \
+	-I$(top_srcdir)/include \
+	$(NULL)
+
+AM_CFLAGS = \
+	-Wall \
+	$(LIBOSMOCORE_CFLAGS) \
+	$(LIBOSMOCODING_CFLAGS) \
+	$(LIBOSMOGSM_CFLAGS) \
+	$(NULL)
+
+bin_PROGRAMS = trxcon
+
+trxcon_SOURCES = \
+	l1ctl_link.c \
+	l1ctl.c \
+	trx_if.c \
+	logging.c \
+	trxcon.c \
+	$(NULL)
+
+# Scheduler
+trxcon_SOURCES += \
+	sched_lchan_common.c \
+	sched_lchan_pdtch.c \
+	sched_lchan_desc.c \
+	sched_lchan_xcch.c \
+	sched_lchan_tchf.c \
+	sched_lchan_tchh.c \
+	sched_lchan_rach.c \
+	sched_lchan_sch.c \
+	sched_mframe.c \
+	sched_clck.c \
+	sched_prim.c \
+	sched_trx.c \
+	$(NULL)
+
+trxcon_LDADD = \
+	$(LIBOSMOCORE_LIBS) \
+	$(LIBOSMOCODING_LIBS) \
+	$(LIBOSMOGSM_LIBS) \
+	$(NULL)
diff --git a/src/host/trxcon/configure.ac b/src/host/trxcon/configure.ac
new file mode 100644
index 00000000..1f24260d
--- /dev/null
+++ b/src/host/trxcon/configure.ac
@@ -0,0 +1,35 @@
+dnl Process this file with autoconf to produce a configure script
+AC_INIT([trxcon], [0.0.0])
+AM_INIT_AUTOMAKE
+
+dnl kernel style compile messages
+m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+
+dnl checks for programs
+AC_PROG_MAKE_SET
+AC_PROG_CC
+AC_PROG_INSTALL
+
+dnl checks for libraries
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore)
+PKG_CHECK_MODULES(LIBOSMOCODING, libosmocoding)
+PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm)
+
+dnl checks for header files
+AC_HEADER_STDC
+
+AC_ARG_ENABLE(sanitize,
+	[AS_HELP_STRING(
+		[--enable-sanitize],
+		[Compile with address sanitizer enabled],
+	)], [sanitize=$enableval], [sanitize="no"])
+if test x"$sanitize" = x"yes"
+then
+	CFLAGS="$CFLAGS -fsanitize=address -fsanitize=undefined"
+	CPPFLAGS="$CPPFLAGS -fsanitize=address -fsanitize=undefined"
+fi
+
+dnl Checks for typedefs, structures and compiler characteristics
+
+AC_OUTPUT(
+    Makefile)
diff --git a/src/host/trxcon/l1ctl.c b/src/host/trxcon/l1ctl.c
new file mode 100644
index 00000000..f239b30a
--- /dev/null
+++ b/src/host/trxcon/l1ctl.c
@@ -0,0 +1,848 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * GSM L1 control interface handlers
+ *
+ * (C) 2014 by Sylvain Munaut <tnt@246tNt.com>
+ * (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <assert.h>
+
+#include <arpa/inet.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include "trxcon.h"
+#include "logging.h"
+#include "l1ctl_link.h"
+#include "l1ctl_proto.h"
+
+#include "trx_if.h"
+#include "sched_trx.h"
+
+static const char *arfcn2band_name(uint16_t arfcn)
+{
+	enum gsm_band band;
+
+	if (gsm_arfcn2band_rc(arfcn, &band) < 0)
+		return "(invalid)";
+
+	return gsm_band_name(band);
+}
+
+static struct msgb *l1ctl_alloc_msg(uint8_t msg_type)
+{
+	struct l1ctl_hdr *l1h;
+	struct msgb *msg;
+
+	/**
+	 * Each L1CTL message gets its own length pushed in front
+	 * before sending. This is why we need this small headroom.
+	 */
+	msg = msgb_alloc_headroom(L1CTL_LENGTH + L1CTL_MSG_LEN_FIELD,
+		L1CTL_MSG_LEN_FIELD, "l1ctl_tx_msg");
+	if (!msg) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to allocate memory\n");
+		return NULL;
+	}
+
+	msg->l1h = msgb_put(msg, sizeof(*l1h));
+	l1h = (struct l1ctl_hdr *) msg->l1h;
+	l1h->msg_type = msg_type;
+
+	return msg;
+}
+
+int l1ctl_tx_pm_conf(struct l1ctl_link *l1l, uint16_t band_arfcn,
+	int dbm, int last)
+{
+	struct l1ctl_pm_conf *pmc;
+	struct msgb *msg;
+
+	msg = l1ctl_alloc_msg(L1CTL_PM_CONF);
+	if (!msg)
+		return -ENOMEM;
+
+	LOGP(DL1C, LOGL_DEBUG, "Send PM Conf (%s %d = %d dBm)\n",
+		arfcn2band_name(band_arfcn),
+		band_arfcn &~ ARFCN_FLAG_MASK, dbm);
+
+	pmc = (struct l1ctl_pm_conf *) msgb_put(msg, sizeof(*pmc));
+	pmc->band_arfcn = htons(band_arfcn);
+	pmc->pm[0] = dbm2rxlev(dbm);
+	pmc->pm[1] = 0;
+
+	if (last) {
+		struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->l1h;
+		l1h->flags |= L1CTL_F_DONE;
+	}
+
+	return l1ctl_link_send(l1l, msg);
+}
+
+int l1ctl_tx_reset_ind(struct l1ctl_link *l1l, uint8_t type)
+{
+	struct msgb *msg;
+	struct l1ctl_reset *res;
+
+	msg = l1ctl_alloc_msg(L1CTL_RESET_IND);
+	if (!msg)
+		return -ENOMEM;
+
+	LOGP(DL1C, LOGL_DEBUG, "Send Reset Ind (%u)\n", type);
+
+	res = (struct l1ctl_reset *) msgb_put(msg, sizeof(*res));
+	res->type = type;
+
+	return l1ctl_link_send(l1l, msg);
+}
+
+int l1ctl_tx_reset_conf(struct l1ctl_link *l1l, uint8_t type)
+{
+	struct msgb *msg;
+	struct l1ctl_reset *res;
+
+	msg = l1ctl_alloc_msg(L1CTL_RESET_CONF);
+	if (!msg)
+		return -ENOMEM;
+
+	LOGP(DL1C, LOGL_DEBUG, "Send Reset Conf (%u)\n", type);
+	res = (struct l1ctl_reset *) msgb_put(msg, sizeof(*res));
+	res->type = type;
+
+	return l1ctl_link_send(l1l, msg);
+}
+
+int l1ctl_tx_fbsb_conf(struct l1ctl_link *l1l, uint8_t result,
+	struct l1ctl_info_dl *dl_info, uint8_t bsic)
+{
+	struct l1ctl_fbsb_conf *conf;
+	struct l1ctl_info_dl *dl;
+	struct msgb *msg;
+	size_t len;
+
+	msg = l1ctl_alloc_msg(L1CTL_FBSB_CONF);
+	if (msg == NULL)
+		return -ENOMEM;
+
+	LOGP(DL1C, LOGL_DEBUG, "Send FBSB Conf (result=%u, bsic=%u)\n",
+		result, bsic);
+
+	/* Copy DL info provided by handler */
+	len = sizeof(struct l1ctl_info_dl);
+	dl = (struct l1ctl_info_dl *) msgb_put(msg, len);
+	memcpy(dl, dl_info, len);
+	talloc_free(dl_info);
+
+	/* Fill in FBSB payload: BSIC and sync result */
+	conf = (struct l1ctl_fbsb_conf *) msgb_put(msg, sizeof(*conf));
+	conf->result = result;
+	conf->bsic = bsic;
+
+	/* FIXME: set proper value */
+	conf->initial_freq_err = 0;
+
+	/* Ask SCH handler not to send L1CTL_FBSB_CONF anymore */
+	l1l->fbsb_conf_sent = 1;
+
+	/* Abort FBSB expire timer */
+	if (osmo_timer_pending(&l1l->fbsb_timer))
+		osmo_timer_del(&l1l->fbsb_timer);
+
+	return l1ctl_link_send(l1l, msg);
+}
+
+int l1ctl_tx_ccch_mode_conf(struct l1ctl_link *l1l, uint8_t mode)
+{
+	struct l1ctl_ccch_mode_conf *conf;
+	struct msgb *msg;
+
+	msg = l1ctl_alloc_msg(L1CTL_CCCH_MODE_CONF);
+	if (msg == NULL)
+		return -ENOMEM;
+
+	conf = (struct l1ctl_ccch_mode_conf *) msgb_put(msg, sizeof(*conf));
+	conf->ccch_mode = mode;
+
+	return l1ctl_link_send(l1l, msg);
+}
+
+/**
+ * Handles both L1CTL_DATA_IND and L1CTL_TRAFFIC_IND.
+ */
+int l1ctl_tx_dt_ind(struct l1ctl_link *l1l, struct l1ctl_info_dl *data,
+	uint8_t *l2, size_t l2_len, bool traffic)
+{
+	struct l1ctl_info_dl *dl;
+	struct msgb *msg;
+	uint8_t *msg_l2;
+
+	msg = l1ctl_alloc_msg(traffic ?
+		L1CTL_TRAFFIC_IND : L1CTL_DATA_IND);
+	if (msg == NULL)
+		return -ENOMEM;
+
+	/* Copy DL header */
+	dl = (struct l1ctl_info_dl *) msgb_put(msg, sizeof(*dl));
+	memcpy(dl, data, sizeof(*dl));
+
+	/* Copy the L2 payload if preset */
+	if (l2 && l2_len > 0) {
+		msg_l2 = (uint8_t *) msgb_put(msg, l2_len);
+		memcpy(msg_l2, l2, l2_len);
+	}
+
+	/* Put message to upper layers */
+	return l1ctl_link_send(l1l, msg);
+}
+
+int l1ctl_tx_rach_conf(struct l1ctl_link *l1l, uint32_t fn)
+{
+	struct l1ctl_info_dl *dl;
+	struct msgb *msg;
+	size_t len;
+
+	msg = l1ctl_alloc_msg(L1CTL_RACH_CONF);
+	if (msg == NULL)
+		return -ENOMEM;
+
+	len = sizeof(struct l1ctl_info_dl);
+	dl = (struct l1ctl_info_dl *) msgb_put(msg, len);
+
+	memset(dl, 0x00, len);
+	dl->band_arfcn = htons(l1l->trx->band_arfcn);
+	dl->frame_nr = htonl(fn);
+
+	return l1ctl_link_send(l1l, msg);
+}
+
+
+/**
+ * Handles both L1CTL_DATA_CONF and L1CTL_TRAFFIC_CONF.
+ */
+int l1ctl_tx_dt_conf(struct l1ctl_link *l1l,
+	struct l1ctl_info_dl *data, bool traffic)
+{
+	struct l1ctl_info_dl *dl;
+	struct msgb *msg;
+	size_t len;
+
+	msg = l1ctl_alloc_msg(traffic ?
+		L1CTL_TRAFFIC_CONF : L1CTL_DATA_CONF);
+	if (msg == NULL)
+		return -ENOMEM;
+
+	/* Copy DL frame header from source message */
+	len = sizeof(struct l1ctl_info_dl);
+	dl = (struct l1ctl_info_dl *) msgb_put(msg, len);
+	memcpy(dl, data, len);
+
+	return l1ctl_link_send(l1l, msg);
+}
+
+static enum gsm_phys_chan_config l1ctl_ccch_mode2pchan_config(enum ccch_mode mode)
+{
+	switch (mode) {
+	/* TODO: distinguish extended BCCH */
+	case CCCH_MODE_NON_COMBINED:
+	case CCCH_MODE_NONE:
+		return GSM_PCHAN_CCCH;
+
+	case CCCH_MODE_COMBINED:
+		return GSM_PCHAN_CCCH_SDCCH4;
+	case CCCH_MODE_COMBINED_CBCH:
+		return GSM_PCHAN_CCCH_SDCCH4_CBCH;
+
+	default:
+		LOGP(DL1C, LOGL_NOTICE, "Undandled CCCH mode (%u), "
+			"assuming non-combined configuration\n", mode);
+		return GSM_PCHAN_CCCH;
+	}
+}
+
+/* FBSB expire timer */
+static void fbsb_timer_cb(void *data)
+{
+	struct l1ctl_link *l1l = (struct l1ctl_link *) data;
+	struct l1ctl_fbsb_conf *conf;
+	struct l1ctl_info_dl *dl;
+	struct msgb *msg;
+	size_t len;
+
+	msg = l1ctl_alloc_msg(L1CTL_FBSB_CONF);
+	if (msg == NULL)
+		return;
+
+	LOGP(DL1C, LOGL_DEBUG, "Send FBSB Conf (result=255, bsic=0)\n");
+
+	/* Compose DL info header */
+	len = sizeof(struct l1ctl_info_dl);
+	dl = (struct l1ctl_info_dl *) msgb_put(msg, len);
+	memset(dl, 0x00, len);
+
+	/* Fill in current ARFCN */
+	dl->band_arfcn = htons(l1l->trx->band_arfcn);
+
+	/* Fill in FBSB payload: BSIC and sync result */
+	conf = (struct l1ctl_fbsb_conf *) msgb_put(msg, sizeof(*conf));
+	conf->result = 255;
+	conf->bsic = 0;
+
+	/* Ask SCH handler not to send L1CTL_FBSB_CONF anymore */
+	l1l->fbsb_conf_sent = 1;
+
+	l1ctl_link_send(l1l, msg);
+}
+
+static int l1ctl_rx_fbsb_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	enum gsm_phys_chan_config ch_config;
+	struct l1ctl_fbsb_req *fbsb;
+	uint16_t band_arfcn;
+	uint16_t timeout;
+	int rc = 0;
+
+	fbsb = (struct l1ctl_fbsb_req *) msg->l1h;
+	if (msgb_l1len(msg) < sizeof(*fbsb)) {
+		LOGP(DL1C, LOGL_ERROR, "MSG too short FBSB Req: %u\n",
+			msgb_l1len(msg));
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	ch_config = l1ctl_ccch_mode2pchan_config(fbsb->ccch_mode);
+	band_arfcn = ntohs(fbsb->band_arfcn);
+	timeout = ntohs(fbsb->timeout);
+
+	LOGP(DL1C, LOGL_NOTICE, "Received FBSB request (%s %d)\n",
+		arfcn2band_name(band_arfcn),
+		band_arfcn &~ ARFCN_FLAG_MASK);
+
+	/* Reset scheduler and clock counter */
+	sched_trx_reset(l1l->trx, 1);
+
+	/* Configure a single timeslot */
+	sched_trx_configure_ts(l1l->trx, 0, ch_config);
+
+	/* Ask SCH handler to send L1CTL_FBSB_CONF */
+	l1l->fbsb_conf_sent = 0;
+
+	/* Only if current ARFCN differs */
+	if (l1l->trx->band_arfcn != band_arfcn) {
+		/* Update current ARFCN */
+		l1l->trx->band_arfcn = band_arfcn;
+
+		/* Tune transceiver to required ARFCN */
+		trx_if_cmd_rxtune(l1l->trx, band_arfcn);
+		trx_if_cmd_txtune(l1l->trx, band_arfcn);
+	}
+
+	trx_if_cmd_poweron(l1l->trx);
+
+	/* Start FBSB expire timer */
+	l1l->fbsb_timer.data = l1l;
+	l1l->fbsb_timer.cb = fbsb_timer_cb;
+	osmo_timer_schedule(&l1l->fbsb_timer, 0,
+		timeout * FRAME_DURATION_uS);
+
+exit:
+	msgb_free(msg);
+	return rc;
+}
+
+static int l1ctl_rx_pm_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	uint16_t band_arfcn_start, band_arfcn_stop;
+	struct l1ctl_pm_req *pmr;
+	int rc = 0;
+
+	pmr = (struct l1ctl_pm_req *) msg->l1h;
+	if (msgb_l1len(msg) < sizeof(*pmr)) {
+		LOGP(DL1C, LOGL_ERROR, "MSG too short PM Req: %u\n",
+			msgb_l1len(msg));
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	band_arfcn_start = ntohs(pmr->range.band_arfcn_from);
+	band_arfcn_stop  = ntohs(pmr->range.band_arfcn_to);
+
+	LOGP(DL1C, LOGL_NOTICE, "Received power measurement "
+		"request (%s: %d -> %d)\n",
+		arfcn2band_name(band_arfcn_start),
+		band_arfcn_start &~ ARFCN_FLAG_MASK,
+		band_arfcn_stop &~ ARFCN_FLAG_MASK);
+
+	/* Send measurement request to transceiver */
+	rc = trx_if_cmd_measure(l1l->trx, band_arfcn_start, band_arfcn_stop);
+
+exit:
+	msgb_free(msg);
+	return rc;
+}
+
+static int l1ctl_rx_reset_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	struct l1ctl_reset *res;
+	int rc = 0;
+
+	res = (struct l1ctl_reset *) msg->l1h;
+	if (msgb_l1len(msg) < sizeof(*res)) {
+		LOGP(DL1C, LOGL_ERROR, "MSG too short Reset Req: %u\n",
+			msgb_l1len(msg));
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	LOGP(DL1C, LOGL_NOTICE, "Received reset request (%u)\n",
+		res->type);
+
+	switch (res->type) {
+	case L1CTL_RES_T_FULL:
+		/* TODO: implement trx_if_reset() */
+		trx_if_cmd_poweroff(l1l->trx);
+		trx_if_cmd_echo(l1l->trx);
+
+		/* Fall through */
+	case L1CTL_RES_T_SCHED:
+		sched_trx_reset(l1l->trx, 1);
+		break;
+	default:
+		LOGP(DL1C, LOGL_ERROR, "Unknown L1CTL_RESET_REQ type\n");
+		goto exit;
+	}
+
+	/* Confirm */
+	rc = l1ctl_tx_reset_conf(l1l, res->type);
+
+exit:
+	msgb_free(msg);
+	return rc;
+}
+
+static int l1ctl_rx_echo_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h;
+
+	LOGP(DL1C, LOGL_NOTICE, "Recv Echo Req\n");
+	LOGP(DL1C, LOGL_NOTICE, "Send Echo Conf\n");
+
+	/* Nothing to do, just send it back */
+	l1h = (struct l1ctl_hdr *) msg->l1h;
+	l1h->msg_type = L1CTL_ECHO_CONF;
+	msg->data = msg->l1h;
+
+	return l1ctl_link_send(l1l, msg);
+}
+
+static int l1ctl_rx_ccch_mode_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	enum gsm_phys_chan_config ch_config;
+	struct l1ctl_ccch_mode_req *req;
+	struct trx_ts *ts;
+	int rc = 0;
+
+	req = (struct l1ctl_ccch_mode_req *) msg->l1h;
+	if (msgb_l1len(msg) < sizeof(*req)) {
+		LOGP(DL1C, LOGL_ERROR, "MSG too short Reset Req: %u\n",
+			msgb_l1len(msg));
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	LOGP(DL1C, LOGL_NOTICE, "Received CCCH mode request (%u)\n",
+		req->ccch_mode); /* TODO: add value-string for ccch_mode */
+
+	/* Make sure that TS0 is allocated and configured */
+	ts = l1l->trx->ts_list[0];
+	if (ts == NULL || ts->mf_layout == NULL) {
+		LOGP(DL1C, LOGL_ERROR, "TS0 is not configured");
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	/* Choose corresponding channel combination */
+	ch_config = l1ctl_ccch_mode2pchan_config(req->ccch_mode);
+
+	/* Do nothing if the current mode matches required */
+	if (ts->mf_layout->chan_config != ch_config)
+		rc = sched_trx_configure_ts(l1l->trx, 0, ch_config);
+
+	/* Confirm reconfiguration */
+	if (!rc)
+		rc = l1ctl_tx_ccch_mode_conf(l1l, req->ccch_mode);
+
+exit:
+	msgb_free(msg);
+	return rc;
+}
+
+static int l1ctl_rx_rach_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	struct l1ctl_rach_req *req;
+	struct l1ctl_info_ul *ul;
+	struct trx_ts_prim *prim;
+	uint8_t chan_nr, link_id;
+	size_t len;
+	int rc;
+
+	ul = (struct l1ctl_info_ul *) msg->l1h;
+	req = (struct l1ctl_rach_req *) ul->payload;
+	len = sizeof(struct l1ctl_rach_req);
+
+	/* Convert offset value to host format */
+	req->offset = ntohs(req->offset);
+
+	/**
+	 * FIXME: l1ctl_info_ul doesn't provide channel description
+	 * FIXME: Can we use other than TS0?
+	 */
+	chan_nr = 0x88;
+	link_id = 0x00;
+
+	LOGP(DL1C, LOGL_NOTICE, "Received RACH request "
+		"(offset=%u ra=0x%02x)\n", req->offset, req->ra);
+
+	/* Init a new primitive */
+	rc = sched_prim_init(l1l->trx, &prim, len, chan_nr, link_id);
+	if (rc)
+		goto exit;
+
+	/**
+	 * Push this primitive to transmit queue
+	 *
+	 * FIXME: what if requested TS is not configured?
+	 * Or what if one (such as TCH) has no TRXC_RACH slots?
+	 */
+	rc = sched_prim_push(l1l->trx, prim, chan_nr);
+	if (rc) {
+		talloc_free(prim);
+		goto exit;
+	}
+
+	/* Fill in the payload */
+	memcpy(prim->payload, req, len);
+
+exit:
+	msgb_free(msg);
+	return rc;
+}
+
+static int l1ctl_rx_dm_est_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	enum gsm_phys_chan_config config;
+	struct l1ctl_dm_est_req *est_req;
+	struct l1ctl_info_ul *ul;
+	struct trx_ts *ts;
+	uint16_t band_arfcn;
+	uint8_t chan_nr, tn;
+	int rc = 0;
+
+	ul = (struct l1ctl_info_ul *) msg->l1h;
+	est_req = (struct l1ctl_dm_est_req *) ul->payload;
+
+	band_arfcn = ntohs(est_req->h0.band_arfcn);
+	chan_nr = ul->chan_nr;
+	tn = chan_nr & 0x07;
+
+	LOGP(DL1C, LOGL_NOTICE, "Received L1CTL_DM_EST_REQ (arfcn=%u, "
+		"tn=%u, chan_nr=0x%02x, tsc=%u, tch_mode=0x%02x)\n",
+		(band_arfcn &~ ARFCN_FLAG_MASK), tn, chan_nr,
+		est_req->tsc, est_req->tch_mode);
+
+	if (est_req->h) {
+		LOGP(DL1C, LOGL_ERROR, "FHSS is not supported\n");
+		rc = -ENOTSUP;
+		goto exit;
+	}
+
+	/* Only if the current ARFCN differs */
+	if (l1l->trx->band_arfcn != band_arfcn) {
+		/* Update current ARFCN */
+		l1l->trx->band_arfcn = band_arfcn;
+
+		/* Tune transceiver to required ARFCN */
+		trx_if_cmd_rxtune(l1l->trx, band_arfcn);
+		trx_if_cmd_txtune(l1l->trx, band_arfcn);
+	}
+
+	/* Update TSC (Training Sequence Code) */
+	l1l->trx->tsc = est_req->tsc;
+
+	/* Determine channel config */
+	config = sched_trx_chan_nr2pchan_config(chan_nr);
+	if (config == GSM_PCHAN_NONE) {
+		LOGP(DL1C, LOGL_ERROR, "Couldn't determine channel config\n");
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	/* Configure requested TS */
+	rc = sched_trx_configure_ts(l1l->trx, tn, config);
+	ts = l1l->trx->ts_list[tn];
+	if (rc) {
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	/* Deactivate all lchans */
+	sched_trx_deactivate_all_lchans(ts);
+
+	/* Activate only requested lchans */
+	rc = sched_trx_set_lchans(ts, chan_nr, 1, est_req->tch_mode);
+	if (rc) {
+		LOGP(DL1C, LOGL_ERROR, "Couldn't activate requested lchans\n");
+		rc = -EINVAL;
+		goto exit;
+	}
+
+exit:
+	msgb_free(msg);
+	return rc;
+}
+
+static int l1ctl_rx_dm_rel_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	LOGP(DL1C, LOGL_NOTICE, "Received L1CTL_DM_REL_REQ, "
+		"switching back to CCCH\n");
+
+	/* Reset scheduler */
+	sched_trx_reset(l1l->trx, 0);
+
+	msgb_free(msg);
+	return 0;
+}
+
+/**
+ * Handles both L1CTL_DATA_REQ and L1CTL_TRAFFIC_REQ.
+ */
+static int l1ctl_rx_dt_req(struct l1ctl_link *l1l,
+	struct msgb *msg, bool traffic)
+{
+	struct l1ctl_info_ul *ul;
+	struct trx_ts_prim *prim;
+	uint8_t chan_nr, link_id;
+	size_t payload_len;
+	int rc;
+
+	/* Extract UL frame header */
+	ul = (struct l1ctl_info_ul *) msg->l1h;
+
+	/* Calculate the payload len */
+	msg->l2h = ul->payload;
+	payload_len = msgb_l2len(msg);
+
+	/* Obtain channel description */
+	chan_nr = ul->chan_nr;
+	link_id = ul->link_id & 0x40;
+
+	LOGP(DL1D, LOGL_DEBUG, "Recv %s Req (chan_nr=0x%02x, "
+		"link_id=0x%02x, len=%zu)\n", traffic ? "TRAFFIC" : "DATA",
+		chan_nr, link_id, payload_len);
+
+	/* Init a new primitive */
+	rc = sched_prim_init(l1l->trx, &prim, payload_len,
+		chan_nr, link_id);
+	if (rc)
+		goto exit;
+
+	/* Push this primitive to transmit queue */
+	rc = sched_prim_push(l1l->trx, prim, chan_nr);
+	if (rc) {
+		talloc_free(prim);
+		goto exit;
+	}
+
+	/* Fill in the payload */
+	memcpy(prim->payload, ul->payload, payload_len);
+
+exit:
+	msgb_free(msg);
+	return rc;
+}
+
+static int l1ctl_rx_param_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	struct l1ctl_par_req *par_req;
+	struct l1ctl_info_ul *ul;
+
+	ul = (struct l1ctl_info_ul *) msg->l1h;
+	par_req = (struct l1ctl_par_req *) ul->payload;
+
+	LOGP(DL1C, LOGL_NOTICE, "Received L1CTL_PARAM_REQ "
+		"(ta=%d, tx_power=%u)\n", par_req->ta, par_req->tx_power);
+
+	/* Instruct TRX to use new TA value */
+	if (l1l->trx->ta != par_req->ta) {
+		trx_if_cmd_setta(l1l->trx, par_req->ta);
+		l1l->trx->ta = par_req->ta;
+	}
+
+	l1l->trx->tx_power = par_req->tx_power;
+
+	msgb_free(msg);
+	return 0;
+}
+
+static int l1ctl_rx_tch_mode_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	struct l1ctl_tch_mode_req *req;
+	struct trx_lchan_state *lchan;
+	struct trx_ts *ts;
+	int i;
+
+	req = (struct l1ctl_tch_mode_req *) msg->l1h;
+
+	LOGP(DL1C, LOGL_NOTICE, "Received L1CTL_TCH_MODE_REQ "
+		"(tch_mode=%u, audio_mode=%u)\n", req->tch_mode, req->audio_mode);
+
+	/* Iterate over timeslot list */
+	for (i = 0; i < TRX_TS_COUNT; i++) {
+		/* Timeslot is not allocated */
+		ts = l1l->trx->ts_list[i];
+		if (ts == NULL)
+			continue;
+
+		/* Timeslot is not configured */
+		if (ts->mf_layout == NULL)
+			continue;
+
+		/* Iterate over all allocated lchans */
+		llist_for_each_entry(lchan, &ts->lchans, list) {
+			/* Omit inactive channels */
+			if (!lchan->active)
+				continue;
+
+			/* Set TCH mode */
+			lchan->tch_mode = req->tch_mode;
+		}
+	}
+
+	/* TODO: do we need to care about audio_mode? */
+
+	msgb_free(msg);
+	return 0;
+}
+
+static int l1ctl_rx_crypto_req(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	struct l1ctl_crypto_req *req;
+	struct l1ctl_info_ul *ul;
+	struct trx_ts *ts;
+	uint8_t tn;
+	int rc = 0;
+
+	ul = (struct l1ctl_info_ul *) msg->l1h;
+	req = (struct l1ctl_crypto_req *) ul->payload;
+
+	LOGP(DL1C, LOGL_NOTICE, "L1CTL_CRYPTO_REQ (algo=A5/%u, key_len=%u)\n",
+		req->algo, req->key_len);
+
+	/* Determine TS index */
+	tn = ul->chan_nr & 0x7;
+
+	/* Make sure that required TS is allocated and configured */
+	ts = l1l->trx->ts_list[tn];
+	if (ts == NULL || ts->mf_layout == NULL) {
+		LOGP(DL1C, LOGL_ERROR, "TS %u is not configured\n", tn);
+		rc = -EINVAL;
+		goto exit;
+	}
+
+	/* Poke scheduler */
+	rc = sched_trx_start_ciphering(ts, req->algo, req->key, req->key_len);
+	if (rc) {
+		LOGP(DL1C, LOGL_ERROR, "Couldn't configure ciphering\n");
+		rc = -EINVAL;
+		goto exit;
+	}
+
+exit:
+	msgb_free(msg);
+	return rc;
+}
+
+int l1ctl_rx_cb(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h;
+
+	l1h = (struct l1ctl_hdr *) msg->l1h;
+	msg->l1h = l1h->data;
+
+	switch (l1h->msg_type) {
+	case L1CTL_FBSB_REQ:
+		return l1ctl_rx_fbsb_req(l1l, msg);
+	case L1CTL_PM_REQ:
+		return l1ctl_rx_pm_req(l1l, msg);
+	case L1CTL_RESET_REQ:
+		return l1ctl_rx_reset_req(l1l, msg);
+	case L1CTL_ECHO_REQ:
+		return l1ctl_rx_echo_req(l1l, msg);
+	case L1CTL_CCCH_MODE_REQ:
+		return l1ctl_rx_ccch_mode_req(l1l, msg);
+	case L1CTL_RACH_REQ:
+		return l1ctl_rx_rach_req(l1l, msg);
+	case L1CTL_DM_EST_REQ:
+		return l1ctl_rx_dm_est_req(l1l, msg);
+	case L1CTL_DM_REL_REQ:
+		return l1ctl_rx_dm_rel_req(l1l, msg);
+	case L1CTL_DATA_REQ:
+		return l1ctl_rx_dt_req(l1l, msg, false);
+	case L1CTL_TRAFFIC_REQ:
+		return l1ctl_rx_dt_req(l1l, msg, true);
+	case L1CTL_PARAM_REQ:
+		return l1ctl_rx_param_req(l1l, msg);
+	case L1CTL_TCH_MODE_REQ:
+		return l1ctl_rx_tch_mode_req(l1l, msg);
+	case L1CTL_CRYPTO_REQ:
+		return l1ctl_rx_crypto_req(l1l, msg);
+
+	/* Not (yet) handled messages */
+	case L1CTL_NEIGH_PM_REQ:
+	case L1CTL_DATA_TBF_REQ:
+	case L1CTL_TBF_CFG_REQ:
+	case L1CTL_DM_FREQ_REQ:
+	case L1CTL_SIM_REQ:
+		LOGP(DL1C, LOGL_NOTICE, "Ignoring unsupported message "
+			"(type=%u)\n", l1h->msg_type);
+		return -ENOTSUP;
+	default:
+		LOGP(DL1C, LOGL_ERROR, "Unknown MSG type %u: %s\n", l1h->msg_type,
+			osmo_hexdump(msgb_data(msg), msgb_length(msg)));
+		msgb_free(msg);
+		return -EINVAL;
+	}
+}
+
+void l1ctl_shutdown_cb(struct l1ctl_link *l1l)
+{
+	/* Abort FBSB expire timer */
+	if (osmo_timer_pending(&l1l->fbsb_timer))
+		osmo_timer_del(&l1l->fbsb_timer);
+}
diff --git a/src/host/trxcon/l1ctl.h b/src/host/trxcon/l1ctl.h
new file mode 100644
index 00000000..ca8c0be6
--- /dev/null
+++ b/src/host/trxcon/l1ctl.h
@@ -0,0 +1,25 @@
+#pragma once
+
+#include <stdint.h>
+#include <osmocom/core/msgb.h>
+
+#include "l1ctl_link.h"
+#include "l1ctl_proto.h"
+
+/* Event handlers */
+int l1ctl_rx_cb(struct l1ctl_link *l1l, struct msgb *msg);
+void l1ctl_shutdown_cb(struct l1ctl_link *l1l);
+
+int l1ctl_tx_fbsb_conf(struct l1ctl_link *l1l, uint8_t result,
+	struct l1ctl_info_dl *dl_info, uint8_t bsic);
+int l1ctl_tx_ccch_mode_conf(struct l1ctl_link *l1l, uint8_t mode);
+int l1ctl_tx_pm_conf(struct l1ctl_link *l1l, uint16_t band_arfcn,
+	int dbm, int last);
+int l1ctl_tx_reset_conf(struct l1ctl_link *l1l, uint8_t type);
+int l1ctl_tx_reset_ind(struct l1ctl_link *l1l, uint8_t type);
+
+int l1ctl_tx_dt_ind(struct l1ctl_link *l1l, struct l1ctl_info_dl *data,
+	uint8_t *l2, size_t l2_len, bool traffic);
+int l1ctl_tx_dt_conf(struct l1ctl_link *l1l,
+	struct l1ctl_info_dl *data, bool traffic);
+int l1ctl_tx_rach_conf(struct l1ctl_link *l1l, uint32_t fn);
diff --git a/src/host/trxcon/l1ctl_link.c b/src/host/trxcon/l1ctl_link.c
new file mode 100644
index 00000000..20cb70ce
--- /dev/null
+++ b/src/host/trxcon/l1ctl_link.c
@@ -0,0 +1,310 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * GSM L1 control socket (/tmp/osmocom_l2) handlers
+ *
+ * (C) 2013 by Sylvain Munaut <tnt@246tNt.com>
+ * (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+#include <sys/un.h>
+#include <arpa/inet.h>
+#include <sys/socket.h>
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/write_queue.h>
+
+#include "trxcon.h"
+#include "logging.h"
+#include "l1ctl_link.h"
+#include "l1ctl.h"
+
+static struct value_string l1ctl_evt_names[] = {
+	{ 0, NULL } /* no events? */
+};
+
+static struct osmo_fsm_state l1ctl_fsm_states[] = {
+	[L1CTL_STATE_IDLE] = {
+		.out_state_mask = GEN_MASK(L1CTL_STATE_CONNECTED),
+		.name = "IDLE",
+	},
+	[L1CTL_STATE_CONNECTED] = {
+		.out_state_mask = GEN_MASK(L1CTL_STATE_IDLE),
+		.name = "CONNECTED",
+	},
+};
+
+static struct osmo_fsm l1ctl_fsm = {
+	.name = "l1ctl_link_fsm",
+	.states = l1ctl_fsm_states,
+	.num_states = ARRAY_SIZE(l1ctl_fsm_states),
+	.log_subsys = DL1C,
+	.event_names = l1ctl_evt_names,
+};
+
+static int l1ctl_link_read_cb(struct osmo_fd *bfd)
+{
+	struct l1ctl_link *l1l = (struct l1ctl_link *) bfd->data;
+	struct msgb *msg;
+	uint16_t len;
+	int rc;
+
+	/* Attempt to read from socket */
+	rc = read(bfd->fd, &len, L1CTL_MSG_LEN_FIELD);
+	if (rc < L1CTL_MSG_LEN_FIELD) {
+		LOGP(DL1D, LOGL_NOTICE, "L1CTL has lost connection\n");
+		if (rc >= 0)
+			rc = -EIO;
+		l1ctl_link_close_conn(l1l);
+		return rc;
+	}
+
+	/* Check message length */
+	len = ntohs(len);
+	if (len > L1CTL_LENGTH) {
+		LOGP(DL1D, LOGL_ERROR, "Length is too big: %u\n", len);
+		return -EINVAL;
+	}
+
+	/* Allocate a new msg */
+	msg = msgb_alloc_headroom(L1CTL_LENGTH + L1CTL_HEADROOM,
+		L1CTL_HEADROOM, "l1ctl_rx_msg");
+	if (!msg) {
+		LOGP(DL1D, LOGL_ERROR, "Failed to allocate msg\n");
+		return -ENOMEM;
+	}
+
+	msg->l1h = msgb_put(msg, len);
+	rc = read(bfd->fd, msg->l1h, msgb_l1len(msg));
+	if (rc != len) {
+		LOGP(DL1D, LOGL_ERROR, "Can not read data: len=%d < rc=%d: "
+			"%s\n", len, rc, strerror(errno));
+		msgb_free(msg);
+		return rc;
+	}
+
+	/* Debug print */
+	LOGP(DL1D, LOGL_DEBUG, "RX: '%s'\n",
+		osmo_hexdump(msg->data, msg->len));
+
+	/* Call L1CTL handler */
+	l1ctl_rx_cb(l1l, msg);
+
+	return 0;
+}
+
+static int l1ctl_link_write_cb(struct osmo_fd *bfd, struct msgb *msg)
+{
+	int len;
+
+	if (bfd->fd <= 0)
+		return -EINVAL;
+
+	len = write(bfd->fd, msg->data, msg->len);
+	if (len != msg->len) {
+		LOGP(DL1D, LOGL_ERROR, "Failed to write data: "
+			"written (%d) < msg_len (%d)\n", len, msg->len);
+		return -1;
+	}
+
+	return 0;
+}
+
+/* Connection handler */
+static int l1ctl_link_accept(struct osmo_fd *bfd, unsigned int flags)
+{
+	struct l1ctl_link *l1l = (struct l1ctl_link *) bfd->data;
+	struct osmo_fd *conn_bfd = &l1l->wq.bfd;
+	struct sockaddr_un un_addr;
+	socklen_t len;
+	int cfd;
+
+	len = sizeof(un_addr);
+	cfd = accept(bfd->fd, (struct sockaddr *) &un_addr, &len);
+	if (cfd < 0) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to accept a new connection\n");
+		return -1;
+	}
+
+	/* Check if we already have an active connection */
+	if (conn_bfd->fd != -1) {
+		LOGP(DL1C, LOGL_NOTICE, "A new connection rejected: "
+			"we already have another active\n");
+		close(cfd);
+		return 0;
+	}
+
+	osmo_wqueue_init(&l1l->wq, 100);
+	INIT_LLIST_HEAD(&conn_bfd->list);
+
+	l1l->wq.write_cb = l1ctl_link_write_cb;
+	l1l->wq.read_cb = l1ctl_link_read_cb;
+	conn_bfd->when = BSC_FD_READ;
+	conn_bfd->data = l1l;
+	conn_bfd->fd = cfd;
+
+	if (osmo_fd_register(conn_bfd) != 0) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to register new connection fd\n");
+		close(conn_bfd->fd);
+		conn_bfd->fd = -1;
+		return -1;
+	}
+
+	osmo_fsm_inst_dispatch(trxcon_fsm, L1CTL_EVENT_CONNECT, l1l);
+	osmo_fsm_inst_state_chg(l1l->fsm, L1CTL_STATE_CONNECTED, 0, 0);
+
+	LOGP(DL1C, LOGL_NOTICE, "L1CTL has a new connection\n");
+
+	return 0;
+}
+
+int l1ctl_link_send(struct l1ctl_link *l1l, struct msgb *msg)
+{
+	uint16_t *len;
+
+	/* Debug print */
+	LOGP(DL1D, LOGL_DEBUG, "TX: '%s'\n",
+		osmo_hexdump(msg->data, msg->len));
+
+	if (msg->l1h != msg->data)
+		LOGP(DL1D, LOGL_INFO, "Message L1 header != Message Data\n");
+
+	/* Prepend 16-bit length before sending */
+	len = (uint16_t *) msgb_push(msg, L1CTL_MSG_LEN_FIELD);
+	*len = htons(msg->len - L1CTL_MSG_LEN_FIELD);
+
+	if (osmo_wqueue_enqueue(&l1l->wq, msg) != 0) {
+		LOGP(DL1D, LOGL_ERROR, "Failed to enqueue msg!\n");
+		msgb_free(msg);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+int l1ctl_link_close_conn(struct l1ctl_link *l1l)
+{
+	struct osmo_fd *conn_bfd = &l1l->wq.bfd;
+
+	if (conn_bfd->fd <= 0)
+		return -EINVAL;
+
+	/* Close connection socket */
+	osmo_fd_unregister(conn_bfd);
+	close(conn_bfd->fd);
+	conn_bfd->fd = -1;
+
+	/* Clear pending messages */
+	osmo_wqueue_clear(&l1l->wq);
+
+	osmo_fsm_inst_dispatch(trxcon_fsm, L1CTL_EVENT_DISCONNECT, l1l);
+	osmo_fsm_inst_state_chg(l1l->fsm, L1CTL_STATE_IDLE, 0, 0);
+
+	return 0;
+}
+
+int l1ctl_link_init(struct l1ctl_link **l1l, const char *sock_path)
+{
+	struct l1ctl_link *l1l_new;
+	struct osmo_fd *bfd;
+	int rc;
+
+	LOGP(DL1C, LOGL_NOTICE, "Init L1CTL link (%s)\n", sock_path);
+
+	l1l_new = talloc_zero(tall_trx_ctx, struct l1ctl_link);
+	if (!l1l_new) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to allocate memory\n");
+		return -ENOMEM;
+	}
+
+	/* Create a socket and bind handlers */
+	bfd = &l1l_new->listen_bfd;
+	rc = osmo_sock_unix_init_ofd(bfd, SOCK_STREAM, 0, sock_path,
+		OSMO_SOCK_F_BIND);
+	if (rc < 0) {
+		LOGP(DL1C, LOGL_ERROR, "Could not create UNIX socket: %s\n",
+			strerror(errno));
+		talloc_free(l1l_new);
+		return rc;
+	}
+
+	/* Bind shutdown handler */
+	l1l_new->shutdown_cb = l1ctl_shutdown_cb;
+
+	/* Bind connection handler */
+	bfd->cb = l1ctl_link_accept;
+	bfd->when = BSC_FD_READ;
+	bfd->data = l1l_new;
+
+	/**
+	 * To be able to accept first connection and
+	 * drop others, it should be set to -1
+	 */
+	l1l_new->wq.bfd.fd = -1;
+
+	/* Allocate a new dedicated state machine */
+	osmo_fsm_register(&l1ctl_fsm);
+	l1l_new->fsm = osmo_fsm_inst_alloc(&l1ctl_fsm, l1l_new,
+		NULL, LOGL_DEBUG, "l1ctl_link");
+
+	*l1l = l1l_new;
+
+	return 0;
+}
+
+void l1ctl_link_shutdown(struct l1ctl_link *l1l)
+{
+	struct osmo_fd *listen_bfd;
+
+	/* May be unallocated due to init error */
+	if (!l1l)
+		return;
+
+	LOGP(DL1C, LOGL_NOTICE, "Shutdown L1CTL link\n");
+
+	/* Call shutdown callback */
+	if (l1l->shutdown_cb != NULL)
+		l1l->shutdown_cb(l1l);
+
+	listen_bfd = &l1l->listen_bfd;
+
+	/* Check if we have an established connection */
+	if (l1l->wq.bfd.fd != -1)
+		l1ctl_link_close_conn(l1l);
+
+	/* Unbind listening socket */
+	if (listen_bfd->fd != -1) {
+		osmo_fd_unregister(listen_bfd);
+		close(listen_bfd->fd);
+		listen_bfd->fd = -1;
+	}
+
+	osmo_fsm_inst_free(l1l->fsm);
+	talloc_free(l1l);
+}
diff --git a/src/host/trxcon/l1ctl_link.h b/src/host/trxcon/l1ctl_link.h
new file mode 100644
index 00000000..01103dcc
--- /dev/null
+++ b/src/host/trxcon/l1ctl_link.h
@@ -0,0 +1,48 @@
+#pragma once
+
+#include <stdint.h>
+
+#include <osmocom/core/write_queue.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/fsm.h>
+
+#define L1CTL_LENGTH 256
+#define L1CTL_HEADROOM 32
+
+/**
+ * Each L1CTL message gets its own length pushed
+ * as two bytes in front before sending.
+ */
+#define L1CTL_MSG_LEN_FIELD 2
+
+/* Forward declaration to avoid mutual include */
+struct trx_instance;
+
+enum l1ctl_fsm_states {
+	L1CTL_STATE_IDLE = 0,
+	L1CTL_STATE_CONNECTED,
+};
+
+struct l1ctl_link {
+	struct osmo_fsm_inst *fsm;
+	struct osmo_fd listen_bfd;
+	struct osmo_wqueue wq;
+
+	/* Bind TRX instance */
+	struct trx_instance *trx;
+
+	/* L1CTL handlers specific */
+	struct osmo_timer_list fbsb_timer;
+	uint8_t fbsb_conf_sent;
+
+	/* Shutdown callback */
+	void (*shutdown_cb)(struct l1ctl_link *l1l);
+};
+
+int l1ctl_link_init(struct l1ctl_link **l1l, const char *sock_path);
+void l1ctl_link_shutdown(struct l1ctl_link *l1l);
+
+int l1ctl_link_send(struct l1ctl_link *l1l, struct msgb *msg);
+int l1ctl_link_close_conn(struct l1ctl_link *l1l);
diff --git a/src/host/trxcon/l1ctl_proto.h b/src/host/trxcon/l1ctl_proto.h
new file mode 120000
index 00000000..75862bae
--- /dev/null
+++ b/src/host/trxcon/l1ctl_proto.h
@@ -0,0 +1 @@
+../../../include/l1ctl_proto.h
\ No newline at end of file
diff --git a/src/host/trxcon/logging.c b/src/host/trxcon/logging.c
new file mode 100644
index 00000000..6a3043bb
--- /dev/null
+++ b/src/host/trxcon/logging.c
@@ -0,0 +1,89 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ *
+ * (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/core/application.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+
+#include "logging.h"
+#include "trxcon.h"
+
+static struct log_info_cat trx_log_info_cat[] = {
+	[DAPP] = {
+		.name = "DAPP",
+		.description = "Application",
+		.color = "\033[1;35m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DL1C] = {
+		.name = "DL1C",
+		.description = "Layer 1 control interface",
+		.color = "\033[1;31m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DL1D] = {
+		.name = "DL1D",
+		.description = "Layer 1 data",
+		.color = "\033[1;31m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DTRX] = {
+		.name = "DTRX",
+		.description = "Transceiver control interface",
+		.color = "\033[1;33m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DTRXD] = {
+		.name = "DTRXD",
+		.description = "Transceiver data interface",
+		.color = "\033[1;33m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DSCH] = {
+		.name = "DSCH",
+		.description = "Scheduler management",
+		.color = "\033[1;36m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DSCHD] = {
+		.name = "DSCHD",
+		.description = "Scheduler data",
+		.color = "\033[1;36m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+};
+
+static const struct log_info trx_log_info = {
+	.cat = trx_log_info_cat,
+	.num_cat = ARRAY_SIZE(trx_log_info_cat),
+};
+
+int trx_log_init(const char *category_mask)
+{
+	osmo_init_logging2(tall_trx_ctx, &trx_log_info);
+
+	if (category_mask)
+		log_parse_category_mask(osmo_stderr_target, category_mask);
+
+	return 0;
+}
diff --git a/src/host/trxcon/logging.h b/src/host/trxcon/logging.h
new file mode 100644
index 00000000..0206362a
--- /dev/null
+++ b/src/host/trxcon/logging.h
@@ -0,0 +1,17 @@
+#pragma once
+
+#include <osmocom/core/logging.h>
+
+#define DEBUG_DEFAULT "DAPP:DL1C:DL1D:DTRX:DTRXD:DSCH:DSCHD"
+
+enum {
+	DAPP,
+	DL1C,
+	DL1D,
+	DTRX,
+	DTRXD,
+	DSCH,
+	DSCHD,
+};
+
+int trx_log_init(const char *category_mask);
diff --git a/src/host/trxcon/sched_clck.c b/src/host/trxcon/sched_clck.c
new file mode 100644
index 00000000..d4054c99
--- /dev/null
+++ b/src/host/trxcon/sched_clck.c
@@ -0,0 +1,207 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: clock synchronization
+ *
+ * (C) 2013 by Andreas Eversberg <jolly@eversberg.eu>
+ * (C) 2015 by Alexander Chemeris <Alexander.Chemeris@fairwaves.co>
+ * (C) 2015 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <inttypes.h>
+#include <string.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/bits.h>
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/timer_compat.h>
+#include <osmocom/gsm/a5.h>
+
+#include "scheduler.h"
+#include "logging.h"
+#include "trx_if.h"
+#include "trxcon.h"
+
+#define MAX_FN_SKEW		50
+#define TRX_LOSS_FRAMES	400
+
+static void sched_clck_tick(void *data)
+{
+	struct trx_sched *sched = (struct trx_sched *) data;
+	struct timespec tv_now, *tv_clock, elapsed;
+	int64_t elapsed_us;
+	const struct timespec frame_duration = { .tv_sec = 0, .tv_nsec = FRAME_DURATION_uS * 1000 };
+
+	/* Check if transceiver is still alive */
+	if (sched->fn_counter_lost++ == TRX_LOSS_FRAMES) {
+		LOGP(DSCH, LOGL_DEBUG, "No more clock from transceiver\n");
+		sched->state = SCH_CLCK_STATE_WAIT;
+
+		return;
+	}
+
+	/* Get actual / previous frame time */
+	osmo_clock_gettime(CLOCK_MONOTONIC, &tv_now);
+	tv_clock = &sched->clock;
+
+	timespecsub(&tv_now, tv_clock, &elapsed);
+	elapsed_us = (elapsed.tv_sec * 1000000) + (elapsed.tv_nsec / 1000);
+
+	/* If someone played with clock, or if the process stalled */
+	if (elapsed_us > FRAME_DURATION_uS * MAX_FN_SKEW || elapsed_us < 0) {
+		LOGP(DSCH, LOGL_NOTICE, "PC clock skew: "
+			"elapsed uS %" PRId64 "\n", elapsed_us);
+
+		sched->state = SCH_CLCK_STATE_WAIT;
+
+		return;
+	}
+
+	/* Schedule next FN clock */
+	while (elapsed_us > FRAME_DURATION_uS / 2) {
+		timespecadd(tv_clock, &frame_duration, tv_clock);
+		elapsed_us -= FRAME_DURATION_uS;
+
+		sched->fn_counter_proc = TDMA_FN_INC(sched->fn_counter_proc);
+
+		/* Call frame callback */
+		if (sched->clock_cb)
+			sched->clock_cb(sched);
+	}
+
+	osmo_timer_schedule(&sched->clock_timer, 0,
+		FRAME_DURATION_uS - elapsed_us);
+}
+
+static void sched_clck_correct(struct trx_sched *sched,
+	struct timespec *tv_now, uint32_t fn)
+{
+	sched->fn_counter_proc = fn;
+
+	/* Call frame callback */
+	if (sched->clock_cb)
+		sched->clock_cb(sched);
+
+	/* Schedule first FN clock */
+	sched->clock = *tv_now;
+	memset(&sched->clock_timer, 0, sizeof(sched->clock_timer));
+
+	sched->clock_timer.cb = sched_clck_tick;
+	sched->clock_timer.data = sched;
+	osmo_timer_schedule(&sched->clock_timer, 0, FRAME_DURATION_uS);
+}
+
+int sched_clck_handle(struct trx_sched *sched, uint32_t fn)
+{
+	struct timespec tv_now, *tv_clock, elapsed;
+	int64_t elapsed_us, elapsed_fn;
+
+	/* Reset lost counter */
+	sched->fn_counter_lost = 0;
+
+	/* Get actual / previous frame time */
+	osmo_clock_gettime(CLOCK_MONOTONIC, &tv_now);
+	tv_clock = &sched->clock;
+
+	/* If this is the first CLCK IND */
+	if (sched->state == SCH_CLCK_STATE_WAIT) {
+		sched_clck_correct(sched, &tv_now, fn);
+
+		LOGP(DSCH, LOGL_DEBUG, "Initial clock received: fn=%u\n", fn);
+		sched->state = SCH_CLCK_STATE_OK;
+
+		return 0;
+	}
+
+	LOGP(DSCH, LOGL_NOTICE, "Clock indication: fn=%u\n", fn);
+
+	osmo_timer_del(&sched->clock_timer);
+
+	/* Calculate elapsed time / frames since last processed fn */
+	timespecsub(&tv_now, tv_clock, &elapsed);
+	elapsed_us = (elapsed.tv_sec * 1000000) + (elapsed.tv_nsec / 1000);
+	elapsed_fn = TDMA_FN_SUB(fn, sched->fn_counter_proc);
+
+	if (elapsed_fn >= 135774)
+		elapsed_fn -= GSM_HYPERFRAME;
+
+	/* Check for max clock skew */
+	if (elapsed_fn > MAX_FN_SKEW || elapsed_fn < -MAX_FN_SKEW) {
+		LOGP(DSCH, LOGL_NOTICE, "GSM clock skew: old fn=%u, "
+			"new fn=%u\n", sched->fn_counter_proc, fn);
+
+		sched_clck_correct(sched, &tv_now, fn);
+		return 0;
+	}
+
+	LOGP(DSCH, LOGL_INFO, "GSM clock jitter: %" PRId64 "\n",
+		elapsed_fn * FRAME_DURATION_uS - elapsed_us);
+
+	/* Too many frames have been processed already */
+	if (elapsed_fn < 0) {
+		struct timespec duration;
+		/**
+		 * Set clock to the time or last FN should
+		 * have been transmitted
+		 */
+		duration.tv_nsec = (0 - elapsed_fn) * FRAME_DURATION_uS * 1000;
+		duration.tv_sec = duration.tv_nsec / 1000000000;
+		duration.tv_nsec = duration.tv_nsec % 1000000000;
+		timespecadd(&tv_now, &duration, tv_clock);
+
+		/* Set time to the time our next FN has to be transmitted */
+		osmo_timer_schedule(&sched->clock_timer, 0,
+			FRAME_DURATION_uS * (1 - elapsed_fn));
+
+		return 0;
+	}
+
+	/* Transmit what we still need to transmit */
+	while (fn != sched->fn_counter_proc) {
+		sched->fn_counter_proc = TDMA_FN_INC(sched->fn_counter_proc);
+
+		/* Call frame callback */
+		if (sched->clock_cb)
+			sched->clock_cb(sched);
+	}
+
+	/* Schedule next FN to be transmitted */
+	*tv_clock = tv_now;
+	osmo_timer_schedule(&sched->clock_timer, 0, FRAME_DURATION_uS);
+
+	return 0;
+}
+
+void sched_clck_reset(struct trx_sched *sched)
+{
+	/* Reset internal state */
+	sched->state = SCH_CLCK_STATE_WAIT;
+
+	/* Stop clock timer */
+	osmo_timer_del(&sched->clock_timer);
+
+	/* Flush counters */
+	sched->fn_counter_proc = 0;
+	sched->fn_counter_lost = 0;
+}
diff --git a/src/host/trxcon/sched_lchan_common.c b/src/host/trxcon/sched_lchan_common.c
new file mode 100644
index 00000000..95e496b2
--- /dev/null
+++ b/src/host/trxcon/sched_lchan_common.c
@@ -0,0 +1,172 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: common routines for lchan handlers
+ *
+ * (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <talloc.h>
+#include <stdint.h>
+#include <stdbool.h>
+
+#include <arpa/inet.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/bits.h>
+
+#include <osmocom/codec/codec.h>
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+#include "l1ctl_proto.h"
+#include "scheduler.h"
+#include "sched_trx.h"
+#include "logging.h"
+#include "trx_if.h"
+#include "trxcon.h"
+#include "l1ctl.h"
+
+/* GSM 05.02 Chapter 5.2.3 Normal Burst (NB) */
+const uint8_t sched_nb_training_bits[8][26] = {
+	{
+		0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0,
+		0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1,
+	},
+	{
+		0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1,
+		1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1,
+	},
+	{
+		0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1,
+		0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0,
+	},
+	{
+		0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0,
+		1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0,
+	},
+	{
+		0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0,
+		1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1,
+	},
+	{
+		0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0,
+		0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0,
+	},
+	{
+		1, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 1,
+		0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1,
+	},
+	{
+		1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0,
+		0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0,
+	},
+};
+
+int sched_send_dt_ind(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint8_t *l2, size_t l2_len,
+	int bit_error_count, bool dec_failed, bool traffic)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	struct l1ctl_info_dl dl_hdr;
+
+	/* Set up pointers */
+	lchan_desc = &trx_lchan_desc[lchan->type];
+
+	/* Fill in known downlink info */
+	dl_hdr.chan_nr = lchan_desc->chan_nr | ts->index;
+	dl_hdr.link_id = lchan_desc->link_id;
+	dl_hdr.band_arfcn = htons(trx->band_arfcn);
+	dl_hdr.frame_nr = htonl(lchan->rx_first_fn);
+	dl_hdr.rx_level = -(lchan->meas.rssi_sum / lchan->meas.rssi_num);
+	dl_hdr.num_biterr = bit_error_count;
+
+	/* FIXME: set proper values */
+	dl_hdr.snr = 0;
+
+	/* Mark frame as broken if so */
+	dl_hdr.fire_crc = dec_failed ? 2 : 0;
+
+	/* Put a packet to higher layers */
+	l1ctl_tx_dt_ind(trx->l1l, &dl_hdr, l2, l2_len, traffic);
+
+	return 0;
+}
+
+int sched_send_dt_conf(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, bool traffic)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	struct l1ctl_info_dl dl_hdr;
+
+	/* Set up pointers */
+	lchan_desc = &trx_lchan_desc[lchan->type];
+
+	/* Zero-initialize DL header, because we don't set all fields */
+	memset(&dl_hdr, 0x00, sizeof(struct l1ctl_info_dl));
+
+	/* Fill in known downlink info */
+	dl_hdr.chan_nr = lchan_desc->chan_nr | ts->index;
+	dl_hdr.link_id = lchan_desc->link_id;
+	dl_hdr.band_arfcn = htons(trx->band_arfcn);
+	dl_hdr.frame_nr = htonl(fn);
+
+	l1ctl_tx_dt_conf(trx->l1l, &dl_hdr, traffic);
+
+	return 0;
+}
+
+/**
+ * Composes a bad frame indication message
+ * according to the current tch_mode.
+ *
+ * @param  l2       Caller-allocated byte array
+ * @param  lchan    Logical channel to generate BFI for
+ * @return          How much bytes were written
+ */
+size_t sched_bad_frame_ind(uint8_t *l2, struct trx_lchan_state *lchan)
+{
+	switch (lchan->tch_mode) {
+	case GSM48_CMODE_SPEECH_V1:
+		if (lchan->type == TRXC_TCHF) { /* Full Rate */
+			memset(l2, 0x00, GSM_FR_BYTES);
+			l2[0] = 0xd0;
+			return GSM_FR_BYTES;
+		} else { /* Half Rate */
+			memset(l2 + 1, 0x00, GSM_HR_BYTES);
+			l2[0] = 0x70; /* F = 0, FT = 111 */
+			return GSM_HR_BYTES + 1;
+		}
+	case GSM48_CMODE_SPEECH_EFR: /* Enhanced Full Rate */
+		memset(l2, 0x00, GSM_EFR_BYTES);
+		l2[0] = 0xc0;
+		return GSM_EFR_BYTES;
+	case GSM48_CMODE_SPEECH_AMR: /* Adaptive Multi Rate */
+		/* FIXME: AMR is not implemented yet */
+		return 0;
+	case GSM48_CMODE_SIGN:
+		LOGP(DSCH, LOGL_ERROR, "BFI is not allowed in signalling mode\n");
+		return 0;
+	default:
+		LOGP(DSCH, LOGL_ERROR, "Invalid TCH mode: %u\n", lchan->tch_mode);
+		return 0;
+	}
+}
diff --git a/src/host/trxcon/sched_lchan_desc.c b/src/host/trxcon/sched_lchan_desc.c
new file mode 100644
index 00000000..93639a37
--- /dev/null
+++ b/src/host/trxcon/sched_lchan_desc.c
@@ -0,0 +1,317 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: logical channels, RX / TX handlers
+ *
+ * (C) 2013 by Andreas Eversberg <jolly@eversberg.eu>
+ * (C) 2015 by Alexander Chemeris <Alexander.Chemeris@fairwaves.co>
+ * (C) 2015 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "sched_trx.h"
+
+/* Forward declaration of handlers */
+int rx_data_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid,
+	sbit_t *bits, int8_t rssi, int16_t toa256);
+
+int tx_data_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid);
+
+int rx_sch_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid,
+	sbit_t *bits, int8_t rssi, int16_t toa256);
+
+int tx_rach_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid);
+
+int rx_tchf_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid,
+	sbit_t *bits, int8_t rssi, int16_t toa256);
+
+int tx_tchf_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid);
+
+int rx_tchh_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid,
+	sbit_t *bits, int8_t rssi, int16_t toa256);
+
+int tx_tchh_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid);
+
+int rx_pdtch_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid,
+	sbit_t *bits, int8_t rssi, int16_t toa256);
+
+int tx_pdtch_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid);
+
+const struct trx_lchan_desc trx_lchan_desc[_TRX_CHAN_MAX] = {
+	{
+		TRXC_IDLE,		"IDLE",
+		0x00,			TRX_CH_LID_DEDIC,
+		0x00,			0x00,
+
+		/**
+		 * MS: do nothing, save power...
+		 * BTS: send dummy burst on C0
+		 */
+		NULL,			NULL,
+	},
+	{
+		TRXC_FCCH,		"FCCH",
+		0x00,			TRX_CH_LID_DEDIC,
+		0x00,			0x00,
+
+		/* FCCH is handled by transceiver */
+		NULL,			NULL,
+	},
+	{
+		TRXC_SCH, 		"SCH",
+		0x00,			TRX_CH_LID_DEDIC,
+		0x00,			TRX_CH_FLAG_AUTO,
+
+		/**
+		 * We already have clock indications from TRX,
+		 * but we also need BSIC (BCC / NCC) value.
+		 */
+		rx_sch_fn,		NULL,
+	},
+	{
+		TRXC_BCCH,		"BCCH",
+		0x80,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_AUTO,
+		rx_data_fn,		NULL,
+	},
+	{
+		TRXC_RACH,		"RACH",
+		0x88,			TRX_CH_LID_DEDIC,
+		0x00,			TRX_CH_FLAG_AUTO,
+		NULL,			tx_rach_fn,
+	},
+	{
+		TRXC_CCCH,		"CCCH",
+		0x90,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_AUTO,
+		rx_data_fn,		NULL,
+	},
+	{
+		TRXC_TCHF,		"TCH/F",
+		0x08,			TRX_CH_LID_DEDIC,
+		8 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_tchf_fn,		tx_tchf_fn,
+	},
+	{
+		TRXC_TCHH_0,		"TCH/H(0)",
+		0x10,			TRX_CH_LID_DEDIC,
+		6 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_tchh_fn,		tx_tchh_fn,
+	},
+	{
+		TRXC_TCHH_1,		"TCH/H(1)",
+		0x18,			TRX_CH_LID_DEDIC,
+		6 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_tchh_fn,		tx_tchh_fn,
+	},
+	{
+		TRXC_SDCCH4_0,		"SDCCH/4(0)",
+		0x20,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH4_1,		"SDCCH/4(1)",
+		0x28,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH4_2,		"SDCCH/4(2)",
+		0x30,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH4_3,		"SDCCH/4(3)",
+		0x38,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH8_0,		"SDCCH/8(0)",
+		0x40,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH8_1,		"SDCCH/8(1)",
+		0x48,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH8_2,		"SDCCH/8(2)",
+		0x50,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH8_3,		"SDCCH/8(3)",
+		0x58,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH8_4,		"SDCCH/8(4)",
+		0x60,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH8_5,		"SDCCH/8(5)",
+		0x68,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH8_6,		"SDCCH/8(6)",
+		0x70,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SDCCH8_7,		"SDCCH/8(7)",
+		0x78,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCHTF,		"SACCH/TF",
+		0x08,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCHTH_0,		"SACCH/TH(0)",
+		0x10,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCHTH_1,		"SACCH/TH(1)",
+		0x18,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH4_0,		"SACCH/4(0)",
+		0x20,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH4_1,		"SACCH/4(1)",
+		0x28,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH4_2,		"SACCH/4(2)",
+		0x30,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH4_3,		"SACCH/4(3)",
+		0x38,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH8_0,		"SACCH/8(0)",
+		0x40,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH8_1,		"SACCH/8(1)",
+		0x48,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH8_2,		"SACCH/8(2)",
+		0x50,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH8_3,		"SACCH/8(3)",
+		0x58,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH8_4,		"SACCH/8(4)",
+		0x60,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH8_5,		"SACCH/8(5)",
+		0x68,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH8_6,		"SACCH/8(6)",
+		0x70,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_SACCH8_7,		"SACCH/8(7)",
+		0x78,			TRX_CH_LID_SACCH,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_CBTX,
+		rx_data_fn,		tx_data_fn,
+	},
+	{
+		TRXC_PDTCH,		"PDTCH",
+		0xc0,			TRX_CH_LID_DEDIC,
+		12 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_PDCH,
+		rx_pdtch_fn,		tx_pdtch_fn,
+	},
+	{
+		TRXC_PTCCH,		"PTCCH",
+		0xc0,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_PDCH,
+		rx_data_fn,		tx_data_fn,
+	},
+	[TRXC_SDCCH4_CBCH] = {
+		TRXC_SDCCH4_CBCH,	"SDCCH/4(CBCH)",
+		0xc0,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	TRX_CH_FLAG_AUTO,
+		rx_data_fn,		NULL,
+	},
+	[TRXC_SDCCH8_CBCH] = {
+		TRXC_SDCCH8_CBCH,	"SDCCH/8(CBCH)",
+		0xc8,			TRX_CH_LID_DEDIC,
+		4 * GSM_BURST_PL_LEN,	0x00,
+		rx_data_fn,		NULL,
+	},
+};
diff --git a/src/host/trxcon/sched_lchan_pdtch.c b/src/host/trxcon/sched_lchan_pdtch.c
new file mode 100644
index 00000000..1a8987b3
--- /dev/null
+++ b/src/host/trxcon/sched_lchan_pdtch.c
@@ -0,0 +1,204 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: handlers for DL / UL bursts on logical channels
+ *
+ * (C) 2018 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <stdint.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/bits.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/coding/gsm0503_coding.h>
+
+#include "l1ctl_proto.h"
+#include "scheduler.h"
+#include "sched_trx.h"
+#include "logging.h"
+#include "trx_if.h"
+#include "trxcon.h"
+#include "l1ctl.h"
+
+int rx_pdtch_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid,
+	sbit_t *bits, int8_t rssi, int16_t toa256)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	uint8_t l2[GPRS_L2_MAX_LEN], *mask;
+	int n_errors, n_bits_total, rc;
+	sbit_t *buffer, *offset;
+	uint32_t *first_fn;
+	size_t l2_len;
+
+	/* Set up pointers */
+	lchan_desc = &trx_lchan_desc[lchan->type];
+	first_fn = &lchan->rx_first_fn;
+	mask = &lchan->rx_burst_mask;
+	buffer = lchan->rx_bursts;
+
+	LOGP(DSCHD, LOGL_DEBUG, "Packet data received on %s: "
+		"fn=%u ts=%u bid=%u\n", lchan_desc->name, fn, ts->index, bid);
+
+	/* Reset internal state */
+	if (bid == 0) {
+		/* Clean up old measurements */
+		memset(&lchan->meas, 0x00, sizeof(lchan->meas));
+
+		*first_fn = fn;
+		*mask = 0x0;
+	}
+
+	/* Update mask */
+	*mask |= (1 << bid);
+
+	/* Update measurements */
+	lchan->meas.toa256_sum += toa256;
+	lchan->meas.rssi_sum += rssi;
+	lchan->meas.toa256_num++;
+	lchan->meas.rssi_num++;
+
+	/* Copy burst to buffer of 4 bursts */
+	offset = buffer + bid * 116;
+	memcpy(offset, bits + 3, 58);
+	memcpy(offset + 58, bits + 87, 58);
+
+	/* Wait until complete set of bursts */
+	if (bid != 3)
+		return 0;
+
+	/* Check for complete set of bursts */
+	if ((*mask & 0xf) != 0xf) {
+		LOGP(DSCHD, LOGL_ERROR, "Received incomplete data frame at "
+			"fn=%u (%u/%u) for %s\n", *first_fn,
+			(*first_fn) % ts->mf_layout->period,
+			ts->mf_layout->period,
+			lchan_desc->name);
+
+		return -1;
+	}
+
+	/* Attempt to decode */
+	rc = gsm0503_pdtch_decode(l2, buffer,
+		NULL, &n_errors, &n_bits_total);
+	if (rc < 0) {
+		LOGP(DSCHD, LOGL_ERROR, "Received bad packet data frame "
+			"at fn=%u (%u/%u) for %s\n", *first_fn,
+			(*first_fn) % ts->mf_layout->period,
+			ts->mf_layout->period,
+			lchan_desc->name);
+	}
+
+	/* Determine L2 length */
+	l2_len = rc > 0 ? rc : 0;
+
+	/* Send a L2 frame to the higher layers */
+	sched_send_dt_ind(trx, ts, lchan,
+		l2, l2_len, n_errors, rc < 0, true);
+
+	return 0;
+}
+
+
+int tx_pdtch_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	ubit_t burst[GSM_BURST_LEN];
+	ubit_t *buffer, *offset;
+	const uint8_t *tsc;
+	uint8_t *mask;
+	int rc;
+
+	/* Set up pointers */
+	lchan_desc = &trx_lchan_desc[lchan->type];
+	mask = &lchan->tx_burst_mask;
+	buffer = lchan->tx_bursts;
+
+	if (bid > 0) {
+		/* If we have encoded bursts */
+		if (*mask)
+			goto send_burst;
+		else
+			return 0;
+	}
+
+	/* Encode payload */
+	rc = gsm0503_pdtch_encode(buffer, lchan->prim->payload,
+		lchan->prim->payload_len);
+	if (rc) {
+		LOGP(DSCHD, LOGL_ERROR, "Failed to encode L2 payload\n");
+
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+
+		return -EINVAL;
+	}
+
+send_burst:
+	/* Determine which burst should be sent */
+	offset = buffer + bid * 116;
+
+	/* Update mask */
+	*mask |= (1 << bid);
+
+	/* Choose proper TSC */
+	tsc = sched_nb_training_bits[trx->tsc];
+
+	/* Compose a new burst */
+	memset(burst, 0, 3); /* TB */
+	memcpy(burst + 3, offset, 58); /* Payload 1/2 */
+	memcpy(burst + 61, tsc, 26); /* TSC */
+	memcpy(burst + 87, offset + 58, 58); /* Payload 2/2 */
+	memset(burst + 145, 0, 3); /* TB */
+
+	LOGP(DSCHD, LOGL_DEBUG, "Transmitting %s fn=%u ts=%u burst=%u\n",
+		lchan_desc->name, fn, ts->index, bid);
+
+	/* Forward burst to scheduler */
+	rc = sched_trx_handle_tx_burst(trx, ts, lchan, fn, burst);
+	if (rc) {
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+
+		/* Reset mask */
+		*mask = 0x00;
+
+		return rc;
+	}
+
+	/* If we have sent the last (4/4) burst */
+	if ((*mask & 0x0f) == 0x0f) {
+		/* Confirm data / traffic sending */
+		sched_send_dt_conf(trx, ts, lchan, fn, true);
+
+		/* Forget processed primitive */
+		sched_prim_drop(lchan);
+
+		/* Reset mask */
+		*mask = 0x00;
+	}
+
+	return 0;
+}
diff --git a/src/host/trxcon/sched_lchan_rach.c b/src/host/trxcon/sched_lchan_rach.c
new file mode 100644
index 00000000..a255efb8
--- /dev/null
+++ b/src/host/trxcon/sched_lchan_rach.c
@@ -0,0 +1,123 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: handlers for DL / UL bursts on logical channels
+ *
+ * (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <stdint.h>
+#include <stdbool.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/bits.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/coding/gsm0503_coding.h>
+
+#include "l1ctl_proto.h"
+#include "scheduler.h"
+#include "sched_trx.h"
+#include "logging.h"
+#include "trx_if.h"
+#include "trxcon.h"
+#include "l1ctl.h"
+
+/**
+ * 8-bit RACH extended tail bits
+ * GSM 05.02 Chapter 5.2.7 Access burst (AB)
+ */
+
+static ubit_t rach_ext_tail_bits[] = {
+	0, 0, 1, 1, 1, 0, 1, 0,
+};
+
+/**
+ * 41-bit RACH synchronization sequence
+ * GSM 05.02 Chapter 5.2.7 Access burst (AB)
+ */
+static ubit_t rach_synch_seq[] = {
+	0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1,
+	1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0,
+	1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0,
+};
+
+/* Obtain a to-be-transmitted RACH burst */
+int tx_rach_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid)
+{
+	struct l1ctl_rach_req *req;
+	uint8_t burst[GSM_BURST_LEN];
+	uint8_t payload[36];
+	int rc;
+
+	/* Check the prim payload length */
+	if (lchan->prim->payload_len != sizeof(*req)) {
+		LOGP(DSCHD, LOGL_ERROR, "Primitive has odd length %zu (expected %zu), "
+			"so dropping...\n", lchan->prim->payload_len, sizeof(*req));
+
+		sched_prim_drop(lchan);
+		return -EINVAL;
+	}
+
+	/* Get the payload from a current primitive */
+	req = (struct l1ctl_rach_req *) lchan->prim->payload;
+
+	/* Delay RACH sending according to offset value */
+	if (req->offset-- > 0)
+		return 0;
+
+	/* Encode (8-bit) payload */
+	rc = gsm0503_rach_ext_encode(payload, req->ra, trx->bsic, false);
+	if (rc) {
+		LOGP(DSCHD, LOGL_ERROR, "Could not encode RACH burst\n");
+
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+
+		return rc;
+	}
+
+	/* Compose RACH burst */
+	memcpy(burst, rach_ext_tail_bits, 8); /* TB */
+	memcpy(burst + 8, rach_synch_seq, 41); /* sync seq */
+	memcpy(burst + 49, payload, 36); /* payload */
+	memset(burst + 85, 0, 63); /* TB + GP */
+
+	LOGP(DSCHD, LOGL_DEBUG, "Transmitting RACH fn=%u\n", fn);
+
+	/* Forward burst to scheduler */
+	rc = sched_trx_handle_tx_burst(trx, ts, lchan, fn, burst);
+	if (rc) {
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+
+		return rc;
+	}
+
+	/* Confirm RACH request */
+	l1ctl_tx_rach_conf(trx->l1l, fn);
+
+	/* Forget processed primitive */
+	sched_prim_drop(lchan);
+
+	return 0;
+}
diff --git a/src/host/trxcon/sched_lchan_sch.c b/src/host/trxcon/sched_lchan_sch.c
new file mode 100644
index 00000000..1b241a08
--- /dev/null
+++ b/src/host/trxcon/sched_lchan_sch.c
@@ -0,0 +1,134 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: handlers for DL / UL bursts on logical channels
+ *
+ * (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <talloc.h>
+#include <stdint.h>
+
+#include <arpa/inet.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/bits.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/coding/gsm0503_coding.h>
+
+#include "l1ctl_proto.h"
+#include "scheduler.h"
+#include "sched_trx.h"
+#include "logging.h"
+#include "trx_if.h"
+#include "trxcon.h"
+#include "l1ctl.h"
+
+static void decode_sb(struct gsm_time *time, uint8_t *bsic, uint8_t *sb_info)
+{
+	uint8_t t3p;
+	uint32_t sb;
+
+	sb = (sb_info[3] << 24)
+	   | (sb_info[2] << 16)
+	   | (sb_info[1] << 8)
+	   | sb_info[0];
+
+	*bsic = (sb >> 2) & 0x3f;
+
+	/* TS 05.02 Chapter 3.3.2.2.1 SCH Frame Numbers */
+	time->t1 = ((sb >> 23) & 0x01)
+		 | ((sb >> 7) & 0x1fe)
+		 | ((sb << 9) & 0x600);
+
+	time->t2 = (sb >> 18) & 0x1f;
+
+	t3p = ((sb >> 24) & 0x01) | ((sb >> 15) & 0x06);
+	time->t3 = t3p * 10 + 1;
+
+	/* TS 05.02 Chapter 4.3.3 TDMA frame number */
+	time->fn = gsm_gsmtime2fn(time);
+}
+
+int rx_sch_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid,
+	sbit_t *bits, int8_t rssi, int16_t toa256)
+{
+	sbit_t payload[2 * 39];
+	struct gsm_time time;
+	uint8_t sb_info[4];
+	uint8_t bsic;
+	int rc;
+
+	/* Obtain payload from burst */
+	memcpy(payload, bits + 3, 39);
+	memcpy(payload + 39, bits + 3 + 39 + 64, 39);
+
+	/* Attempt to decode */
+	rc = gsm0503_sch_decode(sb_info, payload);
+	if (rc) {
+		LOGP(DSCHD, LOGL_ERROR, "Received bad SCH burst at fn=%u\n", fn);
+		return rc;
+	}
+
+	/* Decode BSIC and TDMA frame number */
+	decode_sb(&time, &bsic, sb_info);
+
+	LOGP(DSCHD, LOGL_DEBUG, "Received SCH: bsic=%u, fn=%u, sched_fn=%u\n",
+		bsic, time.fn, trx->sched.fn_counter_proc);
+
+	/* Check if decoded frame number matches */
+	if (time.fn != fn) {
+		LOGP(DSCHD, LOGL_ERROR, "Decoded fn=%u does not match "
+			"fn=%u provided by scheduler\n", time.fn, fn);
+		return -EINVAL;
+	}
+
+	/* We don't need to send L1CTL_FBSB_CONF */
+	if (trx->l1l->fbsb_conf_sent)
+		return 0;
+
+	/* Send L1CTL_FBSB_CONF to higher layers */
+	struct l1ctl_info_dl *data;
+	data = talloc_zero_size(ts, sizeof(struct l1ctl_info_dl));
+	if (data == NULL)
+		return -ENOMEM;
+
+	/* Fill in some downlink info */
+	data->chan_nr = trx_lchan_desc[lchan->type].chan_nr | ts->index;
+	data->link_id = trx_lchan_desc[lchan->type].link_id;
+	data->band_arfcn = htons(trx->band_arfcn);
+	data->frame_nr = htonl(fn);
+	data->rx_level = -rssi;
+
+	/* FIXME: set proper values */
+	data->num_biterr = 0;
+	data->fire_crc = 0;
+	data->snr = 0;
+
+	l1ctl_tx_fbsb_conf(trx->l1l, 0, data, bsic);
+
+	/* Update BSIC value of trx_instance */
+	trx->bsic = bsic;
+
+	return 0;
+}
diff --git a/src/host/trxcon/sched_lchan_tchf.c b/src/host/trxcon/sched_lchan_tchf.c
new file mode 100644
index 00000000..09d504f8
--- /dev/null
+++ b/src/host/trxcon/sched_lchan_tchf.c
@@ -0,0 +1,297 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: handlers for DL / UL bursts on logical channels
+ *
+ * (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <stdint.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/bits.h>
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <osmocom/coding/gsm0503_coding.h>
+#include <osmocom/codec/codec.h>
+
+#include "l1ctl_proto.h"
+#include "scheduler.h"
+#include "sched_trx.h"
+#include "logging.h"
+#include "trx_if.h"
+#include "trxcon.h"
+#include "l1ctl.h"
+
+int rx_tchf_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid,
+	sbit_t *bits, int8_t rssi, int16_t toa256)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	int n_errors = -1, n_bits_total, rc;
+	sbit_t *buffer, *offset;
+	uint8_t l2[128], *mask;
+	uint32_t *first_fn;
+	size_t l2_len;
+
+	/* Set up pointers */
+	lchan_desc = &trx_lchan_desc[lchan->type];
+	first_fn = &lchan->rx_first_fn;
+	mask = &lchan->rx_burst_mask;
+	buffer = lchan->rx_bursts;
+
+	LOGP(DSCHD, LOGL_DEBUG, "Traffic received on %s: fn=%u ts=%u bid=%u\n",
+		lchan_desc->name, fn, ts->index, bid);
+
+	/* Reset internal state */
+	if (bid == 0) {
+		/* Clean up old measurements */
+		memset(&lchan->meas, 0x00, sizeof(lchan->meas));
+
+		*first_fn = fn;
+		*mask = 0x00;
+	}
+
+	/* Update mask */
+	*mask |= (1 << bid);
+
+	/* Update mask and RSSI */
+	lchan->meas.rssi_sum += rssi;
+	lchan->meas.toa256_sum += toa256;
+	lchan->meas.rssi_num++;
+	lchan->meas.toa256_num++;
+
+	/* Copy burst to end of buffer of 8 bursts */
+	offset = buffer + bid * 116 + 464;
+	memcpy(offset, bits + 3, 58);
+	memcpy(offset + 58, bits + 87, 58);
+
+	/* Wait until complete set of bursts */
+	if (bid != 3)
+		return 0;
+
+	/* Check for complete set of bursts */
+	if ((*mask & 0xf) != 0xf) {
+		LOGP(DSCHD, LOGL_ERROR, "Received incomplete traffic frame at "
+			"fn=%u (%u/%u) for %s\n", *first_fn,
+			(*first_fn) % ts->mf_layout->period,
+			ts->mf_layout->period,
+			lchan_desc->name);
+
+		/* Send BFI */
+		goto bfi;
+	}
+
+	switch (lchan->tch_mode) {
+	case GSM48_CMODE_SIGN:
+	case GSM48_CMODE_SPEECH_V1: /* FR */
+		rc = gsm0503_tch_fr_decode(l2, buffer,
+			1, 0, &n_errors, &n_bits_total);
+		break;
+	case GSM48_CMODE_SPEECH_EFR: /* EFR */
+		rc = gsm0503_tch_fr_decode(l2, buffer,
+			1, 1, &n_errors, &n_bits_total);
+		break;
+	case GSM48_CMODE_SPEECH_AMR: /* AMR */
+		/**
+		 * TODO: AMR requires a dedicated loop,
+		 * which will be implemented later...
+		 */
+		LOGP(DSCHD, LOGL_ERROR, "AMR isn't supported yet\n");
+		return -ENOTSUP;
+	default:
+		LOGP(DSCHD, LOGL_ERROR, "Invalid TCH mode: %u\n", lchan->tch_mode);
+		return -EINVAL;
+	}
+
+	/* Shift buffer by 4 bursts for interleaving */
+	memcpy(buffer, buffer + 464, 464);
+
+	/* Check decoding result */
+	if (rc < 4) {
+		LOGP(DSCHD, LOGL_ERROR, "Received bad TCH frame ending at "
+			"fn=%u for %s\n", fn, lchan_desc->name);
+
+		/* Send BFI */
+		goto bfi;
+	} else if (rc == GSM_MACBLOCK_LEN) {
+		/* FACCH received, forward it to the higher layers */
+		sched_send_dt_ind(trx, ts, lchan, l2, GSM_MACBLOCK_LEN,
+			n_errors, false, false);
+
+		/* Send BFI instead of stolen TCH frame */
+		goto bfi;
+	} else {
+		/* A good TCH frame received */
+		l2_len = rc;
+	}
+
+	/* Send a traffic frame to the higher layers */
+	return sched_send_dt_ind(trx, ts, lchan, l2, l2_len,
+		n_errors, false, true);
+
+bfi:
+	/* Didn't try to decode */
+	if (n_errors < 0)
+		n_errors = 116 * 4;
+
+	/* BFI is not applicable in signalling mode */
+	if (lchan->tch_mode == GSM48_CMODE_SIGN)
+		return sched_send_dt_ind(trx, ts, lchan, NULL, 0,
+			n_errors, true, false);
+
+	/* Bad frame indication */
+	l2_len = sched_bad_frame_ind(l2, lchan);
+
+	/* Send a BFI frame to the higher layers */
+	return sched_send_dt_ind(trx, ts, lchan, l2, l2_len,
+		n_errors, true, true);
+}
+
+int tx_tchf_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	ubit_t burst[GSM_BURST_LEN];
+	ubit_t *buffer, *offset;
+	const uint8_t *tsc;
+	uint8_t *mask;
+	size_t l2_len;
+	int rc;
+
+	/* Set up pointers */
+	lchan_desc = &trx_lchan_desc[lchan->type];
+	mask = &lchan->tx_burst_mask;
+	buffer = lchan->tx_bursts;
+
+	/* If we have encoded bursts */
+	if (*mask)
+		goto send_burst;
+
+	/* Wait until a first burst in period */
+	if (bid > 0)
+		return 0;
+
+	/* Check the current TCH mode */
+	switch (lchan->tch_mode) {
+	case GSM48_CMODE_SIGN:
+	case GSM48_CMODE_SPEECH_V1: /* FR */
+		l2_len = GSM_FR_BYTES;
+		break;
+	case GSM48_CMODE_SPEECH_EFR: /* EFR */
+		l2_len = GSM_EFR_BYTES;
+		break;
+	case GSM48_CMODE_SPEECH_AMR: /* AMR */
+		/**
+		 * TODO: AMR requires a dedicated loop,
+		 * which will be implemented later...
+		 */
+		LOGP(DSCHD, LOGL_ERROR, "AMR isn't supported yet, "
+			"dropping frame...\n");
+
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+
+		return -ENOTSUP;
+	default:
+		LOGP(DSCHD, LOGL_ERROR, "Invalid TCH mode: %u, "
+			"dropping frame...\n", lchan->tch_mode);
+
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+
+		return -EINVAL;
+	}
+
+	/* Determine and check the payload length */
+	if (lchan->prim->payload_len == GSM_MACBLOCK_LEN) {
+		l2_len = GSM_MACBLOCK_LEN; /* FACCH */
+	} else if (lchan->prim->payload_len != l2_len) {
+		LOGP(DSCHD, LOGL_ERROR, "Primitive has odd length %zu "
+			"(expected %zu for TCH or %u for FACCH), so dropping...\n",
+			lchan->prim->payload_len, l2_len, GSM_MACBLOCK_LEN);
+
+		sched_prim_drop(lchan);
+		return -EINVAL;
+	}
+
+	/* Shift buffer by 4 bursts back for interleaving */
+	memcpy(buffer, buffer + 464, 464);
+
+	/* Encode payload */
+	rc = gsm0503_tch_fr_encode(buffer, lchan->prim->payload, l2_len, 1);
+	if (rc) {
+		LOGP(DSCHD, LOGL_ERROR, "Failed to encode L2 payload\n");
+
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+
+		return -EINVAL;
+	}
+
+send_burst:
+	/* Determine which burst should be sent */
+	offset = buffer + bid * 116;
+
+	/* Update mask */
+	*mask |= (1 << bid);
+
+	/* Choose proper TSC */
+	tsc = sched_nb_training_bits[trx->tsc];
+
+	/* Compose a new burst */
+	memset(burst, 0, 3); /* TB */
+	memcpy(burst + 3, offset, 58); /* Payload 1/2 */
+	memcpy(burst + 61, tsc, 26); /* TSC */
+	memcpy(burst + 87, offset + 58, 58); /* Payload 2/2 */
+	memset(burst + 145, 0, 3); /* TB */
+
+	LOGP(DSCHD, LOGL_DEBUG, "Transmitting %s fn=%u ts=%u burst=%u\n",
+		lchan_desc->name, fn, ts->index, bid);
+
+	/* Forward burst to scheduler */
+	rc = sched_trx_handle_tx_burst(trx, ts, lchan, fn, burst);
+	if (rc) {
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+
+		/* Reset mask */
+		*mask = 0x00;
+
+		return rc;
+	}
+
+	/* If we have sent the last (4/4) burst */
+	if (*mask == 0x0f) {
+		/* Confirm data / traffic sending */
+		sched_send_dt_conf(trx, ts, lchan, fn, PRIM_IS_TCH(lchan->prim));
+
+		/* Forget processed primitive */
+		sched_prim_drop(lchan);
+
+		/* Reset mask */
+		*mask = 0x00;
+	}
+
+	return 0;
+}
diff --git a/src/host/trxcon/sched_lchan_tchh.c b/src/host/trxcon/sched_lchan_tchh.c
new file mode 100644
index 00000000..7fb2809d
--- /dev/null
+++ b/src/host/trxcon/sched_lchan_tchh.c
@@ -0,0 +1,502 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: handlers for DL / UL bursts on logical channels
+ *
+ * (C) 2018 by Vadim Yanitskiy <axilirator@gmail.com>
+ * (C) 2018 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <stdint.h>
+#include <stdbool.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/bits.h>
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <osmocom/coding/gsm0503_coding.h>
+#include <osmocom/codec/codec.h>
+
+#include "l1ctl_proto.h"
+#include "scheduler.h"
+#include "sched_trx.h"
+#include "logging.h"
+#include "trx_if.h"
+#include "trxcon.h"
+#include "l1ctl.h"
+
+static const uint8_t tch_h0_traffic_block_map[3][4] = {
+	/* B0(0,2,4,6), B1(4,6,8,10), B2(8,10,0,2) */
+	{ 0, 2, 4, 6 },
+	{ 4, 6, 8, 10 },
+	{ 8, 10, 0, 2 },
+};
+
+static const uint8_t tch_h1_traffic_block_map[3][4] = {
+	/* B0(1,3,5,7), B1(5,7,9,11), B2(9,11,1,3) */
+	{ 1, 3, 5, 7 },
+	{ 5, 7, 9, 11 },
+	{ 9, 11, 1, 3 },
+};
+
+static const uint8_t tch_h0_dl_facch_block_map[3][6] = {
+	/* B0(4,6,8,10,13,15), B1(13,15,17,19,21,23), B2(21,23,0,2,4,6) */
+	{ 4, 6, 8, 10, 13, 15 },
+	{ 13, 15, 17, 19, 21, 23 },
+	{ 21, 23, 0, 2, 4, 6 },
+};
+
+static const uint8_t tch_h0_ul_facch_block_map[3][6] = {
+	/* B0(0,2,4,6,8,10), B1(8,10,13,15,17,19), B2(17,19,21,23,0,2) */
+	{ 0, 2, 4, 6, 8, 10 },
+	{ 8, 10, 13, 15, 17, 19 },
+	{ 17, 19, 21, 23, 0, 2 },
+};
+
+static const uint8_t tch_h1_dl_facch_block_map[3][6] = {
+	/* B0(5,7,9,11,14,16), B1(14,16,18,20,22,24), B2(22,24,1,3,5,7) */
+	{ 5, 7, 9, 11, 14, 16 },
+	{ 14, 16, 18, 20, 22, 24 },
+	{ 22, 24, 1, 3, 5, 7 },
+};
+
+const uint8_t tch_h1_ul_facch_block_map[3][6] = {
+	/* B0(1,3,5,7,9,11), B1(9,11,14,16,18,20), B2(18,20,22,24,1,3) */
+	{ 1, 3, 5, 7, 9, 11 },
+	{ 9, 11, 14, 16, 18, 20 },
+	{ 18, 20, 22, 24, 1, 3 },
+};
+
+/**
+ * Can a TCH/H block transmission be initiated / finished
+ * on a given frame number and a given channel type?
+ *
+ * See GSM 05.02, clause 7, table 1
+ *
+ * @param  chan   channel type (TRXC_TCHH_0 or TRXC_TCHH_1)
+ * @param  fn     the current frame number
+ * @param  ul     Uplink or Downlink?
+ * @param  facch  FACCH/H or traffic?
+ * @param  start  init or end of transmission?
+ * @return        true (yes) or false (no)
+ */
+bool sched_tchh_block_map_fn(enum trx_lchan_type chan,
+	uint32_t fn, bool ul, bool facch, bool start)
+{
+	uint8_t fn_mf;
+	int i = 0;
+
+	/* Just to be sure */
+	OSMO_ASSERT(chan == TRXC_TCHH_0 || chan == TRXC_TCHH_1);
+
+	/* Calculate a modulo */
+	fn_mf = facch ? (fn % 26) : (fn % 13);
+
+#define MAP_GET_POS(map) \
+	(start ? 0 : ARRAY_SIZE(map[i]) - 1)
+
+#define BLOCK_MAP_FN(map) \
+	do { \
+		if (map[i][MAP_GET_POS(map)] == fn_mf) \
+			return true; \
+	} while (++i < ARRAY_SIZE(map))
+
+	/* Choose a proper block map */
+	if (facch) {
+		if (ul) {
+			if (chan == TRXC_TCHH_0)
+				BLOCK_MAP_FN(tch_h0_ul_facch_block_map);
+			else
+				BLOCK_MAP_FN(tch_h1_ul_facch_block_map);
+		} else {
+			if (chan == TRXC_TCHH_0)
+				BLOCK_MAP_FN(tch_h0_dl_facch_block_map);
+			else
+				BLOCK_MAP_FN(tch_h1_dl_facch_block_map);
+		}
+	} else {
+		if (chan == TRXC_TCHH_0)
+			BLOCK_MAP_FN(tch_h0_traffic_block_map);
+		else
+			BLOCK_MAP_FN(tch_h1_traffic_block_map);
+	}
+
+	return false;
+}
+
+/**
+ * Calculates a frame number of the first burst
+ * using given frame number of the last burst.
+ *
+ * See GSM 05.02, clause 7, table 1
+ *
+ * @param  chan      channel type (TRXC_TCHH_0 or TRXC_TCHH_1)
+ * @param  last_fn   frame number of the last burst
+ * @param  facch     FACCH/H or traffic?
+ * @return           either frame number of the first burst,
+ *                   or fn=last_fn if calculation failed
+ */
+uint32_t sched_tchh_block_dl_first_fn(enum trx_lchan_type chan,
+	uint32_t last_fn, bool facch)
+{
+	uint8_t fn_mf, fn_diff;
+	int i = 0;
+
+	/* Just to be sure */
+	OSMO_ASSERT(chan == TRXC_TCHH_0 || chan == TRXC_TCHH_1);
+
+	/* Calculate a modulo */
+	fn_mf = facch ? (last_fn % 26) : (last_fn % 13);
+
+#define BLOCK_FIRST_FN(map) \
+	do { \
+		if (map[i][ARRAY_SIZE(map[i]) - 1] == fn_mf) { \
+			fn_diff = TDMA_FN_DIFF(fn_mf, map[i][0]); \
+			return TDMA_FN_SUB(last_fn, fn_diff); \
+		} \
+	} while (++i < ARRAY_SIZE(map))
+
+	/* Choose a proper block map */
+	if (facch) {
+		if (chan == TRXC_TCHH_0)
+			BLOCK_FIRST_FN(tch_h0_dl_facch_block_map);
+		else
+			BLOCK_FIRST_FN(tch_h1_dl_facch_block_map);
+	} else {
+		if (chan == TRXC_TCHH_0)
+			BLOCK_FIRST_FN(tch_h0_traffic_block_map);
+		else
+			BLOCK_FIRST_FN(tch_h1_traffic_block_map);
+	}
+
+	LOGP(DSCHD, LOGL_ERROR, "Failed to calculate TDMA "
+		"frame number of the first burst of %s block, "
+		"using the current fn=%u\n", facch ?
+			"FACCH/H" : "TCH/H", last_fn);
+
+	/* Couldn't calculate the first fn, return the last */
+	return last_fn;
+}
+
+int rx_tchh_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid,
+	sbit_t *bits, int8_t rssi, int16_t toa256)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	int n_errors = -1, n_bits_total, rc;
+	sbit_t *buffer, *offset;
+	uint8_t l2[128], *mask;
+	size_t l2_len;
+
+	/* Set up pointers */
+	lchan_desc = &trx_lchan_desc[lchan->type];
+	mask = &lchan->rx_burst_mask;
+	buffer = lchan->rx_bursts;
+
+	LOGP(DSCHD, LOGL_DEBUG, "Traffic received on %s: fn=%u ts=%u bid=%u\n",
+		lchan_desc->name, fn, ts->index, bid);
+
+	if (*mask == 0x00) {
+		/* Align to the first burst */
+		if (bid > 0)
+			return 0;
+
+		/* Align reception of the first FACCH/H frame */
+		if (lchan->tch_mode == GSM48_CMODE_SIGN) {
+			if (!sched_tchh_facch_start(lchan->type, fn, 0))
+				return 0;
+		} else { /* or TCH/H traffic frame */
+			if (!sched_tchh_traffic_start(lchan->type, fn, 0))
+				return 0;
+		}
+	}
+
+	/* Update mask */
+	*mask |= (1 << bid);
+
+	/**
+	 * FIXME: properly update measurements
+	 *
+	 * Since TCH/H channel is using block-diagonal interleaving,
+	 * a single burst may carry 57 bits of one encoded frame,
+	 * and 57 bits of another. This should be taken into account.
+	 */
+	lchan->meas.rssi_sum += rssi;
+	lchan->meas.toa256_sum += toa256;
+	lchan->meas.rssi_num++;
+	lchan->meas.toa256_num++;
+
+	/* Copy burst to the end of buffer of 6 bursts */
+	offset = buffer + bid * 116 + 464;
+	memcpy(offset, bits + 3, 58);
+	memcpy(offset + 58, bits + 87, 58);
+
+	/* Wait until the second burst */
+	if (bid != 1)
+		return 0;
+
+	/* Wait for complete set of bursts */
+	if (lchan->tch_mode == GSM48_CMODE_SIGN) {
+		/* FACCH/H is interleaved over 6 bursts */
+		if ((*mask & 0x3f) != 0x3f)
+			goto bfi_shift;
+	} else {
+		/* Traffic is interleaved over 4 bursts */
+		if ((*mask & 0x0f) != 0x0f)
+			goto bfi_shift;
+	}
+
+	/* Skip decoding attempt in case of FACCH/H */
+	if (lchan->dl_ongoing_facch) {
+		lchan->dl_ongoing_facch = false;
+		goto bfi_shift; /* 2/2 BFI */
+	}
+
+	switch (lchan->tch_mode) {
+	case GSM48_CMODE_SIGN:
+	case GSM48_CMODE_SPEECH_V1: /* HR */
+		rc = gsm0503_tch_hr_decode(l2, buffer,
+			!sched_tchh_facch_end(lchan->type, fn, 0),
+			&n_errors, &n_bits_total);
+		break;
+	case GSM48_CMODE_SPEECH_AMR: /* AMR */
+		/**
+		 * TODO: AMR requires a dedicated loop,
+		 * which will be implemented later...
+		 */
+		LOGP(DSCHD, LOGL_ERROR, "AMR isn't supported yet\n");
+		return -ENOTSUP;
+	default:
+		LOGP(DSCHD, LOGL_ERROR, "Invalid TCH mode: %u\n", lchan->tch_mode);
+		return -EINVAL;
+	}
+
+	/* Shift buffer by 4 bursts for interleaving */
+	memcpy(buffer, buffer + 232, 232);
+	memcpy(buffer + 232, buffer + 464, 232);
+
+	/* Shift burst mask */
+	*mask = *mask << 2;
+
+	/* Check decoding result */
+	if (rc < 4) {
+		LOGP(DSCHD, LOGL_ERROR, "Received bad TCH frame ending at "
+			"fn=%u on %s (rc=%d)\n", fn, lchan_desc->name, rc);
+
+		/* Send BFI */
+		goto bfi;
+	} else if (rc == GSM_MACBLOCK_LEN) {
+		/* Skip decoding of the next 2 stolen bursts */
+		lchan->dl_ongoing_facch = true;
+
+		/* Calculate TDMA frame number of the first burst */
+		lchan->rx_first_fn = sched_tchh_block_dl_first_fn(lchan->type,
+			fn, true); /* FACCH/H */
+
+		/* FACCH/H received, forward to the higher layers */
+		sched_send_dt_ind(trx, ts, lchan, l2, GSM_MACBLOCK_LEN,
+			n_errors, false, false);
+
+		/* 1/2 BFI */
+		goto bfi;
+	} else {
+		/* A good TCH frame received */
+		l2_len = rc;
+	}
+
+	/* Calculate TDMA frame number of the first burst */
+	lchan->rx_first_fn = sched_tchh_block_dl_first_fn(lchan->type,
+		fn, false); /* TCH/H */
+
+	/* Send a traffic frame to the higher layers */
+	return sched_send_dt_ind(trx, ts, lchan, l2, l2_len,
+		n_errors, false, true);
+
+bfi_shift:
+	/* Shift buffer */
+	memcpy(buffer, buffer + 232, 232);
+	memcpy(buffer + 232, buffer + 464, 232);
+
+	/* Shift burst mask */
+	*mask = *mask << 2;
+
+bfi:
+	/* Didn't try to decode */
+	if (n_errors < 0)
+		n_errors = 116 * 2;
+
+	/* Calculate TDMA frame number of the first burst */
+	lchan->rx_first_fn = sched_tchh_block_dl_first_fn(lchan->type,
+		fn, false); /* TCH/H */
+
+	/* BFI is not applicable in signalling mode */
+	if (lchan->tch_mode == GSM48_CMODE_SIGN)
+		return sched_send_dt_ind(trx, ts, lchan, NULL, 0,
+			n_errors, true, false);
+
+	/* Bad frame indication */
+	l2_len = sched_bad_frame_ind(l2, lchan);
+
+	/* Send a BFI frame to the higher layers */
+	return sched_send_dt_ind(trx, ts, lchan, l2, l2_len,
+		n_errors, true, true);
+}
+
+int tx_tchh_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	ubit_t burst[GSM_BURST_LEN];
+	ubit_t *buffer, *offset;
+	const uint8_t *tsc;
+	uint8_t *mask;
+	size_t l2_len;
+	int rc;
+
+	/* Set up pointers */
+	lchan_desc = &trx_lchan_desc[lchan->type];
+	mask = &lchan->tx_burst_mask;
+	buffer = lchan->tx_bursts;
+
+	if (bid > 0) {
+		/* Align to the first burst */
+		if (*mask == 0x00)
+			return 0;
+		goto send_burst;
+	}
+
+	if (*mask == 0x00) {
+		/* Align transmission of the first FACCH/H frame */
+		if (lchan->tch_mode == GSM48_CMODE_SIGN)
+			if (!sched_tchh_facch_start(lchan->type, fn, 1))
+				return 0;
+	}
+
+	/* Shift buffer by 2 bursts back for interleaving */
+	memcpy(buffer, buffer + 232, 232);
+
+	/* Also shift TX burst mask */
+	*mask = *mask << 2;
+
+	/* If FACCH/H blocks are still pending */
+	if (lchan->ul_facch_blocks > 2) {
+		memcpy(buffer + 232, buffer + 464, 232);
+		goto send_burst;
+	}
+
+	/* Check the current TCH mode */
+	switch (lchan->tch_mode) {
+	case GSM48_CMODE_SIGN:
+	case GSM48_CMODE_SPEECH_V1: /* HR */
+		l2_len = GSM_HR_BYTES + 1;
+		break;
+	case GSM48_CMODE_SPEECH_AMR: /* AMR */
+		/**
+		 * TODO: AMR requires a dedicated loop,
+		 * which will be implemented later...
+		 */
+		LOGP(DSCHD, LOGL_ERROR, "AMR isn't supported yet, "
+			"dropping frame...\n");
+
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+		return -ENOTSUP;
+	default:
+		LOGP(DSCHD, LOGL_ERROR, "Invalid TCH mode: %u, "
+			"dropping frame...\n", lchan->tch_mode);
+
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+		return -EINVAL;
+	}
+
+	/* Determine payload length */
+	if (PRIM_IS_FACCH(lchan->prim)) {
+		l2_len = GSM_MACBLOCK_LEN; /* FACCH */
+	} else if (lchan->prim->payload_len != l2_len) {
+		LOGP(DSCHD, LOGL_ERROR, "Primitive has odd length %zu "
+			"(expected %zu for TCH or %u for FACCH), so dropping...\n",
+			lchan->prim->payload_len, l2_len, GSM_MACBLOCK_LEN);
+
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+		return -EINVAL;
+	}
+
+	/* Encode the payload */
+	rc = gsm0503_tch_hr_encode(buffer, lchan->prim->payload, l2_len);
+	if (rc) {
+		LOGP(DSCHD, LOGL_ERROR, "Failed to encode L2 payload\n");
+
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+		return -EINVAL;
+	}
+
+	/* A FACCH/H frame occupies 6 bursts */
+	if (PRIM_IS_FACCH(lchan->prim))
+		lchan->ul_facch_blocks = 6;
+
+send_burst:
+	/* Determine which burst should be sent */
+	offset = buffer + bid * 116;
+
+	/* Update mask */
+	*mask |= (1 << bid);
+
+	/* Choose proper TSC */
+	tsc = sched_nb_training_bits[trx->tsc];
+
+	/* Compose a new burst */
+	memset(burst, 0, 3); /* TB */
+	memcpy(burst + 3, offset, 58); /* Payload 1/2 */
+	memcpy(burst + 61, tsc, 26); /* TSC */
+	memcpy(burst + 87, offset + 58, 58); /* Payload 2/2 */
+	memset(burst + 145, 0, 3); /* TB */
+
+	LOGP(DSCHD, LOGL_DEBUG, "Transmitting %s fn=%u ts=%u burst=%u\n",
+		lchan_desc->name, fn, ts->index, bid);
+
+	/* Forward burst to transceiver */
+	sched_trx_handle_tx_burst(trx, ts, lchan, fn, burst);
+
+	/* In case of a FACCH/H frame, one block less */
+	if (lchan->ul_facch_blocks)
+		lchan->ul_facch_blocks--;
+
+	if ((*mask & 0x0f) == 0x0f) {
+		/**
+		 * If no more FACCH/H blocks pending,
+		 * confirm data / traffic sending
+		 */
+		if (!lchan->ul_facch_blocks)
+			sched_send_dt_conf(trx, ts, lchan, fn,
+				PRIM_IS_TCH(lchan->prim));
+
+		/* Forget processed primitive */
+		sched_prim_drop(lchan);
+	}
+
+	return 0;
+}
diff --git a/src/host/trxcon/sched_lchan_xcch.c b/src/host/trxcon/sched_lchan_xcch.c
new file mode 100644
index 00000000..b31f727a
--- /dev/null
+++ b/src/host/trxcon/sched_lchan_xcch.c
@@ -0,0 +1,209 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: handlers for DL / UL bursts on logical channels
+ *
+ * (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <stdint.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/bits.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/coding/gsm0503_coding.h>
+
+#include "l1ctl_proto.h"
+#include "scheduler.h"
+#include "sched_trx.h"
+#include "logging.h"
+#include "trx_if.h"
+#include "trxcon.h"
+#include "l1ctl.h"
+
+int rx_data_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid,
+	sbit_t *bits, int8_t rssi, int16_t toa256)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	uint8_t l2[GSM_MACBLOCK_LEN], *mask;
+	int n_errors, n_bits_total, rc;
+	sbit_t *buffer, *offset;
+	uint32_t *first_fn;
+
+	/* Set up pointers */
+	lchan_desc = &trx_lchan_desc[lchan->type];
+	first_fn = &lchan->rx_first_fn;
+	mask = &lchan->rx_burst_mask;
+	buffer = lchan->rx_bursts;
+
+	LOGP(DSCHD, LOGL_DEBUG, "Data received on %s: fn=%u ts=%u bid=%u\n",
+		lchan_desc->name, fn, ts->index, bid);
+
+	/* Reset internal state */
+	if (bid == 0) {
+		/* Clean up old measurements */
+		memset(&lchan->meas, 0x00, sizeof(lchan->meas));
+
+		*first_fn = fn;
+		*mask = 0x0;
+	}
+
+	/* Update mask */
+	*mask |= (1 << bid);
+
+	/* Update measurements */
+	lchan->meas.rssi_sum += rssi;
+	lchan->meas.toa256_sum += toa256;
+	lchan->meas.rssi_num++;
+	lchan->meas.toa256_num++;
+
+	/* Copy burst to buffer of 4 bursts */
+	offset = buffer + bid * 116;
+	memcpy(offset, bits + 3, 58);
+	memcpy(offset + 58, bits + 87, 58);
+
+	/* Wait until complete set of bursts */
+	if (bid != 3)
+		return 0;
+
+	/* Check for complete set of bursts */
+	if ((*mask & 0xf) != 0xf) {
+		LOGP(DSCHD, LOGL_ERROR, "Received incomplete data frame at "
+			"fn=%u (%u/%u) for %s\n", *first_fn,
+			(*first_fn) % ts->mf_layout->period,
+			ts->mf_layout->period,
+			lchan_desc->name);
+	}
+
+	/* Attempt to decode */
+	rc = gsm0503_xcch_decode(l2, buffer, &n_errors, &n_bits_total);
+	if (rc) {
+		LOGP(DSCHD, LOGL_ERROR, "Received bad data frame at fn=%u "
+			"(%u/%u) for %s\n", *first_fn,
+			(*first_fn) % ts->mf_layout->period,
+			ts->mf_layout->period,
+			lchan_desc->name);
+
+		/**
+		 * We should anyway send dummy frame for
+		 * proper measurement reporting...
+		 */
+		return sched_send_dt_ind(trx, ts, lchan, NULL, 0,
+			n_errors, true, false);
+	}
+
+	/* Send a L2 frame to the higher layers */
+	return sched_send_dt_ind(trx, ts, lchan, l2, GSM_MACBLOCK_LEN,
+		n_errors, false, false);
+}
+
+int tx_data_fn(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, uint8_t bid)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	ubit_t burst[GSM_BURST_LEN];
+	ubit_t *buffer, *offset;
+	const uint8_t *tsc;
+	uint8_t *mask;
+	int rc;
+
+	/* Set up pointers */
+	lchan_desc = &trx_lchan_desc[lchan->type];
+	mask = &lchan->tx_burst_mask;
+	buffer = lchan->tx_bursts;
+
+	if (bid > 0) {
+		/* If we have encoded bursts */
+		if (*mask)
+			goto send_burst;
+		else
+			return 0;
+	}
+
+	/* Check the prim payload length */
+	if (lchan->prim->payload_len != GSM_MACBLOCK_LEN) {
+		LOGP(DSCHD, LOGL_ERROR, "Primitive has odd length %zu (expected %u), "
+			"so dropping...\n", lchan->prim->payload_len, GSM_MACBLOCK_LEN);
+
+		sched_prim_drop(lchan);
+		return -EINVAL;
+	}
+
+	/* Encode payload */
+	rc = gsm0503_xcch_encode(buffer, lchan->prim->payload);
+	if (rc) {
+		LOGP(DSCHD, LOGL_ERROR, "Failed to encode L2 payload\n");
+
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+
+		return -EINVAL;
+	}
+
+send_burst:
+	/* Determine which burst should be sent */
+	offset = buffer + bid * 116;
+
+	/* Update mask */
+	*mask |= (1 << bid);
+
+	/* Choose proper TSC */
+	tsc = sched_nb_training_bits[trx->tsc];
+
+	/* Compose a new burst */
+	memset(burst, 0, 3); /* TB */
+	memcpy(burst + 3, offset, 58); /* Payload 1/2 */
+	memcpy(burst + 61, tsc, 26); /* TSC */
+	memcpy(burst + 87, offset + 58, 58); /* Payload 2/2 */
+	memset(burst + 145, 0, 3); /* TB */
+
+	LOGP(DSCHD, LOGL_DEBUG, "Transmitting %s fn=%u ts=%u burst=%u\n",
+		lchan_desc->name, fn, ts->index, bid);
+
+	/* Forward burst to scheduler */
+	rc = sched_trx_handle_tx_burst(trx, ts, lchan, fn, burst);
+	if (rc) {
+		/* Forget this primitive */
+		sched_prim_drop(lchan);
+
+		/* Reset mask */
+		*mask = 0x00;
+
+		return rc;
+	}
+
+	/* If we have sent the last (4/4) burst */
+	if ((*mask & 0x0f) == 0x0f) {
+		/* Forget processed primitive */
+		sched_prim_drop(lchan);
+
+		/* Reset mask */
+		*mask = 0x00;
+
+		/* Confirm data sending */
+		sched_send_dt_conf(trx, ts, lchan, fn, false);
+	}
+
+	return 0;
+}
diff --git a/src/host/trxcon/sched_mframe.c b/src/host/trxcon/sched_mframe.c
new file mode 100644
index 00000000..0dcf3e7e
--- /dev/null
+++ b/src/host/trxcon/sched_mframe.c
@@ -0,0 +1,2038 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: channel combinations, burst mapping
+ *
+ * (C) 2013 by Andreas Eversberg <jolly@eversberg.eu>
+ * (C) 2015 by Alexander Chemeris <Alexander.Chemeris@fairwaves.co>
+ * (C) 2015 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/gsm/gsm_utils.h>
+
+#include "sched_trx.h"
+
+/* Non-combined CCCH */
+static const struct trx_frame frame_bcch[51] = {
+	/* dl_chan	dl_bid	ul_chan		ul_bid */
+	{ TRXC_FCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_BCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_BCCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_BCCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_BCCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_IDLE,	0,	TRXC_RACH,	0 },
+};
+
+/* Combined CCCH+SDCCH4 */
+static const struct trx_frame frame_bcch_sdcch4[102] = {
+	/* dl_chan		dl_bid	ul_chan		ul_bid */
+	{ TRXC_FCCH,		0,	TRXC_SDCCH4_3,	0 },
+	{ TRXC_SCH,		0,	TRXC_SDCCH4_3,	1 },
+	{ TRXC_BCCH,		0,	TRXC_SDCCH4_3,	2 },
+	{ TRXC_BCCH,		1,	TRXC_SDCCH4_3,	3 },
+	{ TRXC_BCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_BCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		0,	TRXC_SACCH4_2,	0 },
+	{ TRXC_CCCH,		1,	TRXC_SACCH4_2,	1 },
+	{ TRXC_CCCH,		2,	TRXC_SACCH4_2,	2 },
+	{ TRXC_CCCH,		3,	TRXC_SACCH4_2,	3 },
+	{ TRXC_FCCH,		0,	TRXC_SACCH4_3,	0 },
+	{ TRXC_SCH,		0,	TRXC_SACCH4_3,	1 },
+	{ TRXC_CCCH,		0,	TRXC_SACCH4_3,	2 },
+	{ TRXC_CCCH,		1,	TRXC_SACCH4_3,	3 },
+	{ TRXC_CCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	3,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_2,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_2,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_2,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_2,	3,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_3,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_3,	1,	TRXC_SDCCH4_0,	0 },
+	{ TRXC_SDCCH4_3,	2,	TRXC_SDCCH4_0,	1 },
+	{ TRXC_SDCCH4_3,	3,	TRXC_SDCCH4_0,	2 },
+	{ TRXC_FCCH,		0,	TRXC_SDCCH4_0,	3 },
+	{ TRXC_SCH,		0,	TRXC_SDCCH4_1,	0 },
+	{ TRXC_SACCH4_0,	0,	TRXC_SDCCH4_1,	1 },
+	{ TRXC_SACCH4_0,	1,	TRXC_SDCCH4_1,	2 },
+	{ TRXC_SACCH4_0,	2,	TRXC_SDCCH4_1,	3 },
+	{ TRXC_SACCH4_0,	3,	TRXC_RACH,	0 },
+	{ TRXC_SACCH4_1,	0,	TRXC_RACH,	0 },
+	{ TRXC_SACCH4_1,	1,	TRXC_SDCCH4_2,	0 },
+	{ TRXC_SACCH4_1,	2,	TRXC_SDCCH4_2,	1 },
+	{ TRXC_SACCH4_1,	3,	TRXC_SDCCH4_2,	2 },
+	{ TRXC_IDLE,		0,	TRXC_SDCCH4_2,	3 },
+
+	{ TRXC_FCCH,		0,	TRXC_SDCCH4_3,	0 },
+	{ TRXC_SCH,		0,	TRXC_SDCCH4_3,	1 },
+	{ TRXC_BCCH,		0,	TRXC_SDCCH4_3,	2 },
+	{ TRXC_BCCH,		1,	TRXC_SDCCH4_3,	3 },
+	{ TRXC_BCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_BCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		0,	TRXC_SACCH4_0,	0 },
+	{ TRXC_CCCH,		1,	TRXC_SACCH4_0,	1 },
+	{ TRXC_CCCH,		2,	TRXC_SACCH4_0,	2 },
+	{ TRXC_CCCH,		3,	TRXC_SACCH4_0,	3 },
+	{ TRXC_FCCH,		0,	TRXC_SACCH4_1,	0 },
+	{ TRXC_SCH,		0,	TRXC_SACCH4_1,	1 },
+	{ TRXC_CCCH,		0,	TRXC_SACCH4_1,	2 },
+	{ TRXC_CCCH,		1,	TRXC_SACCH4_1,	3 },
+	{ TRXC_CCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	3,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_2,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_2,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_2,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_2,	3,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_3,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_3,	1,	TRXC_SDCCH4_0,	0 },
+	{ TRXC_SDCCH4_3,	2,	TRXC_SDCCH4_0,	1 },
+	{ TRXC_SDCCH4_3,	3,	TRXC_SDCCH4_0,	2 },
+	{ TRXC_FCCH,		0,	TRXC_SDCCH4_0,	3 },
+	{ TRXC_SCH,		0,	TRXC_SDCCH4_1,	0 },
+	{ TRXC_SACCH4_2,	0,	TRXC_SDCCH4_1,	1 },
+	{ TRXC_SACCH4_2,	1,	TRXC_SDCCH4_1,	2 },
+	{ TRXC_SACCH4_2,	2,	TRXC_SDCCH4_1,	3 },
+	{ TRXC_SACCH4_2,	3,	TRXC_RACH,	0 },
+	{ TRXC_SACCH4_3,	0,	TRXC_RACH,	0 },
+	{ TRXC_SACCH4_3,	1,	TRXC_SDCCH4_2,	0 },
+	{ TRXC_SACCH4_3,	2,	TRXC_SDCCH4_2,	1 },
+	{ TRXC_SACCH4_3,	3,	TRXC_SDCCH4_2,	2 },
+	{ TRXC_IDLE,		0,	TRXC_SDCCH4_2,	3 },
+};
+
+static const struct trx_frame frame_bcch_sdcch4_cbch[102] = {
+	/* dl_chan		dl_bid	ul_chan		ul_bid */
+	{ TRXC_FCCH,		0,	TRXC_SDCCH4_3,	0 },
+	{ TRXC_SCH,		0,	TRXC_SDCCH4_3,	1 },
+	{ TRXC_BCCH,		0,	TRXC_SDCCH4_3,	2 },
+	{ TRXC_BCCH,		1,	TRXC_SDCCH4_3,	3 },
+	{ TRXC_BCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_BCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		0,	TRXC_IDLE,	0 },
+	{ TRXC_CCCH,		1,	TRXC_IDLE,	1 },
+	{ TRXC_CCCH,		2,	TRXC_IDLE,	2 },
+	{ TRXC_CCCH,		3,	TRXC_IDLE,	3 },
+	{ TRXC_FCCH,		0,	TRXC_SACCH4_3,	0 },
+	{ TRXC_SCH,		0,	TRXC_SACCH4_3,	1 },
+	{ TRXC_CCCH,		0,	TRXC_SACCH4_3,	2 },
+	{ TRXC_CCCH,		1,	TRXC_SACCH4_3,	3 },
+	{ TRXC_CCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	3,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_CBCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_CBCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_CBCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_CBCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_3,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_3,	1,	TRXC_SDCCH4_0,	0 },
+	{ TRXC_SDCCH4_3,	2,	TRXC_SDCCH4_0,	1 },
+	{ TRXC_SDCCH4_3,	3,	TRXC_SDCCH4_0,	2 },
+	{ TRXC_FCCH,		0,	TRXC_SDCCH4_0,	3 },
+	{ TRXC_SCH,		0,	TRXC_SDCCH4_1,	0 },
+	{ TRXC_SACCH4_0,	0,	TRXC_SDCCH4_1,	1 },
+	{ TRXC_SACCH4_0,	1,	TRXC_SDCCH4_1,	2 },
+	{ TRXC_SACCH4_0,	2,	TRXC_SDCCH4_1,	3 },
+	{ TRXC_SACCH4_0,	3,	TRXC_RACH,	0 },
+	{ TRXC_SACCH4_1,	0,	TRXC_RACH,	0 },
+	{ TRXC_SACCH4_1,	1,	TRXC_IDLE,	0 },
+	{ TRXC_SACCH4_1,	2,	TRXC_IDLE,	1 },
+	{ TRXC_SACCH4_1,	3,	TRXC_IDLE,	2 },
+	{ TRXC_IDLE,		0,	TRXC_IDLE,	3 },
+
+	{ TRXC_FCCH,		0,	TRXC_SDCCH4_3,	0 },
+	{ TRXC_SCH,		0,	TRXC_SDCCH4_3,	1 },
+	{ TRXC_BCCH,		0,	TRXC_SDCCH4_3,	2 },
+	{ TRXC_BCCH,		1,	TRXC_SDCCH4_3,	3 },
+	{ TRXC_BCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_BCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		0,	TRXC_SACCH4_0,	0 },
+	{ TRXC_CCCH,		1,	TRXC_SACCH4_0,	1 },
+	{ TRXC_CCCH,		2,	TRXC_SACCH4_0,	2 },
+	{ TRXC_CCCH,		3,	TRXC_SACCH4_0,	3 },
+	{ TRXC_FCCH,		0,	TRXC_SACCH4_1,	0 },
+	{ TRXC_SCH,		0,	TRXC_SACCH4_1,	1 },
+	{ TRXC_CCCH,		0,	TRXC_SACCH4_1,	2 },
+	{ TRXC_CCCH,		1,	TRXC_SACCH4_1,	3 },
+	{ TRXC_CCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		1,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		2,	TRXC_RACH,	0 },
+	{ TRXC_CCCH,		3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_0,	3,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_1,	3,	TRXC_RACH,	0 },
+	{ TRXC_FCCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SCH,		0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_CBCH,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_CBCH,	1,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_CBCH,	2,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_CBCH,	3,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_3,	0,	TRXC_RACH,	0 },
+	{ TRXC_SDCCH4_3,	1,	TRXC_SDCCH4_0,	0 },
+	{ TRXC_SDCCH4_3,	2,	TRXC_SDCCH4_0,	1 },
+	{ TRXC_SDCCH4_3,	3,	TRXC_SDCCH4_0,	2 },
+	{ TRXC_FCCH,		0,	TRXC_SDCCH4_0,	3 },
+	{ TRXC_SCH,		0,	TRXC_SDCCH4_1,	0 },
+	{ TRXC_IDLE,		0,	TRXC_SDCCH4_1,	1 },
+	{ TRXC_IDLE,		1,	TRXC_SDCCH4_1,	2 },
+	{ TRXC_IDLE,		2,	TRXC_SDCCH4_1,	3 },
+	{ TRXC_IDLE,		3,	TRXC_RACH,	0 },
+	{ TRXC_SACCH4_3,	0,	TRXC_RACH,	0 },
+	{ TRXC_SACCH4_3,	1,	TRXC_SDCCH4_2,	0 },
+	{ TRXC_SACCH4_3,	2,	TRXC_SDCCH4_2,	1 },
+	{ TRXC_SACCH4_3,	3,	TRXC_SDCCH4_2,	2 },
+	{ TRXC_IDLE,		0,	TRXC_SDCCH4_2,	3 },
+};
+
+static const struct trx_frame frame_sdcch8[102] = {
+	/* dl_chan		dl_bid	ul_chan		ul_bid */
+	{ TRXC_SDCCH8_0,	0,	TRXC_SACCH8_5,	0 },
+	{ TRXC_SDCCH8_0,	1,	TRXC_SACCH8_5,	1 },
+	{ TRXC_SDCCH8_0,	2,	TRXC_SACCH8_5,	2 },
+	{ TRXC_SDCCH8_0,	3,	TRXC_SACCH8_5,	3 },
+	{ TRXC_SDCCH8_1,	0,	TRXC_SACCH8_6,	0 },
+	{ TRXC_SDCCH8_1,	1,	TRXC_SACCH8_6,	1 },
+	{ TRXC_SDCCH8_1,	2,	TRXC_SACCH8_6,	2 },
+	{ TRXC_SDCCH8_1,	3,	TRXC_SACCH8_6,	3 },
+	{ TRXC_SDCCH8_2,	0,	TRXC_SACCH8_7,	0 },
+	{ TRXC_SDCCH8_2,	1,	TRXC_SACCH8_7,	1 },
+	{ TRXC_SDCCH8_2,	2,	TRXC_SACCH8_7,	2 },
+	{ TRXC_SDCCH8_2,	3,	TRXC_SACCH8_7,	3 },
+	{ TRXC_SDCCH8_3,	0,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	1,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	2,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	3,	TRXC_SDCCH8_0,	0 },
+	{ TRXC_SDCCH8_4,	0,	TRXC_SDCCH8_0,	1 },
+	{ TRXC_SDCCH8_4,	1,	TRXC_SDCCH8_0,	2 },
+	{ TRXC_SDCCH8_4,	2,	TRXC_SDCCH8_0,	3 },
+	{ TRXC_SDCCH8_4,	3,	TRXC_SDCCH8_1,	0 },
+	{ TRXC_SDCCH8_5,	0,	TRXC_SDCCH8_1,	1 },
+	{ TRXC_SDCCH8_5,	1,	TRXC_SDCCH8_1,	2 },
+	{ TRXC_SDCCH8_5,	2,	TRXC_SDCCH8_1,	3 },
+	{ TRXC_SDCCH8_5,	3,	TRXC_SDCCH8_2,	0 },
+	{ TRXC_SDCCH8_6,	0,	TRXC_SDCCH8_2,	1 },
+	{ TRXC_SDCCH8_6,	1,	TRXC_SDCCH8_2,	2 },
+	{ TRXC_SDCCH8_6,	2,	TRXC_SDCCH8_2,	3 },
+	{ TRXC_SDCCH8_6,	3,	TRXC_SDCCH8_3,	0 },
+	{ TRXC_SDCCH8_7,	0,	TRXC_SDCCH8_3,	1 },
+	{ TRXC_SDCCH8_7,	1,	TRXC_SDCCH8_3,	2 },
+	{ TRXC_SDCCH8_7,	2,	TRXC_SDCCH8_3,	3 },
+	{ TRXC_SDCCH8_7,	3,	TRXC_SDCCH8_4,	0 },
+	{ TRXC_SACCH8_0,	0,	TRXC_SDCCH8_4,	1 },
+	{ TRXC_SACCH8_0,	1,	TRXC_SDCCH8_4,	2 },
+	{ TRXC_SACCH8_0,	2,	TRXC_SDCCH8_4,	3 },
+	{ TRXC_SACCH8_0,	3,	TRXC_SDCCH8_5,	0 },
+	{ TRXC_SACCH8_1,	0,	TRXC_SDCCH8_5,	1 },
+	{ TRXC_SACCH8_1,	1,	TRXC_SDCCH8_5,	2 },
+	{ TRXC_SACCH8_1,	2,	TRXC_SDCCH8_5,	3 },
+	{ TRXC_SACCH8_1,	3,	TRXC_SDCCH8_6,	0 },
+	{ TRXC_SACCH8_2,	0,	TRXC_SDCCH8_6,	1 },
+	{ TRXC_SACCH8_2,	1,	TRXC_SDCCH8_6,	2 },
+	{ TRXC_SACCH8_2,	2,	TRXC_SDCCH8_6,	3 },
+	{ TRXC_SACCH8_2,	3,	TRXC_SDCCH8_7,	0 },
+	{ TRXC_SACCH8_3,	0,	TRXC_SDCCH8_7,	1 },
+	{ TRXC_SACCH8_3,	1,	TRXC_SDCCH8_7,	2 },
+	{ TRXC_SACCH8_3,	2,	TRXC_SDCCH8_7,	3 },
+	{ TRXC_SACCH8_3,	3,	TRXC_SACCH8_0,	0 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_0,	1 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_0,	2 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_0,	3 },
+
+	{ TRXC_SDCCH8_0,	0,	TRXC_SACCH8_1,	0 },
+	{ TRXC_SDCCH8_0,	1,	TRXC_SACCH8_1,	1 },
+	{ TRXC_SDCCH8_0,	2,	TRXC_SACCH8_1,	2 },
+	{ TRXC_SDCCH8_0,	3,	TRXC_SACCH8_1,	3 },
+	{ TRXC_SDCCH8_1,	0,	TRXC_SACCH8_2,	0 },
+	{ TRXC_SDCCH8_1,	1,	TRXC_SACCH8_2,	1 },
+	{ TRXC_SDCCH8_1,	2,	TRXC_SACCH8_2,	2 },
+	{ TRXC_SDCCH8_1,	3,	TRXC_SACCH8_2,	3 },
+	{ TRXC_SDCCH8_2,	0,	TRXC_SACCH8_3,	0 },
+	{ TRXC_SDCCH8_2,	1,	TRXC_SACCH8_3,	1 },
+	{ TRXC_SDCCH8_2,	2,	TRXC_SACCH8_3,	2 },
+	{ TRXC_SDCCH8_2,	3,	TRXC_SACCH8_3,	3 },
+	{ TRXC_SDCCH8_3,	0,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	1,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	2,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	3,	TRXC_SDCCH8_0,	0 },
+	{ TRXC_SDCCH8_4,	0,	TRXC_SDCCH8_0,	1 },
+	{ TRXC_SDCCH8_4,	1,	TRXC_SDCCH8_0,	2 },
+	{ TRXC_SDCCH8_4,	2,	TRXC_SDCCH8_0,	3 },
+	{ TRXC_SDCCH8_4,	3,	TRXC_SDCCH8_1,	0 },
+	{ TRXC_SDCCH8_5,	0,	TRXC_SDCCH8_1,	1 },
+	{ TRXC_SDCCH8_5,	1,	TRXC_SDCCH8_1,	2 },
+	{ TRXC_SDCCH8_5,	2,	TRXC_SDCCH8_1,	3 },
+	{ TRXC_SDCCH8_5,	3,	TRXC_SDCCH8_2,	0 },
+	{ TRXC_SDCCH8_6,	0,	TRXC_SDCCH8_2,	1 },
+	{ TRXC_SDCCH8_6,	1,	TRXC_SDCCH8_2,	2 },
+	{ TRXC_SDCCH8_6,	2,	TRXC_SDCCH8_2,	3 },
+	{ TRXC_SDCCH8_6,	3,	TRXC_SDCCH8_3,	0 },
+	{ TRXC_SDCCH8_7,	0,	TRXC_SDCCH8_3,	1 },
+	{ TRXC_SDCCH8_7,	1,	TRXC_SDCCH8_3,	2 },
+	{ TRXC_SDCCH8_7,	2,	TRXC_SDCCH8_3,	3 },
+	{ TRXC_SDCCH8_7,	3,	TRXC_SDCCH8_4,	0 },
+	{ TRXC_SACCH8_4,	0,	TRXC_SDCCH8_4,	1 },
+	{ TRXC_SACCH8_4,	1,	TRXC_SDCCH8_4,	2 },
+	{ TRXC_SACCH8_4,	2,	TRXC_SDCCH8_4,	3 },
+	{ TRXC_SACCH8_4,	3,	TRXC_SDCCH8_5,	0 },
+	{ TRXC_SACCH8_5,	0,	TRXC_SDCCH8_5,	1 },
+	{ TRXC_SACCH8_5,	1,	TRXC_SDCCH8_5,	2 },
+	{ TRXC_SACCH8_5,	2,	TRXC_SDCCH8_5,	3 },
+	{ TRXC_SACCH8_5,	3,	TRXC_SDCCH8_6,	0 },
+	{ TRXC_SACCH8_6,	0,	TRXC_SDCCH8_6,	1 },
+	{ TRXC_SACCH8_6,	1,	TRXC_SDCCH8_6,	2 },
+	{ TRXC_SACCH8_6,	2,	TRXC_SDCCH8_6,	3 },
+	{ TRXC_SACCH8_6,	3,	TRXC_SDCCH8_7,	0 },
+	{ TRXC_SACCH8_7,	0,	TRXC_SDCCH8_7,	1 },
+	{ TRXC_SACCH8_7,	1,	TRXC_SDCCH8_7,	2 },
+	{ TRXC_SACCH8_7,	2,	TRXC_SDCCH8_7,	3 },
+	{ TRXC_SACCH8_7,	3,	TRXC_SACCH8_4,	0 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_4,	1 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_4,	2 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_4,	3 },
+};
+
+static const struct trx_frame frame_sdcch8_cbch[102] = {
+	/* dl_chan		dl_bid	ul_chan		ul_bid */
+	{ TRXC_SDCCH8_0,	0,	TRXC_SACCH8_5,	0 },
+	{ TRXC_SDCCH8_0,	1,	TRXC_SACCH8_5,	1 },
+	{ TRXC_SDCCH8_0,	2,	TRXC_SACCH8_5,	2 },
+	{ TRXC_SDCCH8_0,	3,	TRXC_SACCH8_5,	3 },
+	{ TRXC_SDCCH8_1,	0,	TRXC_SACCH8_6,	0 },
+	{ TRXC_SDCCH8_1,	1,	TRXC_SACCH8_6,	1 },
+	{ TRXC_SDCCH8_1,	2,	TRXC_SACCH8_6,	2 },
+	{ TRXC_SDCCH8_1,	3,	TRXC_SACCH8_6,	3 },
+	{ TRXC_SDCCH8_CBCH,	0,	TRXC_SACCH8_7,	0 },
+	{ TRXC_SDCCH8_CBCH,	1,	TRXC_SACCH8_7,	1 },
+	{ TRXC_SDCCH8_CBCH,	2,	TRXC_SACCH8_7,	2 },
+	{ TRXC_SDCCH8_CBCH,	3,	TRXC_SACCH8_7,	3 },
+	{ TRXC_SDCCH8_3,	0,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	1,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	2,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	3,	TRXC_SDCCH8_0,	0 },
+	{ TRXC_SDCCH8_4,	0,	TRXC_SDCCH8_0,	1 },
+	{ TRXC_SDCCH8_4,	1,	TRXC_SDCCH8_0,	2 },
+	{ TRXC_SDCCH8_4,	2,	TRXC_SDCCH8_0,	3 },
+	{ TRXC_SDCCH8_4,	3,	TRXC_SDCCH8_1,	0 },
+	{ TRXC_SDCCH8_5,	0,	TRXC_SDCCH8_1,	1 },
+	{ TRXC_SDCCH8_5,	1,	TRXC_SDCCH8_1,	2 },
+	{ TRXC_SDCCH8_5,	2,	TRXC_SDCCH8_1,	3 },
+	{ TRXC_SDCCH8_5,	3,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_6,	0,	TRXC_IDLE,	1 },
+	{ TRXC_SDCCH8_6,	1,	TRXC_IDLE,	2 },
+	{ TRXC_SDCCH8_6,	2,	TRXC_IDLE,	3 },
+	{ TRXC_SDCCH8_6,	3,	TRXC_SDCCH8_3,	0 },
+	{ TRXC_SDCCH8_7,	0,	TRXC_SDCCH8_3,	1 },
+	{ TRXC_SDCCH8_7,	1,	TRXC_SDCCH8_3,	2 },
+	{ TRXC_SDCCH8_7,	2,	TRXC_SDCCH8_3,	3 },
+	{ TRXC_SDCCH8_7,	3,	TRXC_SDCCH8_4,	0 },
+	{ TRXC_SACCH8_0,	0,	TRXC_SDCCH8_4,	1 },
+	{ TRXC_SACCH8_0,	1,	TRXC_SDCCH8_4,	2 },
+	{ TRXC_SACCH8_0,	2,	TRXC_SDCCH8_4,	3 },
+	{ TRXC_SACCH8_0,	3,	TRXC_SDCCH8_5,	0 },
+	{ TRXC_SACCH8_1,	0,	TRXC_SDCCH8_5,	1 },
+	{ TRXC_SACCH8_1,	1,	TRXC_SDCCH8_5,	2 },
+	{ TRXC_SACCH8_1,	2,	TRXC_SDCCH8_5,	3 },
+	{ TRXC_SACCH8_1,	3,	TRXC_SDCCH8_6,	0 },
+	{ TRXC_IDLE,		0,	TRXC_SDCCH8_6,	1 },
+	{ TRXC_IDLE,		1,	TRXC_SDCCH8_6,	2 },
+	{ TRXC_IDLE,		2,	TRXC_SDCCH8_6,	3 },
+	{ TRXC_IDLE,		3,	TRXC_SDCCH8_7,	0 },
+	{ TRXC_SACCH8_3,	0,	TRXC_SDCCH8_7,	1 },
+	{ TRXC_SACCH8_3,	1,	TRXC_SDCCH8_7,	2 },
+	{ TRXC_SACCH8_3,	2,	TRXC_SDCCH8_7,	3 },
+	{ TRXC_SACCH8_3,	3,	TRXC_SACCH8_0,	0 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_0,	1 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_0,	2 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_0,	3 },
+
+	{ TRXC_SDCCH8_0,	0,	TRXC_SACCH8_1,	0 },
+	{ TRXC_SDCCH8_0,	1,	TRXC_SACCH8_1,	1 },
+	{ TRXC_SDCCH8_0,	2,	TRXC_SACCH8_1,	2 },
+	{ TRXC_SDCCH8_0,	3,	TRXC_SACCH8_1,	3 },
+	{ TRXC_SDCCH8_1,	0,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_1,	1,	TRXC_IDLE,	1 },
+	{ TRXC_SDCCH8_1,	2,	TRXC_IDLE,	2 },
+	{ TRXC_SDCCH8_1,	3,	TRXC_IDLE,	3 },
+	{ TRXC_SDCCH8_CBCH,	0,	TRXC_SACCH8_3,	0 },
+	{ TRXC_SDCCH8_CBCH,	1,	TRXC_SACCH8_3,	1 },
+	{ TRXC_SDCCH8_CBCH,	2,	TRXC_SACCH8_3,	2 },
+	{ TRXC_SDCCH8_CBCH,	3,	TRXC_SACCH8_3,	3 },
+	{ TRXC_SDCCH8_3,	0,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	1,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	2,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_3,	3,	TRXC_SDCCH8_0,	0 },
+	{ TRXC_SDCCH8_4,	0,	TRXC_SDCCH8_0,	1 },
+	{ TRXC_SDCCH8_4,	1,	TRXC_SDCCH8_0,	2 },
+	{ TRXC_SDCCH8_4,	2,	TRXC_SDCCH8_0,	3 },
+	{ TRXC_SDCCH8_4,	3,	TRXC_SDCCH8_1,	0 },
+	{ TRXC_SDCCH8_5,	0,	TRXC_SDCCH8_1,	1 },
+	{ TRXC_SDCCH8_5,	1,	TRXC_SDCCH8_1,	2 },
+	{ TRXC_SDCCH8_5,	2,	TRXC_SDCCH8_1,	3 },
+	{ TRXC_SDCCH8_5,	3,	TRXC_IDLE,	0 },
+	{ TRXC_SDCCH8_6,	0,	TRXC_IDLE,	1 },
+	{ TRXC_SDCCH8_6,	1,	TRXC_IDLE,	2 },
+	{ TRXC_SDCCH8_6,	2,	TRXC_IDLE,	3 },
+	{ TRXC_SDCCH8_6,	3,	TRXC_SDCCH8_3,	0 },
+	{ TRXC_SDCCH8_7,	0,	TRXC_SDCCH8_3,	1 },
+	{ TRXC_SDCCH8_7,	1,	TRXC_SDCCH8_3,	2 },
+	{ TRXC_SDCCH8_7,	2,	TRXC_SDCCH8_3,	3 },
+	{ TRXC_SDCCH8_7,	3,	TRXC_SDCCH8_4,	0 },
+	{ TRXC_SACCH8_4,	0,	TRXC_SDCCH8_4,	1 },
+	{ TRXC_SACCH8_4,	1,	TRXC_SDCCH8_4,	2 },
+	{ TRXC_SACCH8_4,	2,	TRXC_SDCCH8_4,	3 },
+	{ TRXC_SACCH8_4,	3,	TRXC_SDCCH8_5,	0 },
+	{ TRXC_SACCH8_5,	0,	TRXC_SDCCH8_5,	1 },
+	{ TRXC_SACCH8_5,	1,	TRXC_SDCCH8_5,	2 },
+	{ TRXC_SACCH8_5,	2,	TRXC_SDCCH8_5,	3 },
+	{ TRXC_SACCH8_5,	3,	TRXC_SDCCH8_6,	0 },
+	{ TRXC_SACCH8_6,	0,	TRXC_SDCCH8_6,	1 },
+	{ TRXC_SACCH8_6,	1,	TRXC_SDCCH8_6,	2 },
+	{ TRXC_SACCH8_6,	2,	TRXC_SDCCH8_6,	3 },
+	{ TRXC_SACCH8_6,	3,	TRXC_SDCCH8_7,	0 },
+	{ TRXC_SACCH8_7,	0,	TRXC_SDCCH8_7,	1 },
+	{ TRXC_SACCH8_7,	1,	TRXC_SDCCH8_7,	2 },
+	{ TRXC_SACCH8_7,	2,	TRXC_SDCCH8_7,	3 },
+	{ TRXC_SACCH8_7,	3,	TRXC_SACCH8_4,	0 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_4,	1 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_4,	2 },
+	{ TRXC_IDLE,		0,	TRXC_SACCH8_4,	3 },
+};
+
+static const struct trx_frame frame_tchf_ts0[104] = {
+	/* dl_chan	dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	0,	TRXC_SACCHTF,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	1,	TRXC_SACCHTF,	1 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	2,	TRXC_SACCHTF,	2 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	3,	TRXC_SACCHTF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+};
+
+static const struct trx_frame frame_tchf_ts1[104] = {
+	/* dl_chan	dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	0,	TRXC_SACCHTF,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	1,	TRXC_SACCHTF,	1 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	2,	TRXC_SACCHTF,	2 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	3,	TRXC_SACCHTF,	3 },
+};
+
+static const struct trx_frame frame_tchf_ts2[104] = {
+	/* dl_chan	dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	3,	TRXC_SACCHTF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	0,	TRXC_SACCHTF,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	1,	TRXC_SACCHTF,	1 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	2,	TRXC_SACCHTF,	2 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+};
+
+static const struct trx_frame frame_tchf_ts3[104] = {
+	/* dl_chan	dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	3,	TRXC_SACCHTF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	0,	TRXC_SACCHTF,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	1,	TRXC_SACCHTF,	1 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	2,	TRXC_SACCHTF,	2 },
+};
+
+static const struct trx_frame frame_tchf_ts4[104] = {
+	/* dl_chan	dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	2,	TRXC_SACCHTF,	2 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	3,	TRXC_SACCHTF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	0,	TRXC_SACCHTF,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	1,	TRXC_SACCHTF,	1 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+};
+
+static const struct trx_frame frame_tchf_ts5[104] = {
+	/* dl_chan	dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	2,	TRXC_SACCHTF,	2 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	3,	TRXC_SACCHTF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	0,	TRXC_SACCHTF,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	1,	TRXC_SACCHTF,	1 },
+};
+
+static const struct trx_frame frame_tchf_ts6[104] = {
+	/* dl_chan	dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	1,	TRXC_SACCHTF,	1 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	2,	TRXC_SACCHTF,	2 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	3,	TRXC_SACCHTF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	0,	TRXC_SACCHTF,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+};
+
+static const struct trx_frame frame_tchf_ts7[104] = {
+	/* dl_chan	dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	1,	TRXC_SACCHTF,	1 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	2,	TRXC_SACCHTF,	2 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	3,	TRXC_SACCHTF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_TCHF,	0,	TRXC_TCHF,	0 },
+	{ TRXC_TCHF,	1,	TRXC_TCHF,	1 },
+	{ TRXC_TCHF,	2,	TRXC_TCHF,	2 },
+	{ TRXC_TCHF,	3,	TRXC_TCHF,	3 },
+	{ TRXC_SACCHTF,	0,	TRXC_SACCHTF,	0 },
+};
+
+static const struct trx_frame frame_tchh_ts01[104] = {
+	/* dl_chan		dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	0,	TRXC_SACCHTH_0,	0 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	0,	TRXC_SACCHTH_1,	0 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	1,	TRXC_SACCHTH_0,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	1,	TRXC_SACCHTH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	2,	TRXC_SACCHTH_0,	2 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	2,	TRXC_SACCHTH_1,	2 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	3,	TRXC_SACCHTH_0,	3 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	3,	TRXC_SACCHTH_1,	3 },
+};
+
+static const struct trx_frame frame_tchh_ts23[104] = {
+	/* dl_chan		dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	3,	TRXC_SACCHTH_0,	3 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	3,	TRXC_SACCHTH_1,	3 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	0,	TRXC_SACCHTH_0,	0 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	0,	TRXC_SACCHTH_1,	0 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	1,	TRXC_SACCHTH_0,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	1,	TRXC_SACCHTH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	2,	TRXC_SACCHTH_0,	2 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	2,	TRXC_SACCHTH_1,	2 },
+};
+
+static const struct trx_frame frame_tchh_ts45[104] = {
+	/* dl_chan		dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	2,	TRXC_SACCHTH_0,	2 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	2,	TRXC_SACCHTH_1,	2 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	3,	TRXC_SACCHTH_0,	3 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	3,	TRXC_SACCHTH_1,	3 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	0,	TRXC_SACCHTH_0,	0 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	0,	TRXC_SACCHTH_1,	0 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	1,	TRXC_SACCHTH_0,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	1,	TRXC_SACCHTH_1,	1 },
+};
+
+static const struct trx_frame frame_tchh_ts67[104] = {
+	/* dl_chan		dl_bid	ul_chan		ul_bid */
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	1,	TRXC_SACCHTH_0,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	1,	TRXC_SACCHTH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	2,	TRXC_SACCHTH_0,	2 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	2,	TRXC_SACCHTH_1,	2 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	3,	TRXC_SACCHTH_0,	3 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	3,	TRXC_SACCHTH_1,	3 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_0,	0,	TRXC_SACCHTH_0,	0 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_TCHH_0,		0,	TRXC_TCHH_0,	0 },
+	{ TRXC_TCHH_1,		0,	TRXC_TCHH_1,	0 },
+	{ TRXC_TCHH_0,		1,	TRXC_TCHH_0,	1 },
+	{ TRXC_TCHH_1,		1,	TRXC_TCHH_1,	1 },
+	{ TRXC_SACCHTH_1,	0,	TRXC_SACCHTH_1,	0 },
+};
+
+static const struct trx_frame frame_pdch[104] = {
+	/* dl_chan	dl_bid	ul_chan		ul_bid */
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PTCCH,	0,	TRXC_PTCCH,	0 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PTCCH,	1,	TRXC_PTCCH,	1 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PTCCH,	2,	TRXC_PTCCH,	2 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PTCCH,	3,	TRXC_PTCCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_PDTCH,	0,	TRXC_PDTCH,	0 },
+	{ TRXC_PDTCH,	1,	TRXC_PDTCH,	1 },
+	{ TRXC_PDTCH,	2,	TRXC_PDTCH,	2 },
+	{ TRXC_PDTCH,	3,	TRXC_PDTCH,	3 },
+	{ TRXC_IDLE,	0,	TRXC_IDLE,	0 },
+};
+
+/**
+ * A few notes about frame count:
+ *
+ * 26 frame multiframe - traffic multiframe
+ * 51 frame multiframe - control multiframe
+ *
+ * 102 = 2 x 51 frame multiframe
+ * 104 = 4 x 26 frame multiframe
+ */
+static const struct trx_multiframe layouts[] = {
+	{
+		GSM_PCHAN_NONE, "NONE",
+		0,	0xff,	(uint64_t) 0x00,
+		NULL
+	},
+	{
+		GSM_PCHAN_CCCH, "BCCH+CCCH",
+		51,	0xff,	(uint64_t) 0x3e,
+		frame_bcch
+	},
+	{
+		GSM_PCHAN_CCCH_SDCCH4, "BCCH+CCCH+SDCCH/4+SACCH/4",
+		102,	0xff,	(uint64_t) 0xf001e3e,
+		frame_bcch_sdcch4
+	},
+	{
+		GSM_PCHAN_CCCH_SDCCH4_CBCH, "BCCH+CCCH+SDCCH/4+SACCH/4+CBCH",
+		102,	0xff,	(uint64_t) 0x400f001e3e,
+		frame_bcch_sdcch4_cbch
+	},
+	{
+		GSM_PCHAN_SDCCH8_SACCH8C, "SDCCH/8+SACCH/8",
+		102,	0xff,	(uint64_t) 0xff01fe000,
+		frame_sdcch8
+	},
+	{
+		GSM_PCHAN_SDCCH8_SACCH8C_CBCH, "SDCCH/8+SACCH/8+CBCH",
+		102,	0xff,	(uint64_t) 0x8ff01fe000,
+		frame_sdcch8_cbch
+	},
+	{
+		GSM_PCHAN_TCH_F, "TCH/F+SACCH",
+		104,	0x01,	(uint64_t) 0x200040,
+		frame_tchf_ts0
+	},
+	{
+		GSM_PCHAN_TCH_F, "TCH/F+SACCH",
+		104,	0x02,	(uint64_t) 0x200040,
+		frame_tchf_ts1
+	},
+	{
+		GSM_PCHAN_TCH_F, "TCH/F+SACCH",
+		104,	0x04,	(uint64_t) 0x200040,
+		frame_tchf_ts2
+	},
+	{
+		GSM_PCHAN_TCH_F, "TCH/F+SACCH",
+		104,	0x08,	(uint64_t) 0x200040,
+		frame_tchf_ts3
+	},
+	{
+		GSM_PCHAN_TCH_F, "TCH/F+SACCH",
+		104,	0x10,	(uint64_t) 0x200040,
+		frame_tchf_ts4
+	},
+	{
+		GSM_PCHAN_TCH_F, "TCH/F+SACCH",
+		104,	0x20,	(uint64_t) 0x200040,
+		frame_tchf_ts5
+	},
+	{
+		GSM_PCHAN_TCH_F, "TCH/F+SACCH",
+		104,	0x40,	(uint64_t) 0x200040,
+		frame_tchf_ts6
+	},
+	{
+		GSM_PCHAN_TCH_F, "TCH/F+SACCH",
+		104,	0x80,	(uint64_t) 0x200040,
+		frame_tchf_ts7
+	},
+	{
+		GSM_PCHAN_TCH_H, "TCH/H+SACCH",
+		104,	0x03,	(uint64_t) 0xc00180,
+		frame_tchh_ts01
+	},
+	{
+		GSM_PCHAN_TCH_H, "TCH/H+SACCH",
+		104,	0x0c,	(uint64_t) 0xc00180,
+		frame_tchh_ts23
+	},
+	{
+		GSM_PCHAN_TCH_H, "TCH/H+SACCH",
+		104,	0x30,	(uint64_t) 0xc00180,
+		frame_tchh_ts45
+	},
+	{
+		GSM_PCHAN_TCH_H, "TCH/H+SACCH",
+		104,	0xc0,	(uint64_t) 0xc00180,
+		frame_tchh_ts67
+	},
+	{
+		GSM_PCHAN_PDCH, "PDCH",
+		104,	0xff,	(uint64_t) 0x3000000000,
+		frame_pdch
+	},
+};
+
+const struct trx_multiframe *sched_mframe_layout(
+	enum gsm_phys_chan_config config, int tn)
+{
+	int i, ts_allowed;
+
+	for (i = 0; i < ARRAY_SIZE(layouts); i++) {
+		ts_allowed = layouts[i].slotmask & (0x01 << tn);
+		if (layouts[i].chan_config == config && ts_allowed)
+			return &layouts[i];
+	}
+
+	return NULL;
+}
diff --git a/src/host/trxcon/sched_prim.c b/src/host/trxcon/sched_prim.c
new file mode 100644
index 00000000..275a0509
--- /dev/null
+++ b/src/host/trxcon/sched_prim.c
@@ -0,0 +1,611 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: primitive management
+ *
+ * (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <talloc.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/linuxlist.h>
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+#include "scheduler.h"
+#include "sched_trx.h"
+#include "trx_if.h"
+#include "logging.h"
+
+/**
+ * Initializes a new primitive by allocating memory
+ * and filling some meta-information (e.g. lchan type).
+ *
+ * @param  ctx     parent talloc context
+ * @param  prim    external prim pointer (will point to the allocated prim)
+ * @param  pl_len  prim payload length
+ * @param  chan_nr RSL channel description (used to set a proper chan)
+ * @param  link_id RSL link description (used to set a proper chan)
+ * @return         zero in case of success, otherwise a error number
+ */
+int sched_prim_init(void *ctx, struct trx_ts_prim **prim,
+	size_t pl_len, uint8_t chan_nr, uint8_t link_id)
+{
+	enum trx_lchan_type lchan_type;
+	struct trx_ts_prim *new_prim;
+	uint8_t len;
+
+	/* Determine lchan type */
+	lchan_type = sched_trx_chan_nr2lchan_type(chan_nr, link_id);
+	if (!lchan_type) {
+		LOGP(DSCH, LOGL_ERROR, "Couldn't determine lchan type "
+			"for chan_nr=%02x and link_id=%02x\n", chan_nr, link_id);
+		return -EINVAL;
+	}
+
+	/* How much memory do we need? */
+	len  = sizeof(struct trx_ts_prim); /* Primitive header */
+	len += pl_len; /* Requested payload size */
+
+	/* Allocate a new primitive */
+	new_prim = talloc_zero_size(ctx, len);
+	if (new_prim == NULL) {
+		LOGP(DSCH, LOGL_ERROR, "Failed to allocate memory\n");
+		return -ENOMEM;
+	}
+
+	/* Init primitive header */
+	new_prim->payload_len = pl_len;
+	new_prim->chan = lchan_type;
+
+	/* Set external pointer */
+	*prim = new_prim;
+
+	return 0;
+}
+
+/**
+ * Adds a primitive to the end of transmit queue of a particular
+ * timeslot, whose index is parsed from chan_nr.
+ *
+ * @param  trx     TRX instance
+ * @param  prim    to be enqueued primitive
+ * @param  chan_nr RSL channel description
+ * @return         zero in case of success, otherwise a error number
+ */
+int sched_prim_push(struct trx_instance *trx,
+	struct trx_ts_prim *prim, uint8_t chan_nr)
+{
+	struct trx_ts *ts;
+	uint8_t tn;
+
+	/* Determine TS index */
+	tn = chan_nr & 0x7;
+
+	/* Check whether required timeslot is allocated and configured */
+	ts = trx->ts_list[tn];
+	if (ts == NULL || ts->mf_layout == NULL) {
+		LOGP(DSCH, LOGL_ERROR, "Timeslot %u isn't configured\n", tn);
+		return -EINVAL;
+	}
+
+	/**
+	 * Change talloc context of primitive
+	 * from trx to the parent ts
+	 */
+	talloc_steal(ts, prim);
+
+	/* Add primitive to TS transmit queue */
+	llist_add_tail(&prim->list, &ts->tx_prims);
+
+	return 0;
+}
+
+/**
+ * Composes a new primitive using either cached (if populated),
+ * or "dummy" Measurement Report message.
+ *
+ * @param  lchan lchan to assign a primitive
+ * @return       SACCH primitive to be transmitted
+ */
+static struct trx_ts_prim *prim_compose_mr(struct trx_lchan_state *lchan)
+{
+	struct trx_ts_prim *prim;
+	uint8_t *mr_src_ptr;
+	bool cached;
+	int rc;
+
+	/* "Dummy" Measurement Report */
+	static const uint8_t meas_rep_dummy[] = {
+		/* L1 SACCH pseudo-header */
+		0x0f, 0x00,
+
+		/* LAPDm header */
+		0x01, 0x03, 0x49,
+
+		/* Measurement report */
+		0x06, 0x15, 0x36, 0x36, 0x01, 0xC0,
+
+		/* TODO: Padding? Randomize if so */
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	};
+
+	/* Allocate a new primitive */
+	rc = sched_prim_init(lchan, &prim, GSM_MACBLOCK_LEN,
+		trx_lchan_desc[lchan->type].chan_nr, TRX_CH_LID_SACCH);
+	OSMO_ASSERT(rc == 0);
+
+	/* Check if the MR cache is populated (verify LAPDm header) */
+	cached = (lchan->sacch.mr_cache[2] != 0x00
+		&& lchan->sacch.mr_cache[3] != 0x00
+		&& lchan->sacch.mr_cache[4] != 0x00);
+	if (cached) { /* Use the cached one */
+		mr_src_ptr = lchan->sacch.mr_cache;
+		lchan->sacch.mr_cache_usage++;
+	} else { /* Use "dummy" one */
+		mr_src_ptr = (uint8_t *) meas_rep_dummy;
+	}
+
+	/* Compose a new Measurement Report primitive */
+	memcpy(prim->payload, mr_src_ptr, GSM_MACBLOCK_LEN);
+
+#if 0
+	/**
+	 * Update the L1 SACCH pseudo-header (only for cached MRs)
+	 *
+	 * FIXME: this would require having access to the trx_instance,
+	 * what can be achieved either by chain-passing the pointer
+	 * through sched_prim_dequeue(), or by adding some
+	 * back-pointers to the logical channel state.
+	 *
+	 * TODO: filling of the actual values into cached Measurement
+	 * Reports would break the distance spoofing feature. If it
+	 * were known whether the spoofing is enabled or not, we could
+	 * decide whether to update the cached L1 SACCH header here.
+	 */
+	if (!cached) {
+		prim->payload[0] = trx->tx_power;
+		prim->payload[1] = trx->ta;
+	}
+#endif
+
+	/* Inform about the cache usage count */
+	if (cached && lchan->sacch.mr_cache_usage > 5) {
+		LOGP(DSCHD, LOGL_NOTICE, "SACCH MR cache usage count=%u > 5 "
+			"on lchan=%s => ancient measurements, please fix!\n",
+			lchan->sacch.mr_cache_usage,
+			trx_lchan_desc[lchan->type].name);
+	}
+
+	LOGP(DSCHD, LOGL_NOTICE, "Using a %s Measurement Report "
+		"on lchan=%s\n", (cached ? "cached" : "dummy"),
+		trx_lchan_desc[lchan->type].name);
+
+	return prim;
+}
+
+/**
+ * Dequeues a SACCH primitive from transmit queue, if present.
+ * Otherwise dequeues a cached Measurement Report (the last
+ * received one). Finally, if the cache is empty, a "dummy"
+ * measurement report is used.
+ *
+ * According to 3GPP TS 04.08, section 3.4.1, SACCH channel
+ * accompanies either a traffic or a signaling channel. It
+ * has the particularity that continuous transmission must
+ * occur in both directions, so on the Uplink direction
+ * measurement result messages are sent at each possible
+ * occasion when nothing else has to be sent. The LAPDm
+ * fill frames (0x01, 0x03, 0x01, 0x2b, ...) are not
+ * applicable on SACCH channels!
+ *
+ * Unfortunately, 3GPP TS 04.08 doesn't clearly state
+ * which "else messages" besides Measurement Reports
+ * can be send by the MS on SACCH channels. However,
+ * in sub-clause 3.4.1 it's stated that the interval
+ * between two successive measurement result messages
+ * shall not exceed one L2 frame.
+ *
+ * @param  queue transmit queue to take a prim from
+ * @param  lchan lchan to assign a primitive
+ * @return       SACCH primitive to be transmitted
+ */
+static struct trx_ts_prim *prim_dequeue_sacch(struct llist_head *queue,
+	struct trx_lchan_state *lchan)
+{
+	struct trx_ts_prim *prim_nmr = NULL;
+	struct trx_ts_prim *prim_mr = NULL;
+	struct trx_ts_prim *prim;
+	bool mr_now;
+
+	/* Shall we transmit MR now? */
+	mr_now = !lchan->sacch.mr_tx_last;
+
+#define PRIM_IS_MR(prim) \
+	(prim->payload[5] == GSM48_PDISC_RR \
+		&& prim->payload[6] == GSM48_MT_RR_MEAS_REP)
+
+	/* Iterate over all primitives in the queue */
+	llist_for_each_entry(prim, queue, list) {
+		/* We are looking for particular channel */
+		if (prim->chan != lchan->type)
+			continue;
+
+		/* Just to be sure... */
+		if (prim->payload_len != GSM_MACBLOCK_LEN)
+			continue;
+
+		/* Look for a Measurement Report */
+		if (!prim_mr && PRIM_IS_MR(prim))
+			prim_mr = prim;
+
+		/* Look for anything else */
+		if (!prim_nmr && !PRIM_IS_MR(prim))
+			prim_nmr = prim;
+
+		/* Should we look further? */
+		if (mr_now && prim_mr)
+			break; /* MR was found */
+		else if (!mr_now && prim_nmr)
+			break; /* something else was found */
+	}
+
+	LOGP(DSCHD, LOGL_DEBUG, "SACCH MR selection on lchan=%s: "
+		"mr_tx_last=%d prim_mr=%p prim_nmr=%p\n",
+		trx_lchan_desc[lchan->type].name,
+		lchan->sacch.mr_tx_last,
+		prim_mr, prim_nmr);
+
+	/* Prioritize non-MR prim if possible */
+	if (mr_now && prim_mr)
+		prim = prim_mr;
+	else if (!mr_now && prim_nmr)
+		prim = prim_nmr;
+	else if (!mr_now && prim_mr)
+		prim = prim_mr;
+	else /* Nothing was found */
+		prim = NULL;
+
+	/* Have we found what we were looking for? */
+	if (prim) /* Dequeue if so */
+		llist_del(&prim->list);
+	else /* Otherwise compose a new MR */
+		prim = prim_compose_mr(lchan);
+
+	/* Update the cached report */
+	if (prim == prim_mr) {
+		memcpy(lchan->sacch.mr_cache,
+			prim->payload, GSM_MACBLOCK_LEN);
+		lchan->sacch.mr_cache_usage = 0;
+
+		LOGP(DSCHD, LOGL_DEBUG, "SACCH MR cache has been updated "
+			"for lchan=%s\n", trx_lchan_desc[lchan->type].name);
+	}
+
+	/* Update the MR transmission state */
+	lchan->sacch.mr_tx_last = PRIM_IS_MR(prim);
+
+	return prim;
+}
+
+/* Dequeues a primitive of a given channel type */
+static struct trx_ts_prim *prim_dequeue_one(struct llist_head *queue,
+	enum trx_lchan_type lchan_type)
+{
+	struct trx_ts_prim *prim;
+
+	/**
+	 * There is no need to use the 'safe' list iteration here
+	 * as an item removal is immediately followed by return.
+	 */
+	llist_for_each_entry(prim, queue, list) {
+		if (prim->chan == lchan_type) {
+			llist_del(&prim->list);
+			return prim;
+		}
+	}
+
+	return NULL;
+}
+
+/**
+ * Dequeues either a FACCH, or a speech TCH primitive
+ * of a given channel type (Lm or Bm).
+ *
+ * Note: we could avoid 'lchan_type' parameter and just
+ * check the prim's channel type using CHAN_IS_TCH(),
+ * but the current approach is a bit more flexible,
+ * and allows one to have both sub-slots of TCH/H
+ * enabled on same timeslot e.g. for testing...
+ *
+ * @param  queue      transmit queue to take a prim from
+ * @param  lchan_type required channel type of a primitive,
+ *                    e.g. TRXC_TCHF, TRXC_TCHH_0, or TRXC_TCHH_1
+ * @param  facch      FACCH (true) or speech (false) prim?
+ * @return            either a FACCH, or a TCH primitive if found,
+ *                    otherwise NULL
+ */
+static struct trx_ts_prim *prim_dequeue_tch(struct llist_head *queue,
+	enum trx_lchan_type lchan_type, bool facch)
+{
+	struct trx_ts_prim *prim;
+
+	/**
+	 * There is no need to use the 'safe' list iteration here
+	 * as an item removal is immediately followed by return.
+	 */
+	llist_for_each_entry(prim, queue, list) {
+		if (prim->chan != lchan_type)
+			continue;
+
+		/* Either FACCH, or not FACCH */
+		if (PRIM_IS_FACCH(prim) != facch)
+			continue;
+
+		llist_del(&prim->list);
+		return prim;
+	}
+
+	return NULL;
+}
+
+/**
+ * Dequeues either a TCH/F, or a FACCH/F prim (preferred).
+ * If a FACCH/F prim is found, one TCH/F prim is being
+ * dropped (i.e. replaced).
+ *
+ * @param  queue a transmit queue to take a prim from
+ * @return       either a FACCH/F, or a TCH/F primitive,
+ *               otherwise NULL
+ */
+static struct trx_ts_prim *prim_dequeue_tch_f(struct llist_head *queue)
+{
+	struct trx_ts_prim *facch;
+	struct trx_ts_prim *tch;
+
+	/* Attempt to find a pair of both FACCH/F and TCH/F frames */
+	facch = prim_dequeue_tch(queue, TRXC_TCHF, true);
+	tch = prim_dequeue_tch(queue, TRXC_TCHF, false);
+
+	/* Prioritize FACCH/F, if found */
+	if (facch) {
+		/* One TCH/F prim is replaced */
+		if (tch)
+			talloc_free(tch);
+		return facch;
+	} else if (tch) {
+		/* Only TCH/F prim was found */
+		return tch;
+	} else {
+		/* Nothing was found, e.g. when only SACCH frames are in queue */
+		return NULL;
+	}
+}
+
+/**
+ * Dequeues either a TCH/H, or a FACCH/H prim (preferred).
+ * If a FACCH/H prim is found, two TCH/H prims are being
+ * dropped (i.e. replaced).
+ *
+ * According to GSM 05.02, the following blocks can be used
+ * to carry FACCH/H data (see clause 7, table 1 of 9):
+ *
+ * UL FACCH/H0:
+ * B0(0,2,4,6,8,10), B1(8,10,13,15,17,19), B2(17,19,21,23,0,2)
+ *
+ * UL FACCH/H1:
+ * B0(1,3,5,7,9,11), B1(9,11,14,16,18,20), B2(18,20,22,24,1,3)
+ *
+ * where the numbers within brackets are fn % 26.
+ *
+ * @param  queue      transmit queue to take a prim from
+ * @param  fn         the current frame number
+ * @param  lchan_type required channel type of a primitive,
+ * @return            either a FACCH/H, or a TCH/H primitive,
+ *                    otherwise NULL
+ */
+static struct trx_ts_prim *prim_dequeue_tch_h(struct llist_head *queue,
+	uint32_t fn, enum trx_lchan_type lchan_type)
+{
+	struct trx_ts_prim *facch;
+	struct trx_ts_prim *tch;
+	bool facch_now;
+
+	/* May we initiate an UL FACCH/H frame transmission now? */
+	facch_now = sched_tchh_facch_start(lchan_type, fn, true);
+	if (!facch_now) /* Just dequeue a TCH/H prim */
+		goto no_facch;
+
+	/* If there are no FACCH/H prims in the queue */
+	facch = prim_dequeue_tch(queue, lchan_type, true);
+	if (!facch) /* Just dequeue a TCH/H prim */
+		goto no_facch;
+
+	/* FACCH/H prim replaces two TCH/F prims */
+	tch = prim_dequeue_tch(queue, lchan_type, false);
+	if (tch) {
+		/* At least one TCH/H prim is dropped */
+		talloc_free(tch);
+
+		/* Attempt to find another */
+		tch = prim_dequeue_tch(queue, lchan_type, false);
+		if (tch) /* Drop the second TCH/H prim */
+			talloc_free(tch);
+	}
+
+	return facch;
+
+no_facch:
+	return prim_dequeue_tch(queue, lchan_type, false);
+}
+
+/**
+ * Dequeues a single primitive of required type
+ * from a specified transmit queue.
+ *
+ * @param  queue      a transmit queue to take a prim from
+ * @param  fn         the current frame number (used for FACCH/H)
+ * @param  lchan      logical channel state
+ * @return            a primitive or NULL if not found
+ */
+struct trx_ts_prim *sched_prim_dequeue(struct llist_head *queue,
+	uint32_t fn, struct trx_lchan_state *lchan)
+{
+	/* SACCH is unorthodox, see 3GPP TS 04.08, section 3.4.1 */
+	if (CHAN_IS_SACCH(lchan->type))
+		return prim_dequeue_sacch(queue, lchan);
+
+	/* There is nothing to dequeue */
+	if (llist_empty(queue))
+		return NULL;
+
+	switch (lchan->type) {
+	/* TCH/F requires FACCH/F prioritization */
+	case TRXC_TCHF:
+		return prim_dequeue_tch_f(queue);
+
+	/* FACCH/H prioritization is a bit more complex */
+	case TRXC_TCHH_0:
+	case TRXC_TCHH_1:
+		return prim_dequeue_tch_h(queue, fn, lchan->type);
+
+	/* Other kinds of logical channels */
+	default:
+		return prim_dequeue_one(queue, lchan->type);
+	}
+}
+
+/**
+ * Drops the current primitive of specified logical channel
+ *
+ * @param lchan a logical channel to drop prim from
+ */
+void sched_prim_drop(struct trx_lchan_state *lchan)
+{
+	/* Forget this primitive */
+	talloc_free(lchan->prim);
+	lchan->prim = NULL;
+}
+
+/**
+ * Assigns a dummy primitive to a lchan depending on its type.
+ * Could be used when there is nothing to transmit, but
+ * CBTX (Continuous Burst Transmission) is assumed.
+ *
+ * @param  lchan lchan to assign a primitive
+ * @return       zero in case of success, otherwise a error code
+ */
+int sched_prim_dummy(struct trx_lchan_state *lchan)
+{
+	enum trx_lchan_type chan = lchan->type;
+	uint8_t tch_mode = lchan->tch_mode;
+	struct trx_ts_prim *prim;
+	uint8_t prim_buffer[40];
+	size_t prim_len = 0;
+	int i;
+
+	/**
+	 * TS 144.006, section 8.4.2.3 "Fill frames"
+	 * A fill frame is a UI command frame for SAPI 0, P=0
+	 * and with an information field of 0 octet length.
+	 */
+	static const uint8_t lapdm_fill_frame[] = {
+		0x01, 0x03, 0x01, 0x2b,
+		/* Pending part is to be randomized */
+	};
+
+	/* Make sure that there is no existing primitive */
+	OSMO_ASSERT(lchan->prim == NULL);
+	/* Not applicable for SACCH! */
+	OSMO_ASSERT(!CHAN_IS_SACCH(lchan->type));
+
+	/**
+	 * Determine what actually should be generated:
+	 * TCH in GSM48_CMODE_SIGN: LAPDm fill frame;
+	 * TCH in other modes: silence frame;
+	 * other channels: LAPDm fill frame.
+	 */
+	if (CHAN_IS_TCH(chan) && TCH_MODE_IS_SPEECH(tch_mode)) {
+		/* Bad frame indication */
+		prim_len = sched_bad_frame_ind(prim_buffer, lchan);
+	} else if (CHAN_IS_TCH(chan) && TCH_MODE_IS_DATA(tch_mode)) {
+		/* FIXME: should we do anything for CSD? */
+		return 0;
+	} else {
+		/* Copy LAPDm fill frame's header */
+		memcpy(prim_buffer, lapdm_fill_frame, sizeof(lapdm_fill_frame));
+
+		/**
+		 * TS 144.006, section 5.2 "Frame delimitation and fill bits"
+		 * Except for the first octet containing fill bits which shall
+		 * be set to the binary value "00101011", each fill bit should
+		 * be set to a random value when sent by the network.
+		 */
+		for (i = sizeof(lapdm_fill_frame); i < GSM_MACBLOCK_LEN; i++)
+			prim_buffer[i] = (uint8_t) rand();
+
+		/* Define a prim length */
+		prim_len = GSM_MACBLOCK_LEN;
+	}
+
+	/* Nothing to allocate / assign */
+	if (!prim_len)
+		return 0;
+
+	/* Allocate a new primitive */
+	prim = talloc_zero_size(lchan, sizeof(struct trx_ts_prim) + prim_len);
+	if (prim == NULL)
+		return -ENOMEM;
+
+	/* Init primitive header */
+	prim->payload_len = prim_len;
+	prim->chan = lchan->type;
+
+	/* Fill in the payload */
+	memcpy(prim->payload, prim_buffer, prim_len);
+
+	/* Assign the current prim */
+	lchan->prim = prim;
+
+	LOGP(DSCHD, LOGL_DEBUG, "Transmitting a dummy / silence frame "
+		"on lchan=%s\n", trx_lchan_desc[chan].name);
+
+	return 0;
+}
+
+/**
+ * Flushes a queue of primitives
+ *
+ * @param list list of prims going to be flushed
+ */
+void sched_prim_flush_queue(struct llist_head *list)
+{
+	struct trx_ts_prim *prim, *prim_next;
+
+	llist_for_each_entry_safe(prim, prim_next, list, list) {
+		llist_del(&prim->list);
+		talloc_free(prim);
+	}
+}
diff --git a/src/host/trxcon/sched_trx.c b/src/host/trxcon/sched_trx.c
new file mode 100644
index 00000000..19d1fe82
--- /dev/null
+++ b/src/host/trxcon/sched_trx.c
@@ -0,0 +1,694 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * TDMA scheduler: GSM PHY routines
+ *
+ * (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <error.h>
+#include <errno.h>
+#include <string.h>
+#include <talloc.h>
+
+#include <osmocom/gsm/a5.h>
+#include <osmocom/core/bits.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/linuxlist.h>
+
+#include "scheduler.h"
+#include "sched_trx.h"
+#include "trx_if.h"
+#include "logging.h"
+
+static void sched_frame_clck_cb(struct trx_sched *sched)
+{
+	struct trx_instance *trx = (struct trx_instance *) sched->data;
+	const struct trx_frame *frame;
+	struct trx_lchan_state *lchan;
+	trx_lchan_tx_func *handler;
+	enum trx_lchan_type chan;
+	uint8_t offset, bid;
+	struct trx_ts *ts;
+	uint32_t fn;
+	int i;
+
+	/* Iterate over timeslot list */
+	for (i = 0; i < TRX_TS_COUNT; i++) {
+		/* Timeslot is not allocated */
+		ts = trx->ts_list[i];
+		if (ts == NULL)
+			continue;
+
+		/* Timeslot is not configured */
+		if (ts->mf_layout == NULL)
+			continue;
+
+		/**
+		 * Advance frame number, giving the transceiver more
+		 * time until a burst must be transmitted...
+		 */
+		fn = TDMA_FN_SUM(sched->fn_counter_proc,
+			sched->fn_counter_advance);
+
+		/* Get frame from multiframe */
+		offset = fn % ts->mf_layout->period;
+		frame = ts->mf_layout->frames + offset;
+
+		/* Get required info from frame */
+		bid = frame->ul_bid;
+		chan = frame->ul_chan;
+		handler = trx_lchan_desc[chan].tx_fn;
+
+		/* Omit lchans without handler */
+		if (!handler)
+			continue;
+
+		/* Make sure that lchan was allocated and activated */
+		lchan = sched_trx_find_lchan(ts, chan);
+		if (lchan == NULL)
+			continue;
+
+		/* Omit inactive lchans */
+		if (!lchan->active)
+			continue;
+
+		/**
+		 * If we aren't processing any primitive yet,
+		 * attempt to obtain a new one from queue
+		 */
+		if (lchan->prim == NULL)
+			lchan->prim = sched_prim_dequeue(&ts->tx_prims, fn, lchan);
+
+		/* TODO: report TX buffers health to the higher layers */
+
+		/* If CBTX (Continuous Burst Transmission) is assumed */
+		if (trx_lchan_desc[chan].flags & TRX_CH_FLAG_CBTX) {
+			/**
+			 * Probably, a TX buffer is empty. Nevertheless,
+			 * we shall continuously transmit anything on
+			 * CBTX channels.
+			 */
+			if (lchan->prim == NULL)
+				sched_prim_dummy(lchan);
+		}
+
+		/* If there is no primitive, do nothing */
+		if (lchan->prim == NULL)
+			continue;
+
+		/* Poke lchan handler */
+		handler(trx, ts, lchan, fn, bid);
+	}
+}
+
+int sched_trx_init(struct trx_instance *trx, uint32_t fn_advance)
+{
+	struct trx_sched *sched;
+
+	if (!trx)
+		return -EINVAL;
+
+	LOGP(DSCH, LOGL_NOTICE, "Init scheduler\n");
+
+	/* Obtain a scheduler instance from TRX */
+	sched = &trx->sched;
+
+	/* Register frame clock callback */
+	sched->clock_cb = sched_frame_clck_cb;
+
+	/* Set pointers */
+	sched = &trx->sched;
+	sched->data = trx;
+
+	/* Set frame counter advance */
+	sched->fn_counter_advance = fn_advance;
+
+	return 0;
+}
+
+int sched_trx_shutdown(struct trx_instance *trx)
+{
+	int i;
+
+	if (!trx)
+		return -EINVAL;
+
+	LOGP(DSCH, LOGL_NOTICE, "Shutdown scheduler\n");
+
+	/* Free all potentially allocated timeslots */
+	for (i = 0; i < TRX_TS_COUNT; i++)
+		sched_trx_del_ts(trx, i);
+
+	return 0;
+}
+
+int sched_trx_reset(struct trx_instance *trx, int reset_clock)
+{
+	int i;
+
+	if (!trx)
+		return -EINVAL;
+
+	LOGP(DSCH, LOGL_NOTICE, "Reset scheduler %s\n",
+		reset_clock ? "and clock counter" : "");
+
+	/* Free all potentially allocated timeslots */
+	for (i = 0; i < TRX_TS_COUNT; i++)
+		sched_trx_del_ts(trx, i);
+
+	/* Stop and reset clock counter if required */
+	if (reset_clock)
+		sched_clck_reset(&trx->sched);
+
+	return 0;
+}
+
+struct trx_ts *sched_trx_add_ts(struct trx_instance *trx, int tn)
+{
+	/* Make sure that ts isn't allocated yet */
+	if (trx->ts_list[tn] != NULL) {
+		LOGP(DSCH, LOGL_ERROR, "Timeslot #%u already allocated\n", tn);
+		return NULL;
+	}
+
+	LOGP(DSCH, LOGL_NOTICE, "Add a new TDMA timeslot #%u\n", tn);
+
+	/* Allocate a new one */
+	trx->ts_list[tn] = talloc_zero(trx, struct trx_ts);
+
+	/* Assign TS index */
+	trx->ts_list[tn]->index = tn;
+
+	return trx->ts_list[tn];
+}
+
+void sched_trx_del_ts(struct trx_instance *trx, int tn)
+{
+	struct trx_lchan_state *lchan, *lchan_next;
+	struct trx_ts *ts;
+
+	/* Find ts in list */
+	ts = trx->ts_list[tn];
+	if (ts == NULL)
+		return;
+
+	LOGP(DSCH, LOGL_NOTICE, "Delete TDMA timeslot #%u\n", tn);
+
+	/* Deactivate all logical channels */
+	sched_trx_deactivate_all_lchans(ts);
+
+	/* Free channel states */
+	llist_for_each_entry_safe(lchan, lchan_next, &ts->lchans, list) {
+		llist_del(&lchan->list);
+		talloc_free(lchan);
+	}
+
+	/* Flush queue primitives for TX */
+	sched_prim_flush_queue(&ts->tx_prims);
+
+	/* Remove ts from list and free memory */
+	trx->ts_list[tn] = NULL;
+	talloc_free(ts);
+
+	/* Notify transceiver about that */
+	trx_if_cmd_setslot(trx, tn, 0);
+}
+
+#define LAYOUT_HAS_LCHAN(layout, lchan) \
+	(layout->lchan_mask & ((uint64_t) 0x01 << lchan))
+
+int sched_trx_configure_ts(struct trx_instance *trx, int tn,
+	enum gsm_phys_chan_config config)
+{
+	struct trx_lchan_state *lchan;
+	enum trx_lchan_type type;
+	struct trx_ts *ts;
+
+	/* Try to find specified ts */
+	ts = trx->ts_list[tn];
+	if (ts != NULL) {
+		/* Reconfiguration of existing one */
+		sched_trx_reset_ts(trx, tn);
+	} else {
+		/* Allocate a new one if doesn't exist */
+		ts = sched_trx_add_ts(trx, tn);
+		if (ts == NULL)
+			return -ENOMEM;
+	}
+
+	/* Choose proper multiframe layout */
+	ts->mf_layout = sched_mframe_layout(config, tn);
+	if (ts->mf_layout->chan_config != config)
+		return -EINVAL;
+
+	LOGP(DSCH, LOGL_NOTICE, "(Re)configure TDMA timeslot #%u as %s\n",
+		tn, ts->mf_layout->name);
+
+	/* Init queue primitives for TX */
+	INIT_LLIST_HEAD(&ts->tx_prims);
+	/* Init logical channels list */
+	INIT_LLIST_HEAD(&ts->lchans);
+
+	/* Allocate channel states */
+	for (type = 0; type < _TRX_CHAN_MAX; type++) {
+		if (!LAYOUT_HAS_LCHAN(ts->mf_layout, type))
+			continue;
+
+		/* Allocate a channel state */
+		lchan = talloc_zero(ts, struct trx_lchan_state);
+		if (!lchan)
+			return -ENOMEM;
+
+		/* Set channel type */
+		lchan->type = type;
+
+		/* Add to the list of channel states */
+		llist_add_tail(&lchan->list, &ts->lchans);
+
+		/* Enable channel automatically if required */
+		if (trx_lchan_desc[type].flags & TRX_CH_FLAG_AUTO)
+			sched_trx_activate_lchan(ts, type);
+	}
+
+	/* Notify transceiver about TS activation */
+	/* FIXME: set proper channel type */
+	trx_if_cmd_setslot(trx, tn, 1);
+
+	return 0;
+}
+
+int sched_trx_reset_ts(struct trx_instance *trx, int tn)
+{
+	struct trx_lchan_state *lchan, *lchan_next;
+	struct trx_ts *ts;
+
+	/* Try to find specified ts */
+	ts = trx->ts_list[tn];
+	if (ts == NULL)
+		return -EINVAL;
+
+	/* Flush TS frame counter */
+	ts->mf_last_fn = 0;
+
+	/* Undefine multiframe layout */
+	ts->mf_layout = NULL;
+
+	/* Flush queue primitives for TX */
+	sched_prim_flush_queue(&ts->tx_prims);
+
+	/* Deactivate all logical channels */
+	sched_trx_deactivate_all_lchans(ts);
+
+	/* Free channel states */
+	llist_for_each_entry_safe(lchan, lchan_next, &ts->lchans, list) {
+		llist_del(&lchan->list);
+		talloc_free(lchan);
+	}
+
+	/* Notify transceiver about that */
+	trx_if_cmd_setslot(trx, tn, 0);
+
+	return 0;
+}
+
+int sched_trx_start_ciphering(struct trx_ts *ts, uint8_t algo,
+	uint8_t *key, uint8_t key_len)
+{
+	struct trx_lchan_state *lchan;
+
+	/* Prevent NULL-pointer deference */
+	if (!ts)
+		return -EINVAL;
+
+	/* Make sure we can store this key */
+	if (key_len > MAX_A5_KEY_LEN)
+		return -ERANGE;
+
+	/* Iterate over all allocated logical channels */
+	llist_for_each_entry(lchan, &ts->lchans, list) {
+		/* Omit inactive channels */
+		if (!lchan->active)
+			continue;
+
+		/* Set key length and algorithm */
+		lchan->a5.key_len = key_len;
+		lchan->a5.algo = algo;
+
+		/* Copy requested key */
+		if (key_len)
+			memcpy(lchan->a5.key, key, key_len);
+	}
+
+	return 0;
+}
+
+struct trx_lchan_state *sched_trx_find_lchan(struct trx_ts *ts,
+	enum trx_lchan_type chan)
+{
+	struct trx_lchan_state *lchan;
+
+	llist_for_each_entry(lchan, &ts->lchans, list)
+		if (lchan->type == chan)
+			return lchan;
+
+	return NULL;
+}
+
+int sched_trx_set_lchans(struct trx_ts *ts, uint8_t chan_nr, int active, uint8_t tch_mode)
+{
+	const struct trx_lchan_desc *lchan_desc;
+	struct trx_lchan_state *lchan;
+	int rc = 0;
+
+	/* Prevent NULL-pointer deference */
+	if (ts == NULL) {
+		LOGP(DSCH, LOGL_ERROR, "Timeslot isn't configured\n");
+		return -EINVAL;
+	}
+
+	/* Iterate over all allocated lchans */
+	llist_for_each_entry(lchan, &ts->lchans, list) {
+		lchan_desc = &trx_lchan_desc[lchan->type];
+
+		if (lchan_desc->chan_nr == (chan_nr & 0xf8)) {
+			if (active) {
+				rc |= sched_trx_activate_lchan(ts, lchan->type);
+				lchan->tch_mode = tch_mode;
+			} else
+				rc |= sched_trx_deactivate_lchan(ts, lchan->type);
+		}
+	}
+
+	return rc;
+}
+
+int sched_trx_activate_lchan(struct trx_ts *ts, enum trx_lchan_type chan)
+{
+	const struct trx_lchan_desc *lchan_desc = &trx_lchan_desc[chan];
+	struct trx_lchan_state *lchan;
+
+	/* Try to find requested logical channel */
+	lchan = sched_trx_find_lchan(ts, chan);
+	if (lchan == NULL)
+		return -EINVAL;
+
+	if (lchan->active) {
+		LOGP(DSCH, LOGL_ERROR, "Logical channel %s already activated "
+			"on ts=%d\n", trx_lchan_desc[chan].name, ts->index);
+		return -EINVAL;
+	}
+
+	LOGP(DSCH, LOGL_NOTICE, "Activating lchan=%s "
+		"on ts=%d\n", trx_lchan_desc[chan].name, ts->index);
+
+	/* Conditionally allocate memory for bursts */
+	if (lchan_desc->rx_fn && lchan_desc->burst_buf_size > 0) {
+		lchan->rx_bursts = talloc_zero_size(lchan,
+			lchan_desc->burst_buf_size);
+		if (lchan->rx_bursts == NULL)
+			return -ENOMEM;
+	}
+
+	if (lchan_desc->tx_fn && lchan_desc->burst_buf_size > 0) {
+		lchan->tx_bursts = talloc_zero_size(lchan,
+			lchan_desc->burst_buf_size);
+		if (lchan->tx_bursts == NULL)
+			return -ENOMEM;
+	}
+
+	/* Finally, update channel status */
+	lchan->active = 1;
+
+	return 0;
+}
+
+static void sched_trx_reset_lchan(struct trx_lchan_state *lchan)
+{
+	/* Prevent NULL-pointer deference */
+	OSMO_ASSERT(lchan != NULL);
+
+	/* Reset internal state variables */
+	lchan->rx_burst_mask = 0x00;
+	lchan->tx_burst_mask = 0x00;
+	lchan->rx_first_fn = 0;
+
+	/* Free burst memory */
+	talloc_free(lchan->rx_bursts);
+	talloc_free(lchan->tx_bursts);
+
+	lchan->rx_bursts = NULL;
+	lchan->tx_bursts = NULL;
+
+	/* Forget the current prim */
+	sched_prim_drop(lchan);
+
+	/* Channel specific stuff */
+	if (CHAN_IS_TCH(lchan->type)) {
+		lchan->dl_ongoing_facch = 0;
+		lchan->ul_facch_blocks = 0;
+
+		lchan->tch_mode = GSM48_CMODE_SIGN;
+
+		/* Reset AMR state */
+		memset(&lchan->amr, 0x00, sizeof(lchan->amr));
+	} else if (CHAN_IS_SACCH(lchan->type)) {
+		/* Reset SACCH state */
+		memset(&lchan->sacch, 0x00, sizeof(lchan->sacch));
+	}
+
+	/* Reset ciphering state */
+	memset(&lchan->a5, 0x00, sizeof(lchan->a5));
+}
+
+int sched_trx_deactivate_lchan(struct trx_ts *ts, enum trx_lchan_type chan)
+{
+	struct trx_lchan_state *lchan;
+
+	/* Try to find requested logical channel */
+	lchan = sched_trx_find_lchan(ts, chan);
+	if (lchan == NULL)
+		return -EINVAL;
+
+	if (!lchan->active) {
+		LOGP(DSCH, LOGL_ERROR, "Logical channel %s already deactivated "
+			"on ts=%d\n", trx_lchan_desc[chan].name, ts->index);
+		return -EINVAL;
+	}
+
+	LOGP(DSCH, LOGL_DEBUG, "Deactivating lchan=%s "
+		"on ts=%d\n", trx_lchan_desc[chan].name, ts->index);
+
+	/* Reset internal state, free memory */
+	sched_trx_reset_lchan(lchan);
+
+	/* Update activation flag */
+	lchan->active = 0;
+
+	return 0;
+}
+
+void sched_trx_deactivate_all_lchans(struct trx_ts *ts)
+{
+	struct trx_lchan_state *lchan;
+
+	LOGP(DSCH, LOGL_DEBUG, "Deactivating all logical channels "
+		"on ts=%d\n", ts->index);
+
+	llist_for_each_entry(lchan, &ts->lchans, list) {
+		/* Omit inactive channels */
+		if (!lchan->active)
+			continue;
+
+		/* Reset internal state, free memory */
+		sched_trx_reset_lchan(lchan);
+
+		/* Update activation flag */
+		lchan->active = 0;
+	}
+}
+
+enum gsm_phys_chan_config sched_trx_chan_nr2pchan_config(uint8_t chan_nr)
+{
+	uint8_t cbits = chan_nr >> 3;
+
+	if (cbits == 0x01)
+		return GSM_PCHAN_TCH_F;
+	else if ((cbits & 0x1e) == 0x02)
+		return GSM_PCHAN_TCH_H;
+	else if ((cbits & 0x1c) == 0x04)
+		return GSM_PCHAN_CCCH_SDCCH4;
+	else if ((cbits & 0x1f) == 0x18)
+		return GSM_PCHAN_CCCH_SDCCH4_CBCH;
+	else if ((cbits & 0x18) == 0x08)
+		return GSM_PCHAN_SDCCH8_SACCH8C;
+	else if ((cbits & 0x1f) == 0x19)
+		return GSM_PCHAN_SDCCH8_SACCH8C_CBCH;
+
+	return GSM_PCHAN_NONE;
+}
+
+enum trx_lchan_type sched_trx_chan_nr2lchan_type(uint8_t chan_nr,
+	uint8_t link_id)
+{
+	int i;
+
+	/* Iterate over all known lchan types */
+	for (i = 0; i < _TRX_CHAN_MAX; i++)
+		if (trx_lchan_desc[i].chan_nr == (chan_nr & 0xf8))
+			if (trx_lchan_desc[i].link_id == link_id)
+				return i;
+
+	return TRXC_IDLE;
+}
+
+static void sched_trx_a5_burst_dec(struct trx_lchan_state *lchan,
+	uint32_t fn, sbit_t *burst)
+{
+	ubit_t ks[114];
+	int i;
+
+	/* Generate keystream for a DL burst */
+	osmo_a5(lchan->a5.algo, lchan->a5.key, fn, ks, NULL);
+
+	/* Apply keystream over ciphertext */
+	for (i = 0; i < 57; i++) {
+		if (ks[i])
+			burst[i + 3] *= -1;
+		if (ks[i + 57])
+			burst[i + 88] *= -1;
+	}
+}
+
+static void sched_trx_a5_burst_enc(struct trx_lchan_state *lchan,
+	uint32_t fn, ubit_t *burst)
+{
+	ubit_t ks[114];
+	int i;
+
+	/* Generate keystream for an UL burst */
+	osmo_a5(lchan->a5.algo, lchan->a5.key, fn, NULL, ks);
+
+	/* Apply keystream over plaintext */
+	for (i = 0; i < 57; i++) {
+		burst[i + 3] ^= ks[i];
+		burst[i + 88] ^= ks[i + 57];
+	}
+}
+
+int sched_trx_handle_rx_burst(struct trx_instance *trx, uint8_t tn,
+	uint32_t burst_fn, sbit_t *bits, uint16_t nbits,
+	int8_t rssi, int16_t toa256)
+{
+	struct trx_lchan_state *lchan;
+	const struct trx_frame *frame;
+	struct trx_ts *ts;
+
+	trx_lchan_rx_func *handler;
+	enum trx_lchan_type chan;
+	uint32_t fn, elapsed;
+	uint8_t offset, bid;
+
+	/* Check whether required timeslot is allocated and configured */
+	ts = trx->ts_list[tn];
+	if (ts == NULL || ts->mf_layout == NULL) {
+		LOGP(DSCHD, LOGL_DEBUG, "TDMA timeslot #%u isn't configured, "
+			"ignoring burst...\n", tn);
+		return -EINVAL;
+	}
+
+	/* Calculate how many frames have been elapsed */
+	elapsed = TDMA_FN_SUB(burst_fn, ts->mf_last_fn);
+
+	/**
+	 * If not too many frames have been elapsed,
+	 * start counting from last fn + 1
+	 */
+	if (elapsed < 10)
+		fn = TDMA_FN_INC(ts->mf_last_fn);
+	else
+		fn = burst_fn;
+
+	while (1) {
+		/* Get frame from multiframe */
+		offset = fn % ts->mf_layout->period;
+		frame = ts->mf_layout->frames + offset;
+
+		/* Get required info from frame */
+		bid = frame->dl_bid;
+		chan = frame->dl_chan;
+		handler = trx_lchan_desc[chan].rx_fn;
+
+		/* Omit bursts which have no handler, like IDLE bursts */
+		if (!handler)
+			goto next_frame;
+
+		/* Find required channel state */
+		lchan = sched_trx_find_lchan(ts, chan);
+		if (lchan == NULL)
+			goto next_frame;
+
+		/* Ensure that channel is active */
+		if (!lchan->active)
+			goto next_frame;
+
+		/* Reached current fn */
+		if (fn == burst_fn) {
+			/* Perform A5/X decryption if required */
+			if (lchan->a5.algo)
+				sched_trx_a5_burst_dec(lchan, fn, bits);
+
+			/* Put burst to handler */
+			handler(trx, ts, lchan, fn, bid, bits, rssi, toa256);
+		}
+
+next_frame:
+		/* Reached current fn */
+		if (fn == burst_fn)
+			break;
+
+		fn = TDMA_FN_INC(fn);
+	}
+
+	/* Set last processed frame number */
+	ts->mf_last_fn = fn;
+
+	return 0;
+}
+
+int sched_trx_handle_tx_burst(struct trx_instance *trx,
+	struct trx_ts *ts, struct trx_lchan_state *lchan,
+	uint32_t fn, ubit_t *bits)
+{
+	int rc;
+
+	/* Perform A5/X burst encryption if required */
+	if (lchan->a5.algo)
+		sched_trx_a5_burst_enc(lchan, fn, bits);
+
+	/* Forward burst to transceiver */
+	rc = trx_if_tx_burst(trx, ts->index, fn, trx->tx_power, bits);
+	if (rc) {
+		LOGP(DSCHD, LOGL_ERROR, "Could not send burst to transceiver\n");
+		return rc;
+	}
+
+	return 0;
+}
diff --git a/src/host/trxcon/sched_trx.h b/src/host/trxcon/sched_trx.h
new file mode 100644
index 00000000..b7236d51
--- /dev/null
+++ b/src/host/trxcon/sched_trx.h
@@ -0,0 +1,356 @@
+#pragma once
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#include <osmocom/core/bits.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/linuxlist.h>
+
+#include "logging.h"
+#include "scheduler.h"
+
+#define GSM_BURST_LEN		148
+#define GSM_BURST_PL_LEN	116
+
+#define GPRS_BURST_LEN		GSM_BURST_LEN
+#define EDGE_BURST_LEN		444
+
+#define GPRS_L2_MAX_LEN		54
+#define EDGE_L2_MAX_LEN		155
+
+#define TRX_CH_LID_DEDIC	0x00
+#define TRX_CH_LID_SACCH	0x40
+
+/* Is a channel related to PDCH (GPRS) */
+#define TRX_CH_FLAG_PDCH	(1 << 0)
+/* Should a channel be activated automatically */
+#define TRX_CH_FLAG_AUTO	(1 << 1)
+/* Is continuous burst transmission assumed */
+#define TRX_CH_FLAG_CBTX	(1 << 2)
+
+#define MAX_A5_KEY_LEN		(128 / 8)
+#define TRX_TS_COUNT		8
+
+/* Forward declaration to avoid mutual include */
+struct trx_lchan_state;
+struct trx_instance;
+struct trx_ts;
+
+enum trx_burst_type {
+	TRX_BURST_GMSK,
+	TRX_BURST_8PSK,
+};
+
+/**
+ * These types define the different channels on a multiframe.
+ * Each channel has queues and can be activated individually.
+ */
+enum trx_lchan_type {
+	TRXC_IDLE = 0,
+	TRXC_FCCH,
+	TRXC_SCH,
+	TRXC_BCCH,
+	TRXC_RACH,
+	TRXC_CCCH,
+	TRXC_TCHF,
+	TRXC_TCHH_0,
+	TRXC_TCHH_1,
+	TRXC_SDCCH4_0,
+	TRXC_SDCCH4_1,
+	TRXC_SDCCH4_2,
+	TRXC_SDCCH4_3,
+	TRXC_SDCCH8_0,
+	TRXC_SDCCH8_1,
+	TRXC_SDCCH8_2,
+	TRXC_SDCCH8_3,
+	TRXC_SDCCH8_4,
+	TRXC_SDCCH8_5,
+	TRXC_SDCCH8_6,
+	TRXC_SDCCH8_7,
+	TRXC_SACCHTF,
+	TRXC_SACCHTH_0,
+	TRXC_SACCHTH_1,
+	TRXC_SACCH4_0,
+	TRXC_SACCH4_1,
+	TRXC_SACCH4_2,
+	TRXC_SACCH4_3,
+	TRXC_SACCH8_0,
+	TRXC_SACCH8_1,
+	TRXC_SACCH8_2,
+	TRXC_SACCH8_3,
+	TRXC_SACCH8_4,
+	TRXC_SACCH8_5,
+	TRXC_SACCH8_6,
+	TRXC_SACCH8_7,
+	TRXC_PDTCH,
+	TRXC_PTCCH,
+	TRXC_SDCCH4_CBCH,
+	TRXC_SDCCH8_CBCH,
+	_TRX_CHAN_MAX
+};
+
+typedef int trx_lchan_rx_func(struct trx_instance *trx,
+	struct trx_ts *ts, struct trx_lchan_state *lchan,
+	uint32_t fn, uint8_t bid, sbit_t *bits,
+	int8_t rssi, int16_t toa256);
+
+typedef int trx_lchan_tx_func(struct trx_instance *trx,
+	struct trx_ts *ts, struct trx_lchan_state *lchan,
+	uint32_t fn, uint8_t bid);
+
+struct trx_lchan_desc {
+	/*! \brief TRX Channel Type */
+	enum trx_lchan_type chan;
+	/*! \brief Human-readable name */
+	const char *name;
+	/*! \brief Channel Number (like in RSL) */
+	uint8_t chan_nr;
+	/*! \brief Link ID (like in RSL) */
+	uint8_t link_id;
+
+	/*! \brief How much memory do we need to store bursts */
+	size_t burst_buf_size;
+	/*! \brief Channel specific flags */
+	uint8_t flags;
+
+	/*! \brief Function to call when burst received from PHY */
+	trx_lchan_rx_func *rx_fn;
+	/*! \brief Function to call when data received from L2 */
+	trx_lchan_tx_func *tx_fn;
+};
+
+struct trx_frame {
+	/*! \brief Downlink TRX channel type */
+	enum trx_lchan_type dl_chan;
+	/*! \brief Downlink block ID */
+	uint8_t dl_bid;
+	/*! \brief Uplink TRX channel type */
+	enum trx_lchan_type ul_chan;
+	/*! \brief Uplink block ID */
+	uint8_t ul_bid;
+};
+
+struct trx_multiframe {
+	/*! \brief Channel combination */
+	enum gsm_phys_chan_config chan_config;
+	/*! \brief Human-readable name */
+	const char *name;
+	/*! \brief Repeats how many frames */
+	uint8_t period;
+	/*! \brief Applies to which timeslots */
+	uint8_t slotmask;
+	/*! \brief Contains which lchans */
+	uint64_t lchan_mask;
+	/*! \brief Pointer to scheduling structure */
+	const struct trx_frame *frames;
+};
+
+/* States each channel on a multiframe */
+struct trx_lchan_state {
+	/*! \brief Channel type */
+	enum trx_lchan_type type;
+	/*! \brief Channel status */
+	uint8_t active;
+	/*! \brief Link to a list of channels */
+	struct llist_head list;
+
+	/*! \brief Burst type: GMSK or 8PSK */
+	enum trx_burst_type burst_type;
+	/*! \brief Frame number of first burst */
+	uint32_t rx_first_fn;
+	/*! \brief Mask of received bursts */
+	uint8_t rx_burst_mask;
+	/*! \brief Mask of transmitted bursts */
+	uint8_t tx_burst_mask;
+	/*! \brief Burst buffer for RX */
+	sbit_t *rx_bursts;
+	/*! \brief Burst buffer for TX */
+	ubit_t *tx_bursts;
+
+	/*! \brief A primitive being sent */
+	struct trx_ts_prim *prim;
+
+	/*! \brief Mode for TCH channels (see GSM48_CMODE_*) */
+	uint8_t	tch_mode;
+
+	/*! \brief FACCH/H on downlink */
+	bool dl_ongoing_facch;
+	/*! \brief pending FACCH/H blocks on Uplink */
+	uint8_t ul_facch_blocks;
+
+	struct {
+		/*! \brief Number of RSSI values */
+		uint8_t rssi_num;
+		/*! \brief Sum of RSSI values */
+		float rssi_sum;
+		/*! \brief Number of TOA values */
+		uint8_t toa256_num;
+		/*! \brief Sum of TOA values */
+		int32_t toa256_sum;
+	} meas;
+
+	/*! \brief SACCH state */
+	struct {
+		/*! \brief Cached measurement report (last received) */
+		uint8_t mr_cache[GSM_MACBLOCK_LEN];
+		/*! \brief Cache usage counter */
+		uint8_t mr_cache_usage;
+		/*! \brief Was a MR transmitted last time? */
+		bool mr_tx_last;
+	} sacch;
+
+	/* AMR specific */
+	struct {
+		/*! \brief 4 possible codecs for AMR */
+		uint8_t codec[4];
+		/*! \brief Number of possible codecs */
+		uint8_t codecs;
+		/*! \brief Current uplink FT index */
+		uint8_t ul_ft;
+		/*! \brief Current downlink FT index */
+		uint8_t dl_ft;
+		/*! \brief Current uplink CMR index */
+		uint8_t ul_cmr;
+		/*! \brief Current downlink CMR index */
+		uint8_t dl_cmr;
+		/*! \brief If AMR loop is enabled */
+		uint8_t amr_loop;
+		/*! \brief Number of bit error rates */
+		uint8_t ber_num;
+		/*! \brief Sum of bit error rates */
+		float ber_sum;
+	} amr;
+
+	/*! \brief A5/X encryption state */
+	struct {
+		uint8_t key[MAX_A5_KEY_LEN];
+		uint8_t key_len;
+		uint8_t algo;
+	} a5;
+};
+
+struct trx_ts {
+	/*! \brief Timeslot index within a frame (0..7) */
+	uint8_t index;
+	/*! \brief Last received frame number */
+	uint32_t mf_last_fn;
+
+	/*! \brief Pointer to multiframe layout */
+	const struct trx_multiframe *mf_layout;
+	/*! \brief Channel states for logical channels */
+	struct llist_head lchans;
+	/*! \brief Queue primitives for TX */
+	struct llist_head tx_prims;
+};
+
+/* Represents one TX primitive in the queue of trx_ts */
+struct trx_ts_prim {
+	/*! \brief Link to queue of TS */
+	struct llist_head list;
+	/*! \brief Logical channel type */
+	enum trx_lchan_type chan;
+	/*! \brief Payload length */
+	size_t payload_len;
+	/*! \brief Payload */
+	uint8_t payload[0];
+};
+
+extern const struct trx_lchan_desc trx_lchan_desc[_TRX_CHAN_MAX];
+const struct trx_multiframe *sched_mframe_layout(
+	enum gsm_phys_chan_config config, int tn);
+
+/* Scheduler management functions */
+int sched_trx_init(struct trx_instance *trx, uint32_t fn_advance);
+int sched_trx_reset(struct trx_instance *trx, int reset_clock);
+int sched_trx_shutdown(struct trx_instance *trx);
+
+/* Timeslot management functions */
+struct trx_ts *sched_trx_add_ts(struct trx_instance *trx, int tn);
+void sched_trx_del_ts(struct trx_instance *trx, int tn);
+int sched_trx_reset_ts(struct trx_instance *trx, int tn);
+int sched_trx_configure_ts(struct trx_instance *trx, int tn,
+	enum gsm_phys_chan_config config);
+int sched_trx_start_ciphering(struct trx_ts *ts, uint8_t algo,
+	uint8_t *key, uint8_t key_len);
+
+/* Logical channel management functions */
+enum gsm_phys_chan_config sched_trx_chan_nr2pchan_config(uint8_t chan_nr);
+enum trx_lchan_type sched_trx_chan_nr2lchan_type(uint8_t chan_nr,
+	uint8_t link_id);
+
+void sched_trx_deactivate_all_lchans(struct trx_ts *ts);
+int sched_trx_set_lchans(struct trx_ts *ts, uint8_t chan_nr, int active, uint8_t tch_mode);
+int sched_trx_activate_lchan(struct trx_ts *ts, enum trx_lchan_type chan);
+int sched_trx_deactivate_lchan(struct trx_ts *ts, enum trx_lchan_type chan);
+struct trx_lchan_state *sched_trx_find_lchan(struct trx_ts *ts,
+	enum trx_lchan_type chan);
+
+/* Primitive management functions */
+int sched_prim_init(void *ctx, struct trx_ts_prim **prim,
+	size_t pl_len, uint8_t chan_nr, uint8_t link_id);
+int sched_prim_push(struct trx_instance *trx,
+	struct trx_ts_prim *prim, uint8_t chan_nr);
+
+#define TCH_MODE_IS_SPEECH(mode)       \
+	  (mode == GSM48_CMODE_SPEECH_V1   \
+	|| mode == GSM48_CMODE_SPEECH_EFR  \
+	|| mode == GSM48_CMODE_SPEECH_AMR)
+
+#define TCH_MODE_IS_DATA(mode)        \
+	  (mode == GSM48_CMODE_DATA_14k5  \
+	|| mode == GSM48_CMODE_DATA_12k0  \
+	|| mode == GSM48_CMODE_DATA_6k0   \
+	|| mode == GSM48_CMODE_DATA_3k6)
+
+#define CHAN_IS_TCH(chan) \
+	(chan == TRXC_TCHF || chan == TRXC_TCHH_0 || chan == TRXC_TCHH_1)
+
+#define CHAN_IS_SACCH(chan) \
+	(trx_lchan_desc[chan].link_id & TRX_CH_LID_SACCH)
+
+#define PRIM_IS_TCH(prim) \
+	(CHAN_IS_TCH(prim->chan) && prim->payload_len != GSM_MACBLOCK_LEN)
+
+#define PRIM_IS_FACCH(prim) \
+	(CHAN_IS_TCH(prim->chan) && prim->payload_len == GSM_MACBLOCK_LEN)
+
+struct trx_ts_prim *sched_prim_dequeue(struct llist_head *queue,
+	uint32_t fn, struct trx_lchan_state *lchan);
+int sched_prim_dummy(struct trx_lchan_state *lchan);
+void sched_prim_drop(struct trx_lchan_state *lchan);
+void sched_prim_flush_queue(struct llist_head *list);
+
+int sched_trx_handle_rx_burst(struct trx_instance *trx, uint8_t tn,
+	uint32_t burst_fn, sbit_t *bits, uint16_t nbits,
+	int8_t rssi, int16_t toa256);
+int sched_trx_handle_tx_burst(struct trx_instance *trx,
+	struct trx_ts *ts, struct trx_lchan_state *lchan,
+	uint32_t fn, ubit_t *bits);
+
+/* Shared declarations for lchan handlers */
+extern const uint8_t sched_nb_training_bits[8][26];
+
+size_t sched_bad_frame_ind(uint8_t *l2, struct trx_lchan_state *lchan);
+int sched_send_dt_ind(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint8_t *l2, size_t l2_len,
+	int bit_error_count, bool dec_failed, bool traffic);
+int sched_send_dt_conf(struct trx_instance *trx, struct trx_ts *ts,
+	struct trx_lchan_state *lchan, uint32_t fn, bool traffic);
+
+/* Interleaved TCH/H block TDMA frame mapping */
+uint32_t sched_tchh_block_dl_first_fn(enum trx_lchan_type chan,
+	uint32_t last_fn, bool facch);
+bool sched_tchh_block_map_fn(enum trx_lchan_type chan,
+	uint32_t fn, bool ul, bool facch, bool start);
+
+#define sched_tchh_traffic_start(chan, fn, ul) \
+	sched_tchh_block_map_fn(chan, fn, ul, 0, 1)
+#define sched_tchh_traffic_end(chan, fn, ul) \
+	sched_tchh_block_map_fn(chan, fn, ul, 0, 0)
+
+#define sched_tchh_facch_start(chan, fn, ul) \
+	sched_tchh_block_map_fn(chan, fn, ul, 1, 1)
+#define sched_tchh_facch_end(chan, fn, ul) \
+	sched_tchh_block_map_fn(chan, fn, ul, 1, 0)
diff --git a/src/host/trxcon/scheduler.h b/src/host/trxcon/scheduler.h
new file mode 100644
index 00000000..7ab17ab5
--- /dev/null
+++ b/src/host/trxcon/scheduler.h
@@ -0,0 +1,54 @@
+#pragma once
+
+#include <stdint.h>
+#include <time.h>
+
+#include <osmocom/core/timer.h>
+
+#define FRAME_DURATION_uS	4615
+
+#define GSM_SUPERFRAME		(26 * 51)
+#define GSM_HYPERFRAME		(2048 * GSM_SUPERFRAME)
+
+/* TDMA frame number arithmetics */
+#define TDMA_FN_SUM(a, b) \
+	((a + b) % GSM_HYPERFRAME)
+#define TDMA_FN_SUB(a, b) \
+	((a + GSM_HYPERFRAME - b) % GSM_HYPERFRAME)
+#define TDMA_FN_INC(fn) \
+	TDMA_FN_SUM(fn, 1)
+#define TDMA_FN_MIN(a, b) \
+	(a < b ? a : b)
+#define TDMA_FN_DIFF(a, b) \
+	TDMA_FN_MIN(TDMA_FN_SUB(a, b), TDMA_FN_SUB(b, a))
+
+enum tdma_sched_clck_state {
+	SCH_CLCK_STATE_WAIT,
+	SCH_CLCK_STATE_OK,
+};
+
+/* Forward structure declaration */
+struct trx_sched;
+
+/*! \brief One scheduler instance */
+struct trx_sched {
+	/*! \brief Clock state */
+	uint8_t state;
+	/*! \brief Local clock source */
+	struct timespec clock;
+	/*! \brief Count of processed frames */
+	uint32_t fn_counter_proc;
+	/*! \brief Local frame counter advance */
+	uint32_t fn_counter_advance;
+	/*! \brief Frame counter */
+	uint32_t fn_counter_lost;
+	/*! \brief Frame callback timer */
+	struct osmo_timer_list clock_timer;
+	/*! \brief Frame callback */
+	void (*clock_cb)(struct trx_sched *sched);
+	/*! \brief Private data (e.g. pointer to trx instance) */
+	void *data;
+};
+
+int sched_clck_handle(struct trx_sched *sched, uint32_t fn);
+void sched_clck_reset(struct trx_sched *sched);
diff --git a/src/host/trxcon/trx_if.c b/src/host/trxcon/trx_if.c
new file mode 100644
index 00000000..b8bbace5
--- /dev/null
+++ b/src/host/trxcon/trx_if.c
@@ -0,0 +1,668 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * Transceiver interface handlers
+ *
+ * Copyright (C) 2013 by Andreas Eversberg <jolly@eversberg.eu>
+ * Copyright (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <netinet/in.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/bits.h>
+#include <osmocom/core/fsm.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+
+#include "l1ctl.h"
+#include "trxcon.h"
+#include "trx_if.h"
+#include "logging.h"
+#include "scheduler.h"
+
+static struct value_string trx_evt_names[] = {
+	{ 0, NULL } /* no events? */
+};
+
+static struct osmo_fsm_state trx_fsm_states[] = {
+	[TRX_STATE_OFFLINE] = {
+		.out_state_mask = (
+			GEN_MASK(TRX_STATE_IDLE) |
+			GEN_MASK(TRX_STATE_RSP_WAIT)),
+		.name = "OFFLINE",
+	},
+	[TRX_STATE_IDLE] = {
+		.out_state_mask = UINT32_MAX,
+		.name = "IDLE",
+	},
+	[TRX_STATE_ACTIVE] = {
+		.out_state_mask = (
+			GEN_MASK(TRX_STATE_IDLE) |
+			GEN_MASK(TRX_STATE_RSP_WAIT)),
+		.name = "ACTIVE",
+	},
+	[TRX_STATE_RSP_WAIT] = {
+		.out_state_mask = (
+			GEN_MASK(TRX_STATE_IDLE) |
+			GEN_MASK(TRX_STATE_ACTIVE) |
+			GEN_MASK(TRX_STATE_OFFLINE)),
+		.name = "RSP_WAIT",
+	},
+};
+
+static struct osmo_fsm trx_fsm = {
+	.name = "trx_interface_fsm",
+	.states = trx_fsm_states,
+	.num_states = ARRAY_SIZE(trx_fsm_states),
+	.log_subsys = DTRX,
+	.event_names = trx_evt_names,
+};
+
+static int trx_udp_open(void *priv, struct osmo_fd *ofd, const char *host_local,
+	uint16_t port_local, const char *host_remote, uint16_t port_remote,
+	int (*cb)(struct osmo_fd *fd, unsigned int what))
+{
+	int rc;
+
+	ofd->data = priv;
+	ofd->fd = -1;
+	ofd->cb = cb;
+
+	/* Init UDP Connection */
+	rc = osmo_sock_init2_ofd(ofd, AF_UNSPEC, SOCK_DGRAM, 0, host_local, port_local,
+				 host_remote, port_remote,
+				 OSMO_SOCK_F_BIND | OSMO_SOCK_F_CONNECT);
+	return rc;
+}
+
+static void trx_udp_close(struct osmo_fd *ofd)
+{
+	if (ofd->fd > 0) {
+		osmo_fd_unregister(ofd);
+		close(ofd->fd);
+		ofd->fd = -1;
+	}
+}
+
+/* ------------------------------------------------------------------------ */
+/* Control (CTRL) interface handlers                                        */
+/* ------------------------------------------------------------------------ */
+/* Commands on the Per-ARFCN Control Interface                              */
+/*                                                                          */
+/* The per-ARFCN control interface uses a command-response protocol.        */
+/* Commands are NULL-terminated ASCII strings, one per UDP socket.          */
+/* Each command has a corresponding response.                               */
+/* Every command is of the form:                                            */
+/*                                                                          */
+/* CMD <cmdtype> [params]                                                   */
+/*                                                                          */
+/* The <cmdtype> is the actual command.                                     */
+/* Parameters are optional depending on the commands type.                  */
+/* Every response is of the form:                                           */
+/*                                                                          */
+/* RSP <cmdtype> <status> [result]                                          */
+/*                                                                          */
+/* The <status> is 0 for success and a non-zero error code for failure.     */
+/* Successful responses may include results, depending on the command type. */
+/* ------------------------------------------------------------------------ */
+
+static void trx_ctrl_timer_cb(void *data);
+
+/* Send first CTRL message and start timer */
+static void trx_ctrl_send(struct trx_instance *trx)
+{
+	struct trx_ctrl_msg *tcm;
+
+	if (llist_empty(&trx->trx_ctrl_list))
+		return;
+	tcm = llist_entry(trx->trx_ctrl_list.next, struct trx_ctrl_msg, list);
+
+	/* Send command */
+	LOGP(DTRX, LOGL_DEBUG, "Sending control '%s'\n", tcm->cmd);
+	send(trx->trx_ofd_ctrl.fd, tcm->cmd, strlen(tcm->cmd) + 1, 0);
+
+	/* Trigger state machine */
+	if (trx->fsm->state != TRX_STATE_RSP_WAIT) {
+		trx->prev_state = trx->fsm->state;
+		osmo_fsm_inst_state_chg(trx->fsm, TRX_STATE_RSP_WAIT, 0, 0);
+	}
+
+	/* Start expire timer */
+	trx->trx_ctrl_timer.data = trx;
+	trx->trx_ctrl_timer.cb = trx_ctrl_timer_cb;
+	osmo_timer_schedule(&trx->trx_ctrl_timer, 2, 0);
+}
+
+static void trx_ctrl_timer_cb(void *data)
+{
+	struct trx_instance *trx = (struct trx_instance *) data;
+	struct trx_ctrl_msg *tcm;
+
+	/* Queue may be cleaned at this moment */
+	if (llist_empty(&trx->trx_ctrl_list))
+		return;
+
+	LOGP(DTRX, LOGL_NOTICE, "No response from transceiver...\n");
+
+	tcm = llist_entry(trx->trx_ctrl_list.next, struct trx_ctrl_msg, list);
+	if (++tcm->retry_cnt > 3) {
+		LOGP(DTRX, LOGL_NOTICE, "Transceiver offline\n");
+		osmo_fsm_inst_state_chg(trx->fsm, TRX_STATE_OFFLINE, 0, 0);
+		osmo_fsm_inst_dispatch(trxcon_fsm, TRX_EVENT_OFFLINE, trx);
+		return;
+	}
+
+	/* Attempt to send a command again */
+	trx_ctrl_send(trx);
+}
+
+/* Add a new CTRL command to the trx_ctrl_list */
+static int trx_ctrl_cmd(struct trx_instance *trx, int critical,
+	const char *cmd, const char *fmt, ...)
+{
+	struct trx_ctrl_msg *tcm;
+	int len, pending = 0;
+	va_list ap;
+
+	/* TODO: make sure that transceiver online */
+
+	if (!llist_empty(&trx->trx_ctrl_list))
+		pending = 1;
+
+	/* Allocate a message */
+	tcm = talloc_zero(trx, struct trx_ctrl_msg);
+	if (!tcm)
+		return -ENOMEM;
+
+	/* Fill in command arguments */
+	if (fmt && fmt[0]) {
+		len = snprintf(tcm->cmd, sizeof(tcm->cmd) - 1, "CMD %s ", cmd);
+		va_start(ap, fmt);
+		vsnprintf(tcm->cmd + len, sizeof(tcm->cmd) - len - 1, fmt, ap);
+		va_end(ap);
+	} else {
+		snprintf(tcm->cmd, sizeof(tcm->cmd) - 1, "CMD %s", cmd);
+	}
+
+	tcm->cmd_len = strlen(cmd);
+	tcm->critical = critical;
+	llist_add_tail(&tcm->list, &trx->trx_ctrl_list);
+	LOGP(DTRX, LOGL_INFO, "Adding new control '%s'\n", tcm->cmd);
+
+	/* Send message, if no pending messages */
+	if (!pending)
+		trx_ctrl_send(trx);
+
+	return 0;
+}
+
+/*
+ * Power Control
+ *
+ * ECHO is used to check transceiver availability.
+ * CMD ECHO
+ * RSP ECHO <status>
+ *
+ * POWEROFF shuts off transmitter power and stops the demodulator.
+ * CMD POWEROFF
+ * RSP POWEROFF <status>
+ *
+ * POWERON starts the transmitter and starts the demodulator.
+ * Initial power level is very low.
+ * This command fails if the transmitter and receiver are not yet tuned.
+ * This command fails if the transmit or receive frequency creates a conflict
+ * with another ARFCN that is already running.
+ * If the transceiver is already on, it response with success to this command.
+ * CMD POWERON
+ * RSP POWERON <status>
+ */
+
+int trx_if_cmd_echo(struct trx_instance *trx)
+{
+	return trx_ctrl_cmd(trx, 1, "ECHO", "");
+}
+
+int trx_if_cmd_poweroff(struct trx_instance *trx)
+{
+	return trx_ctrl_cmd(trx, 1, "POWEROFF", "");
+}
+
+int trx_if_cmd_poweron(struct trx_instance *trx)
+{
+	return trx_ctrl_cmd(trx, 1, "POWERON", "");
+}
+
+/*
+ * Timeslot Control
+ *
+ * SETSLOT sets the format of the uplink timeslots in the ARFCN.
+ * The <timeslot> indicates the timeslot of interest.
+ * The <chantype> indicates the type of channel that occupies the timeslot.
+ * A chantype of zero indicates the timeslot is off.
+ * CMD SETSLOT <timeslot> <chantype>
+ * RSP SETSLOT <status> <timeslot> <chantype>
+ */
+
+int trx_if_cmd_setslot(struct trx_instance *trx, uint8_t tn, uint8_t type)
+{
+	return trx_ctrl_cmd(trx, 1, "SETSLOT", "%u %u", tn, type);
+}
+
+/*
+ * Tuning Control
+ *
+ * (RX/TX)TUNE tunes the receiver to a given frequency in kHz.
+ * This command fails if the receiver is already running.
+ * (To re-tune you stop the radio, re-tune, and restart.)
+ * This command fails if the transmit or receive frequency
+ * creates a conflict with another ARFCN that is already running.
+ * CMD (RX/TX)TUNE <kHz>
+ * RSP (RX/TX)TUNE <status> <kHz>
+ */
+
+int trx_if_cmd_rxtune(struct trx_instance *trx, uint16_t band_arfcn)
+{
+	uint16_t freq10;
+
+	/* RX is downlink on MS side */
+	freq10 = gsm_arfcn2freq10(band_arfcn, 0);
+	if (freq10 == 0xffff) {
+		LOGP(DTRX, LOGL_ERROR, "ARFCN %d not defined\n", band_arfcn);
+		return -ENOTSUP;
+	}
+
+	return trx_ctrl_cmd(trx, 1, "RXTUNE", "%u", freq10 * 100);
+}
+
+int trx_if_cmd_txtune(struct trx_instance *trx, uint16_t band_arfcn)
+{
+	uint16_t freq10;
+
+	/* TX is uplink on MS side */
+	freq10 = gsm_arfcn2freq10(band_arfcn, 1);
+	if (freq10 == 0xffff) {
+		LOGP(DTRX, LOGL_ERROR, "ARFCN %d not defined\n", band_arfcn);
+		return -ENOTSUP;
+	}
+
+	return trx_ctrl_cmd(trx, 1, "TXTUNE", "%u", freq10 * 100);
+}
+
+/*
+ * Power measurement
+ *
+ * MEASURE instructs the transceiver to perform a power
+ * measurement on specified frequency. After receiving this
+ * request, transceiver should quickly re-tune to requested
+ * frequency, measure power level and re-tune back to the
+ * previous frequency.
+ * CMD MEASURE <kHz>
+ * RSP MEASURE <status> <kHz> <dB>
+ */
+
+int trx_if_cmd_measure(struct trx_instance *trx,
+	uint16_t band_arfcn_start, uint16_t band_arfcn_stop)
+{
+	uint16_t freq10;
+
+	/* Update ARFCN range for measurement */
+	trx->pm_band_arfcn_start = band_arfcn_start;
+	trx->pm_band_arfcn_stop = band_arfcn_stop;
+
+	/* Calculate a frequency for current ARFCN (DL) */
+	freq10 = gsm_arfcn2freq10(band_arfcn_start, 0);
+	if (freq10 == 0xffff) {
+		LOGP(DTRX, LOGL_ERROR, "ARFCN %d not defined\n", band_arfcn_start);
+		return -ENOTSUP;
+	}
+
+	return trx_ctrl_cmd(trx, 1, "MEASURE", "%u", freq10 * 100);
+}
+
+static void trx_if_measure_rsp_cb(struct trx_instance *trx, char *resp)
+{
+	unsigned int freq10;
+	uint16_t band_arfcn;
+	int dbm;
+
+	/* Parse freq. and power level */
+	sscanf(resp, "%u %d", &freq10, &dbm);
+	freq10 /= 100;
+
+	/* Check received ARFCN against expected */
+	band_arfcn = gsm_freq102arfcn((uint16_t) freq10, 0);
+	if (band_arfcn != trx->pm_band_arfcn_start) {
+		LOGP(DTRX, LOGL_ERROR, "Power measurement error: "
+			"response ARFCN=%u doesn't match expected ARFCN=%u\n",
+			band_arfcn &~ ARFCN_FLAG_MASK,
+			trx->pm_band_arfcn_start &~ ARFCN_FLAG_MASK);
+		return;
+	}
+
+	/* Send L1CTL_PM_CONF */
+	l1ctl_tx_pm_conf(trx->l1l, band_arfcn, dbm,
+		band_arfcn == trx->pm_band_arfcn_stop);
+
+	/* Schedule a next measurement */
+	if (band_arfcn != trx->pm_band_arfcn_stop)
+		trx_if_cmd_measure(trx, ++band_arfcn, trx->pm_band_arfcn_stop);
+}
+
+/*
+ * Timing Advance control
+ *
+ * SETTA instructs the transceiver to transmit bursts in
+ * advance calculated from requested TA value. This value is
+ * normally between 0 and 63, with each step representing
+ * an advance of one bit period (about 3.69 microseconds).
+ * Since OsmocomBB has a special feature, which allows one
+ * to spoof the distance from BTS, the range is extended.
+ * CMD SETTA <-128..127>
+ * RSP SETTA <status> <TA>
+ */
+
+int trx_if_cmd_setta(struct trx_instance *trx, int8_t ta)
+{
+	return trx_ctrl_cmd(trx, 0, "SETTA", "%d", ta);
+}
+
+/* Get response from CTRL socket */
+static int trx_ctrl_read_cb(struct osmo_fd *ofd, unsigned int what)
+{
+	struct trx_instance *trx = ofd->data;
+	struct trx_ctrl_msg *tcm;
+	int len, resp, rsp_len;
+	char buf[1500], *p;
+
+	len = recv(ofd->fd, buf, sizeof(buf) - 1, 0);
+	if (len <= 0)
+		return len;
+	buf[len] = '\0';
+
+	if (!!strncmp(buf, "RSP ", 4)) {
+		LOGP(DTRX, LOGL_NOTICE, "Unknown message on CTRL port: %s\n", buf);
+		return 0;
+	}
+
+	/* Calculate the length of response item */
+	p = strchr(buf + 4, ' ');
+	rsp_len = p ? p - buf - 4 : strlen(buf) - 4;
+
+	LOGP(DTRX, LOGL_INFO, "Response message: '%s'\n", buf);
+
+	/* Abort expire timer */
+	if (osmo_timer_pending(&trx->trx_ctrl_timer))
+		osmo_timer_del(&trx->trx_ctrl_timer);
+
+	/* Get command for response message */
+	if (llist_empty(&trx->trx_ctrl_list)) {
+		LOGP(DTRX, LOGL_NOTICE, "Response message without command\n");
+		return -EINVAL;
+	}
+
+	tcm = llist_entry(trx->trx_ctrl_list.next,
+		struct trx_ctrl_msg, list);
+
+	/* Check if response matches command */
+	if (!!strncmp(buf + 4, tcm->cmd + 4, rsp_len)) {
+		LOGP(DTRX, (tcm->critical) ? LOGL_FATAL : LOGL_ERROR,
+			"Response message '%s' does not match command "
+			"message '%s'\n", buf, tcm->cmd);
+		goto rsp_error;
+	}
+
+	/* Check for response code */
+	sscanf(p + 1, "%d", &resp);
+	if (resp) {
+		LOGP(DTRX, (tcm->critical) ? LOGL_FATAL : LOGL_ERROR,
+			"Transceiver rejected TRX command with "
+			"response: '%s'\n", buf);
+
+		if (tcm->critical)
+			goto rsp_error;
+	}
+
+	/* Trigger state machine */
+	if (!strncmp(tcm->cmd + 4, "POWERON", 7))
+		osmo_fsm_inst_state_chg(trx->fsm, TRX_STATE_ACTIVE, 0, 0);
+	else if (!strncmp(tcm->cmd + 4, "POWEROFF", 8))
+		osmo_fsm_inst_state_chg(trx->fsm, TRX_STATE_IDLE, 0, 0);
+	else if (!strncmp(tcm->cmd + 4, "MEASURE", 7))
+		trx_if_measure_rsp_cb(trx, buf + 14);
+	else if (!strncmp(tcm->cmd + 4, "ECHO", 4))
+		osmo_fsm_inst_state_chg(trx->fsm, TRX_STATE_IDLE, 0, 0);
+	else
+		osmo_fsm_inst_state_chg(trx->fsm, trx->prev_state, 0, 0);
+
+	/* Remove command from list */
+	llist_del(&tcm->list);
+	talloc_free(tcm);
+
+	/* Send next message, if any */
+	trx_ctrl_send(trx);
+
+	return 0;
+
+rsp_error:
+	/* Notify higher layers about the problem */
+	osmo_fsm_inst_dispatch(trxcon_fsm, TRX_EVENT_RSP_ERROR, trx);
+	return -EIO;
+}
+
+/* ------------------------------------------------------------------------ */
+/* Data interface handlers                                                  */
+/* ------------------------------------------------------------------------ */
+/* DATA interface                                                           */
+/*                                                                          */
+/* Messages on the data interface carry one radio burst per UDP message.    */
+/*                                                                          */
+/* Received Data Burst:                                                     */
+/* 1 byte timeslot index                                                    */
+/* 4 bytes GSM frame number, BE                                             */
+/* 1 byte RSSI in -dBm                                                      */
+/* 2 bytes correlator timing offset in 1/256 symbol steps, 2's-comp, BE     */
+/* 148 bytes soft symbol estimates, 0 -> definite "0", 255 -> definite "1"  */
+/* 2 bytes are not used, but being sent by OsmoTRX                          */
+/*                                                                          */
+/* Transmit Data Burst:                                                     */
+/* 1 byte timeslot index                                                    */
+/* 4 bytes GSM frame number, BE                                             */
+/* 1 byte transmit level wrt ARFCN max, -dB (attenuation)                   */
+/* 148 bytes output symbol values, 0 & 1                                    */
+/* ------------------------------------------------------------------------ */
+
+static int trx_data_rx_cb(struct osmo_fd *ofd, unsigned int what)
+{
+	struct trx_instance *trx = ofd->data;
+	uint8_t buf[256];
+	sbit_t bits[148];
+	int8_t rssi, tn;
+	int16_t toa256;
+	uint32_t fn;
+	int len;
+
+	len = recv(ofd->fd, buf, sizeof(buf), 0);
+	if (len <= 0)
+		return len;
+
+	if (len != 158) {
+		LOGP(DTRXD, LOGL_ERROR, "Got data message with invalid "
+			"length '%d'\n", len);
+		return -EINVAL;
+	}
+
+	tn = buf[0];
+	fn = (buf[1] << 24) | (buf[2] << 16) | (buf[3] << 8) | buf[4];
+	rssi = -(int8_t) buf[5];
+	toa256 = ((int16_t) (buf[6] << 8) | buf[7]);
+
+	/* Copy and convert bits {254..0} to sbits {-127..127} */
+	osmo_ubit2sbit(bits, buf + 8, 148);
+
+	if (tn >= 8) {
+		LOGP(DTRXD, LOGL_ERROR, "Illegal TS %d\n", tn);
+		return -EINVAL;
+	}
+
+	if (fn >= 2715648) {
+		LOGP(DTRXD, LOGL_ERROR, "Illegal FN %u\n", fn);
+		return -EINVAL;
+	}
+
+	LOGP(DTRXD, LOGL_DEBUG, "RX burst tn=%u fn=%u rssi=%d toa=%d\n",
+		tn, fn, rssi, toa256);
+
+	/* Poke scheduler */
+	sched_trx_handle_rx_burst(trx, tn, fn, bits, 148, rssi, toa256);
+
+	/* Correct local clock counter */
+	if (fn % 51 == 0)
+		sched_clck_handle(&trx->sched, fn);
+
+	return 0;
+}
+
+int trx_if_tx_burst(struct trx_instance *trx, uint8_t tn, uint32_t fn,
+	uint8_t pwr, const ubit_t *bits)
+{
+	uint8_t buf[256];
+
+	/**
+	 * We must be sure that we have clock,
+	 * and we have sent all control data
+	 *
+	 * TODO: should we wait in TRX_STATE_RSP_WAIT state?
+	 */
+	if (trx->fsm->state != TRX_STATE_ACTIVE) {
+		LOGP(DTRXD, LOGL_DEBUG, "Ignoring TX data, "
+			"transceiver isn't ready\n");
+		return -EAGAIN;
+	}
+
+	LOGP(DTRXD, LOGL_DEBUG, "TX burst tn=%u fn=%u pwr=%u\n", tn, fn, pwr);
+
+	buf[0] = tn;
+	buf[1] = (fn >> 24) & 0xff;
+	buf[2] = (fn >> 16) & 0xff;
+	buf[3] = (fn >>  8) & 0xff;
+	buf[4] = (fn >>  0) & 0xff;
+	buf[5] = pwr;
+
+	/* Copy ubits {0,1} */
+	memcpy(buf + 6, bits, 148);
+
+	/* Send data to transceiver */
+	send(trx->trx_ofd_data.fd, buf, 154, 0);
+
+	return 0;
+}
+
+/*
+ * Open/close OsmoTRX connection
+ */
+
+int trx_if_open(struct trx_instance **trx, const char *local_host,
+		const char *remote_host, uint16_t port)
+{
+	struct trx_instance *trx_new;
+	int rc;
+
+	LOGP(DTRX, LOGL_NOTICE, "Init transceiver interface\n");
+
+	/* Try to allocate memory */
+	trx_new = talloc_zero(tall_trx_ctx, struct trx_instance);
+	if (!trx_new) {
+		LOGP(DTRX, LOGL_ERROR, "Failed to allocate memory\n");
+		return -ENOMEM;
+	}
+
+	/* Initialize CTRL queue */
+	INIT_LLIST_HEAD(&trx_new->trx_ctrl_list);
+
+	/* Open sockets */
+	rc = trx_udp_open(trx_new, &trx_new->trx_ofd_ctrl, local_host,
+		port + 101, remote_host, port + 1, trx_ctrl_read_cb);
+	if (rc < 0)
+		goto error;
+
+	rc = trx_udp_open(trx_new, &trx_new->trx_ofd_data, local_host,
+		port + 102, remote_host, port + 2, trx_data_rx_cb);
+	if (rc < 0)
+		goto error;
+
+	/* Allocate a new dedicated state machine */
+	osmo_fsm_register(&trx_fsm);
+	trx_new->fsm = osmo_fsm_inst_alloc(&trx_fsm, trx_new,
+		NULL, LOGL_DEBUG, "trx_interface");
+
+	*trx = trx_new;
+
+	return 0;
+
+error:
+	LOGP(DTRX, LOGL_ERROR, "Couldn't establish UDP connection\n");
+	talloc_free(trx_new);
+	return rc;
+}
+
+/* Flush pending control messages */
+void trx_if_flush_ctrl(struct trx_instance *trx)
+{
+	struct trx_ctrl_msg *tcm;
+
+	/* Reset state machine */
+	osmo_fsm_inst_state_chg(trx->fsm, TRX_STATE_IDLE, 0, 0);
+
+	/* Clear command queue */
+	while (!llist_empty(&trx->trx_ctrl_list)) {
+		tcm = llist_entry(trx->trx_ctrl_list.next,
+			struct trx_ctrl_msg, list);
+		llist_del(&tcm->list);
+		talloc_free(tcm);
+	}
+}
+
+void trx_if_close(struct trx_instance *trx)
+{
+	/* May be unallocated due to init error */
+	if (!trx)
+		return;
+
+	LOGP(DTRX, LOGL_NOTICE, "Shutdown transceiver interface\n");
+
+	/* Flush CTRL message list */
+	trx_if_flush_ctrl(trx);
+
+	/* Close sockets */
+	trx_udp_close(&trx->trx_ofd_ctrl);
+	trx_udp_close(&trx->trx_ofd_data);
+
+	/* Free memory */
+	osmo_fsm_inst_free(trx->fsm);
+	talloc_free(trx);
+}
diff --git a/src/host/trxcon/trx_if.h b/src/host/trxcon/trx_if.h
new file mode 100644
index 00000000..be0d41a6
--- /dev/null
+++ b/src/host/trxcon/trx_if.h
@@ -0,0 +1,75 @@
+#pragma once
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/fsm.h>
+
+#include "scheduler.h"
+#include "sched_trx.h"
+
+/* Forward declaration to avoid mutual include */
+struct l1ctl_link;
+
+enum trx_fsm_states {
+	TRX_STATE_OFFLINE = 0,
+	TRX_STATE_IDLE,
+	TRX_STATE_ACTIVE,
+	TRX_STATE_RSP_WAIT,
+};
+
+struct trx_instance {
+	struct osmo_fd trx_ofd_ctrl;
+	struct osmo_fd trx_ofd_data;
+
+	struct osmo_timer_list trx_ctrl_timer;
+	struct llist_head trx_ctrl_list;
+	struct osmo_fsm_inst *fsm;
+	uint32_t prev_state;
+
+	/* GSM L1 specific */
+	uint16_t pm_band_arfcn_start;
+	uint16_t pm_band_arfcn_stop;
+	uint16_t band_arfcn;
+	uint8_t tx_power;
+	uint8_t bsic;
+	uint8_t tsc;
+	int8_t ta;
+
+	/* Scheduler stuff */
+	struct trx_sched sched;
+	struct trx_ts *ts_list[TRX_TS_COUNT];
+
+	/* Bind L1CTL link */
+	struct l1ctl_link *l1l;
+};
+
+struct trx_ctrl_msg {
+	struct llist_head list;
+	char cmd[128];
+	int retry_cnt;
+	int critical;
+	int cmd_len;
+};
+
+int trx_if_open(struct trx_instance **trx, const char *local_host,
+		const char *remote_host, uint16_t port);
+void trx_if_flush_ctrl(struct trx_instance *trx);
+void trx_if_close(struct trx_instance *trx);
+
+int trx_if_cmd_poweron(struct trx_instance *trx);
+int trx_if_cmd_poweroff(struct trx_instance *trx);
+int trx_if_cmd_echo(struct trx_instance *trx);
+
+int trx_if_cmd_setta(struct trx_instance *trx, int8_t ta);
+
+int trx_if_cmd_rxtune(struct trx_instance *trx, uint16_t band_arfcn);
+int trx_if_cmd_txtune(struct trx_instance *trx, uint16_t band_arfcn);
+
+int trx_if_cmd_setslot(struct trx_instance *trx, uint8_t tn, uint8_t type);
+
+int trx_if_cmd_measure(struct trx_instance *trx,
+	uint16_t band_arfcn_start, uint16_t band_arfcn_stop);
+
+int trx_if_tx_burst(struct trx_instance *trx, uint8_t tn, uint32_t fn,
+	uint8_t pwr, const ubit_t *bits);
diff --git a/src/host/trxcon/trxcon.c b/src/host/trxcon/trxcon.c
new file mode 100644
index 00000000..251321d2
--- /dev/null
+++ b/src/host/trxcon/trxcon.c
@@ -0,0 +1,341 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ *
+ * (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <getopt.h>
+#include <unistd.h>
+#include <signal.h>
+#include <time.h>
+
+#include <arpa/inet.h>
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/application.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+
+#include "trxcon.h"
+#include "trx_if.h"
+#include "logging.h"
+#include "l1ctl.h"
+#include "l1ctl_link.h"
+#include "l1ctl_proto.h"
+#include "scheduler.h"
+#include "sched_trx.h"
+
+#define COPYRIGHT \
+	"Copyright (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>\n" \
+	"License GPLv2+: GNU GPL version 2 or later " \
+	"<http://gnu.org/licenses/gpl.html>\n" \
+	"This is free software: you are free to change and redistribute it.\n" \
+	"There is NO WARRANTY, to the extent permitted by law.\n\n"
+
+static struct {
+	const char *debug_mask;
+	int daemonize;
+	int quit;
+
+	/* L1CTL specific */
+	struct l1ctl_link *l1l;
+	const char *bind_socket;
+
+	/* TRX specific */
+	struct trx_instance *trx;
+	const char *trx_bind_ip;
+	const char *trx_remote_ip;
+	uint16_t trx_base_port;
+	uint32_t trx_fn_advance;
+} app_data;
+
+void *tall_trx_ctx = NULL;
+struct osmo_fsm_inst *trxcon_fsm;
+
+static void trxcon_fsm_idle_action(struct osmo_fsm_inst *fi,
+	uint32_t event, void *data)
+{
+	if (event == L1CTL_EVENT_CONNECT)
+		osmo_fsm_inst_state_chg(trxcon_fsm, TRXCON_STATE_MANAGED, 0, 0);
+}
+
+static void trxcon_fsm_managed_action(struct osmo_fsm_inst *fi,
+	uint32_t event, void *data)
+{
+	switch (event) {
+	case L1CTL_EVENT_DISCONNECT:
+		osmo_fsm_inst_state_chg(trxcon_fsm, TRXCON_STATE_IDLE, 0, 0);
+
+		if (app_data.trx->fsm->state != TRX_STATE_OFFLINE) {
+			/* Reset scheduler and clock counter */
+			sched_trx_reset(app_data.trx, 1);
+
+			/* TODO: implement trx_if_reset() */
+			trx_if_cmd_poweroff(app_data.trx);
+			trx_if_cmd_echo(app_data.trx);
+		}
+		break;
+	case TRX_EVENT_RSP_ERROR:
+	case TRX_EVENT_OFFLINE:
+		/* TODO: notify L2 & L3 about that */
+		break;
+	default:
+		LOGPFSML(fi, LOGL_ERROR, "Unhandled event %u\n", event);
+	}
+}
+
+static struct osmo_fsm_state trxcon_fsm_states[] = {
+	[TRXCON_STATE_IDLE] = {
+		.in_event_mask = GEN_MASK(L1CTL_EVENT_CONNECT),
+		.out_state_mask = GEN_MASK(TRXCON_STATE_MANAGED),
+		.name = "IDLE",
+		.action = trxcon_fsm_idle_action,
+	},
+	[TRXCON_STATE_MANAGED] = {
+		.in_event_mask = (
+			GEN_MASK(L1CTL_EVENT_DISCONNECT) |
+			GEN_MASK(TRX_EVENT_RSP_ERROR) |
+			GEN_MASK(TRX_EVENT_OFFLINE)),
+		.out_state_mask = GEN_MASK(TRXCON_STATE_IDLE),
+		.name = "MANAGED",
+		.action = trxcon_fsm_managed_action,
+	},
+};
+
+static const struct value_string app_evt_names[] = {
+	OSMO_VALUE_STRING(L1CTL_EVENT_CONNECT),
+	OSMO_VALUE_STRING(L1CTL_EVENT_DISCONNECT),
+	OSMO_VALUE_STRING(TRX_EVENT_OFFLINE),
+	OSMO_VALUE_STRING(TRX_EVENT_RSP_ERROR),
+	{ 0, NULL }
+};
+
+static struct osmo_fsm trxcon_fsm_def = {
+	.name = "trxcon_app_fsm",
+	.states = trxcon_fsm_states,
+	.num_states = ARRAY_SIZE(trxcon_fsm_states),
+	.log_subsys = DAPP,
+	.event_names = app_evt_names,
+};
+
+static void print_usage(const char *app)
+{
+	printf("Usage: %s\n", app);
+}
+
+static void print_help(void)
+{
+	printf(" Some help...\n");
+	printf("  -h --help         this text\n");
+	printf("  -d --debug        Change debug flags. Default: %s\n", DEBUG_DEFAULT);
+	printf("  -b --trx-bind     TRX bind IP address (default 0.0.0.0)\n");
+	printf("  -i --trx-remote   TRX remote IP address (default 127.0.0.1)\n");
+	printf("  -p --trx-port     Base port of TRX instance (default 6700)\n");
+	printf("  -f --trx-advance  Scheduler clock advance (default 20)\n");
+	printf("  -s --socket       Listening socket for layer23 (default /tmp/osmocom_l2)\n");
+	printf("  -D --daemonize    Run as daemon\n");
+}
+
+static void handle_options(int argc, char **argv)
+{
+	while (1) {
+		int option_index = 0, c;
+		static struct option long_options[] = {
+			{"help", 0, 0, 'h'},
+			{"debug", 1, 0, 'd'},
+			{"socket", 1, 0, 's'},
+			{"trx-bind", 1, 0, 'b'},
+			/* NOTE: 'trx-ip' is now an alias for 'trx-remote'
+			 * due to backward compatibility reasons! */
+			{"trx-ip", 1, 0, 'i'},
+			{"trx-remote", 1, 0, 'i'},
+			{"trx-port", 1, 0, 'p'},
+			{"trx-advance", 1, 0, 'f'},
+			{"daemonize", 0, 0, 'D'},
+			{0, 0, 0, 0}
+		};
+
+		c = getopt_long(argc, argv, "d:b:i:p:f:s:Dh",
+				long_options, &option_index);
+		if (c == -1)
+			break;
+
+		switch (c) {
+		case 'h':
+			print_usage(argv[0]);
+			print_help();
+			exit(0);
+			break;
+		case 'd':
+			app_data.debug_mask = optarg;
+			break;
+		case 'b':
+			app_data.trx_bind_ip = optarg;
+			break;
+		case 'i':
+			app_data.trx_remote_ip = optarg;
+			break;
+		case 'p':
+			app_data.trx_base_port = atoi(optarg);
+			break;
+		case 'f':
+			app_data.trx_fn_advance = atoi(optarg);
+			break;
+		case 's':
+			app_data.bind_socket = optarg;
+			break;
+		case 'D':
+			app_data.daemonize = 1;
+			break;
+		default:
+			break;
+		}
+	}
+}
+
+static void init_defaults(void)
+{
+	app_data.bind_socket = "/tmp/osmocom_l2";
+	app_data.trx_remote_ip = "127.0.0.1";
+	app_data.trx_bind_ip = "0.0.0.0";
+	app_data.trx_base_port = 6700;
+	app_data.trx_fn_advance = 20;
+
+	app_data.debug_mask = NULL;
+	app_data.daemonize = 0;
+	app_data.quit = 0;
+}
+
+static void signal_handler(int signal)
+{
+	fprintf(stderr, "signal %u received\n", signal);
+
+	switch (signal) {
+	case SIGINT:
+		app_data.quit++;
+		break;
+	case SIGABRT:
+	case SIGUSR1:
+	case SIGUSR2:
+		talloc_report_full(tall_trx_ctx, stderr);
+		break;
+	default:
+		break;
+	}
+}
+
+int main(int argc, char **argv)
+{
+	int rc = 0;
+
+	printf("%s", COPYRIGHT);
+	init_defaults();
+	handle_options(argc, argv);
+
+	/* Track the use of talloc NULL memory contexts */
+	talloc_enable_null_tracking();
+
+	/* Init talloc memory management system */
+	tall_trx_ctx = talloc_init("trxcon context");
+	msgb_talloc_ctx_init(tall_trx_ctx, 0);
+
+	/* Setup signal handlers */
+	signal(SIGINT, &signal_handler);
+	signal(SIGUSR1, &signal_handler);
+	signal(SIGUSR2, &signal_handler);
+	osmo_init_ignore_signals();
+
+	/* Init logging system */
+	trx_log_init(app_data.debug_mask);
+
+	/* Allocate the application state machine */
+	osmo_fsm_register(&trxcon_fsm_def);
+	trxcon_fsm = osmo_fsm_inst_alloc(&trxcon_fsm_def, tall_trx_ctx,
+		NULL, LOGL_DEBUG, "main");
+
+	/* Init L1CTL server */
+	rc = l1ctl_link_init(&app_data.l1l, app_data.bind_socket);
+	if (rc)
+		goto exit;
+
+	/* Init transceiver interface */
+	rc = trx_if_open(&app_data.trx,
+		app_data.trx_bind_ip, app_data.trx_remote_ip, app_data.trx_base_port);
+	if (rc)
+		goto exit;
+
+	/* Bind L1CTL with TRX and vice versa */
+	app_data.l1l->trx = app_data.trx;
+	app_data.trx->l1l = app_data.l1l;
+
+	/* Init scheduler */
+	rc = sched_trx_init(app_data.trx, app_data.trx_fn_advance);
+	if (rc)
+		goto exit;
+
+	LOGP(DAPP, LOGL_NOTICE, "Init complete\n");
+
+	if (app_data.daemonize) {
+		rc = osmo_daemonize();
+		if (rc < 0) {
+			perror("Error during daemonize");
+			goto exit;
+		}
+	}
+
+	/* Initialize pseudo-random generator */
+	srand(time(NULL));
+
+	while (!app_data.quit)
+		osmo_select_main(0);
+
+exit:
+	/* Close active connections */
+	l1ctl_link_shutdown(app_data.l1l);
+	sched_trx_shutdown(app_data.trx);
+	trx_if_close(app_data.trx);
+
+	/* Shutdown main state machine */
+	osmo_fsm_inst_free(trxcon_fsm);
+
+	/* Deinitialize logging */
+	log_fini();
+
+	/**
+	 * Print report for the root talloc context in order
+	 * to be able to find and fix potential memory leaks.
+	 */
+	talloc_report_full(tall_trx_ctx, stderr);
+	talloc_free(tall_trx_ctx);
+
+	/* Make both Valgrind and ASAN happy */
+	talloc_report_full(NULL, stderr);
+	talloc_disable_null_tracking();
+
+	return rc;
+}
diff --git a/src/host/trxcon/trxcon.h b/src/host/trxcon/trxcon.h
new file mode 100644
index 00000000..65b5e85d
--- /dev/null
+++ b/src/host/trxcon/trxcon.h
@@ -0,0 +1,21 @@
+#pragma once
+
+#define GEN_MASK(state) (0x01 << state)
+
+extern struct osmo_fsm_inst *trxcon_fsm;
+extern void *tall_trx_ctx;
+
+enum trxcon_fsm_states {
+	TRXCON_STATE_IDLE = 0,
+	TRXCON_STATE_MANAGED,
+};
+
+enum trxcon_fsm_events {
+	/* L1CTL specific events */
+	L1CTL_EVENT_CONNECT,
+	L1CTL_EVENT_DISCONNECT,
+
+	/* TRX specific events */
+	TRX_EVENT_RSP_ERROR,
+	TRX_EVENT_OFFLINE,
+};
diff --git a/src/host/virt_phy/.gitignore b/src/host/virt_phy/.gitignore
new file mode 100644
index 00000000..b9a2ca77
--- /dev/null
+++ b/src/host/virt_phy/.gitignore
@@ -0,0 +1,5 @@
+Makefile
+config.h
+config.h.in
+src/virtphy
+.dirstamp
diff --git a/src/host/virt_phy/Makefile.am b/src/host/virt_phy/Makefile.am
new file mode 100644
index 00000000..629ce0f7
--- /dev/null
+++ b/src/host/virt_phy/Makefile.am
@@ -0,0 +1,2 @@
+SUBDIRS = include src
+dist_doc_DATA = README
diff --git a/src/host/virt_phy/README b/src/host/virt_phy/README
new file mode 100644
index 00000000..a7806647
--- /dev/null
+++ b/src/host/virt_phy/README
@@ -0,0 +1,2 @@
+This is the package for the Osmocom virtual physical layer.
+A layer 1 implementation satisfying the L1CTL interface towards the l23 application (e.g. mobile).
\ No newline at end of file
diff --git a/src/host/virt_phy/configure.ac b/src/host/virt_phy/configure.ac
new file mode 100644
index 00000000..c8012c99
--- /dev/null
+++ b/src/host/virt_phy/configure.ac
@@ -0,0 +1,28 @@
+dnl Process this file with autoconf to produce a configure script
+AC_INIT([virtphy], 0.0.0)
+AM_CONFIG_HEADER([config.h])
+AM_INIT_AUTOMAKE([foreign dist-bzip2 subdir-objects])
+
+dnl kernel style compile messages
+m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+
+dnl checks for programs
+AC_PROG_MAKE_SET
+AC_PROG_CC
+AC_PROG_INSTALL
+
+dnl checks for libraries
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore)
+PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm)
+
+dnl checks for header files
+AC_HEADER_STDC
+
+dnl Checks for typedefs, structures and compiler characteristics
+
+AC_CONFIG_FILES([
+ Makefile
+ include/Makefile
+ src/Makefile
+])
+AC_OUTPUT
diff --git a/src/host/virt_phy/include/Makefile.am b/src/host/virt_phy/include/Makefile.am
new file mode 100644
index 00000000..6048a4b3
--- /dev/null
+++ b/src/host/virt_phy/include/Makefile.am
@@ -0,0 +1,10 @@
+noinst_HEADERS = \
+	virtphy/logging.h \
+	virtphy/osmo_mcast_sock.h \
+	virtphy/l1ctl_sock.h \
+	virtphy/virtual_um.h \
+	virtphy/gsmtapl1_if.h \
+	virtphy/virt_l1_sched.h \
+	virtphy/common_util.h \
+	virtphy/l1ctl_sap.h \
+	virtphy/virt_l1_model.h
diff --git a/src/host/virt_phy/include/virtphy/common_util.h b/src/host/virt_phy/include/virtphy/common_util.h
new file mode 100644
index 00000000..2585d069
--- /dev/null
+++ b/src/host/virt_phy/include/virtphy/common_util.h
@@ -0,0 +1,11 @@
+/*
+ * Utility function used both in osmo bts virt and osmocom bb virt.
+ */
+
+#pragma once
+
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/gsm/rsl.h>
+
+#define LID_SACCH 		0x40
+#define LID_DEDIC 		0x00
diff --git a/src/host/virt_phy/include/virtphy/gsmtapl1_if.h b/src/host/virt_phy/include/virtphy/gsmtapl1_if.h
new file mode 100644
index 00000000..8dab6b28
--- /dev/null
+++ b/src/host/virt_phy/include/virtphy/gsmtapl1_if.h
@@ -0,0 +1,12 @@
+#pragma once
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/gsmtap.h>
+#include <virtphy/virtual_um.h>
+#include <virtphy/l1ctl_sock.h>
+#include <virtphy/virt_l1_model.h>
+
+void gsmtapl1_init(struct l1_model_ms *model);
+void gsmtapl1_rx_from_virt_um_inst_cb(struct virt_um_inst *vui,
+                                      struct msgb *msg);
+void gsmtapl1_tx_to_virt_um_inst(struct l1_model_ms *ms, uint32_t fn, uint8_t tn, struct msgb *msg);
diff --git a/src/host/virt_phy/include/virtphy/l1ctl_sap.h b/src/host/virt_phy/include/virtphy/l1ctl_sap.h
new file mode 100644
index 00000000..94174da4
--- /dev/null
+++ b/src/host/virt_phy/include/virtphy/l1ctl_sap.h
@@ -0,0 +1,80 @@
+#pragma once
+
+#include <stdint.h>
+#include <osmocom/core/msgb.h>
+#include <l1ctl_proto.h>
+#include <virtphy/virtual_um.h>
+#include <virtphy/l1ctl_sock.h>
+#include <virtphy/virt_l1_model.h>
+
+/* following sizes are used for message allocation */
+/* size of layer 3 header */
+#define L3_MSG_HEAD 4
+/* size of layer 3 payload */
+#define L3_MSG_DATA 200
+#define L3_MSG_SIZE (sizeof(struct l1ctl_hdr) + L3_MSG_HEAD + L3_MSG_DATA)
+
+/* lchan link ID */
+#define LID_SACCH 		0x40
+#define LID_DEDIC 		0x00
+
+/* signature strengths for the ms */
+#define MIN_SIG_LEV_DBM -110
+#define MAX_SIG_LEV_DBM -63
+
+/* Ignore all flags of the arfcn */
+#define ARFCN_NO_FLAGS_MASK 0x0fff
+
+
+void l1ctl_sap_init(struct l1_model_ms *model);
+void l1ctl_sap_exit(struct l1_model_ms *model);
+void prim_pm_init(struct l1_model_ms *model);
+void prim_pm_exit(struct l1_model_ms *model);
+void l1ctl_sap_tx_to_l23_inst(struct l1_model_ms *model, struct msgb *msg);
+void l1ctl_sap_rx_from_l23_inst_cb(struct l1ctl_sock_client *lsc, struct msgb *msg);
+void l1ctl_sap_rx_from_l23(struct msgb *msg);
+void l1ctl_sap_handler(struct l1_model_ms *ms, struct msgb *msg);
+
+/* utility methods */
+struct msgb *l1ctl_msgb_alloc(uint8_t msg_type);
+struct msgb *l1ctl_create_l2_msg(int msg_type, uint32_t fn, uint16_t snr,
+                                 uint16_t arfcn);
+
+/* receive routines */
+void l1ctl_rx_fbsb_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_dm_est_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_dm_rel_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_param_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_dm_freq_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_crypto_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_rach_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_data_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_pm_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_reset_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_ccch_mode_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_tch_mode_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_neigh_pm_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_traffic_req(struct l1_model_ms *, struct msgb *msg);
+void l1ctl_rx_sim_req(struct l1_model_ms *, struct msgb *msg);
+
+/* transmit routines */
+void l1ctl_tx_reset(struct l1_model_ms *, uint8_t msg_type, uint8_t reset_type);
+void l1ctl_tx_rach_conf(struct l1_model_ms *, uint32_t fn, uint16_t arfcn);
+void l1ctl_tx_data_conf(struct l1_model_ms *, uint32_t fn, uint16_t snr, uint16_t arfcn);
+void l1ctl_tx_data_ind(struct l1_model_ms *, struct msgb *msg, uint16_t arfcn, uint8_t link_id,
+                       uint8_t chan_nr, uint32_t fn, uint8_t snr,
+                       uint8_t signal_dbm, uint8_t num_biterr,
+                       uint8_t fire_crc);
+void l1ctl_tx_traffic_conf(struct l1_model_ms *, uint32_t fn, uint16_t snr, uint16_t arfcn);
+void l1ctl_tx_traffic_ind(struct l1_model_ms *, struct msgb *msg, uint16_t arfcn, uint8_t link_id,
+                          uint8_t chan_nr, uint32_t fn, uint8_t snr,
+                          uint8_t signal_dbm, uint8_t num_biterr,
+                          uint8_t fire_crc);
+void l1ctl_tx_pm_conf(struct l1_model_ms *, struct l1ctl_pm_req *pm_req);
+void l1ctl_tx_fbsb_conf(struct l1_model_ms *, uint8_t res, uint16_t arfcn);
+void l1ctl_tx_ccch_mode_conf(struct l1_model_ms *, uint8_t ccch_mode);
+void l1ctl_tx_tch_mode_conf(struct l1_model_ms *, uint8_t tch_mode, uint8_t audio_mode);
+
+/* scheduler functions */
+uint32_t sched_fn_ul(struct gsm_time cur_time, uint8_t chan_nr,
+                     uint8_t link_id);
diff --git a/src/host/virt_phy/include/virtphy/l1ctl_sock.h b/src/host/virt_phy/include/virtphy/l1ctl_sock.h
new file mode 100644
index 00000000..2c98fa58
--- /dev/null
+++ b/src/host/virt_phy/include/virtphy/l1ctl_sock.h
@@ -0,0 +1,53 @@
+#pragma once
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/select.h>
+
+#define L1CTL_SOCK_PATH	"/tmp/osmocom_l2"
+
+struct l1ctl_sock_inst;
+
+struct l1ctl_sock_client {
+	/* list head in l1ctl_sock_inst.clients */
+	struct llist_head list;
+	/* pointer back to the server socket that accepted us */
+	struct l1ctl_sock_inst *l1ctl_sock;
+	/* Osmo FD for the client socket */
+	struct osmo_fd ofd;
+	/* private data, can be set in accept_cb */
+	void *priv;
+};
+
+/* L1CTL socket instance contains socket data. */
+struct l1ctl_sock_inst {
+	void *priv; /* Will be appended after osmo-fd's data pointer. */
+	struct llist_head clients;
+	char* l1ctl_sock_path; /* Socket path used to connect to l23 */
+	struct osmo_fd ofd; /* Osmocom file descriptor to accept L1CTL connections. */
+	void (*recv_cb)(struct l1ctl_sock_client *lsc, struct msgb *msg); /* Callback function called for incoming data from l2 app. */
+	/* Callback function called for new client after accept() */
+	int (*accept_cb)(struct l1ctl_sock_client *lsc);
+	/* Callback function called when client disappeared */
+	void (*close_cb)(struct l1ctl_sock_client *lsc);
+};
+
+/**
+ * @brief Initialise the l1ctl socket for communication with l2 apps.
+ */
+struct l1ctl_sock_inst *l1ctl_sock_init(
+                void *ctx,
+                void (*recv_cb)(struct l1ctl_sock_client *lsc, struct msgb *msg),
+                int (*accept_cb)(struct l1ctl_sock_client *lsc),
+                void (*close_cb)(struct l1ctl_sock_client *lsc),
+                char *path);
+
+/**
+ * @brief Transmit message to l2.
+ */
+int l1ctl_sock_write_msg(struct l1ctl_sock_client *lsc, struct msgb *msg);
+
+/**
+ * @brief Destroy instance.
+ */
+void l1ctl_sock_destroy(struct l1ctl_sock_inst *lsi);
diff --git a/src/host/virt_phy/include/virtphy/logging.h b/src/host/virt_phy/include/virtphy/logging.h
new file mode 100644
index 00000000..b22db992
--- /dev/null
+++ b/src/host/virt_phy/include/virtphy/logging.h
@@ -0,0 +1,19 @@
+#pragma once
+
+#include <osmocom/core/logging.h>
+
+/* L1CTL related messages */
+enum virtphy_log_cat {
+	DL1C,
+	DL1P,
+	DVIRPHY,
+	DMAIN
+};
+
+#define LOGPMS(ss, lvl, ms, fmt, args ...)	LOGP(ss, lvl, "MS %04u: " fmt, ms->nr, ## args)
+#define DEBUGPMS(ss, ms, fmt, args ...)		DEBUGP(ss, "MS %04u: " fmt, ms->nr, ## args)
+
+extern const struct log_info ms_log_info;
+
+int ms_log_init(char *cat_mask);
+const char *getL1ctlPrimName(uint8_t type);
diff --git a/src/host/virt_phy/include/virtphy/osmo_mcast_sock.h b/src/host/virt_phy/include/virtphy/osmo_mcast_sock.h
new file mode 100644
index 00000000..aa2013c6
--- /dev/null
+++ b/src/host/virt_phy/include/virtphy/osmo_mcast_sock.h
@@ -0,0 +1,29 @@
+#pragma once
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <netinet/in.h>
+#include <osmocom/core/select.h>
+
+struct mcast_bidir_sock {
+	struct osmo_fd tx_ofd;
+	struct osmo_fd rx_ofd;
+};
+
+struct mcast_bidir_sock *mcast_bidir_sock_setup(void *ctx,
+                const char *tx_mcast_group, uint16_t tx_mcast_port,
+                const char *rx_mcast_group, uint16_t rx_mcast_port, bool loopback,
+                int (*fd_rx_cb)(struct osmo_fd *ofd, unsigned int what),
+                void *osmo_fd_data);
+
+int mcast_server_sock_setup(struct osmo_fd *ofd, const char *tx_mcast_group,
+			    uint16_t tx_mcast_port, bool loopback);
+
+int mcast_client_sock_setup(struct osmo_fd *ofd, const char *mcast_group, uint16_t mcast_port,
+			    int (*fd_rx_cb)(struct osmo_fd *ofd, unsigned int what),
+			    void *osmo_fd_data);
+
+int mcast_bidir_sock_tx(struct mcast_bidir_sock *bidir_sock, const uint8_t *data, unsigned int data_len);
+int mcast_bidir_sock_rx(struct mcast_bidir_sock *bidir_sock, uint8_t *buf, unsigned int buf_len);
+void mcast_bidir_sock_close(struct mcast_bidir_sock* bidir_sock);
+
diff --git a/src/host/virt_phy/include/virtphy/virt_l1_model.h b/src/host/virt_phy/include/virtphy/virt_l1_model.h
new file mode 100644
index 00000000..67c24bb6
--- /dev/null
+++ b/src/host/virt_phy/include/virtphy/virt_l1_model.h
@@ -0,0 +1,119 @@
+#pragma once
+
+/* Per-MS specific state, closely attached to the L1CTL user progran */
+
+#include <virtphy/virtual_um.h>
+#include <virtphy/l1ctl_sock.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/timer.h>
+
+#define L1S_NUM_NEIGH_CELL	6
+#define A5_KEY_LEN		8
+
+enum ms_state {
+	MS_STATE_IDLE_SEARCHING = 0,
+	MS_STATE_IDLE_SYNCING,
+	MS_STATE_IDLE_CAMPING,
+	MS_STATE_DEDICATED,
+	MS_STATE_TBF
+};
+
+
+/* structure representing L1 sync information about a cell */
+struct l1_cell_info {
+	/* on which ARFCN (+band) is the cell? */
+	uint16_t arfcn;
+	/* what's the BSIC of the cell (from SCH burst decoding) */
+	uint8_t bsic;
+	/* Combined or non-combined CCCH */
+	uint8_t ccch_mode; /* enum ccch_mode */
+	/* whats the delta of the cells current GSM frame number
+	 * compared to our current local frame number */
+	int32_t fn_offset;
+	/* how much does the TPU need adjustment (delta) to synchronize
+	 * with the cells burst */
+	uint32_t time_alignment;
+};
+
+struct crypto_info_ms {
+	/* key is expected in the same format as in RSL
+	 * Encryption information IE. */
+	uint8_t key[A5_KEY_LEN];
+	uint8_t algo;
+};
+
+struct l1_state_ms {
+
+	struct gsm_time	downlink_time;	/* current GSM time received on downlink */
+	struct gsm_time current_time; /* GSM time used internally for scheduling */
+	struct {
+		uint32_t last_exec_fn;
+		struct llist_head mframe_items;
+	} sched;
+
+	enum ms_state state;
+
+	/* the cell on which we are camping right now */
+	struct l1_cell_info serving_cell;
+	/* neighbor cell sync info */
+	struct l1_cell_info neigh_cell[L1S_NUM_NEIGH_CELL];
+	struct crypto_info_ms crypto_inf;
+
+	/* TCH info */
+	uint8_t tch_mode; // see enum gsm48_chan_mode in gsm_04_08.h
+	uint8_t tch_sync; // needed for audio synchronization
+	uint8_t audio_mode; // see l1ctl_proto.h, e.g. AUDIO_TX_MICROPHONE
+
+	/* dedicated channel info */
+	struct {
+		uint8_t chan_type; // like rsl chantype 08.58 -> Chapter 9.3.1 */
+
+		uint8_t tn; // timeslot number 1-7
+		uint8_t subslot; // subslot of the dedicated channel, SDCCH/4:[0-3], SDCCH/8:[0-7]
+
+		uint8_t scn; // single-hop cellular network? (ununsed in virtual um)
+		uint8_t tsc; // training sequence code (ununsed in virtual um)
+		uint8_t h; // hopping enabled flag (ununsed in virtual um)
+	} dedicated;
+	struct {
+		struct {
+			uint8_t usf[8];
+			struct llist_head tx_queue;
+		} ul;
+		struct {
+			uint8_t tfi[8];
+		} dl;
+	} tbf;
+
+	/* fbsb state */
+	struct {
+		uint32_t arfcn;
+	} fbsb;
+
+	/* power management state */
+	struct {
+		uint32_t timeout_us;
+		uint32_t timeout_s;
+		struct {
+			int16_t arfcn_sig_lev_dbm[1024];
+			uint8_t arfcn_sig_lev_red_dbm[1024];
+			struct osmo_timer_list arfcn_sig_lev_timers[1024];
+		} meas;
+	} pm;
+};
+
+struct l1_model_ms {
+	uint32_t nr;
+	/* pointer to the L1CTL socket client associated with this specific MS */
+	struct l1ctl_sock_client *lsc;
+	/* pointer to the (shared) GSMTAP/VirtUM socket to talk to BTS(s) */
+	struct virt_um_inst *vui;
+	/* actual per-MS state */
+	struct l1_state_ms state;
+};
+
+
+struct l1_model_ms *l1_model_ms_init(void *ctx, struct l1ctl_sock_client *lsc, struct virt_um_inst *vui);
+
+void l1_model_ms_destroy(struct l1_model_ms *model);
+
diff --git a/src/host/virt_phy/include/virtphy/virt_l1_sched.h b/src/host/virt_phy/include/virtphy/virt_l1_sched.h
new file mode 100644
index 00000000..b8d401ff
--- /dev/null
+++ b/src/host/virt_phy/include/virtphy/virt_l1_sched.h
@@ -0,0 +1,32 @@
+#pragma once
+#include <osmocom/core/msgb.h>
+#include <virtphy/virt_l1_model.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <virtphy/virt_l1_sched.h>
+
+struct l1_model_ms;
+
+typedef void virt_l1_sched_cb(struct l1_model_ms *ms, uint32_t fn, uint8_t tn, struct msgb * msg);
+
+/* bucket containing items to be executed for a specific mframe number */
+struct virt_l1_sched_mframe_item {
+	struct llist_head mframe_item_entry;
+	struct llist_head tdma_item_list; /* list of tdma sched items */
+	uint32_t fn; /* frame number of execution */
+};
+
+/* item to be be executed for a specific tdma timeslot of a framenumber */
+struct virt_l1_sched_tdma_item {
+	struct llist_head tdma_item_entry;
+	struct msgb * msg; /* the msg to be handled */
+	uint8_t ts; /* tdma timeslot of execution */
+	virt_l1_sched_cb * handler_cb; /* handler callback */
+};
+
+int virt_l1_sched_restart(struct l1_model_ms *ms, struct gsm_time time);
+void virt_l1_sched_sync_time(struct l1_model_ms *ms, struct gsm_time time, uint8_t hard_reset);
+void virt_l1_sched_stop(struct l1_model_ms *ms);
+void virt_l1_sched_execute(struct l1_model_ms *ms, uint32_t fn);
+void virt_l1_sched_schedule(struct l1_model_ms *ms, struct msgb *msg, uint32_t fn, uint8_t ts,
+                            virt_l1_sched_cb * handler_cb);
diff --git a/src/host/virt_phy/include/virtphy/virtual_um.h b/src/host/virt_phy/include/virtphy/virtual_um.h
new file mode 100644
index 00000000..52f2df64
--- /dev/null
+++ b/src/host/virt_phy/include/virtphy/virtual_um.h
@@ -0,0 +1,35 @@
+#pragma once
+
+/* the "Virtual Um instance" encapsulates the multicast UDP sockets as
+ * well as the encoding and decoding of GSMTAP messages towards the
+ * virtual radio interface. It receives DL messages via GSMTAP from any
+ * number of BTSs transmitting to GSMTAP, and transmits UL messages via
+ * GSMTAP to those BTSs in another multicast group */
+
+#include <osmocom/core/select.h>
+#include <osmocom/core/msgb.h>
+#include "osmo_mcast_sock.h"
+
+/* We use multicast group addresses from the 239.192.0.0/14 rage, as
+ * those are designated by RFC2365 as "IPv4 Organization Local Scope,
+ * "... the space from which an organization should allocate sub-
+ *  ranges when defining scopes for private use." */
+
+#define VIRT_UM_MSGB_SIZE	256
+#define DEFAULT_MS_MCAST_GROUP	"239.193.23.1"
+#define DEFAULT_BTS_MCAST_GROUP	"239.193.23.2"
+
+struct virt_um_inst {
+	void *priv;
+	struct mcast_bidir_sock *mcast_sock;
+	void (*recv_cb)(struct virt_um_inst *vui, struct msgb *msg);
+};
+
+struct virt_um_inst *virt_um_init(
+                void *ctx, char *tx_mcast_group, uint16_t tx_mcast_port,
+                char *rx_mcast_group, uint16_t rx_mcast_port,
+                void (*recv_cb)(struct virt_um_inst *vui, struct msgb *msg));
+
+void virt_um_destroy(struct virt_um_inst *vui);
+
+int virt_um_write_msg(struct virt_um_inst *vui, struct msgb *msg);
diff --git a/src/host/virt_phy/src/Makefile.am b/src/host/virt_phy/src/Makefile.am
new file mode 100644
index 00000000..bfd0dfaa
--- /dev/null
+++ b/src/host/virt_phy/src/Makefile.am
@@ -0,0 +1,11 @@
+AM_CFLAGS=-Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS)
+AM_CPPFLAGS = $(all_includes) -I$(top_srcdir)/include  -I$(top_srcdir)/../layer23/include
+
+bin_PROGRAMS = virtphy
+virtphy_SOURCES = virtphy.c l1ctl_sock.c gsmtapl1_if.c l1ctl_sap.c virt_prim_pm.c virt_prim_fbsb.c virt_prim_rach.c virt_prim_data.c virt_prim_traffic.c virt_l1_sched_simple.c logging.c virt_l1_model.c shared/virtual_um.c shared/osmo_mcast_sock.c
+virtphy_LDADD = $(LIBOSMOCORE_LIBS) $(LIBOSMOGSM_LIBS) 
+virtphy_LDFLAGS = -pthread
+
+# debug output
+all:
+	$(info $$AM_CPPFLAGS is [${AM_CPPFLAGS}])
diff --git a/src/host/virt_phy/src/gsmtapl1_if.c b/src/host/virt_phy/src/gsmtapl1_if.c
new file mode 100644
index 00000000..2cf9d2dc
--- /dev/null
+++ b/src/host/virt_phy/src/gsmtapl1_if.c
@@ -0,0 +1,325 @@
+/* GSMTAP layer1 is transmits gsmtap messages over a virtual layer 1.*/
+
+/* (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ * (C) 2017 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/core/gsmtap_util.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+#include <osmocom/core/msgb.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <l1ctl_proto.h>
+#include <virtphy/virtual_um.h>
+#include <virtphy/l1ctl_sock.h>
+#include <virtphy/virt_l1_model.h>
+#include <virtphy/l1ctl_sap.h>
+#include <virtphy/gsmtapl1_if.h>
+#include <virtphy/logging.h>
+#include <virtphy/virt_l1_sched.h>
+
+static char *pseudo_lchan_name(uint16_t arfcn, uint8_t ts, uint8_t ss, uint8_t sub_type)
+{
+	static char lname[64];
+	snprintf(lname, sizeof(lname), "(arfcn=%u,ts=%u,ss=%u,type=%s)",
+		arfcn, ts, ss, get_value_string(gsmtap_gsm_channel_names, sub_type));
+	return lname;
+}
+
+/**
+ * Replace l11 header of given msgb by a gsmtap header and send it over the virt um.
+ */
+void gsmtapl1_tx_to_virt_um_inst(struct l1_model_ms *ms, uint32_t fn, uint8_t tn, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *)msg->data;
+	struct l1ctl_info_ul *ul;
+	struct gsmtap_hdr *gh;
+	struct msgb *outmsg;	/* msg to send with gsmtap header prepended */
+	uint16_t arfcn = ms->state.serving_cell.arfcn;	/* arfcn of the cell we currently camp on */
+	uint8_t signal_dbm = 63;	/* signal strength */
+	uint8_t snr = 63;	/* signal noise ratio, 63 is best */
+	uint8_t *data = msgb_l2(msg);	/* data to transmit (whole message without l1 header) */
+	uint8_t data_len = msgb_l2len(msg);	/* length of data */
+
+	uint8_t rsl_chantype;	/* rsl chan type (8.58, 9.3.1) */
+	uint8_t subslot;	/* multiframe subslot to send msg in (tch -> 0-26, bcch/ccch -> 0-51) */
+	uint8_t timeslot;	/* tdma timeslot to send in (0-7) */
+	uint8_t gsmtap_chan;	/* the gsmtap channel */
+
+	switch (l1h->msg_type) {
+	case L1CTL_DATA_TBF_REQ:
+		ul = NULL;
+		rsl_chantype = RSL_CHAN_OSMO_PDCH;
+		timeslot = tn;
+		subslot = 0;
+		gsmtap_chan = chantype_rsl2gsmtap(rsl_chantype, 0);
+		break;
+	default:
+		ul = (struct l1ctl_info_ul *)l1h->data;
+		rsl_dec_chan_nr(ul->chan_nr, &rsl_chantype, &subslot, &timeslot);
+		gsmtap_chan = chantype_rsl2gsmtap(rsl_chantype, ul->link_id);
+		break;
+	}
+
+	/* arfcn needs to be flagged to be able to distinguish between uplink and downlink */
+	outmsg = gsmtap_makemsg(arfcn | GSMTAP_ARFCN_F_UPLINK, timeslot,
+				gsmtap_chan, subslot, fn, signal_dbm, snr, data,
+				data_len);
+	if (outmsg) {
+		outmsg->l1h = msgb_data(outmsg);
+		gh = msgb_l1(outmsg);
+		if (virt_um_write_msg(ms->vui, outmsg) == -1) {
+			LOGPMS(DVIRPHY, LOGL_ERROR, ms, "%s Tx go GSMTAP failed: %s\n",
+				pseudo_lchan_name(gh->arfcn, gh->timeslot, gh->sub_slot, gh->sub_type),
+				strerror(errno));
+		} else {
+			DEBUGPMS(DVIRPHY, ms, "%s: Tx to GSMTAP: %s\n",
+				pseudo_lchan_name(gh->arfcn, gh->timeslot, gh->sub_slot, gh->sub_type),
+				osmo_hexdump(data, data_len));
+		}
+	} else
+		LOGPMS(DVIRPHY, LOGL_ERROR, ms, "GSMTAP msg could not be created!\n");
+
+	/* free message */
+	msgb_free(msg);
+}
+
+/**
+ * @see virt_prim_fbsb.c
+ */
+extern void prim_fbsb_sync(struct l1_model_ms *ms, struct msgb *msg);
+
+/**
+ * @see virt_prim_pm.c
+ */
+extern uint16_t prim_pm_set_sig_strength(struct l1_model_ms *ms, uint16_t arfcn, int16_t sig_lev);
+
+/* determine if a received Downlink RLC/MAC block matches the current MS configuration */
+static bool gprs_dl_block_matches_ms(struct l1_model_ms *ms, struct msgb *msg, uint8_t timeslot)
+{
+	uint8_t payload_type;
+	uint8_t tfi;
+
+	if (msgb_length(msg) < 1)
+		return false;
+
+	/* FIXME: Ensure this will also work for EGPRS!  */
+	payload_type = msg->data[0] >> 6;
+	switch (payload_type) {
+	case 0: /* RLC Data Block */
+		/* forward all RLD Data Blocks destined for TFI of MS */
+		tfi = (msg->data[1] >> 1) & 0x1f;
+		if (ms->state.state == MS_STATE_TBF && ms->state.tbf.dl.tfi[timeslot] == tfi)
+			return true;
+		break;
+	case 1: /* RLC/MAC Control without optional octets */
+		/* forward all RLC/MAC control blocks without optional octets, i.e. not adressed
+		 * to a specific TFI */
+		return true;
+	case 2: /* RLC/MAC with optional control octets */
+		/* forward all RLD Control Blocks destined for TFI of MS */
+		tfi = (msg->data[2] >> 1) & 0x1f;
+		if (ms->state.state == MS_STATE_TBF && ms->state.tbf.dl.tfi[timeslot] == tfi)
+			return true;
+		break;
+	default:
+		break;
+	}
+	return false;
+}
+
+/* determine if given USF at given timeslot is relevant to given MS or not */
+static bool usf_matches_ms(struct l1_model_ms *ms, uint8_t usf, uint8_t timeslot)
+{
+	if (ms->state.state == MS_STATE_TBF && ms->state.tbf.ul.usf[timeslot] == usf)
+		return true;
+
+	return false;
+}
+
+/* extract USF from (E)GPRS RLC/MAC block */
+static uint8_t get_usf_from_block(struct msgb *msg)
+{
+	/* FIXME: Ensure this will also work for EGPRS!  */
+	return msg->data[0] & 0x7;
+}
+
+/* MS is authorized to transmit a block in uplink for given USF on timeslot+arfcn at FN */
+static void ms_ul_tbf_may_transmit(struct l1_model_ms *ms, uint16_t arfcn, uint8_t timeslot,
+				   uint32_t fn, uint8_t usf)
+{
+	struct msgb *msg;
+
+	/* If USF is not for us, bail out */
+	if (!usf_matches_ms(ms, usf, timeslot))
+		return;
+
+	/* attempt to de-queue pending msgb for this UL TBF and transmit it */
+	msg = msgb_dequeue(&ms->state.tbf.ul.tx_queue);
+	if (!msg) {
+		printf("FN=%u, TN=%u, USF=%u: empty tx_queue, not transmitting\n", fn, timeslot, usf);
+		/* FIXME: send some dummy control frame? */
+	} else {
+		printf("FN=%u, TN=%u, USF=%u: transmitting queued msg\n", fn, timeslot, usf);
+		gsmtapl1_tx_to_virt_um_inst(ms, fn, timeslot, msg);
+	}
+}
+
+static void l1ctl_from_virt_um(struct l1ctl_sock_client *lsc, struct msgb *msg, uint32_t fn,
+				uint16_t arfcn, uint8_t timeslot, uint8_t subslot,
+				uint8_t gsmtap_chantype, uint8_t chan_nr, uint8_t link_id,
+				uint8_t snr_db)
+{
+	struct l1_model_ms *ms = lsc->priv;
+	uint8_t signal_dbm = dbm2rxlev(prim_pm_set_sig_strength(ms, arfcn & GSMTAP_ARFCN_MASK, MAX_SIG_LEV_DBM));	/* Power measurement with each received massage */
+	uint8_t usf;
+
+	gsm_fn2gsmtime(&ms->state.downlink_time, fn);
+
+	/* we do not forward messages to l23 if we are in network search state */
+	if (ms->state.state == MS_STATE_IDLE_SEARCHING)
+		return;
+
+	/* forward downlink msg to fbsb sync routine if we are in sync state */
+	if (ms->state.state == MS_STATE_IDLE_SYNCING) {
+		prim_fbsb_sync(ms, msg);
+		return;
+	}
+	/* generally ignore all messages coming from another arfcn than the camped one */
+	if (ms->state.serving_cell.arfcn != arfcn) {
+		return;
+	}
+
+	virt_l1_sched_sync_time(ms, ms->state.downlink_time, 0);
+	virt_l1_sched_execute(ms, fn);
+
+	/* switch case with removed ACCH flag */
+	switch (gsmtap_chantype & ~GSMTAP_CHANNEL_ACCH & 0xff) {
+	case GSMTAP_CHANNEL_TCH_H:
+	case GSMTAP_CHANNEL_TCH_F:
+#if 0
+		/* TODO: handle voice */
+		if (!facch && !tch_acch) {
+			l1ctl_tx_traffic_ind(msg, arfcn, link_id, chan_nr, fn,
+					     snr, signal_dbm, 0, 0);
+		}
+#endif
+	case GSMTAP_CHANNEL_SDCCH4:
+	case GSMTAP_CHANNEL_SDCCH8:
+		/* only forward messages on dedicated channels to l2, if
+		 * the timeslot and subslot is fitting */
+		if (ms->state.dedicated.tn == timeslot
+		    && ms->state.dedicated.subslot == subslot) {
+			l1ctl_tx_data_ind(ms, msg, arfcn, link_id, chan_nr, fn, snr_db, signal_dbm, 0, 0);
+		}
+		break;
+	case GSMTAP_CHANNEL_AGCH:
+	case GSMTAP_CHANNEL_PCH:
+	case GSMTAP_CHANNEL_BCCH:
+	case GSMTAP_CHANNEL_CBCH51:
+	case GSMTAP_CHANNEL_CBCH52:
+		/* save to just forward here, as upper layer ignores messages that
+		 * do not fit the current state (e.g.  gsm48_rr.c:2159) */
+		l1ctl_tx_data_ind(ms, msg, arfcn, link_id, chan_nr, fn, snr_db, signal_dbm, 0, 0);
+		break;
+	case GSMTAP_CHANNEL_RACH:
+		LOGPMS(DVIRPHY, LOGL_NOTICE, ms, "Ignoring unexpected RACH in downlink ?!?\n");
+		break;
+	case GSMTAP_CHANNEL_PACCH:
+	case GSMTAP_CHANNEL_PDCH:
+		if (gprs_dl_block_matches_ms(ms, msg, timeslot))
+			l1ctl_tx_data_ind(ms, msg, arfcn, link_id, chan_nr, fn, snr_db, signal_dbm, 0, 0);
+		usf = get_usf_from_block(msg);
+		ms_ul_tbf_may_transmit(ms, arfcn, timeslot, fn, usf);
+		break;
+	case GSMTAP_CHANNEL_SDCCH:
+	case GSMTAP_CHANNEL_CCCH:
+	case GSMTAP_CHANNEL_PTCCH:
+		LOGPMS(DVIRPHY, LOGL_NOTICE, ms, "Ignoring unsupported channel type %s\n",
+			get_value_string(gsmtap_gsm_channel_names, gsmtap_chantype));
+		break;
+	default:
+		LOGPMS(DVIRPHY, LOGL_NOTICE, ms, "Ignoring unknown channel type %s\n",
+			get_value_string(gsmtap_gsm_channel_names, gsmtap_chantype));
+		break;
+	}
+}
+
+/**
+ * Receive a gsmtap message from the virt um.
+ *
+ * As we do not have a downlink scheduler, but not all dl messages must be processed and thus forwarded to l2, this function also implements some message filtering.
+ * E.g. we do not forward:
+ * - uplink messages
+ * - messages with a wrong arfcn
+ * - if in MS_STATE_IDLE_SEARCHING
+ */
+void gsmtapl1_rx_from_virt_um_inst_cb(struct virt_um_inst *vui,
+				      struct msgb *msg)
+{
+	struct l1ctl_sock_inst *lsi = vui->priv;
+	struct l1ctl_sock_client *lsc;
+
+	if (!msg)
+		return;
+
+	struct gsmtap_hdr *gh = msgb_l1(msg);
+	uint32_t fn = ntohl(gh->frame_number);	/* frame number of the rcv msg */
+	uint16_t arfcn = ntohs(gh->arfcn);	/* arfcn of the received msg */
+	uint8_t gsmtap_chantype = gh->sub_type;	/* gsmtap channel type */
+	uint8_t snr = gh->snr_db;	/* signal noise ratio */
+	uint8_t subslot = gh->sub_slot;	/* multiframe subslot to send msg in (tch -> 0-26, bcch/ccch -> 0-51) */
+	uint8_t timeslot = gh->timeslot;	/* tdma timeslot to send in (0-7) */
+	uint8_t rsl_chantype;	/* rsl chan type (8.58, 9.3.1) */
+	uint8_t link_id;	/* rsl link id tells if this is an ssociated or dedicated link */
+	uint8_t chan_nr;	/* encoded rsl channel type, timeslot and mf subslot */
+	struct gsm_time gtime;
+
+	msg->l2h = msgb_pull(msg, sizeof(*gh));
+	chantype_gsmtap2rsl(gsmtap_chantype, &rsl_chantype, &link_id);
+	/* see TS 08.58 -> 9.3.1 for channel number encoding */
+	chan_nr = rsl_enc_chan_nr(rsl_chantype, subslot, timeslot);
+
+	gsm_fn2gsmtime(&gtime, fn);
+
+	DEBUGP(DVIRPHY, "%s Rx from VirtUM: FN=%s chan_nr=0x%02x link_id=0x%02x\n",
+		pseudo_lchan_name(arfcn, timeslot, subslot, gsmtap_chantype),
+		osmo_dump_gsmtime(&gtime), chan_nr, link_id);
+
+	/* generally ignore all uplink messages received */
+	if (arfcn & GSMTAP_ARFCN_F_UPLINK) {
+		LOGP(DVIRPHY, LOGL_NOTICE, "Ignoring unexpected uplink message in downlink!\n");
+		goto freemsg;
+	}
+
+	/* dispatch the incoming DL message from GSMTAP to each of the registered L1CTL instances */
+	llist_for_each_entry(lsc, &lsi->clients, list) {
+		l1ctl_from_virt_um(lsc, msg, fn, arfcn, timeslot, subslot, gsmtap_chantype,
+				   chan_nr, link_id, snr);
+	}
+
+freemsg:
+	talloc_free(msg);
+}
diff --git a/src/host/virt_phy/src/l1ctl_sap.c b/src/host/virt_phy/src/l1ctl_sap.c
new file mode 100644
index 00000000..aac49bf0
--- /dev/null
+++ b/src/host/virt_phy/src/l1ctl_sap.c
@@ -0,0 +1,1092 @@
+/* L1CTL SAP implementation.  */
+
+/* (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gprs/gprs_rlc.h>
+#include <stdio.h>
+#include <l1ctl_proto.h>
+#include <netinet/in.h>
+#include <string.h>
+#include <virtphy/virtual_um.h>
+#include <virtphy/l1ctl_sock.h>
+#include <virtphy/virt_l1_model.h>
+#include <virtphy/l1ctl_sap.h>
+#include <virtphy/gsmtapl1_if.h>
+#include <virtphy/logging.h>
+#include <virtphy/virt_l1_sched.h>
+
+static void l1ctl_rx_tbf_cfg_req(struct l1_model_ms *ms, struct msgb *msg);
+static void l1ctl_rx_data_tbf_req(struct l1_model_ms *ms, struct msgb *msg);
+
+static void l1_model_tch_mode_set(struct l1_model_ms *ms, uint8_t tch_mode)
+{
+	if (tch_mode == GSM48_CMODE_SPEECH_V1 || tch_mode == GSM48_CMODE_SPEECH_EFR)
+		ms->state.tch_mode = tch_mode;
+	else {
+		/* set default value if no proper mode was assigned by l23 */
+		ms->state.tch_mode = GSM48_CMODE_SIGN;
+	}
+}
+
+/**
+ * @brief Init the SAP.
+ */
+void l1ctl_sap_init(struct l1_model_ms *model)
+{
+	INIT_LLIST_HEAD(&model->state.sched.mframe_items);
+	INIT_LLIST_HEAD(&model->state.tbf.ul.tx_queue);
+
+	prim_pm_init(model);
+}
+
+void l1ctl_sap_exit(struct l1_model_ms *model)
+{
+	virt_l1_sched_stop(model);
+	prim_pm_exit(model);
+}
+
+/**
+ * @brief L1CTL handler called for received messages from L23.
+ *
+ * Enqueues the message into the rx queue.
+ */
+void l1ctl_sap_rx_from_l23_inst_cb(struct l1ctl_sock_client *lsc, struct msgb *msg)
+{
+	struct l1_model_ms *ms = lsc->priv;
+	/* check if the received msg is not empty */
+	if (!msg)
+		return;
+
+	l1ctl_sap_handler(ms, msg);
+}
+
+/**
+ * @brief Send a l1ctl message to layer 23.
+ *
+ * This will forward the message as it is to the upper layer.
+ */
+void l1ctl_sap_tx_to_l23_inst(struct l1_model_ms *ms, struct msgb *msg)
+{
+	/* prepend 16bit length before sending */
+	msgb_push_u16(msg, msg->len);
+	l1ctl_sock_write_msg(ms->lsc, msg);
+}
+
+/**
+ * @brief Allocates a msgb with set l1ctl header and room for a l3 header.
+ *
+ * @param [in] msg_type L1CTL primitive message type set to l1ctl_hdr.
+ * @return the allocated message.
+ *
+ * The message looks as follows:
+ * # headers
+ * [l1ctl_hdr]		: initialized. msgb->l1h points here
+ * [spare-bytes]	: L3_MSG_HEAD bytes reserved for l3 header
+ * # data
+ * [spare-bytes]	: L3_MSG_DATA bytes reserved for data. msgb->tail points here. msgb->data points here.
+ */
+struct msgb *l1ctl_msgb_alloc(uint8_t msg_type)
+{
+	struct msgb *msg;
+	struct l1ctl_hdr *l1h;
+
+	msg = msgb_alloc_headroom(L3_MSG_SIZE, L3_MSG_HEAD, "l1ctl");
+	OSMO_ASSERT(msg);
+
+	l1h = (struct l1ctl_hdr *) msgb_put(msg, sizeof(*l1h));
+	l1h->msg_type = msg_type;
+	l1h->flags = 0;
+
+	msg->l1h = (uint8_t *)l1h;
+
+	return msg;
+}
+
+/**
+ * @brief Allocates a msgb with set l1ctl header and room for a l3 header and puts l1ctl_info_dl to the msgb data.
+ *
+ * @param [in] msg_type L1CTL primitive message type set to l1ctl_hdr.
+ * @param [in] fn framenumber put into l1ctl_info_dl.
+ * @param [in] snr time slot number put into l1ctl_info_dl.
+ * @param [in] arfcn arfcn put into l1ctl_info_dl.
+ * @return the allocated message.
+ *
+ * The message looks as follows:
+ * # headers
+ * [l1ctl_hdr]		: initialized. msgb->l1h points here
+ * [spare-bytes]	: L3_MSG_HEAD bytes reserved for l3 header
+ * # data
+ * [l1ctl_info_dl]	: initialized with params. msgb->data points here.
+ * [spare-bytes]	: L3_MSG_DATA bytes reserved for data. msgb->tail points here.
+ */
+struct msgb *l1ctl_create_l2_msg(int msg_type, uint32_t fn, uint16_t snr, uint16_t arfcn)
+{
+	struct l1ctl_info_dl *dl;
+	struct msgb *msg = l1ctl_msgb_alloc(msg_type);
+
+	dl = (struct l1ctl_info_dl *) msgb_put(msg, sizeof(*dl));
+	dl->frame_nr = htonl(fn);
+	dl->snr = htons(snr);
+	dl->band_arfcn = htons(arfcn);
+
+	return msg;
+}
+
+static bool is_l1ctl_control(uint8_t msg_type)
+{
+	switch (msg_type) {
+	case L1CTL_DATA_REQ:
+	case L1CTL_DATA_CONF:
+	case L1CTL_DATA_TBF_REQ:
+	case L1CTL_DATA_TBF_CONF:
+	case L1CTL_TRAFFIC_REQ:
+	case L1CTL_TRAFFIC_CONF:
+	case L1CTL_TRAFFIC_IND:
+		return false;
+	default:
+		return true;
+	}
+}
+
+/**
+ * @brief General handler for incoming L1CTL messages from layer 2/3.
+ *
+ * This handler will call the specific routine dependent on the L1CTL message type.
+ */
+void l1ctl_sap_handler(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h;
+	int log_subsys;
+
+	if (!msg)
+		return;
+
+	l1h = (struct l1ctl_hdr *) msg->data;
+
+	if (sizeof(*l1h) > msg->len) {
+		LOGPMS(DL1C, LOGL_NOTICE, ms, "Malformed message: too short. %u\n", msg->len);
+		goto exit_msgbfree;
+	}
+
+	if (is_l1ctl_control(l1h->msg_type))
+		log_subsys = DL1C;
+	else
+		log_subsys = DL1P;
+
+	DEBUGPMS(log_subsys, ms, "Rx RAW from MS: %s\n", msgb_hexdump(msg));
+
+	switch (l1h->msg_type) {
+	case L1CTL_FBSB_REQ:
+		l1ctl_rx_fbsb_req(ms, msg);
+		break;
+	case L1CTL_DM_EST_REQ:
+		l1ctl_rx_dm_est_req(ms, msg);
+		break;
+	case L1CTL_DM_REL_REQ:
+		l1ctl_rx_dm_rel_req(ms, msg);
+		break;
+	case L1CTL_PARAM_REQ:
+		l1ctl_rx_param_req(ms, msg);
+		break;
+	case L1CTL_DM_FREQ_REQ:
+		l1ctl_rx_dm_freq_req(ms,msg);
+		break;
+	case L1CTL_CRYPTO_REQ:
+		l1ctl_rx_crypto_req(ms, msg);
+		break;
+	case L1CTL_RACH_REQ:
+		l1ctl_rx_rach_req(ms, msg);
+		goto exit_nofree;
+	case L1CTL_DATA_REQ:
+		l1ctl_rx_data_req(ms, msg);
+		goto exit_nofree;
+	case L1CTL_PM_REQ:
+		l1ctl_rx_pm_req(ms, msg);
+		break;
+	case L1CTL_RESET_REQ:
+		l1ctl_rx_reset_req(ms, msg);
+		break;
+	case L1CTL_CCCH_MODE_REQ:
+		l1ctl_rx_ccch_mode_req(ms, msg);
+		break;
+	case L1CTL_TCH_MODE_REQ:
+		l1ctl_rx_tch_mode_req(ms, msg);
+		break;
+	case L1CTL_NEIGH_PM_REQ:
+		l1ctl_rx_neigh_pm_req(ms, msg);
+		break;
+	case L1CTL_TRAFFIC_REQ:
+		l1ctl_rx_traffic_req(ms, msg);
+		goto exit_nofree;
+	case L1CTL_SIM_REQ:
+		l1ctl_rx_sim_req(ms, msg);
+		break;
+	case L1CTL_TBF_CFG_REQ:
+		l1ctl_rx_tbf_cfg_req(ms, msg);
+		break;
+	case L1CTL_DATA_TBF_REQ:
+		l1ctl_rx_data_tbf_req(ms, msg);
+		goto exit_nofree;
+	}
+
+exit_msgbfree:
+	msgb_free(msg);
+
+exit_nofree:
+	return; /* msg is scheduled for uplink and mustn't be freed here */
+}
+
+/***************************************************************
+ * L1CTL RX ROUTINES *******************************************
+ * For more routines check the respective handler classes ******
+ * like virt_prim_rach.c ***************************************
+ ***************************************************************/
+
+/**
+ * @brief Handler for received L1CTL_DM_EST_REQ from L23.
+ *
+ * -- dedicated mode established request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Handle state change from idle to dedicated mode.
+ *
+ */
+void l1ctl_rx_dm_est_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_dm_est_req *est_req = (struct l1ctl_dm_est_req *) ul->payload;
+	uint8_t rsl_chantype, subslot, timeslot;
+
+	rsl_dec_chan_nr(ul->chan_nr, &rsl_chantype, &subslot, &timeslot);
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_DM_EST_REQ (chan_nr=0x%02x, tn=%u, ss=%u)\n",
+		ul->chan_nr, timeslot, subslot);
+
+	ms->state.dedicated.chan_type = rsl_chantype;
+	ms->state.dedicated.tn = timeslot;
+	ms->state.dedicated.subslot = subslot;
+	ms->state.state = MS_STATE_DEDICATED;
+
+	/* TCH config */
+	if (rsl_chantype == RSL_CHAN_Bm_ACCHs || rsl_chantype == RSL_CHAN_Lm_ACCHs) {
+		ms->state.tch_mode = est_req->tch_mode;
+		l1_model_tch_mode_set(ms, est_req->tch_mode);
+		ms->state.audio_mode = est_req->audio_mode;
+		/* TODO: configure audio hardware for encoding /
+		 * decoding / recording / playing voice */
+	}
+}
+
+/**
+ * @brief Handler for received L1CTL_DM_FREQ_REQ from L23.
+ *
+ * -- dedicated mode frequency request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Handle frequency change in dedicated mode. E.g. used for frequency hopping.
+ *
+ * Note: Not needed for virtual physical layer as freqency hopping is generally disabled.
+ */
+void l1ctl_rx_dm_freq_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_dm_freq_req *freq_req = (struct l1ctl_dm_freq_req *) ul->payload;
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_DM_FREQ_REQ (arfcn0=%u, hsn=%u, maio=%u): IGNORED\n",
+		ntohs(freq_req->h0.band_arfcn), freq_req->h1.hsn, freq_req->h1.maio);
+}
+
+/**
+ * @brief Handler for received L1CTL_CRYPTO_REQ from L23.
+ *
+ * -- cryptographic request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Configure the key and algorithm used for cryptographic operations in the DSP (Digital Signal Processor).
+ *
+ * Note: in the virtual physical layer the cryptographic operations are not handled in the DSP.
+ *
+ * TODO: Implement cryptographic operations for virtual um!
+ * TODO: Implement this handler routine!
+ */
+void l1ctl_rx_crypto_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_crypto_req *cr = (struct l1ctl_crypto_req *) ul->payload;
+	uint8_t key_len = msg->len - sizeof(*l1h) - sizeof(*ul) - sizeof(*cr);
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_CRYPTO_REQ (algo=A5/%u, len=%u)\n",
+		cr->algo, key_len);
+
+	if (cr->algo && key_len != A5_KEY_LEN) {
+		LOGPMS(DL1C, LOGL_ERROR, ms, "L1CTL_CRYPTO_REQ -> Invalid key\n");
+		return;
+	}
+
+	ms->state.crypto_inf.algo = cr->algo;
+	memcpy(ms->state.crypto_inf.key, cr->key, sizeof(uint8_t) * A5_KEY_LEN);
+}
+
+/**
+ * @brief Handler for received L1CTL_DM_REL_REQ from L23.
+ *
+ * -- dedicated mode release request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Handle state change from dedicated to idle mode. Flush message buffers of dedicated channel.
+ *
+ */
+void l1ctl_rx_dm_rel_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_DM_REL_REQ\n");
+
+	ms->state.dedicated.chan_type = 0;
+	ms->state.dedicated.tn = 0;
+	ms->state.dedicated.subslot = 0;
+	ms->state.tch_mode = GSM48_CMODE_SIGN;
+	ms->state.state = MS_STATE_IDLE_CAMPING;
+
+	/* TODO: disable ciphering */
+	/* TODO: disable audio recording / playing */
+}
+
+/**
+ * @brief Handler for received L1CTL_PARAM_REQ from L23.
+ *
+ * -- parameter request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Configure transceiver parameters timing advance value and sending power.
+ *
+ * Note: Not needed for virtual physical layer.
+ */
+void l1ctl_rx_param_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *)msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *)l1h->data;
+	struct l1ctl_par_req *par_req = (struct l1ctl_par_req *)ul->payload;
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_PARAM_REQ (ta=%d, tx_power=%d)\n",
+		par_req->ta, par_req->tx_power);
+}
+
+/**
+ * @brief Handler for received L1CTL_RESET_REQ from L23.
+ *
+ * -- reset request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Reset layer 1 (state machine, scheduler, transceiver) depending on the reset type.
+ *
+ * Note: Currently we do not perform anything else than response with a reset confirm
+ * to just tell l2 that we are rdy.
+ *
+ */
+void l1ctl_rx_reset_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_reset *reset_req = (struct l1ctl_reset *) l1h->data;
+
+	switch (reset_req->type) {
+	case L1CTL_RES_T_FULL:
+		DEBUGPMS(DL1C, ms, "Rx L1CTL_RESET_REQ (type=FULL)\n");
+		ms->state.state = MS_STATE_IDLE_SEARCHING;
+		virt_l1_sched_stop(ms);
+		l1ctl_tx_reset(ms, L1CTL_RESET_CONF, reset_req->type);
+		break;
+	case L1CTL_RES_T_SCHED:
+		virt_l1_sched_restart(ms, ms->state.downlink_time);
+		DEBUGPMS(DL1C, ms, "Rx L1CTL_RESET_REQ (type=SCHED)\n");
+		l1ctl_tx_reset(ms, L1CTL_RESET_CONF, reset_req->type);
+		break;
+	default:
+		LOGPMS(DL1C, LOGL_ERROR, ms, "Rx L1CTL_RESET_REQ (type=unknown): IGNORED\n");
+		break;
+	}
+}
+
+/**
+ * @brief Handler for received L1CTL_CCCH_MODE_REQ from L23.
+ *
+ * -- common control channel mode request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Configure CCCH combined / non-combined mode.
+ *
+ * @see l1ctl_proto.h -- enum ccch_mode
+ *
+ * TODO: Implement this handler routine!
+ */
+void l1ctl_rx_ccch_mode_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_ccch_mode_req *ccch_mode_req = (struct l1ctl_ccch_mode_req *) l1h->data;
+	uint8_t ccch_mode = ccch_mode_req->ccch_mode;
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_CCCH_MODE_REQ (mode=%u)\n", ccch_mode);
+
+	ms->state.serving_cell.ccch_mode = ccch_mode;
+
+	/* check if more has to be done here */
+	l1ctl_tx_ccch_mode_conf(ms, ccch_mode);
+}
+
+/**
+ * @brief Handler for received L1CTL_TCH_MODE_REQ from L23.
+ *
+ * -- traffic channel mode request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Configure TCH mode and audio mode.
+ *
+ * TODO: Implement this handler routine!
+ */
+void l1ctl_rx_tch_mode_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_tch_mode_req *tch_mode_req = (struct l1ctl_tch_mode_req *) l1h->data;
+
+	l1_model_tch_mode_set(ms, tch_mode_req->tch_mode);
+	ms->state.audio_mode = tch_mode_req->audio_mode;
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_TCH_MODE_REQ (tch_mode=0x%02x audio_mode=0x%02x)\n",
+		tch_mode_req->tch_mode, tch_mode_req->audio_mode);
+
+	/* TODO: configure audio hardware for encoding / decoding / recording / playing voice */
+
+	l1ctl_tx_tch_mode_conf(ms, ms->state.tch_mode, ms->state.audio_mode);
+}
+
+/**
+ * @brief Handler for received L1CTL_NEIGH_PM_REQ from L23.
+ *
+ * -- neighbor power measurement request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Update the maintained list of neighbor cells used in neighbor cell power measurement.
+ * The neighbor cell description is one of the info messages sent by the BTS on BCCH.
+ * This method will also enable neighbor measurement in the multiframe scheduler.
+ *
+ * Note: Not needed for virtual physical layer as we dont maintain neigbors.
+ */
+void l1ctl_rx_neigh_pm_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_neigh_pm_req *pm_req = (struct l1ctl_neigh_pm_req *) l1h->data;
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_NEIGH_PM_REQ (list with %u entries): IGNORED\n", pm_req->n);
+}
+
+/**
+ * @brief Handler for received L1CTL_SIM_REQ from L23.
+ *
+ * -- sim request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Forward and a sim request to the SIM APDU.
+ *
+ * Note: Not needed for virtual layer. Please configure layer23 application to use test-sim implementation.
+ * In this case layer1 wont need to handle sim logic.
+ * ms <x>
+ * --------
+ * sim test
+ * test-sim
+ *  imsi <xxxxxxxxxxxxxxx>
+ *  ki comp128 <xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx>
+ * --------
+ */
+void l1ctl_rx_sim_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	uint16_t len = msg->len - sizeof(struct l1ctl_hdr);
+	uint8_t *data = msg->data + sizeof(struct l1ctl_hdr);
+
+	LOGPMS(DL1C, LOGL_ERROR, ms, "Rx SIM Request (length: %u, data: %s): UNSUPPORTED\n",
+		len, osmo_hexdump(data, sizeof(data)));
+
+}
+
+static void l1ctl_tx_tbf_cfg_conf(struct l1_model_ms *ms, const struct l1ctl_tbf_cfg_req *in);
+
+static void l1ctl_rx_tbf_cfg_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_tbf_cfg_req *cfg_req = (struct l1ctl_tbf_cfg_req *) l1h->data;
+	unsigned int i;
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_TBF_CFG_REQ (tbf_id=%u, dir=%s, "
+		"usf=[%d,%d,%d,%d,%d,%d,%d,%d]\n", cfg_req->tbf_nr,
+		cfg_req->is_uplink ? "UL" : "DL", cfg_req->usf[0], cfg_req->usf[1],
+		cfg_req->usf[2], cfg_req->usf[3], cfg_req->usf[4], cfg_req->usf[5],
+		cfg_req->usf[6], cfg_req->usf[7]);
+
+	if (cfg_req->tbf_nr != 0) {
+		LOGPMS(DL1C, LOGL_ERROR, ms, "TBF_NR != 0 not supported yet!\n");
+		return;
+	}
+
+	if (ms->state.state == MS_STATE_DEDICATED)
+		LOGPMS(DL1C, LOGL_NOTICE, ms, "Harrd termiation of DEDICATED mode, fix L23!\n");
+
+	if (cfg_req->is_uplink) {
+		for (i = 0; i < 8; i++)
+			ms->state.tbf.ul.usf[i] = cfg_req->usf[i];
+	} else {
+		for (i = 0; i < 8; i++)
+			ms->state.tbf.dl.tfi[i] = cfg_req->usf[i];
+	}
+	ms->state.state = MS_STATE_TBF;
+
+	l1ctl_tx_tbf_cfg_conf(ms, cfg_req);
+}
+
+static const enum osmo_gprs_cs osmo_cs_by_l1ctl[] = {
+	[L1CTL_CS_NONE]	= OSMO_GPRS_CS_NONE,
+	[L1CTL_CS1]	= OSMO_GPRS_CS1,
+	[L1CTL_CS2]	= OSMO_GPRS_CS2,
+	[L1CTL_CS3]	= OSMO_GPRS_CS3,
+	[L1CTL_CS4]	= OSMO_GPRS_CS4,
+	[L1CTL_MCS1]	= OSMO_GPRS_MCS1,
+	[L1CTL_MCS2]	= OSMO_GPRS_MCS2,
+	[L1CTL_MCS3]	= OSMO_GPRS_MCS3,
+	[L1CTL_MCS4]	= OSMO_GPRS_MCS4,
+	[L1CTL_MCS5]	= OSMO_GPRS_MCS5,
+	[L1CTL_MCS6]	= OSMO_GPRS_MCS6,
+	[L1CTL_MCS7]	= OSMO_GPRS_MCS7,
+	[L1CTL_MCS8]	= OSMO_GPRS_MCS8,
+	[L1CTL_MCS9]	= OSMO_GPRS_MCS9,
+};
+
+static int get_osmo_cs_by_l1ctl(enum l1ctl_coding_scheme l1)
+{
+	if (l1 >= ARRAY_SIZE(osmo_cs_by_l1ctl))
+		return -1;
+	return osmo_cs_by_l1ctl[l1];
+}
+
+static const enum l1ctl_coding_scheme l1ctl_cs_by_osmo[] = {
+	[OSMO_GPRS_CS_NONE]	= L1CTL_CS_NONE,
+	[OSMO_GPRS_CS1]		= L1CTL_CS1,
+	[OSMO_GPRS_CS2]		= L1CTL_CS2,
+	[OSMO_GPRS_CS3]		= L1CTL_CS3,
+	[OSMO_GPRS_CS4]		= L1CTL_CS4,
+	[OSMO_GPRS_MCS1]	= L1CTL_MCS1,
+	[OSMO_GPRS_MCS2]	= L1CTL_MCS2,
+	[OSMO_GPRS_MCS3]	= L1CTL_MCS3,
+	[OSMO_GPRS_MCS4]	= L1CTL_MCS4,
+	[OSMO_GPRS_MCS5]	= L1CTL_MCS5,
+	[OSMO_GPRS_MCS6]	= L1CTL_MCS6,
+	[OSMO_GPRS_MCS7]	= L1CTL_MCS7,
+	[OSMO_GPRS_MCS8]	= L1CTL_MCS8,
+	[OSMO_GPRS_MCS9]	= L1CTL_MCS9,
+};
+
+static int get_l1ctl_cs_by_osmo(enum osmo_gprs_cs in)
+{
+	if (in >= ARRAY_SIZE(l1ctl_cs_by_osmo))
+		return -1;
+	return l1ctl_cs_by_osmo[in];
+}
+
+static void l1ctl_rx_data_tbf_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul_tbf *udt = (struct l1ctl_info_ul_tbf *) l1h->data;
+	enum osmo_gprs_cs osmo_cs;
+	int block_size;
+
+	msg->l2h = udt->payload;
+
+	LOGPMS(DL1P, LOGL_ERROR, ms, "Rx L1CTL_DATA_TBF_REQ (tbf_id=%d, data=%s)\n",
+		udt->tbf_nr, osmo_hexdump(msg->l2h, msgb_l2len(msg)));
+	if (udt->tbf_nr != 0) {
+		LOGPMS(DL1C, LOGL_ERROR, ms, "TBF_NR != 0 not supported yet!\n");
+		return;
+	}
+
+	if (ms->state.state != MS_STATE_TBF) {
+		LOGPMS(DL1P, LOGL_ERROR, ms, "DATA_TBF_REQ in state != TBF\n");
+		return;
+	}
+
+	osmo_cs = get_l1ctl_cs_by_osmo(udt->coding_scheme);
+	if (osmo_cs < 0) {
+		LOGPMS(DL1P, LOGL_ERROR, ms, "DATA_RBF_REQ with invalid CS\n");
+		return;
+	}
+	block_size = osmo_gprs_ul_block_size_bytes(osmo_cs);
+
+	if (msgb_l2len(msg) < block_size) {
+		int pad_len = block_size - msgb_l2len(msg);
+		uint8_t *pad = msgb_put(msg, pad_len);
+		memset(pad, GSM_MACBLOCK_PADDING, pad_len);
+	}
+
+	msgb_enqueue(&ms->state.tbf.ul.tx_queue, msg);
+}
+
+/***************************************************************
+ * L1CTL TX ROUTINES *******************************************
+ * For more routines check the respective handler classes ******
+ * like virt_prim_rach.c ***************************************
+ ***************************************************************/
+
+static void l1ctl_tx_tbf_cfg_conf(struct l1_model_ms *ms, const struct l1ctl_tbf_cfg_req *in)
+{
+	struct msgb *msg = l1ctl_msgb_alloc(L1CTL_TBF_CFG_CONF);
+	struct l1ctl_tbf_cfg_req *out;
+
+	/* copy over the data from the request */
+	out = (struct l1ctl_tbf_cfg_req *) msgb_put(msg, sizeof(*out));
+	*out = *in;
+
+	l1ctl_sap_tx_to_l23_inst(ms, msg);
+}
+
+/**
+ * @brief Transmit L1CTL_RESET_IND or L1CTL_RESET_CONF to layer 23.
+ *
+ * -- reset indication / confirm --
+ *
+ * @param [in] msg_type L1CTL primitive message type.
+ * @param [in] reset_type reset type (full, boot or just scheduler reset).
+ */
+void l1ctl_tx_reset(struct l1_model_ms *ms, uint8_t msg_type, uint8_t reset_type)
+{
+	struct msgb *msg = l1ctl_msgb_alloc(msg_type);
+	struct l1ctl_reset *reset_resp = (struct l1ctl_reset *) msgb_put(msg, sizeof(*reset_resp));
+
+	reset_resp->type = reset_type;
+	LOGPMS(DL1C, LOGL_INFO, ms, "Tx %s (reset_type: %u)\n", getL1ctlPrimName(msg_type), reset_type);
+
+	l1ctl_sap_tx_to_l23_inst(ms, msg);
+}
+
+/**
+ * @brief Transmit L1CTL_CCCH_MODE_CONF to layer 23.
+ *
+ * -- common control channel mode confirm --
+ *
+ * @param [in] ccch_mode the new configured ccch mode. Combined or non-combined, see l1ctl_proto.
+ *
+ * Called by layer 1 to inform layer 2 that the ccch mode was successfully changed.
+ */
+void l1ctl_tx_ccch_mode_conf(struct l1_model_ms *ms, uint8_t ccch_mode)
+{
+	struct msgb *msg = l1ctl_msgb_alloc(L1CTL_CCCH_MODE_CONF);
+	struct l1ctl_ccch_mode_conf *mode_conf;
+
+	mode_conf = (struct l1ctl_ccch_mode_conf *) msgb_put(msg, sizeof(*mode_conf));
+	mode_conf->ccch_mode = ccch_mode;
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Tx L1CTL_CCCH_MODE_CONF (mode: %u)\n", ccch_mode);
+	l1ctl_sap_tx_to_l23_inst(ms, msg);
+}
+
+/**
+ * @brief Transmit L1CTL_TCH_MODE_CONF to layer 23.
+ *
+ * -- traffic channel mode confirm --
+ *
+ * @param [in] tch_mode the new configured traffic channel mode, see gsm48_chan_mode in gsm_04_08.h.
+ * @param [in] audio_mode the new configured audio mode(s), see l1ctl_tch_mode_req in l1ctl_proto.h.
+ *
+ * Called by layer 1 to inform layer 23 that the traffic channel mode was successfully changed.
+ */
+void l1ctl_tx_tch_mode_conf(struct l1_model_ms *ms, uint8_t tch_mode, uint8_t audio_mode)
+{
+	struct msgb *msg = l1ctl_msgb_alloc(L1CTL_TCH_MODE_CONF);
+	struct l1ctl_tch_mode_conf *mode_conf;
+
+	mode_conf = (struct l1ctl_tch_mode_conf *) msgb_put(msg, sizeof(*mode_conf));
+	mode_conf->tch_mode = tch_mode;
+	mode_conf->audio_mode = audio_mode;
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Tx L1CTL_TCH_MODE_CONF (tch_mode: %u, audio_mode: %u)\n",
+		tch_mode, audio_mode);
+	l1ctl_sap_tx_to_l23_inst(ms, msg);
+}
+
+/**
+ * @brief Get the scheduled fn for a msg depending on its chan_nr and link_id.
+ */
+uint32_t sched_fn_ul(struct gsm_time cur_time, uint8_t chan_nr, uint8_t link_id)
+{
+	uint8_t chan_type, chan_ss, chan_ts;
+	uint32_t sched_fn = cur_time.fn;
+	uint16_t mod_102 = cur_time.fn % 2 * 51;
+
+	rsl_dec_chan_nr(chan_nr, &chan_type, &chan_ss, &chan_ts);
+
+	/* TODO: Replace this spaghetti monster with some lookup table */
+	switch (chan_type) {
+	case RSL_CHAN_Bm_ACCHs:
+		switch (link_id) {
+		case LID_DEDIC:
+			/* dl=[0...11,13...24] ul=[0...11,13...24]
+			 * skip idle frames and frames reserved for TCH_ACCH */
+			if (cur_time.t2 == 12 || cur_time.t2 == 25)
+				sched_fn++;
+			break;
+		/* dl=42, ul=42+15 */
+		case LID_SACCH:
+			if ((chan_ts & 1)) {
+				/* Odd traffic channel timeslot -> dl=[25] ul=[25]
+				 * TCH_ACCH always at the end of tch multiframe (mod 26) */
+				sched_fn -= cur_time.t2;
+				sched_fn += 25;
+			} else {
+				/* Even traffic channel timeslot -> dl=[12] ul=[12] */
+				if (cur_time.t2 <= 12) {
+					sched_fn -= cur_time.t2;
+					sched_fn += 12;
+				} else {
+					sched_fn -= cur_time.t2;
+					sched_fn += 26 + 12;
+				}
+			}
+			break;
+		}
+		break;
+	case RSL_CHAN_Lm_ACCHs:
+		break; /* TCH/H not supported */
+	case RSL_CHAN_SDCCH4_ACCH:
+		switch (chan_ss) {
+		case 0:
+			switch (link_id) {
+			/* dl=22, ul=22+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 22 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 22 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 22 + 15;
+				}
+				break;
+			/* dl=42, ul=42+15 */
+			case LID_SACCH:
+				if (mod_102 <= 42 + 15) {
+					sched_fn -= mod_102;
+					sched_fn += 42 + 15;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 42 + 15;
+				}
+				break;
+			}
+			break;
+		case 1:
+			switch (link_id) {
+			/* dl=26, ul=26+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 26 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 26 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 26 + 15;
+				}
+				break;
+			/* dl=46, ul=46+15 */
+			case LID_SACCH:
+				if (mod_102 <= 46 + 15) {
+					sched_fn -= mod_102;
+					sched_fn += 46 + 15;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 46 + 15;
+				}
+				break;
+			}
+			break;
+		case 2:
+			switch (link_id) {
+			/* dl=32, ul=32+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 32 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 32 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 32 + 15;
+				}
+				break;
+			/* dl=51+42, ul=51+42+15 */
+			case LID_SACCH:
+				if (mod_102 <= 51 + 42 + 15) {
+					sched_fn -= mod_102;
+					sched_fn += 51 + 42 + 15;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 51 + 42 + 15;
+				}
+				break;
+			}
+			break;
+		case 3:
+			switch (link_id) {
+			/* dl=36, ul=36+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 36 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 36 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 36 + 15;
+				}
+				break;
+			/* dl=51+46, ul=51+46+15 */
+			case LID_SACCH:
+				if (mod_102 <= 51 + 46 + 15) {
+					sched_fn -= mod_102;
+					sched_fn += 51 + 46 + 15;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 51 + 46 + 15;
+				}
+				break;
+			}
+			break;
+		}
+		break;
+	case RSL_CHAN_SDCCH8_ACCH:
+		switch (chan_ss) {
+		case 0:
+			switch (link_id) {
+			/* dl=0, ul=0+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 0 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 0 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 0 + 15;
+				}
+				break;
+			/* dl=32, ul=32+15 */
+			case LID_SACCH:
+				if (mod_102 <= 32 + 15) {
+					sched_fn -= mod_102;
+					sched_fn += 32 + 15;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 32 + 15;
+				}
+				break;
+			}
+			break;
+		case 1:
+			switch (link_id) {
+			/* dl=4, ul=4+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 4 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 4 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 4 + 15;
+				}
+				break;
+			/* dl=36, ul=36+15 */
+			case LID_SACCH:
+				if (mod_102 <= 36 + 15) {
+					sched_fn -= mod_102;
+					sched_fn += 36 + 15;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 36 + 15;
+				}
+				break;
+			}
+			break;
+		case 2:
+			switch (link_id) {
+			/* dl=8, ul=8+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 8 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 8 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 8 + 15;
+				}
+				break;
+			/* dl=40, ul=40+15 */
+			case LID_SACCH:
+				if (mod_102 <= 40 + 15) {
+					sched_fn -= mod_102;
+					sched_fn += 40 + 15;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 40 + 15;
+				}
+				break;
+			}
+			break;
+		case 3:
+			switch (link_id) {
+			/* dl=12, ul=12+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 12 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 12 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 12 + 15;
+				}
+				break;
+			/* dl=44, ul=44+15 */
+			case LID_SACCH:
+				if (mod_102 <= 44 + 15) {
+					sched_fn -= mod_102;
+					sched_fn += 44 + 15;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 44 + 15;
+				}
+				break;
+			}
+			break;
+		case 4:
+			switch (link_id) {
+			/* dl=16, ul=16+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 16 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 16 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 16 + 15;
+				}
+				break;
+			/* dl=51+32, ul=51+32+15 */
+			case LID_SACCH:
+				if (mod_102 <= 51 + 32 + 15) {
+					sched_fn -= mod_102;
+					sched_fn += 51 + 32 + 15;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 51 + 32 + 15;
+				}
+				break;
+			}
+			break;
+		case 5:
+			switch (link_id) {
+			/* dl=20, ul=36+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 20 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 20 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 20 + 15;
+				}
+				break;
+			/* dl=51+36, ul=51+36+15 ==> 0 */
+			case LID_SACCH:
+				if (mod_102 <= 0) {
+					sched_fn -= mod_102;
+					sched_fn += 0;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 0;
+				}
+				break;
+			}
+			break;
+		case 6:
+			switch (link_id) {
+			/* dl=24, ul=24+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 24 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 24 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 24 + 15;
+				}
+				break;
+			/* dl=51+40, ul=51+40+15 ==> 4 */
+			case LID_SACCH:
+				if (mod_102 <= 4) {
+					sched_fn -= mod_102;
+					sched_fn += 4;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 4;
+				}
+				break;
+			}
+			break;
+		case 7:
+			switch (link_id) {
+			/* dl=28, ul=28+15 */
+			case LID_DEDIC:
+				if (cur_time.t3 <= 28 + 15) {
+					sched_fn -= cur_time.t3;
+					sched_fn += 28 + 15;
+				} else {
+					sched_fn -= cur_time.t3;
+					sched_fn += 51 + 28 + 15;
+				}
+				break;
+			/* dl=51+44, ul=51+44+15 ==> 8 */
+			case LID_SACCH:
+				if (mod_102 <= 8) {
+					sched_fn -= mod_102;
+					sched_fn += 8;
+				} else {
+					sched_fn -= mod_102;
+					sched_fn += 2 * 51 + 8;
+				}
+				break;
+			}
+			break;
+		}
+		break;
+	case RSL_CHAN_RACH:
+		break; /* Use virt_prim_rach.c for calculation of sched fn for rach */
+	default:
+		break; /* Use current fn as default */
+	}
+	return sched_fn;
+}
diff --git a/src/host/virt_phy/src/l1ctl_sock.c b/src/host/virt_phy/src/l1ctl_sock.c
new file mode 100644
index 00000000..bf28895f
--- /dev/null
+++ b/src/host/virt_phy/src/l1ctl_sock.c
@@ -0,0 +1,203 @@
+/* Socket based Layer1 <-> Layer23 communication over L1CTL primitives. */
+
+/* (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ * (C) 2017 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdint.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <termios.h>
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/socket.h>
+
+#include <virtphy/l1ctl_sock.h>
+#include <virtphy/logging.h>
+
+#define L1CTL_SOCK_MSGB_SIZE	256
+
+static void l1ctl_client_destroy(struct l1ctl_sock_client *lsc)
+{
+	struct l1ctl_sock_inst *lsi = lsc->l1ctl_sock;
+	if (lsi->close_cb)
+		lsi->close_cb(lsc);
+	osmo_fd_close(&lsc->ofd);
+	llist_del(&lsc->list);
+	talloc_free(lsc);
+}
+
+/**
+ * @brief L1CTL socket file descriptor callback function.
+ *
+ * @param ofd The osmocom file descriptor.
+ * @param what Indicates if the fd has a read, write or exception request. See select.h.
+ *
+ * Will be called by osmo_select_main() if data on fd is pending.
+ */
+static int l1ctl_sock_data_cb(struct osmo_fd *ofd, unsigned int what)
+{
+	struct l1ctl_sock_client *lsc = ofd->data;
+	struct l1ctl_hdr *l1h;
+	struct msgb *msg;
+	uint16_t len;
+	int rc;
+
+	/* Check if request is really read request */
+	if (!(what & BSC_FD_READ))
+		return 0;
+
+	msg = msgb_alloc(L1CTL_SOCK_MSGB_SIZE, "L1CTL sock rx");
+
+	/* read length of the message first and convert to host byte order */
+	rc = read(ofd->fd, &len, sizeof(len));
+	if (rc < sizeof(len))
+		goto err_close;
+
+	/* convert to host byte order */
+	len = ntohs(len);
+	if (len <= 0 || len > L1CTL_SOCK_MSGB_SIZE)
+		goto err_close;
+
+	rc = read(ofd->fd, msgb_data(msg), len);
+	if (rc == len) {
+		msgb_put(msg, rc);
+		l1h = (void *) msgb_data(msg);
+		msg->l1h = (void *) l1h;
+		lsc->l1ctl_sock->recv_cb(lsc, msg);
+		return 0;
+	}
+err_close:
+	LOGP(DL1C, LOGL_ERROR, "Failed to receive msg from l2. Connection will be closed.\n");
+	l1ctl_client_destroy(lsc);
+
+	return 0;
+
+}
+
+/* called for the master (listening) socket of the instance, allocates a new client */
+static int l1ctl_sock_accept_cb(struct osmo_fd *ofd, unsigned int what)
+{
+
+	struct l1ctl_sock_inst *lsi = ofd->data;
+	struct l1ctl_sock_client *lsc;
+	int fd, rc;
+
+	fd = accept(ofd->fd, NULL, NULL);
+	if (fd < 0) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to accept connection to l2.\n");
+		return -1;
+	}
+
+	lsc = talloc_zero(lsi, struct l1ctl_sock_client);
+	if (!lsc) {
+		close(fd);
+		LOGP(DL1C, LOGL_ERROR, "Failed to allocate L1CTL client\n");
+		return -1;
+	}
+
+	lsc->l1ctl_sock = lsi;
+	lsc->ofd.fd = fd;
+	lsc->ofd.when = BSC_FD_READ;
+	lsc->ofd.cb = l1ctl_sock_data_cb;
+	lsc->ofd.data = lsc;
+	if (lsi->accept_cb) {
+		rc = lsi->accept_cb(lsc);
+		if (rc < 0) {
+			talloc_free(lsc);
+			close(fd);
+			return rc;
+		}
+	}
+
+	LOGP(DL1C, LOGL_INFO, "Accepted client (fd=%u) from server (fd=%u)\n", fd, ofd->fd);
+	if (osmo_fd_register(&lsc->ofd) != 0) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to register the l2 connection fd.\n");
+		talloc_free(lsc);
+		return -1;
+	}
+	llist_add_tail(&lsc->list, &lsi->clients);
+	return 0;
+}
+
+struct l1ctl_sock_inst *l1ctl_sock_init(
+                void *ctx,
+                void (*recv_cb)(struct l1ctl_sock_client *lsc, struct msgb *msg),
+                int (*accept_cb)(struct l1ctl_sock_client *lsc),
+                void (*close_cb)(struct l1ctl_sock_client *lsc),
+                char *path)
+{
+	struct l1ctl_sock_inst *lsi;
+	int rc;
+
+	if (!path)
+		path = L1CTL_SOCK_PATH;
+
+	lsi = talloc_zero(ctx, struct l1ctl_sock_inst);
+	lsi->priv = NULL;
+	lsi->ofd.data = lsi;
+	lsi->ofd.when = BSC_FD_READ;
+	lsi->ofd.cb = l1ctl_sock_accept_cb;
+
+	rc = osmo_sock_unix_init_ofd(&lsi->ofd, SOCK_STREAM, 0, path, OSMO_SOCK_F_BIND);
+	if (rc < 0) {
+		LOGP(DL1C, LOGL_ERROR, "Error creating L1CTL listening socket\n");
+		talloc_free(lsi);
+		return NULL;
+	}
+
+	lsi->recv_cb = recv_cb;
+	lsi->accept_cb = accept_cb;
+	lsi->close_cb = close_cb;
+	lsi->l1ctl_sock_path = path;
+	INIT_LLIST_HEAD(&lsi->clients);
+
+	return lsi;
+}
+
+void l1ctl_sock_destroy(struct l1ctl_sock_inst *lsi)
+{
+	struct l1ctl_sock_client *lsc, *lsc2;
+
+	llist_for_each_entry_safe(lsc, lsc2, &lsi->clients, list)
+		l1ctl_client_destroy(lsc);
+
+	osmo_fd_close(&lsi->ofd);
+	talloc_free(lsi);
+}
+
+int l1ctl_sock_write_msg(struct l1ctl_sock_client *lsc, struct msgb *msg)
+{
+	int rc;
+	rc = write(lsc->ofd.fd, msgb_data(msg), msgb_length(msg));
+	msgb_free(msg);
+	return rc;
+}
diff --git a/src/host/virt_phy/src/logging.c b/src/host/virt_phy/src/logging.c
new file mode 100644
index 00000000..a3e63bc5
--- /dev/null
+++ b/src/host/virt_phy/src/logging.c
@@ -0,0 +1,135 @@
+/* Logging/Debug support of the virtual physical layer */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/application.h>
+#include <virtphy/logging.h>
+
+static const char* l1ctlPrimNames[] = {
+        "_L1CTL_NONE",
+        "L1CTL_FBSB_REQ",
+        "L1CTL_FBSB_CONF",
+        "L1CTL_DATA_IND",
+        "L1CTL_RACH_REQ",
+        "L1CTL_DM_EST_REQ",
+        "L1CTL_DATA_REQ",
+        "L1CTL_RESET_IND",
+        "L1CTL_PM_REQ",
+        "L1CTL_PM_CONF",
+        "L1CTL_ECHO_REQ",
+        "L1CTL_ECHO_CONF",
+        "L1CTL_RACH_CONF",
+        "L1CTL_RESET_REQ",
+        "L1CTL_RESET_CONF",
+        "L1CTL_DATA_CONF",
+        "L1CTL_CCCH_MODE_REQ",
+        "L1CTL_CCCH_MODE_CONF",
+        "L1CTL_DM_REL_REQ",
+        "L1CTL_PARAM_REQ",
+        "L1CTL_DM_FREQ_REQ",
+        "L1CTL_CRYPTO_REQ",
+        "L1CTL_SIM_REQ",
+        "L1CTL_SIM_CONF",
+        "L1CTL_TCH_MODE_REQ",
+        "L1CTL_TCH_MODE_CONF",
+        "L1CTL_NEIGH_PM_REQ",
+        "L1CTL_NEIGH_PM_IND",
+        "L1CTL_TRAFFIC_REQ",
+        "L1CTL_TRAFFIC_CONF",
+        "L1CTL_TRAFFIC_IND",
+        "L1CTL_BURST_IND",
+        "L1CTL_TBF_CFG_REQ",
+        "L1CTL_TBF_CFG_CONF",
+        "L1CTL_DATA_TBF_REQ",
+        "L1CTL_DATA_TBF_CONF"
+};
+
+static const struct log_info_cat default_categories[] = {
+	[DL1C] = {
+		.name = "DL1C",
+		.description = "Layer 1 Control",
+		.color = "\033[1;31m",
+		.enabled = 1,
+		.loglevel = LOGL_DEBUG,
+	},
+	[DL1P] = {
+		.name = "DL1P",
+		.description = "Layer 1 Data",
+		.color = "\033[1;31m",
+		.enabled = 1,
+		.loglevel = LOGL_DEBUG,
+	},
+	[DVIRPHY] = {
+		.name = "DVIRPHY",
+		.description = "Virtual Layer 1 Interface",
+		.color = "\033[1;31m",
+		.enabled = 1,
+		.loglevel = LOGL_DEBUG,
+	},
+	[DMAIN] = {
+		.name = "DMAIN",
+		.description = "Main Program / Data Structures",
+		.color = "\033[1;32m",
+		.enabled = 1,
+		.loglevel = LOGL_DEBUG,
+	},
+};
+
+const struct log_info ms_log_info = {
+	.filter_fn = NULL,
+	.cat = default_categories,
+	.num_cat = ARRAY_SIZE(default_categories),
+};
+
+/**
+ * Initialize the logging system for the virtual physical layer.
+ */
+int ms_log_init(char *cat_mask)
+{
+	struct log_target *stderr_target;
+
+	log_init(&ms_log_info, NULL);
+	stderr_target = log_target_create_stderr();
+	if (!stderr)
+		return -1;
+
+	log_add_target(stderr_target);
+	log_set_all_filter(stderr_target, 1);
+	//log_set_log_level(stderr_target, 1);
+	log_set_print_filename(stderr_target, 1);
+	log_set_use_color(stderr_target, 0);
+	log_set_print_timestamp(stderr_target, 1);
+	log_set_print_category(stderr_target, 1);
+	if (cat_mask)
+		log_parse_category_mask(stderr_target, cat_mask);
+
+	return 0;
+}
+
+const char *getL1ctlPrimName(uint8_t type)
+{
+	if (type <= ARRAY_SIZE(l1ctlPrimNames))
+		return l1ctlPrimNames[type];
+	else
+		return "Unknwon Primitive";
+}
diff --git a/src/host/virt_phy/src/shared/osmo_mcast_sock.c b/src/host/virt_phy/src/shared/osmo_mcast_sock.c
new file mode 100644
index 00000000..9a713fcf
--- /dev/null
+++ b/src/host/virt_phy/src/shared/osmo_mcast_sock.c
@@ -0,0 +1,113 @@
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/select.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <talloc.h>
+#include <unistd.h>
+#include <virtphy/osmo_mcast_sock.h>
+
+/* server socket is what we use for transmission. It is not subscribed
+ * to a multicast group or locally bound, but it is just a normal UDP
+ * socket that's connected to the remote mcast group + port */
+int mcast_server_sock_setup(struct osmo_fd *ofd, const char* tx_mcast_group,
+			    uint16_t tx_mcast_port, bool loopback)
+{
+	int rc;
+	unsigned int flags = OSMO_SOCK_F_CONNECT | OSMO_SOCK_F_UDP_REUSEADDR;
+
+	if (!loopback)
+		flags |= OSMO_SOCK_F_NO_MCAST_LOOP;
+
+	/* setup mcast server socket */
+	rc = osmo_sock_init_ofd(ofd, AF_INET, SOCK_DGRAM, IPPROTO_UDP,
+				tx_mcast_group, tx_mcast_port, flags);
+	if (rc < 0) {
+		perror("Failed to create Multicast Server Socket");
+		return rc;
+	}
+
+	return 0;
+}
+
+/* the client socket is what we use for reception.  It is a UDP socket
+ * that's bound to the GSMTAP UDP port and subscribed to the respective
+ * multicast group */
+int mcast_client_sock_setup(struct osmo_fd *ofd, const char *mcast_group, uint16_t mcast_port,
+			    int (*fd_rx_cb)(struct osmo_fd *ofd, unsigned int what),
+			    void *osmo_fd_data)
+{
+	int rc;
+	unsigned int flags = OSMO_SOCK_F_BIND | OSMO_SOCK_F_NO_MCAST_ALL | OSMO_SOCK_F_UDP_REUSEADDR;
+
+	ofd->cb = fd_rx_cb;
+	ofd->when = BSC_FD_READ;
+	ofd->data = osmo_fd_data;
+
+	/* Create mcast client socket */
+	rc = osmo_sock_init_ofd(ofd, AF_INET, SOCK_DGRAM, IPPROTO_UDP,
+				NULL, mcast_port, flags);
+	if (rc < 0) {
+		perror("Could not create mcast client socket");
+		return rc;
+	}
+
+	/* Configure and join the multicast group */
+	rc = osmo_sock_mcast_subscribe(ofd->fd, mcast_group);
+	if (rc < 0) {
+		perror("Failed to join to mcast goup");
+		osmo_fd_close(ofd);
+		return rc;
+	}
+
+	return 0;
+}
+
+struct mcast_bidir_sock *
+mcast_bidir_sock_setup(void *ctx, const char *tx_mcast_group, uint16_t tx_mcast_port,
+			const char *rx_mcast_group, uint16_t rx_mcast_port, bool loopback,
+			int (*fd_rx_cb)(struct osmo_fd *ofd, unsigned int what),
+			void *osmo_fd_data)
+{
+	struct mcast_bidir_sock *bidir_sock = talloc(ctx, struct mcast_bidir_sock);
+	int rc;
+
+	if (!bidir_sock)
+		return NULL;
+
+	rc = mcast_client_sock_setup(&bidir_sock->rx_ofd, rx_mcast_group, rx_mcast_port,
+				fd_rx_cb, osmo_fd_data);
+	if (rc < 0) {
+		talloc_free(bidir_sock);
+		return NULL;
+	}
+	rc = mcast_server_sock_setup(&bidir_sock->tx_ofd, tx_mcast_group, tx_mcast_port, loopback);
+	if (rc < 0) {
+		osmo_fd_close(&bidir_sock->rx_ofd);
+		talloc_free(bidir_sock);
+		return NULL;
+	}
+	return bidir_sock;
+
+}
+
+int mcast_bidir_sock_tx(struct mcast_bidir_sock *bidir_sock, const uint8_t *data,
+                        unsigned int data_len)
+{
+	return send(bidir_sock->tx_ofd.fd, data, data_len, 0);
+}
+
+int mcast_bidir_sock_rx(struct mcast_bidir_sock *bidir_sock, uint8_t *buf, unsigned int buf_len)
+{
+	return recv(bidir_sock->rx_ofd.fd, buf, buf_len, 0);
+}
+
+void mcast_bidir_sock_close(struct mcast_bidir_sock *bidir_sock)
+{
+	osmo_fd_close(&bidir_sock->tx_ofd);
+	osmo_fd_close(&bidir_sock->rx_ofd);
+	talloc_free(bidir_sock);
+}
diff --git a/src/host/virt_phy/src/shared/virtual_um.c b/src/host/virt_phy/src/shared/virtual_um.c
new file mode 100644
index 00000000..9415bfbb
--- /dev/null
+++ b/src/host/virt_phy/src/shared/virtual_um.c
@@ -0,0 +1,103 @@
+/* Routines for a Virtual Um interface over GSMTAP/UDP */
+
+/* (C) 2015 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/select.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <virtphy/osmo_mcast_sock.h>
+#include <virtphy/virtual_um.h>
+#include <unistd.h>
+
+/**
+ * Virtual UM interface file descriptor callback.
+ * Should be called by select.c when the fd is ready for reading.
+ */
+static int virt_um_fd_cb(struct osmo_fd *ofd, unsigned int what)
+{
+	struct virt_um_inst *vui = ofd->data;
+
+	// check if the read flag is set
+	if (what & BSC_FD_READ) {
+		// allocate message buffer of specified size
+		struct msgb *msg = msgb_alloc(VIRT_UM_MSGB_SIZE,
+		                "Virtual UM Rx");
+		int rc;
+
+		// read message from fd in message buffer
+		rc = mcast_bidir_sock_rx(vui->mcast_sock, msgb_data(msg),
+		                msgb_tailroom(msg));
+		// rc is number of bytes actually read
+		if (rc > 0) {
+			msgb_put(msg, rc);
+			msg->l1h = msgb_data(msg);
+			// call the l1 callback function for a received msg
+			vui->recv_cb(vui, msg);
+		} else {
+			// TODO: this kind of error handling might be a bit harsh
+			vui->recv_cb(vui, NULL);
+			// Unregister fd from select loop
+			osmo_fd_unregister(ofd);
+			close(ofd->fd);
+			ofd->fd = -1;
+			ofd->when = 0;
+		}
+	}
+
+	return 0;
+}
+
+struct virt_um_inst *virt_um_init(
+                void *ctx, char *tx_mcast_group, uint16_t tx_mcast_port,
+                char *rx_mcast_group, uint16_t rx_mcast_port,
+                void (*recv_cb)(struct virt_um_inst *vui, struct msgb *msg))
+{
+	struct virt_um_inst *vui = talloc_zero(ctx, struct virt_um_inst);
+	vui->mcast_sock = mcast_bidir_sock_setup(ctx, tx_mcast_group,
+	                tx_mcast_port, rx_mcast_group, rx_mcast_port, 1,
+	                virt_um_fd_cb, vui);
+	vui->recv_cb = recv_cb;
+
+	return vui;
+
+}
+
+void virt_um_destroy(struct virt_um_inst *vui)
+{
+	mcast_bidir_sock_close(vui->mcast_sock);
+	talloc_free(vui);
+}
+
+/**
+ * Write msg to to multicast socket and free msg afterwards
+ */
+int virt_um_write_msg(struct virt_um_inst *vui, struct msgb *msg)
+{
+	int rc;
+
+	rc = mcast_bidir_sock_tx(vui->mcast_sock, msgb_data(msg),
+	                msgb_length(msg));
+	msgb_free(msg);
+
+	return rc;
+}
diff --git a/src/host/virt_phy/src/virt_l1_model.c b/src/host/virt_phy/src/virt_l1_model.c
new file mode 100644
index 00000000..5738bed6
--- /dev/null
+++ b/src/host/virt_phy/src/virt_l1_model.c
@@ -0,0 +1,51 @@
+
+/* (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ * (C) 2017 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <virtphy/virt_l1_model.h>
+#include <virtphy/l1ctl_sap.h>
+#include <virtphy/logging.h>
+#include <talloc.h>
+
+static uint32_t next_ms_nr;
+
+struct l1_model_ms *l1_model_ms_init(void *ctx, struct l1ctl_sock_client *lsc, struct virt_um_inst *vui)
+{
+	struct l1_model_ms *model = talloc_zero(ctx, struct l1_model_ms);
+	if (!model)
+		return NULL;
+
+	model->nr = next_ms_nr++;
+	model->lsc = lsc;
+	model->vui = vui;
+
+	l1ctl_sap_init(model);
+
+	LOGPMS(DMAIN, LOGL_INFO, model, "allocated\n");
+
+	return model;
+}
+
+void l1_model_ms_destroy(struct l1_model_ms *model)
+{
+	LOGPMS(DMAIN, LOGL_INFO, model, "destroyed\n");
+	l1ctl_sap_exit(model);
+	talloc_free(model);
+}
diff --git a/src/host/virt_phy/src/virt_l1_sched_simple.c b/src/host/virt_phy/src/virt_l1_sched_simple.c
new file mode 100644
index 00000000..4737135c
--- /dev/null
+++ b/src/host/virt_phy/src/virt_l1_sched_simple.c
@@ -0,0 +1,147 @@
+/* (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ * (C) 2017 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <virtphy/virt_l1_sched.h>
+#include <osmocom/core/linuxlist.h>
+#include <virtphy/virt_l1_model.h>
+#include <virtphy/logging.h>
+#include <time.h>
+#include <talloc.h>
+
+/**
+ * @brief Start scheduler thread based on current gsm time from model
+ */
+static int virt_l1_sched_start(struct l1_model_ms *ms, struct gsm_time time)
+{
+	virt_l1_sched_sync_time(ms, time, 1);
+	return 0;
+}
+
+/**
+ * @brief Clear scheduler queue and completely restart scheduler.
+ */
+int virt_l1_sched_restart(struct l1_model_ms *ms, struct gsm_time time)
+{
+	virt_l1_sched_stop(ms);
+	return virt_l1_sched_start(ms, time);
+}
+
+/**
+ * @brief Sync scheduler with given time.
+ */
+void virt_l1_sched_sync_time(struct l1_model_ms *ms, struct gsm_time time, uint8_t hard_reset)
+{
+	ms->state.current_time = time;
+}
+
+/**
+ * @brief Stop the scheduler thread and cleanup mframe items queue
+ */
+void virt_l1_sched_stop(struct l1_model_ms *ms)
+{
+	struct virt_l1_sched_mframe_item *mi_next, *mi_tmp;
+
+	/* Empty tdma and mframe sched items lists */
+	llist_for_each_entry_safe(mi_next, mi_tmp, &ms->state.sched.mframe_items, mframe_item_entry) {
+		struct virt_l1_sched_tdma_item *ti_next, *ti_tmp;
+
+		llist_for_each_entry_safe(ti_next, ti_tmp, &mi_next->tdma_item_list, tdma_item_entry) {
+			talloc_free(ti_next->msg);
+			llist_del(&ti_next->tdma_item_entry);
+		}
+		llist_del(&mi_next->mframe_item_entry);
+		talloc_free(mi_next);
+	}
+}
+
+/**
+ * @brief Handle all pending scheduled items for the current frame number.
+ */
+void virt_l1_sched_execute(struct l1_model_ms *ms, uint32_t fn)
+{
+	struct l1_state_ms *l1s = &ms->state;
+	struct virt_l1_sched_mframe_item *mi_next, *mi_tmp;
+	uint8_t hyperframe_restart = fn < l1s->sched.last_exec_fn;
+
+	llist_for_each_entry_safe(mi_next, mi_tmp, &l1s->sched.mframe_items, mframe_item_entry) {
+		/* execute all registered handler for current mf sched item */
+		uint8_t exec_now = mi_next->fn <= fn || (hyperframe_restart && mi_next->fn > l1s->sched.last_exec_fn);
+		/* break loop, as we have an ordered list in case the hyperframe had not been reset */
+		uint8_t break_now = mi_next->fn > fn && !hyperframe_restart;
+
+		if (exec_now) {
+			struct virt_l1_sched_tdma_item *ti_next, *ti_tmp;
+			/* run through all scheduled tdma sched items for that frame number */
+			llist_for_each_entry_safe(ti_next, ti_tmp, &mi_next->tdma_item_list,
+						  tdma_item_entry) {
+				/* exec tdma sched item's handler callback */
+				/* TODO: we do not have a TDMA scheduler currently and execute
+				 * all scheduled tdma items here at once */
+				ti_next->handler_cb(ms, mi_next->fn, ti_next->ts, ti_next->msg);
+				/* remove handled tdma sched item */
+				llist_del(&ti_next->tdma_item_entry);
+			}
+			/* remove handled mframe sched item */
+			llist_del(&mi_next->mframe_item_entry);
+			talloc_free(mi_next);
+		}
+
+		if (break_now)
+			break;
+	}
+	l1s->sched.last_exec_fn = fn;
+}
+
+/**
+ * @brief Schedule a msg to the given framenumber and timeslot.
+ */
+void virt_l1_sched_schedule(struct l1_model_ms *ms, struct msgb *msg, uint32_t fn, uint8_t ts,
+                            virt_l1_sched_cb *handler_cb)
+{
+	struct virt_l1_sched_mframe_item *mi_next = NULL, *mi_tmp = NULL, *mi_fn = NULL;
+	struct virt_l1_sched_tdma_item *ti_new = NULL;
+
+	llist_for_each_entry_safe(mi_next, mi_tmp, &ms->state.sched.mframe_items, mframe_item_entry) {
+		if (mi_next->fn == fn) {
+			mi_fn = mi_next;
+			break;
+		} else if (mi_next->fn > fn)
+			break;
+	}
+	if (!mi_fn) {
+		/* list did not contain mframe item with needed fn */
+		mi_fn = talloc_zero(ms, struct virt_l1_sched_mframe_item);
+		mi_fn->fn = fn;
+		/* need to manually init the struct content.... no so happy */
+		mi_fn->tdma_item_list.prev = &mi_fn->tdma_item_list;
+		mi_fn->tdma_item_list.next = &mi_fn->tdma_item_list;
+
+		/* TODO: check if we get an error if list is empty... */
+		llist_add(&mi_fn->mframe_item_entry, mi_next->mframe_item_entry.prev);
+	}
+
+	ti_new = talloc_zero(mi_fn, struct virt_l1_sched_tdma_item);
+	ti_new->msg = msg;
+	ti_new->handler_cb = handler_cb;
+	ti_new->ts = ts;
+	/* simply add at end, no ordering for tdma sched items currently */
+	llist_add_tail(&ti_new->tdma_item_entry, &mi_fn->tdma_item_list);
+	/* TODO: ordered insert needed if tdma scheduler should be implemented */
+}
diff --git a/src/host/virt_phy/src/virt_prim_data.c b/src/host/virt_phy/src/virt_prim_data.c
new file mode 100644
index 00000000..96534aab
--- /dev/null
+++ b/src/host/virt_phy/src/virt_prim_data.c
@@ -0,0 +1,128 @@
+/* Layer 1 normal data burst uplink handling and scheduling */
+
+/* (C) 2010 by Dieter Spaar <spaar@mirider.augusta.de>
+ * (C) 2010,2017 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+#include <osmocom/core/msgb.h>
+#include <virtphy/l1ctl_sap.h>
+#include <virtphy/virt_l1_sched.h>
+#include <virtphy/logging.h>
+#include <virtphy/gsmtapl1_if.h>
+
+#include <l1ctl_proto.h>
+
+/**
+ * @brief Handler callback function for DATA request.
+ *
+ * @param [in] fn frame number
+ * @param [in] msg the msg to sent over virtual um.
+ */
+static void virt_l1_sched_handler_cb(struct l1_model_ms *ms, uint32_t fn, uint8_t tn, struct msgb * msg)
+{
+	gsmtapl1_tx_to_virt_um_inst(ms, fn, tn, msg);
+	l1ctl_tx_data_conf(ms, fn, 0, ms->state.serving_cell.arfcn);
+}
+
+/**
+ * @brief Handler for received L1CTL_DATA_REQ from L23.
+ *
+ * -- data request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Transmit message on a signalling channel. FACCH/SDCCH or SACCH depending on the headers set link id (TS 8.58 - 9.3.2).
+ *
+ * TODO: Check if a msg on FACCH needs special handling.
+ */
+void l1ctl_rx_data_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *)msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *)l1h->data;
+	struct l1ctl_data_ind *data_ind = (struct l1ctl_data_ind *)ul->payload;
+	uint8_t rsl_chantype, subslot, timeslot;
+	uint32_t fn_sched = sched_fn_ul(ms->state.current_time,
+	                                ul->chan_nr, ul->link_id);
+
+	rsl_dec_chan_nr(ul->chan_nr, &rsl_chantype, &subslot, &timeslot);
+	msg->l2h = data_ind->data;
+
+	LOGPMS(DL1P, LOGL_INFO, ms, "Rx L1CTL_DATA_REQ (chan_nr=0x%02x, link_id=0x%02x) %s\n",
+		ul->chan_nr, ul->link_id, osmo_hexdump(msg->l2h, msgb_l2len(msg)));
+
+	virt_l1_sched_schedule(ms, msg, fn_sched, timeslot, &virt_l1_sched_handler_cb);
+}
+
+void l1ctl_tx_data_ind(struct l1_model_ms *ms, struct msgb *msg, uint16_t arfcn, uint8_t link_id,
+                       uint8_t chan_nr, uint32_t fn, uint8_t snr,
+                       uint8_t signal_dbm, uint8_t num_biterr, uint8_t fire_crc)
+{
+	struct msgb *l1ctl_msg = NULL;
+	struct l1ctl_data_ind * l1di;
+	struct l1ctl_info_dl * l1dl;
+	l1ctl_msg = l1ctl_msgb_alloc(L1CTL_DATA_IND);
+	l1dl = (struct l1ctl_info_dl *)msgb_put(l1ctl_msg,
+	                                        sizeof(struct l1ctl_info_dl));
+	l1di = (struct l1ctl_data_ind *)msgb_put(l1ctl_msg,
+	                                         sizeof(struct l1ctl_data_ind));
+
+	l1dl->band_arfcn = htons(arfcn);
+	l1dl->link_id = link_id;
+	l1dl->chan_nr = chan_nr;
+	l1dl->frame_nr = htonl(fn);
+	l1dl->snr = snr;
+	l1dl->rx_level = signal_dbm;
+	l1dl->num_biterr = 0; /* no biterrors */
+	l1dl->fire_crc = 0;
+
+	/* TODO: data decoding and decryption */
+
+	memcpy(l1di->data, msgb_data(msg), msgb_length(msg));
+
+	LOGPMS(DL1P, LOGL_INFO, ms, "TX L1CTL_DATA_IND (link_id=0x%02x) %s\n", link_id,
+		 osmo_hexdump(msgb_data(msg), msgb_length(msg)));
+	l1ctl_sap_tx_to_l23_inst(ms, l1ctl_msg);
+}
+
+/**
+ * @brief Send a L1CTL_DATA_CONF to L23.
+ *
+ * @param [in] fn frame number
+ * @param [in] snr signal noise ratio
+ * @param [in] arfcn arfcn of the cell the message was send on
+ *
+ */
+void l1ctl_tx_data_conf(struct l1_model_ms *ms, uint32_t fn, uint16_t snr, uint16_t arfcn)
+{
+	struct msgb * l1ctl_msg;
+	l1ctl_msg = l1ctl_create_l2_msg(L1CTL_DATA_CONF, fn, snr, arfcn);
+	/* send confirm to layer23 */
+	LOGPMS(DL1P, LOGL_INFO, ms, "Tx L1CTL_DATA_CONF\n");
+	l1ctl_sap_tx_to_l23_inst(ms, l1ctl_msg);
+}
diff --git a/src/host/virt_phy/src/virt_prim_fbsb.c b/src/host/virt_phy/src/virt_prim_fbsb.c
new file mode 100644
index 00000000..c14a4485
--- /dev/null
+++ b/src/host/virt_phy/src/virt_prim_fbsb.c
@@ -0,0 +1,132 @@
+
+/* (C) 2010 by Dieter Spaar <spaar@mirider.augusta.de>
+ * (C) 2010,2017 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+#include <osmocom/core/msgb.h>
+#include <virtphy/l1ctl_sap.h>
+#include <virtphy/virt_l1_sched.h>
+#include <osmocom/core/gsmtap.h>
+#include <virtphy/logging.h>
+#include <l1ctl_proto.h>
+
+static uint16_t sync_count = 0;
+
+/**
+ * @brief Handler for received L1CTL_FBSB_REQ from L23.
+ *
+ * -- frequency burst synchronisation burst request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Transmit frequency control and synchronisation bursts on FCCH and SCH to calibrate transceiver and search for base stations.
+ * Sync to a given arfcn.
+ *
+ * Note: ms will start receiving msgs on virtual um only after this req was received.
+ * Note: virt bts does not broadcast freq and sync bursts.
+ *
+ */
+void l1ctl_rx_fbsb_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1_state_ms *l1s = &ms->state;
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_fbsb_req *sync_req = (struct l1ctl_fbsb_req *) l1h->data;
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_FBSB_REQ (arfcn=%u, flags=0x%x)\n",
+		 ntohs(sync_req->band_arfcn), sync_req->flags);
+
+	l1s->state = MS_STATE_IDLE_SYNCING;
+	l1s->fbsb.arfcn = ntohs(sync_req->band_arfcn);
+}
+
+/**
+ * @brief A msg was received on l1 that can be used for synchronization.
+ *
+ * Note: for virtual layer 1 this can be a random downlink message, as we can parse the fn from the gsmtap header.
+ */
+void prim_fbsb_sync(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1_state_ms *l1s = &ms->state;
+	struct gsmtap_hdr *gh = msgb_l1(msg);
+	uint32_t fn = ntohl(gh->frame_number); /* frame number of the rcv msg */
+	uint16_t arfcn = ntohs(gh->arfcn); /* arfcn of the received msg */
+
+	/* ignore messages from other arfcns as the one requested to sync to by l23 */
+	if (l1s->fbsb.arfcn != arfcn) {
+		/* cancel sync if we did not receive a msg on dl from
+		 * the requested arfcn that we can sync to */
+		if (sync_count++ > 20) {
+			sync_count = 0;
+			l1s->state = MS_STATE_IDLE_SEARCHING;
+			l1ctl_tx_fbsb_conf(ms, 1, (l1s->fbsb.arfcn));
+		}
+		return;
+	}
+	l1s->serving_cell.arfcn = arfcn;
+	l1s->state = MS_STATE_IDLE_CAMPING;
+	/* Not needed in virtual phy */
+	l1s->serving_cell.fn_offset = 0;
+	l1s->serving_cell.time_alignment = 0;
+	l1s->serving_cell.bsic = 0;
+	/* Update current gsm time each time we receive a message on the virt um */
+	gsm_fn2gsmtime(&l1s->downlink_time, fn);
+	/* Restart scheduler */
+	virt_l1_sched_restart(ms, l1s->downlink_time);
+	l1ctl_tx_fbsb_conf(ms, 0, arfcn);
+}
+
+/**
+ * @brief Transmit L1CTL_FBSB_CONF to l23.
+ *
+ * -- frequency burst synchronisation burst confirm --
+ *
+ * @param [in] res 0 -> success, 255 -> error.
+ * @param [in] arfcn the arfcn we are synced to.
+ *
+ * No calculation needed for virtual pyh -> uses dummy values for a good link quality.
+ */
+void l1ctl_tx_fbsb_conf(struct l1_model_ms *ms, uint8_t res, uint16_t arfcn)
+{
+	struct msgb *msg;
+	struct l1ctl_fbsb_conf *resp;
+	uint32_t fn = 0; /* 0 should be okay here */
+	uint16_t snr = 40; /* signal noise ratio > 40db is best signal (unused in virt)*/
+	int16_t initial_freq_err = 0; /* 0 means no error (unused in virt) */
+	uint8_t bsic = 0; /* BSIC can be read from sync burst (unused in virt) */
+
+	msg = l1ctl_create_l2_msg(L1CTL_FBSB_CONF, fn, snr, arfcn);
+
+	resp = (struct l1ctl_fbsb_conf *)msgb_put(msg, sizeof(*resp));
+	resp->initial_freq_err = htons(initial_freq_err);
+	resp->result = res;
+	resp->bsic = bsic;
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Tx L1CTL_FBSB_CONF (res: %u)\n", res);
+
+	l1ctl_sap_tx_to_l23_inst(ms, msg);
+}
diff --git a/src/host/virt_phy/src/virt_prim_pm.c b/src/host/virt_phy/src/virt_prim_pm.c
new file mode 100644
index 00000000..46370138
--- /dev/null
+++ b/src/host/virt_phy/src/virt_prim_pm.c
@@ -0,0 +1,149 @@
+
+/* (C) 2010 by Dieter Spaar <spaar@mirider.augusta.de>
+ * (C) 2010,2017 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+#include <osmocom/core/msgb.h>
+#include <virtphy/l1ctl_sap.h>
+#include <virtphy/virt_l1_sched.h>
+#include <osmocom/core/gsmtap.h>
+#include <virtphy/logging.h>
+#include <l1ctl_proto.h>
+
+/**
+ * @brief Change the signal strength for a given arfcn.
+ *
+ * Should be called if a msg is received on the virtual layer. The configured signal level reduction is applied.
+ *
+ * @param [in] arfcn to change sig str for.
+ * @param [in] sig_lev the measured signal level value.
+ */
+uint16_t prim_pm_set_sig_strength(struct l1_model_ms *ms, uint16_t arfcn, int16_t sig_lev)
+{
+	struct l1_state_ms *l1s = &ms->state;
+
+	if (l1s->pm.timeout_s > 0 || l1s->pm.timeout_us > 0) {
+		osmo_timer_schedule(&l1s->pm.meas.arfcn_sig_lev_timers[arfcn],
+				    l1s->pm.timeout_s, l1s->pm.timeout_us);
+	}
+	l1s->pm.meas.arfcn_sig_lev_dbm[arfcn] = sig_lev - l1s->pm.meas.arfcn_sig_lev_red_dbm[arfcn];
+	DEBUGPMS(DL1C, ms, "Power measurement set for arfcn %u. Set signal level to %d (== rxlev: %u).\n",
+		arfcn, l1s->pm.meas.arfcn_sig_lev_dbm[arfcn],
+		dbm2rxlev(l1s->pm.meas.arfcn_sig_lev_dbm[arfcn]));
+	return l1s->pm.meas.arfcn_sig_lev_dbm[arfcn];
+}
+
+void prim_pm_timer_cb(void *data)
+{
+	/* reset the signal level to bad value if no messages have been
+	 * received from that rfcn for a given time */
+	DEBUGP(DL1C, "Timeout occurred for arfcn, signal level reset to worst value.\n");
+	*((int16_t*)data) = MIN_SIG_LEV_DBM;
+}
+
+/**
+ * @brief Handler for received L1CTL_PM_REQ from L23.
+ *
+ * -- power measurement request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Process power measurement for a given range of arfcns to calculate
+ * signal power and connection quality.
+ *
+ * Note: This should only be called after a certain time so some
+ * messages have already been received.
+ */
+void l1ctl_rx_pm_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1_state_ms *l1s = &ms->state;
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_pm_req *pm_req = (struct l1ctl_pm_req *) l1h->data;
+	struct msgb *resp_msg = l1ctl_msgb_alloc(L1CTL_PM_CONF);
+	uint16_t arfcn_next;
+
+	/* convert to host order */
+	pm_req->range.band_arfcn_from = ntohs(pm_req->range.band_arfcn_from);
+	pm_req->range.band_arfcn_to = ntohs(pm_req->range.band_arfcn_to);
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_PM_REQ TYPE=%u, FROM=%d, TO=%d\n",
+		pm_req->type, pm_req->range.band_arfcn_from, pm_req->range.band_arfcn_to);
+
+	for (arfcn_next = pm_req->range.band_arfcn_from;
+	     arfcn_next <= pm_req->range.band_arfcn_to; ++arfcn_next) {
+		struct l1ctl_pm_conf *pm_conf = (struct l1ctl_pm_conf *) msgb_put(resp_msg, sizeof(*pm_conf));
+		pm_conf->band_arfcn = htons(arfcn_next);
+		/* set min and max to the value calculated for that
+		 * arfcn (IGNORE UPLINKK AND  PCS AND OTHER FLAGS) */
+		pm_conf->pm[0] = dbm2rxlev(l1s->pm.meas.arfcn_sig_lev_dbm[arfcn_next & ARFCN_NO_FLAGS_MASK]);
+		pm_conf->pm[1] = dbm2rxlev(l1s->pm.meas.arfcn_sig_lev_dbm[arfcn_next & ARFCN_NO_FLAGS_MASK]);
+		if (arfcn_next == pm_req->range.band_arfcn_to) {
+			struct l1ctl_hdr *resp_l1h = msgb_l1(resp_msg);
+			resp_l1h->flags |= L1CTL_F_DONE;
+		}
+		/* no more space to hold mor pm info in msgb, flush to l23 */
+		if (msgb_tailroom(resp_msg) < sizeof(*pm_conf)) {
+			LOGPMS(DL1C, LOGL_INFO, ms, "Tx L1CTL_PM_CONF\n");
+			l1ctl_sap_tx_to_l23_inst(ms, resp_msg);
+			resp_msg = l1ctl_msgb_alloc(L1CTL_PM_CONF);
+		}
+	}
+	/* transmit the remaining part of pm response to l23 */
+	if (resp_msg) {
+		LOGPMS(DL1C, LOGL_INFO, ms, "Tx L1CTL_PM_CONF\n");
+		l1ctl_sap_tx_to_l23_inst(ms, resp_msg);
+	}
+}
+
+/**
+ * @brief Initialize virtual prim pm.
+ *
+ * @param [in] model the l1 model instance
+ */
+void prim_pm_init(struct l1_model_ms *model)
+{
+	struct l1_state_ms *l1s = &model->state;
+	int i;
+
+	/* init the signal level of all arfcns with the lowest value possible */
+	memset(l1s->pm.meas.arfcn_sig_lev_dbm, MIN_SIG_LEV_DBM, sizeof (int16_t) * 1024);
+	/* init timers */
+	for (i = 0; i < 1024; ++i) {
+		l1s->pm.meas.arfcn_sig_lev_timers[i].cb = prim_pm_timer_cb;
+		l1s->pm.meas.arfcn_sig_lev_timers[i].data = &l1s->pm.meas.arfcn_sig_lev_dbm[i];
+	}
+}
+
+void prim_pm_exit(struct l1_model_ms *model)
+{
+	struct l1_state_ms *l1s = &model->state;
+	int i;
+
+	for (i = 0; i < 1024; ++i)
+		osmo_timer_del(&l1s->pm.meas.arfcn_sig_lev_timers[i]);
+}
diff --git a/src/host/virt_phy/src/virt_prim_rach.c b/src/host/virt_phy/src/virt_prim_rach.c
new file mode 100644
index 00000000..94076cf9
--- /dev/null
+++ b/src/host/virt_phy/src/virt_prim_rach.c
@@ -0,0 +1,128 @@
+/* Layer 1 Random Access Channel Burst */
+
+/* (C) 2010 by Dieter Spaar <spaar@mirider.augusta.de>
+ * (C) 2010,2017 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+#include <osmocom/core/msgb.h>
+#include <virtphy/l1ctl_sap.h>
+#include <virtphy/virt_l1_sched.h>
+#include <virtphy/logging.h>
+#include <virtphy/gsmtapl1_if.h>
+
+#include <l1ctl_proto.h>
+
+/* use if we have a combined uplink (RACH, SDCCH, ...) (see
+ * http://www.rfwireless-world.com/Terminology/GSM-combined-channel-configuration.html)
+ * if we have no combined channel config, uplink consists of only RACH * */
+static const uint8_t t3_to_rach_comb[51] = {
+        0, 0, 0, 0, 0, 1, 2, 2, 2, 2, 2, 2, 2, 2, 2, 3, 4, 5, 6, 7, 8, 9, 10,
+        11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 25, 25, 25,
+        25, 25, 25, 25, 25, 26, 27, 27, 27, 27
+};
+static const uint8_t rach_to_t3_comb[27] = {
+        4, 5, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29,
+        30, 31, 32, 33, 34, 35, 36, 45, 46
+};
+
+/**
+ * @brief Handler callback function for RACH request.
+ *
+ * @param [in] msg the msg to sent over virtual um.
+ */
+static void virt_l1_sched_handler_cb(struct l1_model_ms *ms, uint32_t fn, uint8_t tn, struct msgb *msg)
+{
+	gsmtapl1_tx_to_virt_um_inst(ms, fn, tn, msg);
+	l1ctl_tx_rach_conf(ms, fn, ms->state.serving_cell.arfcn);
+}
+
+/**
+ * @brief Handler for received L1CTL_RACH_REQ from L23.
+ *
+ * -- random access channel request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Transmit RACH request on RACH. Refer to 04.08 - 9.1.8 - Channel request.
+ *
+ */
+void l1ctl_rx_rach_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1_state_ms *l1s = &ms->state;
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_rach_req *rach_req = (struct l1ctl_rach_req *) ul->payload;
+	uint32_t fn_sched;
+	uint8_t ts = 1; /* FIXME mostly, ts 1 is used for rach, where can i get that info? System info? */
+	uint16_t offset = ntohs(rach_req->offset);
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Rx L1CTL_RACH_REQ (ra=0x%02x, offset=%d combined=%d)\n",
+		rach_req->ra, offset, rach_req->combined);
+
+	if (rach_req->ra == 0x03)
+		fn_sched = 42;
+
+	/* set ra data to msg (8bits, the 11bit option is not used for GSM) */
+	msg->l2h = msgb_put(msg, sizeof(uint8_t));
+	*msg->l2h = rach_req->ra;
+
+	/* chan_nr need to be encoded here, as it is not set by l23 for
+	 * the rach request, but needed by virt um */
+	ul->chan_nr = rsl_enc_chan_nr(RSL_CHAN_RACH, 0, ts);
+	ul->link_id = LID_DEDIC;
+
+	/* sched fn calculation if we have a combined ccch channel configuration */
+	if (rach_req->combined) {
+		/* add elapsed RACH slots to offset */
+		offset += t3_to_rach_comb[l1s->current_time.t3];
+		/* offset is the number of RACH slots in the future */
+		fn_sched = l1s->current_time.fn - l1s->current_time.t3;
+		fn_sched += offset / 27 * 51;
+		fn_sched += rach_to_t3_comb[offset % 27];
+	} else
+		fn_sched = l1s->current_time.fn + offset;
+
+	virt_l1_sched_schedule(ms, msg, fn_sched, ts, &virt_l1_sched_handler_cb);
+}
+
+/**
+ * @brief Transmit L1CTL_RACH_CONF to layer 23.
+ *
+ * -- rach confirm --
+ *
+ * @param [in] fn the fn on which the rach was sent
+ * @param [in] arfcn arfcn on which the rach was sent
+ */
+void l1ctl_tx_rach_conf(struct l1_model_ms *ms, uint32_t fn, uint16_t arfcn)
+{
+	struct msgb *msg = l1ctl_create_l2_msg(L1CTL_RACH_CONF, fn, 0, arfcn);
+
+	LOGPMS(DL1C, LOGL_INFO, ms, "Tx L1CTL_RACH_CONF (fn: %u, arfcn: %u)\n", fn, arfcn);
+	l1ctl_sap_tx_to_l23_inst(ms, msg);
+}
diff --git a/src/host/virt_phy/src/virt_prim_traffic.c b/src/host/virt_phy/src/virt_prim_traffic.c
new file mode 100644
index 00000000..5f6b273b
--- /dev/null
+++ b/src/host/virt_phy/src/virt_prim_traffic.c
@@ -0,0 +1,129 @@
+/* Layer 1 normal data burst tx handling */
+
+/* (C) 2010 by Dieter Spaar <spaar@mirider.augusta.de>
+ * (C) 2010,2017 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+#include <osmocom/core/msgb.h>
+#include <virtphy/l1ctl_sap.h>
+#include <virtphy/virt_l1_sched.h>
+#include <virtphy/logging.h>
+#include <virtphy/gsmtapl1_if.h>
+
+#include <l1ctl_proto.h>
+
+/**
+ * @brief Handler callback function for TRAFFIC request.
+ *
+ * @param [in] fn frame number
+ * @param [in] msg the msg to sent over virtual um.
+ */
+static void virt_l1_sched_handler_cb(struct l1_model_ms *ms, uint32_t fn, uint8_t tn, struct msgb * msg)
+{
+	gsmtapl1_tx_to_virt_um_inst(ms, fn, tn, msg);
+	l1ctl_tx_traffic_conf(ms, fn, 0, ms->state.serving_cell.arfcn);
+}
+
+/**
+ * @brief Handler for received L1CTL_TRAFFIC_REQ from L23.
+ *
+ * -- traffic request --
+ *
+ * @param [in] msg the received message.
+ *
+ * Enqueue the message (traffic frame) to the L1 state machine's transmit queue. In virtual layer1 just submit it to the virt um.
+ *
+ */
+void l1ctl_rx_traffic_req(struct l1_model_ms *ms, struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_traffic_req *tr = (struct l1ctl_traffic_req *) ul->payload;
+	uint8_t rsl_chantype, subslot, timeslot;
+	uint32_t fn_sched = sched_fn_ul(ms->state.current_time, ul->chan_nr, ul->link_id);
+
+	rsl_dec_chan_nr(ul->chan_nr, &rsl_chantype, &subslot, &timeslot);
+	DEBUGPMS(DL1P, ms, "Rx L1CTL_TRAFFIC_REQ (chan_nr=0x%02x, link_id=0x%02x)\n",
+		 ul->chan_nr, ul->link_id);
+
+	msg->l2h = tr->data;
+
+	virt_l1_sched_schedule(ms, msg, fn_sched, timeslot, &virt_l1_sched_handler_cb);
+}
+
+void l1ctl_tx_traffic_ind(struct l1_model_ms *ms, struct msgb *msg, uint16_t arfcn, uint8_t link_id,
+			  uint8_t chan_nr, uint32_t fn, uint8_t snr, uint8_t signal_dbm,
+			  uint8_t num_biterr, uint8_t fire_crc)
+{
+	struct msgb *l1ctl_msg = NULL;
+	struct l1ctl_traffic_ind * l1ti;
+	struct l1ctl_info_dl * l1dl;
+	uint8_t *frame, frame_len;
+	uint8_t rsl_chan_type, subchan, timeslot;
+	l1ctl_msg = l1ctl_msgb_alloc(L1CTL_TRAFFIC_IND);
+	l1dl = (struct l1ctl_info_dl *) msgb_put(l1ctl_msg, sizeof(*l1dl));
+	l1ti = (struct l1ctl_traffic_ind *) msgb_put(l1ctl_msg, sizeof(*l1ti));
+
+	rsl_dec_chan_nr(chan_nr, &rsl_chan_type, &subchan, &timeslot);
+
+	l1dl->band_arfcn = htons(arfcn);
+	l1dl->link_id = link_id;
+	l1dl->chan_nr = chan_nr;
+	l1dl->frame_nr = htonl(fn);
+	l1dl->snr = snr;
+	l1dl->rx_level = signal_dbm;
+	l1dl->num_biterr = 0; /* no biterrors */
+	l1dl->fire_crc = 0;
+
+	/* TODO: traffic decoding and decryption */
+
+	frame_len = msgb_length(msg);
+	frame = (uint8_t *) msgb_put(l1ctl_msg, frame_len);
+	memcpy(frame, msgb_data(msg), frame_len);
+
+	DEBUGPMS(DL1P, ms, "Tx L1CTL_TRAFFIC_IND (chan_nr=0x%02x, link_id=0x%02x)\n", chan_nr, link_id);
+	l1ctl_sap_tx_to_l23_inst(ms, l1ctl_msg);
+}
+
+/**
+ * @brief Send a L1CTL_TRAFFIC_CONF to L23.
+ *
+ * @param [in] fn frame number
+ * @param [in] snr signal noise ratio
+ * @param [in] arfcn arfcn of the cell the message was send on
+ *
+ */
+void l1ctl_tx_traffic_conf(struct l1_model_ms *ms, uint32_t fn, uint16_t snr, uint16_t arfcn)
+{
+	struct msgb * l1ctl_msg;
+	l1ctl_msg = l1ctl_create_l2_msg(L1CTL_TRAFFIC_CONF, fn, snr, arfcn);
+	/* send confirm to layer23 */
+	DEBUGPMS(DL1P, ms, "Tx L1CTL_TRAFFIC_CONF\n");
+	l1ctl_sap_tx_to_l23_inst(ms, l1ctl_msg);
+}
diff --git a/src/host/virt_phy/src/virtphy.c b/src/host/virt_phy/src/virtphy.c
new file mode 100644
index 00000000..118e8a10
--- /dev/null
+++ b/src/host/virt_phy/src/virtphy.c
@@ -0,0 +1,252 @@
+/* osmocom includes */
+
+/* (C) 2016 by Sebastian Stumpf <sebastian.stumpf87@googlemail.com>
+ * (C) 2017 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/core/application.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <errno.h>
+#include <signal.h>
+#include <virtphy/virtual_um.h>
+#include <virtphy/l1ctl_sock.h>
+#include <virtphy/virt_l1_model.h>
+#include <virtphy/l1ctl_sap.h>
+#include <virtphy/gsmtapl1_if.h>
+#include <virtphy/logging.h>
+#include <virtphy/virt_l1_sched.h>
+
+#define DEFAULT_LOG_MASK "DL1C,2:DL1P,2:DVIRPHY,2:DMAIN,1"
+
+/* this exists once in the program, and contains the state that we
+ * only keep once:  L1CTL server socket, GSMTAP/VirtUM socket */
+struct virtphy_context {
+	/* L1CTL socket server */
+	struct l1ctl_sock_inst *l1ctl_sock;
+	/* Virtual Um layer based on GSMTAP multicast */
+	struct virt_um_inst *virt_um;
+};
+
+static struct virtphy_context g_vphy;
+
+static char *dl_rx_grp = DEFAULT_MS_MCAST_GROUP;
+static char *ul_tx_grp = DEFAULT_BTS_MCAST_GROUP;
+static int port = GSMTAP_UDP_PORT;
+static char *log_mask = DEFAULT_LOG_MASK;
+static char *l1ctl_sock_path = L1CTL_SOCK_PATH;
+static char *arfcn_sig_lev_red_mask = NULL;
+static char *pm_timeout = NULL;
+
+static void print_usage()
+{
+	printf("Usage: virtphy\n");
+}
+
+static void print_help()
+{
+	printf("  Some useful help...\n");
+	printf("  -h --help 			This text.\n");
+	printf("  -z --dl-rx-grp 		ms multicast group.\n");
+	printf("  -y --ul-tx-grp 		bts multicast group.\n");
+	printf("  -x --port			udp port to use for communication with virtual BTS (GSMTAP)\n");
+	printf("  -d --log-mask			--log-mask=DRLL:DCC enable debugging.\n");
+	printf("  -s --l1ctl-sock            	l1ctl socket path path.\n");
+	printf("  -r --arfcn-sig-lev-red        reduce signal level (e.g. 666,12:888,43:176,22).\n");
+	printf("  -t --pm-timeout		power management timeout.\n");
+}
+
+static void handle_options(int argc, char **argv)
+{
+	while (1) {
+		int option_index = 0, c;
+		static struct option long_options[] = {
+			{"help", 0, 0, 'h'},
+			{"dl-rx-grp", required_argument, 0, 'z'},
+		        {"ul-tx-grp", required_argument, 0, 'y'},
+		        {"port", required_argument, 0, 'x'},
+		        {"log-mask", required_argument, 0, 'd'},
+		        {"l1ctl-sock", required_argument, 0, 's'},
+		        {"arfcn-sig-lev-red", required_argument, 0, 'r'},
+		        {"pm-timeout", required_argument, 0, 't'},
+		        {0, 0, 0, 0},
+		};
+		c = getopt_long(argc, argv, "hz:y:x:d:s:r:t:", long_options,
+		                &option_index);
+		if (c == -1)
+			break;
+
+		switch (c) {
+		case 'h':
+			print_usage();
+			print_help();
+			exit(0);
+		case 'z':
+			dl_rx_grp = optarg;
+			break;
+		case 'y':
+			ul_tx_grp = optarg;
+			break;
+		case 'x':
+			port = atoi(optarg);
+			break;
+		case 'd':
+			log_mask = optarg;
+			break;
+		case 's':
+			l1ctl_sock_path = optarg;
+			break;
+		case 'r':
+			arfcn_sig_lev_red_mask = optarg;
+			break;
+		case 't':
+			pm_timeout = optarg;
+			break;
+		default:
+			break;
+		}
+	}
+}
+
+void parse_pm_timeout(struct l1_model_ms *model, char *pm_timeout) {
+
+	if (!pm_timeout || (strcmp(pm_timeout, "") == 0))
+		return;
+
+	/* seconds */
+	char *buf = strtok(pm_timeout, ":");
+	model->state.pm.timeout_s = atoi(buf);
+	/* microseconds */
+	buf = strtok(NULL, ":");
+	if (buf)
+		model->state.pm.timeout_us = atoi(buf);
+}
+
+/**
+ * arfcn_sig_lev_red_mask has to be formatted like 666,12:888,43:176,22
+ */
+void parse_arfcn_sig_lev_red(struct l1_model_ms *model, char * arfcn_sig_lev_red_mask) {
+
+	if (!arfcn_sig_lev_red_mask || (strcmp(arfcn_sig_lev_red_mask, "") == 0))
+		return;
+
+	char *token = strtok(arfcn_sig_lev_red_mask, ":");
+	do {
+		char* colon = strstr(token, ",");
+		uint16_t arfcn;
+		uint8_t red;
+		if (!colon)
+			continue;
+
+		colon[0] = '\0';
+
+		arfcn = atoi(token);
+		red = atoi(colon + 1);
+
+		/* TODO: this may go wild if the token string is not properly formatted */
+		model->state.pm.meas.arfcn_sig_lev_red_dbm[arfcn] = red;
+	} while ((token = strtok(NULL, ":")));
+}
+
+/* create a new l1_model_ms instance when L1CTL socket accept()s new connection */
+static int l1ctl_accept_cb(struct l1ctl_sock_client *lsc)
+{
+	struct l1_model_ms *ms = l1_model_ms_init(lsc, lsc, g_vphy.virt_um);
+
+	if (!ms)
+		return -ENOMEM;
+
+	/* apply timeout and arfcn reduction value config to model */
+	parse_pm_timeout(ms, pm_timeout);
+	parse_arfcn_sig_lev_red(ms, arfcn_sig_lev_red_mask);
+
+	lsc->priv = ms;
+
+	return 0;
+}
+
+static void l1ctl_close_cb(struct l1ctl_sock_client *lsc)
+{
+	struct l1_model_ms *ms = lsc->priv;
+	l1_model_ms_destroy(ms);
+}
+
+static void *tall_vphy_ctx;
+
+static void signal_handler(int signum)
+{
+	LOGP(DMAIN, LOGL_NOTICE, "Signal %d received\n", signum);
+
+	switch (signum) {
+	case SIGINT:
+	case SIGTERM:
+		exit(0);
+		break;
+	case SIGUSR1:
+		talloc_report_full(tall_vphy_ctx, stderr);
+		break;
+	default:
+		break;
+	}
+}
+
+int main(int argc, char *argv[])
+{
+	tall_vphy_ctx = talloc_named_const(NULL, 1, "root");
+
+	msgb_talloc_ctx_init(tall_vphy_ctx, 0);
+	signal(SIGINT, &signal_handler);
+	signal(SIGTERM, &signal_handler);
+	signal(SIGUSR1, &signal_handler);
+	osmo_init_ignore_signals();
+
+	/* init loginfo */
+	handle_options(argc, argv);
+
+	ms_log_init(log_mask);
+
+	LOGP(DVIRPHY, LOGL_INFO, "Virtual physical layer starting up...\n");
+
+	g_vphy.virt_um = virt_um_init(tall_vphy_ctx, ul_tx_grp, port, dl_rx_grp, port,
+					gsmtapl1_rx_from_virt_um_inst_cb);
+
+	g_vphy.l1ctl_sock = l1ctl_sock_init(tall_vphy_ctx, l1ctl_sap_rx_from_l23_inst_cb,
+					    l1ctl_accept_cb, l1ctl_close_cb, l1ctl_sock_path);
+	g_vphy.virt_um->priv = g_vphy.l1ctl_sock;
+
+	LOGP(DVIRPHY, LOGL_INFO, "Virtual physical layer ready, waiting for l23 app(s) on %s\n",
+	     l1ctl_sock_path);
+
+	while (1) {
+		/* handle osmocom fd READ events (l1ctl-unix-socket, virtual-um-mcast-socket) */
+		osmo_select_main(0);
+	}
+
+	l1ctl_sock_destroy(g_vphy.l1ctl_sock);
+	virt_um_destroy(g_vphy.virt_um);
+
+	/* not reached */
+	return EXIT_FAILURE;
+}
diff --git a/src/shared/.gitignore b/src/shared/.gitignore
new file mode 100644
index 00000000..5058adb1
--- /dev/null
+++ b/src/shared/.gitignore
@@ -0,0 +1,5 @@
+libosmocore/build-host/tests/msgfile/msgfile_test
+libosmocore/build-host/tests/smscb/smscb_test
+libosmocore/build-host/tests/sms/sms_test
+libosmocore/build-host/tests/timer/timer_test
+libosmocore/build-host/tests/ussd/ussd_test
diff --git a/src/shared/libosmocore/.gitignore b/src/shared/libosmocore/.gitignore
new file mode 100644
index 00000000..ac19b238
--- /dev/null
+++ b/src/shared/libosmocore/.gitignore
@@ -0,0 +1,87 @@
+Makefile
+Makefile.in
+.deps
+.dirstamp
+.libs
+*.o
+*.lo
+*.la
+*.pc
+aclocal.m4
+acinclude.m4
+aminclude.am
+m4/*.m4
+autom4te.cache
+config.h*
+config.sub
+config.log
+config.status
+config.guess
+configure
+depcomp
+missing
+ltmain.sh
+install-sh
+stamp-h1
+libtool
+libosmocore-*.tar.*
+
+Doxyfile.core
+Doxyfile.gsm
+Doxyfile.vty
+Doxyfile.codec
+
+debian/autoreconf.after
+debian/autoreconf.before
+debian/files
+debian/libosmocore-dev/
+debian/libosmocore*.log
+debian/tmp/
+debian/libosmocore*.substvars
+debian/libosmocore/
+debian/libosmocore.post*.debhelper
+
+.tarball-version
+.version
+
+#gnu autotest
+tests/package.m4
+tests/atconfig
+tests/atlocal
+tests/osmo-test
+tests/package.m4
+tests/testsuite
+tests/testsuite.dir/
+tests/testsuite.log
+
+tests/sms/sms_test
+tests/timer/timer_test
+tests/msgfile/msgfile_test
+tests/ussd/ussd_test
+tests/smscb/smscb_test
+tests/bits/bitrev_test
+tests/a5/a5_test
+tests/auth/milenage_test
+tests/conv/conv_test
+tests/lapd/lapd_test
+tests/gsm0808/gsm0808_test
+tests/gb/bssgp_fc_test
+tests/gsm0408/gsm0408_test
+tests/logging/logging_test
+
+utils/osmo-arfcn
+utils/osmo-auc-gen
+
+doc/codec
+doc/core
+doc/vty/latex
+doc/vty/html
+doc/gsm
+doc/html.tar
+
+src/crc*gen.c
+include/osmocom/core/crc*gen.h
+
+
+# vi files
+*.sw?
diff --git a/src/shared/libosmocore/COPYING b/src/shared/libosmocore/COPYING
new file mode 100644
index 00000000..d511905c
--- /dev/null
+++ b/src/shared/libosmocore/COPYING
@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
diff --git a/src/shared/libosmocore/Doxyfile.codec.in b/src/shared/libosmocore/Doxyfile.codec.in
new file mode 100644
index 00000000..fcd5122e
--- /dev/null
+++ b/src/shared/libosmocore/Doxyfile.codec.in
@@ -0,0 +1,1716 @@
+# Doxyfile 1.7.4
+
+# This file describes the settings to be used by the documentation system
+# doxygen (www.doxygen.org) for a project.
+#
+# All text after a hash (#) is considered a comment and will be ignored.
+# The format is:
+#       TAG = value [value, ...]
+# For lists items can also be appended using:
+#       TAG += value [value, ...]
+# Values that contain spaces should be placed between quotes (" ").
+
+#---------------------------------------------------------------------------
+# Project related configuration options
+#---------------------------------------------------------------------------
+
+# This tag specifies the encoding used for all characters in the config file
+# that follow. The default is UTF-8 which is also the encoding used for all
+# text before the first occurrence of this tag. Doxygen uses libiconv (or the
+# iconv built into libc) for the transcoding. See
+# http://www.gnu.org/software/libiconv for the list of possible encodings.
+
+DOXYFILE_ENCODING      = UTF-8
+
+# The PROJECT_NAME tag is a single word (or a sequence of words surrounded
+# by quotes) that should identify the project.
+
+PROJECT_NAME           = libosmocodec
+
+# The PROJECT_NUMBER tag can be used to enter a project or revision number.
+# This could be handy for archiving the generated documentation or
+# if some version control system is used.
+
+PROJECT_NUMBER         = @VERSION@
+
+# Using the PROJECT_BRIEF tag one can provide an optional one line description
+# for a project that appears at the top of each page and should give viewer
+# a quick idea about the purpose of the project. Keep the description short.
+
+PROJECT_BRIEF          = "Osmocom codec library"
+
+# With the PROJECT_LOGO tag one can specify an logo or icon that is
+# included in the documentation. The maximum height of the logo should not
+# exceed 55 pixels and the maximum width should not exceed 200 pixels.
+# Doxygen will copy the logo to the output directory.
+
+PROJECT_LOGO           =
+
+# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
+# base path where the generated documentation will be put.
+# If a relative path is entered, it will be relative to the location
+# where doxygen was started. If left blank the current directory will be used.
+
+OUTPUT_DIRECTORY       = doc/codec
+
+# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create
+# 4096 sub-directories (in 2 levels) under the output directory of each output
+# format and will distribute the generated files over these directories.
+# Enabling this option can be useful when feeding doxygen a huge amount of
+# source files, where putting all generated files in the same directory would
+# otherwise cause performance problems for the file system.
+
+CREATE_SUBDIRS         = NO
+
+# The OUTPUT_LANGUAGE tag is used to specify the language in which all
+# documentation generated by doxygen is written. Doxygen will use this
+# information to generate all constant output in the proper language.
+# The default language is English, other supported languages are:
+# Afrikaans, Arabic, Brazilian, Catalan, Chinese, Chinese-Traditional,
+# Croatian, Czech, Danish, Dutch, Esperanto, Farsi, Finnish, French, German,
+# Greek, Hungarian, Italian, Japanese, Japanese-en (Japanese with English
+# messages), Korean, Korean-en, Lithuanian, Norwegian, Macedonian, Persian,
+# Polish, Portuguese, Romanian, Russian, Serbian, Serbian-Cyrillic, Slovak,
+# Slovene, Spanish, Swedish, Ukrainian, and Vietnamese.
+
+OUTPUT_LANGUAGE        = English
+
+# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will
+# include brief member descriptions after the members that are listed in
+# the file and class documentation (similar to JavaDoc).
+# Set to NO to disable this.
+
+BRIEF_MEMBER_DESC      = YES
+
+# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend
+# the brief description of a member or function before the detailed description.
+# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the
+# brief descriptions will be completely suppressed.
+
+REPEAT_BRIEF           = YES
+
+# This tag implements a quasi-intelligent brief description abbreviator
+# that is used to form the text in various listings. Each string
+# in this list, if found as the leading text of the brief description, will be
+# stripped from the text and the result after processing the whole list, is
+# used as the annotated text. Otherwise, the brief description is used as-is.
+# If left blank, the following values are used ("$name" is automatically
+# replaced with the name of the entity): "The $name class" "The $name widget"
+# "The $name file" "is" "provides" "specifies" "contains"
+# "represents" "a" "an" "the"
+
+ABBREVIATE_BRIEF       =
+
+# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then
+# Doxygen will generate a detailed section even if there is only a brief
+# description.
+
+ALWAYS_DETAILED_SEC    = NO
+
+# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all
+# inherited members of a class in the documentation of that class as if those
+# members were ordinary class members. Constructors, destructors and assignment
+# operators of the base classes will not be shown.
+
+INLINE_INHERITED_MEMB  = NO
+
+# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full
+# path before files name in the file list and in the header files. If set
+# to NO the shortest path that makes the file name unique will be used.
+
+FULL_PATH_NAMES        = YES
+
+# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag
+# can be used to strip a user-defined part of the path. Stripping is
+# only done if one of the specified strings matches the left-hand part of
+# the path. The tag can be used to show relative paths in the file list.
+# If left blank the directory from which doxygen is run is used as the
+# path to strip.
+
+STRIP_FROM_PATH        =
+
+# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of
+# the path mentioned in the documentation of a class, which tells
+# the reader which header file to include in order to use a class.
+# If left blank only the name of the header file containing the class
+# definition is used. Otherwise one should specify the include paths that
+# are normally passed to the compiler using the -I flag.
+
+STRIP_FROM_INC_PATH    =
+
+# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter
+# (but less readable) file names. This can be useful if your file system
+# doesn't support long names like on DOS, Mac, or CD-ROM.
+
+SHORT_NAMES            = NO
+
+# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen
+# will interpret the first line (until the first dot) of a JavaDoc-style
+# comment as the brief description. If set to NO, the JavaDoc
+# comments will behave just like regular Qt-style comments
+# (thus requiring an explicit @brief command for a brief description.)
+
+JAVADOC_AUTOBRIEF      = NO
+
+# If the QT_AUTOBRIEF tag is set to YES then Doxygen will
+# interpret the first line (until the first dot) of a Qt-style
+# comment as the brief description. If set to NO, the comments
+# will behave just like regular Qt-style comments (thus requiring
+# an explicit \brief command for a brief description.)
+
+QT_AUTOBRIEF           = NO
+
+# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen
+# treat a multi-line C++ special comment block (i.e. a block of //! or ///
+# comments) as a brief description. This used to be the default behaviour.
+# The new default is to treat a multi-line C++ comment block as a detailed
+# description. Set this tag to YES if you prefer the old behaviour instead.
+
+MULTILINE_CPP_IS_BRIEF = NO
+
+# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented
+# member inherits the documentation from any documented member that it
+# re-implements.
+
+INHERIT_DOCS           = YES
+
+# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce
+# a new page for each member. If set to NO, the documentation of a member will
+# be part of the file/class/namespace that contains it.
+
+SEPARATE_MEMBER_PAGES  = NO
+
+# The TAB_SIZE tag can be used to set the number of spaces in a tab.
+# Doxygen uses this value to replace tabs by spaces in code fragments.
+
+TAB_SIZE               = 8
+
+# This tag can be used to specify a number of aliases that acts
+# as commands in the documentation. An alias has the form "name=value".
+# For example adding "sideeffect=\par Side Effects:\n" will allow you to
+# put the command \sideeffect (or @sideeffect) in the documentation, which
+# will result in a user-defined paragraph with heading "Side Effects:".
+# You can put \n's in the value part of an alias to insert newlines.
+
+ALIASES                =
+
+# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C
+# sources only. Doxygen will then generate output that is more tailored for C.
+# For instance, some of the names that are used will be different. The list
+# of all members will be omitted, etc.
+
+OPTIMIZE_OUTPUT_FOR_C  = YES
+
+# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java
+# sources only. Doxygen will then generate output that is more tailored for
+# Java. For instance, namespaces will be presented as packages, qualified
+# scopes will look different, etc.
+
+OPTIMIZE_OUTPUT_JAVA   = NO
+
+# Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran
+# sources only. Doxygen will then generate output that is more tailored for
+# Fortran.
+
+OPTIMIZE_FOR_FORTRAN   = NO
+
+# Set the OPTIMIZE_OUTPUT_VHDL tag to YES if your project consists of VHDL
+# sources. Doxygen will then generate output that is tailored for
+# VHDL.
+
+OPTIMIZE_OUTPUT_VHDL   = NO
+
+# Doxygen selects the parser to use depending on the extension of the files it
+# parses. With this tag you can assign which parser to use for a given extension.
+# Doxygen has a built-in mapping, but you can override or extend it using this
+# tag. The format is ext=language, where ext is a file extension, and language
+# is one of the parsers supported by doxygen: IDL, Java, Javascript, CSharp, C,
+# C++, D, PHP, Objective-C, Python, Fortran, VHDL, C, C++. For instance to make
+# doxygen treat .inc files as Fortran files (default is PHP), and .f files as C
+# (default is Fortran), use: inc=Fortran f=C. Note that for custom extensions
+# you also need to set FILE_PATTERNS otherwise the files are not read by doxygen.
+
+EXTENSION_MAPPING      =
+
+# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want
+# to include (a tag file for) the STL sources as input, then you should
+# set this tag to YES in order to let doxygen match functions declarations and
+# definitions whose arguments contain STL classes (e.g. func(std::string); v.s.
+# func(std::string) {}). This also makes the inheritance and collaboration
+# diagrams that involve STL classes more complete and accurate.
+
+BUILTIN_STL_SUPPORT    = NO
+
+# If you use Microsoft's C++/CLI language, you should set this option to YES to
+# enable parsing support.
+
+CPP_CLI_SUPPORT        = NO
+
+# Set the SIP_SUPPORT tag to YES if your project consists of sip sources only.
+# Doxygen will parse them like normal C++ but will assume all classes use public
+# instead of private inheritance when no explicit protection keyword is present.
+
+SIP_SUPPORT            = NO
+
+# For Microsoft's IDL there are propget and propput attributes to indicate getter
+# and setter methods for a property. Setting this option to YES (the default)
+# will make doxygen replace the get and set methods by a property in the
+# documentation. This will only work if the methods are indeed getting or
+# setting a simple type. If this is not the case, or you want to show the
+# methods anyway, you should set this option to NO.
+
+IDL_PROPERTY_SUPPORT   = YES
+
+# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC
+# tag is set to YES, then doxygen will reuse the documentation of the first
+# member in the group (if any) for the other members of the group. By default
+# all members of a group must be documented explicitly.
+
+DISTRIBUTE_GROUP_DOC   = NO
+
+# Set the SUBGROUPING tag to YES (the default) to allow class member groups of
+# the same type (for instance a group of public functions) to be put as a
+# subgroup of that type (e.g. under the Public Functions section). Set it to
+# NO to prevent subgrouping. Alternatively, this can be done per class using
+# the \nosubgrouping command.
+
+SUBGROUPING            = YES
+
+# When the INLINE_GROUPED_CLASSES tag is set to YES, classes, structs and
+# unions are shown inside the group in which they are included (e.g. using
+# @ingroup) instead of on a separate page (for HTML and Man pages) or
+# section (for LaTeX and RTF).
+
+INLINE_GROUPED_CLASSES = NO
+
+# When TYPEDEF_HIDES_STRUCT is enabled, a typedef of a struct, union, or enum
+# is documented as struct, union, or enum with the name of the typedef. So
+# typedef struct TypeS {} TypeT, will appear in the documentation as a struct
+# with name TypeT. When disabled the typedef will appear as a member of a file,
+# namespace, or class. And the struct will be named TypeS. This can typically
+# be useful for C code in case the coding convention dictates that all compound
+# types are typedef'ed and only the typedef is referenced, never the tag name.
+
+TYPEDEF_HIDES_STRUCT   = NO
+
+# The SYMBOL_CACHE_SIZE determines the size of the internal cache use to
+# determine which symbols to keep in memory and which to flush to disk.
+# When the cache is full, less often used symbols will be written to disk.
+# For small to medium size projects (<1000 input files) the default value is
+# probably good enough. For larger projects a too small cache size can cause
+# doxygen to be busy swapping symbols to and from disk most of the time
+# causing a significant performance penalty.
+# If the system has enough physical memory increasing the cache will improve the
+# performance by keeping more symbols in memory. Note that the value works on
+# a logarithmic scale so increasing the size by one will roughly double the
+# memory usage. The cache size is given by this formula:
+# 2^(16+SYMBOL_CACHE_SIZE). The valid range is 0..9, the default is 0,
+# corresponding to a cache size of 2^16 = 65536 symbols
+
+SYMBOL_CACHE_SIZE      = 0
+
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+
+# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in
+# documentation are documented, even if no documentation was available.
+# Private class members and static file members will be hidden unless
+# the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES
+
+EXTRACT_ALL            = NO
+
+# If the EXTRACT_PRIVATE tag is set to YES all private members of a class
+# will be included in the documentation.
+
+EXTRACT_PRIVATE        = NO
+
+# If the EXTRACT_STATIC tag is set to YES all static members of a file
+# will be included in the documentation.
+
+EXTRACT_STATIC         = YES
+
+# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs)
+# defined locally in source files will be included in the documentation.
+# If set to NO only classes defined in header files are included.
+
+EXTRACT_LOCAL_CLASSES  = YES
+
+# This flag is only useful for Objective-C code. When set to YES local
+# methods, which are defined in the implementation section but not in
+# the interface are included in the documentation.
+# If set to NO (the default) only methods in the interface are included.
+
+EXTRACT_LOCAL_METHODS  = NO
+
+# If this flag is set to YES, the members of anonymous namespaces will be
+# extracted and appear in the documentation as a namespace called
+# 'anonymous_namespace{file}', where file will be replaced with the base
+# name of the file that contains the anonymous namespace. By default
+# anonymous namespaces are hidden.
+
+EXTRACT_ANON_NSPACES   = NO
+
+# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all
+# undocumented members of documented classes, files or namespaces.
+# If set to NO (the default) these members will be included in the
+# various overviews, but no documentation section is generated.
+# This option has no effect if EXTRACT_ALL is enabled.
+
+HIDE_UNDOC_MEMBERS     = NO
+
+# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all
+# undocumented classes that are normally visible in the class hierarchy.
+# If set to NO (the default) these classes will be included in the various
+# overviews. This option has no effect if EXTRACT_ALL is enabled.
+
+HIDE_UNDOC_CLASSES     = NO
+
+# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all
+# friend (class|struct|union) declarations.
+# If set to NO (the default) these declarations will be included in the
+# documentation.
+
+HIDE_FRIEND_COMPOUNDS  = NO
+
+# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any
+# documentation blocks found inside the body of a function.
+# If set to NO (the default) these blocks will be appended to the
+# function's detailed documentation block.
+
+HIDE_IN_BODY_DOCS      = NO
+
+# The INTERNAL_DOCS tag determines if documentation
+# that is typed after a \internal command is included. If the tag is set
+# to NO (the default) then the documentation will be excluded.
+# Set it to YES to include the internal documentation.
+
+INTERNAL_DOCS          = NO
+
+# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate
+# file names in lower-case letters. If set to YES upper-case letters are also
+# allowed. This is useful if you have classes or files whose names only differ
+# in case and if your file system supports case sensitive file names. Windows
+# and Mac users are advised to set this option to NO.
+
+CASE_SENSE_NAMES       = YES
+
+# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen
+# will show members with their full class and namespace scopes in the
+# documentation. If set to YES the scope will be hidden.
+
+HIDE_SCOPE_NAMES       = NO
+
+# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen
+# will put a list of the files that are included by a file in the documentation
+# of that file.
+
+SHOW_INCLUDE_FILES     = YES
+
+# If the FORCE_LOCAL_INCLUDES tag is set to YES then Doxygen
+# will list include files with double quotes in the documentation
+# rather than with sharp brackets.
+
+FORCE_LOCAL_INCLUDES   = NO
+
+# If the INLINE_INFO tag is set to YES (the default) then a tag [inline]
+# is inserted in the documentation for inline members.
+
+INLINE_INFO            = YES
+
+# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen
+# will sort the (detailed) documentation of file and class members
+# alphabetically by member name. If set to NO the members will appear in
+# declaration order.
+
+SORT_MEMBER_DOCS       = YES
+
+# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the
+# brief documentation of file, namespace and class members alphabetically
+# by member name. If set to NO (the default) the members will appear in
+# declaration order.
+
+SORT_BRIEF_DOCS        = NO
+
+# If the SORT_MEMBERS_CTORS_1ST tag is set to YES then doxygen
+# will sort the (brief and detailed) documentation of class members so that
+# constructors and destructors are listed first. If set to NO (the default)
+# the constructors will appear in the respective orders defined by
+# SORT_MEMBER_DOCS and SORT_BRIEF_DOCS.
+# This tag will be ignored for brief docs if SORT_BRIEF_DOCS is set to NO
+# and ignored for detailed docs if SORT_MEMBER_DOCS is set to NO.
+
+SORT_MEMBERS_CTORS_1ST = NO
+
+# If the SORT_GROUP_NAMES tag is set to YES then doxygen will sort the
+# hierarchy of group names into alphabetical order. If set to NO (the default)
+# the group names will appear in their defined order.
+
+SORT_GROUP_NAMES       = NO
+
+# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be
+# sorted by fully-qualified names, including namespaces. If set to
+# NO (the default), the class list will be sorted only by class name,
+# not including the namespace part.
+# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES.
+# Note: This option applies only to the class list, not to the
+# alphabetical list.
+
+SORT_BY_SCOPE_NAME     = NO
+
+# If the STRICT_PROTO_MATCHING option is enabled and doxygen fails to
+# do proper type resolution of all parameters of a function it will reject a
+# match between the prototype and the implementation of a member function even
+# if there is only one candidate or it is obvious which candidate to choose
+# by doing a simple string match. By disabling STRICT_PROTO_MATCHING doxygen
+# will still accept a match between prototype and implementation in such cases.
+
+STRICT_PROTO_MATCHING  = NO
+
+# The GENERATE_TODOLIST tag can be used to enable (YES) or
+# disable (NO) the todo list. This list is created by putting \todo
+# commands in the documentation.
+
+GENERATE_TODOLIST      = YES
+
+# The GENERATE_TESTLIST tag can be used to enable (YES) or
+# disable (NO) the test list. This list is created by putting \test
+# commands in the documentation.
+
+GENERATE_TESTLIST      = YES
+
+# The GENERATE_BUGLIST tag can be used to enable (YES) or
+# disable (NO) the bug list. This list is created by putting \bug
+# commands in the documentation.
+
+GENERATE_BUGLIST       = YES
+
+# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or
+# disable (NO) the deprecated list. This list is created by putting
+# \deprecated commands in the documentation.
+
+GENERATE_DEPRECATEDLIST= YES
+
+# The ENABLED_SECTIONS tag can be used to enable conditional
+# documentation sections, marked by \if sectionname ... \endif.
+
+ENABLED_SECTIONS       =
+
+# The MAX_INITIALIZER_LINES tag determines the maximum number of lines
+# the initial value of a variable or macro consists of for it to appear in
+# the documentation. If the initializer consists of more lines than specified
+# here it will be hidden. Use a value of 0 to hide initializers completely.
+# The appearance of the initializer of individual variables and macros in the
+# documentation can be controlled using \showinitializer or \hideinitializer
+# command in the documentation regardless of this setting.
+
+MAX_INITIALIZER_LINES  = 30
+
+# Set the SHOW_USED_FILES tag to NO to disable the list of files generated
+# at the bottom of the documentation of classes and structs. If set to YES the
+# list will mention the files that were used to generate the documentation.
+
+SHOW_USED_FILES        = YES
+
+# If the sources in your project are distributed over multiple directories
+# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy
+# in the documentation. The default is NO.
+
+SHOW_DIRECTORIES       = NO
+
+# Set the SHOW_FILES tag to NO to disable the generation of the Files page.
+# This will remove the Files entry from the Quick Index and from the
+# Folder Tree View (if specified). The default is YES.
+
+SHOW_FILES             = YES
+
+# Set the SHOW_NAMESPACES tag to NO to disable the generation of the
+# Namespaces page.
+# This will remove the Namespaces entry from the Quick Index
+# and from the Folder Tree View (if specified). The default is YES.
+
+SHOW_NAMESPACES        = YES
+
+# The FILE_VERSION_FILTER tag can be used to specify a program or script that
+# doxygen should invoke to get the current version for each file (typically from
+# the version control system). Doxygen will invoke the program by executing (via
+# popen()) the command <command> <input-file>, where <command> is the value of
+# the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file
+# provided by doxygen. Whatever the program writes to standard output
+# is used as the file version. See the manual for examples.
+
+FILE_VERSION_FILTER    =
+
+# The LAYOUT_FILE tag can be used to specify a layout file which will be parsed
+# by doxygen. The layout file controls the global structure of the generated
+# output files in an output format independent way. The create the layout file
+# that represents doxygen's defaults, run doxygen with the -l option.
+# You can optionally specify a file name after the option, if omitted
+# DoxygenLayout.xml will be used as the name of the layout file.
+
+LAYOUT_FILE            =
+
+#---------------------------------------------------------------------------
+# configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+
+# The QUIET tag can be used to turn on/off the messages that are generated
+# by doxygen. Possible values are YES and NO. If left blank NO is used.
+
+QUIET                  = NO
+
+# The WARNINGS tag can be used to turn on/off the warning messages that are
+# generated by doxygen. Possible values are YES and NO. If left blank
+# NO is used.
+
+WARNINGS               = YES
+
+# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings
+# for undocumented members. If EXTRACT_ALL is set to YES then this flag will
+# automatically be disabled.
+
+WARN_IF_UNDOCUMENTED   = YES
+
+# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for
+# potential errors in the documentation, such as not documenting some
+# parameters in a documented function, or documenting parameters that
+# don't exist or using markup commands wrongly.
+
+WARN_IF_DOC_ERROR      = YES
+
+# The WARN_NO_PARAMDOC option can be enabled to get warnings for
+# functions that are documented, but have no documentation for their parameters
+# or return value. If set to NO (the default) doxygen will only warn about
+# wrong or incomplete parameter documentation, but not about the absence of
+# documentation.
+
+WARN_NO_PARAMDOC       = NO
+
+# The WARN_FORMAT tag determines the format of the warning messages that
+# doxygen can produce. The string should contain the $file, $line, and $text
+# tags, which will be replaced by the file and line number from which the
+# warning originated and the warning text. Optionally the format may contain
+# $version, which will be replaced by the version of the file (if it could
+# be obtained via FILE_VERSION_FILTER)
+
+WARN_FORMAT            = "$file:$line: $text"
+
+# The WARN_LOGFILE tag can be used to specify a file to which warning
+# and error messages should be written. If left blank the output is written
+# to stderr.
+
+WARN_LOGFILE           =
+
+#---------------------------------------------------------------------------
+# configuration options related to the input files
+#---------------------------------------------------------------------------
+
+# The INPUT tag can be used to specify the files and/or directories that contain
+# documented source files. You may enter file names like "myfile.cpp" or
+# directories like "/usr/src/myproject". Separate the files or directories
+# with spaces.
+
+INPUT                  = include/osmocom/codec src/codec
+
+# This tag can be used to specify the character encoding of the source files
+# that doxygen parses. Internally doxygen uses the UTF-8 encoding, which is
+# also the default input encoding. Doxygen uses libiconv (or the iconv built
+# into libc) for the transcoding. See http://www.gnu.org/software/libiconv for
+# the list of possible encodings.
+
+INPUT_ENCODING         = UTF-8
+
+# If the value of the INPUT tag contains directories, you can use the
+# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
+# and *.h) to filter out the source-files in the directories. If left
+# blank the following patterns are tested:
+# *.c *.cc *.cxx *.cpp *.c++ *.d *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh
+# *.hxx *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.dox *.py
+# *.f90 *.f *.for *.vhd *.vhdl
+
+FILE_PATTERNS          =
+
+# The RECURSIVE tag can be used to turn specify whether or not subdirectories
+# should be searched for input files as well. Possible values are YES and NO.
+# If left blank NO is used.
+
+RECURSIVE              = YES
+
+# The EXCLUDE tag can be used to specify files and/or directories that should
+# excluded from the INPUT source files. This way you can easily exclude a
+# subdirectory from a directory tree whose root is specified with the INPUT tag.
+
+EXCLUDE                =
+
+# The EXCLUDE_SYMLINKS tag can be used select whether or not files or
+# directories that are symbolic links (a Unix file system feature) are excluded
+# from the input.
+
+EXCLUDE_SYMLINKS       = NO
+
+# If the value of the INPUT tag contains directories, you can use the
+# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude
+# certain files from those directories. Note that the wildcards are matched
+# against the file with absolute path, so to exclude all test directories
+# for example use the pattern */test/*
+
+EXCLUDE_PATTERNS       =
+
+# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names
+# (namespaces, classes, functions, etc.) that should be excluded from the
+# output. The symbol name can be a fully qualified name, a word, or if the
+# wildcard * is used, a substring. Examples: ANamespace, AClass,
+# AClass::ANamespace, ANamespace::*Test
+
+EXCLUDE_SYMBOLS        =
+
+# The EXAMPLE_PATH tag can be used to specify one or more files or
+# directories that contain example code fragments that are included (see
+# the \include command).
+
+EXAMPLE_PATH           =
+
+# If the value of the EXAMPLE_PATH tag contains directories, you can use the
+# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
+# and *.h) to filter out the source-files in the directories. If left
+# blank all files are included.
+
+EXAMPLE_PATTERNS       =
+
+# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be
+# searched for input files to be used with the \include or \dontinclude
+# commands irrespective of the value of the RECURSIVE tag.
+# Possible values are YES and NO. If left blank NO is used.
+
+EXAMPLE_RECURSIVE      = NO
+
+# The IMAGE_PATH tag can be used to specify one or more files or
+# directories that contain image that are included in the documentation (see
+# the \image command).
+
+IMAGE_PATH             = images/
+
+# The INPUT_FILTER tag can be used to specify a program that doxygen should
+# invoke to filter for each input file. Doxygen will invoke the filter program
+# by executing (via popen()) the command <filter> <input-file>, where <filter>
+# is the value of the INPUT_FILTER tag, and <input-file> is the name of an
+# input file. Doxygen will then use the output that the filter program writes
+# to standard output.
+# If FILTER_PATTERNS is specified, this tag will be
+# ignored.
+
+INPUT_FILTER           =
+
+# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern
+# basis.
+# Doxygen will compare the file name with each pattern and apply the
+# filter if there is a match.
+# The filters are a list of the form:
+# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further
+# info on how filters are used. If FILTER_PATTERNS is empty or if
+# non of the patterns match the file name, INPUT_FILTER is applied.
+
+FILTER_PATTERNS        =
+
+# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using
+# INPUT_FILTER) will be used to filter the input files when producing source
+# files to browse (i.e. when SOURCE_BROWSER is set to YES).
+
+FILTER_SOURCE_FILES    = NO
+
+# The FILTER_SOURCE_PATTERNS tag can be used to specify source filters per file
+# pattern. A pattern will override the setting for FILTER_PATTERN (if any)
+# and it is also possible to disable source filtering for a specific pattern
+# using *.ext= (so without naming a filter). This option only has effect when
+# FILTER_SOURCE_FILES is enabled.
+
+FILTER_SOURCE_PATTERNS =
+
+#---------------------------------------------------------------------------
+# configuration options related to source browsing
+#---------------------------------------------------------------------------
+
+# If the SOURCE_BROWSER tag is set to YES then a list of source files will
+# be generated. Documented entities will be cross-referenced with these sources.
+# Note: To get rid of all source code in the generated output, make sure also
+# VERBATIM_HEADERS is set to NO.
+
+SOURCE_BROWSER         = NO
+
+# Setting the INLINE_SOURCES tag to YES will include the body
+# of functions and classes directly in the documentation.
+
+INLINE_SOURCES         = NO
+
+# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct
+# doxygen to hide any special comment blocks from generated source code
+# fragments. Normal C and C++ comments will always remain visible.
+
+STRIP_CODE_COMMENTS    = YES
+
+# If the REFERENCED_BY_RELATION tag is set to YES
+# then for each documented function all documented
+# functions referencing it will be listed.
+
+REFERENCED_BY_RELATION = YES
+
+# If the REFERENCES_RELATION tag is set to YES
+# then for each documented function all documented entities
+# called/used by that function will be listed.
+
+REFERENCES_RELATION    = YES
+
+# If the REFERENCES_LINK_SOURCE tag is set to YES (the default)
+# and SOURCE_BROWSER tag is set to YES, then the hyperlinks from
+# functions in REFERENCES_RELATION and REFERENCED_BY_RELATION lists will
+# link to the source code.
+# Otherwise they will link to the documentation.
+
+REFERENCES_LINK_SOURCE = YES
+
+# If the USE_HTAGS tag is set to YES then the references to source code
+# will point to the HTML generated by the htags(1) tool instead of doxygen
+# built-in source browser. The htags tool is part of GNU's global source
+# tagging system (see http://www.gnu.org/software/global/global.html). You
+# will need version 4.8.6 or higher.
+
+USE_HTAGS              = NO
+
+# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen
+# will generate a verbatim copy of the header file for each class for
+# which an include is specified. Set to NO to disable this.
+
+VERBATIM_HEADERS       = YES
+
+#---------------------------------------------------------------------------
+# configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+
+# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index
+# of all compounds will be generated. Enable this if the project
+# contains a lot of classes, structs, unions or interfaces.
+
+ALPHABETICAL_INDEX     = NO
+
+# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then
+# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns
+# in which this list will be split (can be a number in the range [1..20])
+
+COLS_IN_ALPHA_INDEX    = 5
+
+# In case all classes in a project start with a common prefix, all
+# classes will be put under the same header in the alphabetical index.
+# The IGNORE_PREFIX tag can be used to specify one or more prefixes that
+# should be ignored while generating the index headers.
+
+IGNORE_PREFIX          =
+
+#---------------------------------------------------------------------------
+# configuration options related to the HTML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_HTML tag is set to YES (the default) Doxygen will
+# generate HTML output.
+
+GENERATE_HTML          = YES
+
+# The HTML_OUTPUT tag is used to specify where the HTML docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `html' will be used as the default path.
+
+HTML_OUTPUT            = html
+
+# The HTML_FILE_EXTENSION tag can be used to specify the file extension for
+# each generated HTML page (for example: .htm,.php,.asp). If it is left blank
+# doxygen will generate files with .html extension.
+
+HTML_FILE_EXTENSION    = .html
+
+# The HTML_HEADER tag can be used to specify a personal HTML header for
+# each generated HTML page. If it is left blank doxygen will generate a
+# standard header. Note that when using a custom header you are responsible
+# for the proper inclusion of any scripts and style sheets that doxygen
+# needs, which is dependent on the configuration options used.
+# It is adviced to generate a default header using "doxygen -w html
+# header.html footer.html stylesheet.css YourConfigFile" and then modify
+# that header. Note that the header is subject to change so you typically
+# have to redo this when upgrading to a newer version of doxygen or when changing the value of configuration settings such as GENERATE_TREEVIEW!
+
+HTML_HEADER            =
+
+# The HTML_FOOTER tag can be used to specify a personal HTML footer for
+# each generated HTML page. If it is left blank doxygen will generate a
+# standard footer.
+
+HTML_FOOTER            =
+
+# The HTML_STYLESHEET tag can be used to specify a user-defined cascading
+# style sheet that is used by each HTML page. It can be used to
+# fine-tune the look of the HTML output. If the tag is left blank doxygen
+# will generate a default style sheet. Note that doxygen will try to copy
+# the style sheet file to the HTML output directory, so don't put your own
+# stylesheet in the HTML output directory as well, or it will be erased!
+
+HTML_STYLESHEET        =
+
+# The HTML_EXTRA_FILES tag can be used to specify one or more extra images or
+# other source files which should be copied to the HTML output directory. Note
+# that these files will be copied to the base HTML output directory. Use the
+# $relpath$ marker in the HTML_HEADER and/or HTML_FOOTER files to load these
+# files. In the HTML_STYLESHEET file, use the file name only. Also note that
+# the files will be copied as-is; there are no commands or markers available.
+
+HTML_EXTRA_FILES       =
+
+# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output.
+# Doxygen will adjust the colors in the stylesheet and background images
+# according to this color. Hue is specified as an angle on a colorwheel,
+# see http://en.wikipedia.org/wiki/Hue for more information.
+# For instance the value 0 represents red, 60 is yellow, 120 is green,
+# 180 is cyan, 240 is blue, 300 purple, and 360 is red again.
+# The allowed range is 0 to 359.
+
+HTML_COLORSTYLE_HUE    = 220
+
+# The HTML_COLORSTYLE_SAT tag controls the purity (or saturation) of
+# the colors in the HTML output. For a value of 0 the output will use
+# grayscales only. A value of 255 will produce the most vivid colors.
+
+HTML_COLORSTYLE_SAT    = 100
+
+# The HTML_COLORSTYLE_GAMMA tag controls the gamma correction applied to
+# the luminance component of the colors in the HTML output. Values below
+# 100 gradually make the output lighter, whereas values above 100 make
+# the output darker. The value divided by 100 is the actual gamma applied,
+# so 80 represents a gamma of 0.8, The value 220 represents a gamma of 2.2,
+# and 100 does not change the gamma.
+
+HTML_COLORSTYLE_GAMMA  = 80
+
+# If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML
+# page will contain the date and time when the page was generated. Setting
+# this to NO can help when comparing the output of multiple runs.
+
+HTML_TIMESTAMP         = YES
+
+# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes,
+# files or namespaces will be aligned in HTML using tables. If set to
+# NO a bullet list will be used.
+
+HTML_ALIGN_MEMBERS     = YES
+
+# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML
+# documentation will contain sections that can be hidden and shown after the
+# page has loaded. For this to work a browser that supports
+# JavaScript and DHTML is required (for instance Mozilla 1.0+, Firefox
+# Netscape 6.0+, Internet explorer 5.0+, Konqueror, or Safari).
+
+HTML_DYNAMIC_SECTIONS  = NO
+
+# If the GENERATE_DOCSET tag is set to YES, additional index files
+# will be generated that can be used as input for Apple's Xcode 3
+# integrated development environment, introduced with OSX 10.5 (Leopard).
+# To create a documentation set, doxygen will generate a Makefile in the
+# HTML output directory. Running make will produce the docset in that
+# directory and running "make install" will install the docset in
+# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find
+# it at startup.
+# See http://developer.apple.com/tools/creatingdocsetswithdoxygen.html
+# for more information.
+
+GENERATE_DOCSET        = NO
+
+# When GENERATE_DOCSET tag is set to YES, this tag determines the name of the
+# feed. A documentation feed provides an umbrella under which multiple
+# documentation sets from a single provider (such as a company or product suite)
+# can be grouped.
+
+DOCSET_FEEDNAME        = "Doxygen generated docs"
+
+# When GENERATE_DOCSET tag is set to YES, this tag specifies a string that
+# should uniquely identify the documentation set bundle. This should be a
+# reverse domain-name style string, e.g. com.mycompany.MyDocSet. Doxygen
+# will append .docset to the name.
+
+DOCSET_BUNDLE_ID       = org.doxygen.Project
+
+# When GENERATE_PUBLISHER_ID tag specifies a string that should uniquely identify
+# the documentation publisher. This should be a reverse domain-name style
+# string, e.g. com.mycompany.MyDocSet.documentation.
+
+DOCSET_PUBLISHER_ID    = org.doxygen.Publisher
+
+# The GENERATE_PUBLISHER_NAME tag identifies the documentation publisher.
+
+DOCSET_PUBLISHER_NAME  = Publisher
+
+# If the GENERATE_HTMLHELP tag is set to YES, additional index files
+# will be generated that can be used as input for tools like the
+# Microsoft HTML help workshop to generate a compiled HTML help file (.chm)
+# of the generated HTML documentation.
+
+GENERATE_HTMLHELP      = NO
+
+# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can
+# be used to specify the file name of the resulting .chm file. You
+# can add a path in front of the file if the result should not be
+# written to the html output directory.
+
+CHM_FILE               =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can
+# be used to specify the location (absolute path including file name) of
+# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run
+# the HTML help compiler on the generated index.hhp.
+
+HHC_LOCATION           =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag
+# controls if a separate .chi index file is generated (YES) or that
+# it should be included in the master .chm file (NO).
+
+GENERATE_CHI           = NO
+
+# If the GENERATE_HTMLHELP tag is set to YES, the CHM_INDEX_ENCODING
+# is used to encode HtmlHelp index (hhk), content (hhc) and project file
+# content.
+
+CHM_INDEX_ENCODING     =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag
+# controls whether a binary table of contents is generated (YES) or a
+# normal table of contents (NO) in the .chm file.
+
+BINARY_TOC             = NO
+
+# The TOC_EXPAND flag can be set to YES to add extra items for group members
+# to the contents of the HTML help documentation and to the tree view.
+
+TOC_EXPAND             = NO
+
+# If the GENERATE_QHP tag is set to YES and both QHP_NAMESPACE and
+# QHP_VIRTUAL_FOLDER are set, an additional index file will be generated
+# that can be used as input for Qt's qhelpgenerator to generate a
+# Qt Compressed Help (.qch) of the generated HTML documentation.
+
+GENERATE_QHP           = NO
+
+# If the QHG_LOCATION tag is specified, the QCH_FILE tag can
+# be used to specify the file name of the resulting .qch file.
+# The path specified is relative to the HTML output folder.
+
+QCH_FILE               =
+
+# The QHP_NAMESPACE tag specifies the namespace to use when generating
+# Qt Help Project output. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#namespace
+
+QHP_NAMESPACE          = org.doxygen.Project
+
+# The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating
+# Qt Help Project output. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#virtual-folders
+
+QHP_VIRTUAL_FOLDER     = doc
+
+# If QHP_CUST_FILTER_NAME is set, it specifies the name of a custom filter to
+# add. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#custom-filters
+
+QHP_CUST_FILTER_NAME   =
+
+# The QHP_CUST_FILT_ATTRS tag specifies the list of the attributes of the
+# custom filter to add. For more information please see
+# <a href="http://doc.trolltech.com/qthelpproject.html#custom-filters">
+# Qt Help Project / Custom Filters</a>.
+
+QHP_CUST_FILTER_ATTRS  =
+
+# The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this
+# project's
+# filter section matches.
+# <a href="http://doc.trolltech.com/qthelpproject.html#filter-attributes">
+# Qt Help Project / Filter Attributes</a>.
+
+QHP_SECT_FILTER_ATTRS  =
+
+# If the GENERATE_QHP tag is set to YES, the QHG_LOCATION tag can
+# be used to specify the location of Qt's qhelpgenerator.
+# If non-empty doxygen will try to run qhelpgenerator on the generated
+# .qhp file.
+
+QHG_LOCATION           =
+
+# If the GENERATE_ECLIPSEHELP tag is set to YES, additional index files
+#  will be generated, which together with the HTML files, form an Eclipse help
+# plugin. To install this plugin and make it available under the help contents
+# menu in Eclipse, the contents of the directory containing the HTML and XML
+# files needs to be copied into the plugins directory of eclipse. The name of
+# the directory within the plugins directory should be the same as
+# the ECLIPSE_DOC_ID value. After copying Eclipse needs to be restarted before
+# the help appears.
+
+GENERATE_ECLIPSEHELP   = NO
+
+# A unique identifier for the eclipse help plugin. When installing the plugin
+# the directory name containing the HTML and XML files should also have
+# this name.
+
+ECLIPSE_DOC_ID         = org.doxygen.Project
+
+# The DISABLE_INDEX tag can be used to turn on/off the condensed index at
+# top of each HTML page. The value NO (the default) enables the index and
+# the value YES disables it.
+
+DISABLE_INDEX          = NO
+
+# The ENUM_VALUES_PER_LINE tag can be used to set the number of enum values
+# (range [0,1..20]) that doxygen will group on one line in the generated HTML
+# documentation. Note that a value of 0 will completely suppress the enum
+# values from appearing in the overview section.
+
+ENUM_VALUES_PER_LINE   = 4
+
+# The GENERATE_TREEVIEW tag is used to specify whether a tree-like index
+# structure should be generated to display hierarchical information.
+# If the tag value is set to YES, a side panel will be generated
+# containing a tree-like index structure (just like the one that
+# is generated for HTML Help). For this to work a browser that supports
+# JavaScript, DHTML, CSS and frames is required (i.e. any modern browser).
+# Windows users are probably better off using the HTML help feature.
+
+GENERATE_TREEVIEW      = YES
+
+# By enabling USE_INLINE_TREES, doxygen will generate the Groups, Directories,
+# and Class Hierarchy pages using a tree view instead of an ordered list.
+
+USE_INLINE_TREES       = NO
+
+# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be
+# used to set the initial width (in pixels) of the frame in which the tree
+# is shown.
+
+TREEVIEW_WIDTH         = 250
+
+# When the EXT_LINKS_IN_WINDOW option is set to YES doxygen will open
+# links to external symbols imported via tag files in a separate window.
+
+EXT_LINKS_IN_WINDOW    = NO
+
+# Use this tag to change the font size of Latex formulas included
+# as images in the HTML documentation. The default is 10. Note that
+# when you change the font size after a successful doxygen run you need
+# to manually remove any form_*.png images from the HTML output directory
+# to force them to be regenerated.
+
+FORMULA_FONTSIZE       = 10
+
+# Use the FORMULA_TRANPARENT tag to determine whether or not the images
+# generated for formulas are transparent PNGs. Transparent PNGs are
+# not supported properly for IE 6.0, but are supported on all modern browsers.
+# Note that when changing this option you need to delete any form_*.png files
+# in the HTML output before the changes have effect.
+
+FORMULA_TRANSPARENT    = YES
+
+# Enable the USE_MATHJAX option to render LaTeX formulas using MathJax
+# (see http://www.mathjax.org) which uses client side Javascript for the
+# rendering instead of using prerendered bitmaps. Use this if you do not
+# have LaTeX installed or if you want to formulas look prettier in the HTML
+# output. When enabled you also need to install MathJax separately and
+# configure the path to it using the MATHJAX_RELPATH option.
+
+USE_MATHJAX            = NO
+
+# When MathJax is enabled you need to specify the location relative to the
+# HTML output directory using the MATHJAX_RELPATH option. The destination
+# directory should contain the MathJax.js script. For instance, if the mathjax
+# directory is located at the same level as the HTML output directory, then
+# MATHJAX_RELPATH should be ../mathjax. The default value points to the
+# mathjax.org site, so you can quickly see the result without installing
+# MathJax, but it is strongly recommended to install a local copy of MathJax
+# before deployment.
+
+MATHJAX_RELPATH        = http://www.mathjax.org/mathjax
+
+# When the SEARCHENGINE tag is enabled doxygen will generate a search box
+# for the HTML output. The underlying search engine uses javascript
+# and DHTML and should work on any modern browser. Note that when using
+# HTML help (GENERATE_HTMLHELP), Qt help (GENERATE_QHP), or docsets
+# (GENERATE_DOCSET) there is already a search function so this one should
+# typically be disabled. For large projects the javascript based search engine
+# can be slow, then enabling SERVER_BASED_SEARCH may provide a better solution.
+
+SEARCHENGINE           = NO
+
+# When the SERVER_BASED_SEARCH tag is enabled the search engine will be
+# implemented using a PHP enabled web server instead of at the web client
+# using Javascript. Doxygen will generate the search PHP script and index
+# file to put on the web server. The advantage of the server
+# based approach is that it scales better to large projects and allows
+# full text search. The disadvantages are that it is more difficult to setup
+# and does not have live searching capabilities.
+
+SERVER_BASED_SEARCH    = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the LaTeX output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will
+# generate Latex output.
+
+GENERATE_LATEX         = YES
+
+# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `latex' will be used as the default path.
+
+LATEX_OUTPUT           = latex
+
+# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be
+# invoked. If left blank `latex' will be used as the default command name.
+# Note that when enabling USE_PDFLATEX this option is only used for
+# generating bitmaps for formulas in the HTML output, but not in the
+# Makefile that is written to the output directory.
+
+LATEX_CMD_NAME         = latex
+
+# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to
+# generate index for LaTeX. If left blank `makeindex' will be used as the
+# default command name.
+
+MAKEINDEX_CMD_NAME     = makeindex
+
+# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact
+# LaTeX documents. This may be useful for small projects and may help to
+# save some trees in general.
+
+COMPACT_LATEX          = NO
+
+# The PAPER_TYPE tag can be used to set the paper type that is used
+# by the printer. Possible values are: a4, letter, legal and
+# executive. If left blank a4wide will be used.
+
+PAPER_TYPE             = a4wide
+
+# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX
+# packages that should be included in the LaTeX output.
+
+EXTRA_PACKAGES         =
+
+# The LATEX_HEADER tag can be used to specify a personal LaTeX header for
+# the generated latex document. The header should contain everything until
+# the first chapter. If it is left blank doxygen will generate a
+# standard header. Notice: only use this tag if you know what you are doing!
+
+LATEX_HEADER           =
+
+# The LATEX_FOOTER tag can be used to specify a personal LaTeX footer for
+# the generated latex document. The footer should contain everything after
+# the last chapter. If it is left blank doxygen will generate a
+# standard footer. Notice: only use this tag if you know what you are doing!
+
+LATEX_FOOTER           =
+
+# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated
+# is prepared for conversion to pdf (using ps2pdf). The pdf file will
+# contain links (just like the HTML output) instead of page references
+# This makes the output suitable for online browsing using a pdf viewer.
+
+PDF_HYPERLINKS         = NO
+
+# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of
+# plain latex in the generated Makefile. Set this option to YES to get a
+# higher quality PDF documentation.
+
+USE_PDFLATEX           = NO
+
+# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode.
+# command to the generated LaTeX files. This will instruct LaTeX to keep
+# running if errors occur, instead of asking the user for help.
+# This option is also used when generating formulas in HTML.
+
+LATEX_BATCHMODE        = NO
+
+# If LATEX_HIDE_INDICES is set to YES then doxygen will not
+# include the index chapters (such as File Index, Compound Index, etc.)
+# in the output.
+
+LATEX_HIDE_INDICES     = NO
+
+# If LATEX_SOURCE_CODE is set to YES then doxygen will include
+# source code with syntax highlighting in the LaTeX output.
+# Note that which sources are shown also depends on other settings
+# such as SOURCE_BROWSER.
+
+LATEX_SOURCE_CODE      = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the RTF output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output
+# The RTF output is optimized for Word 97 and may not look very pretty with
+# other RTF readers or editors.
+
+GENERATE_RTF           = NO
+
+# The RTF_OUTPUT tag is used to specify where the RTF docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `rtf' will be used as the default path.
+
+RTF_OUTPUT             = rtf
+
+# If the COMPACT_RTF tag is set to YES Doxygen generates more compact
+# RTF documents. This may be useful for small projects and may help to
+# save some trees in general.
+
+COMPACT_RTF            = NO
+
+# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated
+# will contain hyperlink fields. The RTF file will
+# contain links (just like the HTML output) instead of page references.
+# This makes the output suitable for online browsing using WORD or other
+# programs which support those fields.
+# Note: wordpad (write) and others do not support links.
+
+RTF_HYPERLINKS         = NO
+
+# Load stylesheet definitions from file. Syntax is similar to doxygen's
+# config file, i.e. a series of assignments. You only have to provide
+# replacements, missing definitions are set to their default value.
+
+RTF_STYLESHEET_FILE    =
+
+# Set optional variables used in the generation of an rtf document.
+# Syntax is similar to doxygen's config file.
+
+RTF_EXTENSIONS_FILE    =
+
+#---------------------------------------------------------------------------
+# configuration options related to the man page output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_MAN tag is set to YES (the default) Doxygen will
+# generate man pages
+
+GENERATE_MAN           = NO
+
+# The MAN_OUTPUT tag is used to specify where the man pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `man' will be used as the default path.
+
+MAN_OUTPUT             = man
+
+# The MAN_EXTENSION tag determines the extension that is added to
+# the generated man pages (default is the subroutine's section .3)
+
+MAN_EXTENSION          = .3
+
+# If the MAN_LINKS tag is set to YES and Doxygen generates man output,
+# then it will generate one additional man file for each entity
+# documented in the real man page(s). These additional files
+# only source the real man page, but without them the man command
+# would be unable to find the correct page. The default is NO.
+
+MAN_LINKS              = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the XML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_XML tag is set to YES Doxygen will
+# generate an XML file that captures the structure of
+# the code including all documentation.
+
+GENERATE_XML           = NO
+
+# The XML_OUTPUT tag is used to specify where the XML pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `xml' will be used as the default path.
+
+XML_OUTPUT             = xml
+
+# The XML_SCHEMA tag can be used to specify an XML schema,
+# which can be used by a validating XML parser to check the
+# syntax of the XML files.
+
+XML_SCHEMA             =
+
+# The XML_DTD tag can be used to specify an XML DTD,
+# which can be used by a validating XML parser to check the
+# syntax of the XML files.
+
+XML_DTD                =
+
+# If the XML_PROGRAMLISTING tag is set to YES Doxygen will
+# dump the program listings (including syntax highlighting
+# and cross-referencing information) to the XML output. Note that
+# enabling this will significantly increase the size of the XML output.
+
+XML_PROGRAMLISTING     = YES
+
+#---------------------------------------------------------------------------
+# configuration options for the AutoGen Definitions output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will
+# generate an AutoGen Definitions (see autogen.sf.net) file
+# that captures the structure of the code including all
+# documentation. Note that this feature is still experimental
+# and incomplete at the moment.
+
+GENERATE_AUTOGEN_DEF   = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the Perl module output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_PERLMOD tag is set to YES Doxygen will
+# generate a Perl module file that captures the structure of
+# the code including all documentation. Note that this
+# feature is still experimental and incomplete at the
+# moment.
+
+GENERATE_PERLMOD       = NO
+
+# If the PERLMOD_LATEX tag is set to YES Doxygen will generate
+# the necessary Makefile rules, Perl scripts and LaTeX code to be able
+# to generate PDF and DVI output from the Perl module output.
+
+PERLMOD_LATEX          = NO
+
+# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be
+# nicely formatted so it can be parsed by a human reader.
+# This is useful
+# if you want to understand what is going on.
+# On the other hand, if this
+# tag is set to NO the size of the Perl module output will be much smaller
+# and Perl will parse it just the same.
+
+PERLMOD_PRETTY         = YES
+
+# The names of the make variables in the generated doxyrules.make file
+# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX.
+# This is useful so different doxyrules.make files included by the same
+# Makefile don't overwrite each other's variables.
+
+PERLMOD_MAKEVAR_PREFIX =
+
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor
+#---------------------------------------------------------------------------
+
+# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will
+# evaluate all C-preprocessor directives found in the sources and include
+# files.
+
+ENABLE_PREPROCESSING   = NO
+
+# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro
+# names in the source code. If set to NO (the default) only conditional
+# compilation will be performed. Macro expansion can be done in a controlled
+# way by setting EXPAND_ONLY_PREDEF to YES.
+
+MACRO_EXPANSION        = NO
+
+# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES
+# then the macro expansion is limited to the macros specified with the
+# PREDEFINED and EXPAND_AS_DEFINED tags.
+
+EXPAND_ONLY_PREDEF     = NO
+
+# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files
+# pointed to by INCLUDE_PATH will be searched when a #include is found.
+
+SEARCH_INCLUDES        = YES
+
+# The INCLUDE_PATH tag can be used to specify one or more directories that
+# contain include files that are not input files but should be processed by
+# the preprocessor.
+
+INCLUDE_PATH           =
+
+# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard
+# patterns (like *.h and *.hpp) to filter out the header-files in the
+# directories. If left blank, the patterns specified with FILE_PATTERNS will
+# be used.
+
+INCLUDE_FILE_PATTERNS  =
+
+# The PREDEFINED tag can be used to specify one or more macro names that
+# are defined before the preprocessor is started (similar to the -D option of
+# gcc). The argument of the tag is a list of macros of the form: name
+# or name=definition (no spaces). If the definition and the = are
+# omitted =1 is assumed. To prevent a macro definition from being
+# undefined via #undef or recursively expanded use the := operator
+# instead of the = operator.
+
+PREDEFINED             =
+
+# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then
+# this tag can be used to specify a list of macro names that should be expanded.
+# The macro definition that is found in the sources will be used.
+# Use the PREDEFINED tag if you want to use a different macro definition that
+# overrules the definition found in the source code.
+
+EXPAND_AS_DEFINED      =
+
+# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then
+# doxygen's preprocessor will remove all references to function-like macros
+# that are alone on a line, have an all uppercase name, and do not end with a
+# semicolon, because these will confuse the parser if not removed.
+
+SKIP_FUNCTION_MACROS   = YES
+
+#---------------------------------------------------------------------------
+# Configuration::additions related to external references
+#---------------------------------------------------------------------------
+
+# The TAGFILES option can be used to specify one or more tagfiles.
+# Optionally an initial location of the external documentation
+# can be added for each tagfile. The format of a tag file without
+# this location is as follows:
+#
+# TAGFILES = file1 file2 ...
+# Adding location for the tag files is done as follows:
+#
+# TAGFILES = file1=loc1 "file2 = loc2" ...
+# where "loc1" and "loc2" can be relative or absolute paths or
+# URLs. If a location is present for each tag, the installdox tool
+# does not have to be run to correct the links.
+# Note that each tag file must have a unique name
+# (where the name does NOT include the path)
+# If a tag file is not located in the directory in which doxygen
+# is run, you must also specify the path to the tagfile here.
+
+TAGFILES               =
+
+# When a file name is specified after GENERATE_TAGFILE, doxygen will create
+# a tag file that is based on the input files it reads.
+
+GENERATE_TAGFILE       =
+
+# If the ALLEXTERNALS tag is set to YES all external classes will be listed
+# in the class index. If set to NO only the inherited external classes
+# will be listed.
+
+ALLEXTERNALS           = NO
+
+# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed
+# in the modules index. If set to NO, only the current project's groups will
+# be listed.
+
+EXTERNAL_GROUPS        = YES
+
+# The PERL_PATH should be the absolute path and name of the perl script
+# interpreter (i.e. the result of `which perl').
+
+PERL_PATH              = /usr/bin/perl
+
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool
+#---------------------------------------------------------------------------
+
+# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will
+# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base
+# or super classes. Setting the tag to NO turns the diagrams off. Note that
+# this option also works with HAVE_DOT disabled, but it is recommended to
+# install and use dot, since it yields more powerful graphs.
+
+CLASS_DIAGRAMS         = YES
+
+# You can define message sequence charts within doxygen comments using the \msc
+# command. Doxygen will then run the mscgen tool (see
+# http://www.mcternan.me.uk/mscgen/) to produce the chart and insert it in the
+# documentation. The MSCGEN_PATH tag allows you to specify the directory where
+# the mscgen tool resides. If left empty the tool is assumed to be found in the
+# default search path.
+
+MSCGEN_PATH            =
+
+# If set to YES, the inheritance and collaboration graphs will hide
+# inheritance and usage relations if the target is undocumented
+# or is not a class.
+
+HIDE_UNDOC_RELATIONS   = YES
+
+# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is
+# available from the path. This tool is part of Graphviz, a graph visualization
+# toolkit from AT&T and Lucent Bell Labs. The other options in this section
+# have no effect if this option is set to NO (the default)
+
+HAVE_DOT               = NO
+
+# The DOT_NUM_THREADS specifies the number of dot invocations doxygen is
+# allowed to run in parallel. When set to 0 (the default) doxygen will
+# base this on the number of processors available in the system. You can set it
+# explicitly to a value larger than 0 to get control over the balance
+# between CPU load and processing speed.
+
+DOT_NUM_THREADS        = 0
+
+# By default doxygen will write a font called Helvetica to the output
+# directory and reference it in all dot files that doxygen generates.
+# When you want a differently looking font you can specify the font name
+# using DOT_FONTNAME. You need to make sure dot is able to find the font,
+# which can be done by putting it in a standard location or by setting the
+# DOTFONTPATH environment variable or by setting DOT_FONTPATH to the directory
+# containing the font.
+
+DOT_FONTNAME           = Helvetica
+
+# The DOT_FONTSIZE tag can be used to set the size of the font of dot graphs.
+# The default size is 10pt.
+
+DOT_FONTSIZE           = 10
+
+# By default doxygen will tell dot to use the output directory to look for the
+# FreeSans.ttf font (which doxygen will put there itself). If you specify a
+# different font using DOT_FONTNAME you can set the path where dot
+# can find it using this tag.
+
+DOT_FONTPATH           =
+
+# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for each documented class showing the direct and
+# indirect inheritance relations. Setting this tag to YES will force the
+# the CLASS_DIAGRAMS tag to NO.
+
+CLASS_GRAPH            = YES
+
+# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for each documented class showing the direct and
+# indirect implementation dependencies (inheritance, containment, and
+# class references variables) of the class with other documented classes.
+
+COLLABORATION_GRAPH    = YES
+
+# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for groups, showing the direct groups dependencies
+
+GROUP_GRAPHS           = YES
+
+# If the UML_LOOK tag is set to YES doxygen will generate inheritance and
+# collaboration diagrams in a style similar to the OMG's Unified Modeling
+# Language.
+
+UML_LOOK               = NO
+
+# If set to YES, the inheritance and collaboration graphs will show the
+# relations between templates and their instances.
+
+TEMPLATE_RELATIONS     = NO
+
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT
+# tags are set to YES then doxygen will generate a graph for each documented
+# file showing the direct and indirect include dependencies of the file with
+# other documented files.
+
+INCLUDE_GRAPH          = YES
+
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and
+# HAVE_DOT tags are set to YES then doxygen will generate a graph for each
+# documented header file showing the documented files that directly or
+# indirectly include this file.
+
+INCLUDED_BY_GRAPH      = YES
+
+# If the CALL_GRAPH and HAVE_DOT options are set to YES then
+# doxygen will generate a call dependency graph for every global function
+# or class method. Note that enabling this option will significantly increase
+# the time of a run. So in most cases it will be better to enable call graphs
+# for selected functions only using the \callgraph command.
+
+CALL_GRAPH             = NO
+
+# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then
+# doxygen will generate a caller dependency graph for every global function
+# or class method. Note that enabling this option will significantly increase
+# the time of a run. So in most cases it will be better to enable caller
+# graphs for selected functions only using the \callergraph command.
+
+CALLER_GRAPH           = NO
+
+# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen
+# will generate a graphical hierarchy of all classes instead of a textual one.
+
+GRAPHICAL_HIERARCHY    = YES
+
+# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES
+# then doxygen will show the dependencies a directory has on other directories
+# in a graphical way. The dependency relations are determined by the #include
+# relations between the files in the directories.
+
+DIRECTORY_GRAPH        = YES
+
+# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images
+# generated by dot. Possible values are svg, png, jpg, or gif.
+# If left blank png will be used.
+
+DOT_IMAGE_FORMAT       = png
+
+# The tag DOT_PATH can be used to specify the path where the dot tool can be
+# found. If left blank, it is assumed the dot tool can be found in the path.
+
+DOT_PATH               = /usr/bin/dot
+
+# The DOTFILE_DIRS tag can be used to specify one or more directories that
+# contain dot files that are included in the documentation (see the
+# \dotfile command).
+
+DOTFILE_DIRS           =
+
+# The MSCFILE_DIRS tag can be used to specify one or more directories that
+# contain msc files that are included in the documentation (see the
+# \mscfile command).
+
+MSCFILE_DIRS           =
+
+# The DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of
+# nodes that will be shown in the graph. If the number of nodes in a graph
+# becomes larger than this value, doxygen will truncate the graph, which is
+# visualized by representing a node as a red box. Note that doxygen if the
+# number of direct children of the root node in a graph is already larger than
+# DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note
+# that the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH.
+
+DOT_GRAPH_MAX_NODES    = 50
+
+# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the
+# graphs generated by dot. A depth value of 3 means that only nodes reachable
+# from the root by following a path via at most 3 edges will be shown. Nodes
+# that lay further from the root node will be omitted. Note that setting this
+# option to 1 or 2 may greatly reduce the computation time needed for large
+# code bases. Also note that the size of a graph can be further restricted by
+# DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction.
+
+MAX_DOT_GRAPH_DEPTH    = 0
+
+# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent
+# background. This is disabled by default, because dot on Windows does not
+# seem to support this out of the box. Warning: Depending on the platform used,
+# enabling this option may lead to badly anti-aliased labels on the edges of
+# a graph (i.e. they become hard to read).
+
+DOT_TRANSPARENT        = NO
+
+# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output
+# files in one run (i.e. multiple -o and -T options on the command line). This
+# makes dot run faster, but since only newer versions of dot (>1.8.10)
+# support this, this feature is disabled by default.
+
+DOT_MULTI_TARGETS      = NO
+
+# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will
+# generate a legend page explaining the meaning of the various boxes and
+# arrows in the dot generated graphs.
+
+GENERATE_LEGEND        = YES
+
+# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will
+# remove the intermediate dot files that are used to generate
+# the various graphs.
+
+DOT_CLEANUP            = YES
diff --git a/src/shared/libosmocore/Doxyfile.core.in b/src/shared/libosmocore/Doxyfile.core.in
new file mode 100644
index 00000000..18eb2265
--- /dev/null
+++ b/src/shared/libosmocore/Doxyfile.core.in
@@ -0,0 +1,1716 @@
+# Doxyfile 1.7.4
+
+# This file describes the settings to be used by the documentation system
+# doxygen (www.doxygen.org) for a project.
+#
+# All text after a hash (#) is considered a comment and will be ignored.
+# The format is:
+#       TAG = value [value, ...]
+# For lists items can also be appended using:
+#       TAG += value [value, ...]
+# Values that contain spaces should be placed between quotes (" ").
+
+#---------------------------------------------------------------------------
+# Project related configuration options
+#---------------------------------------------------------------------------
+
+# This tag specifies the encoding used for all characters in the config file
+# that follow. The default is UTF-8 which is also the encoding used for all
+# text before the first occurrence of this tag. Doxygen uses libiconv (or the
+# iconv built into libc) for the transcoding. See
+# http://www.gnu.org/software/libiconv for the list of possible encodings.
+
+DOXYFILE_ENCODING      = UTF-8
+
+# The PROJECT_NAME tag is a single word (or a sequence of words surrounded
+# by quotes) that should identify the project.
+
+PROJECT_NAME           = libosmocore
+
+# The PROJECT_NUMBER tag can be used to enter a project or revision number.
+# This could be handy for archiving the generated documentation or
+# if some version control system is used.
+
+PROJECT_NUMBER         = @VERSION@
+
+# Using the PROJECT_BRIEF tag one can provide an optional one line description
+# for a project that appears at the top of each page and should give viewer
+# a quick idea about the purpose of the project. Keep the description short.
+
+PROJECT_BRIEF          = "Osmocom core library"
+
+# With the PROJECT_LOGO tag one can specify an logo or icon that is
+# included in the documentation. The maximum height of the logo should not
+# exceed 55 pixels and the maximum width should not exceed 200 pixels.
+# Doxygen will copy the logo to the output directory.
+
+PROJECT_LOGO           =
+
+# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
+# base path where the generated documentation will be put.
+# If a relative path is entered, it will be relative to the location
+# where doxygen was started. If left blank the current directory will be used.
+
+OUTPUT_DIRECTORY       = doc/core
+
+# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create
+# 4096 sub-directories (in 2 levels) under the output directory of each output
+# format and will distribute the generated files over these directories.
+# Enabling this option can be useful when feeding doxygen a huge amount of
+# source files, where putting all generated files in the same directory would
+# otherwise cause performance problems for the file system.
+
+CREATE_SUBDIRS         = NO
+
+# The OUTPUT_LANGUAGE tag is used to specify the language in which all
+# documentation generated by doxygen is written. Doxygen will use this
+# information to generate all constant output in the proper language.
+# The default language is English, other supported languages are:
+# Afrikaans, Arabic, Brazilian, Catalan, Chinese, Chinese-Traditional,
+# Croatian, Czech, Danish, Dutch, Esperanto, Farsi, Finnish, French, German,
+# Greek, Hungarian, Italian, Japanese, Japanese-en (Japanese with English
+# messages), Korean, Korean-en, Lithuanian, Norwegian, Macedonian, Persian,
+# Polish, Portuguese, Romanian, Russian, Serbian, Serbian-Cyrillic, Slovak,
+# Slovene, Spanish, Swedish, Ukrainian, and Vietnamese.
+
+OUTPUT_LANGUAGE        = English
+
+# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will
+# include brief member descriptions after the members that are listed in
+# the file and class documentation (similar to JavaDoc).
+# Set to NO to disable this.
+
+BRIEF_MEMBER_DESC      = YES
+
+# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend
+# the brief description of a member or function before the detailed description.
+# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the
+# brief descriptions will be completely suppressed.
+
+REPEAT_BRIEF           = YES
+
+# This tag implements a quasi-intelligent brief description abbreviator
+# that is used to form the text in various listings. Each string
+# in this list, if found as the leading text of the brief description, will be
+# stripped from the text and the result after processing the whole list, is
+# used as the annotated text. Otherwise, the brief description is used as-is.
+# If left blank, the following values are used ("$name" is automatically
+# replaced with the name of the entity): "The $name class" "The $name widget"
+# "The $name file" "is" "provides" "specifies" "contains"
+# "represents" "a" "an" "the"
+
+ABBREVIATE_BRIEF       =
+
+# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then
+# Doxygen will generate a detailed section even if there is only a brief
+# description.
+
+ALWAYS_DETAILED_SEC    = NO
+
+# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all
+# inherited members of a class in the documentation of that class as if those
+# members were ordinary class members. Constructors, destructors and assignment
+# operators of the base classes will not be shown.
+
+INLINE_INHERITED_MEMB  = NO
+
+# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full
+# path before files name in the file list and in the header files. If set
+# to NO the shortest path that makes the file name unique will be used.
+
+FULL_PATH_NAMES        = YES
+
+# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag
+# can be used to strip a user-defined part of the path. Stripping is
+# only done if one of the specified strings matches the left-hand part of
+# the path. The tag can be used to show relative paths in the file list.
+# If left blank the directory from which doxygen is run is used as the
+# path to strip.
+
+STRIP_FROM_PATH        =
+
+# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of
+# the path mentioned in the documentation of a class, which tells
+# the reader which header file to include in order to use a class.
+# If left blank only the name of the header file containing the class
+# definition is used. Otherwise one should specify the include paths that
+# are normally passed to the compiler using the -I flag.
+
+STRIP_FROM_INC_PATH    =
+
+# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter
+# (but less readable) file names. This can be useful if your file system
+# doesn't support long names like on DOS, Mac, or CD-ROM.
+
+SHORT_NAMES            = NO
+
+# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen
+# will interpret the first line (until the first dot) of a JavaDoc-style
+# comment as the brief description. If set to NO, the JavaDoc
+# comments will behave just like regular Qt-style comments
+# (thus requiring an explicit @brief command for a brief description.)
+
+JAVADOC_AUTOBRIEF      = NO
+
+# If the QT_AUTOBRIEF tag is set to YES then Doxygen will
+# interpret the first line (until the first dot) of a Qt-style
+# comment as the brief description. If set to NO, the comments
+# will behave just like regular Qt-style comments (thus requiring
+# an explicit \brief command for a brief description.)
+
+QT_AUTOBRIEF           = NO
+
+# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen
+# treat a multi-line C++ special comment block (i.e. a block of //! or ///
+# comments) as a brief description. This used to be the default behaviour.
+# The new default is to treat a multi-line C++ comment block as a detailed
+# description. Set this tag to YES if you prefer the old behaviour instead.
+
+MULTILINE_CPP_IS_BRIEF = NO
+
+# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented
+# member inherits the documentation from any documented member that it
+# re-implements.
+
+INHERIT_DOCS           = YES
+
+# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce
+# a new page for each member. If set to NO, the documentation of a member will
+# be part of the file/class/namespace that contains it.
+
+SEPARATE_MEMBER_PAGES  = NO
+
+# The TAB_SIZE tag can be used to set the number of spaces in a tab.
+# Doxygen uses this value to replace tabs by spaces in code fragments.
+
+TAB_SIZE               = 8
+
+# This tag can be used to specify a number of aliases that acts
+# as commands in the documentation. An alias has the form "name=value".
+# For example adding "sideeffect=\par Side Effects:\n" will allow you to
+# put the command \sideeffect (or @sideeffect) in the documentation, which
+# will result in a user-defined paragraph with heading "Side Effects:".
+# You can put \n's in the value part of an alias to insert newlines.
+
+ALIASES                =
+
+# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C
+# sources only. Doxygen will then generate output that is more tailored for C.
+# For instance, some of the names that are used will be different. The list
+# of all members will be omitted, etc.
+
+OPTIMIZE_OUTPUT_FOR_C  = YES
+
+# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java
+# sources only. Doxygen will then generate output that is more tailored for
+# Java. For instance, namespaces will be presented as packages, qualified
+# scopes will look different, etc.
+
+OPTIMIZE_OUTPUT_JAVA   = NO
+
+# Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran
+# sources only. Doxygen will then generate output that is more tailored for
+# Fortran.
+
+OPTIMIZE_FOR_FORTRAN   = NO
+
+# Set the OPTIMIZE_OUTPUT_VHDL tag to YES if your project consists of VHDL
+# sources. Doxygen will then generate output that is tailored for
+# VHDL.
+
+OPTIMIZE_OUTPUT_VHDL   = NO
+
+# Doxygen selects the parser to use depending on the extension of the files it
+# parses. With this tag you can assign which parser to use for a given extension.
+# Doxygen has a built-in mapping, but you can override or extend it using this
+# tag. The format is ext=language, where ext is a file extension, and language
+# is one of the parsers supported by doxygen: IDL, Java, Javascript, CSharp, C,
+# C++, D, PHP, Objective-C, Python, Fortran, VHDL, C, C++. For instance to make
+# doxygen treat .inc files as Fortran files (default is PHP), and .f files as C
+# (default is Fortran), use: inc=Fortran f=C. Note that for custom extensions
+# you also need to set FILE_PATTERNS otherwise the files are not read by doxygen.
+
+EXTENSION_MAPPING      =
+
+# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want
+# to include (a tag file for) the STL sources as input, then you should
+# set this tag to YES in order to let doxygen match functions declarations and
+# definitions whose arguments contain STL classes (e.g. func(std::string); v.s.
+# func(std::string) {}). This also makes the inheritance and collaboration
+# diagrams that involve STL classes more complete and accurate.
+
+BUILTIN_STL_SUPPORT    = NO
+
+# If you use Microsoft's C++/CLI language, you should set this option to YES to
+# enable parsing support.
+
+CPP_CLI_SUPPORT        = NO
+
+# Set the SIP_SUPPORT tag to YES if your project consists of sip sources only.
+# Doxygen will parse them like normal C++ but will assume all classes use public
+# instead of private inheritance when no explicit protection keyword is present.
+
+SIP_SUPPORT            = NO
+
+# For Microsoft's IDL there are propget and propput attributes to indicate getter
+# and setter methods for a property. Setting this option to YES (the default)
+# will make doxygen replace the get and set methods by a property in the
+# documentation. This will only work if the methods are indeed getting or
+# setting a simple type. If this is not the case, or you want to show the
+# methods anyway, you should set this option to NO.
+
+IDL_PROPERTY_SUPPORT   = YES
+
+# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC
+# tag is set to YES, then doxygen will reuse the documentation of the first
+# member in the group (if any) for the other members of the group. By default
+# all members of a group must be documented explicitly.
+
+DISTRIBUTE_GROUP_DOC   = NO
+
+# Set the SUBGROUPING tag to YES (the default) to allow class member groups of
+# the same type (for instance a group of public functions) to be put as a
+# subgroup of that type (e.g. under the Public Functions section). Set it to
+# NO to prevent subgrouping. Alternatively, this can be done per class using
+# the \nosubgrouping command.
+
+SUBGROUPING            = YES
+
+# When the INLINE_GROUPED_CLASSES tag is set to YES, classes, structs and
+# unions are shown inside the group in which they are included (e.g. using
+# @ingroup) instead of on a separate page (for HTML and Man pages) or
+# section (for LaTeX and RTF).
+
+INLINE_GROUPED_CLASSES = NO
+
+# When TYPEDEF_HIDES_STRUCT is enabled, a typedef of a struct, union, or enum
+# is documented as struct, union, or enum with the name of the typedef. So
+# typedef struct TypeS {} TypeT, will appear in the documentation as a struct
+# with name TypeT. When disabled the typedef will appear as a member of a file,
+# namespace, or class. And the struct will be named TypeS. This can typically
+# be useful for C code in case the coding convention dictates that all compound
+# types are typedef'ed and only the typedef is referenced, never the tag name.
+
+TYPEDEF_HIDES_STRUCT   = NO
+
+# The SYMBOL_CACHE_SIZE determines the size of the internal cache use to
+# determine which symbols to keep in memory and which to flush to disk.
+# When the cache is full, less often used symbols will be written to disk.
+# For small to medium size projects (<1000 input files) the default value is
+# probably good enough. For larger projects a too small cache size can cause
+# doxygen to be busy swapping symbols to and from disk most of the time
+# causing a significant performance penalty.
+# If the system has enough physical memory increasing the cache will improve the
+# performance by keeping more symbols in memory. Note that the value works on
+# a logarithmic scale so increasing the size by one will roughly double the
+# memory usage. The cache size is given by this formula:
+# 2^(16+SYMBOL_CACHE_SIZE). The valid range is 0..9, the default is 0,
+# corresponding to a cache size of 2^16 = 65536 symbols
+
+SYMBOL_CACHE_SIZE      = 0
+
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+
+# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in
+# documentation are documented, even if no documentation was available.
+# Private class members and static file members will be hidden unless
+# the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES
+
+EXTRACT_ALL            = NO
+
+# If the EXTRACT_PRIVATE tag is set to YES all private members of a class
+# will be included in the documentation.
+
+EXTRACT_PRIVATE        = NO
+
+# If the EXTRACT_STATIC tag is set to YES all static members of a file
+# will be included in the documentation.
+
+EXTRACT_STATIC         = YES
+
+# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs)
+# defined locally in source files will be included in the documentation.
+# If set to NO only classes defined in header files are included.
+
+EXTRACT_LOCAL_CLASSES  = YES
+
+# This flag is only useful for Objective-C code. When set to YES local
+# methods, which are defined in the implementation section but not in
+# the interface are included in the documentation.
+# If set to NO (the default) only methods in the interface are included.
+
+EXTRACT_LOCAL_METHODS  = NO
+
+# If this flag is set to YES, the members of anonymous namespaces will be
+# extracted and appear in the documentation as a namespace called
+# 'anonymous_namespace{file}', where file will be replaced with the base
+# name of the file that contains the anonymous namespace. By default
+# anonymous namespaces are hidden.
+
+EXTRACT_ANON_NSPACES   = NO
+
+# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all
+# undocumented members of documented classes, files or namespaces.
+# If set to NO (the default) these members will be included in the
+# various overviews, but no documentation section is generated.
+# This option has no effect if EXTRACT_ALL is enabled.
+
+HIDE_UNDOC_MEMBERS     = NO
+
+# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all
+# undocumented classes that are normally visible in the class hierarchy.
+# If set to NO (the default) these classes will be included in the various
+# overviews. This option has no effect if EXTRACT_ALL is enabled.
+
+HIDE_UNDOC_CLASSES     = NO
+
+# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all
+# friend (class|struct|union) declarations.
+# If set to NO (the default) these declarations will be included in the
+# documentation.
+
+HIDE_FRIEND_COMPOUNDS  = NO
+
+# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any
+# documentation blocks found inside the body of a function.
+# If set to NO (the default) these blocks will be appended to the
+# function's detailed documentation block.
+
+HIDE_IN_BODY_DOCS      = NO
+
+# The INTERNAL_DOCS tag determines if documentation
+# that is typed after a \internal command is included. If the tag is set
+# to NO (the default) then the documentation will be excluded.
+# Set it to YES to include the internal documentation.
+
+INTERNAL_DOCS          = NO
+
+# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate
+# file names in lower-case letters. If set to YES upper-case letters are also
+# allowed. This is useful if you have classes or files whose names only differ
+# in case and if your file system supports case sensitive file names. Windows
+# and Mac users are advised to set this option to NO.
+
+CASE_SENSE_NAMES       = YES
+
+# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen
+# will show members with their full class and namespace scopes in the
+# documentation. If set to YES the scope will be hidden.
+
+HIDE_SCOPE_NAMES       = NO
+
+# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen
+# will put a list of the files that are included by a file in the documentation
+# of that file.
+
+SHOW_INCLUDE_FILES     = YES
+
+# If the FORCE_LOCAL_INCLUDES tag is set to YES then Doxygen
+# will list include files with double quotes in the documentation
+# rather than with sharp brackets.
+
+FORCE_LOCAL_INCLUDES   = NO
+
+# If the INLINE_INFO tag is set to YES (the default) then a tag [inline]
+# is inserted in the documentation for inline members.
+
+INLINE_INFO            = YES
+
+# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen
+# will sort the (detailed) documentation of file and class members
+# alphabetically by member name. If set to NO the members will appear in
+# declaration order.
+
+SORT_MEMBER_DOCS       = YES
+
+# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the
+# brief documentation of file, namespace and class members alphabetically
+# by member name. If set to NO (the default) the members will appear in
+# declaration order.
+
+SORT_BRIEF_DOCS        = NO
+
+# If the SORT_MEMBERS_CTORS_1ST tag is set to YES then doxygen
+# will sort the (brief and detailed) documentation of class members so that
+# constructors and destructors are listed first. If set to NO (the default)
+# the constructors will appear in the respective orders defined by
+# SORT_MEMBER_DOCS and SORT_BRIEF_DOCS.
+# This tag will be ignored for brief docs if SORT_BRIEF_DOCS is set to NO
+# and ignored for detailed docs if SORT_MEMBER_DOCS is set to NO.
+
+SORT_MEMBERS_CTORS_1ST = NO
+
+# If the SORT_GROUP_NAMES tag is set to YES then doxygen will sort the
+# hierarchy of group names into alphabetical order. If set to NO (the default)
+# the group names will appear in their defined order.
+
+SORT_GROUP_NAMES       = NO
+
+# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be
+# sorted by fully-qualified names, including namespaces. If set to
+# NO (the default), the class list will be sorted only by class name,
+# not including the namespace part.
+# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES.
+# Note: This option applies only to the class list, not to the
+# alphabetical list.
+
+SORT_BY_SCOPE_NAME     = NO
+
+# If the STRICT_PROTO_MATCHING option is enabled and doxygen fails to
+# do proper type resolution of all parameters of a function it will reject a
+# match between the prototype and the implementation of a member function even
+# if there is only one candidate or it is obvious which candidate to choose
+# by doing a simple string match. By disabling STRICT_PROTO_MATCHING doxygen
+# will still accept a match between prototype and implementation in such cases.
+
+STRICT_PROTO_MATCHING  = NO
+
+# The GENERATE_TODOLIST tag can be used to enable (YES) or
+# disable (NO) the todo list. This list is created by putting \todo
+# commands in the documentation.
+
+GENERATE_TODOLIST      = YES
+
+# The GENERATE_TESTLIST tag can be used to enable (YES) or
+# disable (NO) the test list. This list is created by putting \test
+# commands in the documentation.
+
+GENERATE_TESTLIST      = YES
+
+# The GENERATE_BUGLIST tag can be used to enable (YES) or
+# disable (NO) the bug list. This list is created by putting \bug
+# commands in the documentation.
+
+GENERATE_BUGLIST       = YES
+
+# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or
+# disable (NO) the deprecated list. This list is created by putting
+# \deprecated commands in the documentation.
+
+GENERATE_DEPRECATEDLIST= YES
+
+# The ENABLED_SECTIONS tag can be used to enable conditional
+# documentation sections, marked by \if sectionname ... \endif.
+
+ENABLED_SECTIONS       =
+
+# The MAX_INITIALIZER_LINES tag determines the maximum number of lines
+# the initial value of a variable or macro consists of for it to appear in
+# the documentation. If the initializer consists of more lines than specified
+# here it will be hidden. Use a value of 0 to hide initializers completely.
+# The appearance of the initializer of individual variables and macros in the
+# documentation can be controlled using \showinitializer or \hideinitializer
+# command in the documentation regardless of this setting.
+
+MAX_INITIALIZER_LINES  = 30
+
+# Set the SHOW_USED_FILES tag to NO to disable the list of files generated
+# at the bottom of the documentation of classes and structs. If set to YES the
+# list will mention the files that were used to generate the documentation.
+
+SHOW_USED_FILES        = YES
+
+# If the sources in your project are distributed over multiple directories
+# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy
+# in the documentation. The default is NO.
+
+SHOW_DIRECTORIES       = NO
+
+# Set the SHOW_FILES tag to NO to disable the generation of the Files page.
+# This will remove the Files entry from the Quick Index and from the
+# Folder Tree View (if specified). The default is YES.
+
+SHOW_FILES             = YES
+
+# Set the SHOW_NAMESPACES tag to NO to disable the generation of the
+# Namespaces page.
+# This will remove the Namespaces entry from the Quick Index
+# and from the Folder Tree View (if specified). The default is YES.
+
+SHOW_NAMESPACES        = YES
+
+# The FILE_VERSION_FILTER tag can be used to specify a program or script that
+# doxygen should invoke to get the current version for each file (typically from
+# the version control system). Doxygen will invoke the program by executing (via
+# popen()) the command <command> <input-file>, where <command> is the value of
+# the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file
+# provided by doxygen. Whatever the program writes to standard output
+# is used as the file version. See the manual for examples.
+
+FILE_VERSION_FILTER    =
+
+# The LAYOUT_FILE tag can be used to specify a layout file which will be parsed
+# by doxygen. The layout file controls the global structure of the generated
+# output files in an output format independent way. The create the layout file
+# that represents doxygen's defaults, run doxygen with the -l option.
+# You can optionally specify a file name after the option, if omitted
+# DoxygenLayout.xml will be used as the name of the layout file.
+
+LAYOUT_FILE            =
+
+#---------------------------------------------------------------------------
+# configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+
+# The QUIET tag can be used to turn on/off the messages that are generated
+# by doxygen. Possible values are YES and NO. If left blank NO is used.
+
+QUIET                  = NO
+
+# The WARNINGS tag can be used to turn on/off the warning messages that are
+# generated by doxygen. Possible values are YES and NO. If left blank
+# NO is used.
+
+WARNINGS               = YES
+
+# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings
+# for undocumented members. If EXTRACT_ALL is set to YES then this flag will
+# automatically be disabled.
+
+WARN_IF_UNDOCUMENTED   = YES
+
+# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for
+# potential errors in the documentation, such as not documenting some
+# parameters in a documented function, or documenting parameters that
+# don't exist or using markup commands wrongly.
+
+WARN_IF_DOC_ERROR      = YES
+
+# The WARN_NO_PARAMDOC option can be enabled to get warnings for
+# functions that are documented, but have no documentation for their parameters
+# or return value. If set to NO (the default) doxygen will only warn about
+# wrong or incomplete parameter documentation, but not about the absence of
+# documentation.
+
+WARN_NO_PARAMDOC       = NO
+
+# The WARN_FORMAT tag determines the format of the warning messages that
+# doxygen can produce. The string should contain the $file, $line, and $text
+# tags, which will be replaced by the file and line number from which the
+# warning originated and the warning text. Optionally the format may contain
+# $version, which will be replaced by the version of the file (if it could
+# be obtained via FILE_VERSION_FILTER)
+
+WARN_FORMAT            = "$file:$line: $text"
+
+# The WARN_LOGFILE tag can be used to specify a file to which warning
+# and error messages should be written. If left blank the output is written
+# to stderr.
+
+WARN_LOGFILE           =
+
+#---------------------------------------------------------------------------
+# configuration options related to the input files
+#---------------------------------------------------------------------------
+
+# The INPUT tag can be used to specify the files and/or directories that contain
+# documented source files. You may enter file names like "myfile.cpp" or
+# directories like "/usr/src/myproject". Separate the files or directories
+# with spaces.
+
+INPUT                  = include/osmocom/core src
+
+# This tag can be used to specify the character encoding of the source files
+# that doxygen parses. Internally doxygen uses the UTF-8 encoding, which is
+# also the default input encoding. Doxygen uses libiconv (or the iconv built
+# into libc) for the transcoding. See http://www.gnu.org/software/libiconv for
+# the list of possible encodings.
+
+INPUT_ENCODING         = UTF-8
+
+# If the value of the INPUT tag contains directories, you can use the
+# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
+# and *.h) to filter out the source-files in the directories. If left
+# blank the following patterns are tested:
+# *.c *.cc *.cxx *.cpp *.c++ *.d *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh
+# *.hxx *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.dox *.py
+# *.f90 *.f *.for *.vhd *.vhdl
+
+FILE_PATTERNS          =
+
+# The RECURSIVE tag can be used to turn specify whether or not subdirectories
+# should be searched for input files as well. Possible values are YES and NO.
+# If left blank NO is used.
+
+RECURSIVE              = NO
+
+# The EXCLUDE tag can be used to specify files and/or directories that should
+# excluded from the INPUT source files. This way you can easily exclude a
+# subdirectory from a directory tree whose root is specified with the INPUT tag.
+
+EXCLUDE                =
+
+# The EXCLUDE_SYMLINKS tag can be used select whether or not files or
+# directories that are symbolic links (a Unix file system feature) are excluded
+# from the input.
+
+EXCLUDE_SYMLINKS       = NO
+
+# If the value of the INPUT tag contains directories, you can use the
+# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude
+# certain files from those directories. Note that the wildcards are matched
+# against the file with absolute path, so to exclude all test directories
+# for example use the pattern */test/*
+
+EXCLUDE_PATTERNS       =
+
+# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names
+# (namespaces, classes, functions, etc.) that should be excluded from the
+# output. The symbol name can be a fully qualified name, a word, or if the
+# wildcard * is used, a substring. Examples: ANamespace, AClass,
+# AClass::ANamespace, ANamespace::*Test
+
+EXCLUDE_SYMBOLS        =
+
+# The EXAMPLE_PATH tag can be used to specify one or more files or
+# directories that contain example code fragments that are included (see
+# the \include command).
+
+EXAMPLE_PATH           =
+
+# If the value of the EXAMPLE_PATH tag contains directories, you can use the
+# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
+# and *.h) to filter out the source-files in the directories. If left
+# blank all files are included.
+
+EXAMPLE_PATTERNS       =
+
+# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be
+# searched for input files to be used with the \include or \dontinclude
+# commands irrespective of the value of the RECURSIVE tag.
+# Possible values are YES and NO. If left blank NO is used.
+
+EXAMPLE_RECURSIVE      = NO
+
+# The IMAGE_PATH tag can be used to specify one or more files or
+# directories that contain image that are included in the documentation (see
+# the \image command).
+
+IMAGE_PATH             = images/
+
+# The INPUT_FILTER tag can be used to specify a program that doxygen should
+# invoke to filter for each input file. Doxygen will invoke the filter program
+# by executing (via popen()) the command <filter> <input-file>, where <filter>
+# is the value of the INPUT_FILTER tag, and <input-file> is the name of an
+# input file. Doxygen will then use the output that the filter program writes
+# to standard output.
+# If FILTER_PATTERNS is specified, this tag will be
+# ignored.
+
+INPUT_FILTER           =
+
+# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern
+# basis.
+# Doxygen will compare the file name with each pattern and apply the
+# filter if there is a match.
+# The filters are a list of the form:
+# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further
+# info on how filters are used. If FILTER_PATTERNS is empty or if
+# non of the patterns match the file name, INPUT_FILTER is applied.
+
+FILTER_PATTERNS        =
+
+# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using
+# INPUT_FILTER) will be used to filter the input files when producing source
+# files to browse (i.e. when SOURCE_BROWSER is set to YES).
+
+FILTER_SOURCE_FILES    = NO
+
+# The FILTER_SOURCE_PATTERNS tag can be used to specify source filters per file
+# pattern. A pattern will override the setting for FILTER_PATTERN (if any)
+# and it is also possible to disable source filtering for a specific pattern
+# using *.ext= (so without naming a filter). This option only has effect when
+# FILTER_SOURCE_FILES is enabled.
+
+FILTER_SOURCE_PATTERNS =
+
+#---------------------------------------------------------------------------
+# configuration options related to source browsing
+#---------------------------------------------------------------------------
+
+# If the SOURCE_BROWSER tag is set to YES then a list of source files will
+# be generated. Documented entities will be cross-referenced with these sources.
+# Note: To get rid of all source code in the generated output, make sure also
+# VERBATIM_HEADERS is set to NO.
+
+SOURCE_BROWSER         = NO
+
+# Setting the INLINE_SOURCES tag to YES will include the body
+# of functions and classes directly in the documentation.
+
+INLINE_SOURCES         = NO
+
+# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct
+# doxygen to hide any special comment blocks from generated source code
+# fragments. Normal C and C++ comments will always remain visible.
+
+STRIP_CODE_COMMENTS    = YES
+
+# If the REFERENCED_BY_RELATION tag is set to YES
+# then for each documented function all documented
+# functions referencing it will be listed.
+
+REFERENCED_BY_RELATION = YES
+
+# If the REFERENCES_RELATION tag is set to YES
+# then for each documented function all documented entities
+# called/used by that function will be listed.
+
+REFERENCES_RELATION    = YES
+
+# If the REFERENCES_LINK_SOURCE tag is set to YES (the default)
+# and SOURCE_BROWSER tag is set to YES, then the hyperlinks from
+# functions in REFERENCES_RELATION and REFERENCED_BY_RELATION lists will
+# link to the source code.
+# Otherwise they will link to the documentation.
+
+REFERENCES_LINK_SOURCE = YES
+
+# If the USE_HTAGS tag is set to YES then the references to source code
+# will point to the HTML generated by the htags(1) tool instead of doxygen
+# built-in source browser. The htags tool is part of GNU's global source
+# tagging system (see http://www.gnu.org/software/global/global.html). You
+# will need version 4.8.6 or higher.
+
+USE_HTAGS              = NO
+
+# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen
+# will generate a verbatim copy of the header file for each class for
+# which an include is specified. Set to NO to disable this.
+
+VERBATIM_HEADERS       = YES
+
+#---------------------------------------------------------------------------
+# configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+
+# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index
+# of all compounds will be generated. Enable this if the project
+# contains a lot of classes, structs, unions or interfaces.
+
+ALPHABETICAL_INDEX     = NO
+
+# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then
+# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns
+# in which this list will be split (can be a number in the range [1..20])
+
+COLS_IN_ALPHA_INDEX    = 5
+
+# In case all classes in a project start with a common prefix, all
+# classes will be put under the same header in the alphabetical index.
+# The IGNORE_PREFIX tag can be used to specify one or more prefixes that
+# should be ignored while generating the index headers.
+
+IGNORE_PREFIX          =
+
+#---------------------------------------------------------------------------
+# configuration options related to the HTML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_HTML tag is set to YES (the default) Doxygen will
+# generate HTML output.
+
+GENERATE_HTML          = YES
+
+# The HTML_OUTPUT tag is used to specify where the HTML docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `html' will be used as the default path.
+
+HTML_OUTPUT            = html
+
+# The HTML_FILE_EXTENSION tag can be used to specify the file extension for
+# each generated HTML page (for example: .htm,.php,.asp). If it is left blank
+# doxygen will generate files with .html extension.
+
+HTML_FILE_EXTENSION    = .html
+
+# The HTML_HEADER tag can be used to specify a personal HTML header for
+# each generated HTML page. If it is left blank doxygen will generate a
+# standard header. Note that when using a custom header you are responsible
+# for the proper inclusion of any scripts and style sheets that doxygen
+# needs, which is dependent on the configuration options used.
+# It is adviced to generate a default header using "doxygen -w html
+# header.html footer.html stylesheet.css YourConfigFile" and then modify
+# that header. Note that the header is subject to change so you typically
+# have to redo this when upgrading to a newer version of doxygen or when changing the value of configuration settings such as GENERATE_TREEVIEW!
+
+HTML_HEADER            =
+
+# The HTML_FOOTER tag can be used to specify a personal HTML footer for
+# each generated HTML page. If it is left blank doxygen will generate a
+# standard footer.
+
+HTML_FOOTER            =
+
+# The HTML_STYLESHEET tag can be used to specify a user-defined cascading
+# style sheet that is used by each HTML page. It can be used to
+# fine-tune the look of the HTML output. If the tag is left blank doxygen
+# will generate a default style sheet. Note that doxygen will try to copy
+# the style sheet file to the HTML output directory, so don't put your own
+# stylesheet in the HTML output directory as well, or it will be erased!
+
+HTML_STYLESHEET        =
+
+# The HTML_EXTRA_FILES tag can be used to specify one or more extra images or
+# other source files which should be copied to the HTML output directory. Note
+# that these files will be copied to the base HTML output directory. Use the
+# $relpath$ marker in the HTML_HEADER and/or HTML_FOOTER files to load these
+# files. In the HTML_STYLESHEET file, use the file name only. Also note that
+# the files will be copied as-is; there are no commands or markers available.
+
+HTML_EXTRA_FILES       =
+
+# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output.
+# Doxygen will adjust the colors in the stylesheet and background images
+# according to this color. Hue is specified as an angle on a colorwheel,
+# see http://en.wikipedia.org/wiki/Hue for more information.
+# For instance the value 0 represents red, 60 is yellow, 120 is green,
+# 180 is cyan, 240 is blue, 300 purple, and 360 is red again.
+# The allowed range is 0 to 359.
+
+HTML_COLORSTYLE_HUE    = 220
+
+# The HTML_COLORSTYLE_SAT tag controls the purity (or saturation) of
+# the colors in the HTML output. For a value of 0 the output will use
+# grayscales only. A value of 255 will produce the most vivid colors.
+
+HTML_COLORSTYLE_SAT    = 100
+
+# The HTML_COLORSTYLE_GAMMA tag controls the gamma correction applied to
+# the luminance component of the colors in the HTML output. Values below
+# 100 gradually make the output lighter, whereas values above 100 make
+# the output darker. The value divided by 100 is the actual gamma applied,
+# so 80 represents a gamma of 0.8, The value 220 represents a gamma of 2.2,
+# and 100 does not change the gamma.
+
+HTML_COLORSTYLE_GAMMA  = 80
+
+# If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML
+# page will contain the date and time when the page was generated. Setting
+# this to NO can help when comparing the output of multiple runs.
+
+HTML_TIMESTAMP         = YES
+
+# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes,
+# files or namespaces will be aligned in HTML using tables. If set to
+# NO a bullet list will be used.
+
+HTML_ALIGN_MEMBERS     = YES
+
+# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML
+# documentation will contain sections that can be hidden and shown after the
+# page has loaded. For this to work a browser that supports
+# JavaScript and DHTML is required (for instance Mozilla 1.0+, Firefox
+# Netscape 6.0+, Internet explorer 5.0+, Konqueror, or Safari).
+
+HTML_DYNAMIC_SECTIONS  = NO
+
+# If the GENERATE_DOCSET tag is set to YES, additional index files
+# will be generated that can be used as input for Apple's Xcode 3
+# integrated development environment, introduced with OSX 10.5 (Leopard).
+# To create a documentation set, doxygen will generate a Makefile in the
+# HTML output directory. Running make will produce the docset in that
+# directory and running "make install" will install the docset in
+# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find
+# it at startup.
+# See http://developer.apple.com/tools/creatingdocsetswithdoxygen.html
+# for more information.
+
+GENERATE_DOCSET        = NO
+
+# When GENERATE_DOCSET tag is set to YES, this tag determines the name of the
+# feed. A documentation feed provides an umbrella under which multiple
+# documentation sets from a single provider (such as a company or product suite)
+# can be grouped.
+
+DOCSET_FEEDNAME        = "Doxygen generated docs"
+
+# When GENERATE_DOCSET tag is set to YES, this tag specifies a string that
+# should uniquely identify the documentation set bundle. This should be a
+# reverse domain-name style string, e.g. com.mycompany.MyDocSet. Doxygen
+# will append .docset to the name.
+
+DOCSET_BUNDLE_ID       = org.doxygen.Project
+
+# When GENERATE_PUBLISHER_ID tag specifies a string that should uniquely identify
+# the documentation publisher. This should be a reverse domain-name style
+# string, e.g. com.mycompany.MyDocSet.documentation.
+
+DOCSET_PUBLISHER_ID    = org.doxygen.Publisher
+
+# The GENERATE_PUBLISHER_NAME tag identifies the documentation publisher.
+
+DOCSET_PUBLISHER_NAME  = Publisher
+
+# If the GENERATE_HTMLHELP tag is set to YES, additional index files
+# will be generated that can be used as input for tools like the
+# Microsoft HTML help workshop to generate a compiled HTML help file (.chm)
+# of the generated HTML documentation.
+
+GENERATE_HTMLHELP      = NO
+
+# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can
+# be used to specify the file name of the resulting .chm file. You
+# can add a path in front of the file if the result should not be
+# written to the html output directory.
+
+CHM_FILE               =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can
+# be used to specify the location (absolute path including file name) of
+# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run
+# the HTML help compiler on the generated index.hhp.
+
+HHC_LOCATION           =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag
+# controls if a separate .chi index file is generated (YES) or that
+# it should be included in the master .chm file (NO).
+
+GENERATE_CHI           = NO
+
+# If the GENERATE_HTMLHELP tag is set to YES, the CHM_INDEX_ENCODING
+# is used to encode HtmlHelp index (hhk), content (hhc) and project file
+# content.
+
+CHM_INDEX_ENCODING     =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag
+# controls whether a binary table of contents is generated (YES) or a
+# normal table of contents (NO) in the .chm file.
+
+BINARY_TOC             = NO
+
+# The TOC_EXPAND flag can be set to YES to add extra items for group members
+# to the contents of the HTML help documentation and to the tree view.
+
+TOC_EXPAND             = NO
+
+# If the GENERATE_QHP tag is set to YES and both QHP_NAMESPACE and
+# QHP_VIRTUAL_FOLDER are set, an additional index file will be generated
+# that can be used as input for Qt's qhelpgenerator to generate a
+# Qt Compressed Help (.qch) of the generated HTML documentation.
+
+GENERATE_QHP           = NO
+
+# If the QHG_LOCATION tag is specified, the QCH_FILE tag can
+# be used to specify the file name of the resulting .qch file.
+# The path specified is relative to the HTML output folder.
+
+QCH_FILE               =
+
+# The QHP_NAMESPACE tag specifies the namespace to use when generating
+# Qt Help Project output. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#namespace
+
+QHP_NAMESPACE          = org.doxygen.Project
+
+# The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating
+# Qt Help Project output. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#virtual-folders
+
+QHP_VIRTUAL_FOLDER     = doc/core
+
+# If QHP_CUST_FILTER_NAME is set, it specifies the name of a custom filter to
+# add. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#custom-filters
+
+QHP_CUST_FILTER_NAME   =
+
+# The QHP_CUST_FILT_ATTRS tag specifies the list of the attributes of the
+# custom filter to add. For more information please see
+# <a href="http://doc.trolltech.com/qthelpproject.html#custom-filters">
+# Qt Help Project / Custom Filters</a>.
+
+QHP_CUST_FILTER_ATTRS  =
+
+# The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this
+# project's
+# filter section matches.
+# <a href="http://doc.trolltech.com/qthelpproject.html#filter-attributes">
+# Qt Help Project / Filter Attributes</a>.
+
+QHP_SECT_FILTER_ATTRS  =
+
+# If the GENERATE_QHP tag is set to YES, the QHG_LOCATION tag can
+# be used to specify the location of Qt's qhelpgenerator.
+# If non-empty doxygen will try to run qhelpgenerator on the generated
+# .qhp file.
+
+QHG_LOCATION           =
+
+# If the GENERATE_ECLIPSEHELP tag is set to YES, additional index files
+#  will be generated, which together with the HTML files, form an Eclipse help
+# plugin. To install this plugin and make it available under the help contents
+# menu in Eclipse, the contents of the directory containing the HTML and XML
+# files needs to be copied into the plugins directory of eclipse. The name of
+# the directory within the plugins directory should be the same as
+# the ECLIPSE_DOC_ID value. After copying Eclipse needs to be restarted before
+# the help appears.
+
+GENERATE_ECLIPSEHELP   = NO
+
+# A unique identifier for the eclipse help plugin. When installing the plugin
+# the directory name containing the HTML and XML files should also have
+# this name.
+
+ECLIPSE_DOC_ID         = org.doxygen.Project
+
+# The DISABLE_INDEX tag can be used to turn on/off the condensed index at
+# top of each HTML page. The value NO (the default) enables the index and
+# the value YES disables it.
+
+DISABLE_INDEX          = NO
+
+# The ENUM_VALUES_PER_LINE tag can be used to set the number of enum values
+# (range [0,1..20]) that doxygen will group on one line in the generated HTML
+# documentation. Note that a value of 0 will completely suppress the enum
+# values from appearing in the overview section.
+
+ENUM_VALUES_PER_LINE   = 4
+
+# The GENERATE_TREEVIEW tag is used to specify whether a tree-like index
+# structure should be generated to display hierarchical information.
+# If the tag value is set to YES, a side panel will be generated
+# containing a tree-like index structure (just like the one that
+# is generated for HTML Help). For this to work a browser that supports
+# JavaScript, DHTML, CSS and frames is required (i.e. any modern browser).
+# Windows users are probably better off using the HTML help feature.
+
+GENERATE_TREEVIEW      = YES
+
+# By enabling USE_INLINE_TREES, doxygen will generate the Groups, Directories,
+# and Class Hierarchy pages using a tree view instead of an ordered list.
+
+USE_INLINE_TREES       = NO
+
+# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be
+# used to set the initial width (in pixels) of the frame in which the tree
+# is shown.
+
+TREEVIEW_WIDTH         = 250
+
+# When the EXT_LINKS_IN_WINDOW option is set to YES doxygen will open
+# links to external symbols imported via tag files in a separate window.
+
+EXT_LINKS_IN_WINDOW    = NO
+
+# Use this tag to change the font size of Latex formulas included
+# as images in the HTML documentation. The default is 10. Note that
+# when you change the font size after a successful doxygen run you need
+# to manually remove any form_*.png images from the HTML output directory
+# to force them to be regenerated.
+
+FORMULA_FONTSIZE       = 10
+
+# Use the FORMULA_TRANPARENT tag to determine whether or not the images
+# generated for formulas are transparent PNGs. Transparent PNGs are
+# not supported properly for IE 6.0, but are supported on all modern browsers.
+# Note that when changing this option you need to delete any form_*.png files
+# in the HTML output before the changes have effect.
+
+FORMULA_TRANSPARENT    = YES
+
+# Enable the USE_MATHJAX option to render LaTeX formulas using MathJax
+# (see http://www.mathjax.org) which uses client side Javascript for the
+# rendering instead of using prerendered bitmaps. Use this if you do not
+# have LaTeX installed or if you want to formulas look prettier in the HTML
+# output. When enabled you also need to install MathJax separately and
+# configure the path to it using the MATHJAX_RELPATH option.
+
+USE_MATHJAX            = NO
+
+# When MathJax is enabled you need to specify the location relative to the
+# HTML output directory using the MATHJAX_RELPATH option. The destination
+# directory should contain the MathJax.js script. For instance, if the mathjax
+# directory is located at the same level as the HTML output directory, then
+# MATHJAX_RELPATH should be ../mathjax. The default value points to the
+# mathjax.org site, so you can quickly see the result without installing
+# MathJax, but it is strongly recommended to install a local copy of MathJax
+# before deployment.
+
+MATHJAX_RELPATH        = http://www.mathjax.org/mathjax
+
+# When the SEARCHENGINE tag is enabled doxygen will generate a search box
+# for the HTML output. The underlying search engine uses javascript
+# and DHTML and should work on any modern browser. Note that when using
+# HTML help (GENERATE_HTMLHELP), Qt help (GENERATE_QHP), or docsets
+# (GENERATE_DOCSET) there is already a search function so this one should
+# typically be disabled. For large projects the javascript based search engine
+# can be slow, then enabling SERVER_BASED_SEARCH may provide a better solution.
+
+SEARCHENGINE           = NO
+
+# When the SERVER_BASED_SEARCH tag is enabled the search engine will be
+# implemented using a PHP enabled web server instead of at the web client
+# using Javascript. Doxygen will generate the search PHP script and index
+# file to put on the web server. The advantage of the server
+# based approach is that it scales better to large projects and allows
+# full text search. The disadvantages are that it is more difficult to setup
+# and does not have live searching capabilities.
+
+SERVER_BASED_SEARCH    = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the LaTeX output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will
+# generate Latex output.
+
+GENERATE_LATEX         = YES
+
+# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `latex' will be used as the default path.
+
+LATEX_OUTPUT           = latex
+
+# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be
+# invoked. If left blank `latex' will be used as the default command name.
+# Note that when enabling USE_PDFLATEX this option is only used for
+# generating bitmaps for formulas in the HTML output, but not in the
+# Makefile that is written to the output directory.
+
+LATEX_CMD_NAME         = latex
+
+# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to
+# generate index for LaTeX. If left blank `makeindex' will be used as the
+# default command name.
+
+MAKEINDEX_CMD_NAME     = makeindex
+
+# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact
+# LaTeX documents. This may be useful for small projects and may help to
+# save some trees in general.
+
+COMPACT_LATEX          = NO
+
+# The PAPER_TYPE tag can be used to set the paper type that is used
+# by the printer. Possible values are: a4, letter, legal and
+# executive. If left blank a4wide will be used.
+
+PAPER_TYPE             = a4wide
+
+# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX
+# packages that should be included in the LaTeX output.
+
+EXTRA_PACKAGES         =
+
+# The LATEX_HEADER tag can be used to specify a personal LaTeX header for
+# the generated latex document. The header should contain everything until
+# the first chapter. If it is left blank doxygen will generate a
+# standard header. Notice: only use this tag if you know what you are doing!
+
+LATEX_HEADER           =
+
+# The LATEX_FOOTER tag can be used to specify a personal LaTeX footer for
+# the generated latex document. The footer should contain everything after
+# the last chapter. If it is left blank doxygen will generate a
+# standard footer. Notice: only use this tag if you know what you are doing!
+
+LATEX_FOOTER           =
+
+# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated
+# is prepared for conversion to pdf (using ps2pdf). The pdf file will
+# contain links (just like the HTML output) instead of page references
+# This makes the output suitable for online browsing using a pdf viewer.
+
+PDF_HYPERLINKS         = NO
+
+# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of
+# plain latex in the generated Makefile. Set this option to YES to get a
+# higher quality PDF documentation.
+
+USE_PDFLATEX           = NO
+
+# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode.
+# command to the generated LaTeX files. This will instruct LaTeX to keep
+# running if errors occur, instead of asking the user for help.
+# This option is also used when generating formulas in HTML.
+
+LATEX_BATCHMODE        = NO
+
+# If LATEX_HIDE_INDICES is set to YES then doxygen will not
+# include the index chapters (such as File Index, Compound Index, etc.)
+# in the output.
+
+LATEX_HIDE_INDICES     = NO
+
+# If LATEX_SOURCE_CODE is set to YES then doxygen will include
+# source code with syntax highlighting in the LaTeX output.
+# Note that which sources are shown also depends on other settings
+# such as SOURCE_BROWSER.
+
+LATEX_SOURCE_CODE      = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the RTF output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output
+# The RTF output is optimized for Word 97 and may not look very pretty with
+# other RTF readers or editors.
+
+GENERATE_RTF           = NO
+
+# The RTF_OUTPUT tag is used to specify where the RTF docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `rtf' will be used as the default path.
+
+RTF_OUTPUT             = rtf
+
+# If the COMPACT_RTF tag is set to YES Doxygen generates more compact
+# RTF documents. This may be useful for small projects and may help to
+# save some trees in general.
+
+COMPACT_RTF            = NO
+
+# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated
+# will contain hyperlink fields. The RTF file will
+# contain links (just like the HTML output) instead of page references.
+# This makes the output suitable for online browsing using WORD or other
+# programs which support those fields.
+# Note: wordpad (write) and others do not support links.
+
+RTF_HYPERLINKS         = NO
+
+# Load stylesheet definitions from file. Syntax is similar to doxygen's
+# config file, i.e. a series of assignments. You only have to provide
+# replacements, missing definitions are set to their default value.
+
+RTF_STYLESHEET_FILE    =
+
+# Set optional variables used in the generation of an rtf document.
+# Syntax is similar to doxygen's config file.
+
+RTF_EXTENSIONS_FILE    =
+
+#---------------------------------------------------------------------------
+# configuration options related to the man page output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_MAN tag is set to YES (the default) Doxygen will
+# generate man pages
+
+GENERATE_MAN           = NO
+
+# The MAN_OUTPUT tag is used to specify where the man pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `man' will be used as the default path.
+
+MAN_OUTPUT             = man
+
+# The MAN_EXTENSION tag determines the extension that is added to
+# the generated man pages (default is the subroutine's section .3)
+
+MAN_EXTENSION          = .3
+
+# If the MAN_LINKS tag is set to YES and Doxygen generates man output,
+# then it will generate one additional man file for each entity
+# documented in the real man page(s). These additional files
+# only source the real man page, but without them the man command
+# would be unable to find the correct page. The default is NO.
+
+MAN_LINKS              = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the XML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_XML tag is set to YES Doxygen will
+# generate an XML file that captures the structure of
+# the code including all documentation.
+
+GENERATE_XML           = NO
+
+# The XML_OUTPUT tag is used to specify where the XML pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `xml' will be used as the default path.
+
+XML_OUTPUT             = xml
+
+# The XML_SCHEMA tag can be used to specify an XML schema,
+# which can be used by a validating XML parser to check the
+# syntax of the XML files.
+
+XML_SCHEMA             =
+
+# The XML_DTD tag can be used to specify an XML DTD,
+# which can be used by a validating XML parser to check the
+# syntax of the XML files.
+
+XML_DTD                =
+
+# If the XML_PROGRAMLISTING tag is set to YES Doxygen will
+# dump the program listings (including syntax highlighting
+# and cross-referencing information) to the XML output. Note that
+# enabling this will significantly increase the size of the XML output.
+
+XML_PROGRAMLISTING     = YES
+
+#---------------------------------------------------------------------------
+# configuration options for the AutoGen Definitions output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will
+# generate an AutoGen Definitions (see autogen.sf.net) file
+# that captures the structure of the code including all
+# documentation. Note that this feature is still experimental
+# and incomplete at the moment.
+
+GENERATE_AUTOGEN_DEF   = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the Perl module output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_PERLMOD tag is set to YES Doxygen will
+# generate a Perl module file that captures the structure of
+# the code including all documentation. Note that this
+# feature is still experimental and incomplete at the
+# moment.
+
+GENERATE_PERLMOD       = NO
+
+# If the PERLMOD_LATEX tag is set to YES Doxygen will generate
+# the necessary Makefile rules, Perl scripts and LaTeX code to be able
+# to generate PDF and DVI output from the Perl module output.
+
+PERLMOD_LATEX          = NO
+
+# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be
+# nicely formatted so it can be parsed by a human reader.
+# This is useful
+# if you want to understand what is going on.
+# On the other hand, if this
+# tag is set to NO the size of the Perl module output will be much smaller
+# and Perl will parse it just the same.
+
+PERLMOD_PRETTY         = YES
+
+# The names of the make variables in the generated doxyrules.make file
+# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX.
+# This is useful so different doxyrules.make files included by the same
+# Makefile don't overwrite each other's variables.
+
+PERLMOD_MAKEVAR_PREFIX =
+
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor
+#---------------------------------------------------------------------------
+
+# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will
+# evaluate all C-preprocessor directives found in the sources and include
+# files.
+
+ENABLE_PREPROCESSING   = NO
+
+# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro
+# names in the source code. If set to NO (the default) only conditional
+# compilation will be performed. Macro expansion can be done in a controlled
+# way by setting EXPAND_ONLY_PREDEF to YES.
+
+MACRO_EXPANSION        = NO
+
+# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES
+# then the macro expansion is limited to the macros specified with the
+# PREDEFINED and EXPAND_AS_DEFINED tags.
+
+EXPAND_ONLY_PREDEF     = NO
+
+# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files
+# pointed to by INCLUDE_PATH will be searched when a #include is found.
+
+SEARCH_INCLUDES        = YES
+
+# The INCLUDE_PATH tag can be used to specify one or more directories that
+# contain include files that are not input files but should be processed by
+# the preprocessor.
+
+INCLUDE_PATH           =
+
+# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard
+# patterns (like *.h and *.hpp) to filter out the header-files in the
+# directories. If left blank, the patterns specified with FILE_PATTERNS will
+# be used.
+
+INCLUDE_FILE_PATTERNS  =
+
+# The PREDEFINED tag can be used to specify one or more macro names that
+# are defined before the preprocessor is started (similar to the -D option of
+# gcc). The argument of the tag is a list of macros of the form: name
+# or name=definition (no spaces). If the definition and the = are
+# omitted =1 is assumed. To prevent a macro definition from being
+# undefined via #undef or recursively expanded use the := operator
+# instead of the = operator.
+
+PREDEFINED             =
+
+# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then
+# this tag can be used to specify a list of macro names that should be expanded.
+# The macro definition that is found in the sources will be used.
+# Use the PREDEFINED tag if you want to use a different macro definition that
+# overrules the definition found in the source code.
+
+EXPAND_AS_DEFINED      =
+
+# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then
+# doxygen's preprocessor will remove all references to function-like macros
+# that are alone on a line, have an all uppercase name, and do not end with a
+# semicolon, because these will confuse the parser if not removed.
+
+SKIP_FUNCTION_MACROS   = YES
+
+#---------------------------------------------------------------------------
+# Configuration::additions related to external references
+#---------------------------------------------------------------------------
+
+# The TAGFILES option can be used to specify one or more tagfiles.
+# Optionally an initial location of the external documentation
+# can be added for each tagfile. The format of a tag file without
+# this location is as follows:
+#
+# TAGFILES = file1 file2 ...
+# Adding location for the tag files is done as follows:
+#
+# TAGFILES = file1=loc1 "file2 = loc2" ...
+# where "loc1" and "loc2" can be relative or absolute paths or
+# URLs. If a location is present for each tag, the installdox tool
+# does not have to be run to correct the links.
+# Note that each tag file must have a unique name
+# (where the name does NOT include the path)
+# If a tag file is not located in the directory in which doxygen
+# is run, you must also specify the path to the tagfile here.
+
+TAGFILES               =
+
+# When a file name is specified after GENERATE_TAGFILE, doxygen will create
+# a tag file that is based on the input files it reads.
+
+GENERATE_TAGFILE       =
+
+# If the ALLEXTERNALS tag is set to YES all external classes will be listed
+# in the class index. If set to NO only the inherited external classes
+# will be listed.
+
+ALLEXTERNALS           = NO
+
+# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed
+# in the modules index. If set to NO, only the current project's groups will
+# be listed.
+
+EXTERNAL_GROUPS        = YES
+
+# The PERL_PATH should be the absolute path and name of the perl script
+# interpreter (i.e. the result of `which perl').
+
+PERL_PATH              = /usr/bin/perl
+
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool
+#---------------------------------------------------------------------------
+
+# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will
+# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base
+# or super classes. Setting the tag to NO turns the diagrams off. Note that
+# this option also works with HAVE_DOT disabled, but it is recommended to
+# install and use dot, since it yields more powerful graphs.
+
+CLASS_DIAGRAMS         = YES
+
+# You can define message sequence charts within doxygen comments using the \msc
+# command. Doxygen will then run the mscgen tool (see
+# http://www.mcternan.me.uk/mscgen/) to produce the chart and insert it in the
+# documentation. The MSCGEN_PATH tag allows you to specify the directory where
+# the mscgen tool resides. If left empty the tool is assumed to be found in the
+# default search path.
+
+MSCGEN_PATH            =
+
+# If set to YES, the inheritance and collaboration graphs will hide
+# inheritance and usage relations if the target is undocumented
+# or is not a class.
+
+HIDE_UNDOC_RELATIONS   = YES
+
+# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is
+# available from the path. This tool is part of Graphviz, a graph visualization
+# toolkit from AT&T and Lucent Bell Labs. The other options in this section
+# have no effect if this option is set to NO (the default)
+
+HAVE_DOT               = NO
+
+# The DOT_NUM_THREADS specifies the number of dot invocations doxygen is
+# allowed to run in parallel. When set to 0 (the default) doxygen will
+# base this on the number of processors available in the system. You can set it
+# explicitly to a value larger than 0 to get control over the balance
+# between CPU load and processing speed.
+
+DOT_NUM_THREADS        = 0
+
+# By default doxygen will write a font called Helvetica to the output
+# directory and reference it in all dot files that doxygen generates.
+# When you want a differently looking font you can specify the font name
+# using DOT_FONTNAME. You need to make sure dot is able to find the font,
+# which can be done by putting it in a standard location or by setting the
+# DOTFONTPATH environment variable or by setting DOT_FONTPATH to the directory
+# containing the font.
+
+DOT_FONTNAME           = Helvetica
+
+# The DOT_FONTSIZE tag can be used to set the size of the font of dot graphs.
+# The default size is 10pt.
+
+DOT_FONTSIZE           = 10
+
+# By default doxygen will tell dot to use the output directory to look for the
+# FreeSans.ttf font (which doxygen will put there itself). If you specify a
+# different font using DOT_FONTNAME you can set the path where dot
+# can find it using this tag.
+
+DOT_FONTPATH           =
+
+# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for each documented class showing the direct and
+# indirect inheritance relations. Setting this tag to YES will force the
+# the CLASS_DIAGRAMS tag to NO.
+
+CLASS_GRAPH            = YES
+
+# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for each documented class showing the direct and
+# indirect implementation dependencies (inheritance, containment, and
+# class references variables) of the class with other documented classes.
+
+COLLABORATION_GRAPH    = YES
+
+# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for groups, showing the direct groups dependencies
+
+GROUP_GRAPHS           = YES
+
+# If the UML_LOOK tag is set to YES doxygen will generate inheritance and
+# collaboration diagrams in a style similar to the OMG's Unified Modeling
+# Language.
+
+UML_LOOK               = NO
+
+# If set to YES, the inheritance and collaboration graphs will show the
+# relations between templates and their instances.
+
+TEMPLATE_RELATIONS     = NO
+
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT
+# tags are set to YES then doxygen will generate a graph for each documented
+# file showing the direct and indirect include dependencies of the file with
+# other documented files.
+
+INCLUDE_GRAPH          = YES
+
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and
+# HAVE_DOT tags are set to YES then doxygen will generate a graph for each
+# documented header file showing the documented files that directly or
+# indirectly include this file.
+
+INCLUDED_BY_GRAPH      = YES
+
+# If the CALL_GRAPH and HAVE_DOT options are set to YES then
+# doxygen will generate a call dependency graph for every global function
+# or class method. Note that enabling this option will significantly increase
+# the time of a run. So in most cases it will be better to enable call graphs
+# for selected functions only using the \callgraph command.
+
+CALL_GRAPH             = NO
+
+# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then
+# doxygen will generate a caller dependency graph for every global function
+# or class method. Note that enabling this option will significantly increase
+# the time of a run. So in most cases it will be better to enable caller
+# graphs for selected functions only using the \callergraph command.
+
+CALLER_GRAPH           = NO
+
+# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen
+# will generate a graphical hierarchy of all classes instead of a textual one.
+
+GRAPHICAL_HIERARCHY    = YES
+
+# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES
+# then doxygen will show the dependencies a directory has on other directories
+# in a graphical way. The dependency relations are determined by the #include
+# relations between the files in the directories.
+
+DIRECTORY_GRAPH        = YES
+
+# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images
+# generated by dot. Possible values are svg, png, jpg, or gif.
+# If left blank png will be used.
+
+DOT_IMAGE_FORMAT       = png
+
+# The tag DOT_PATH can be used to specify the path where the dot tool can be
+# found. If left blank, it is assumed the dot tool can be found in the path.
+
+DOT_PATH               = /usr/bin/dot
+
+# The DOTFILE_DIRS tag can be used to specify one or more directories that
+# contain dot files that are included in the documentation (see the
+# \dotfile command).
+
+DOTFILE_DIRS           =
+
+# The MSCFILE_DIRS tag can be used to specify one or more directories that
+# contain msc files that are included in the documentation (see the
+# \mscfile command).
+
+MSCFILE_DIRS           =
+
+# The DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of
+# nodes that will be shown in the graph. If the number of nodes in a graph
+# becomes larger than this value, doxygen will truncate the graph, which is
+# visualized by representing a node as a red box. Note that doxygen if the
+# number of direct children of the root node in a graph is already larger than
+# DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note
+# that the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH.
+
+DOT_GRAPH_MAX_NODES    = 50
+
+# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the
+# graphs generated by dot. A depth value of 3 means that only nodes reachable
+# from the root by following a path via at most 3 edges will be shown. Nodes
+# that lay further from the root node will be omitted. Note that setting this
+# option to 1 or 2 may greatly reduce the computation time needed for large
+# code bases. Also note that the size of a graph can be further restricted by
+# DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction.
+
+MAX_DOT_GRAPH_DEPTH    = 0
+
+# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent
+# background. This is disabled by default, because dot on Windows does not
+# seem to support this out of the box. Warning: Depending on the platform used,
+# enabling this option may lead to badly anti-aliased labels on the edges of
+# a graph (i.e. they become hard to read).
+
+DOT_TRANSPARENT        = NO
+
+# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output
+# files in one run (i.e. multiple -o and -T options on the command line). This
+# makes dot run faster, but since only newer versions of dot (>1.8.10)
+# support this, this feature is disabled by default.
+
+DOT_MULTI_TARGETS      = NO
+
+# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will
+# generate a legend page explaining the meaning of the various boxes and
+# arrows in the dot generated graphs.
+
+GENERATE_LEGEND        = YES
+
+# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will
+# remove the intermediate dot files that are used to generate
+# the various graphs.
+
+DOT_CLEANUP            = YES
diff --git a/src/shared/libosmocore/Doxyfile.gsm.in b/src/shared/libosmocore/Doxyfile.gsm.in
new file mode 100644
index 00000000..ab25b220
--- /dev/null
+++ b/src/shared/libosmocore/Doxyfile.gsm.in
@@ -0,0 +1,1716 @@
+# Doxyfile 1.7.4
+
+# This file describes the settings to be used by the documentation system
+# doxygen (www.doxygen.org) for a project.
+#
+# All text after a hash (#) is considered a comment and will be ignored.
+# The format is:
+#       TAG = value [value, ...]
+# For lists items can also be appended using:
+#       TAG += value [value, ...]
+# Values that contain spaces should be placed between quotes (" ").
+
+#---------------------------------------------------------------------------
+# Project related configuration options
+#---------------------------------------------------------------------------
+
+# This tag specifies the encoding used for all characters in the config file
+# that follow. The default is UTF-8 which is also the encoding used for all
+# text before the first occurrence of this tag. Doxygen uses libiconv (or the
+# iconv built into libc) for the transcoding. See
+# http://www.gnu.org/software/libiconv for the list of possible encodings.
+
+DOXYFILE_ENCODING      = UTF-8
+
+# The PROJECT_NAME tag is a single word (or a sequence of words surrounded
+# by quotes) that should identify the project.
+
+PROJECT_NAME           = libosmogsm
+
+# The PROJECT_NUMBER tag can be used to enter a project or revision number.
+# This could be handy for archiving the generated documentation or
+# if some version control system is used.
+
+PROJECT_NUMBER         = @VERSION@
+
+# Using the PROJECT_BRIEF tag one can provide an optional one line description
+# for a project that appears at the top of each page and should give viewer
+# a quick idea about the purpose of the project. Keep the description short.
+
+PROJECT_BRIEF          = "Osmocom GSM library"
+
+# With the PROJECT_LOGO tag one can specify an logo or icon that is
+# included in the documentation. The maximum height of the logo should not
+# exceed 55 pixels and the maximum width should not exceed 200 pixels.
+# Doxygen will copy the logo to the output directory.
+
+PROJECT_LOGO           =
+
+# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
+# base path where the generated documentation will be put.
+# If a relative path is entered, it will be relative to the location
+# where doxygen was started. If left blank the current directory will be used.
+
+OUTPUT_DIRECTORY       = doc/gsm
+
+# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create
+# 4096 sub-directories (in 2 levels) under the output directory of each output
+# format and will distribute the generated files over these directories.
+# Enabling this option can be useful when feeding doxygen a huge amount of
+# source files, where putting all generated files in the same directory would
+# otherwise cause performance problems for the file system.
+
+CREATE_SUBDIRS         = NO
+
+# The OUTPUT_LANGUAGE tag is used to specify the language in which all
+# documentation generated by doxygen is written. Doxygen will use this
+# information to generate all constant output in the proper language.
+# The default language is English, other supported languages are:
+# Afrikaans, Arabic, Brazilian, Catalan, Chinese, Chinese-Traditional,
+# Croatian, Czech, Danish, Dutch, Esperanto, Farsi, Finnish, French, German,
+# Greek, Hungarian, Italian, Japanese, Japanese-en (Japanese with English
+# messages), Korean, Korean-en, Lithuanian, Norwegian, Macedonian, Persian,
+# Polish, Portuguese, Romanian, Russian, Serbian, Serbian-Cyrillic, Slovak,
+# Slovene, Spanish, Swedish, Ukrainian, and Vietnamese.
+
+OUTPUT_LANGUAGE        = English
+
+# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will
+# include brief member descriptions after the members that are listed in
+# the file and class documentation (similar to JavaDoc).
+# Set to NO to disable this.
+
+BRIEF_MEMBER_DESC      = YES
+
+# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend
+# the brief description of a member or function before the detailed description.
+# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the
+# brief descriptions will be completely suppressed.
+
+REPEAT_BRIEF           = YES
+
+# This tag implements a quasi-intelligent brief description abbreviator
+# that is used to form the text in various listings. Each string
+# in this list, if found as the leading text of the brief description, will be
+# stripped from the text and the result after processing the whole list, is
+# used as the annotated text. Otherwise, the brief description is used as-is.
+# If left blank, the following values are used ("$name" is automatically
+# replaced with the name of the entity): "The $name class" "The $name widget"
+# "The $name file" "is" "provides" "specifies" "contains"
+# "represents" "a" "an" "the"
+
+ABBREVIATE_BRIEF       =
+
+# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then
+# Doxygen will generate a detailed section even if there is only a brief
+# description.
+
+ALWAYS_DETAILED_SEC    = NO
+
+# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all
+# inherited members of a class in the documentation of that class as if those
+# members were ordinary class members. Constructors, destructors and assignment
+# operators of the base classes will not be shown.
+
+INLINE_INHERITED_MEMB  = NO
+
+# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full
+# path before files name in the file list and in the header files. If set
+# to NO the shortest path that makes the file name unique will be used.
+
+FULL_PATH_NAMES        = YES
+
+# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag
+# can be used to strip a user-defined part of the path. Stripping is
+# only done if one of the specified strings matches the left-hand part of
+# the path. The tag can be used to show relative paths in the file list.
+# If left blank the directory from which doxygen is run is used as the
+# path to strip.
+
+STRIP_FROM_PATH        =
+
+# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of
+# the path mentioned in the documentation of a class, which tells
+# the reader which header file to include in order to use a class.
+# If left blank only the name of the header file containing the class
+# definition is used. Otherwise one should specify the include paths that
+# are normally passed to the compiler using the -I flag.
+
+STRIP_FROM_INC_PATH    =
+
+# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter
+# (but less readable) file names. This can be useful if your file system
+# doesn't support long names like on DOS, Mac, or CD-ROM.
+
+SHORT_NAMES            = NO
+
+# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen
+# will interpret the first line (until the first dot) of a JavaDoc-style
+# comment as the brief description. If set to NO, the JavaDoc
+# comments will behave just like regular Qt-style comments
+# (thus requiring an explicit @brief command for a brief description.)
+
+JAVADOC_AUTOBRIEF      = NO
+
+# If the QT_AUTOBRIEF tag is set to YES then Doxygen will
+# interpret the first line (until the first dot) of a Qt-style
+# comment as the brief description. If set to NO, the comments
+# will behave just like regular Qt-style comments (thus requiring
+# an explicit \brief command for a brief description.)
+
+QT_AUTOBRIEF           = NO
+
+# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen
+# treat a multi-line C++ special comment block (i.e. a block of //! or ///
+# comments) as a brief description. This used to be the default behaviour.
+# The new default is to treat a multi-line C++ comment block as a detailed
+# description. Set this tag to YES if you prefer the old behaviour instead.
+
+MULTILINE_CPP_IS_BRIEF = NO
+
+# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented
+# member inherits the documentation from any documented member that it
+# re-implements.
+
+INHERIT_DOCS           = YES
+
+# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce
+# a new page for each member. If set to NO, the documentation of a member will
+# be part of the file/class/namespace that contains it.
+
+SEPARATE_MEMBER_PAGES  = NO
+
+# The TAB_SIZE tag can be used to set the number of spaces in a tab.
+# Doxygen uses this value to replace tabs by spaces in code fragments.
+
+TAB_SIZE               = 8
+
+# This tag can be used to specify a number of aliases that acts
+# as commands in the documentation. An alias has the form "name=value".
+# For example adding "sideeffect=\par Side Effects:\n" will allow you to
+# put the command \sideeffect (or @sideeffect) in the documentation, which
+# will result in a user-defined paragraph with heading "Side Effects:".
+# You can put \n's in the value part of an alias to insert newlines.
+
+ALIASES                =
+
+# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C
+# sources only. Doxygen will then generate output that is more tailored for C.
+# For instance, some of the names that are used will be different. The list
+# of all members will be omitted, etc.
+
+OPTIMIZE_OUTPUT_FOR_C  = YES
+
+# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java
+# sources only. Doxygen will then generate output that is more tailored for
+# Java. For instance, namespaces will be presented as packages, qualified
+# scopes will look different, etc.
+
+OPTIMIZE_OUTPUT_JAVA   = NO
+
+# Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran
+# sources only. Doxygen will then generate output that is more tailored for
+# Fortran.
+
+OPTIMIZE_FOR_FORTRAN   = NO
+
+# Set the OPTIMIZE_OUTPUT_VHDL tag to YES if your project consists of VHDL
+# sources. Doxygen will then generate output that is tailored for
+# VHDL.
+
+OPTIMIZE_OUTPUT_VHDL   = NO
+
+# Doxygen selects the parser to use depending on the extension of the files it
+# parses. With this tag you can assign which parser to use for a given extension.
+# Doxygen has a built-in mapping, but you can override or extend it using this
+# tag. The format is ext=language, where ext is a file extension, and language
+# is one of the parsers supported by doxygen: IDL, Java, Javascript, CSharp, C,
+# C++, D, PHP, Objective-C, Python, Fortran, VHDL, C, C++. For instance to make
+# doxygen treat .inc files as Fortran files (default is PHP), and .f files as C
+# (default is Fortran), use: inc=Fortran f=C. Note that for custom extensions
+# you also need to set FILE_PATTERNS otherwise the files are not read by doxygen.
+
+EXTENSION_MAPPING      =
+
+# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want
+# to include (a tag file for) the STL sources as input, then you should
+# set this tag to YES in order to let doxygen match functions declarations and
+# definitions whose arguments contain STL classes (e.g. func(std::string); v.s.
+# func(std::string) {}). This also makes the inheritance and collaboration
+# diagrams that involve STL classes more complete and accurate.
+
+BUILTIN_STL_SUPPORT    = NO
+
+# If you use Microsoft's C++/CLI language, you should set this option to YES to
+# enable parsing support.
+
+CPP_CLI_SUPPORT        = NO
+
+# Set the SIP_SUPPORT tag to YES if your project consists of sip sources only.
+# Doxygen will parse them like normal C++ but will assume all classes use public
+# instead of private inheritance when no explicit protection keyword is present.
+
+SIP_SUPPORT            = NO
+
+# For Microsoft's IDL there are propget and propput attributes to indicate getter
+# and setter methods for a property. Setting this option to YES (the default)
+# will make doxygen replace the get and set methods by a property in the
+# documentation. This will only work if the methods are indeed getting or
+# setting a simple type. If this is not the case, or you want to show the
+# methods anyway, you should set this option to NO.
+
+IDL_PROPERTY_SUPPORT   = YES
+
+# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC
+# tag is set to YES, then doxygen will reuse the documentation of the first
+# member in the group (if any) for the other members of the group. By default
+# all members of a group must be documented explicitly.
+
+DISTRIBUTE_GROUP_DOC   = NO
+
+# Set the SUBGROUPING tag to YES (the default) to allow class member groups of
+# the same type (for instance a group of public functions) to be put as a
+# subgroup of that type (e.g. under the Public Functions section). Set it to
+# NO to prevent subgrouping. Alternatively, this can be done per class using
+# the \nosubgrouping command.
+
+SUBGROUPING            = YES
+
+# When the INLINE_GROUPED_CLASSES tag is set to YES, classes, structs and
+# unions are shown inside the group in which they are included (e.g. using
+# @ingroup) instead of on a separate page (for HTML and Man pages) or
+# section (for LaTeX and RTF).
+
+INLINE_GROUPED_CLASSES = NO
+
+# When TYPEDEF_HIDES_STRUCT is enabled, a typedef of a struct, union, or enum
+# is documented as struct, union, or enum with the name of the typedef. So
+# typedef struct TypeS {} TypeT, will appear in the documentation as a struct
+# with name TypeT. When disabled the typedef will appear as a member of a file,
+# namespace, or class. And the struct will be named TypeS. This can typically
+# be useful for C code in case the coding convention dictates that all compound
+# types are typedef'ed and only the typedef is referenced, never the tag name.
+
+TYPEDEF_HIDES_STRUCT   = NO
+
+# The SYMBOL_CACHE_SIZE determines the size of the internal cache use to
+# determine which symbols to keep in memory and which to flush to disk.
+# When the cache is full, less often used symbols will be written to disk.
+# For small to medium size projects (<1000 input files) the default value is
+# probably good enough. For larger projects a too small cache size can cause
+# doxygen to be busy swapping symbols to and from disk most of the time
+# causing a significant performance penalty.
+# If the system has enough physical memory increasing the cache will improve the
+# performance by keeping more symbols in memory. Note that the value works on
+# a logarithmic scale so increasing the size by one will roughly double the
+# memory usage. The cache size is given by this formula:
+# 2^(16+SYMBOL_CACHE_SIZE). The valid range is 0..9, the default is 0,
+# corresponding to a cache size of 2^16 = 65536 symbols
+
+SYMBOL_CACHE_SIZE      = 0
+
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+
+# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in
+# documentation are documented, even if no documentation was available.
+# Private class members and static file members will be hidden unless
+# the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES
+
+EXTRACT_ALL            = NO
+
+# If the EXTRACT_PRIVATE tag is set to YES all private members of a class
+# will be included in the documentation.
+
+EXTRACT_PRIVATE        = NO
+
+# If the EXTRACT_STATIC tag is set to YES all static members of a file
+# will be included in the documentation.
+
+EXTRACT_STATIC         = YES
+
+# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs)
+# defined locally in source files will be included in the documentation.
+# If set to NO only classes defined in header files are included.
+
+EXTRACT_LOCAL_CLASSES  = YES
+
+# This flag is only useful for Objective-C code. When set to YES local
+# methods, which are defined in the implementation section but not in
+# the interface are included in the documentation.
+# If set to NO (the default) only methods in the interface are included.
+
+EXTRACT_LOCAL_METHODS  = NO
+
+# If this flag is set to YES, the members of anonymous namespaces will be
+# extracted and appear in the documentation as a namespace called
+# 'anonymous_namespace{file}', where file will be replaced with the base
+# name of the file that contains the anonymous namespace. By default
+# anonymous namespaces are hidden.
+
+EXTRACT_ANON_NSPACES   = NO
+
+# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all
+# undocumented members of documented classes, files or namespaces.
+# If set to NO (the default) these members will be included in the
+# various overviews, but no documentation section is generated.
+# This option has no effect if EXTRACT_ALL is enabled.
+
+HIDE_UNDOC_MEMBERS     = NO
+
+# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all
+# undocumented classes that are normally visible in the class hierarchy.
+# If set to NO (the default) these classes will be included in the various
+# overviews. This option has no effect if EXTRACT_ALL is enabled.
+
+HIDE_UNDOC_CLASSES     = NO
+
+# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all
+# friend (class|struct|union) declarations.
+# If set to NO (the default) these declarations will be included in the
+# documentation.
+
+HIDE_FRIEND_COMPOUNDS  = NO
+
+# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any
+# documentation blocks found inside the body of a function.
+# If set to NO (the default) these blocks will be appended to the
+# function's detailed documentation block.
+
+HIDE_IN_BODY_DOCS      = NO
+
+# The INTERNAL_DOCS tag determines if documentation
+# that is typed after a \internal command is included. If the tag is set
+# to NO (the default) then the documentation will be excluded.
+# Set it to YES to include the internal documentation.
+
+INTERNAL_DOCS          = NO
+
+# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate
+# file names in lower-case letters. If set to YES upper-case letters are also
+# allowed. This is useful if you have classes or files whose names only differ
+# in case and if your file system supports case sensitive file names. Windows
+# and Mac users are advised to set this option to NO.
+
+CASE_SENSE_NAMES       = YES
+
+# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen
+# will show members with their full class and namespace scopes in the
+# documentation. If set to YES the scope will be hidden.
+
+HIDE_SCOPE_NAMES       = NO
+
+# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen
+# will put a list of the files that are included by a file in the documentation
+# of that file.
+
+SHOW_INCLUDE_FILES     = YES
+
+# If the FORCE_LOCAL_INCLUDES tag is set to YES then Doxygen
+# will list include files with double quotes in the documentation
+# rather than with sharp brackets.
+
+FORCE_LOCAL_INCLUDES   = NO
+
+# If the INLINE_INFO tag is set to YES (the default) then a tag [inline]
+# is inserted in the documentation for inline members.
+
+INLINE_INFO            = YES
+
+# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen
+# will sort the (detailed) documentation of file and class members
+# alphabetically by member name. If set to NO the members will appear in
+# declaration order.
+
+SORT_MEMBER_DOCS       = YES
+
+# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the
+# brief documentation of file, namespace and class members alphabetically
+# by member name. If set to NO (the default) the members will appear in
+# declaration order.
+
+SORT_BRIEF_DOCS        = NO
+
+# If the SORT_MEMBERS_CTORS_1ST tag is set to YES then doxygen
+# will sort the (brief and detailed) documentation of class members so that
+# constructors and destructors are listed first. If set to NO (the default)
+# the constructors will appear in the respective orders defined by
+# SORT_MEMBER_DOCS and SORT_BRIEF_DOCS.
+# This tag will be ignored for brief docs if SORT_BRIEF_DOCS is set to NO
+# and ignored for detailed docs if SORT_MEMBER_DOCS is set to NO.
+
+SORT_MEMBERS_CTORS_1ST = NO
+
+# If the SORT_GROUP_NAMES tag is set to YES then doxygen will sort the
+# hierarchy of group names into alphabetical order. If set to NO (the default)
+# the group names will appear in their defined order.
+
+SORT_GROUP_NAMES       = NO
+
+# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be
+# sorted by fully-qualified names, including namespaces. If set to
+# NO (the default), the class list will be sorted only by class name,
+# not including the namespace part.
+# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES.
+# Note: This option applies only to the class list, not to the
+# alphabetical list.
+
+SORT_BY_SCOPE_NAME     = NO
+
+# If the STRICT_PROTO_MATCHING option is enabled and doxygen fails to
+# do proper type resolution of all parameters of a function it will reject a
+# match between the prototype and the implementation of a member function even
+# if there is only one candidate or it is obvious which candidate to choose
+# by doing a simple string match. By disabling STRICT_PROTO_MATCHING doxygen
+# will still accept a match between prototype and implementation in such cases.
+
+STRICT_PROTO_MATCHING  = NO
+
+# The GENERATE_TODOLIST tag can be used to enable (YES) or
+# disable (NO) the todo list. This list is created by putting \todo
+# commands in the documentation.
+
+GENERATE_TODOLIST      = YES
+
+# The GENERATE_TESTLIST tag can be used to enable (YES) or
+# disable (NO) the test list. This list is created by putting \test
+# commands in the documentation.
+
+GENERATE_TESTLIST      = YES
+
+# The GENERATE_BUGLIST tag can be used to enable (YES) or
+# disable (NO) the bug list. This list is created by putting \bug
+# commands in the documentation.
+
+GENERATE_BUGLIST       = YES
+
+# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or
+# disable (NO) the deprecated list. This list is created by putting
+# \deprecated commands in the documentation.
+
+GENERATE_DEPRECATEDLIST= YES
+
+# The ENABLED_SECTIONS tag can be used to enable conditional
+# documentation sections, marked by \if sectionname ... \endif.
+
+ENABLED_SECTIONS       =
+
+# The MAX_INITIALIZER_LINES tag determines the maximum number of lines
+# the initial value of a variable or macro consists of for it to appear in
+# the documentation. If the initializer consists of more lines than specified
+# here it will be hidden. Use a value of 0 to hide initializers completely.
+# The appearance of the initializer of individual variables and macros in the
+# documentation can be controlled using \showinitializer or \hideinitializer
+# command in the documentation regardless of this setting.
+
+MAX_INITIALIZER_LINES  = 30
+
+# Set the SHOW_USED_FILES tag to NO to disable the list of files generated
+# at the bottom of the documentation of classes and structs. If set to YES the
+# list will mention the files that were used to generate the documentation.
+
+SHOW_USED_FILES        = YES
+
+# If the sources in your project are distributed over multiple directories
+# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy
+# in the documentation. The default is NO.
+
+SHOW_DIRECTORIES       = NO
+
+# Set the SHOW_FILES tag to NO to disable the generation of the Files page.
+# This will remove the Files entry from the Quick Index and from the
+# Folder Tree View (if specified). The default is YES.
+
+SHOW_FILES             = YES
+
+# Set the SHOW_NAMESPACES tag to NO to disable the generation of the
+# Namespaces page.
+# This will remove the Namespaces entry from the Quick Index
+# and from the Folder Tree View (if specified). The default is YES.
+
+SHOW_NAMESPACES        = YES
+
+# The FILE_VERSION_FILTER tag can be used to specify a program or script that
+# doxygen should invoke to get the current version for each file (typically from
+# the version control system). Doxygen will invoke the program by executing (via
+# popen()) the command <command> <input-file>, where <command> is the value of
+# the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file
+# provided by doxygen. Whatever the program writes to standard output
+# is used as the file version. See the manual for examples.
+
+FILE_VERSION_FILTER    =
+
+# The LAYOUT_FILE tag can be used to specify a layout file which will be parsed
+# by doxygen. The layout file controls the global structure of the generated
+# output files in an output format independent way. The create the layout file
+# that represents doxygen's defaults, run doxygen with the -l option.
+# You can optionally specify a file name after the option, if omitted
+# DoxygenLayout.xml will be used as the name of the layout file.
+
+LAYOUT_FILE            =
+
+#---------------------------------------------------------------------------
+# configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+
+# The QUIET tag can be used to turn on/off the messages that are generated
+# by doxygen. Possible values are YES and NO. If left blank NO is used.
+
+QUIET                  = NO
+
+# The WARNINGS tag can be used to turn on/off the warning messages that are
+# generated by doxygen. Possible values are YES and NO. If left blank
+# NO is used.
+
+WARNINGS               = YES
+
+# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings
+# for undocumented members. If EXTRACT_ALL is set to YES then this flag will
+# automatically be disabled.
+
+WARN_IF_UNDOCUMENTED   = YES
+
+# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for
+# potential errors in the documentation, such as not documenting some
+# parameters in a documented function, or documenting parameters that
+# don't exist or using markup commands wrongly.
+
+WARN_IF_DOC_ERROR      = YES
+
+# The WARN_NO_PARAMDOC option can be enabled to get warnings for
+# functions that are documented, but have no documentation for their parameters
+# or return value. If set to NO (the default) doxygen will only warn about
+# wrong or incomplete parameter documentation, but not about the absence of
+# documentation.
+
+WARN_NO_PARAMDOC       = NO
+
+# The WARN_FORMAT tag determines the format of the warning messages that
+# doxygen can produce. The string should contain the $file, $line, and $text
+# tags, which will be replaced by the file and line number from which the
+# warning originated and the warning text. Optionally the format may contain
+# $version, which will be replaced by the version of the file (if it could
+# be obtained via FILE_VERSION_FILTER)
+
+WARN_FORMAT            = "$file:$line: $text"
+
+# The WARN_LOGFILE tag can be used to specify a file to which warning
+# and error messages should be written. If left blank the output is written
+# to stderr.
+
+WARN_LOGFILE           =
+
+#---------------------------------------------------------------------------
+# configuration options related to the input files
+#---------------------------------------------------------------------------
+
+# The INPUT tag can be used to specify the files and/or directories that contain
+# documented source files. You may enter file names like "myfile.cpp" or
+# directories like "/usr/src/myproject". Separate the files or directories
+# with spaces.
+
+INPUT                  = include/osmocom/gsm include/osmocom/gsm/protocol src/gsm
+
+# This tag can be used to specify the character encoding of the source files
+# that doxygen parses. Internally doxygen uses the UTF-8 encoding, which is
+# also the default input encoding. Doxygen uses libiconv (or the iconv built
+# into libc) for the transcoding. See http://www.gnu.org/software/libiconv for
+# the list of possible encodings.
+
+INPUT_ENCODING         = UTF-8
+
+# If the value of the INPUT tag contains directories, you can use the
+# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
+# and *.h) to filter out the source-files in the directories. If left
+# blank the following patterns are tested:
+# *.c *.cc *.cxx *.cpp *.c++ *.d *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh
+# *.hxx *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.dox *.py
+# *.f90 *.f *.for *.vhd *.vhdl
+
+FILE_PATTERNS          =
+
+# The RECURSIVE tag can be used to turn specify whether or not subdirectories
+# should be searched for input files as well. Possible values are YES and NO.
+# If left blank NO is used.
+
+RECURSIVE              = YES
+
+# The EXCLUDE tag can be used to specify files and/or directories that should
+# excluded from the INPUT source files. This way you can easily exclude a
+# subdirectory from a directory tree whose root is specified with the INPUT tag.
+
+EXCLUDE                =
+
+# The EXCLUDE_SYMLINKS tag can be used select whether or not files or
+# directories that are symbolic links (a Unix file system feature) are excluded
+# from the input.
+
+EXCLUDE_SYMLINKS       = NO
+
+# If the value of the INPUT tag contains directories, you can use the
+# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude
+# certain files from those directories. Note that the wildcards are matched
+# against the file with absolute path, so to exclude all test directories
+# for example use the pattern */test/*
+
+EXCLUDE_PATTERNS       =
+
+# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names
+# (namespaces, classes, functions, etc.) that should be excluded from the
+# output. The symbol name can be a fully qualified name, a word, or if the
+# wildcard * is used, a substring. Examples: ANamespace, AClass,
+# AClass::ANamespace, ANamespace::*Test
+
+EXCLUDE_SYMBOLS        =
+
+# The EXAMPLE_PATH tag can be used to specify one or more files or
+# directories that contain example code fragments that are included (see
+# the \include command).
+
+EXAMPLE_PATH           =
+
+# If the value of the EXAMPLE_PATH tag contains directories, you can use the
+# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
+# and *.h) to filter out the source-files in the directories. If left
+# blank all files are included.
+
+EXAMPLE_PATTERNS       =
+
+# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be
+# searched for input files to be used with the \include or \dontinclude
+# commands irrespective of the value of the RECURSIVE tag.
+# Possible values are YES and NO. If left blank NO is used.
+
+EXAMPLE_RECURSIVE      = NO
+
+# The IMAGE_PATH tag can be used to specify one or more files or
+# directories that contain image that are included in the documentation (see
+# the \image command).
+
+IMAGE_PATH             = images/
+
+# The INPUT_FILTER tag can be used to specify a program that doxygen should
+# invoke to filter for each input file. Doxygen will invoke the filter program
+# by executing (via popen()) the command <filter> <input-file>, where <filter>
+# is the value of the INPUT_FILTER tag, and <input-file> is the name of an
+# input file. Doxygen will then use the output that the filter program writes
+# to standard output.
+# If FILTER_PATTERNS is specified, this tag will be
+# ignored.
+
+INPUT_FILTER           =
+
+# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern
+# basis.
+# Doxygen will compare the file name with each pattern and apply the
+# filter if there is a match.
+# The filters are a list of the form:
+# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further
+# info on how filters are used. If FILTER_PATTERNS is empty or if
+# non of the patterns match the file name, INPUT_FILTER is applied.
+
+FILTER_PATTERNS        =
+
+# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using
+# INPUT_FILTER) will be used to filter the input files when producing source
+# files to browse (i.e. when SOURCE_BROWSER is set to YES).
+
+FILTER_SOURCE_FILES    = NO
+
+# The FILTER_SOURCE_PATTERNS tag can be used to specify source filters per file
+# pattern. A pattern will override the setting for FILTER_PATTERN (if any)
+# and it is also possible to disable source filtering for a specific pattern
+# using *.ext= (so without naming a filter). This option only has effect when
+# FILTER_SOURCE_FILES is enabled.
+
+FILTER_SOURCE_PATTERNS =
+
+#---------------------------------------------------------------------------
+# configuration options related to source browsing
+#---------------------------------------------------------------------------
+
+# If the SOURCE_BROWSER tag is set to YES then a list of source files will
+# be generated. Documented entities will be cross-referenced with these sources.
+# Note: To get rid of all source code in the generated output, make sure also
+# VERBATIM_HEADERS is set to NO.
+
+SOURCE_BROWSER         = NO
+
+# Setting the INLINE_SOURCES tag to YES will include the body
+# of functions and classes directly in the documentation.
+
+INLINE_SOURCES         = NO
+
+# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct
+# doxygen to hide any special comment blocks from generated source code
+# fragments. Normal C and C++ comments will always remain visible.
+
+STRIP_CODE_COMMENTS    = YES
+
+# If the REFERENCED_BY_RELATION tag is set to YES
+# then for each documented function all documented
+# functions referencing it will be listed.
+
+REFERENCED_BY_RELATION = YES
+
+# If the REFERENCES_RELATION tag is set to YES
+# then for each documented function all documented entities
+# called/used by that function will be listed.
+
+REFERENCES_RELATION    = YES
+
+# If the REFERENCES_LINK_SOURCE tag is set to YES (the default)
+# and SOURCE_BROWSER tag is set to YES, then the hyperlinks from
+# functions in REFERENCES_RELATION and REFERENCED_BY_RELATION lists will
+# link to the source code.
+# Otherwise they will link to the documentation.
+
+REFERENCES_LINK_SOURCE = YES
+
+# If the USE_HTAGS tag is set to YES then the references to source code
+# will point to the HTML generated by the htags(1) tool instead of doxygen
+# built-in source browser. The htags tool is part of GNU's global source
+# tagging system (see http://www.gnu.org/software/global/global.html). You
+# will need version 4.8.6 or higher.
+
+USE_HTAGS              = NO
+
+# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen
+# will generate a verbatim copy of the header file for each class for
+# which an include is specified. Set to NO to disable this.
+
+VERBATIM_HEADERS       = YES
+
+#---------------------------------------------------------------------------
+# configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+
+# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index
+# of all compounds will be generated. Enable this if the project
+# contains a lot of classes, structs, unions or interfaces.
+
+ALPHABETICAL_INDEX     = NO
+
+# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then
+# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns
+# in which this list will be split (can be a number in the range [1..20])
+
+COLS_IN_ALPHA_INDEX    = 5
+
+# In case all classes in a project start with a common prefix, all
+# classes will be put under the same header in the alphabetical index.
+# The IGNORE_PREFIX tag can be used to specify one or more prefixes that
+# should be ignored while generating the index headers.
+
+IGNORE_PREFIX          =
+
+#---------------------------------------------------------------------------
+# configuration options related to the HTML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_HTML tag is set to YES (the default) Doxygen will
+# generate HTML output.
+
+GENERATE_HTML          = YES
+
+# The HTML_OUTPUT tag is used to specify where the HTML docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `html' will be used as the default path.
+
+HTML_OUTPUT            = html
+
+# The HTML_FILE_EXTENSION tag can be used to specify the file extension for
+# each generated HTML page (for example: .htm,.php,.asp). If it is left blank
+# doxygen will generate files with .html extension.
+
+HTML_FILE_EXTENSION    = .html
+
+# The HTML_HEADER tag can be used to specify a personal HTML header for
+# each generated HTML page. If it is left blank doxygen will generate a
+# standard header. Note that when using a custom header you are responsible
+# for the proper inclusion of any scripts and style sheets that doxygen
+# needs, which is dependent on the configuration options used.
+# It is adviced to generate a default header using "doxygen -w html
+# header.html footer.html stylesheet.css YourConfigFile" and then modify
+# that header. Note that the header is subject to change so you typically
+# have to redo this when upgrading to a newer version of doxygen or when changing the value of configuration settings such as GENERATE_TREEVIEW!
+
+HTML_HEADER            =
+
+# The HTML_FOOTER tag can be used to specify a personal HTML footer for
+# each generated HTML page. If it is left blank doxygen will generate a
+# standard footer.
+
+HTML_FOOTER            =
+
+# The HTML_STYLESHEET tag can be used to specify a user-defined cascading
+# style sheet that is used by each HTML page. It can be used to
+# fine-tune the look of the HTML output. If the tag is left blank doxygen
+# will generate a default style sheet. Note that doxygen will try to copy
+# the style sheet file to the HTML output directory, so don't put your own
+# stylesheet in the HTML output directory as well, or it will be erased!
+
+HTML_STYLESHEET        =
+
+# The HTML_EXTRA_FILES tag can be used to specify one or more extra images or
+# other source files which should be copied to the HTML output directory. Note
+# that these files will be copied to the base HTML output directory. Use the
+# $relpath$ marker in the HTML_HEADER and/or HTML_FOOTER files to load these
+# files. In the HTML_STYLESHEET file, use the file name only. Also note that
+# the files will be copied as-is; there are no commands or markers available.
+
+HTML_EXTRA_FILES       =
+
+# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output.
+# Doxygen will adjust the colors in the stylesheet and background images
+# according to this color. Hue is specified as an angle on a colorwheel,
+# see http://en.wikipedia.org/wiki/Hue for more information.
+# For instance the value 0 represents red, 60 is yellow, 120 is green,
+# 180 is cyan, 240 is blue, 300 purple, and 360 is red again.
+# The allowed range is 0 to 359.
+
+HTML_COLORSTYLE_HUE    = 220
+
+# The HTML_COLORSTYLE_SAT tag controls the purity (or saturation) of
+# the colors in the HTML output. For a value of 0 the output will use
+# grayscales only. A value of 255 will produce the most vivid colors.
+
+HTML_COLORSTYLE_SAT    = 100
+
+# The HTML_COLORSTYLE_GAMMA tag controls the gamma correction applied to
+# the luminance component of the colors in the HTML output. Values below
+# 100 gradually make the output lighter, whereas values above 100 make
+# the output darker. The value divided by 100 is the actual gamma applied,
+# so 80 represents a gamma of 0.8, The value 220 represents a gamma of 2.2,
+# and 100 does not change the gamma.
+
+HTML_COLORSTYLE_GAMMA  = 80
+
+# If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML
+# page will contain the date and time when the page was generated. Setting
+# this to NO can help when comparing the output of multiple runs.
+
+HTML_TIMESTAMP         = YES
+
+# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes,
+# files or namespaces will be aligned in HTML using tables. If set to
+# NO a bullet list will be used.
+
+HTML_ALIGN_MEMBERS     = YES
+
+# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML
+# documentation will contain sections that can be hidden and shown after the
+# page has loaded. For this to work a browser that supports
+# JavaScript and DHTML is required (for instance Mozilla 1.0+, Firefox
+# Netscape 6.0+, Internet explorer 5.0+, Konqueror, or Safari).
+
+HTML_DYNAMIC_SECTIONS  = NO
+
+# If the GENERATE_DOCSET tag is set to YES, additional index files
+# will be generated that can be used as input for Apple's Xcode 3
+# integrated development environment, introduced with OSX 10.5 (Leopard).
+# To create a documentation set, doxygen will generate a Makefile in the
+# HTML output directory. Running make will produce the docset in that
+# directory and running "make install" will install the docset in
+# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find
+# it at startup.
+# See http://developer.apple.com/tools/creatingdocsetswithdoxygen.html
+# for more information.
+
+GENERATE_DOCSET        = NO
+
+# When GENERATE_DOCSET tag is set to YES, this tag determines the name of the
+# feed. A documentation feed provides an umbrella under which multiple
+# documentation sets from a single provider (such as a company or product suite)
+# can be grouped.
+
+DOCSET_FEEDNAME        = "Doxygen generated docs"
+
+# When GENERATE_DOCSET tag is set to YES, this tag specifies a string that
+# should uniquely identify the documentation set bundle. This should be a
+# reverse domain-name style string, e.g. com.mycompany.MyDocSet. Doxygen
+# will append .docset to the name.
+
+DOCSET_BUNDLE_ID       = org.doxygen.Project
+
+# When GENERATE_PUBLISHER_ID tag specifies a string that should uniquely identify
+# the documentation publisher. This should be a reverse domain-name style
+# string, e.g. com.mycompany.MyDocSet.documentation.
+
+DOCSET_PUBLISHER_ID    = org.doxygen.Publisher
+
+# The GENERATE_PUBLISHER_NAME tag identifies the documentation publisher.
+
+DOCSET_PUBLISHER_NAME  = Publisher
+
+# If the GENERATE_HTMLHELP tag is set to YES, additional index files
+# will be generated that can be used as input for tools like the
+# Microsoft HTML help workshop to generate a compiled HTML help file (.chm)
+# of the generated HTML documentation.
+
+GENERATE_HTMLHELP      = NO
+
+# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can
+# be used to specify the file name of the resulting .chm file. You
+# can add a path in front of the file if the result should not be
+# written to the html output directory.
+
+CHM_FILE               =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can
+# be used to specify the location (absolute path including file name) of
+# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run
+# the HTML help compiler on the generated index.hhp.
+
+HHC_LOCATION           =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag
+# controls if a separate .chi index file is generated (YES) or that
+# it should be included in the master .chm file (NO).
+
+GENERATE_CHI           = NO
+
+# If the GENERATE_HTMLHELP tag is set to YES, the CHM_INDEX_ENCODING
+# is used to encode HtmlHelp index (hhk), content (hhc) and project file
+# content.
+
+CHM_INDEX_ENCODING     =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag
+# controls whether a binary table of contents is generated (YES) or a
+# normal table of contents (NO) in the .chm file.
+
+BINARY_TOC             = NO
+
+# The TOC_EXPAND flag can be set to YES to add extra items for group members
+# to the contents of the HTML help documentation and to the tree view.
+
+TOC_EXPAND             = NO
+
+# If the GENERATE_QHP tag is set to YES and both QHP_NAMESPACE and
+# QHP_VIRTUAL_FOLDER are set, an additional index file will be generated
+# that can be used as input for Qt's qhelpgenerator to generate a
+# Qt Compressed Help (.qch) of the generated HTML documentation.
+
+GENERATE_QHP           = NO
+
+# If the QHG_LOCATION tag is specified, the QCH_FILE tag can
+# be used to specify the file name of the resulting .qch file.
+# The path specified is relative to the HTML output folder.
+
+QCH_FILE               =
+
+# The QHP_NAMESPACE tag specifies the namespace to use when generating
+# Qt Help Project output. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#namespace
+
+QHP_NAMESPACE          = org.doxygen.Project
+
+# The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating
+# Qt Help Project output. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#virtual-folders
+
+QHP_VIRTUAL_FOLDER     = doc
+
+# If QHP_CUST_FILTER_NAME is set, it specifies the name of a custom filter to
+# add. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#custom-filters
+
+QHP_CUST_FILTER_NAME   =
+
+# The QHP_CUST_FILT_ATTRS tag specifies the list of the attributes of the
+# custom filter to add. For more information please see
+# <a href="http://doc.trolltech.com/qthelpproject.html#custom-filters">
+# Qt Help Project / Custom Filters</a>.
+
+QHP_CUST_FILTER_ATTRS  =
+
+# The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this
+# project's
+# filter section matches.
+# <a href="http://doc.trolltech.com/qthelpproject.html#filter-attributes">
+# Qt Help Project / Filter Attributes</a>.
+
+QHP_SECT_FILTER_ATTRS  =
+
+# If the GENERATE_QHP tag is set to YES, the QHG_LOCATION tag can
+# be used to specify the location of Qt's qhelpgenerator.
+# If non-empty doxygen will try to run qhelpgenerator on the generated
+# .qhp file.
+
+QHG_LOCATION           =
+
+# If the GENERATE_ECLIPSEHELP tag is set to YES, additional index files
+#  will be generated, which together with the HTML files, form an Eclipse help
+# plugin. To install this plugin and make it available under the help contents
+# menu in Eclipse, the contents of the directory containing the HTML and XML
+# files needs to be copied into the plugins directory of eclipse. The name of
+# the directory within the plugins directory should be the same as
+# the ECLIPSE_DOC_ID value. After copying Eclipse needs to be restarted before
+# the help appears.
+
+GENERATE_ECLIPSEHELP   = NO
+
+# A unique identifier for the eclipse help plugin. When installing the plugin
+# the directory name containing the HTML and XML files should also have
+# this name.
+
+ECLIPSE_DOC_ID         = org.doxygen.Project
+
+# The DISABLE_INDEX tag can be used to turn on/off the condensed index at
+# top of each HTML page. The value NO (the default) enables the index and
+# the value YES disables it.
+
+DISABLE_INDEX          = NO
+
+# The ENUM_VALUES_PER_LINE tag can be used to set the number of enum values
+# (range [0,1..20]) that doxygen will group on one line in the generated HTML
+# documentation. Note that a value of 0 will completely suppress the enum
+# values from appearing in the overview section.
+
+ENUM_VALUES_PER_LINE   = 4
+
+# The GENERATE_TREEVIEW tag is used to specify whether a tree-like index
+# structure should be generated to display hierarchical information.
+# If the tag value is set to YES, a side panel will be generated
+# containing a tree-like index structure (just like the one that
+# is generated for HTML Help). For this to work a browser that supports
+# JavaScript, DHTML, CSS and frames is required (i.e. any modern browser).
+# Windows users are probably better off using the HTML help feature.
+
+GENERATE_TREEVIEW      = YES
+
+# By enabling USE_INLINE_TREES, doxygen will generate the Groups, Directories,
+# and Class Hierarchy pages using a tree view instead of an ordered list.
+
+USE_INLINE_TREES       = NO
+
+# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be
+# used to set the initial width (in pixels) of the frame in which the tree
+# is shown.
+
+TREEVIEW_WIDTH         = 250
+
+# When the EXT_LINKS_IN_WINDOW option is set to YES doxygen will open
+# links to external symbols imported via tag files in a separate window.
+
+EXT_LINKS_IN_WINDOW    = NO
+
+# Use this tag to change the font size of Latex formulas included
+# as images in the HTML documentation. The default is 10. Note that
+# when you change the font size after a successful doxygen run you need
+# to manually remove any form_*.png images from the HTML output directory
+# to force them to be regenerated.
+
+FORMULA_FONTSIZE       = 10
+
+# Use the FORMULA_TRANPARENT tag to determine whether or not the images
+# generated for formulas are transparent PNGs. Transparent PNGs are
+# not supported properly for IE 6.0, but are supported on all modern browsers.
+# Note that when changing this option you need to delete any form_*.png files
+# in the HTML output before the changes have effect.
+
+FORMULA_TRANSPARENT    = YES
+
+# Enable the USE_MATHJAX option to render LaTeX formulas using MathJax
+# (see http://www.mathjax.org) which uses client side Javascript for the
+# rendering instead of using prerendered bitmaps. Use this if you do not
+# have LaTeX installed or if you want to formulas look prettier in the HTML
+# output. When enabled you also need to install MathJax separately and
+# configure the path to it using the MATHJAX_RELPATH option.
+
+USE_MATHJAX            = NO
+
+# When MathJax is enabled you need to specify the location relative to the
+# HTML output directory using the MATHJAX_RELPATH option. The destination
+# directory should contain the MathJax.js script. For instance, if the mathjax
+# directory is located at the same level as the HTML output directory, then
+# MATHJAX_RELPATH should be ../mathjax. The default value points to the
+# mathjax.org site, so you can quickly see the result without installing
+# MathJax, but it is strongly recommended to install a local copy of MathJax
+# before deployment.
+
+MATHJAX_RELPATH        = http://www.mathjax.org/mathjax
+
+# When the SEARCHENGINE tag is enabled doxygen will generate a search box
+# for the HTML output. The underlying search engine uses javascript
+# and DHTML and should work on any modern browser. Note that when using
+# HTML help (GENERATE_HTMLHELP), Qt help (GENERATE_QHP), or docsets
+# (GENERATE_DOCSET) there is already a search function so this one should
+# typically be disabled. For large projects the javascript based search engine
+# can be slow, then enabling SERVER_BASED_SEARCH may provide a better solution.
+
+SEARCHENGINE           = NO
+
+# When the SERVER_BASED_SEARCH tag is enabled the search engine will be
+# implemented using a PHP enabled web server instead of at the web client
+# using Javascript. Doxygen will generate the search PHP script and index
+# file to put on the web server. The advantage of the server
+# based approach is that it scales better to large projects and allows
+# full text search. The disadvantages are that it is more difficult to setup
+# and does not have live searching capabilities.
+
+SERVER_BASED_SEARCH    = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the LaTeX output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will
+# generate Latex output.
+
+GENERATE_LATEX         = YES
+
+# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `latex' will be used as the default path.
+
+LATEX_OUTPUT           = latex
+
+# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be
+# invoked. If left blank `latex' will be used as the default command name.
+# Note that when enabling USE_PDFLATEX this option is only used for
+# generating bitmaps for formulas in the HTML output, but not in the
+# Makefile that is written to the output directory.
+
+LATEX_CMD_NAME         = latex
+
+# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to
+# generate index for LaTeX. If left blank `makeindex' will be used as the
+# default command name.
+
+MAKEINDEX_CMD_NAME     = makeindex
+
+# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact
+# LaTeX documents. This may be useful for small projects and may help to
+# save some trees in general.
+
+COMPACT_LATEX          = NO
+
+# The PAPER_TYPE tag can be used to set the paper type that is used
+# by the printer. Possible values are: a4, letter, legal and
+# executive. If left blank a4wide will be used.
+
+PAPER_TYPE             = a4wide
+
+# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX
+# packages that should be included in the LaTeX output.
+
+EXTRA_PACKAGES         =
+
+# The LATEX_HEADER tag can be used to specify a personal LaTeX header for
+# the generated latex document. The header should contain everything until
+# the first chapter. If it is left blank doxygen will generate a
+# standard header. Notice: only use this tag if you know what you are doing!
+
+LATEX_HEADER           =
+
+# The LATEX_FOOTER tag can be used to specify a personal LaTeX footer for
+# the generated latex document. The footer should contain everything after
+# the last chapter. If it is left blank doxygen will generate a
+# standard footer. Notice: only use this tag if you know what you are doing!
+
+LATEX_FOOTER           =
+
+# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated
+# is prepared for conversion to pdf (using ps2pdf). The pdf file will
+# contain links (just like the HTML output) instead of page references
+# This makes the output suitable for online browsing using a pdf viewer.
+
+PDF_HYPERLINKS         = NO
+
+# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of
+# plain latex in the generated Makefile. Set this option to YES to get a
+# higher quality PDF documentation.
+
+USE_PDFLATEX           = NO
+
+# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode.
+# command to the generated LaTeX files. This will instruct LaTeX to keep
+# running if errors occur, instead of asking the user for help.
+# This option is also used when generating formulas in HTML.
+
+LATEX_BATCHMODE        = NO
+
+# If LATEX_HIDE_INDICES is set to YES then doxygen will not
+# include the index chapters (such as File Index, Compound Index, etc.)
+# in the output.
+
+LATEX_HIDE_INDICES     = NO
+
+# If LATEX_SOURCE_CODE is set to YES then doxygen will include
+# source code with syntax highlighting in the LaTeX output.
+# Note that which sources are shown also depends on other settings
+# such as SOURCE_BROWSER.
+
+LATEX_SOURCE_CODE      = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the RTF output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output
+# The RTF output is optimized for Word 97 and may not look very pretty with
+# other RTF readers or editors.
+
+GENERATE_RTF           = NO
+
+# The RTF_OUTPUT tag is used to specify where the RTF docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `rtf' will be used as the default path.
+
+RTF_OUTPUT             = rtf
+
+# If the COMPACT_RTF tag is set to YES Doxygen generates more compact
+# RTF documents. This may be useful for small projects and may help to
+# save some trees in general.
+
+COMPACT_RTF            = NO
+
+# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated
+# will contain hyperlink fields. The RTF file will
+# contain links (just like the HTML output) instead of page references.
+# This makes the output suitable for online browsing using WORD or other
+# programs which support those fields.
+# Note: wordpad (write) and others do not support links.
+
+RTF_HYPERLINKS         = NO
+
+# Load stylesheet definitions from file. Syntax is similar to doxygen's
+# config file, i.e. a series of assignments. You only have to provide
+# replacements, missing definitions are set to their default value.
+
+RTF_STYLESHEET_FILE    =
+
+# Set optional variables used in the generation of an rtf document.
+# Syntax is similar to doxygen's config file.
+
+RTF_EXTENSIONS_FILE    =
+
+#---------------------------------------------------------------------------
+# configuration options related to the man page output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_MAN tag is set to YES (the default) Doxygen will
+# generate man pages
+
+GENERATE_MAN           = NO
+
+# The MAN_OUTPUT tag is used to specify where the man pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `man' will be used as the default path.
+
+MAN_OUTPUT             = man
+
+# The MAN_EXTENSION tag determines the extension that is added to
+# the generated man pages (default is the subroutine's section .3)
+
+MAN_EXTENSION          = .3
+
+# If the MAN_LINKS tag is set to YES and Doxygen generates man output,
+# then it will generate one additional man file for each entity
+# documented in the real man page(s). These additional files
+# only source the real man page, but without them the man command
+# would be unable to find the correct page. The default is NO.
+
+MAN_LINKS              = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the XML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_XML tag is set to YES Doxygen will
+# generate an XML file that captures the structure of
+# the code including all documentation.
+
+GENERATE_XML           = NO
+
+# The XML_OUTPUT tag is used to specify where the XML pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `xml' will be used as the default path.
+
+XML_OUTPUT             = xml
+
+# The XML_SCHEMA tag can be used to specify an XML schema,
+# which can be used by a validating XML parser to check the
+# syntax of the XML files.
+
+XML_SCHEMA             =
+
+# The XML_DTD tag can be used to specify an XML DTD,
+# which can be used by a validating XML parser to check the
+# syntax of the XML files.
+
+XML_DTD                =
+
+# If the XML_PROGRAMLISTING tag is set to YES Doxygen will
+# dump the program listings (including syntax highlighting
+# and cross-referencing information) to the XML output. Note that
+# enabling this will significantly increase the size of the XML output.
+
+XML_PROGRAMLISTING     = YES
+
+#---------------------------------------------------------------------------
+# configuration options for the AutoGen Definitions output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will
+# generate an AutoGen Definitions (see autogen.sf.net) file
+# that captures the structure of the code including all
+# documentation. Note that this feature is still experimental
+# and incomplete at the moment.
+
+GENERATE_AUTOGEN_DEF   = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the Perl module output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_PERLMOD tag is set to YES Doxygen will
+# generate a Perl module file that captures the structure of
+# the code including all documentation. Note that this
+# feature is still experimental and incomplete at the
+# moment.
+
+GENERATE_PERLMOD       = NO
+
+# If the PERLMOD_LATEX tag is set to YES Doxygen will generate
+# the necessary Makefile rules, Perl scripts and LaTeX code to be able
+# to generate PDF and DVI output from the Perl module output.
+
+PERLMOD_LATEX          = NO
+
+# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be
+# nicely formatted so it can be parsed by a human reader.
+# This is useful
+# if you want to understand what is going on.
+# On the other hand, if this
+# tag is set to NO the size of the Perl module output will be much smaller
+# and Perl will parse it just the same.
+
+PERLMOD_PRETTY         = YES
+
+# The names of the make variables in the generated doxyrules.make file
+# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX.
+# This is useful so different doxyrules.make files included by the same
+# Makefile don't overwrite each other's variables.
+
+PERLMOD_MAKEVAR_PREFIX =
+
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor
+#---------------------------------------------------------------------------
+
+# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will
+# evaluate all C-preprocessor directives found in the sources and include
+# files.
+
+ENABLE_PREPROCESSING   = NO
+
+# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro
+# names in the source code. If set to NO (the default) only conditional
+# compilation will be performed. Macro expansion can be done in a controlled
+# way by setting EXPAND_ONLY_PREDEF to YES.
+
+MACRO_EXPANSION        = NO
+
+# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES
+# then the macro expansion is limited to the macros specified with the
+# PREDEFINED and EXPAND_AS_DEFINED tags.
+
+EXPAND_ONLY_PREDEF     = NO
+
+# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files
+# pointed to by INCLUDE_PATH will be searched when a #include is found.
+
+SEARCH_INCLUDES        = YES
+
+# The INCLUDE_PATH tag can be used to specify one or more directories that
+# contain include files that are not input files but should be processed by
+# the preprocessor.
+
+INCLUDE_PATH           =
+
+# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard
+# patterns (like *.h and *.hpp) to filter out the header-files in the
+# directories. If left blank, the patterns specified with FILE_PATTERNS will
+# be used.
+
+INCLUDE_FILE_PATTERNS  =
+
+# The PREDEFINED tag can be used to specify one or more macro names that
+# are defined before the preprocessor is started (similar to the -D option of
+# gcc). The argument of the tag is a list of macros of the form: name
+# or name=definition (no spaces). If the definition and the = are
+# omitted =1 is assumed. To prevent a macro definition from being
+# undefined via #undef or recursively expanded use the := operator
+# instead of the = operator.
+
+PREDEFINED             =
+
+# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then
+# this tag can be used to specify a list of macro names that should be expanded.
+# The macro definition that is found in the sources will be used.
+# Use the PREDEFINED tag if you want to use a different macro definition that
+# overrules the definition found in the source code.
+
+EXPAND_AS_DEFINED      =
+
+# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then
+# doxygen's preprocessor will remove all references to function-like macros
+# that are alone on a line, have an all uppercase name, and do not end with a
+# semicolon, because these will confuse the parser if not removed.
+
+SKIP_FUNCTION_MACROS   = YES
+
+#---------------------------------------------------------------------------
+# Configuration::additions related to external references
+#---------------------------------------------------------------------------
+
+# The TAGFILES option can be used to specify one or more tagfiles.
+# Optionally an initial location of the external documentation
+# can be added for each tagfile. The format of a tag file without
+# this location is as follows:
+#
+# TAGFILES = file1 file2 ...
+# Adding location for the tag files is done as follows:
+#
+# TAGFILES = file1=loc1 "file2 = loc2" ...
+# where "loc1" and "loc2" can be relative or absolute paths or
+# URLs. If a location is present for each tag, the installdox tool
+# does not have to be run to correct the links.
+# Note that each tag file must have a unique name
+# (where the name does NOT include the path)
+# If a tag file is not located in the directory in which doxygen
+# is run, you must also specify the path to the tagfile here.
+
+TAGFILES               =
+
+# When a file name is specified after GENERATE_TAGFILE, doxygen will create
+# a tag file that is based on the input files it reads.
+
+GENERATE_TAGFILE       =
+
+# If the ALLEXTERNALS tag is set to YES all external classes will be listed
+# in the class index. If set to NO only the inherited external classes
+# will be listed.
+
+ALLEXTERNALS           = NO
+
+# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed
+# in the modules index. If set to NO, only the current project's groups will
+# be listed.
+
+EXTERNAL_GROUPS        = YES
+
+# The PERL_PATH should be the absolute path and name of the perl script
+# interpreter (i.e. the result of `which perl').
+
+PERL_PATH              = /usr/bin/perl
+
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool
+#---------------------------------------------------------------------------
+
+# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will
+# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base
+# or super classes. Setting the tag to NO turns the diagrams off. Note that
+# this option also works with HAVE_DOT disabled, but it is recommended to
+# install and use dot, since it yields more powerful graphs.
+
+CLASS_DIAGRAMS         = YES
+
+# You can define message sequence charts within doxygen comments using the \msc
+# command. Doxygen will then run the mscgen tool (see
+# http://www.mcternan.me.uk/mscgen/) to produce the chart and insert it in the
+# documentation. The MSCGEN_PATH tag allows you to specify the directory where
+# the mscgen tool resides. If left empty the tool is assumed to be found in the
+# default search path.
+
+MSCGEN_PATH            =
+
+# If set to YES, the inheritance and collaboration graphs will hide
+# inheritance and usage relations if the target is undocumented
+# or is not a class.
+
+HIDE_UNDOC_RELATIONS   = YES
+
+# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is
+# available from the path. This tool is part of Graphviz, a graph visualization
+# toolkit from AT&T and Lucent Bell Labs. The other options in this section
+# have no effect if this option is set to NO (the default)
+
+HAVE_DOT               = NO
+
+# The DOT_NUM_THREADS specifies the number of dot invocations doxygen is
+# allowed to run in parallel. When set to 0 (the default) doxygen will
+# base this on the number of processors available in the system. You can set it
+# explicitly to a value larger than 0 to get control over the balance
+# between CPU load and processing speed.
+
+DOT_NUM_THREADS        = 0
+
+# By default doxygen will write a font called Helvetica to the output
+# directory and reference it in all dot files that doxygen generates.
+# When you want a differently looking font you can specify the font name
+# using DOT_FONTNAME. You need to make sure dot is able to find the font,
+# which can be done by putting it in a standard location or by setting the
+# DOTFONTPATH environment variable or by setting DOT_FONTPATH to the directory
+# containing the font.
+
+DOT_FONTNAME           = Helvetica
+
+# The DOT_FONTSIZE tag can be used to set the size of the font of dot graphs.
+# The default size is 10pt.
+
+DOT_FONTSIZE           = 10
+
+# By default doxygen will tell dot to use the output directory to look for the
+# FreeSans.ttf font (which doxygen will put there itself). If you specify a
+# different font using DOT_FONTNAME you can set the path where dot
+# can find it using this tag.
+
+DOT_FONTPATH           =
+
+# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for each documented class showing the direct and
+# indirect inheritance relations. Setting this tag to YES will force the
+# the CLASS_DIAGRAMS tag to NO.
+
+CLASS_GRAPH            = YES
+
+# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for each documented class showing the direct and
+# indirect implementation dependencies (inheritance, containment, and
+# class references variables) of the class with other documented classes.
+
+COLLABORATION_GRAPH    = YES
+
+# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for groups, showing the direct groups dependencies
+
+GROUP_GRAPHS           = YES
+
+# If the UML_LOOK tag is set to YES doxygen will generate inheritance and
+# collaboration diagrams in a style similar to the OMG's Unified Modeling
+# Language.
+
+UML_LOOK               = NO
+
+# If set to YES, the inheritance and collaboration graphs will show the
+# relations between templates and their instances.
+
+TEMPLATE_RELATIONS     = NO
+
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT
+# tags are set to YES then doxygen will generate a graph for each documented
+# file showing the direct and indirect include dependencies of the file with
+# other documented files.
+
+INCLUDE_GRAPH          = YES
+
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and
+# HAVE_DOT tags are set to YES then doxygen will generate a graph for each
+# documented header file showing the documented files that directly or
+# indirectly include this file.
+
+INCLUDED_BY_GRAPH      = YES
+
+# If the CALL_GRAPH and HAVE_DOT options are set to YES then
+# doxygen will generate a call dependency graph for every global function
+# or class method. Note that enabling this option will significantly increase
+# the time of a run. So in most cases it will be better to enable call graphs
+# for selected functions only using the \callgraph command.
+
+CALL_GRAPH             = NO
+
+# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then
+# doxygen will generate a caller dependency graph for every global function
+# or class method. Note that enabling this option will significantly increase
+# the time of a run. So in most cases it will be better to enable caller
+# graphs for selected functions only using the \callergraph command.
+
+CALLER_GRAPH           = NO
+
+# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen
+# will generate a graphical hierarchy of all classes instead of a textual one.
+
+GRAPHICAL_HIERARCHY    = YES
+
+# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES
+# then doxygen will show the dependencies a directory has on other directories
+# in a graphical way. The dependency relations are determined by the #include
+# relations between the files in the directories.
+
+DIRECTORY_GRAPH        = YES
+
+# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images
+# generated by dot. Possible values are svg, png, jpg, or gif.
+# If left blank png will be used.
+
+DOT_IMAGE_FORMAT       = png
+
+# The tag DOT_PATH can be used to specify the path where the dot tool can be
+# found. If left blank, it is assumed the dot tool can be found in the path.
+
+DOT_PATH               = /usr/bin/dot
+
+# The DOTFILE_DIRS tag can be used to specify one or more directories that
+# contain dot files that are included in the documentation (see the
+# \dotfile command).
+
+DOTFILE_DIRS           =
+
+# The MSCFILE_DIRS tag can be used to specify one or more directories that
+# contain msc files that are included in the documentation (see the
+# \mscfile command).
+
+MSCFILE_DIRS           =
+
+# The DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of
+# nodes that will be shown in the graph. If the number of nodes in a graph
+# becomes larger than this value, doxygen will truncate the graph, which is
+# visualized by representing a node as a red box. Note that doxygen if the
+# number of direct children of the root node in a graph is already larger than
+# DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note
+# that the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH.
+
+DOT_GRAPH_MAX_NODES    = 50
+
+# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the
+# graphs generated by dot. A depth value of 3 means that only nodes reachable
+# from the root by following a path via at most 3 edges will be shown. Nodes
+# that lay further from the root node will be omitted. Note that setting this
+# option to 1 or 2 may greatly reduce the computation time needed for large
+# code bases. Also note that the size of a graph can be further restricted by
+# DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction.
+
+MAX_DOT_GRAPH_DEPTH    = 0
+
+# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent
+# background. This is disabled by default, because dot on Windows does not
+# seem to support this out of the box. Warning: Depending on the platform used,
+# enabling this option may lead to badly anti-aliased labels on the edges of
+# a graph (i.e. they become hard to read).
+
+DOT_TRANSPARENT        = NO
+
+# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output
+# files in one run (i.e. multiple -o and -T options on the command line). This
+# makes dot run faster, but since only newer versions of dot (>1.8.10)
+# support this, this feature is disabled by default.
+
+DOT_MULTI_TARGETS      = NO
+
+# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will
+# generate a legend page explaining the meaning of the various boxes and
+# arrows in the dot generated graphs.
+
+GENERATE_LEGEND        = YES
+
+# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will
+# remove the intermediate dot files that are used to generate
+# the various graphs.
+
+DOT_CLEANUP            = YES
diff --git a/src/shared/libosmocore/Doxyfile.vty.in b/src/shared/libosmocore/Doxyfile.vty.in
new file mode 100644
index 00000000..57f19ad8
--- /dev/null
+++ b/src/shared/libosmocore/Doxyfile.vty.in
@@ -0,0 +1,1716 @@
+# Doxyfile 1.7.4
+
+# This file describes the settings to be used by the documentation system
+# doxygen (www.doxygen.org) for a project.
+#
+# All text after a hash (#) is considered a comment and will be ignored.
+# The format is:
+#       TAG = value [value, ...]
+# For lists items can also be appended using:
+#       TAG += value [value, ...]
+# Values that contain spaces should be placed between quotes (" ").
+
+#---------------------------------------------------------------------------
+# Project related configuration options
+#---------------------------------------------------------------------------
+
+# This tag specifies the encoding used for all characters in the config file
+# that follow. The default is UTF-8 which is also the encoding used for all
+# text before the first occurrence of this tag. Doxygen uses libiconv (or the
+# iconv built into libc) for the transcoding. See
+# http://www.gnu.org/software/libiconv for the list of possible encodings.
+
+DOXYFILE_ENCODING      = UTF-8
+
+# The PROJECT_NAME tag is a single word (or a sequence of words surrounded
+# by quotes) that should identify the project.
+
+PROJECT_NAME           = libosmovty
+
+# The PROJECT_NUMBER tag can be used to enter a project or revision number.
+# This could be handy for archiving the generated documentation or
+# if some version control system is used.
+
+PROJECT_NUMBER         = @VERSION@
+
+# Using the PROJECT_BRIEF tag one can provide an optional one line description
+# for a project that appears at the top of each page and should give viewer
+# a quick idea about the purpose of the project. Keep the description short.
+
+PROJECT_BRIEF          = "Osmocom VTY library"
+
+# With the PROJECT_LOGO tag one can specify an logo or icon that is
+# included in the documentation. The maximum height of the logo should not
+# exceed 55 pixels and the maximum width should not exceed 200 pixels.
+# Doxygen will copy the logo to the output directory.
+
+PROJECT_LOGO           =
+
+# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute)
+# base path where the generated documentation will be put.
+# If a relative path is entered, it will be relative to the location
+# where doxygen was started. If left blank the current directory will be used.
+
+OUTPUT_DIRECTORY       = doc/vty
+
+# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create
+# 4096 sub-directories (in 2 levels) under the output directory of each output
+# format and will distribute the generated files over these directories.
+# Enabling this option can be useful when feeding doxygen a huge amount of
+# source files, where putting all generated files in the same directory would
+# otherwise cause performance problems for the file system.
+
+CREATE_SUBDIRS         = NO
+
+# The OUTPUT_LANGUAGE tag is used to specify the language in which all
+# documentation generated by doxygen is written. Doxygen will use this
+# information to generate all constant output in the proper language.
+# The default language is English, other supported languages are:
+# Afrikaans, Arabic, Brazilian, Catalan, Chinese, Chinese-Traditional,
+# Croatian, Czech, Danish, Dutch, Esperanto, Farsi, Finnish, French, German,
+# Greek, Hungarian, Italian, Japanese, Japanese-en (Japanese with English
+# messages), Korean, Korean-en, Lithuanian, Norwegian, Macedonian, Persian,
+# Polish, Portuguese, Romanian, Russian, Serbian, Serbian-Cyrillic, Slovak,
+# Slovene, Spanish, Swedish, Ukrainian, and Vietnamese.
+
+OUTPUT_LANGUAGE        = English
+
+# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will
+# include brief member descriptions after the members that are listed in
+# the file and class documentation (similar to JavaDoc).
+# Set to NO to disable this.
+
+BRIEF_MEMBER_DESC      = YES
+
+# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend
+# the brief description of a member or function before the detailed description.
+# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the
+# brief descriptions will be completely suppressed.
+
+REPEAT_BRIEF           = YES
+
+# This tag implements a quasi-intelligent brief description abbreviator
+# that is used to form the text in various listings. Each string
+# in this list, if found as the leading text of the brief description, will be
+# stripped from the text and the result after processing the whole list, is
+# used as the annotated text. Otherwise, the brief description is used as-is.
+# If left blank, the following values are used ("$name" is automatically
+# replaced with the name of the entity): "The $name class" "The $name widget"
+# "The $name file" "is" "provides" "specifies" "contains"
+# "represents" "a" "an" "the"
+
+ABBREVIATE_BRIEF       =
+
+# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then
+# Doxygen will generate a detailed section even if there is only a brief
+# description.
+
+ALWAYS_DETAILED_SEC    = NO
+
+# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all
+# inherited members of a class in the documentation of that class as if those
+# members were ordinary class members. Constructors, destructors and assignment
+# operators of the base classes will not be shown.
+
+INLINE_INHERITED_MEMB  = NO
+
+# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full
+# path before files name in the file list and in the header files. If set
+# to NO the shortest path that makes the file name unique will be used.
+
+FULL_PATH_NAMES        = YES
+
+# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag
+# can be used to strip a user-defined part of the path. Stripping is
+# only done if one of the specified strings matches the left-hand part of
+# the path. The tag can be used to show relative paths in the file list.
+# If left blank the directory from which doxygen is run is used as the
+# path to strip.
+
+STRIP_FROM_PATH        =
+
+# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of
+# the path mentioned in the documentation of a class, which tells
+# the reader which header file to include in order to use a class.
+# If left blank only the name of the header file containing the class
+# definition is used. Otherwise one should specify the include paths that
+# are normally passed to the compiler using the -I flag.
+
+STRIP_FROM_INC_PATH    =
+
+# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter
+# (but less readable) file names. This can be useful if your file system
+# doesn't support long names like on DOS, Mac, or CD-ROM.
+
+SHORT_NAMES            = NO
+
+# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen
+# will interpret the first line (until the first dot) of a JavaDoc-style
+# comment as the brief description. If set to NO, the JavaDoc
+# comments will behave just like regular Qt-style comments
+# (thus requiring an explicit @brief command for a brief description.)
+
+JAVADOC_AUTOBRIEF      = NO
+
+# If the QT_AUTOBRIEF tag is set to YES then Doxygen will
+# interpret the first line (until the first dot) of a Qt-style
+# comment as the brief description. If set to NO, the comments
+# will behave just like regular Qt-style comments (thus requiring
+# an explicit \brief command for a brief description.)
+
+QT_AUTOBRIEF           = NO
+
+# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen
+# treat a multi-line C++ special comment block (i.e. a block of //! or ///
+# comments) as a brief description. This used to be the default behaviour.
+# The new default is to treat a multi-line C++ comment block as a detailed
+# description. Set this tag to YES if you prefer the old behaviour instead.
+
+MULTILINE_CPP_IS_BRIEF = NO
+
+# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented
+# member inherits the documentation from any documented member that it
+# re-implements.
+
+INHERIT_DOCS           = YES
+
+# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce
+# a new page for each member. If set to NO, the documentation of a member will
+# be part of the file/class/namespace that contains it.
+
+SEPARATE_MEMBER_PAGES  = NO
+
+# The TAB_SIZE tag can be used to set the number of spaces in a tab.
+# Doxygen uses this value to replace tabs by spaces in code fragments.
+
+TAB_SIZE               = 8
+
+# This tag can be used to specify a number of aliases that acts
+# as commands in the documentation. An alias has the form "name=value".
+# For example adding "sideeffect=\par Side Effects:\n" will allow you to
+# put the command \sideeffect (or @sideeffect) in the documentation, which
+# will result in a user-defined paragraph with heading "Side Effects:".
+# You can put \n's in the value part of an alias to insert newlines.
+
+ALIASES                =
+
+# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C
+# sources only. Doxygen will then generate output that is more tailored for C.
+# For instance, some of the names that are used will be different. The list
+# of all members will be omitted, etc.
+
+OPTIMIZE_OUTPUT_FOR_C  = YES
+
+# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java
+# sources only. Doxygen will then generate output that is more tailored for
+# Java. For instance, namespaces will be presented as packages, qualified
+# scopes will look different, etc.
+
+OPTIMIZE_OUTPUT_JAVA   = NO
+
+# Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran
+# sources only. Doxygen will then generate output that is more tailored for
+# Fortran.
+
+OPTIMIZE_FOR_FORTRAN   = NO
+
+# Set the OPTIMIZE_OUTPUT_VHDL tag to YES if your project consists of VHDL
+# sources. Doxygen will then generate output that is tailored for
+# VHDL.
+
+OPTIMIZE_OUTPUT_VHDL   = NO
+
+# Doxygen selects the parser to use depending on the extension of the files it
+# parses. With this tag you can assign which parser to use for a given extension.
+# Doxygen has a built-in mapping, but you can override or extend it using this
+# tag. The format is ext=language, where ext is a file extension, and language
+# is one of the parsers supported by doxygen: IDL, Java, Javascript, CSharp, C,
+# C++, D, PHP, Objective-C, Python, Fortran, VHDL, C, C++. For instance to make
+# doxygen treat .inc files as Fortran files (default is PHP), and .f files as C
+# (default is Fortran), use: inc=Fortran f=C. Note that for custom extensions
+# you also need to set FILE_PATTERNS otherwise the files are not read by doxygen.
+
+EXTENSION_MAPPING      =
+
+# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want
+# to include (a tag file for) the STL sources as input, then you should
+# set this tag to YES in order to let doxygen match functions declarations and
+# definitions whose arguments contain STL classes (e.g. func(std::string); v.s.
+# func(std::string) {}). This also makes the inheritance and collaboration
+# diagrams that involve STL classes more complete and accurate.
+
+BUILTIN_STL_SUPPORT    = NO
+
+# If you use Microsoft's C++/CLI language, you should set this option to YES to
+# enable parsing support.
+
+CPP_CLI_SUPPORT        = NO
+
+# Set the SIP_SUPPORT tag to YES if your project consists of sip sources only.
+# Doxygen will parse them like normal C++ but will assume all classes use public
+# instead of private inheritance when no explicit protection keyword is present.
+
+SIP_SUPPORT            = NO
+
+# For Microsoft's IDL there are propget and propput attributes to indicate getter
+# and setter methods for a property. Setting this option to YES (the default)
+# will make doxygen replace the get and set methods by a property in the
+# documentation. This will only work if the methods are indeed getting or
+# setting a simple type. If this is not the case, or you want to show the
+# methods anyway, you should set this option to NO.
+
+IDL_PROPERTY_SUPPORT   = YES
+
+# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC
+# tag is set to YES, then doxygen will reuse the documentation of the first
+# member in the group (if any) for the other members of the group. By default
+# all members of a group must be documented explicitly.
+
+DISTRIBUTE_GROUP_DOC   = NO
+
+# Set the SUBGROUPING tag to YES (the default) to allow class member groups of
+# the same type (for instance a group of public functions) to be put as a
+# subgroup of that type (e.g. under the Public Functions section). Set it to
+# NO to prevent subgrouping. Alternatively, this can be done per class using
+# the \nosubgrouping command.
+
+SUBGROUPING            = YES
+
+# When the INLINE_GROUPED_CLASSES tag is set to YES, classes, structs and
+# unions are shown inside the group in which they are included (e.g. using
+# @ingroup) instead of on a separate page (for HTML and Man pages) or
+# section (for LaTeX and RTF).
+
+INLINE_GROUPED_CLASSES = NO
+
+# When TYPEDEF_HIDES_STRUCT is enabled, a typedef of a struct, union, or enum
+# is documented as struct, union, or enum with the name of the typedef. So
+# typedef struct TypeS {} TypeT, will appear in the documentation as a struct
+# with name TypeT. When disabled the typedef will appear as a member of a file,
+# namespace, or class. And the struct will be named TypeS. This can typically
+# be useful for C code in case the coding convention dictates that all compound
+# types are typedef'ed and only the typedef is referenced, never the tag name.
+
+TYPEDEF_HIDES_STRUCT   = NO
+
+# The SYMBOL_CACHE_SIZE determines the size of the internal cache use to
+# determine which symbols to keep in memory and which to flush to disk.
+# When the cache is full, less often used symbols will be written to disk.
+# For small to medium size projects (<1000 input files) the default value is
+# probably good enough. For larger projects a too small cache size can cause
+# doxygen to be busy swapping symbols to and from disk most of the time
+# causing a significant performance penalty.
+# If the system has enough physical memory increasing the cache will improve the
+# performance by keeping more symbols in memory. Note that the value works on
+# a logarithmic scale so increasing the size by one will roughly double the
+# memory usage. The cache size is given by this formula:
+# 2^(16+SYMBOL_CACHE_SIZE). The valid range is 0..9, the default is 0,
+# corresponding to a cache size of 2^16 = 65536 symbols
+
+SYMBOL_CACHE_SIZE      = 0
+
+#---------------------------------------------------------------------------
+# Build related configuration options
+#---------------------------------------------------------------------------
+
+# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in
+# documentation are documented, even if no documentation was available.
+# Private class members and static file members will be hidden unless
+# the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES
+
+EXTRACT_ALL            = NO
+
+# If the EXTRACT_PRIVATE tag is set to YES all private members of a class
+# will be included in the documentation.
+
+EXTRACT_PRIVATE        = NO
+
+# If the EXTRACT_STATIC tag is set to YES all static members of a file
+# will be included in the documentation.
+
+EXTRACT_STATIC         = YES
+
+# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs)
+# defined locally in source files will be included in the documentation.
+# If set to NO only classes defined in header files are included.
+
+EXTRACT_LOCAL_CLASSES  = YES
+
+# This flag is only useful for Objective-C code. When set to YES local
+# methods, which are defined in the implementation section but not in
+# the interface are included in the documentation.
+# If set to NO (the default) only methods in the interface are included.
+
+EXTRACT_LOCAL_METHODS  = NO
+
+# If this flag is set to YES, the members of anonymous namespaces will be
+# extracted and appear in the documentation as a namespace called
+# 'anonymous_namespace{file}', where file will be replaced with the base
+# name of the file that contains the anonymous namespace. By default
+# anonymous namespaces are hidden.
+
+EXTRACT_ANON_NSPACES   = NO
+
+# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all
+# undocumented members of documented classes, files or namespaces.
+# If set to NO (the default) these members will be included in the
+# various overviews, but no documentation section is generated.
+# This option has no effect if EXTRACT_ALL is enabled.
+
+HIDE_UNDOC_MEMBERS     = NO
+
+# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all
+# undocumented classes that are normally visible in the class hierarchy.
+# If set to NO (the default) these classes will be included in the various
+# overviews. This option has no effect if EXTRACT_ALL is enabled.
+
+HIDE_UNDOC_CLASSES     = NO
+
+# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all
+# friend (class|struct|union) declarations.
+# If set to NO (the default) these declarations will be included in the
+# documentation.
+
+HIDE_FRIEND_COMPOUNDS  = NO
+
+# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any
+# documentation blocks found inside the body of a function.
+# If set to NO (the default) these blocks will be appended to the
+# function's detailed documentation block.
+
+HIDE_IN_BODY_DOCS      = NO
+
+# The INTERNAL_DOCS tag determines if documentation
+# that is typed after a \internal command is included. If the tag is set
+# to NO (the default) then the documentation will be excluded.
+# Set it to YES to include the internal documentation.
+
+INTERNAL_DOCS          = NO
+
+# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate
+# file names in lower-case letters. If set to YES upper-case letters are also
+# allowed. This is useful if you have classes or files whose names only differ
+# in case and if your file system supports case sensitive file names. Windows
+# and Mac users are advised to set this option to NO.
+
+CASE_SENSE_NAMES       = YES
+
+# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen
+# will show members with their full class and namespace scopes in the
+# documentation. If set to YES the scope will be hidden.
+
+HIDE_SCOPE_NAMES       = NO
+
+# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen
+# will put a list of the files that are included by a file in the documentation
+# of that file.
+
+SHOW_INCLUDE_FILES     = YES
+
+# If the FORCE_LOCAL_INCLUDES tag is set to YES then Doxygen
+# will list include files with double quotes in the documentation
+# rather than with sharp brackets.
+
+FORCE_LOCAL_INCLUDES   = NO
+
+# If the INLINE_INFO tag is set to YES (the default) then a tag [inline]
+# is inserted in the documentation for inline members.
+
+INLINE_INFO            = YES
+
+# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen
+# will sort the (detailed) documentation of file and class members
+# alphabetically by member name. If set to NO the members will appear in
+# declaration order.
+
+SORT_MEMBER_DOCS       = YES
+
+# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the
+# brief documentation of file, namespace and class members alphabetically
+# by member name. If set to NO (the default) the members will appear in
+# declaration order.
+
+SORT_BRIEF_DOCS        = NO
+
+# If the SORT_MEMBERS_CTORS_1ST tag is set to YES then doxygen
+# will sort the (brief and detailed) documentation of class members so that
+# constructors and destructors are listed first. If set to NO (the default)
+# the constructors will appear in the respective orders defined by
+# SORT_MEMBER_DOCS and SORT_BRIEF_DOCS.
+# This tag will be ignored for brief docs if SORT_BRIEF_DOCS is set to NO
+# and ignored for detailed docs if SORT_MEMBER_DOCS is set to NO.
+
+SORT_MEMBERS_CTORS_1ST = NO
+
+# If the SORT_GROUP_NAMES tag is set to YES then doxygen will sort the
+# hierarchy of group names into alphabetical order. If set to NO (the default)
+# the group names will appear in their defined order.
+
+SORT_GROUP_NAMES       = NO
+
+# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be
+# sorted by fully-qualified names, including namespaces. If set to
+# NO (the default), the class list will be sorted only by class name,
+# not including the namespace part.
+# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES.
+# Note: This option applies only to the class list, not to the
+# alphabetical list.
+
+SORT_BY_SCOPE_NAME     = NO
+
+# If the STRICT_PROTO_MATCHING option is enabled and doxygen fails to
+# do proper type resolution of all parameters of a function it will reject a
+# match between the prototype and the implementation of a member function even
+# if there is only one candidate or it is obvious which candidate to choose
+# by doing a simple string match. By disabling STRICT_PROTO_MATCHING doxygen
+# will still accept a match between prototype and implementation in such cases.
+
+STRICT_PROTO_MATCHING  = NO
+
+# The GENERATE_TODOLIST tag can be used to enable (YES) or
+# disable (NO) the todo list. This list is created by putting \todo
+# commands in the documentation.
+
+GENERATE_TODOLIST      = YES
+
+# The GENERATE_TESTLIST tag can be used to enable (YES) or
+# disable (NO) the test list. This list is created by putting \test
+# commands in the documentation.
+
+GENERATE_TESTLIST      = YES
+
+# The GENERATE_BUGLIST tag can be used to enable (YES) or
+# disable (NO) the bug list. This list is created by putting \bug
+# commands in the documentation.
+
+GENERATE_BUGLIST       = YES
+
+# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or
+# disable (NO) the deprecated list. This list is created by putting
+# \deprecated commands in the documentation.
+
+GENERATE_DEPRECATEDLIST= YES
+
+# The ENABLED_SECTIONS tag can be used to enable conditional
+# documentation sections, marked by \if sectionname ... \endif.
+
+ENABLED_SECTIONS       =
+
+# The MAX_INITIALIZER_LINES tag determines the maximum number of lines
+# the initial value of a variable or macro consists of for it to appear in
+# the documentation. If the initializer consists of more lines than specified
+# here it will be hidden. Use a value of 0 to hide initializers completely.
+# The appearance of the initializer of individual variables and macros in the
+# documentation can be controlled using \showinitializer or \hideinitializer
+# command in the documentation regardless of this setting.
+
+MAX_INITIALIZER_LINES  = 30
+
+# Set the SHOW_USED_FILES tag to NO to disable the list of files generated
+# at the bottom of the documentation of classes and structs. If set to YES the
+# list will mention the files that were used to generate the documentation.
+
+SHOW_USED_FILES        = YES
+
+# If the sources in your project are distributed over multiple directories
+# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy
+# in the documentation. The default is NO.
+
+SHOW_DIRECTORIES       = NO
+
+# Set the SHOW_FILES tag to NO to disable the generation of the Files page.
+# This will remove the Files entry from the Quick Index and from the
+# Folder Tree View (if specified). The default is YES.
+
+SHOW_FILES             = YES
+
+# Set the SHOW_NAMESPACES tag to NO to disable the generation of the
+# Namespaces page.
+# This will remove the Namespaces entry from the Quick Index
+# and from the Folder Tree View (if specified). The default is YES.
+
+SHOW_NAMESPACES        = YES
+
+# The FILE_VERSION_FILTER tag can be used to specify a program or script that
+# doxygen should invoke to get the current version for each file (typically from
+# the version control system). Doxygen will invoke the program by executing (via
+# popen()) the command <command> <input-file>, where <command> is the value of
+# the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file
+# provided by doxygen. Whatever the program writes to standard output
+# is used as the file version. See the manual for examples.
+
+FILE_VERSION_FILTER    =
+
+# The LAYOUT_FILE tag can be used to specify a layout file which will be parsed
+# by doxygen. The layout file controls the global structure of the generated
+# output files in an output format independent way. The create the layout file
+# that represents doxygen's defaults, run doxygen with the -l option.
+# You can optionally specify a file name after the option, if omitted
+# DoxygenLayout.xml will be used as the name of the layout file.
+
+LAYOUT_FILE            =
+
+#---------------------------------------------------------------------------
+# configuration options related to warning and progress messages
+#---------------------------------------------------------------------------
+
+# The QUIET tag can be used to turn on/off the messages that are generated
+# by doxygen. Possible values are YES and NO. If left blank NO is used.
+
+QUIET                  = NO
+
+# The WARNINGS tag can be used to turn on/off the warning messages that are
+# generated by doxygen. Possible values are YES and NO. If left blank
+# NO is used.
+
+WARNINGS               = YES
+
+# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings
+# for undocumented members. If EXTRACT_ALL is set to YES then this flag will
+# automatically be disabled.
+
+WARN_IF_UNDOCUMENTED   = YES
+
+# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for
+# potential errors in the documentation, such as not documenting some
+# parameters in a documented function, or documenting parameters that
+# don't exist or using markup commands wrongly.
+
+WARN_IF_DOC_ERROR      = YES
+
+# The WARN_NO_PARAMDOC option can be enabled to get warnings for
+# functions that are documented, but have no documentation for their parameters
+# or return value. If set to NO (the default) doxygen will only warn about
+# wrong or incomplete parameter documentation, but not about the absence of
+# documentation.
+
+WARN_NO_PARAMDOC       = NO
+
+# The WARN_FORMAT tag determines the format of the warning messages that
+# doxygen can produce. The string should contain the $file, $line, and $text
+# tags, which will be replaced by the file and line number from which the
+# warning originated and the warning text. Optionally the format may contain
+# $version, which will be replaced by the version of the file (if it could
+# be obtained via FILE_VERSION_FILTER)
+
+WARN_FORMAT            = "$file:$line: $text"
+
+# The WARN_LOGFILE tag can be used to specify a file to which warning
+# and error messages should be written. If left blank the output is written
+# to stderr.
+
+WARN_LOGFILE           =
+
+#---------------------------------------------------------------------------
+# configuration options related to the input files
+#---------------------------------------------------------------------------
+
+# The INPUT tag can be used to specify the files and/or directories that contain
+# documented source files. You may enter file names like "myfile.cpp" or
+# directories like "/usr/src/myproject". Separate the files or directories
+# with spaces.
+
+INPUT                  = include/osmocom/vty src/vty
+
+# This tag can be used to specify the character encoding of the source files
+# that doxygen parses. Internally doxygen uses the UTF-8 encoding, which is
+# also the default input encoding. Doxygen uses libiconv (or the iconv built
+# into libc) for the transcoding. See http://www.gnu.org/software/libiconv for
+# the list of possible encodings.
+
+INPUT_ENCODING         = UTF-8
+
+# If the value of the INPUT tag contains directories, you can use the
+# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
+# and *.h) to filter out the source-files in the directories. If left
+# blank the following patterns are tested:
+# *.c *.cc *.cxx *.cpp *.c++ *.d *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh
+# *.hxx *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.dox *.py
+# *.f90 *.f *.for *.vhd *.vhdl
+
+FILE_PATTERNS          =
+
+# The RECURSIVE tag can be used to turn specify whether or not subdirectories
+# should be searched for input files as well. Possible values are YES and NO.
+# If left blank NO is used.
+
+RECURSIVE              = YES
+
+# The EXCLUDE tag can be used to specify files and/or directories that should
+# excluded from the INPUT source files. This way you can easily exclude a
+# subdirectory from a directory tree whose root is specified with the INPUT tag.
+
+EXCLUDE                =
+
+# The EXCLUDE_SYMLINKS tag can be used select whether or not files or
+# directories that are symbolic links (a Unix file system feature) are excluded
+# from the input.
+
+EXCLUDE_SYMLINKS       = NO
+
+# If the value of the INPUT tag contains directories, you can use the
+# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude
+# certain files from those directories. Note that the wildcards are matched
+# against the file with absolute path, so to exclude all test directories
+# for example use the pattern */test/*
+
+EXCLUDE_PATTERNS       =
+
+# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names
+# (namespaces, classes, functions, etc.) that should be excluded from the
+# output. The symbol name can be a fully qualified name, a word, or if the
+# wildcard * is used, a substring. Examples: ANamespace, AClass,
+# AClass::ANamespace, ANamespace::*Test
+
+EXCLUDE_SYMBOLS        =
+
+# The EXAMPLE_PATH tag can be used to specify one or more files or
+# directories that contain example code fragments that are included (see
+# the \include command).
+
+EXAMPLE_PATH           =
+
+# If the value of the EXAMPLE_PATH tag contains directories, you can use the
+# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp
+# and *.h) to filter out the source-files in the directories. If left
+# blank all files are included.
+
+EXAMPLE_PATTERNS       =
+
+# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be
+# searched for input files to be used with the \include or \dontinclude
+# commands irrespective of the value of the RECURSIVE tag.
+# Possible values are YES and NO. If left blank NO is used.
+
+EXAMPLE_RECURSIVE      = NO
+
+# The IMAGE_PATH tag can be used to specify one or more files or
+# directories that contain image that are included in the documentation (see
+# the \image command).
+
+IMAGE_PATH             = images/
+
+# The INPUT_FILTER tag can be used to specify a program that doxygen should
+# invoke to filter for each input file. Doxygen will invoke the filter program
+# by executing (via popen()) the command <filter> <input-file>, where <filter>
+# is the value of the INPUT_FILTER tag, and <input-file> is the name of an
+# input file. Doxygen will then use the output that the filter program writes
+# to standard output.
+# If FILTER_PATTERNS is specified, this tag will be
+# ignored.
+
+INPUT_FILTER           =
+
+# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern
+# basis.
+# Doxygen will compare the file name with each pattern and apply the
+# filter if there is a match.
+# The filters are a list of the form:
+# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further
+# info on how filters are used. If FILTER_PATTERNS is empty or if
+# non of the patterns match the file name, INPUT_FILTER is applied.
+
+FILTER_PATTERNS        =
+
+# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using
+# INPUT_FILTER) will be used to filter the input files when producing source
+# files to browse (i.e. when SOURCE_BROWSER is set to YES).
+
+FILTER_SOURCE_FILES    = NO
+
+# The FILTER_SOURCE_PATTERNS tag can be used to specify source filters per file
+# pattern. A pattern will override the setting for FILTER_PATTERN (if any)
+# and it is also possible to disable source filtering for a specific pattern
+# using *.ext= (so without naming a filter). This option only has effect when
+# FILTER_SOURCE_FILES is enabled.
+
+FILTER_SOURCE_PATTERNS =
+
+#---------------------------------------------------------------------------
+# configuration options related to source browsing
+#---------------------------------------------------------------------------
+
+# If the SOURCE_BROWSER tag is set to YES then a list of source files will
+# be generated. Documented entities will be cross-referenced with these sources.
+# Note: To get rid of all source code in the generated output, make sure also
+# VERBATIM_HEADERS is set to NO.
+
+SOURCE_BROWSER         = NO
+
+# Setting the INLINE_SOURCES tag to YES will include the body
+# of functions and classes directly in the documentation.
+
+INLINE_SOURCES         = NO
+
+# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct
+# doxygen to hide any special comment blocks from generated source code
+# fragments. Normal C and C++ comments will always remain visible.
+
+STRIP_CODE_COMMENTS    = YES
+
+# If the REFERENCED_BY_RELATION tag is set to YES
+# then for each documented function all documented
+# functions referencing it will be listed.
+
+REFERENCED_BY_RELATION = YES
+
+# If the REFERENCES_RELATION tag is set to YES
+# then for each documented function all documented entities
+# called/used by that function will be listed.
+
+REFERENCES_RELATION    = YES
+
+# If the REFERENCES_LINK_SOURCE tag is set to YES (the default)
+# and SOURCE_BROWSER tag is set to YES, then the hyperlinks from
+# functions in REFERENCES_RELATION and REFERENCED_BY_RELATION lists will
+# link to the source code.
+# Otherwise they will link to the documentation.
+
+REFERENCES_LINK_SOURCE = YES
+
+# If the USE_HTAGS tag is set to YES then the references to source code
+# will point to the HTML generated by the htags(1) tool instead of doxygen
+# built-in source browser. The htags tool is part of GNU's global source
+# tagging system (see http://www.gnu.org/software/global/global.html). You
+# will need version 4.8.6 or higher.
+
+USE_HTAGS              = NO
+
+# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen
+# will generate a verbatim copy of the header file for each class for
+# which an include is specified. Set to NO to disable this.
+
+VERBATIM_HEADERS       = YES
+
+#---------------------------------------------------------------------------
+# configuration options related to the alphabetical class index
+#---------------------------------------------------------------------------
+
+# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index
+# of all compounds will be generated. Enable this if the project
+# contains a lot of classes, structs, unions or interfaces.
+
+ALPHABETICAL_INDEX     = NO
+
+# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then
+# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns
+# in which this list will be split (can be a number in the range [1..20])
+
+COLS_IN_ALPHA_INDEX    = 5
+
+# In case all classes in a project start with a common prefix, all
+# classes will be put under the same header in the alphabetical index.
+# The IGNORE_PREFIX tag can be used to specify one or more prefixes that
+# should be ignored while generating the index headers.
+
+IGNORE_PREFIX          =
+
+#---------------------------------------------------------------------------
+# configuration options related to the HTML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_HTML tag is set to YES (the default) Doxygen will
+# generate HTML output.
+
+GENERATE_HTML          = YES
+
+# The HTML_OUTPUT tag is used to specify where the HTML docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `html' will be used as the default path.
+
+HTML_OUTPUT            = html
+
+# The HTML_FILE_EXTENSION tag can be used to specify the file extension for
+# each generated HTML page (for example: .htm,.php,.asp). If it is left blank
+# doxygen will generate files with .html extension.
+
+HTML_FILE_EXTENSION    = .html
+
+# The HTML_HEADER tag can be used to specify a personal HTML header for
+# each generated HTML page. If it is left blank doxygen will generate a
+# standard header. Note that when using a custom header you are responsible
+# for the proper inclusion of any scripts and style sheets that doxygen
+# needs, which is dependent on the configuration options used.
+# It is adviced to generate a default header using "doxygen -w html
+# header.html footer.html stylesheet.css YourConfigFile" and then modify
+# that header. Note that the header is subject to change so you typically
+# have to redo this when upgrading to a newer version of doxygen or when changing the value of configuration settings such as GENERATE_TREEVIEW!
+
+HTML_HEADER            =
+
+# The HTML_FOOTER tag can be used to specify a personal HTML footer for
+# each generated HTML page. If it is left blank doxygen will generate a
+# standard footer.
+
+HTML_FOOTER            =
+
+# The HTML_STYLESHEET tag can be used to specify a user-defined cascading
+# style sheet that is used by each HTML page. It can be used to
+# fine-tune the look of the HTML output. If the tag is left blank doxygen
+# will generate a default style sheet. Note that doxygen will try to copy
+# the style sheet file to the HTML output directory, so don't put your own
+# stylesheet in the HTML output directory as well, or it will be erased!
+
+HTML_STYLESHEET        =
+
+# The HTML_EXTRA_FILES tag can be used to specify one or more extra images or
+# other source files which should be copied to the HTML output directory. Note
+# that these files will be copied to the base HTML output directory. Use the
+# $relpath$ marker in the HTML_HEADER and/or HTML_FOOTER files to load these
+# files. In the HTML_STYLESHEET file, use the file name only. Also note that
+# the files will be copied as-is; there are no commands or markers available.
+
+HTML_EXTRA_FILES       =
+
+# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output.
+# Doxygen will adjust the colors in the stylesheet and background images
+# according to this color. Hue is specified as an angle on a colorwheel,
+# see http://en.wikipedia.org/wiki/Hue for more information.
+# For instance the value 0 represents red, 60 is yellow, 120 is green,
+# 180 is cyan, 240 is blue, 300 purple, and 360 is red again.
+# The allowed range is 0 to 359.
+
+HTML_COLORSTYLE_HUE    = 220
+
+# The HTML_COLORSTYLE_SAT tag controls the purity (or saturation) of
+# the colors in the HTML output. For a value of 0 the output will use
+# grayscales only. A value of 255 will produce the most vivid colors.
+
+HTML_COLORSTYLE_SAT    = 100
+
+# The HTML_COLORSTYLE_GAMMA tag controls the gamma correction applied to
+# the luminance component of the colors in the HTML output. Values below
+# 100 gradually make the output lighter, whereas values above 100 make
+# the output darker. The value divided by 100 is the actual gamma applied,
+# so 80 represents a gamma of 0.8, The value 220 represents a gamma of 2.2,
+# and 100 does not change the gamma.
+
+HTML_COLORSTYLE_GAMMA  = 80
+
+# If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML
+# page will contain the date and time when the page was generated. Setting
+# this to NO can help when comparing the output of multiple runs.
+
+HTML_TIMESTAMP         = YES
+
+# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes,
+# files or namespaces will be aligned in HTML using tables. If set to
+# NO a bullet list will be used.
+
+HTML_ALIGN_MEMBERS     = YES
+
+# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML
+# documentation will contain sections that can be hidden and shown after the
+# page has loaded. For this to work a browser that supports
+# JavaScript and DHTML is required (for instance Mozilla 1.0+, Firefox
+# Netscape 6.0+, Internet explorer 5.0+, Konqueror, or Safari).
+
+HTML_DYNAMIC_SECTIONS  = NO
+
+# If the GENERATE_DOCSET tag is set to YES, additional index files
+# will be generated that can be used as input for Apple's Xcode 3
+# integrated development environment, introduced with OSX 10.5 (Leopard).
+# To create a documentation set, doxygen will generate a Makefile in the
+# HTML output directory. Running make will produce the docset in that
+# directory and running "make install" will install the docset in
+# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find
+# it at startup.
+# See http://developer.apple.com/tools/creatingdocsetswithdoxygen.html
+# for more information.
+
+GENERATE_DOCSET        = NO
+
+# When GENERATE_DOCSET tag is set to YES, this tag determines the name of the
+# feed. A documentation feed provides an umbrella under which multiple
+# documentation sets from a single provider (such as a company or product suite)
+# can be grouped.
+
+DOCSET_FEEDNAME        = "Doxygen generated docs"
+
+# When GENERATE_DOCSET tag is set to YES, this tag specifies a string that
+# should uniquely identify the documentation set bundle. This should be a
+# reverse domain-name style string, e.g. com.mycompany.MyDocSet. Doxygen
+# will append .docset to the name.
+
+DOCSET_BUNDLE_ID       = org.doxygen.Project
+
+# When GENERATE_PUBLISHER_ID tag specifies a string that should uniquely identify
+# the documentation publisher. This should be a reverse domain-name style
+# string, e.g. com.mycompany.MyDocSet.documentation.
+
+DOCSET_PUBLISHER_ID    = org.doxygen.Publisher
+
+# The GENERATE_PUBLISHER_NAME tag identifies the documentation publisher.
+
+DOCSET_PUBLISHER_NAME  = Publisher
+
+# If the GENERATE_HTMLHELP tag is set to YES, additional index files
+# will be generated that can be used as input for tools like the
+# Microsoft HTML help workshop to generate a compiled HTML help file (.chm)
+# of the generated HTML documentation.
+
+GENERATE_HTMLHELP      = NO
+
+# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can
+# be used to specify the file name of the resulting .chm file. You
+# can add a path in front of the file if the result should not be
+# written to the html output directory.
+
+CHM_FILE               =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can
+# be used to specify the location (absolute path including file name) of
+# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run
+# the HTML help compiler on the generated index.hhp.
+
+HHC_LOCATION           =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag
+# controls if a separate .chi index file is generated (YES) or that
+# it should be included in the master .chm file (NO).
+
+GENERATE_CHI           = NO
+
+# If the GENERATE_HTMLHELP tag is set to YES, the CHM_INDEX_ENCODING
+# is used to encode HtmlHelp index (hhk), content (hhc) and project file
+# content.
+
+CHM_INDEX_ENCODING     =
+
+# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag
+# controls whether a binary table of contents is generated (YES) or a
+# normal table of contents (NO) in the .chm file.
+
+BINARY_TOC             = NO
+
+# The TOC_EXPAND flag can be set to YES to add extra items for group members
+# to the contents of the HTML help documentation and to the tree view.
+
+TOC_EXPAND             = NO
+
+# If the GENERATE_QHP tag is set to YES and both QHP_NAMESPACE and
+# QHP_VIRTUAL_FOLDER are set, an additional index file will be generated
+# that can be used as input for Qt's qhelpgenerator to generate a
+# Qt Compressed Help (.qch) of the generated HTML documentation.
+
+GENERATE_QHP           = NO
+
+# If the QHG_LOCATION tag is specified, the QCH_FILE tag can
+# be used to specify the file name of the resulting .qch file.
+# The path specified is relative to the HTML output folder.
+
+QCH_FILE               =
+
+# The QHP_NAMESPACE tag specifies the namespace to use when generating
+# Qt Help Project output. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#namespace
+
+QHP_NAMESPACE          = org.doxygen.Project
+
+# The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating
+# Qt Help Project output. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#virtual-folders
+
+QHP_VIRTUAL_FOLDER     = doc
+
+# If QHP_CUST_FILTER_NAME is set, it specifies the name of a custom filter to
+# add. For more information please see
+# http://doc.trolltech.com/qthelpproject.html#custom-filters
+
+QHP_CUST_FILTER_NAME   =
+
+# The QHP_CUST_FILT_ATTRS tag specifies the list of the attributes of the
+# custom filter to add. For more information please see
+# <a href="http://doc.trolltech.com/qthelpproject.html#custom-filters">
+# Qt Help Project / Custom Filters</a>.
+
+QHP_CUST_FILTER_ATTRS  =
+
+# The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this
+# project's
+# filter section matches.
+# <a href="http://doc.trolltech.com/qthelpproject.html#filter-attributes">
+# Qt Help Project / Filter Attributes</a>.
+
+QHP_SECT_FILTER_ATTRS  =
+
+# If the GENERATE_QHP tag is set to YES, the QHG_LOCATION tag can
+# be used to specify the location of Qt's qhelpgenerator.
+# If non-empty doxygen will try to run qhelpgenerator on the generated
+# .qhp file.
+
+QHG_LOCATION           =
+
+# If the GENERATE_ECLIPSEHELP tag is set to YES, additional index files
+#  will be generated, which together with the HTML files, form an Eclipse help
+# plugin. To install this plugin and make it available under the help contents
+# menu in Eclipse, the contents of the directory containing the HTML and XML
+# files needs to be copied into the plugins directory of eclipse. The name of
+# the directory within the plugins directory should be the same as
+# the ECLIPSE_DOC_ID value. After copying Eclipse needs to be restarted before
+# the help appears.
+
+GENERATE_ECLIPSEHELP   = NO
+
+# A unique identifier for the eclipse help plugin. When installing the plugin
+# the directory name containing the HTML and XML files should also have
+# this name.
+
+ECLIPSE_DOC_ID         = org.doxygen.Project
+
+# The DISABLE_INDEX tag can be used to turn on/off the condensed index at
+# top of each HTML page. The value NO (the default) enables the index and
+# the value YES disables it.
+
+DISABLE_INDEX          = NO
+
+# The ENUM_VALUES_PER_LINE tag can be used to set the number of enum values
+# (range [0,1..20]) that doxygen will group on one line in the generated HTML
+# documentation. Note that a value of 0 will completely suppress the enum
+# values from appearing in the overview section.
+
+ENUM_VALUES_PER_LINE   = 4
+
+# The GENERATE_TREEVIEW tag is used to specify whether a tree-like index
+# structure should be generated to display hierarchical information.
+# If the tag value is set to YES, a side panel will be generated
+# containing a tree-like index structure (just like the one that
+# is generated for HTML Help). For this to work a browser that supports
+# JavaScript, DHTML, CSS and frames is required (i.e. any modern browser).
+# Windows users are probably better off using the HTML help feature.
+
+GENERATE_TREEVIEW      = YES
+
+# By enabling USE_INLINE_TREES, doxygen will generate the Groups, Directories,
+# and Class Hierarchy pages using a tree view instead of an ordered list.
+
+USE_INLINE_TREES       = NO
+
+# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be
+# used to set the initial width (in pixels) of the frame in which the tree
+# is shown.
+
+TREEVIEW_WIDTH         = 250
+
+# When the EXT_LINKS_IN_WINDOW option is set to YES doxygen will open
+# links to external symbols imported via tag files in a separate window.
+
+EXT_LINKS_IN_WINDOW    = NO
+
+# Use this tag to change the font size of Latex formulas included
+# as images in the HTML documentation. The default is 10. Note that
+# when you change the font size after a successful doxygen run you need
+# to manually remove any form_*.png images from the HTML output directory
+# to force them to be regenerated.
+
+FORMULA_FONTSIZE       = 10
+
+# Use the FORMULA_TRANPARENT tag to determine whether or not the images
+# generated for formulas are transparent PNGs. Transparent PNGs are
+# not supported properly for IE 6.0, but are supported on all modern browsers.
+# Note that when changing this option you need to delete any form_*.png files
+# in the HTML output before the changes have effect.
+
+FORMULA_TRANSPARENT    = YES
+
+# Enable the USE_MATHJAX option to render LaTeX formulas using MathJax
+# (see http://www.mathjax.org) which uses client side Javascript for the
+# rendering instead of using prerendered bitmaps. Use this if you do not
+# have LaTeX installed or if you want to formulas look prettier in the HTML
+# output. When enabled you also need to install MathJax separately and
+# configure the path to it using the MATHJAX_RELPATH option.
+
+USE_MATHJAX            = NO
+
+# When MathJax is enabled you need to specify the location relative to the
+# HTML output directory using the MATHJAX_RELPATH option. The destination
+# directory should contain the MathJax.js script. For instance, if the mathjax
+# directory is located at the same level as the HTML output directory, then
+# MATHJAX_RELPATH should be ../mathjax. The default value points to the
+# mathjax.org site, so you can quickly see the result without installing
+# MathJax, but it is strongly recommended to install a local copy of MathJax
+# before deployment.
+
+MATHJAX_RELPATH        = http://www.mathjax.org/mathjax
+
+# When the SEARCHENGINE tag is enabled doxygen will generate a search box
+# for the HTML output. The underlying search engine uses javascript
+# and DHTML and should work on any modern browser. Note that when using
+# HTML help (GENERATE_HTMLHELP), Qt help (GENERATE_QHP), or docsets
+# (GENERATE_DOCSET) there is already a search function so this one should
+# typically be disabled. For large projects the javascript based search engine
+# can be slow, then enabling SERVER_BASED_SEARCH may provide a better solution.
+
+SEARCHENGINE           = NO
+
+# When the SERVER_BASED_SEARCH tag is enabled the search engine will be
+# implemented using a PHP enabled web server instead of at the web client
+# using Javascript. Doxygen will generate the search PHP script and index
+# file to put on the web server. The advantage of the server
+# based approach is that it scales better to large projects and allows
+# full text search. The disadvantages are that it is more difficult to setup
+# and does not have live searching capabilities.
+
+SERVER_BASED_SEARCH    = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the LaTeX output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will
+# generate Latex output.
+
+GENERATE_LATEX         = YES
+
+# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `latex' will be used as the default path.
+
+LATEX_OUTPUT           = latex
+
+# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be
+# invoked. If left blank `latex' will be used as the default command name.
+# Note that when enabling USE_PDFLATEX this option is only used for
+# generating bitmaps for formulas in the HTML output, but not in the
+# Makefile that is written to the output directory.
+
+LATEX_CMD_NAME         = latex
+
+# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to
+# generate index for LaTeX. If left blank `makeindex' will be used as the
+# default command name.
+
+MAKEINDEX_CMD_NAME     = makeindex
+
+# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact
+# LaTeX documents. This may be useful for small projects and may help to
+# save some trees in general.
+
+COMPACT_LATEX          = NO
+
+# The PAPER_TYPE tag can be used to set the paper type that is used
+# by the printer. Possible values are: a4, letter, legal and
+# executive. If left blank a4wide will be used.
+
+PAPER_TYPE             = a4wide
+
+# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX
+# packages that should be included in the LaTeX output.
+
+EXTRA_PACKAGES         =
+
+# The LATEX_HEADER tag can be used to specify a personal LaTeX header for
+# the generated latex document. The header should contain everything until
+# the first chapter. If it is left blank doxygen will generate a
+# standard header. Notice: only use this tag if you know what you are doing!
+
+LATEX_HEADER           =
+
+# The LATEX_FOOTER tag can be used to specify a personal LaTeX footer for
+# the generated latex document. The footer should contain everything after
+# the last chapter. If it is left blank doxygen will generate a
+# standard footer. Notice: only use this tag if you know what you are doing!
+
+LATEX_FOOTER           =
+
+# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated
+# is prepared for conversion to pdf (using ps2pdf). The pdf file will
+# contain links (just like the HTML output) instead of page references
+# This makes the output suitable for online browsing using a pdf viewer.
+
+PDF_HYPERLINKS         = NO
+
+# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of
+# plain latex in the generated Makefile. Set this option to YES to get a
+# higher quality PDF documentation.
+
+USE_PDFLATEX           = NO
+
+# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode.
+# command to the generated LaTeX files. This will instruct LaTeX to keep
+# running if errors occur, instead of asking the user for help.
+# This option is also used when generating formulas in HTML.
+
+LATEX_BATCHMODE        = NO
+
+# If LATEX_HIDE_INDICES is set to YES then doxygen will not
+# include the index chapters (such as File Index, Compound Index, etc.)
+# in the output.
+
+LATEX_HIDE_INDICES     = NO
+
+# If LATEX_SOURCE_CODE is set to YES then doxygen will include
+# source code with syntax highlighting in the LaTeX output.
+# Note that which sources are shown also depends on other settings
+# such as SOURCE_BROWSER.
+
+LATEX_SOURCE_CODE      = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the RTF output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output
+# The RTF output is optimized for Word 97 and may not look very pretty with
+# other RTF readers or editors.
+
+GENERATE_RTF           = NO
+
+# The RTF_OUTPUT tag is used to specify where the RTF docs will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `rtf' will be used as the default path.
+
+RTF_OUTPUT             = rtf
+
+# If the COMPACT_RTF tag is set to YES Doxygen generates more compact
+# RTF documents. This may be useful for small projects and may help to
+# save some trees in general.
+
+COMPACT_RTF            = NO
+
+# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated
+# will contain hyperlink fields. The RTF file will
+# contain links (just like the HTML output) instead of page references.
+# This makes the output suitable for online browsing using WORD or other
+# programs which support those fields.
+# Note: wordpad (write) and others do not support links.
+
+RTF_HYPERLINKS         = NO
+
+# Load stylesheet definitions from file. Syntax is similar to doxygen's
+# config file, i.e. a series of assignments. You only have to provide
+# replacements, missing definitions are set to their default value.
+
+RTF_STYLESHEET_FILE    =
+
+# Set optional variables used in the generation of an rtf document.
+# Syntax is similar to doxygen's config file.
+
+RTF_EXTENSIONS_FILE    =
+
+#---------------------------------------------------------------------------
+# configuration options related to the man page output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_MAN tag is set to YES (the default) Doxygen will
+# generate man pages
+
+GENERATE_MAN           = NO
+
+# The MAN_OUTPUT tag is used to specify where the man pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `man' will be used as the default path.
+
+MAN_OUTPUT             = man
+
+# The MAN_EXTENSION tag determines the extension that is added to
+# the generated man pages (default is the subroutine's section .3)
+
+MAN_EXTENSION          = .3
+
+# If the MAN_LINKS tag is set to YES and Doxygen generates man output,
+# then it will generate one additional man file for each entity
+# documented in the real man page(s). These additional files
+# only source the real man page, but without them the man command
+# would be unable to find the correct page. The default is NO.
+
+MAN_LINKS              = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the XML output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_XML tag is set to YES Doxygen will
+# generate an XML file that captures the structure of
+# the code including all documentation.
+
+GENERATE_XML           = NO
+
+# The XML_OUTPUT tag is used to specify where the XML pages will be put.
+# If a relative path is entered the value of OUTPUT_DIRECTORY will be
+# put in front of it. If left blank `xml' will be used as the default path.
+
+XML_OUTPUT             = xml
+
+# The XML_SCHEMA tag can be used to specify an XML schema,
+# which can be used by a validating XML parser to check the
+# syntax of the XML files.
+
+XML_SCHEMA             =
+
+# The XML_DTD tag can be used to specify an XML DTD,
+# which can be used by a validating XML parser to check the
+# syntax of the XML files.
+
+XML_DTD                =
+
+# If the XML_PROGRAMLISTING tag is set to YES Doxygen will
+# dump the program listings (including syntax highlighting
+# and cross-referencing information) to the XML output. Note that
+# enabling this will significantly increase the size of the XML output.
+
+XML_PROGRAMLISTING     = YES
+
+#---------------------------------------------------------------------------
+# configuration options for the AutoGen Definitions output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will
+# generate an AutoGen Definitions (see autogen.sf.net) file
+# that captures the structure of the code including all
+# documentation. Note that this feature is still experimental
+# and incomplete at the moment.
+
+GENERATE_AUTOGEN_DEF   = NO
+
+#---------------------------------------------------------------------------
+# configuration options related to the Perl module output
+#---------------------------------------------------------------------------
+
+# If the GENERATE_PERLMOD tag is set to YES Doxygen will
+# generate a Perl module file that captures the structure of
+# the code including all documentation. Note that this
+# feature is still experimental and incomplete at the
+# moment.
+
+GENERATE_PERLMOD       = NO
+
+# If the PERLMOD_LATEX tag is set to YES Doxygen will generate
+# the necessary Makefile rules, Perl scripts and LaTeX code to be able
+# to generate PDF and DVI output from the Perl module output.
+
+PERLMOD_LATEX          = NO
+
+# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be
+# nicely formatted so it can be parsed by a human reader.
+# This is useful
+# if you want to understand what is going on.
+# On the other hand, if this
+# tag is set to NO the size of the Perl module output will be much smaller
+# and Perl will parse it just the same.
+
+PERLMOD_PRETTY         = YES
+
+# The names of the make variables in the generated doxyrules.make file
+# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX.
+# This is useful so different doxyrules.make files included by the same
+# Makefile don't overwrite each other's variables.
+
+PERLMOD_MAKEVAR_PREFIX =
+
+#---------------------------------------------------------------------------
+# Configuration options related to the preprocessor
+#---------------------------------------------------------------------------
+
+# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will
+# evaluate all C-preprocessor directives found in the sources and include
+# files.
+
+ENABLE_PREPROCESSING   = NO
+
+# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro
+# names in the source code. If set to NO (the default) only conditional
+# compilation will be performed. Macro expansion can be done in a controlled
+# way by setting EXPAND_ONLY_PREDEF to YES.
+
+MACRO_EXPANSION        = NO
+
+# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES
+# then the macro expansion is limited to the macros specified with the
+# PREDEFINED and EXPAND_AS_DEFINED tags.
+
+EXPAND_ONLY_PREDEF     = NO
+
+# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files
+# pointed to by INCLUDE_PATH will be searched when a #include is found.
+
+SEARCH_INCLUDES        = YES
+
+# The INCLUDE_PATH tag can be used to specify one or more directories that
+# contain include files that are not input files but should be processed by
+# the preprocessor.
+
+INCLUDE_PATH           =
+
+# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard
+# patterns (like *.h and *.hpp) to filter out the header-files in the
+# directories. If left blank, the patterns specified with FILE_PATTERNS will
+# be used.
+
+INCLUDE_FILE_PATTERNS  =
+
+# The PREDEFINED tag can be used to specify one or more macro names that
+# are defined before the preprocessor is started (similar to the -D option of
+# gcc). The argument of the tag is a list of macros of the form: name
+# or name=definition (no spaces). If the definition and the = are
+# omitted =1 is assumed. To prevent a macro definition from being
+# undefined via #undef or recursively expanded use the := operator
+# instead of the = operator.
+
+PREDEFINED             =
+
+# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then
+# this tag can be used to specify a list of macro names that should be expanded.
+# The macro definition that is found in the sources will be used.
+# Use the PREDEFINED tag if you want to use a different macro definition that
+# overrules the definition found in the source code.
+
+EXPAND_AS_DEFINED      =
+
+# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then
+# doxygen's preprocessor will remove all references to function-like macros
+# that are alone on a line, have an all uppercase name, and do not end with a
+# semicolon, because these will confuse the parser if not removed.
+
+SKIP_FUNCTION_MACROS   = YES
+
+#---------------------------------------------------------------------------
+# Configuration::additions related to external references
+#---------------------------------------------------------------------------
+
+# The TAGFILES option can be used to specify one or more tagfiles.
+# Optionally an initial location of the external documentation
+# can be added for each tagfile. The format of a tag file without
+# this location is as follows:
+#
+# TAGFILES = file1 file2 ...
+# Adding location for the tag files is done as follows:
+#
+# TAGFILES = file1=loc1 "file2 = loc2" ...
+# where "loc1" and "loc2" can be relative or absolute paths or
+# URLs. If a location is present for each tag, the installdox tool
+# does not have to be run to correct the links.
+# Note that each tag file must have a unique name
+# (where the name does NOT include the path)
+# If a tag file is not located in the directory in which doxygen
+# is run, you must also specify the path to the tagfile here.
+
+TAGFILES               =
+
+# When a file name is specified after GENERATE_TAGFILE, doxygen will create
+# a tag file that is based on the input files it reads.
+
+GENERATE_TAGFILE       =
+
+# If the ALLEXTERNALS tag is set to YES all external classes will be listed
+# in the class index. If set to NO only the inherited external classes
+# will be listed.
+
+ALLEXTERNALS           = NO
+
+# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed
+# in the modules index. If set to NO, only the current project's groups will
+# be listed.
+
+EXTERNAL_GROUPS        = YES
+
+# The PERL_PATH should be the absolute path and name of the perl script
+# interpreter (i.e. the result of `which perl').
+
+PERL_PATH              = /usr/bin/perl
+
+#---------------------------------------------------------------------------
+# Configuration options related to the dot tool
+#---------------------------------------------------------------------------
+
+# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will
+# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base
+# or super classes. Setting the tag to NO turns the diagrams off. Note that
+# this option also works with HAVE_DOT disabled, but it is recommended to
+# install and use dot, since it yields more powerful graphs.
+
+CLASS_DIAGRAMS         = YES
+
+# You can define message sequence charts within doxygen comments using the \msc
+# command. Doxygen will then run the mscgen tool (see
+# http://www.mcternan.me.uk/mscgen/) to produce the chart and insert it in the
+# documentation. The MSCGEN_PATH tag allows you to specify the directory where
+# the mscgen tool resides. If left empty the tool is assumed to be found in the
+# default search path.
+
+MSCGEN_PATH            =
+
+# If set to YES, the inheritance and collaboration graphs will hide
+# inheritance and usage relations if the target is undocumented
+# or is not a class.
+
+HIDE_UNDOC_RELATIONS   = YES
+
+# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is
+# available from the path. This tool is part of Graphviz, a graph visualization
+# toolkit from AT&T and Lucent Bell Labs. The other options in this section
+# have no effect if this option is set to NO (the default)
+
+HAVE_DOT               = NO
+
+# The DOT_NUM_THREADS specifies the number of dot invocations doxygen is
+# allowed to run in parallel. When set to 0 (the default) doxygen will
+# base this on the number of processors available in the system. You can set it
+# explicitly to a value larger than 0 to get control over the balance
+# between CPU load and processing speed.
+
+DOT_NUM_THREADS        = 0
+
+# By default doxygen will write a font called Helvetica to the output
+# directory and reference it in all dot files that doxygen generates.
+# When you want a differently looking font you can specify the font name
+# using DOT_FONTNAME. You need to make sure dot is able to find the font,
+# which can be done by putting it in a standard location or by setting the
+# DOTFONTPATH environment variable or by setting DOT_FONTPATH to the directory
+# containing the font.
+
+DOT_FONTNAME           = Helvetica
+
+# The DOT_FONTSIZE tag can be used to set the size of the font of dot graphs.
+# The default size is 10pt.
+
+DOT_FONTSIZE           = 10
+
+# By default doxygen will tell dot to use the output directory to look for the
+# FreeSans.ttf font (which doxygen will put there itself). If you specify a
+# different font using DOT_FONTNAME you can set the path where dot
+# can find it using this tag.
+
+DOT_FONTPATH           =
+
+# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for each documented class showing the direct and
+# indirect inheritance relations. Setting this tag to YES will force the
+# the CLASS_DIAGRAMS tag to NO.
+
+CLASS_GRAPH            = YES
+
+# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for each documented class showing the direct and
+# indirect implementation dependencies (inheritance, containment, and
+# class references variables) of the class with other documented classes.
+
+COLLABORATION_GRAPH    = YES
+
+# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen
+# will generate a graph for groups, showing the direct groups dependencies
+
+GROUP_GRAPHS           = YES
+
+# If the UML_LOOK tag is set to YES doxygen will generate inheritance and
+# collaboration diagrams in a style similar to the OMG's Unified Modeling
+# Language.
+
+UML_LOOK               = NO
+
+# If set to YES, the inheritance and collaboration graphs will show the
+# relations between templates and their instances.
+
+TEMPLATE_RELATIONS     = NO
+
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT
+# tags are set to YES then doxygen will generate a graph for each documented
+# file showing the direct and indirect include dependencies of the file with
+# other documented files.
+
+INCLUDE_GRAPH          = YES
+
+# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and
+# HAVE_DOT tags are set to YES then doxygen will generate a graph for each
+# documented header file showing the documented files that directly or
+# indirectly include this file.
+
+INCLUDED_BY_GRAPH      = YES
+
+# If the CALL_GRAPH and HAVE_DOT options are set to YES then
+# doxygen will generate a call dependency graph for every global function
+# or class method. Note that enabling this option will significantly increase
+# the time of a run. So in most cases it will be better to enable call graphs
+# for selected functions only using the \callgraph command.
+
+CALL_GRAPH             = NO
+
+# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then
+# doxygen will generate a caller dependency graph for every global function
+# or class method. Note that enabling this option will significantly increase
+# the time of a run. So in most cases it will be better to enable caller
+# graphs for selected functions only using the \callergraph command.
+
+CALLER_GRAPH           = NO
+
+# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen
+# will generate a graphical hierarchy of all classes instead of a textual one.
+
+GRAPHICAL_HIERARCHY    = YES
+
+# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES
+# then doxygen will show the dependencies a directory has on other directories
+# in a graphical way. The dependency relations are determined by the #include
+# relations between the files in the directories.
+
+DIRECTORY_GRAPH        = YES
+
+# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images
+# generated by dot. Possible values are svg, png, jpg, or gif.
+# If left blank png will be used.
+
+DOT_IMAGE_FORMAT       = png
+
+# The tag DOT_PATH can be used to specify the path where the dot tool can be
+# found. If left blank, it is assumed the dot tool can be found in the path.
+
+DOT_PATH               = /usr/bin/dot
+
+# The DOTFILE_DIRS tag can be used to specify one or more directories that
+# contain dot files that are included in the documentation (see the
+# \dotfile command).
+
+DOTFILE_DIRS           =
+
+# The MSCFILE_DIRS tag can be used to specify one or more directories that
+# contain msc files that are included in the documentation (see the
+# \mscfile command).
+
+MSCFILE_DIRS           =
+
+# The DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of
+# nodes that will be shown in the graph. If the number of nodes in a graph
+# becomes larger than this value, doxygen will truncate the graph, which is
+# visualized by representing a node as a red box. Note that doxygen if the
+# number of direct children of the root node in a graph is already larger than
+# DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note
+# that the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH.
+
+DOT_GRAPH_MAX_NODES    = 50
+
+# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the
+# graphs generated by dot. A depth value of 3 means that only nodes reachable
+# from the root by following a path via at most 3 edges will be shown. Nodes
+# that lay further from the root node will be omitted. Note that setting this
+# option to 1 or 2 may greatly reduce the computation time needed for large
+# code bases. Also note that the size of a graph can be further restricted by
+# DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction.
+
+MAX_DOT_GRAPH_DEPTH    = 0
+
+# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent
+# background. This is disabled by default, because dot on Windows does not
+# seem to support this out of the box. Warning: Depending on the platform used,
+# enabling this option may lead to badly anti-aliased labels on the edges of
+# a graph (i.e. they become hard to read).
+
+DOT_TRANSPARENT        = NO
+
+# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output
+# files in one run (i.e. multiple -o and -T options on the command line). This
+# makes dot run faster, but since only newer versions of dot (>1.8.10)
+# support this, this feature is disabled by default.
+
+DOT_MULTI_TARGETS      = NO
+
+# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will
+# generate a legend page explaining the meaning of the various boxes and
+# arrows in the dot generated graphs.
+
+GENERATE_LEGEND        = YES
+
+# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will
+# remove the intermediate dot files that are used to generate
+# the various graphs.
+
+DOT_CLEANUP            = YES
diff --git a/src/shared/libosmocore/Makefile.am b/src/shared/libosmocore/Makefile.am
new file mode 100644
index 00000000..c9b7ccd9
--- /dev/null
+++ b/src/shared/libosmocore/Makefile.am
@@ -0,0 +1,56 @@
+ACLOCAL_AMFLAGS = -I m4
+
+INCLUDES = $(all_includes) -I$(top_srcdir)/include
+SUBDIRS = include src src/vty src/codec src/gsm src/gb tests utils
+
+pkgconfigdir = $(libdir)/pkgconfig
+pkgconfig_DATA = libosmocore.pc libosmocodec.pc libosmovty.pc libosmogsm.pc \
+		 libosmogb.pc
+
+BUILT_SOURCES = $(top_srcdir)/.version
+$(top_srcdir)/.version:
+	echo $(VERSION) > $@-t && mv $@-t $@
+dist-hook:
+	echo $(VERSION) > $(distdir)/.tarball-version
+
+EXTRA_DIST = git-version-gen
+
+if HAVE_DOXYGEN
+
+html_DATA = $(top_builddir)/doc/html.tar
+
+$(html_DATA): $(top_builddir)/doc/core/html/index.html \
+		  $(top_builddir)/doc/gsm/html/index.html \
+		  $(top_builddir)/doc/vty/html/index.html \
+		  $(top_builddir)/doc/codec/html/index.html
+	cd $(top_builddir)/doc && tar cf html.tar */html
+
+$(top_builddir)/doc/core/html/index.html: $(SOURCES) Doxyfile.core
+	@rm -rf doc/core
+	mkdir -p doc/core
+	$(DOXYGEN) Doxyfile.core
+
+$(top_builddir)/doc/gsm/html/index.html: $(SOURCES) Doxyfile.gsm
+	@rm -rf doc/gsm
+	mkdir -p doc/gsm
+	$(DOXYGEN) Doxyfile.gsm
+
+$(top_builddir)/doc/vty/html/index.html: $(SOURCES) Doxyfile.vty
+	@rm -rf doc/vty/{html,latex}
+	$(DOXYGEN) Doxyfile.vty
+
+$(top_builddir)/doc/codec/html/index.html: $(SOURCES) Doxyfile.codec
+	@rm -rf doc/codec
+	mkdir -p doc/codec
+	$(DOXYGEN) Doxyfile.codec
+
+install-data-hook:
+	cd $(DESTDIR)$(htmldir) && tar xf html.tar && rm -f html.tar
+
+uninstall-hook:
+	cd $(DESTDIR)$(htmldir) && rm -rf {core,gsm,vty,codec}
+
+DX_CLEAN = doc/{core,gsm,vty,codec}/{html,latex}/* doc/html.tar
+endif
+
+MOSTLYCLEANFILES = $(DX_CLEAN)
diff --git a/src/shared/libosmocore/configure.ac b/src/shared/libosmocore/configure.ac
new file mode 100644
index 00000000..24ddd0c7
--- /dev/null
+++ b/src/shared/libosmocore/configure.ac
@@ -0,0 +1,198 @@
+AC_INIT([libosmocore],
+	m4_esyscmd([./git-version-gen .tarball-version]),
+	[openbsc@lists.osmocom.org])
+
+AM_INIT_AUTOMAKE([foreign dist-bzip2 no-dist-gzip 1.6])
+AC_CONFIG_TESTDIR(tests)
+
+dnl kernel style compile messages
+m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
+
+dnl checks for programs
+AC_PROG_MAKE_SET
+AC_PROG_MKDIR_P
+AC_PROG_CC
+AC_PROG_INSTALL
+LT_INIT([pic-only])
+
+AC_CONFIG_MACRO_DIR([m4])
+
+dnl check os: some linker flags not available on osx
+case $host in
+*-darwin*)
+	;;
+*)
+	LTLDFLAGS_OSMOGB='-Wl,--version-script=$(srcdir)/libosmogb.map'
+	LTLDFLAGS_OSMOGSM='-Wl,--version-script=$(srcdir)/libosmogsm.map'
+	;;
+esac
+AC_SUBST(LTLDFLAGS_OSMOGB)
+AC_SUBST(LTLDFLAGS_OSMOGSM)
+
+dnl checks for header files
+AC_HEADER_STDC
+AC_CHECK_HEADERS(execinfo.h sys/select.h sys/socket.h syslog.h ctype.h)
+# for src/conv.c
+AC_FUNC_ALLOCA
+AC_SEARCH_LIBS([dlopen], [dl dld], [LIBRARY_DL="$LIBS";LIBS=""])
+AC_SUBST(LIBRARY_DL)
+
+AC_PATH_PROG(DOXYGEN,doxygen,false)
+AM_CONDITIONAL(HAVE_DOXYGEN, test $DOXYGEN != false)
+
+# The following test is taken from WebKit's webkit.m4
+saved_CFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -fvisibility=hidden "
+AC_MSG_CHECKING([if ${CC} supports -fvisibility=hidden])
+AC_COMPILE_IFELSE([AC_LANG_SOURCE([char foo;])],
+      [ AC_MSG_RESULT([yes])
+        SYMBOL_VISIBILITY="-fvisibility=hidden"],
+        AC_MSG_RESULT([no]))
+CFLAGS="$saved_CFLAGS"
+AC_SUBST(SYMBOL_VISIBILITY)
+
+AC_DEFUN([CHECK_TM_INCLUDES_TM_GMTOFF], [
+  AC_CACHE_CHECK(
+    [whether struct tm has tm_gmtoff member],
+    osmo_cv_tm_includes_tm_gmtoff,
+    [AC_LINK_IFELSE([
+      AC_LANG_PROGRAM([
+        #include <time.h>
+      ], [
+        time_t t = time(NULL);
+        struct tm* lt = localtime(&t);
+        int off = lt->tm_gmtoff;
+      ])
+    ],
+    osmo_cv_tm_includes_tm_gmtoff=yes,
+    osmo_cv_tm_includes_tm_gmtoff=no
+    )]
+  )
+  if test "x$osmo_cv_tm_includes_tm_gmtoff" = xyes; then
+    AC_DEFINE(HAVE_TM_GMTOFF_IN_TM, 1,
+              [Define if struct tm has tm_gmtoff member.])
+  fi
+])
+
+CHECK_TM_INCLUDES_TM_GMTOFF
+
+dnl Generate the output
+AM_CONFIG_HEADER(config.h)
+
+AC_ARG_ENABLE(talloc,
+	[AS_HELP_STRING(
+		[--disable-talloc],
+		[Disable building talloc memory allocator]
+	)],
+	[enable_talloc=$enableval], [enable_talloc="yes"])
+AM_CONDITIONAL(ENABLE_TALLOC, [test x"$enable_talloc" = x"yes"])
+
+AC_ARG_ENABLE(plugin,
+	[AS_HELP_STRING(
+		[--disable-plugin],
+		[Disable support for dlopen plugins],
+	)],
+	[enable_plugin=$enableval], [enable_plugin="yes"])
+AM_CONDITIONAL(ENABLE_PLUGIN, test x"$enable_plugin" = x"yes")
+
+AC_ARG_ENABLE(vty,
+	[AS_HELP_STRING(
+		[--disable-vty],
+		[Disable building VTY telnet interface]
+	)],
+	[enable_vty=$enableval], [enable_vty="yes"])
+AM_CONDITIONAL(ENABLE_VTY, test x"$enable_vty" = x"yes")
+
+AC_ARG_ENABLE(panic_infloop,
+	[AS_HELP_STRING(
+		[--enable-panic-infloop],
+		[Trigger infinite loop on panic rather than fprintf/abort]
+	)],
+	[panic_infloop=$enableval], [panic_infloop="no"])
+if test x"$panic_infloop" = x"yes"
+then
+	AC_DEFINE([PANIC_INFLOOP],[1],[Use infinite loop on panic rather than fprintf/abort])
+fi
+
+AC_ARG_ENABLE(bsc_fd_check,
+	[AS_HELP_STRING(
+		[--enable-bsc-fd-check],
+		[Instrument bsc_register_fd to check that the fd is registered]
+	)],
+	[fd_check=$enableval], [fd_check="no"])
+if test x"$fd_check" = x"no"
+then
+	AC_DEFINE([BSC_FD_CHECK],[1],[Instrument the bsc_register_fd])
+fi
+
+AC_ARG_ENABLE(msgfile,
+	[AS_HELP_STRING(
+		[--disable-msgfile],
+		[Disable support for the msgfile],
+	)],
+	[enable_msgfile=$enableval], [enable_msgfile="yes"])
+AM_CONDITIONAL(ENABLE_MSGFILE, test x"$enable_msgfile" = x"yes")
+
+AC_ARG_ENABLE(serial,
+	[AS_HELP_STRING(
+		[--disable-serial],
+		[Disable support for the serial helpers],
+	)],
+	[enable_serial=$enableval], [enable_serial="yes"])
+AM_CONDITIONAL(ENABLE_SERIAL, test x"$enable_serial" = x"yes")
+
+AC_ARG_ENABLE(utilities,
+        [AS_HELP_STRING(
+                [--disable-utilities],
+                [Disable building utility programs],
+        )],
+        [enable_utilities=$enableval], [enable_utilities="yes"])
+AM_CONDITIONAL(ENABLE_UTILITIES, test x"$enable_utilities" = x"yes")
+
+AC_ARG_ENABLE(gb,
+        [AS_HELP_STRING(
+                [--disable-gb],
+                [Disable building Gb library],
+        )],
+        [enable_gb=$enableval], [enable_gb="yes"])
+AM_CONDITIONAL(ENABLE_GB, test x"$enable_gb" = x"yes")
+
+AC_ARG_ENABLE(embedded,
+	[AS_HELP_STRING(
+		[--enable-embedded],
+		[Enable building for embedded use and disable unsupported features]
+	)],
+	[embedded=$enableval], [embedded="no"])
+if test x"$embedded" = x"yes"
+then
+	AC_DEFINE([EMBEDDED],[1],[Select building for embedded use])
+	AM_CONDITIONAL(ENABLE_PLUGIN, false)
+	AM_CONDITIONAL(ENABLE_MSGFILE, false)
+	AM_CONDITIONAL(ENABLE_SERIAL, false)
+	AM_CONDITIONAL(ENABLE_VTY, false)
+	AM_CONDITIONAL(ENABLE_TALLOC, false)
+	AM_CONDITIONAL(ENABLE_UTILITIES, false)
+	AM_CONDITIONAL(ENABLE_GB, false)
+	AC_DEFINE([PANIC_INFLOOP],[1],[Use infinite loop on panic rather than fprintf/abort])
+fi
+
+
+AC_OUTPUT(
+	libosmocore.pc
+	libosmocodec.pc
+	libosmovty.pc
+	libosmogsm.pc
+	libosmogb.pc
+	include/Makefile
+	src/Makefile
+	src/vty/Makefile
+	src/codec/Makefile
+	src/gsm/Makefile
+	src/gb/Makefile
+	tests/Makefile
+	utils/Makefile
+	Doxyfile.core
+	Doxyfile.gsm
+	Doxyfile.vty
+	Doxyfile.codec
+	Makefile)
diff --git a/src/shared/libosmocore/debian/changelog b/src/shared/libosmocore/debian/changelog
new file mode 100644
index 00000000..c2b221b1
--- /dev/null
+++ b/src/shared/libosmocore/debian/changelog
@@ -0,0 +1,35 @@
+libosmocore (0.5.3+git1-2) unstable; urgency=low
+
+  * New upstream version 
+
+ -- Holger Hans Peter Freyther <holger@freyther.de>  Mon, 05 Nov 2012 21:35:57 +0100
+
+libosmocore (0.5.3+git1-1) precise; urgency=low
+
+  * Fix issue with package version.
+
+ -- Eric Butler <eric@codebutler.com>  Tue, 14 Aug 2012 20:43:17 -0700
+
+libosmocore (0.5.3+git1) precise; urgency=low
+
+  * Updated debian package.
+
+ -- Eric Butler <eric@codebutler.com>  Tue, 14 Aug 2012 16:53:56 -0700
+
+libosmocore (0.3.0) natty; urgency=low
+
+  * New upstream version of libosmocore
+
+ -- Harald Welte <laforge@gnumonks.org>  Tue, 10 May 2011 17:28:24 +0200
+
+libosmocore (0.1.27) natty; urgency=low
+
+  * New upstream version of libosmocore.
+
+ -- Holger Hans Peter Freyther <holger@freyther.de>  Thu, 13 Jan 2011 18:07:36 +0800
+
+libosmocore (0.1.17-1) unstable; urgency=low
+
+  * Initial release (Closes: #nnnn)  <nnnn is the bug number of your ITP>
+
+ -- Harald Welte <laforge@gnumonks.org>  Tue, 24 Aug 2010 10:55:04 +0200
diff --git a/src/shared/libosmocore/debian/compat b/src/shared/libosmocore/debian/compat
new file mode 100644
index 00000000..7f8f011e
--- /dev/null
+++ b/src/shared/libosmocore/debian/compat
@@ -0,0 +1 @@
+7
diff --git a/src/shared/libosmocore/debian/control b/src/shared/libosmocore/debian/control
new file mode 100644
index 00000000..cd8398fd
--- /dev/null
+++ b/src/shared/libosmocore/debian/control
@@ -0,0 +1,27 @@
+Source: libosmocore
+Section: libs
+Priority: optional
+Maintainer: Harald Welte <laforge@gnumonks.org>
+Build-Depends: debhelper (>= 7.0.50~), autotools-dev, autoconf, automake, libtool, dh-autoreconf, libdpkg-perl, git, doxygen
+Standards-Version: 3.8.4
+Homepage: http://bb.osmocom.org/trac/wiki/libosmocore
+Vcs-Git: git://git.osmocom.org/libosmocore.git
+Vcs-Browser: http://git.osmocom.org/gitweb?p=libosmocore.git;a=summary
+
+Package: libosmocore
+Section: libs
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: Open Source MObile COMmunications CORE library
+
+Package: libosmocore-dev
+Section: libdevel
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, libosmocore
+Description: Development headers for Open Source MObile COMmunications CORE library
+
+#Package: libosmocore-dbg
+#Section: libdevel
+#Architecture: any
+#Depends: ${shlibs:Depends}, ${misc:Depends}
+#Description: Debug symbols for Open Source MObile COMmunications CORE library
diff --git a/src/shared/libosmocore/debian/copyright b/src/shared/libosmocore/debian/copyright
new file mode 100644
index 00000000..c450be58
--- /dev/null
+++ b/src/shared/libosmocore/debian/copyright
@@ -0,0 +1,54 @@
+This work was packaged for Debian by:
+
+    Harald Welte <laforge@gnumonks.org> on Tue, 24 Aug 2010 10:55:04 +0200
+
+It was downloaded from:
+
+    git://git.osmocom.org/libosmocore.git
+
+Upstream Author(s):
+
+    Harald Welte <laforge@gnumonks.org>
+    Holger Hans Peter Freyther <zecke@selfish.org>
+    Sylvain Munaut <tnt@246tNt.com>
+    Daniel Willmann <daniel@totalueberwachung.de>
+    Golde <nico@ngolde.de>
+	For src/talloc.c and include/osmocore/talloc.h:
+    Andrew Tridgell
+    Stefan Metzmacher
+	For src/vty/* and include/osmocom/vty/*
+    Kunihiro Ishiguro
+
+Copyright:
+
+    Copyright (C) 2008-2010 Harald Welte <laforge@gnumonks.org>
+    Copyright (C) 2008-2010 Holger Hans Peter Freyther <zecke@selfish.org>
+    Copyright (C) 2009-2010 Sylvain Munaut <tnt@246tNt.com>
+    Copyright (C) 2009-2010 On-Waves
+    Copyright (C) 2008 Daniel Willmann <daniel@totalueberwachung.de>
+    Copyright (C) 2010 Nico Golde <nico@ngolde.de>
+	For src/talloc.c and include/osmocore/talloc.h:
+    Copyright (C) 2004 Andrew Tridgell
+    Copyright (C) 2006 Stefan Metzmacher
+	For src/vty/* and include/osmocom/vty/*
+    Copyright (C) 1998 Kunihiro Ishiguro
+
+License:
+
+    GNU General Public License, Version 2 or later
+
+The Debian packaging is:
+
+    Copyright (C) 2010 Harald Welte <laforge@gnumonks.org>
+
+# Please chose a license for your packaging work. If the program you package
+# uses a mainstream license, using the same license is the safest choice.
+# Please avoid to pick license terms that are more restrictive than the
+# packaged work, as it may make Debian's contributions unacceptable upstream.
+# If you just want it to be GPL version 3, leave the following lines in.
+
+and is licensed under the GPL version 3,
+see "/usr/share/common-licenses/GPL-3".
+
+# Please also look if there are files or directories which have a
+# different copyright/license attached and list them here.
diff --git a/src/shared/libosmocore/debian/docs b/src/shared/libosmocore/debian/docs
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/src/shared/libosmocore/debian/docs
diff --git a/src/shared/libosmocore/debian/libosmocore-dbg.dirs b/src/shared/libosmocore/debian/libosmocore-dbg.dirs
new file mode 100644
index 00000000..af59b0a9
--- /dev/null
+++ b/src/shared/libosmocore/debian/libosmocore-dbg.dirs
@@ -0,0 +1 @@
+usr/lib/debug/lib
diff --git a/src/shared/libosmocore/debian/libosmocore-dbg.install b/src/shared/libosmocore/debian/libosmocore-dbg.install
new file mode 100644
index 00000000..7ce02127
--- /dev/null
+++ b/src/shared/libosmocore/debian/libosmocore-dbg.install
@@ -0,0 +1 @@
+usr/lib/debug/lib/*
diff --git a/src/shared/libosmocore/debian/libosmocore-dev.dirs b/src/shared/libosmocore/debian/libosmocore-dev.dirs
new file mode 100644
index 00000000..94090a39
--- /dev/null
+++ b/src/shared/libosmocore/debian/libosmocore-dev.dirs
@@ -0,0 +1,8 @@
+usr/lib
+usr/include
+usr/include/osmocom
+usr/include/osmocom/codec
+usr/include/osmocom/core
+usr/include/osmocom/crypt
+usr/include/osmocom/gsm
+usr/include/osmocom/vty
diff --git a/src/shared/libosmocore/debian/libosmocore-dev.install b/src/shared/libosmocore/debian/libosmocore-dev.install
new file mode 100644
index 00000000..eec0e15e
--- /dev/null
+++ b/src/shared/libosmocore/debian/libosmocore-dev.install
@@ -0,0 +1,5 @@
+usr/include/*
+usr/lib/lib*.a
+usr/lib/lib*.so
+usr/lib/lib*.la
+usr/lib/pkgconfig/*
diff --git a/src/shared/libosmocore/debian/libosmocore.dirs b/src/shared/libosmocore/debian/libosmocore.dirs
new file mode 100644
index 00000000..94090a39
--- /dev/null
+++ b/src/shared/libosmocore/debian/libosmocore.dirs
@@ -0,0 +1,8 @@
+usr/lib
+usr/include
+usr/include/osmocom
+usr/include/osmocom/codec
+usr/include/osmocom/core
+usr/include/osmocom/crypt
+usr/include/osmocom/gsm
+usr/include/osmocom/vty
diff --git a/src/shared/libosmocore/debian/libosmocore.install b/src/shared/libosmocore/debian/libosmocore.install
new file mode 100644
index 00000000..93302609
--- /dev/null
+++ b/src/shared/libosmocore/debian/libosmocore.install
@@ -0,0 +1,2 @@
+usr/lib/lib*.so.*
+usr/share/doc/libosmocore/*
diff --git a/src/shared/libosmocore/debian/patches/debian-changes-0.1.17-1 b/src/shared/libosmocore/debian/patches/debian-changes-0.1.17-1
new file mode 100644
index 00000000..c0a54bd7
--- /dev/null
+++ b/src/shared/libosmocore/debian/patches/debian-changes-0.1.17-1
@@ -0,0 +1,46 @@
+Description: Upstream changes introduced in version 0.1.17-1
+ This patch has been created by dpkg-source during the package build.
+ Here's the last changelog entry, hopefully it gives details on why
+ those changes were made:
+ .
+ libosmocore (0.1.17-1) unstable; urgency=low
+ .
+   * Initial release (Closes: #nnnn)  <nnnn is the bug number of your ITP>
+ .
+ The person named in the Author field signed this changelog entry.
+Author: Harald Welte <laforge@gnumonks.org>
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: <vendor|upstream|other>, <url of original patch>
+Bug: <url in upstream bugtracker>
+Bug-Debian: http://bugs.debian.org/<bugnumber>
+Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
+Forwarded: <no|not-needed|url proving that it has been forwarded>
+Reviewed-By: <name and email of someone who approved the patch>
+Last-Update: <YYYY-MM-DD>
+
+--- /dev/null
++++ libosmocore-0.1.17/.version
+@@ -0,0 +1 @@
++0.1.17
+--- /dev/null
++++ libosmocore-0.1.17/copyright
+@@ -0,0 +1,14 @@
++Format-Specification: http://svn.debian.org/wsvn/dep/web/deps/dep5.mdwn?op=file&rev=135
++Name: libosmocore
++Maintainer: Harald Welte <laforge@gnumonks.org>
++Source: git://git.osmocom.org/libosmocore.git
++
++Copyright: 2008-2010 Harald Welte <laforge@gnumonks.org>
++License: GPL-2+
++
++Files: src/talloc.c include/osmocore/talloc.h
++Copyright: 2004 Andrew Tridgell
++License: LGPL-3+
++
++Files: include/osmocore/linuxlist.h
++License: GPL-2
diff --git a/src/shared/libosmocore/debian/patches/series b/src/shared/libosmocore/debian/patches/series
new file mode 100644
index 00000000..0ca407b1
--- /dev/null
+++ b/src/shared/libosmocore/debian/patches/series
@@ -0,0 +1 @@
+debian-changes-0.1.17-1
diff --git a/src/shared/libosmocore/debian/rules b/src/shared/libosmocore/debian/rules
new file mode 100755
index 00000000..f97995d5
--- /dev/null
+++ b/src/shared/libosmocore/debian/rules
@@ -0,0 +1,25 @@
+#!/usr/bin/make -f
+# -*- makefile -*-
+# Sample debian/rules that uses debhelper.
+# This file was originally written by Joey Hess and Craig Small.
+# As a special exception, when this file is copied by dh-make into a
+# dh-make output file, you may use that output file without restriction.
+# This special exception was added by Craig Small in version 0.37 of dh-make.
+
+# Uncomment this to turn on verbose mode.
+#export DH_VERBOSE=1
+
+DEBIAN  := $(shell dpkg-parsechangelog | grep ^Version: | cut -d' ' -f2)
+DEBVERS := $(shell echo '$(DEBIAN)' | cut -d- -f1)
+VERSION := $(shell echo '$(DEBVERS)' | sed -e 's/[+-].*//' -e 's/~//g')
+
+%:
+	dh --with autoreconf $@ --fail-missing
+
+#override_dh_strip:
+#	dh_strip --dbg-package=libosmocore-dbg
+
+override_dh_autoreconf:
+	echo $(VERSION) > .tarball-version
+	dh_autoreconf
+
diff --git a/src/shared/libosmocore/debian/source/format b/src/shared/libosmocore/debian/source/format
new file mode 100644
index 00000000..89ae9db8
--- /dev/null
+++ b/src/shared/libosmocore/debian/source/format
@@ -0,0 +1 @@
+3.0 (native)
diff --git a/src/shared/libosmocore/doc/.empty b/src/shared/libosmocore/doc/.empty
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/src/shared/libosmocore/doc/.empty
diff --git a/src/shared/libosmocore/doc/vty/example.xml b/src/shared/libosmocore/doc/vty/example.xml
new file mode 100644
index 00000000..400c6340
--- /dev/null
+++ b/src/shared/libosmocore/doc/vty/example.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<vtydoc xmlns="urn:osmocom:xml:libosmocore:vty:doc:1.0">
+    <!-- test a nested hierachy -->
+    <node id="mgcp" name="MGCP Node">
+	<!-- define a command -->
+	<command id="foo_cmd">
+		<doc>General docs</doc>
+		<params>
+			<param name="do" doc="Explain do" />
+			<param name="fo" doc="Explain foo" />
+		</params>
+	</command>
+	<command id="foo_cmd">
+		<doc>General docs</doc>
+		<params>
+			<param name="do" doc="Explain do" />
+			<param name="fo" doc="Explain foo" />
+		</params>
+	</command>
+
+    </node>
+</vtydoc>
diff --git a/src/shared/libosmocore/doc/vty/merge_doc.xsl b/src/shared/libosmocore/doc/vty/merge_doc.xsl
new file mode 100644
index 00000000..caea1103
--- /dev/null
+++ b/src/shared/libosmocore/doc/vty/merge_doc.xsl
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<xsl:transform version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+                             xmlns:vty="urn:osmocom:xml:libosmocore:vty:doc:1.0">
+  <xsl:output method="xml" version="1.0" encoding="UTF-8" indent="yes" />
+
+
+  <xsl:template match="@*|node()">
+    <xsl:copy>
+      <xsl:apply-templates select="@*|node()" />
+    </xsl:copy>
+  </xsl:template>
+
+
+  <!-- Copy the name of the node -->
+  <xsl:template match="vty:node">
+    <xsl:variable name="info" select="document($with)/vty:vtydoc/vty:node[@id=current()/@id]/." />
+    <xsl:if test="not($info/vty:hide)">
+      <xsl:copy>
+        <xsl:apply-templates select="@*|node()" />
+          <xsl:for-each select="$info/*">
+            <xsl:copy-of select="." />
+          </xsl:for-each>
+      </xsl:copy>
+    </xsl:if>
+  </xsl:template>
+
+
+  <!-- Copy command and add nodes -->
+  <xsl:template match="vty:command">
+    <xsl:variable name="info" select="document($with)/vty:vtydoc/vty:node[@id=current()/../@id]/vty:command[@id=current()/@id]/." />
+    <xsl:variable name="info_generic" select="document($with)/vty:vtydoc/vty:common/vty:command[@id=current()/@id]/." />
+    <xsl:copy>
+      <xsl:apply-templates select="@*|node()" />
+
+      <!-- Copy the specific issue... -->
+      <xsl:for-each select="$info/*">
+        <xsl:copy-of select="." />
+      </xsl:for-each>
+
+      <xsl:if test="not($info)">
+        <xsl:for-each select="$info_generic/*">
+            <xsl:copy-of select="." />
+        </xsl:for-each>
+      </xsl:if>
+    </xsl:copy>
+  </xsl:template>
+</xsl:transform>
+
diff --git a/src/shared/libosmocore/doc/vty/vtydoc.xsd b/src/shared/libosmocore/doc/vty/vtydoc.xsd
new file mode 100644
index 00000000..53a67a36
--- /dev/null
+++ b/src/shared/libosmocore/doc/vty/vtydoc.xsd
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xs:schema
+    xmlns="urn:osmocom:xml:libosmocore:vty:doc:1.0"
+    xmlns:xs="http://www.w3.org/2001/XMLSchema"
+    targetNamespace="urn:osmocom:xml:libosmocore:vty:doc:1.0"
+    elementFormDefault="qualified"
+    attributeFormDefault="unqualified">
+
+    <xs:complexType name="ParamType">
+        <xs:attribute name="name" type="xs:string" use="required" />
+        <xs:attribute name="doc" type="xs:string" use="required" />
+    </xs:complexType>
+
+    <xs:complexType name="ParamsType">
+        <xs:sequence>
+            <xs:element name="param" type="ParamType" maxOccurs="unbounded" />
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="CommandType">
+        <xs:sequence>
+            <xs:element name="doc" type="xs:string" minOccurs="0" maxOccurs="1" />
+            <xs:element name="params" type="ParamsType" minOccurs="1" maxOccurs="1"/>
+            <xs:element name="enter" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
+        </xs:sequence>
+        <xs:attribute name="id" type="xs:string" use="required" />
+    </xs:complexType>
+
+    <xs:complexType name="NodeType">
+	<xs:sequence>
+		<xs:element name="command" type="CommandType" minOccurs="0" maxOccurs="unbounded"/>
+	</xs:sequence>
+        <xs:attribute name="id" type="xs:anyURI"/>
+        <xs:attribute name="name" type="xs:string"/>
+    </xs:complexType>
+
+    <!-- the main entry -->
+    <xs:element name="vtydoc">
+        <xs:complexType>
+            <xs:sequence>
+                <xs:element name="node" type="NodeType" minOccurs="0" maxOccurs="unbounded"/>
+            </xs:sequence>
+        </xs:complexType>
+    </xs:element>
+</xs:schema>
+
diff --git a/src/shared/libosmocore/git-version-gen b/src/shared/libosmocore/git-version-gen
new file mode 100755
index 00000000..42cf3d2b
--- /dev/null
+++ b/src/shared/libosmocore/git-version-gen
@@ -0,0 +1,151 @@
+#!/bin/sh
+# Print a version string.
+scriptversion=2010-01-28.01
+
+# Copyright (C) 2007-2010 Free Software Foundation, Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# This script is derived from GIT-VERSION-GEN from GIT: http://git.or.cz/.
+# It may be run two ways:
+# - from a git repository in which the "git describe" command below
+#   produces useful output (thus requiring at least one signed tag)
+# - from a non-git-repo directory containing a .tarball-version file, which
+#   presumes this script is invoked like "./git-version-gen .tarball-version".
+
+# In order to use intra-version strings in your project, you will need two
+# separate generated version string files:
+#
+# .tarball-version - present only in a distribution tarball, and not in
+#   a checked-out repository.  Created with contents that were learned at
+#   the last time autoconf was run, and used by git-version-gen.  Must not
+#   be present in either $(srcdir) or $(builddir) for git-version-gen to
+#   give accurate answers during normal development with a checked out tree,
+#   but must be present in a tarball when there is no version control system.
+#   Therefore, it cannot be used in any dependencies.  GNUmakefile has
+#   hooks to force a reconfigure at distribution time to get the value
+#   correct, without penalizing normal development with extra reconfigures.
+#
+# .version - present in a checked-out repository and in a distribution
+#   tarball.  Usable in dependencies, particularly for files that don't
+#   want to depend on config.h but do want to track version changes.
+#   Delete this file prior to any autoconf run where you want to rebuild
+#   files to pick up a version string change; and leave it stale to
+#   minimize rebuild time after unrelated changes to configure sources.
+#
+# It is probably wise to add these two files to .gitignore, so that you
+# don't accidentally commit either generated file.
+#
+# Use the following line in your configure.ac, so that $(VERSION) will
+# automatically be up-to-date each time configure is run (and note that
+# since configure.ac no longer includes a version string, Makefile rules
+# should not depend on configure.ac for version updates).
+#
+# AC_INIT([GNU project],
+#         m4_esyscmd([build-aux/git-version-gen .tarball-version]),
+#         [bug-project@example])
+#
+# Then use the following lines in your Makefile.am, so that .version
+# will be present for dependencies, and so that .tarball-version will
+# exist in distribution tarballs.
+#
+# BUILT_SOURCES = $(top_srcdir)/.version
+# $(top_srcdir)/.version:
+#	echo $(VERSION) > $@-t && mv $@-t $@
+# dist-hook:
+#	echo $(VERSION) > $(distdir)/.tarball-version
+
+case $# in
+    1) ;;
+    *) echo 1>&2 "Usage: $0 \$srcdir/.tarball-version"; exit 1;;
+esac
+
+tarball_version_file=$1
+nl='
+'
+
+# First see if there is a tarball-only version file.
+# then try "git describe", then default.
+if test -f $tarball_version_file
+then
+    v=`cat $tarball_version_file` || exit 1
+    case $v in
+	*$nl*) v= ;; # reject multi-line output
+	[0-9]*) ;;
+	*) v= ;;
+    esac
+    test -z "$v" \
+	&& echo "$0: WARNING: $tarball_version_file seems to be damaged" 1>&2
+fi
+
+if test -n "$v"
+then
+    : # use $v
+elif
+       v=`git describe --abbrev=4 --match='v*' HEAD 2>/dev/null \
+	  || git describe --abbrev=4 HEAD 2>/dev/null` \
+    && case $v in
+	 [0-9]*) ;;
+	 v[0-9]*) ;;
+	 *) (exit 1) ;;
+       esac
+then
+    # Is this a new git that lists number of commits since the last
+    # tag or the previous older version that did not?
+    #   Newer: v6.10-77-g0f8faeb
+    #   Older: v6.10-g0f8faeb
+    case $v in
+	*-*-*) : git describe is okay three part flavor ;;
+	*-*)
+	    : git describe is older two part flavor
+	    # Recreate the number of commits and rewrite such that the
+	    # result is the same as if we were using the newer version
+	    # of git describe.
+	    vtag=`echo "$v" | sed 's/-.*//'`
+	    numcommits=`git rev-list "$vtag"..HEAD | wc -l`
+	    v=`echo "$v" | sed "s/\(.*\)-\(.*\)/\1-$numcommits-\2/"`;
+	    ;;
+    esac
+
+    # Change the first '-' to a '.', so version-comparing tools work properly.
+    # Remove the "g" in git describe's output string, to save a byte.
+    v=`echo "$v" | sed 's/-/./;s/\(.*\)-g/\1-/'`;
+else
+    v=UNKNOWN
+fi
+
+v=`echo "$v" |sed 's/^v//'`
+
+# Don't declare a version "dirty" merely because a time stamp has changed.
+git status > /dev/null 2>&1
+
+dirty=`sh -c 'git diff-index --name-only HEAD' 2>/dev/null` || dirty=
+case "$dirty" in
+    '') ;;
+    *) # Append the suffix only if there isn't one already.
+	case $v in
+	  *-dirty) ;;
+	  *) v="$v-dirty" ;;
+	esac ;;
+esac
+
+# Omit the trailing newline, so that m4_esyscmd can use the result directly.
+echo "$v" | tr -d '\012'
+
+# Local variables:
+# eval: (add-hook 'write-file-hooks 'time-stamp)
+# time-stamp-start: "scriptversion="
+# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-end: "$"
+# End:
diff --git a/src/shared/libosmocore/include/Makefile.am b/src/shared/libosmocore/include/Makefile.am
new file mode 100644
index 00000000..60b9ea9f
--- /dev/null
+++ b/src/shared/libosmocore/include/Makefile.am
@@ -0,0 +1,104 @@
+nobase_include_HEADERS = \
+                       osmocom/codec/codec.h \
+                       osmocom/core/application.h \
+                       osmocom/core/backtrace.h \
+                       osmocom/core/bits.h \
+                       osmocom/core/bitvec.h \
+                       osmocom/core/conv.h \
+                       osmocom/core/crc16.h \
+                       osmocom/core/crc16gen.h \
+                       osmocom/core/crc32gen.h \
+                       osmocom/core/crc64gen.h \
+                       osmocom/core/crc8gen.h \
+                       osmocom/core/crcgen.h \
+                       osmocom/core/gsmtap.h \
+                       osmocom/core/gsmtap_util.h \
+                       osmocom/core/linuxlist.h \
+                       osmocom/core/linuxrbtree.h \
+                       osmocom/core/logging.h \
+                       osmocom/core/msgb.h \
+                       osmocom/core/panic.h \
+                       osmocom/core/prim.h \
+                       osmocom/core/process.h \
+                       osmocom/core/rate_ctr.h \
+                       osmocom/core/select.h \
+                       osmocom/core/signal.h \
+                       osmocom/core/socket.h \
+                       osmocom/core/statistics.h \
+                       osmocom/core/timer.h \
+                       osmocom/core/utils.h \
+                       osmocom/core/write_queue.h \
+                       osmocom/crypt/auth.h \
+                       osmocom/crypt/gprs_cipher.h \
+                       osmocom/gprs/gprs_bssgp.h \
+                       osmocom/gprs/gprs_bssgp_bss.h \
+                       osmocom/gprs/gprs_msgb.h \
+                       osmocom/gprs/gprs_ns.h \
+                       osmocom/gprs/gprs_ns_frgre.h \
+                       osmocom/gprs/protocol/gsm_08_16.h \
+                       osmocom/gprs/protocol/gsm_08_18.h \
+                       osmocom/gsm/a5.h \
+                       osmocom/gsm/abis_nm.h \
+                       osmocom/gsm/comp128.h \
+                       osmocom/gsm/gan.h \
+                       osmocom/gsm/gsm0411_smc.h \
+                       osmocom/gsm/gsm0411_smr.h \
+                       osmocom/gsm/gsm0411_utils.h \
+                       osmocom/gsm/gsm0480.h \
+                       osmocom/gsm/gsm0502.h \
+                       osmocom/gsm/gsm0808.h \
+                       osmocom/gsm/gsm48.h \
+                       osmocom/gsm/gsm48_ie.h \
+                       osmocom/gsm/gsm_utils.h \
+                       osmocom/gsm/lapd_core.h \
+                       osmocom/gsm/lapdm.h \
+                       osmocom/gsm/mncc.h \
+                       osmocom/gsm/prim.h \
+                       osmocom/gsm/protocol/gsm_03_41.h \
+                       osmocom/gsm/protocol/gsm_04_08.h \
+                       osmocom/gsm/protocol/gsm_04_11.h \
+                       osmocom/gsm/protocol/gsm_04_12.h \
+                       osmocom/gsm/protocol/gsm_04_80.h \
+                       osmocom/gsm/protocol/gsm_08_08.h \
+                       osmocom/gsm/protocol/gsm_08_58.h \
+                       osmocom/gsm/protocol/gsm_12_21.h \
+                       osmocom/gsm/protocol/gsm_44_318.h \
+                       osmocom/gsm/protocol/ipaccess.h \
+                       osmocom/gsm/rsl.h \
+                       osmocom/gsm/rxlev_stat.h \
+                       osmocom/gsm/sysinfo.h \
+                       osmocom/gsm/tlv.h
+
+if ENABLE_PLUGIN
+nobase_include_HEADERS += osmocom/core/plugin.h
+endif
+
+if ENABLE_TALLOC
+nobase_include_HEADERS += osmocom/core/talloc.h
+endif
+
+if ENABLE_MSGFILE
+nobase_include_HEADERS += osmocom/core/msgfile.h
+endif
+
+if ENABLE_SERIAL
+nobase_include_HEADERS += osmocom/core/serial.h
+endif
+
+
+if ENABLE_VTY
+nobase_include_HEADERS += \
+                          osmocom/vty/buffer.h \
+                          osmocom/vty/command.h \
+                          osmocom/vty/logging.h \
+                          osmocom/vty/misc.h \
+                          osmocom/vty/telnet_interface.h \
+                          osmocom/vty/vector.h \
+                          osmocom/vty/vty.h
+endif
+
+noinst_HEADERS = osmocom/core/timer_compat.h
+
+osmocom/core/crc%gen.h: osmocom/core/crcXXgen.h.tpl
+	$(AM_V_GEN)$(MKDIR_P) $(dir $@)
+	$(AM_V_GEN)sed -e's/XX/$*/g' $< > $@
diff --git a/src/shared/libosmocore/include/osmocom/codec/codec.h b/src/shared/libosmocore/include/osmocom/codec/codec.h
new file mode 100644
index 00000000..81f5d4ba
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/codec/codec.h
@@ -0,0 +1,20 @@
+#ifndef _OSMOCOM_CODEC_H
+#define _OSMOCOM_CODEC_H
+
+#include <stdint.h>
+
+extern const uint16_t gsm610_bitorder[];	/* FR */
+extern const uint16_t gsm620_unvoiced_bitorder[]; /* HR unvoiced */
+extern const uint16_t gsm620_voiced_bitorder[];   /* HR voiced */
+extern const uint16_t gsm660_bitorder[];	/* EFR */
+
+extern const uint16_t gsm690_12_2_bitorder[];	/* AMR 12.2  kbits */
+extern const uint16_t gsm690_10_2_bitorder[];	/* AMR 10.2  kbits */
+extern const uint16_t gsm690_7_95_bitorder[];	/* AMR  7.95 kbits */
+extern const uint16_t gsm690_7_4_bitorder[];	/* AMR  7.4  kbits */
+extern const uint16_t gsm690_6_7_bitorder[];	/* AMR  6.7  kbits */
+extern const uint16_t gsm690_5_9_bitorder[];	/* AMR  5.9  kbits */
+extern const uint16_t gsm690_5_15_bitorder[];	/* AMR  5.15 kbits */
+extern const uint16_t gsm690_4_75_bitorder[];	/* AMR  4.75 kbits */
+
+#endif /* _OSMOCOM_CODEC_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/application.h b/src/shared/libosmocore/include/osmocom/core/application.h
new file mode 100644
index 00000000..34571698
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/application.h
@@ -0,0 +1,23 @@
+#ifndef OSMO_APPLICATION_H
+#define OSMO_APPLICATION_H
+
+/*!
+ * \file application.h
+ * \brief Routines for helping with the osmocom application setup.
+ */
+
+/*! \brief information containing the available logging subsystems */
+struct log_info;
+
+/*! \brief one instance of a logging target (file, stderr, ...) */
+struct log_target;
+
+/*! \brief the default logging target, logging to stderr */
+extern struct log_target *osmo_stderr_target;
+
+void osmo_init_ignore_signals(void);
+int osmo_init_logging(const struct log_info *);
+
+int osmo_daemonize(void);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/core/backtrace.h b/src/shared/libosmocore/include/osmocom/core/backtrace.h
new file mode 100644
index 00000000..a24290c5
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/backtrace.h
@@ -0,0 +1,7 @@
+#ifndef _OSMO_BACKTRACE_H_
+#define _OSMO_BACKTRACE_H_
+
+void osmo_generate_backtrace(void);
+void osmo_log_backtrace(int subsys, int level);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/core/bits.h b/src/shared/libosmocore/include/osmocom/core/bits.h
new file mode 100644
index 00000000..4c685321
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/bits.h
@@ -0,0 +1,78 @@
+#ifndef _OSMO_BITS_H
+#define _OSMO_BITS_H
+
+#include <stdint.h>
+
+/*! \defgroup bits soft, unpacked and packed bits
+ *  @{
+ */
+
+/*! \file bits.h
+ *  \brief Osmocom bit level support code
+ */
+
+typedef int8_t  sbit_t;		/*!< \brief soft bit (-127...127) */
+typedef uint8_t ubit_t;		/*!< \brief unpacked bit (0 or 1) */
+typedef uint8_t pbit_t;		/*!< \brief packed bis (8 bits in a byte) */
+
+/*
+   NOTE on the endianess of pbit_t:
+   Bits in a pbit_t are ordered MSB first, i.e. 0x80 is the first bit.
+   Bit i in a pbit_t array is array[i/8] & (1<<(7-i%8))
+*/
+
+/*! \brief determine how many bytes we would need for \a num_bits packed bits
+ *  \param[in] num_bits Number of packed bits
+ */
+static inline unsigned int osmo_pbit_bytesize(unsigned int num_bits)
+{
+	unsigned int pbit_bytesize = num_bits / 8;
+
+	if (num_bits % 8)
+		pbit_bytesize++;
+
+	return pbit_bytesize;
+}
+
+int osmo_ubit2pbit(pbit_t *out, const ubit_t *in, unsigned int num_bits);
+
+int osmo_pbit2ubit(ubit_t *out, const pbit_t *in, unsigned int num_bits);
+
+int osmo_ubit2pbit_ext(pbit_t *out, unsigned int out_ofs,
+                       const ubit_t *in, unsigned int in_ofs,
+                       unsigned int num_bits, int lsb_mode);
+
+int osmo_pbit2ubit_ext(ubit_t *out, unsigned int out_ofs,
+                       const pbit_t *in, unsigned int in_ofs,
+                       unsigned int num_bits, int lsb_mode);
+
+
+/* BIT REVERSAL */
+
+/*! \brief bit-reversal mode for osmo_bit_reversal() */
+enum osmo_br_mode {
+	/*! \brief reverse all bits in a 32bit dword */
+	OSMO_BR_BITS_IN_DWORD	= 31,
+	/*! \brief reverse byte order in a 32bit dword */
+	OSMO_BR_BYTES_IN_DWORD	= 24,
+	/*! \brief reverse bits of each byte in a 32bit dword */
+	OSMO_BR_BITS_IN_BYTE	= 7,
+	/*! \brief swap the two 16bit words in a 32bit dword */
+	OSMO_BR_WORD_SWAP	= 16,
+};
+
+/*! \brief generic bit reversal function */
+uint32_t osmo_bit_reversal(uint32_t x, enum osmo_br_mode k);
+
+/* \brief reverse the bits within each byte of a 32bit word */
+uint32_t osmo_revbytebits_32(uint32_t x);
+
+/* \brief reverse the bits within a byte */
+uint32_t osmo_revbytebits_8(uint8_t x);
+
+/* \brief reverse the bits of each byte in a given buffer */
+void osmo_revbytebits_buf(uint8_t *buf, int len);
+
+/*! @} */
+
+#endif /* _OSMO_BITS_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/bitvec.h b/src/shared/libosmocore/include/osmocom/core/bitvec.h
new file mode 100644
index 00000000..9c000d02
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/bitvec.h
@@ -0,0 +1,70 @@
+#ifndef _BITVEC_H
+#define _BITVEC_H
+
+/* bit vector utility routines */
+
+/* (C) 2009 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \defgroup bitvec Bit vectors
+ *  @{
+ */
+
+/*! \file bitvec.h
+ *  \brief Osmocom bit vector abstraction
+ */
+
+#include <stdint.h>
+
+/*! \brief A single GSM bit
+ *
+ * In GSM mac blocks, every bit can be 0 or 1, or L or H.  L/H are
+ * defined relative to the 0x2b padding pattern */
+enum bit_value {
+	ZERO	= 0, 	/*!< \brief A zero (0) bit */
+	ONE	= 1,	/*!< \brief A one (1) bit */
+	L	= 2,	/*!< \brief A CSN.1 "L" bit */
+	H	= 3,	/*!< \brief A CSN.1 "H" bit */
+};
+
+/*! \brief structure describing a bit vector */
+struct bitvec {
+	unsigned int cur_bit;	/*!< \brief curser to the next unused bit */
+	unsigned int data_len;	/*!< \brief length of data array in bytes */
+	uint8_t *data;		/*!< \brief pointer to data array */
+};
+
+enum bit_value bitvec_get_bit_pos(const struct bitvec *bv, unsigned int bitnr);
+enum bit_value bitvec_get_bit_pos_high(const struct bitvec *bv,
+					unsigned int bitnr);
+unsigned int bitvec_get_nth_set_bit(const struct bitvec *bv, unsigned int n);
+int bitvec_set_bit_pos(struct bitvec *bv, unsigned int bitnum,
+			enum bit_value bit);
+int bitvec_set_bit(struct bitvec *bv, enum bit_value bit);
+int bitvec_get_bit_high(struct bitvec *bv);
+int bitvec_set_bits(struct bitvec *bv, enum bit_value *bits, int count);
+int bitvec_set_uint(struct bitvec *bv, unsigned int in, int count);
+int bitvec_get_uint(struct bitvec *bv, int num_bits);
+int bitvec_find_bit_pos(const struct bitvec *bv, unsigned int n, enum bit_value val);
+int bitvec_spare_padding(struct bitvec *bv, unsigned int up_to_bit);
+
+/*! @} */
+
+#endif /* _BITVEC_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/conv.h b/src/shared/libosmocore/include/osmocom/core/conv.h
new file mode 100644
index 00000000..e5b2a975
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/conv.h
@@ -0,0 +1,146 @@
+/*
+ * conv.h
+ *
+ * Copyright (C) 2011  Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/*! \defgroup conv Convolutional encoding and decoding routines
+ *  @{
+ */
+
+/*! \file conv.h
+ *  \file Osmocom convolutional encoder and decoder
+ */
+
+#ifndef __OSMO_CONV_H__
+#define __OSMO_CONV_H__
+
+#include <stdint.h>
+
+#include <osmocom/core/bits.h>
+
+/*! \brief possibe termination types
+ *
+ *  The termination type will determine which state the encoder/decoder
+ *  can start/end with. This is mostly taken care of in the high level API
+ *  call. So if you use the low level API, you must take care of making the
+ *  proper calls yourself.
+ */
+enum osmo_conv_term {
+	CONV_TERM_FLUSH = 0,	/*!< \brief Flush encoder state */
+	CONV_TERM_TRUNCATION,	/*!< \brief Direct truncation */
+	CONV_TERM_TAIL_BITING,	/*!< \brief Tail biting */
+};
+
+/*! \brief structure describing a given convolutional code
+ *
+ *  The only required fields are N,K and the next_output/next_state arrays. The
+ *  other can be left to default value of zero depending on what the code does.
+ *  If 'len' is left at 0 then only the low level API can be used.
+ */
+struct osmo_conv_code {
+	int N;				/*!< \brief Inverse of code rate */
+	int K;				/*!< \brief Constraint length */
+	int len;			/*!< \brief # of data bits */
+
+	enum osmo_conv_term term;	/*!< \brief Termination type */
+
+	const uint8_t (*next_output)[2];/*!< \brief Next output array */
+	const uint8_t (*next_state)[2];	/*!< \brief Next state array  */
+
+	const uint8_t *next_term_output;/*!< \brief Flush termination output */
+	const uint8_t *next_term_state;	/*!< \brief Flush termination state  */
+
+	const int *puncture;		/*!< \brief Punctured bits indexes */
+};
+
+
+/* Common */
+
+int osmo_conv_get_input_length(const struct osmo_conv_code *code, int len);
+int osmo_conv_get_output_length(const struct osmo_conv_code *code, int len);
+
+
+/* Encoding */
+
+	/* Low level API */
+
+/*! \brief convolutional encoder state */
+struct osmo_conv_encoder {
+	const struct osmo_conv_code *code; /*!< \brief for which code? */
+	int i_idx;	/*!< \brief Next input bit index */
+	int p_idx;	/*!< \brief Current puncture index */
+	uint8_t state;	/*!< \brief Current state */
+};
+
+void osmo_conv_encode_init(struct osmo_conv_encoder *encoder,
+                           const struct osmo_conv_code *code);
+void osmo_conv_encode_load_state(struct osmo_conv_encoder *encoder,
+                                 const ubit_t *input);
+int  osmo_conv_encode_raw(struct osmo_conv_encoder *encoder,
+                          const ubit_t *input, ubit_t *output, int n);
+int  osmo_conv_encode_flush(struct osmo_conv_encoder *encoder, ubit_t *output);
+
+	/* All-in-one */
+int  osmo_conv_encode(const struct osmo_conv_code *code,
+                      const ubit_t *input, ubit_t *output);
+
+
+/* Decoding */
+
+	/* Low level API */
+
+/*! \brief convolutional decoder state */
+struct osmo_conv_decoder {
+	const struct osmo_conv_code *code; /*!< \brief for which code? */
+
+	int n_states;		/*!< \brief number of states */
+
+	int len;		/*!< \brief Max o_idx (excl. termination) */
+
+	int o_idx;		/*!< \brief output index */
+	int p_idx;		/*!< \brief puncture index */
+
+	unsigned int *ae;	/*!< \brief accumulated error */
+	unsigned int *ae_next;	/*!< \brief next accumulated error (tmp in scan) */
+	uint8_t *state_history;	/*!< \brief state history [len][n_states] */
+};
+
+void osmo_conv_decode_init(struct osmo_conv_decoder *decoder,
+                           const struct osmo_conv_code *code,
+                           int len, int start_state);
+void osmo_conv_decode_reset(struct osmo_conv_decoder *decoder, int start_state);
+void osmo_conv_decode_rewind(struct osmo_conv_decoder *decoder);
+void osmo_conv_decode_deinit(struct osmo_conv_decoder *decoder);
+
+int osmo_conv_decode_scan(struct osmo_conv_decoder *decoder,
+                          const sbit_t *input, int n);
+int osmo_conv_decode_flush(struct osmo_conv_decoder *decoder,
+                           const sbit_t *input);
+int osmo_conv_decode_get_output(struct osmo_conv_decoder *decoder,
+                                ubit_t *output, int has_flush, int end_state);
+
+	/* All-in-one */
+int osmo_conv_decode(const struct osmo_conv_code *code,
+                     const sbit_t *input, ubit_t *output);
+
+
+/*! @} */
+
+#endif /* __OSMO_CONV_H__ */
diff --git a/src/shared/libosmocore/include/osmocom/core/crc16.h b/src/shared/libosmocore/include/osmocom/core/crc16.h
new file mode 100644
index 00000000..0e524176
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/crc16.h
@@ -0,0 +1,34 @@
+/*
+ * This was copied from the linux kernel and adjusted for our types.
+ */
+/*
+ *	crc16.h - CRC-16 routine
+ *
+ * Implements the standard CRC-16:
+ *   Width 16
+ *   Poly  0x8005 (x^16 + x^15 + x^2 + 1)
+ *   Init  0
+ *
+ * Copyright (c) 2005 Ben Gardner <bgardner@wabtec.com>
+ *
+ * This source code is licensed under the GNU General Public License,
+ * Version 2. See the file COPYING for more details.
+ */
+
+#ifndef __CRC16_H
+#define __CRC16_H
+
+#include <stdint.h>
+
+#include <sys/types.h>
+
+extern uint16_t const osmo_crc16_table[256];
+
+extern uint16_t osmo_crc16(uint16_t crc, const uint8_t *buffer, size_t len);
+
+static inline uint16_t osmo_crc16_byte(uint16_t crc, const uint8_t data)
+{
+	return (crc >> 8) ^ osmo_crc16_table[(crc ^ data) & 0xff];
+}
+
+#endif /* __CRC16_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/crcXXgen.h.tpl b/src/shared/libosmocore/include/osmocom/core/crcXXgen.h.tpl
new file mode 100644
index 00000000..89d083ae
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/crcXXgen.h.tpl
@@ -0,0 +1,59 @@
+/*
+ * crcXXgen.h
+ *
+ * Copyright (C) 2011  Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef __OSMO_CRCXXGEN_H__
+#define __OSMO_CRCXXGEN_H__
+
+/*! \addtogroup crcgen
+ *  @{
+ */
+
+/*! \file crcXXgen.h
+ *  \file Osmocom generic CRC routines (for max XX bits poly) header
+ */
+
+
+#include <stdint.h>
+#include <osmocom/core/bits.h>
+
+
+/*! \brief structure describing a given CRC code of max XX bits */
+struct osmo_crcXXgen_code {
+	int bits;           /*!< \brief Actual number of bits of the CRC */
+	uintXX_t poly;      /*!< \brief Polynom (normal representation, MSB omitted */
+	uintXX_t init;      /*!< \brief Initialization value of the CRC state */
+	uintXX_t remainder; /*!< \brief Remainder of the CRC (final XOR) */
+};
+
+uintXX_t osmo_crcXXgen_compute_bits(const struct osmo_crcXXgen_code *code,
+                                    const ubit_t *in, int len);
+int osmo_crcXXgen_check_bits(const struct osmo_crcXXgen_code *code,
+                             const ubit_t *in, int len, const ubit_t *crc_bits);
+void osmo_crcXXgen_set_bits(const struct osmo_crcXXgen_code *code,
+                            const ubit_t *in, int len, ubit_t *crc_bits);
+
+
+/*! @} */
+
+#endif /* __OSMO_CRCXXGEN_H__ */
+
+/* vim: set syntax=c: */
diff --git a/src/shared/libosmocore/include/osmocom/core/crcgen.h b/src/shared/libosmocore/include/osmocom/core/crcgen.h
new file mode 100644
index 00000000..8e208a74
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/crcgen.h
@@ -0,0 +1,41 @@
+/*
+ * crcgen.h
+ *
+ * Copyright (C) 2011  Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef __OSMO_CRCGEN_H__
+#define __OSMO_CRCGEN_H__
+
+/*! \defgroup crcgen Osmocom generic CRC routines
+ *  @{
+ */
+
+/*! \file crcgen.h
+ *  \file Osmocom generic CRC routines global header
+ */
+
+#include <osmocom/core/crc8gen.h>
+#include <osmocom/core/crc16gen.h>
+#include <osmocom/core/crc32gen.h>
+#include <osmocom/core/crc64gen.h>
+
+/*! @} */
+
+#endif /* __OSMO_CRCGEN_H__ */
diff --git a/src/shared/libosmocore/include/osmocom/core/gsmtap.h b/src/shared/libosmocore/include/osmocom/core/gsmtap.h
new file mode 100644
index 00000000..0b647b28
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/gsmtap.h
@@ -0,0 +1,166 @@
+#ifndef _GSMTAP_H
+#define _GSMTAP_H
+
+/* gsmtap header, pseudo-header in front of the actua GSM payload */
+
+/* GSMTAP is a generic header format for GSM protocol captures,
+ * it uses the IANA-assigned UDP port number 4729 and carries
+ * payload in various formats of GSM interfaces such as Um MAC
+ * blocks or Um bursts.
+ *
+ * Example programs generating GSMTAP data are airprobe
+ * (http://airprobe.org/) or OsmocomBB (http://bb.osmocom.org/)
+ */
+
+#include <stdint.h>
+
+/* ====== DO NOT MAKE UNAPPROVED MODIFICATIONS HERE ===== */
+
+/* The GSMTAP format definition is maintained in libosmocore,
+ * specifically the latest version can always be obtained from
+ * http://cgit.osmocom.org/cgit/libosmocore/tree/include/osmocom/core/gsmtap.h
+ *
+ * If you want to introduce new protocol/burst/channel types or extend
+ * GSMTAP in any way, please contact the GSMTAP maintainer at either the
+ * public openbsc@lists.osmocom.org mailing list, or privately at
+ * Harald Welte <laforge@gnumonks.org>.
+ *
+ * Your cooperation ensures that all projects will use the same GSMTAP
+ * definitions and remain compatible with each other.
+ */
+
+#define GSMTAP_VERSION		0x02
+
+#define GSMTAP_TYPE_UM		0x01
+#define GSMTAP_TYPE_ABIS	0x02
+#define GSMTAP_TYPE_UM_BURST	0x03	/* raw burst bits */
+#define GSMTAP_TYPE_SIM		0x04
+#define GSMTAP_TYPE_TETRA_I1		0x05	/* tetra air interface */
+#define GSMTAP_TYPE_TETRA_I1_BURST	0x06	/* tetra air interface */
+#define GSMTAP_TYPE_WMX_BURST	0x07    /* WiMAX burst */
+#define GSMTAP_TYPE_GB_LLC	0x08 /* GPRS Gb interface: LLC */
+#define GSMTAP_TYPE_GB_SNDCP	0x09 /* GPRS Gb interface: SNDCP */
+#define GSMTAP_TYPE_GMR1_UM	0x0a	/* GMR-1 L2 packets */
+#define GSMTAP_TYPE_UMTS_RLC_MAC	0x0b
+#define GSMTAP_TYPE_UMTS_RRC	0x0c
+
+
+/* ====== DO NOT MAKE UNAPPROVED MODIFICATIONS HERE ===== */
+
+/* sub-types for TYPE_UM_BURST */
+#define GSMTAP_BURST_UNKNOWN		0x00
+#define GSMTAP_BURST_FCCH		0x01
+#define GSMTAP_BURST_PARTIAL_SCH	0x02
+#define GSMTAP_BURST_SCH		0x03
+#define GSMTAP_BURST_CTS_SCH		0x04
+#define GSMTAP_BURST_COMPACT_SCH	0x05
+#define GSMTAP_BURST_NORMAL		0x06
+#define GSMTAP_BURST_DUMMY		0x07
+#define GSMTAP_BURST_ACCESS		0x08
+#define GSMTAP_BURST_NONE		0x09
+/* WiMAX bursts */
+#define GSMTAP_BURST_CDMA_CODE		0x10	/* WiMAX CDMA Code Attribute burst */
+#define GSMTAP_BURST_FCH		0x11	/* WiMAX FCH burst */
+#define GSMTAP_BURST_FFB		0x12	/* WiMAX Fast Feedback burst */
+#define GSMTAP_BURST_PDU		0x13	/* WiMAX PDU burst */
+#define GSMTAP_BURST_HACK		0x14	/* WiMAX HARQ ACK burst */
+#define GSMTAP_BURST_PHY_ATTRIBUTES	0x15	/* WiMAX PHY Attributes burst */
+
+/* ====== DO NOT MAKE UNAPPROVED MODIFICATIONS HERE ===== */
+
+/* sub-types for TYPE_UM */
+#define GSMTAP_CHANNEL_UNKNOWN	0x00
+#define GSMTAP_CHANNEL_BCCH	0x01
+#define GSMTAP_CHANNEL_CCCH	0x02
+#define GSMTAP_CHANNEL_RACH	0x03
+#define GSMTAP_CHANNEL_AGCH	0x04
+#define GSMTAP_CHANNEL_PCH	0x05
+#define GSMTAP_CHANNEL_SDCCH	0x06
+#define GSMTAP_CHANNEL_SDCCH4	0x07
+#define GSMTAP_CHANNEL_SDCCH8	0x08
+#define GSMTAP_CHANNEL_TCH_F	0x09
+#define GSMTAP_CHANNEL_TCH_H	0x0a
+#define GSMTAP_CHANNEL_PACCH	0x0b
+#define GSMTAP_CHANNEL_CBCH52	0x0c
+#define GSMTAP_CHANNEL_PDCH	0x0d
+#define GSMTAP_CHANNEL_PTCCH	0x0e
+#define GSMTAP_CHANNEL_CBCH51	0x0f
+
+/* GPRS Coding Scheme CS1..4 */
+#define GSMTAP_GPRS_CS_BASE	0x20
+#define GSMTAP_GPRS_CS(N)	(GSMTAP_GPRS_CS_BASE + N)
+/* (E) GPRS Coding Scheme MCS0..9 */
+#define GSMTAP_GPRS_MCS_BASE	0x30
+#define GSMTAP_GPRS_MCS(N)	(GSMTAP_GPRS_MCS_BASE + N)
+
+#define GSMTAP_CHANNEL_ACCH	0x80
+
+/* ====== DO NOT MAKE UNAPPROVED MODIFICATIONS HERE ===== */
+
+/* sub-types for TYPE_TETRA_AIR */
+#define GSMTAP_TETRA_BSCH	0x01
+#define GSMTAP_TETRA_AACH	0x02
+#define GSMTAP_TETRA_SCH_HU	0x03
+#define GSMTAP_TETRA_SCH_HD	0x04
+#define GSMTAP_TETRA_SCH_F	0x05
+#define GSMTAP_TETRA_BNCH	0x06
+#define GSMTAP_TETRA_STCH	0x07
+#define GSMTAP_TETRA_TCH_F	0x08
+
+/* ====== DO NOT MAKE UNAPPROVED MODIFICATIONS HERE ===== */
+
+/* sub-types for TYPE_GMR1_UM */
+#define GSMTAP_GMR1_UNKNOWN	0x00
+#define GSMTAP_GMR1_BCCH	0x01
+#define GSMTAP_GMR1_CCCH	0x02	/* either AGCH or PCH */
+#define GSMTAP_GMR1_PCH		0x03
+#define GSMTAP_GMR1_AGCH	0x04
+#define GSMTAP_GMR1_BACH	0x05
+#define GSMTAP_GMR1_RACH	0x06
+#define GSMTAP_GMR1_CBCH	0x07
+#define GSMTAP_GMR1_SDCCH	0x08
+#define GSMTAP_GMR1_TACCH	0x09
+#define GSMTAP_GMR1_GBCH	0x0a
+
+#define GSMTAP_GMR1_SACCH	0x01	/* to be combined with _TCH{6,9}   */
+#define GSMTAP_GMR1_FACCH	0x02	/* to be combines with _TCH{3,6,9} */
+#define GSMTAP_GMR1_DKAB	0x03	/* to be combined with _TCH3 */
+#define GSMTAP_GMR1_TCH3	0x10
+#define GSMTAP_GMR1_TCH6	0x14
+#define GSMTAP_GMR1_TCH9	0x18
+
+/* ====== DO NOT MAKE UNAPPROVED MODIFICATIONS HERE ===== */
+
+#define GSMTAP_UMTS_CH_PCCH	0x01
+#define GSMTAP_UMTS_CH_CCCH	0x02
+#define GSMTAP_UMTS_CH_DCCH	0x03
+
+/* flags for the ARFCN */
+#define GSMTAP_ARFCN_F_PCS	0x8000
+#define GSMTAP_ARFCN_F_UPLINK	0x4000
+#define GSMTAP_ARFCN_MASK	0x3fff
+
+/* IANA-assigned well-known UDP port for GSMTAP messages */
+#define GSMTAP_UDP_PORT			4729
+
+/* ====== DO NOT MAKE UNAPPROVED MODIFICATIONS HERE ===== */
+struct gsmtap_hdr {
+	uint8_t version;	/* version, set to 0x01 currently */
+	uint8_t hdr_len;	/* length in number of 32bit words */
+	uint8_t type;		/* see GSMTAP_TYPE_* */
+	uint8_t timeslot;	/* timeslot (0..7 on Um) */
+
+	uint16_t arfcn;		/* ARFCN (frequency) */
+	int8_t signal_dbm;	/* signal level in dBm */
+	int8_t snr_db;		/* signal/noise ratio in dB */
+
+	uint32_t frame_number;	/* GSM Frame Number (FN) */
+
+	uint8_t sub_type;	/* Type of burst/channel, see above */
+	uint8_t antenna_nr;	/* Antenna Number */
+	uint8_t sub_slot;	/* sub-slot within timeslot */
+	uint8_t res;		/* reserved for future use (RFU) */
+
+} __attribute__((packed));
+
+#endif /* _GSMTAP_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/gsmtap_util.h b/src/shared/libosmocore/include/osmocom/core/gsmtap_util.h
new file mode 100644
index 00000000..5609381f
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/gsmtap_util.h
@@ -0,0 +1,57 @@
+#ifndef _GSMTAP_UTIL_H
+#define _GSMTAP_UTIL_H
+
+#include <stdint.h>
+#include <osmocom/core/write_queue.h>
+#include <osmocom/core/select.h>
+
+/*! \defgroup gsmtap GSMTAP
+ *  @{
+ */
+/*! \file gsmtap_util.h */
+
+uint8_t chantype_rsl2gsmtap(uint8_t rsl_chantype, uint8_t rsl_link_id);
+
+struct msgb *gsmtap_makemsg_ex(uint8_t type, uint16_t arfcn, uint8_t ts, uint8_t chan_type,
+			    uint8_t ss, uint32_t fn, int8_t signal_dbm,
+			    uint8_t snr, const uint8_t *data, unsigned int len);
+
+struct msgb *gsmtap_makemsg(uint16_t arfcn, uint8_t ts, uint8_t chan_type,
+			    uint8_t ss, uint32_t fn, int8_t signal_dbm,
+			    uint8_t snr, const uint8_t *data, unsigned int len);
+
+/*! \brief one gsmtap instance */
+struct gsmtap_inst {
+	int ofd_wq_mode;	/*!< \brief wait queue mode? */
+	struct osmo_wqueue wq;	/*!< \brief the wait queue */
+	struct osmo_fd sink_ofd;/*!< \brief file descriptor */
+};
+
+/*! \brief obtain the file descriptor associated with a gsmtap instance */
+static inline int gsmtap_inst_fd(struct gsmtap_inst *gti)
+{
+	return gti->wq.bfd.fd;
+}
+
+int gsmtap_source_init_fd(const char *host, uint16_t port);
+
+int gsmtap_source_add_sink_fd(int gsmtap_fd);
+
+struct gsmtap_inst *gsmtap_source_init(const char *host, uint16_t port,
+					int ofd_wq_mode);
+
+int gsmtap_source_add_sink(struct gsmtap_inst *gti);
+
+int gsmtap_sendmsg(struct gsmtap_inst *gti, struct msgb *msg);
+
+int gsmtap_send_ex(struct gsmtap_inst *gti, uint8_t type, uint16_t arfcn, uint8_t ts,
+		uint8_t chan_type, uint8_t ss, uint32_t fn,
+		int8_t signal_dbm, uint8_t snr, const uint8_t *data,
+		unsigned int len);
+
+int gsmtap_send(struct gsmtap_inst *gti, uint16_t arfcn, uint8_t ts,
+		uint8_t chan_type, uint8_t ss, uint32_t fn,
+		int8_t signal_dbm, uint8_t snr, const uint8_t *data,
+		unsigned int len);
+
+#endif /* _GSMTAP_UTIL_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/linuxlist.h b/src/shared/libosmocore/include/osmocom/core/linuxlist.h
new file mode 100644
index 00000000..ff2c4915
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/linuxlist.h
@@ -0,0 +1,360 @@
+#ifndef _LINUX_LLIST_H
+#define _LINUX_LLIST_H
+
+#include <stddef.h>
+
+#ifndef inline
+#define inline __inline__
+#endif
+
+static inline void prefetch(__attribute__((unused)) const void *x) {;}
+
+/**
+ * container_of - cast a member of a structure out to the containing structure
+ *
+ * @ptr:	the pointer to the member.
+ * @type:	the type of the container struct this is embedded in.
+ * @member:	the name of the member within the struct.
+ *
+ */
+#define container_of(ptr, type, member) ({			\
+        const typeof( ((type *)0)->member ) *__mptr = (typeof( ((type *)0)->member ) *)(ptr);	\
+        (type *)( (char *)__mptr - offsetof(type, member) );})
+
+
+/*
+ * These are non-NULL pointers that will result in page faults
+ * under normal circumstances, used to verify that nobody uses
+ * non-initialized llist entries.
+ */
+#define LLIST_POISON1  ((void *) 0x00100100)
+#define LLIST_POISON2  ((void *) 0x00200200)
+
+/*
+ * Simple doubly linked llist implementation.
+ *
+ * Some of the internal functions ("__xxx") are useful when
+ * manipulating whole llists rather than single entries, as
+ * sometimes we already know the next/prev entries and we can
+ * generate better code by using them directly rather than
+ * using the generic single-entry routines.
+ */
+
+struct llist_head {
+	struct llist_head *next, *prev;
+};
+
+#define LLIST_HEAD_INIT(name) { &(name), &(name) }
+
+#define LLIST_HEAD(name) \
+	struct llist_head name = LLIST_HEAD_INIT(name)
+
+#define INIT_LLIST_HEAD(ptr) do { \
+	(ptr)->next = (ptr); (ptr)->prev = (ptr); \
+} while (0)
+
+/*
+ * Insert a new entry between two known consecutive entries. 
+ *
+ * This is only for internal llist manipulation where we know
+ * the prev/next entries already!
+ */
+static inline void __llist_add(struct llist_head *_new,
+			      struct llist_head *prev,
+			      struct llist_head *next)
+{
+	next->prev = _new;
+	_new->next = next;
+	_new->prev = prev;
+	prev->next = _new;
+}
+
+/**
+ * llist_add - add a new entry
+ * @new: new entry to be added
+ * @head: llist head to add it after
+ *
+ * Insert a new entry after the specified head.
+ * This is good for implementing stacks.
+ */
+static inline void llist_add(struct llist_head *_new, struct llist_head *head)
+{
+	__llist_add(_new, head, head->next);
+}
+
+/**
+ * llist_add_tail - add a new entry
+ * @new: new entry to be added
+ * @head: llist head to add it before
+ *
+ * Insert a new entry before the specified head.
+ * This is useful for implementing queues.
+ */
+static inline void llist_add_tail(struct llist_head *_new, struct llist_head *head)
+{
+	__llist_add(_new, head->prev, head);
+}
+
+/*
+ * Delete a llist entry by making the prev/next entries
+ * point to each other.
+ *
+ * This is only for internal llist manipulation where we know
+ * the prev/next entries already!
+ */
+static inline void __llist_del(struct llist_head * prev, struct llist_head * next)
+{
+	next->prev = prev;
+	prev->next = next;
+}
+
+/**
+ * llist_del - deletes entry from llist.
+ * @entry: the element to delete from the llist.
+ * Note: llist_empty on entry does not return true after this, the entry is
+ * in an undefined state.
+ */
+static inline void llist_del(struct llist_head *entry)
+{
+	__llist_del(entry->prev, entry->next);
+	entry->next = (struct llist_head *)LLIST_POISON1;
+	entry->prev = (struct llist_head *)LLIST_POISON2;
+}
+
+/**
+ * llist_del_init - deletes entry from llist and reinitialize it.
+ * @entry: the element to delete from the llist.
+ */
+static inline void llist_del_init(struct llist_head *entry)
+{
+	__llist_del(entry->prev, entry->next);
+	INIT_LLIST_HEAD(entry); 
+}
+
+/**
+ * llist_move - delete from one llist and add as another's head
+ * @llist: the entry to move
+ * @head: the head that will precede our entry
+ */
+static inline void llist_move(struct llist_head *llist, struct llist_head *head)
+{
+        __llist_del(llist->prev, llist->next);
+        llist_add(llist, head);
+}
+
+/**
+ * llist_move_tail - delete from one llist and add as another's tail
+ * @llist: the entry to move
+ * @head: the head that will follow our entry
+ */
+static inline void llist_move_tail(struct llist_head *llist,
+				  struct llist_head *head)
+{
+        __llist_del(llist->prev, llist->next);
+        llist_add_tail(llist, head);
+}
+
+/**
+ * llist_empty - tests whether a llist is empty
+ * @head: the llist to test.
+ */
+static inline int llist_empty(const struct llist_head *head)
+{
+	return head->next == head;
+}
+
+static inline void __llist_splice(struct llist_head *llist,
+				 struct llist_head *head)
+{
+	struct llist_head *first = llist->next;
+	struct llist_head *last = llist->prev;
+	struct llist_head *at = head->next;
+
+	first->prev = head;
+	head->next = first;
+
+	last->next = at;
+	at->prev = last;
+}
+
+/**
+ * llist_splice - join two llists
+ * @llist: the new llist to add.
+ * @head: the place to add it in the first llist.
+ */
+static inline void llist_splice(struct llist_head *llist, struct llist_head *head)
+{
+	if (!llist_empty(llist))
+		__llist_splice(llist, head);
+}
+
+/**
+ * llist_splice_init - join two llists and reinitialise the emptied llist.
+ * @llist: the new llist to add.
+ * @head: the place to add it in the first llist.
+ *
+ * The llist at @llist is reinitialised
+ */
+static inline void llist_splice_init(struct llist_head *llist,
+				    struct llist_head *head)
+{
+	if (!llist_empty(llist)) {
+		__llist_splice(llist, head);
+		INIT_LLIST_HEAD(llist);
+	}
+}
+
+/**
+ * llist_entry - get the struct for this entry
+ * @ptr:	the &struct llist_head pointer.
+ * @type:	the type of the struct this is embedded in.
+ * @member:	the name of the llist_struct within the struct.
+ */
+#define llist_entry(ptr, type, member) \
+	container_of(ptr, type, member)
+
+/**
+ * llist_for_each	-	iterate over a llist
+ * @pos:	the &struct llist_head to use as a loop counter.
+ * @head:	the head for your llist.
+ */
+#define llist_for_each(pos, head) \
+	for (pos = (head)->next, prefetch(pos->next); pos != (head); \
+        	pos = pos->next, prefetch(pos->next))
+
+/**
+ * __llist_for_each	-	iterate over a llist
+ * @pos:	the &struct llist_head to use as a loop counter.
+ * @head:	the head for your llist.
+ *
+ * This variant differs from llist_for_each() in that it's the
+ * simplest possible llist iteration code, no prefetching is done.
+ * Use this for code that knows the llist to be very short (empty
+ * or 1 entry) most of the time.
+ */
+#define __llist_for_each(pos, head) \
+	for (pos = (head)->next; pos != (head); pos = pos->next)
+
+/**
+ * llist_for_each_prev	-	iterate over a llist backwards
+ * @pos:	the &struct llist_head to use as a loop counter.
+ * @head:	the head for your llist.
+ */
+#define llist_for_each_prev(pos, head) \
+	for (pos = (head)->prev, prefetch(pos->prev); pos != (head); \
+        	pos = pos->prev, prefetch(pos->prev))
+        	
+/**
+ * llist_for_each_safe	-	iterate over a llist safe against removal of llist entry
+ * @pos:	the &struct llist_head to use as a loop counter.
+ * @n:		another &struct llist_head to use as temporary storage
+ * @head:	the head for your llist.
+ */
+#define llist_for_each_safe(pos, n, head) \
+	for (pos = (head)->next, n = pos->next; pos != (head); \
+		pos = n, n = pos->next)
+
+/**
+ * llist_for_each_entry	-	iterate over llist of given type
+ * @pos:	the type * to use as a loop counter.
+ * @head:	the head for your llist.
+ * @member:	the name of the llist_struct within the struct.
+ */
+#define llist_for_each_entry(pos, head, member)				\
+	for (pos = llist_entry((head)->next, typeof(*pos), member),	\
+		     prefetch(pos->member.next);			\
+	     &pos->member != (head); 					\
+	     pos = llist_entry(pos->member.next, typeof(*pos), member),	\
+		     prefetch(pos->member.next))
+
+/**
+ * llist_for_each_entry_reverse - iterate backwards over llist of given type.
+ * @pos:	the type * to use as a loop counter.
+ * @head:	the head for your llist.
+ * @member:	the name of the llist_struct within the struct.
+ */
+#define llist_for_each_entry_reverse(pos, head, member)			\
+	for (pos = llist_entry((head)->prev, typeof(*pos), member),	\
+		     prefetch(pos->member.prev);			\
+	     &pos->member != (head); 					\
+	     pos = llist_entry(pos->member.prev, typeof(*pos), member),	\
+		     prefetch(pos->member.prev))
+
+/**
+ * llist_for_each_entry_continue -	iterate over llist of given type
+ *			continuing after existing point
+ * @pos:	the type * to use as a loop counter.
+ * @head:	the head for your llist.
+ * @member:	the name of the llist_struct within the struct.
+ */
+#define llist_for_each_entry_continue(pos, head, member) 		\
+	for (pos = llist_entry(pos->member.next, typeof(*pos), member),	\
+		     prefetch(pos->member.next);			\
+	     &pos->member != (head);					\
+	     pos = llist_entry(pos->member.next, typeof(*pos), member),	\
+		     prefetch(pos->member.next))
+
+/**
+ * llist_for_each_entry_safe - iterate over llist of given type safe against removal of llist entry
+ * @pos:	the type * to use as a loop counter.
+ * @n:		another type * to use as temporary storage
+ * @head:	the head for your llist.
+ * @member:	the name of the llist_struct within the struct.
+ */
+#define llist_for_each_entry_safe(pos, n, head, member)			\
+	for (pos = llist_entry((head)->next, typeof(*pos), member),	\
+		n = llist_entry(pos->member.next, typeof(*pos), member);	\
+	     &pos->member != (head); 					\
+	     pos = n, n = llist_entry(n->member.next, typeof(*n), member))
+
+/**
+ * llist_for_each_rcu	-	iterate over an rcu-protected llist
+ * @pos:	the &struct llist_head to use as a loop counter.
+ * @head:	the head for your llist.
+ */
+#define llist_for_each_rcu(pos, head) \
+	for (pos = (head)->next, prefetch(pos->next); pos != (head); \
+        	pos = pos->next, ({ smp_read_barrier_depends(); 0;}), prefetch(pos->next))
+        	
+#define __llist_for_each_rcu(pos, head) \
+	for (pos = (head)->next; pos != (head); \
+        	pos = pos->next, ({ smp_read_barrier_depends(); 0;}))
+        	
+/**
+ * llist_for_each_safe_rcu	-	iterate over an rcu-protected llist safe
+ *					against removal of llist entry
+ * @pos:	the &struct llist_head to use as a loop counter.
+ * @n:		another &struct llist_head to use as temporary storage
+ * @head:	the head for your llist.
+ */
+#define llist_for_each_safe_rcu(pos, n, head) \
+	for (pos = (head)->next, n = pos->next; pos != (head); \
+		pos = n, ({ smp_read_barrier_depends(); 0;}), n = pos->next)
+
+/**
+ * llist_for_each_entry_rcu	-	iterate over rcu llist of given type
+ * @pos:	the type * to use as a loop counter.
+ * @head:	the head for your llist.
+ * @member:	the name of the llist_struct within the struct.
+ */
+#define llist_for_each_entry_rcu(pos, head, member)			\
+	for (pos = llist_entry((head)->next, typeof(*pos), member),	\
+		     prefetch(pos->member.next);			\
+	     &pos->member != (head); 					\
+	     pos = llist_entry(pos->member.next, typeof(*pos), member),	\
+		     ({ smp_read_barrier_depends(); 0;}),		\
+		     prefetch(pos->member.next))
+
+
+/**
+ * llist_for_each_continue_rcu	-	iterate over an rcu-protected llist 
+ *			continuing after existing point.
+ * @pos:	the &struct llist_head to use as a loop counter.
+ * @head:	the head for your llist.
+ */
+#define llist_for_each_continue_rcu(pos, head) \
+	for ((pos) = (pos)->next, prefetch((pos)->next); (pos) != (head); \
+        	(pos) = (pos)->next, ({ smp_read_barrier_depends(); 0;}), prefetch((pos)->next))
+
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/core/linuxrbtree.h b/src/shared/libosmocore/include/osmocom/core/linuxrbtree.h
new file mode 100644
index 00000000..079f440d
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/linuxrbtree.h
@@ -0,0 +1,160 @@
+/*
+  Red Black Trees
+  (C) 1999  Andrea Arcangeli <andrea@suse.de>
+  
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+  linux/include/linux/rbtree.h
+
+  To use rbtrees you'll have to implement your own insert and search cores.
+  This will avoid us to use callbacks and to drop drammatically performances.
+  I know it's not the cleaner way,  but in C (not in C++) to get
+  performances and genericity...
+
+  Some example of insert and search follows here. The search is a plain
+  normal search over an ordered tree. The insert instead must be implemented
+  int two steps: as first thing the code must insert the element in
+  order as a red leaf in the tree, then the support library function
+  rb_insert_color() must be called. Such function will do the
+  not trivial work to rebalance the rbtree if necessary.
+
+-----------------------------------------------------------------------
+static inline struct page * rb_search_page_cache(struct inode * inode,
+						 unsigned long offset)
+{
+	struct rb_node * n = inode->i_rb_page_cache.rb_node;
+	struct page * page;
+
+	while (n)
+	{
+		page = rb_entry(n, struct page, rb_page_cache);
+
+		if (offset < page->offset)
+			n = n->rb_left;
+		else if (offset > page->offset)
+			n = n->rb_right;
+		else
+			return page;
+	}
+	return NULL;
+}
+
+static inline struct page * __rb_insert_page_cache(struct inode * inode,
+						   unsigned long offset,
+						   struct rb_node * node)
+{
+	struct rb_node ** p = &inode->i_rb_page_cache.rb_node;
+	struct rb_node * parent = NULL;
+	struct page * page;
+
+	while (*p)
+	{
+		parent = *p;
+		page = rb_entry(parent, struct page, rb_page_cache);
+
+		if (offset < page->offset)
+			p = &(*p)->rb_left;
+		else if (offset > page->offset)
+			p = &(*p)->rb_right;
+		else
+			return page;
+	}
+
+	rb_link_node(node, parent, p);
+
+	return NULL;
+}
+
+static inline struct page * rb_insert_page_cache(struct inode * inode,
+						 unsigned long offset,
+						 struct rb_node * node)
+{
+	struct page * ret;
+	if ((ret = __rb_insert_page_cache(inode, offset, node)))
+		goto out;
+	rb_insert_color(node, &inode->i_rb_page_cache);
+ out:
+	return ret;
+}
+-----------------------------------------------------------------------
+*/
+
+#ifndef	_LINUX_RBTREE_H
+#define	_LINUX_RBTREE_H
+
+#include <stdlib.h>
+
+struct rb_node
+{
+	unsigned long  rb_parent_color;
+#define	RB_RED		0
+#define	RB_BLACK	1
+	struct rb_node *rb_right;
+	struct rb_node *rb_left;
+} __attribute__((aligned(sizeof(long))));
+    /* The alignment might seem pointless, but allegedly CRIS needs it */
+
+struct rb_root
+{
+	struct rb_node *rb_node;
+};
+
+
+#define rb_parent(r)   ((struct rb_node *)((r)->rb_parent_color & ~3))
+#define rb_color(r)   ((r)->rb_parent_color & 1)
+#define rb_is_red(r)   (!rb_color(r))
+#define rb_is_black(r) rb_color(r)
+#define rb_set_red(r)  do { (r)->rb_parent_color &= ~1; } while (0)
+#define rb_set_black(r)  do { (r)->rb_parent_color |= 1; } while (0)
+
+static inline void rb_set_parent(struct rb_node *rb, struct rb_node *p)
+{
+	rb->rb_parent_color = (rb->rb_parent_color & 3) | (unsigned long)p;
+}
+static inline void rb_set_color(struct rb_node *rb, int color)
+{
+	rb->rb_parent_color = (rb->rb_parent_color & ~1) | color;
+}
+
+#define RB_ROOT	{ NULL, }
+#define	rb_entry(ptr, type, member) container_of(ptr, type, member)
+
+#define RB_EMPTY_ROOT(root)	((root)->rb_node == NULL)
+#define RB_EMPTY_NODE(node)	(rb_parent(node) == node)
+#define RB_CLEAR_NODE(node)	(rb_set_parent(node, node))
+
+extern void rb_insert_color(struct rb_node *, struct rb_root *);
+extern void rb_erase(struct rb_node *, struct rb_root *);
+
+/* Find logical next and previous nodes in a tree */
+extern struct rb_node *rb_next(const struct rb_node *);
+extern struct rb_node *rb_prev(const struct rb_node *);
+extern struct rb_node *rb_first(const struct rb_root *);
+extern struct rb_node *rb_last(const struct rb_root *);
+
+/* Fast replacement of a single node without remove/rebalance/add/rebalance */
+extern void rb_replace_node(struct rb_node *victim, struct rb_node *_new, 
+			    struct rb_root *root);
+
+static inline void rb_link_node(struct rb_node * node, struct rb_node * parent,
+				struct rb_node ** rb_link)
+{
+	node->rb_parent_color = (unsigned long )parent;
+	node->rb_left = node->rb_right = NULL;
+
+	*rb_link = node;
+}
+
+#endif	/* _LINUX_RBTREE_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/logging.h b/src/shared/libosmocore/include/osmocom/core/logging.h
new file mode 100644
index 00000000..655f7a44
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/logging.h
@@ -0,0 +1,214 @@
+#ifndef _OSMOCORE_LOGGING_H
+#define _OSMOCORE_LOGGING_H
+
+/*! \defgroup logging Osmocom logging framework
+ *  @{
+ */
+
+/*! \file logging.h */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdarg.h>
+#include <osmocom/core/linuxlist.h>
+
+/*! \brief Maximum number of logging contexts */
+#define LOG_MAX_CTX		8
+/*! \brief Maximum number of logging filters */
+#define LOG_MAX_FILTERS	8
+
+#define DEBUG
+
+#ifdef DEBUG
+#define DEBUGP(ss, fmt, args...) logp(ss, __FILE__, __LINE__, 0, fmt, ## args)
+#define DEBUGPC(ss, fmt, args...) logp(ss, __FILE__, __LINE__, 1, fmt, ## args)
+#else
+#define DEBUGP(xss, fmt, args...)
+#define DEBUGPC(ss, fmt, args...)
+#endif
+
+
+void osmo_vlogp(int subsys, int level, const char *file, int line,
+		int cont, const char *format, va_list ap);
+
+void logp(int subsys, const char *file, int line, int cont, const char *format, ...) __attribute__ ((format (printf, 5, 6)));
+
+/*! \brief Log a new message through the Osmocom logging framework
+ *  \param[in] ss logging subsystem (e.g. \ref DLGLOBAL)
+ *  \param[in] level logging level (e.g. \ref LOGL_NOTICE)
+ *  \param[in] fmt format string
+ *  \param[in] args variable argument list
+ */
+#define LOGP(ss, level, fmt, args...) \
+	logp2(ss, level, __FILE__, __LINE__, 0, fmt, ##args)
+
+/*! \brief Continue a log message through the Osmocom logging framework
+ *  \param[in] ss logging subsystem (e.g. \ref DLGLOBAL)
+ *  \param[in] level logging level (e.g. \ref LOGL_NOTICE)
+ *  \param[in] fmt format string
+ *  \param[in] args variable argument list
+ */
+#define LOGPC(ss, level, fmt, args...) \
+	logp2(ss, level, __FILE__, __LINE__, 1, fmt, ##args)
+
+/*! \brief different log levels */
+#define LOGL_DEBUG	1	/*!< \brief debugging information */
+#define LOGL_INFO	3
+#define LOGL_NOTICE	5	/*!< \brief abnormal/unexpected condition */
+#define LOGL_ERROR	7	/*!< \brief error condition, requires user action */
+#define LOGL_FATAL	8	/*!< \brief fatal, program aborted */
+
+#define LOG_FILTER_ALL	0x0001
+
+/* logging levels defined by the library itself */
+#define DLGLOBAL	-1
+#define DLLAPD		-2
+#define DLINP		-3
+#define DLMUX		-4
+#define DLMI		-5
+#define DLMIB		-6
+#define DLSMS		-7
+#define OSMO_NUM_DLIB	7
+
+struct log_category {
+	uint8_t loglevel;
+	uint8_t enabled;
+};
+
+/*! \brief Information regarding one logging category */
+struct log_info_cat {
+	const char *name;		/*!< name of category */
+	const char *color;		/*!< color string for cateyory */
+	const char *description;	/*!< description text */
+	uint8_t loglevel;		/*!< currently selected log-level */
+	uint8_t enabled;		/*!< is this category enabled or not */
+};
+
+/*! \brief Log context information, passed to filter */
+struct log_context {
+	void *ctx[LOG_MAX_CTX+1];
+};
+
+struct log_target;
+
+/*! \brief Log filter function */
+typedef int log_filter(const struct log_context *ctx,
+		       struct log_target *target);
+
+/*! \brief Logging configuration, passed to \ref log_init */
+struct log_info {
+	/* \brief filter callback function */
+	log_filter *filter_fn;
+
+	/*! \brief per-category information */
+	const struct log_info_cat *cat;
+	/*! \brief total number of categories */
+	unsigned int num_cat;
+	/*! \brief total number of user categories (not library) */
+	unsigned int num_cat_user;
+};
+
+/*! \brief Type of logging target */
+enum log_target_type {
+	LOG_TGT_TYPE_VTY,	/*!< \brief VTY logging */
+	LOG_TGT_TYPE_SYSLOG,	/*!< \brief syslog based logging */
+	LOG_TGT_TYPE_FILE,	/*!< \brief text file logging */
+	LOG_TGT_TYPE_STDERR,	/*!< \brief stderr logging */
+};
+
+/*! \brief structure representing a logging target */
+struct log_target {
+        struct llist_head entry;		/*!< \brief linked list */
+
+	/*! \brief Internal data for filtering */
+	int filter_map;
+	/*! \brief Internal data for filtering */
+	void *filter_data[LOG_MAX_FILTERS+1];
+
+	/*! \brief logging categories */
+	struct log_category *categories;
+
+	/*! \brief global log level */
+	uint8_t loglevel;
+	/*! \brief should color be used when printing log messages? */
+	unsigned int use_color:1;
+	/*! \brief should log messages be prefixed with a timestamp? */
+	unsigned int print_timestamp:1;
+	/*! \brief should log messages be prefixed with a filename? */
+	unsigned int print_filename:1;
+
+	/*! \brief the type of this log taget */
+	enum log_target_type type;
+
+	union {
+		struct {
+			FILE *out;
+			const char *fname;
+		} tgt_file;
+
+		struct {
+			int priority;
+			int facility;
+		} tgt_syslog;
+
+		struct {
+			void *vty;
+		} tgt_vty;
+	};
+
+	/*! \brief call-back function to be called when the logging framework
+	 *	   wants to log somethnig.
+	 *  \param[[in] target logging target
+	 *  \param[in] level log level of currnet message
+	 *  \param[in] string the string that is to be written to the log
+	 */
+        void (*output) (struct log_target *target, unsigned int level,
+			const char *string);
+};
+
+/* use the above macros */
+void logp2(int subsys, unsigned int level, const char *file,
+	   int line, int cont, const char *format, ...)
+				__attribute__ ((format (printf, 6, 7)));
+int log_init(const struct log_info *inf, void *talloc_ctx);
+
+/* context management */
+void log_reset_context(void);
+int log_set_context(uint8_t ctx, void *value);
+
+/* filter on the targets */
+void log_set_all_filter(struct log_target *target, int);
+
+void log_set_use_color(struct log_target *target, int);
+void log_set_print_timestamp(struct log_target *target, int);
+void log_set_print_filename(struct log_target *target, int);
+void log_set_log_level(struct log_target *target, int log_level);
+void log_parse_category_mask(struct log_target *target, const char* mask);
+int log_parse_level(const char *lvl);
+const char *log_level_str(unsigned int lvl);
+int log_parse_category(const char *category);
+void log_set_category_filter(struct log_target *target, int category,
+			       int enable, int level);
+
+/* management of the targets */
+struct log_target *log_target_create(void);
+void log_target_destroy(struct log_target *target);
+struct log_target *log_target_create_stderr(void);
+struct log_target *log_target_create_file(const char *fname);
+struct log_target *log_target_create_syslog(const char *ident, int option,
+					    int facility);
+int log_target_file_reopen(struct log_target *tgt);
+
+void log_add_target(struct log_target *target);
+void log_del_target(struct log_target *target);
+
+/* Generate command string for VTY use */
+const char *log_vty_command_string(const struct log_info *info);
+const char *log_vty_command_description(const struct log_info *info);
+
+struct log_target *log_target_find(int type, const char *fname);
+extern struct llist_head osmo_log_target_list;
+
+/*! @} */
+
+#endif /* _OSMOCORE_LOGGING_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/msgb.h b/src/shared/libosmocore/include/osmocom/core/msgb.h
new file mode 100644
index 00000000..a1939ab6
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/msgb.h
@@ -0,0 +1,401 @@
+#ifndef _MSGB_H
+#define _MSGB_H
+
+/* (C) 2008 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/utils.h>
+
+/*! \defgroup msgb Message buffers
+ *  @{
+ */
+
+/*! \file msgb.h
+ *  \brief Osmocom message buffers
+ * The Osmocom message buffers are modelled after the 'struct skb'
+ * inside the Linux kernel network stack.  As they exist in userspace,
+ * they are much simplified.  However, terminology such as headroom,
+ * tailroom, push/pull/put etc. remains the same.
+ */
+
+#define MSGB_DEBUG
+
+/*! \brief Osmocom message buffer */
+struct msgb {
+	struct llist_head list; /*!< \brief linked list header */
+
+
+	/* Part of which TRX logical channel we were received / transmitted */
+	/* FIXME: move them into the control buffer */
+	union {
+		void *dst; /*!< \brief reference of origin/destination */
+		struct gsm_bts_trx *trx;
+	};
+	struct gsm_lchan *lchan; /*!< \brief logical channel */
+
+	unsigned char *l1h; /*!< \brief pointer to Layer1 header (if any) */
+	unsigned char *l2h; /*!< \brief pointer to A-bis layer 2 header: OML, RSL(RLL), NS */
+	unsigned char *l3h; /*!< \brief pointer to Layer 3 header. For OML: FOM; RSL: 04.08; GPRS: BSSGP */
+	unsigned char *l4h; /*!< \brief pointer to layer 4 header */
+
+	unsigned long cb[5]; /*!< \brief control buffer */
+
+	uint16_t data_len;   /*!< \brief length of underlying data array */
+	uint16_t len;	     /*!< \brief length of bytes used in msgb */
+
+	unsigned char *head;	/*!< \brief start of underlying memory buffer */
+	unsigned char *tail;	/*!< \brief end of message in buffer */
+	unsigned char *data;	/*!< \brief start of message in buffer */
+	unsigned char _data[0]; /*!< \brief optional immediate data array */
+};
+
+extern struct msgb *msgb_alloc(uint16_t size, const char *name);
+extern void msgb_free(struct msgb *m);
+extern void msgb_enqueue(struct llist_head *queue, struct msgb *msg);
+extern struct msgb *msgb_dequeue(struct llist_head *queue);
+extern void msgb_reset(struct msgb *m);
+uint16_t msgb_length(const struct msgb *msg);
+
+#ifdef MSGB_DEBUG
+#include <osmocom/core/panic.h>
+#define MSGB_ABORT(msg, fmt, args ...) do {		\
+	osmo_panic("msgb(%p): " fmt, msg, ## args);	\
+	} while(0)
+#else
+#define MSGB_ABORT(msg, fmt, args ...)
+#endif
+
+/*! \brief obtain L1 header of msgb */
+#define msgb_l1(m)	((void *)(m->l1h))
+/*! \brief obtain L2 header of msgb */
+#define msgb_l2(m)	((void *)(m->l2h))
+/*! \brief obtain L3 header of msgb */
+#define msgb_l3(m)	((void *)(m->l3h))
+/*! \brief obtain SMS header of msgb */
+#define msgb_sms(m)	((void *)(m->l4h))
+
+/*! \brief determine length of L1 message
+ *  \param[in] msgb message buffer
+ *  \returns size of L1 message in bytes
+ *
+ * This function computes the number of bytes between the tail of the
+ * message and the layer 1 header.
+ */
+static inline unsigned int msgb_l1len(const struct msgb *msgb)
+{
+	return msgb->tail - (uint8_t *)msgb_l1(msgb);
+}
+
+/*! \brief determine length of L2 message
+ *  \param[in] msgb message buffer
+ *  \returns size of L2 message in bytes
+ *
+ * This function computes the number of bytes between the tail of the
+ * message and the layer 2 header.
+ */
+static inline unsigned int msgb_l2len(const struct msgb *msgb)
+{
+	return msgb->tail - (uint8_t *)msgb_l2(msgb);
+}
+
+/*! \brief determine length of L3 message
+ *  \param[in] msgb message buffer
+ *  \returns size of L3 message in bytes
+ *
+ * This function computes the number of bytes between the tail of the
+ * message and the layer 3 header.
+ */
+static inline unsigned int msgb_l3len(const struct msgb *msgb)
+{
+	return msgb->tail - (uint8_t *)msgb_l3(msgb);
+}
+
+/*! \brief determine the length of the header
+ *  \param[in] msgb message buffer
+ *  \returns number of bytes between start of buffer and start of msg
+ *
+ * This function computes the length difference between the underlying
+ * data buffer and the used section of the \a msgb.
+ */
+static inline unsigned int msgb_headlen(const struct msgb *msgb)
+{
+	return msgb->len - msgb->data_len;
+}
+
+/*! \brief determine how much tail room is left in msgb
+ *  \param[in] msgb message buffer
+ *  \returns number of bytes remaining at end of msgb
+ *
+ * This function computes the amount of octets left in the underlying
+ * data buffer after the end of the message.
+ */
+static inline int msgb_tailroom(const struct msgb *msgb)
+{
+	return (msgb->head + msgb->data_len) - msgb->tail;
+}
+
+/*! \brief determine the amount of headroom in msgb
+ *  \param[in] msgb message buffer
+ *  \returns number of bytes left ahead of message start in msgb
+ *
+ * This function computes the amount of bytes left in the underlying
+ * data buffer before the start of the actual message.
+ */
+static inline int msgb_headroom(const struct msgb *msgb)
+{
+	return (msgb->data - msgb->head);
+}
+
+/*! \brief append data to end of message buffer
+ *  \param[in] msgb message buffer
+ *  \param[in] len number of bytes to append to message
+ *  \returns pointer to start of newly-appended data
+ *
+ * This function will move the \a tail pointer of the message buffer \a
+ * len bytes further, thus enlarging the message by \a len bytes.
+ *
+ * The return value is a pointer to start of the newly added section at
+ * the end of the message and can be used for actually filling/copying
+ * data into it.
+ */
+static inline unsigned char *msgb_put(struct msgb *msgb, unsigned int len)
+{
+	unsigned char *tmp = msgb->tail;
+	if (msgb_tailroom(msgb) < (int) len)
+		MSGB_ABORT(msgb, "Not enough tailroom msgb_push (%u < %u)\n",
+			   msgb_tailroom(msgb), len);
+	msgb->tail += len;
+	msgb->len += len;
+	return tmp;
+}
+
+/*! \brief append a uint8 value to the end of the message
+ *  \param[in] msgb message buffer
+ *  \param[in] word unsigned 8bit byte to be appended
+ */
+static inline void msgb_put_u8(struct msgb *msgb, uint8_t word)
+{
+	uint8_t *space = msgb_put(msgb, 1);
+	space[0] = word & 0xFF;
+}
+
+/*! \brief append a uint16 value to the end of the message
+ *  \param[in] msgb message buffer
+ *  \param[in] word unsigned 16bit byte to be appended
+ */
+static inline void msgb_put_u16(struct msgb *msgb, uint16_t word)
+{
+	uint8_t *space = msgb_put(msgb, 2);
+	space[0] = word >> 8 & 0xFF;
+	space[1] = word & 0xFF;
+}
+
+/*! \brief append a uint32 value to the end of the message
+ *  \param[in] msgb message buffer
+ *  \param[in] word unsigned 32bit byte to be appended
+ */
+static inline void msgb_put_u32(struct msgb *msgb, uint32_t word)
+{
+	uint8_t *space = msgb_put(msgb, 4);
+	space[0] = word >> 24 & 0xFF;
+	space[1] = word >> 16 & 0xFF;
+	space[2] = word >> 8 & 0xFF;
+	space[3] = word & 0xFF;
+}
+
+/*! \brief remove data from end of message
+ *  \param[in] msgb message buffer
+ *  \param[in] len number of bytes to remove from end
+ */
+static inline unsigned char *msgb_get(struct msgb *msgb, unsigned int len)
+{
+	unsigned char *tmp = msgb->data - len;
+	if (msgb_length(msgb) < len)
+		MSGB_ABORT(msgb, "msgb too small to get %u (len %u)\n",
+			   len, msgb_length(msgb));
+	msgb->tail -= len;
+	msgb->len -= len;
+	return tmp;
+}
+/*! \brief remove uint8 from end of message
+ *  \param[in] msgb message buffer
+ *  \returns 8bit value taken from end of msgb
+ */
+static inline uint8_t msgb_get_u8(struct msgb *msgb)
+{
+	uint8_t *space = msgb_get(msgb, 1);
+	return space[0];
+}
+/*! \brief remove uint16 from end of message
+ *  \param[in] msgb message buffer
+ *  \returns 16bit value taken from end of msgb
+ */
+static inline uint16_t msgb_get_u16(struct msgb *msgb)
+{
+	uint8_t *space = msgb_get(msgb, 2);
+	return space[0] << 8 | space[1];
+}
+/*! \brief remove uint32 from end of message
+ *  \param[in] msgb message buffer
+ *  \returns 32bit value taken from end of msgb
+ */
+static inline uint32_t msgb_get_u32(struct msgb *msgb)
+{
+	uint8_t *space = msgb_get(msgb, 4);
+	return space[0] << 24 | space[1] << 16 | space[2] << 8 | space[3];
+}
+
+/*! \brief prepend (push) some data to start of message
+ *  \param[in] msgb message buffer
+ *  \param[in] len number of bytes to pre-pend
+ *  \returns pointer to newly added portion at start of \a msgb
+ *
+ * This function moves the \a data pointer of the \ref msgb further
+ * to the front (by \a len bytes), thereby enlarging the message by \a
+ * len bytes.
+ *
+ * The return value is a pointer to the newly added section in the
+ * beginning of the message.  It can be used to fill/copy data into it.
+ */
+static inline unsigned char *msgb_push(struct msgb *msgb, unsigned int len)
+{
+	if (msgb_headroom(msgb) < (int) len)
+		MSGB_ABORT(msgb, "Not enough headroom msgb_push (%u < %u)\n",
+			   msgb_headroom(msgb), len);
+	msgb->data -= len;
+	msgb->len += len;
+	return msgb->data;
+}
+/*! \brief remove (pull) a header from the front of the message buffer
+ *  \param[in] msgb message buffer
+ *  \param[in] len number of octets to be pulled
+ *  \returns pointer to new start of msgb
+ *
+ * This function moves the \a data pointer of the \ref msgb further back
+ * in the message, thereby shrinking the size of the message by \a len
+ * bytes.
+ */
+static inline unsigned char *msgb_pull(struct msgb *msgb, unsigned int len)
+{
+	msgb->len -= len;
+	return msgb->data += len;
+}
+
+/*! \brief remove uint8 from front of message
+ *  \param[in] msgb message buffer
+ *  \returns 8bit value taken from end of msgb
+ */
+static inline uint8_t msgb_pull_u8(struct msgb *msgb)
+{
+	uint8_t *space = msgb_pull(msgb, 1) - 1;
+	return space[0];
+}
+/*! \brief remove uint16 from front of message
+ *  \param[in] msgb message buffer
+ *  \returns 16bit value taken from end of msgb
+ */
+static inline uint16_t msgb_pull_u16(struct msgb *msgb)
+{
+	uint8_t *space = msgb_pull(msgb, 2) - 2;
+	return space[0] << 8 | space[1];
+}
+/*! \brief remove uint32 from front of message
+ *  \param[in] msgb message buffer
+ *  \returns 32bit value taken from end of msgb
+ */
+static inline uint32_t msgb_pull_u32(struct msgb *msgb)
+{
+	uint8_t *space = msgb_pull(msgb, 4) - 4;
+	return space[0] << 24 | space[1] << 16 | space[2] << 8 | space[3];
+}
+
+/*! \brief Increase headroom of empty msgb, reducing the tailroom
+ *  \param[in] msg message buffer
+ *  \param[in] len amount of extra octets to be reserved as headroom
+ *
+ * This function reserves some memory at the beginning of the underlying
+ * data buffer.  The idea is to reserve space in case further headers
+ * have to be pushed to the \ref msgb during further processing.
+ *
+ * Calling this function leads to undefined reusults if it is called on
+ * a non-empty \ref msgb.
+ */
+static inline void msgb_reserve(struct msgb *msg, int len)
+{
+	msg->data += len;
+	msg->tail += len;
+}
+
+/*! \brief Trim the msgb to a given absolute length
+ *  \param[in] msg message buffer
+ *  \param[in] len new total length of buffer
+ *  \returns 0 in case of success, negative in case of error
+ */
+static inline int msgb_trim(struct msgb *msg, int len)
+{
+	if (len > msg->data_len)
+		return -1;
+
+	msg->len = len;
+	msg->tail = msg->data + len;
+
+	return 0;
+}
+
+/*! \brief Trim the msgb to a given layer3 length
+ *  \pram[in] msg message buffer
+ *  \param[in] l3len new layer3 length
+ *  \returns 0 in case of success, negative in case of error
+ */
+static inline int msgb_l3trim(struct msgb *msg, int l3len)
+{
+	return msgb_trim(msg, (msg->l3h - msg->data) + l3len);
+}
+
+/*! \brief Allocate message buffer with specified headroom
+ *  \param[in] size size in bytes, including headroom
+ *  \param[in] headroom headroom in bytes
+ *  \param[in] name human-readable name
+ *  \returns allocated message buffer with specified headroom
+ *
+ * This function is a convenience wrapper around \ref msgb_alloc
+ * followed by \ref msgb_reserve in order to create a new \ref msgb with
+ * user-specified amount of headroom.
+ */
+static inline struct msgb *msgb_alloc_headroom(int size, int headroom,
+						const char *name)
+{
+	osmo_static_assert(size > headroom, headroom_bigger);
+
+	struct msgb *msg = msgb_alloc(size, name);
+	if (msg)
+		msgb_reserve(msg, headroom);
+	return msg;
+}
+
+/* non inline functions to ease binding */
+
+uint8_t *msgb_data(const struct msgb *msg);
+void msgb_set_talloc_ctx(void *ctx);
+
+/*! @} */
+
+#endif /* _MSGB_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/msgfile.h b/src/shared/libosmocore/include/osmocom/core/msgfile.h
new file mode 100644
index 00000000..c5e67a45
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/msgfile.h
@@ -0,0 +1,49 @@
+/*
+ * (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef MSG_FILE_H
+#define MSG_FILE_H
+
+#include <osmocom/core/linuxlist.h>
+
+/**
+ * One message in the list.
+ */
+struct osmo_config_entry {
+	struct llist_head list;
+
+	/* number for everyone to use */
+	int nr;
+
+	/* data from the file */
+	char *mcc;
+	char *mnc;
+	char *option;
+	char *text;
+};
+
+struct osmo_config_list {
+	struct llist_head entry;
+};
+
+struct osmo_config_list* osmo_config_list_parse(void *ctx, const char *filename);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/core/panic.h b/src/shared/libosmocore/include/osmocom/core/panic.h
new file mode 100644
index 00000000..fd5cf208
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/panic.h
@@ -0,0 +1,20 @@
+#ifndef OSMOCORE_PANIC_H
+#define OSMOCORE_PANIC_H
+
+/*! \addtogroup utils
+ *  @{
+ */
+
+/*! \file panic.h */
+
+#include <stdarg.h>
+
+/*! \brief panic handler callback function type */
+typedef void (*osmo_panic_handler_t)(const char *fmt, va_list args);
+
+extern void osmo_panic(const char *fmt, ...);
+extern void osmo_set_panic_handler(osmo_panic_handler_t h);
+
+/*! @} */
+
+#endif /* OSMOCORE_PANIC_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/plugin.h b/src/shared/libosmocore/include/osmocom/core/plugin.h
new file mode 100644
index 00000000..6c0eccc6
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/plugin.h
@@ -0,0 +1,6 @@
+#ifndef _OSMO_PLUGIN_H
+#define _OSMO_PLUGIN_H
+
+int osmo_plugin_load_all(const char *directory);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/core/prim.h b/src/shared/libosmocore/include/osmocom/core/prim.h
new file mode 100644
index 00000000..b1026fe3
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/prim.h
@@ -0,0 +1,58 @@
+#ifndef OSMO_PRIMITIVE_H
+#define OSMO_PRIMITIVE_H
+
+/*! \defgroup prim Osmocom primitives
+ *  @{
+ */
+
+/*! \file prim.c */
+
+#include <stdint.h>
+#include <osmocom/core/msgb.h>
+
+#define OSMO_PRIM(prim, op)	((prim << 8) | (op & 0xFF))
+#define OSMO_PRIM_HDR(oph)	OSMO_PRIM((oph)->primitive, (oph)->operation)
+
+/*! \brief primitive operation */
+enum osmo_prim_operation {
+	PRIM_OP_REQUEST,	/*!< \brief request */
+	PRIM_OP_RESPONSE,	/*!< \brief response */
+	PRIM_OP_INDICATION,	/*!< \brief indication */
+	PRIM_OP_CONFIRM,	/*!< \brief cofirm */
+};
+
+#define _SAP_GSM_SHIFT	24
+
+#define _SAP_GSM_BASE	(0x01 << _SAP_GSM_SHIFT)
+#define _SAP_TETRA_BASE	(0x02 << _SAP_GSM_SHIFT)
+
+/*! \brief primitive header */
+struct osmo_prim_hdr {
+	unsigned int sap;	/*!< \brief Service Access Point */
+	unsigned int primitive;	/*!< \brief Primitive number */
+	enum osmo_prim_operation operation; /*! \brief Primitive Operation */
+	struct msgb *msg;	/*!< \brief \ref msgb containing associated data */
+};
+
+/*! \brief initialize a primitive header
+ *  \param[in,out] oph primitive header
+ *  \param[in] sap Service Access Point
+ *  \param[in] primtive Primitive Number
+ *  \param[in] operation Primitive Operation (REQ/RESP/IND/CONF)
+ *  \param[in] msg Message
+ */
+static inline void
+osmo_prim_init(struct osmo_prim_hdr *oph, unsigned int sap,
+		unsigned int primitive, enum osmo_prim_operation operation,
+		struct msgb *msg)
+{
+	oph->sap = sap;
+	oph->primitive = primitive;
+	oph->operation = operation;
+	oph->msg = msg;
+}
+
+/*! \brief primitive handler callback type */
+typedef int (*osmo_prim_cb)(struct osmo_prim_hdr *oph, void *ctx);
+
+#endif /* OSMO_PRIMITIVE_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/process.h b/src/shared/libosmocore/include/osmocom/core/process.h
new file mode 100644
index 00000000..1dde0219
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/process.h
@@ -0,0 +1,2 @@
+#warning "Update from osmocom/core/process.h to osmocom/core/application.h"
+#include <osmocom/core/application.h>
diff --git a/src/shared/libosmocore/include/osmocom/core/rate_ctr.h b/src/shared/libosmocore/include/osmocom/core/rate_ctr.h
new file mode 100644
index 00000000..24577fdf
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/rate_ctr.h
@@ -0,0 +1,88 @@
+#ifndef _RATE_CTR_H
+#define _RATE_CTR_H
+
+/*! \defgroup rate_ctr Rate counters
+ *  @{
+ */
+
+/*! \file rate_ctr.h */
+
+#include <stdint.h>
+
+#include <osmocom/core/linuxlist.h>
+
+/*! \brief Number of rate counter intervals */
+#define RATE_CTR_INTV_NUM	4
+
+/*! \brief Rate counter interval */
+enum rate_ctr_intv {
+	RATE_CTR_INTV_SEC,	/*!< \brief last second */
+	RATE_CTR_INTV_MIN,	/*!< \brief last minute */
+	RATE_CTR_INTV_HOUR,	/*!< \brief last hour */
+	RATE_CTR_INTV_DAY,	/*!< \brief last day */
+};
+
+/*! \brief data we keep for each of the intervals */
+struct rate_ctr_per_intv {
+	uint64_t last;		/*!< \brief counter value in last interval */
+	uint64_t rate;		/*!< \brief counter rate */
+};
+
+/*! \brief data we keep for each actual value */
+struct rate_ctr {
+	uint64_t current;	/*!< \brief current value */
+	/*! \brief per-interval data */
+	struct rate_ctr_per_intv intv[RATE_CTR_INTV_NUM];
+};
+
+/*! \brief rate counter description */
+struct rate_ctr_desc {
+	const char *name;	/*!< \brief name of the counter */
+	const char *description;/*!< \brief description of the counter */
+};
+
+/*! \brief description of a rate counter group */
+struct rate_ctr_group_desc {
+	/*! \brief The prefix to the name of all counters in this group */
+	const char *group_name_prefix;
+	/*! \brief The human-readable description of the group */
+	const char *group_description;
+	/*! \brief The number of counters in this group */
+	const unsigned int num_ctr;
+	/*! \brief Pointer to array of counter names */
+	const struct rate_ctr_desc *ctr_desc;
+};
+
+/*! \brief One instance of a counter group class */
+struct rate_ctr_group {
+	/*! \brief Linked list of all counter groups in the system */
+	struct llist_head list;
+	/*! \brief Pointer to the counter group class */
+	const struct rate_ctr_group_desc *desc;
+	/*! \brief The index of this ctr_group within its class */
+	unsigned int idx;
+	/*! \brief Actual counter structures below */
+	struct rate_ctr ctr[0];
+};
+
+struct rate_ctr_group *rate_ctr_group_alloc(void *ctx,
+					    const struct rate_ctr_group_desc *desc,
+					    unsigned int idx);
+
+void rate_ctr_group_free(struct rate_ctr_group *grp);
+
+void rate_ctr_add(struct rate_ctr *ctr, int inc);
+
+/*! \brief Increment the counter by 1 */
+static inline void rate_ctr_inc(struct rate_ctr *ctr)
+{
+	rate_ctr_add(ctr, 1);
+}
+
+int rate_ctr_init(void *tall_ctx);
+
+struct rate_ctr_group *rate_ctr_get_group_by_name_idx(const char *name, const unsigned int idx);
+const struct rate_ctr *rate_ctr_get_by_name(const struct rate_ctr_group *ctrg, const char *name);
+
+/*! @} */
+#endif /* RATE_CTR_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/select.h b/src/shared/libosmocore/include/osmocom/core/select.h
new file mode 100644
index 00000000..efdd716f
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/select.h
@@ -0,0 +1,45 @@
+#ifndef _BSC_SELECT_H
+#define _BSC_SELECT_H
+
+#include <osmocom/core/linuxlist.h>
+
+/*! \defgroup select Select loop abstraction
+ *  @{
+ */
+
+/*! \file select.h
+ *  \brief select loop abstraction
+ */
+
+/*! \brief Indicate interest in reading from the file descriptor */
+#define BSC_FD_READ	0x0001
+/*! \brief Indicate interest in writing to the file descriptor */
+#define BSC_FD_WRITE	0x0002
+/*! \brief Indicate interest in exceptions from the file descriptor */
+#define BSC_FD_EXCEPT	0x0004
+
+/*! \brief Structure representing a file dsecriptor */
+struct osmo_fd {
+	/*! linked list for internal management */
+	struct llist_head list;	
+	/*! actual operating-system level file decriptor */
+	int fd;
+	/*! bit-mask or of \ref BSC_FD_READ, \ref BSC_FD_WRITE and/or
+	 * \ref BSC_FD_EXCEPT */
+	unsigned int when;
+	/*! call-back function to be called once file descriptor becomes
+	 * available */
+	int (*cb)(struct osmo_fd *fd, unsigned int what);
+	/*! data pointer passed through to call-back function */
+	void *data;
+	/*! private number, extending \a data */
+	unsigned int priv_nr;
+};
+
+int osmo_fd_register(struct osmo_fd *fd);
+void osmo_fd_unregister(struct osmo_fd *fd);
+int osmo_select_main(int polling);
+
+/*! @} */
+
+#endif /* _BSC_SELECT_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/serial.h b/src/shared/libosmocore/include/osmocom/core/serial.h
new file mode 100644
index 00000000..889bd8a1
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/serial.h
@@ -0,0 +1,43 @@
+/*
+ * serial.h
+ *
+ * Copyright (C) 2011  Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/*! \defgroup serial Utility functions to deal with serial ports
+ *  @{
+ */
+
+/*! \file serial.h
+ *  \file Osmocom serial port helpers
+ */
+
+#ifndef __OSMO_SERIAL_H__
+#define __OSMO_SERIAL_H__
+
+#include <termios.h>
+
+int osmo_serial_init(const char *dev, speed_t baudrate);
+int osmo_serial_set_baudrate(int fd, speed_t baudrate);
+int osmo_serial_set_custom_baudrate(int fd, int baudrate);
+int osmo_serial_clear_custom_baudrate(int fd);
+
+/*! @} */
+
+#endif /* __OSMO_SERIAL_H__ */
diff --git a/src/shared/libosmocore/include/osmocom/core/signal.h b/src/shared/libosmocore/include/osmocom/core/signal.h
new file mode 100644
index 00000000..b3a5aaee
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/signal.h
@@ -0,0 +1,46 @@
+#ifndef OSMO_SIGNAL_H
+#define OSMO_SIGNAL_H
+
+#include <stdint.h>
+
+/*! \defgroup signal Intra-application signals
+ *  @{
+ */
+/*! \file signal.h */
+
+/* subsystem signaling numbers: we split the numberspace for applications and
+ * libraries: from 0 to UINT_MAX/2 for applications, from UINT_MAX/2 to
+ * UINT_MAX for libraries. */
+#define OSMO_SIGNAL_SS_APPS		0
+#define OSMO_SIGNAL_SS_RESERVED		2147483648u
+
+/*! \brief signal subsystems */
+enum {
+	SS_L_GLOBAL		= OSMO_SIGNAL_SS_RESERVED,
+	SS_L_INPUT,
+	SS_L_NS,
+};
+
+/* application-defined signal types. */
+#define OSMO_SIGNAL_T_APPS		0
+#define OSMO_SIGNAL_T_RESERVED		2147483648u
+
+/*! \brief signal types. */
+enum {
+	S_L_GLOBAL_SHUTDOWN	= OSMO_SIGNAL_T_RESERVED,
+};
+
+/*! signal callback function type */
+typedef int osmo_signal_cbfn(unsigned int subsys, unsigned int signal, void *handler_data, void *signal_data);
+
+
+/* Management */
+int osmo_signal_register_handler(unsigned int subsys, osmo_signal_cbfn *cbfn, void *data);
+void osmo_signal_unregister_handler(unsigned int subsys, osmo_signal_cbfn *cbfn, void *data);
+
+/* Dispatch */
+void osmo_signal_dispatch(unsigned int subsys, unsigned int signal, void *signal_data);
+
+/*! @} */
+
+#endif /* OSMO_SIGNAL_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/socket.h b/src/shared/libosmocore/include/osmocom/core/socket.h
new file mode 100644
index 00000000..f15a03a9
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/socket.h
@@ -0,0 +1,35 @@
+#ifndef _OSMOCORE_SOCKET_H
+#define _OSMOCORE_SOCKET_H
+
+/*! \defgroup socket Socket convenience functions
+ *  @{
+ */
+
+/*! \file socket.h
+ *  \brief Osmocom socket convenience functions
+ */
+
+#include <stdint.h>
+
+struct sockaddr;
+struct osmo_fd;
+
+/* flags for osmo_sock_init. */
+#define OSMO_SOCK_F_CONNECT	(1 << 0)
+#define OSMO_SOCK_F_BIND	(1 << 1)
+#define OSMO_SOCK_F_NONBLOCK	(1 << 2)
+
+int osmo_sock_init(uint16_t family, uint16_t type, uint8_t proto,
+		   const char *host, uint16_t port, unsigned int flags);
+
+int osmo_sock_init_ofd(struct osmo_fd *ofd, int family, int type, int proto,
+			const char *host, uint16_t port, unsigned int flags);
+
+int osmo_sock_init_sa(struct sockaddr *ss, uint16_t type,
+		      uint8_t proto, unsigned int flags);
+
+int osmo_sockaddr_is_local(struct sockaddr *addr, unsigned int addrlen);
+
+/*! @} */
+
+#endif /* _OSMOCORE_SOCKET_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/statistics.h b/src/shared/libosmocore/include/osmocom/core/statistics.h
new file mode 100644
index 00000000..04816c16
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/statistics.h
@@ -0,0 +1,53 @@
+#ifndef _STATISTICS_H
+#define _STATISTICS_H
+
+/*! \file statistics.h
+ *  \brief Common routines regarding statistics */
+
+/*! structure representing a single counter */
+struct osmo_counter {
+	struct llist_head list;		/*!< \brief internal list head */
+	const char *name;		/*!< \brief human-readable name */
+	const char *description;	/*!< \brief humn-readable description */
+	unsigned long value;		/*!< \brief current value */
+};
+
+/*! \brief Increment counter */
+static inline void osmo_counter_inc(struct osmo_counter *ctr)
+{
+	ctr->value++;
+}
+
+/*! \brief Get current value of counter */
+static inline unsigned long osmo_counter_get(struct osmo_counter *ctr)
+{
+	return ctr->value;
+}
+
+/*! \brief Reset current value of counter to 0 */
+static inline void osmo_counter_reset(struct osmo_counter *ctr)
+{
+	ctr->value = 0;
+}
+
+/*! \brief Allocate a new counter */
+struct osmo_counter *osmo_counter_alloc(const char *name);
+
+/*! \brief Free the specified counter
+ *  \param[ctr] Counter
+ */
+void osmo_counter_free(struct osmo_counter *ctr);
+
+/*! \brief Iteate over all counters
+ *  \param[in] handle_counter Call-back function
+ *  \param[in] data Private dtata handed through to \a handle_counter
+ */
+int osmo_counters_for_each(int (*handle_counter)(struct osmo_counter *, void *), void *data);
+
+/*! \brief Resolve counter by human-readable name
+ *  \param[in] name human-readable name of counter
+ *  \returns pointer to counter (\ref osmo_counter) or NULL otherwise
+ */
+struct osmo_counter *osmo_counter_get_by_name(const char *name);
+
+#endif /* _STATISTICS_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/talloc.h b/src/shared/libosmocore/include/osmocom/core/talloc.h
new file mode 100644
index 00000000..f7f7643b
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/talloc.h
@@ -0,0 +1,192 @@
+#ifndef _TALLOC_H_
+#define _TALLOC_H_
+/* 
+   Unix SMB/CIFS implementation.
+   Samba temporary memory allocation functions
+
+   Copyright (C) Andrew Tridgell 2004-2005
+   Copyright (C) Stefan Metzmacher 2006
+   
+     ** NOTE! The following LGPL license applies to the talloc
+     ** library. This does NOT imply that all of Samba is released
+     ** under the LGPL
+   
+   This library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 3 of the License, or (at your option) any later version.
+
+   This library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with this library; if not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdarg.h>
+
+#define HAVE_VA_COPY
+
+/* this is only needed for compatibility with the old talloc */
+typedef void TALLOC_CTX;
+
+/*
+  this uses a little trick to allow __LINE__ to be stringified
+*/
+#ifndef __location__
+#define __TALLOC_STRING_LINE1__(s)    #s
+#define __TALLOC_STRING_LINE2__(s)   __TALLOC_STRING_LINE1__(s)
+#define __TALLOC_STRING_LINE3__  __TALLOC_STRING_LINE2__(__LINE__)
+#define __location__ __FILE__ ":" __TALLOC_STRING_LINE3__
+#endif
+
+#ifndef TALLOC_DEPRECATED
+#define TALLOC_DEPRECATED 0
+#endif
+
+#ifndef PRINTF_ATTRIBUTE
+#if (__GNUC__ >= 3)
+/** Use gcc attribute to check printf fns.  a1 is the 1-based index of
+ * the parameter containing the format, and a2 the index of the first
+ * argument. Note that some gcc 2.x versions don't handle this
+ * properly **/
+#define PRINTF_ATTRIBUTE(a1, a2) __attribute__ ((format (__printf__, a1, a2)))
+#else
+#define PRINTF_ATTRIBUTE(a1, a2)
+#endif
+#endif
+
+/* try to make talloc_set_destructor() and talloc_steal() type safe,
+   if we have a recent gcc */
+#if (__GNUC__ >= 3)
+#define _TALLOC_TYPEOF(ptr) __typeof__(ptr)
+#define talloc_set_destructor(ptr, function)				      \
+	do {								      \
+		int (*_talloc_destructor_fn)(_TALLOC_TYPEOF(ptr)) = (function);	      \
+		_talloc_set_destructor((ptr), (int (*)(void *))_talloc_destructor_fn); \
+	} while(0)
+/* this extremely strange macro is to avoid some braindamaged warning
+   stupidity in gcc 4.1.x */
+#define talloc_steal(ctx, ptr) ({ _TALLOC_TYPEOF(ptr) __talloc_steal_ret = (_TALLOC_TYPEOF(ptr))_talloc_steal((ctx),(ptr)); __talloc_steal_ret; })
+#else
+#define talloc_set_destructor(ptr, function) \
+	_talloc_set_destructor((ptr), (int (*)(void *))(function))
+#define _TALLOC_TYPEOF(ptr) void *
+#define talloc_steal(ctx, ptr) (_TALLOC_TYPEOF(ptr))_talloc_steal((ctx),(ptr))
+#endif
+
+#define talloc_reference(ctx, ptr) (_TALLOC_TYPEOF(ptr))_talloc_reference((ctx),(ptr))
+#define talloc_move(ctx, ptr) (_TALLOC_TYPEOF(*(ptr)))_talloc_move((ctx),(void *)(ptr))
+
+/* useful macros for creating type checked pointers */
+#define talloc(ctx, type) (type *)talloc_named_const(ctx, sizeof(type), #type)
+#define talloc_size(ctx, size) talloc_named_const(ctx, size, __location__)
+#define talloc_ptrtype(ctx, ptr) (_TALLOC_TYPEOF(ptr))talloc_size(ctx, sizeof(*(ptr)))
+
+#define talloc_new(ctx) talloc_named_const(ctx, 0, "talloc_new: " __location__)
+
+#define talloc_zero(ctx, type) (type *)_talloc_zero(ctx, sizeof(type), #type)
+#define talloc_zero_size(ctx, size) _talloc_zero(ctx, size, __location__)
+
+#define talloc_zero_array(ctx, type, count) (type *)_talloc_zero_array(ctx, sizeof(type), count, #type)
+#define talloc_array(ctx, type, count) (type *)_talloc_array(ctx, sizeof(type), count, #type)
+#define talloc_array_size(ctx, size, count) _talloc_array(ctx, size, count, __location__)
+#define talloc_array_ptrtype(ctx, ptr, count) (_TALLOC_TYPEOF(ptr))talloc_array_size(ctx, sizeof(*(ptr)), count)
+#define talloc_array_length(ctx) (talloc_get_size(ctx)/sizeof(*ctx))
+
+#define talloc_realloc(ctx, p, type, count) (type *)_talloc_realloc_array(ctx, p, sizeof(type), count, #type)
+#define talloc_realloc_size(ctx, ptr, size) _talloc_realloc(ctx, ptr, size, __location__)
+
+#define talloc_memdup(t, p, size) _talloc_memdup(t, p, size, __location__)
+
+#define talloc_set_type(ptr, type) talloc_set_name_const(ptr, #type)
+#define talloc_get_type(ptr, type) (type *)talloc_check_name(ptr, #type)
+#define talloc_get_type_abort(ptr, type) (type *)_talloc_get_type_abort(ptr, #type, __location__)
+
+#define talloc_find_parent_bytype(ptr, type) (type *)talloc_find_parent_byname(ptr, #type)
+
+#if TALLOC_DEPRECATED
+#define talloc_zero_p(ctx, type) talloc_zero(ctx, type)
+#define talloc_p(ctx, type) talloc(ctx, type)
+#define talloc_array_p(ctx, type, count) talloc_array(ctx, type, count)
+#define talloc_realloc_p(ctx, p, type, count) talloc_realloc(ctx, p, type, count)
+#define talloc_destroy(ctx) talloc_free(ctx)
+#define talloc_append_string(c, s, a) (s?talloc_strdup_append(s,a):talloc_strdup(c, a))
+#endif
+
+#define TALLOC_FREE(ctx) do { talloc_free(ctx); ctx=NULL; } while(0)
+
+/* The following definitions come from talloc.c  */
+void *_talloc(const void *context, size_t size);
+void *talloc_pool(const void *context, size_t size);
+void _talloc_set_destructor(const void *ptr, int (*_destructor)(void *));
+int talloc_increase_ref_count(const void *ptr);
+size_t talloc_reference_count(const void *ptr);
+void *_talloc_reference(const void *context, const void *ptr);
+int talloc_unlink(const void *context, void *ptr);
+const char *talloc_set_name(const void *ptr, const char *fmt, ...) PRINTF_ATTRIBUTE(2,3);
+void talloc_set_name_const(const void *ptr, const char *name);
+void *talloc_named(const void *context, size_t size, 
+		   const char *fmt, ...) PRINTF_ATTRIBUTE(3,4);
+void *talloc_named_const(const void *context, size_t size, const char *name);
+const char *talloc_get_name(const void *ptr);
+void *talloc_check_name(const void *ptr, const char *name);
+void *_talloc_get_type_abort(const void *ptr, const char *name, const char *location);
+void *talloc_parent(const void *ptr);
+const char *talloc_parent_name(const void *ptr);
+void *talloc_init(const char *fmt, ...) PRINTF_ATTRIBUTE(1,2);
+int talloc_free(void *ptr);
+void talloc_free_children(void *ptr);
+void *_talloc_realloc(const void *context, void *ptr, size_t size, const char *name);
+void *_talloc_steal(const void *new_ctx, const void *ptr);
+void *_talloc_move(const void *new_ctx, const void *pptr);
+size_t talloc_total_size(const void *ptr);
+size_t talloc_total_blocks(const void *ptr);
+void talloc_report_depth_cb(const void *ptr, int depth, int max_depth,
+			    void (*callback)(const void *ptr,
+			  		     int depth, int max_depth,
+					     int is_ref,
+					     void *private_data),
+			    void *private_data);
+void talloc_report_depth_file(const void *ptr, int depth, int max_depth, FILE *f);
+void talloc_report_full(const void *ptr, FILE *f);
+void talloc_report(const void *ptr, FILE *f);
+void talloc_enable_null_tracking(void);
+void talloc_disable_null_tracking(void);
+void talloc_enable_leak_report(void);
+void talloc_enable_leak_report_full(void);
+void *_talloc_zero(const void *ctx, size_t size, const char *name);
+void *_talloc_memdup(const void *t, const void *p, size_t size, const char *name);
+void *_talloc_array(const void *ctx, size_t el_size, unsigned count, const char *name);
+void *_talloc_zero_array(const void *ctx, size_t el_size, unsigned count, const char *name);
+void *_talloc_realloc_array(const void *ctx, void *ptr, size_t el_size, unsigned count, const char *name);
+void *talloc_realloc_fn(const void *context, void *ptr, size_t size);
+void *talloc_autofree_context(void);
+size_t talloc_get_size(const void *ctx);
+void *talloc_find_parent_byname(const void *ctx, const char *name);
+void talloc_show_parents(const void *context, FILE *file);
+int talloc_is_parent(const void *context, const void *ptr);
+
+char *talloc_strdup(const void *t, const char *p);
+char *talloc_strdup_append(char *s, const char *a);
+char *talloc_strdup_append_buffer(char *s, const char *a);
+
+char *talloc_strndup(const void *t, const char *p, size_t n);
+char *talloc_strndup_append(char *s, const char *a, size_t n);
+char *talloc_strndup_append_buffer(char *s, const char *a, size_t n);
+
+char *talloc_vasprintf(const void *t, const char *fmt, va_list ap) PRINTF_ATTRIBUTE(2,0);
+char *talloc_vasprintf_append(char *s, const char *fmt, va_list ap) PRINTF_ATTRIBUTE(2,0);
+char *talloc_vasprintf_append_buffer(char *s, const char *fmt, va_list ap) PRINTF_ATTRIBUTE(2,0);
+
+char *talloc_asprintf(const void *t, const char *fmt, ...) PRINTF_ATTRIBUTE(2,3);
+char *talloc_asprintf_append(char *s, const char *fmt, ...) PRINTF_ATTRIBUTE(2,3);
+char *talloc_asprintf_append_buffer(char *s, const char *fmt, ...) PRINTF_ATTRIBUTE(2,3);
+
+void talloc_set_abort_fn(void (*abort_fn)(const char *reason));
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/core/timer.h b/src/shared/libosmocore/include/osmocom/core/timer.h
new file mode 100644
index 00000000..d37af806
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/timer.h
@@ -0,0 +1,89 @@
+/*
+ * (C) 2008, 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \defgroup timer Osmocom timers
+ *  @{
+ */
+
+/*! \file timer.h
+ *  \brief Osmocom timer handling routines
+ */
+
+#ifndef TIMER_H
+#define TIMER_H
+
+#include <sys/time.h>
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/linuxrbtree.h>
+
+/**
+ * Timer management:
+ *      - Create a struct osmo_timer_list
+ *      - Fill out timeout and use add_timer or
+ *        use schedule_timer to schedule a timer in
+ *        x seconds and microseconds from now...
+ *      - Use del_timer to remove the timer
+ *
+ *  Internally:
+ *      - We hook into select.c to give a timeval of the
+ *        nearest timer. On already passed timers we give
+ *        it a 0 to immediately fire after the select
+ *      - update_timers will call the callbacks and remove
+ *        the timers.
+ *
+ */
+/*! \brief A structure representing a single instance of a timer */
+struct osmo_timer_list {
+	struct rb_node node;	  /*!< \brief rb-tree node header */
+	struct llist_head list;   /*!< \brief internal list header */
+	struct timeval timeout;   /*!< \brief expiration time */
+	unsigned int active  : 1; /*!< \brief is it active? */
+
+	void (*cb)(void*);	  /*!< \brief call-back called at timeout */
+	void *data;		  /*!< \brief user data for callback */
+};
+
+/**
+ * timer management
+ */
+
+void osmo_timer_add(struct osmo_timer_list *timer);
+
+void osmo_timer_schedule(struct osmo_timer_list *timer, int seconds, int microseconds);
+
+void osmo_timer_del(struct osmo_timer_list *timer);
+
+int osmo_timer_pending(struct osmo_timer_list *timer);
+
+int osmo_timer_remaining(const struct osmo_timer_list *timer,
+			 const struct timeval *now,
+			 struct timeval *remaining);
+/*
+ * internal timer list management
+ */
+struct timeval *osmo_timers_nearest(void);
+void osmo_timers_prepare(void);
+int osmo_timers_update(void);
+int osmo_timers_check(void);
+
+/*! @} */
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/core/timer_compat.h b/src/shared/libosmocore/include/osmocom/core/timer_compat.h
new file mode 100644
index 00000000..d86c109e
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/timer_compat.h
@@ -0,0 +1,79 @@
+/*
+ * (C) 2011 Sylvain Munaut <tnt@246tNt.com>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \defgroup timer Osmocom timers
+ *  @{
+ */
+
+/*! \file timer_compat.h
+ *  \brief Compatibility header with some helpers
+ */
+
+#ifndef TIMER_COMPAT_H
+#define TIMER_COMPAT_H
+
+
+/* Convenience macros for operations on timevals.
+   NOTE: `timercmp' does not work for >= or <=.  */
+
+#ifndef timerisset
+# define timerisset(tvp)	((tvp)->tv_sec || (tvp)->tv_usec)
+#endif
+
+#ifndef timerclear
+# define timerclear(tvp)	((tvp)->tv_sec = (tvp)->tv_usec = 0)
+#endif
+
+#ifndef timercmp
+# define timercmp(a, b, CMP) 						      \
+  (((a)->tv_sec == (b)->tv_sec) ? 					      \
+   ((a)->tv_usec CMP (b)->tv_usec) : 					      \
+   ((a)->tv_sec CMP (b)->tv_sec))
+#endif
+
+#ifndef timeradd
+# define timeradd(a, b, result)						      \
+  do {									      \
+    (result)->tv_sec = (a)->tv_sec + (b)->tv_sec;			      \
+    (result)->tv_usec = (a)->tv_usec + (b)->tv_usec;			      \
+    if ((result)->tv_usec >= 1000000)					      \
+      {									      \
+	++(result)->tv_sec;						      \
+	(result)->tv_usec -= 1000000;					      \
+      }									      \
+  } while (0)
+#endif
+
+#ifndef timersub
+# define timersub(a, b, result)						      \
+  do {									      \
+    (result)->tv_sec = (a)->tv_sec - (b)->tv_sec;			      \
+    (result)->tv_usec = (a)->tv_usec - (b)->tv_usec;			      \
+    if ((result)->tv_usec < 0) {					      \
+      --(result)->tv_sec;						      \
+      (result)->tv_usec += 1000000;					      \
+    }									      \
+  } while (0)
+#endif
+
+
+/*! @} */
+
+#endif /* TIMER_COMPAT_H */
diff --git a/src/shared/libosmocore/include/osmocom/core/utils.h b/src/shared/libosmocore/include/osmocom/core/utils.h
new file mode 100644
index 00000000..03861d78
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/utils.h
@@ -0,0 +1,56 @@
+#ifndef OSMOCORE_UTIL_H
+#define OSMOCORE_UTIL_H
+
+/*! \defgroup utils General-purpose utility functions
+ *  @{
+ */
+
+/*! \file utils.h */
+
+/*! \brief Determine number of elements in an array of static size */
+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+/*! \brief Return the maximum of two specified values */
+#define OSMO_MAX(a, b) ((a) >= (b) ? (a) : (b))
+/*! \brief Return the minimum of two specified values */
+#define OSMO_MIN(a, b) ((a) >= (b) ? (b) : (a))
+
+#include <stdint.h>
+
+/*! \brief A mapping between human-readable string and numeric value */
+struct value_string {
+	unsigned int value;	/*!< \brief numeric value */
+	const char *str;	/*!< \brief human-readable string */
+};
+
+const char *get_value_string(const struct value_string *vs, uint32_t val);
+
+int get_string_value(const struct value_string *vs, const char *str);
+
+char osmo_bcd2char(uint8_t bcd);
+/* only works for numbers in ascci */
+uint8_t osmo_char2bcd(char c);
+
+int osmo_hexparse(const char *str, uint8_t *b, int max_len);
+
+char *osmo_ubit_dump(const uint8_t *bits, unsigned int len);
+char *osmo_hexdump(const unsigned char *buf, int len);
+char *osmo_hexdump_nospc(const unsigned char *buf, int len);
+char *osmo_osmo_hexdump_nospc(const unsigned char *buf, int len) __attribute__((__deprecated__));
+
+#define osmo_static_assert(exp, name) typedef int dummy##name [(exp) ? 1 : -1];
+
+void osmo_str2lower(char *out, const char *in);
+void osmo_str2upper(char *out, const char *in);
+
+#define OSMO_SNPRINTF_RET(ret, rem, offset, len)		\
+do {								\
+	len += ret;						\
+	if (ret > rem)						\
+		ret = rem;					\
+	offset += ret;						\
+	rem -= ret;						\
+} while (0)
+
+/*! @} */
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/core/write_queue.h b/src/shared/libosmocore/include/osmocom/core/write_queue.h
new file mode 100644
index 00000000..816c0364
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/core/write_queue.h
@@ -0,0 +1,63 @@
+/* Generic write queue implementation */
+/*
+ * (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by On-Waves
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+#ifndef OSMO_WQUEUE_H
+#define OSMO_WQUEUE_H
+
+/*! \defgroup write_queue Osmocom msgb write queues
+ *  @{
+ */
+
+/*! \file write_queue.h
+ */
+
+#include <osmocom/core/select.h>
+#include <osmocom/core/msgb.h>
+
+/*! write queue instance */
+struct osmo_wqueue {
+	/*! \brief osmocom file descriptor */
+	struct osmo_fd bfd;
+	/*! \brief maximum length of write queue */
+	unsigned int max_length;
+	/*! \brief current length of write queue */
+	unsigned int current_length;
+
+	/*! \brief actual linked list implementing the queue */
+	struct llist_head msg_queue;
+
+	/*! \brief call-back in case qeueue is readable */
+	int (*read_cb)(struct osmo_fd *fd);
+	/*! \brief call-back in case qeueue is writable */
+	int (*write_cb)(struct osmo_fd *fd, struct msgb *msg);
+	/*! \brief call-back in case qeueue has exceptions */
+	int (*except_cb)(struct osmo_fd *fd);
+};
+
+void osmo_wqueue_init(struct osmo_wqueue *queue, int max_length);
+void osmo_wqueue_clear(struct osmo_wqueue *queue);
+int osmo_wqueue_enqueue(struct osmo_wqueue *queue, struct msgb *data);
+int osmo_wqueue_bfd_cb(struct osmo_fd *fd, unsigned int what);
+
+/*! @} */
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/crypt/auth.h b/src/shared/libosmocore/include/osmocom/crypt/auth.h
new file mode 100644
index 00000000..871e7c87
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/crypt/auth.h
@@ -0,0 +1,101 @@
+#ifndef _OSMOCRYPTO_AUTH_H
+#define _OSMOCRYPTO_AUTH_H
+
+/*! \addtogroup auth
+ *  @{
+ */
+
+/*! \file auth.h */
+
+#include <stdint.h>
+
+#include <osmocom/core/linuxlist.h>
+
+/*! \brief Authentication Type (GSM/UMTS) */
+enum osmo_sub_auth_type {
+	OSMO_AUTH_TYPE_NONE	= 0x00,
+	OSMO_AUTH_TYPE_GSM	= 0x01,
+	OSMO_AUTH_TYPE_UMTS	= 0x02,
+};
+
+/*! \brief Authentication Algorithm */
+enum osmo_auth_algo {
+	OSMO_AUTH_ALG_NONE,
+	OSMO_AUTH_ALG_COMP128v1,
+	OSMO_AUTH_ALG_COMP128v2,
+	OSMO_AUTH_ALG_COMP128v3,
+	OSMO_AUTH_ALG_XOR,
+	OSMO_AUTH_ALG_MILENAGE,
+	_OSMO_AUTH_ALG_NUM,
+};
+
+/*! \brief permanent (secret) subscriber auth data */
+struct osmo_sub_auth_data {
+	enum osmo_sub_auth_type type;
+	enum osmo_auth_algo algo;
+	union {
+		struct {
+			uint8_t opc[16]; /*!< operator invariant value */
+			uint8_t k[16];	/*!< secret key of the subscriber */
+			uint8_t amf[2];
+			uint64_t sqn;	/*!< sequence number */
+			int opc_is_op;	/*!< is the OPC field OPC (0) or OP (1) ? */
+		} umts;
+		struct {
+			uint8_t ki[16];	/*!< secret key */
+		} gsm;
+	} u;
+};
+
+/* data structure describing a computed auth vector, generated by AuC */
+struct osmo_auth_vector {
+	uint8_t rand[16];	/*!< random challenge */
+	uint8_t autn[16];	/*!< authentication nonce */
+	uint8_t ck[16];		/*!< ciphering key */
+	uint8_t ik[16];		/*!< integrity key */
+	uint8_t res[16];	/*!< authentication result */
+	uint8_t res_len;	/*!< length (in bytes) of res */
+	uint8_t kc[8];		/*!< Kc for GSM encryption (A5) */
+	uint8_t sres[4];	/*!< authentication result for GSM */
+	uint32_t auth_types;	/*!< bitmask of OSMO_AUTH_TYPE_* */
+};
+
+/* \brief An implementation of an authentication algorithm */
+struct osmo_auth_impl {
+	struct llist_head list;
+	enum osmo_auth_algo algo; /*!< algorithm we implement */
+	const char *name;	/*!< name of the implementation */
+	unsigned int priority;	/*!< priority value (resp. othe implementations */
+
+	/*! \brief callback for generate authentication vectors */
+	int (*gen_vec)(struct osmo_auth_vector *vec,
+			struct osmo_sub_auth_data *aud,
+			const uint8_t *_rand);
+
+	/* \brief callback for generationg auth vectors + re-sync */
+	int (*gen_vec_auts)(struct osmo_auth_vector *vec,
+			    struct osmo_sub_auth_data *aud,
+			    const uint8_t *rand_auts, const uint8_t *auts,
+			    const uint8_t *_rand);
+};
+
+int osmo_auth_gen_vec(struct osmo_auth_vector *vec,
+		      struct osmo_sub_auth_data *aud, const uint8_t *_rand);
+
+int osmo_auth_gen_vec_auts(struct osmo_auth_vector *vec,
+			   struct osmo_sub_auth_data *aud,
+			   const uint8_t *rand_auts, const uint8_t *auts,
+			   const uint8_t *_rand);
+
+int osmo_auth_register(struct osmo_auth_impl *impl);
+
+int osmo_auth_load(const char *path);
+
+int osmo_auth_supported(enum osmo_auth_algo algo);
+
+const char *osmo_auth_alg_name(enum osmo_auth_algo alg);
+enum osmo_auth_algo osmo_auth_alg_parse(const char *name);
+
+#endif /* _OSMOCRYPTO_AUTH_H */
+
+/* @} */
diff --git a/src/shared/libosmocore/include/osmocom/crypt/gprs_cipher.h b/src/shared/libosmocore/include/osmocom/crypt/gprs_cipher.h
new file mode 100644
index 00000000..30510711
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/crypt/gprs_cipher.h
@@ -0,0 +1,54 @@
+#ifndef _GPRS_CIPHER_H
+#define _GPRS_CIPHER_H
+
+#include <osmocom/core/linuxlist.h>
+
+#define GSM0464_CIPH_MAX_BLOCK	1523
+
+enum gprs_ciph_algo {
+	GPRS_ALGO_GEA0,
+	GPRS_ALGO_GEA1,
+	GPRS_ALGO_GEA2,
+	GPRS_ALGO_GEA3,
+	_GPRS_ALGO_NUM
+};
+
+enum gprs_cipher_direction {
+	GPRS_CIPH_MS2SGSN,
+	GPRS_CIPH_SGSN2MS,
+};
+
+/* An implementation of a GPRS cipher */
+struct gprs_cipher_impl {
+	struct llist_head list;
+	enum gprs_ciph_algo algo;
+	const char *name;
+	unsigned int priority;
+
+	/* As specified in 04.64 Annex A.  Uses Kc, IV and direction
+	 * to generate the 1523 bytes cipher stream that need to be
+	 * XORed wit the plaintext for encrypt / ciphertext for decrypt */
+	int (*run)(uint8_t *out, uint16_t len, uint64_t kc, uint32_t iv,
+		   enum gprs_cipher_direction direction);
+};
+
+/* register a cipher with the core (from a plugin) */
+int gprs_cipher_register(struct gprs_cipher_impl *ciph);
+
+/* load all available GPRS cipher plugins */
+int gprs_cipher_load(const char *path);
+
+/* function to be called by core code */
+int gprs_cipher_run(uint8_t *out, uint16_t len, enum gprs_ciph_algo algo,
+		    uint64_t kc, uint32_t iv, enum gprs_cipher_direction dir);
+
+/* Do we have an implementation for this cipher? */
+int gprs_cipher_supported(enum gprs_ciph_algo algo);
+
+/* GSM TS 04.64 / Section A.2.1 : Generation of 'input' */
+uint32_t gprs_cipher_gen_input_ui(uint32_t iov_ui, uint8_t sapi, uint32_t lfn, uint32_t oc);
+
+/* GSM TS 04.64 / Section A.2.1 : Generation of 'input' */
+uint32_t gprs_cipher_gen_input_i(uint32_t iov_i, uint32_t lfn, uint32_t oc);
+
+#endif /* _GPRS_CIPHER_H */
diff --git a/src/shared/libosmocore/include/osmocom/gprs/gprs_bssgp.h b/src/shared/libosmocore/include/osmocom/gprs/gprs_bssgp.h
new file mode 100644
index 00000000..eb4e7219
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gprs/gprs_bssgp.h
@@ -0,0 +1,211 @@
+#ifndef _GPRS_BSSGP_H
+#define _GPRS_BSSGP_H
+
+#include <stdint.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/linuxlist.h>
+
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/gsm/prim.h>
+
+#include <osmocom/gprs/protocol/gsm_08_18.h>
+
+/* gprs_bssgp_util.c */
+extern struct gprs_ns_inst *bssgp_nsi;
+struct msgb *bssgp_msgb_alloc(void);
+const char *bssgp_cause_str(enum gprs_bssgp_cause cause);
+/* Transmit a simple response such as BLOCK/UNBLOCK/RESET ACK/NACK */
+int bssgp_tx_simple_bvci(uint8_t pdu_type, uint16_t nsei,
+			 uint16_t bvci, uint16_t ns_bvci);
+/* Chapter 10.4.14: Status */
+int bssgp_tx_status(uint8_t cause, uint16_t *bvci, struct msgb *orig_msg);
+
+enum bssgp_prim {
+	PRIM_BSSGP_DL_UD,
+	PRIM_BSSGP_UL_UD,
+	PRIM_BSSGP_PTM_UD,
+
+	PRIM_BSSGP_GMM_SUSPEND,
+	PRIM_BSSGP_GMM_RESUME,
+	PRIM_BSSGP_GMM_PAGING,
+
+	PRIM_NM_FLUSH_LL,
+	PRIM_NM_LLC_DISCARDED,
+	PRIM_NM_BVC_RESET,
+	PRIM_NM_BVC_BLOCK,
+	PRIM_NM_BVC_UNBLOCK,
+};
+
+struct osmo_bssgp_prim {
+	struct osmo_prim_hdr oph;
+
+	/* common fields */
+	uint16_t nsei;
+	uint16_t bvci;
+	uint32_t tlli;
+	struct tlv_parsed *tp;
+	struct gprs_ra_id *ra_id;
+
+	/* specific fields */
+	union {
+		struct {
+			uint8_t suspend_ref;
+		} resume;
+	} u;
+};
+
+/* gprs_bssgp.c */
+
+/*! \brief BSSGP flow control (SGSN side) According to Section 8.2 */
+struct bssgp_flow_control {
+	uint32_t bucket_size_max;	/*!< maximum size of the bucket (octets) */
+	uint32_t bucket_leak_rate; 	/*!< leak rate of the bucket (octets/sec) */
+
+	uint32_t bucket_counter;	/*!< number of tokens in the bucket */
+	struct timeval time_last_pdu;	/*!< timestamp of last PDU sent */
+
+	/* the built-in queue */
+	uint32_t max_queue_depth;	/*!< how many packets to queue (mgs) */
+	uint32_t queue_depth;		/*!< current length of queue (msgs) */
+	struct llist_head queue;	/*!< linked list of msgb's */
+	struct osmo_timer_list timer;	/*!< timer-based dequeueing */
+
+	/*! callback to be called at output of flow control */
+	int (*out_cb)(struct bssgp_flow_control *fc, struct msgb *msg,
+			uint32_t llc_pdu_len, void *priv);
+};
+
+#define BVC_S_BLOCKED	0x0001
+
+/* The per-BTS context that we keep on the SGSN side of the BSSGP link */
+struct bssgp_bvc_ctx {
+	struct llist_head list;
+
+	struct gprs_ra_id ra_id; /*!< parsed RA ID of the remote BTS */
+	uint16_t cell_id; /*!< Cell ID of the remote BTS */
+
+	/* NSEI and BVCI of underlying Gb link.  Together they
+	 * uniquely identify a link to a BTS (5.4.4) */
+	uint16_t bvci;
+	uint16_t nsei;
+
+	uint32_t state;
+
+	struct rate_ctr_group *ctrg;
+
+	struct bssgp_flow_control *fc;
+	/*! default maximum size of per-MS bucket in octets */
+	uint32_t bmax_default_ms;
+	/*! default bucket leak rate of per-MS bucket in octests/s */
+	uint32_t r_default_ms;
+
+	/* we might want to add this as a shortcut later, avoiding the NSVC
+	 * lookup for every packet, similar to a routing cache */
+	//struct gprs_nsvc *nsvc;
+};
+extern struct llist_head bssgp_bvc_ctxts;
+/* Find a BTS Context based on parsed RA ID and Cell ID */
+struct bssgp_bvc_ctx *btsctx_by_raid_cid(const struct gprs_ra_id *raid, uint16_t cid);
+/* Find a BTS context based on BVCI+NSEI tuple */
+struct bssgp_bvc_ctx *btsctx_by_bvci_nsei(uint16_t bvci, uint16_t nsei);
+
+#define BVC_F_BLOCKED	0x0001
+
+enum bssgp_ctr {
+	BSSGP_CTR_PKTS_IN,
+	BSSGP_CTR_PKTS_OUT,
+	BSSGP_CTR_BYTES_IN,
+	BSSGP_CTR_BYTES_OUT,
+	BSSGP_CTR_BLOCKED,
+	BSSGP_CTR_DISCARDED,
+};
+
+
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gprs/gprs_msgb.h>
+
+/* BSSGP-UL-UNITDATA.ind */
+int bssgp_rcvmsg(struct msgb *msg);
+
+/* BSSGP-DL-UNITDATA.req */
+struct bssgp_lv {
+	uint16_t len;
+	uint8_t *v;
+};
+/* parameters for BSSGP downlink userdata transmission */
+struct bssgp_dl_ud_par {
+	uint32_t *tlli;
+	char *imsi;
+	struct bssgp_flow_control *fc;
+	uint16_t drx_parms;
+	/* FIXME: priority */
+	struct bssgp_lv ms_ra_cap;
+	uint8_t qos_profile[3];
+};
+int bssgp_tx_dl_ud(struct msgb *msg, uint16_t pdu_lifetime,
+		   struct bssgp_dl_ud_par *dup);
+
+uint16_t bssgp_parse_cell_id(struct gprs_ra_id *raid, const uint8_t *buf);
+int bssgp_create_cell_id(uint8_t *buf, const struct gprs_ra_id *raid,
+			 uint16_t cid);
+
+/* Wrapper around TLV parser to parse BSSGP IEs */
+static inline int bssgp_tlv_parse(struct tlv_parsed *tp, uint8_t *buf, int len)
+{
+	return tlv_parse(tp, &tvlv_att_def, buf, len, 0, 0);
+}
+
+/*! \brief BSSGP Paging mode */
+enum bssgp_paging_mode {
+	BSSGP_PAGING_PS,
+	BSSGP_PAGING_CS,
+};
+
+/*! \brief BSSGP Paging scope */
+enum bssgp_paging_scope {
+	BSSGP_PAGING_BSS_AREA,		/*!< all cells in BSS */
+	BSSGP_PAGING_LOCATION_AREA,	/*!< all cells in LA */
+	BSSGP_PAGING_ROUTEING_AREA,	/*!< all cells in RA */
+	BSSGP_PAGING_BVCI,		/*!< one cell */
+};
+
+/*! \brief BSSGP paging information */
+struct bssgp_paging_info {
+	enum bssgp_paging_mode mode;	/*!< CS or PS paging */
+	enum bssgp_paging_scope scope;	/*!< bssgp_paging_scope */
+	struct gprs_ra_id raid;		/*!< RA Identifier */
+	uint16_t bvci;			/*!< BVCI */
+	char *imsi;			/*!< IMSI, if any */
+	uint32_t *ptmsi;		/*!< P-TMSI, if any */
+	uint16_t drx_params;		/*!< DRX parameters */
+	uint8_t qos[3];			/*!< QoS parameters */
+};
+
+/* Send a single GMM-PAGING.req to a given NSEI/NS-BVCI */
+int bssgp_tx_paging(uint16_t nsei, uint16_t ns_bvci,
+		    struct bssgp_paging_info *pinfo);
+
+void bssgp_fc_init(struct bssgp_flow_control *fc,
+		   uint32_t bucket_size_max, uint32_t bucket_leak_rate,
+		   uint32_t max_queue_depth,
+		   int (*out_cb)(struct bssgp_flow_control *fc, struct msgb *msg,
+				 uint32_t llc_pdu_len, void *priv));
+
+/* input function of the flow control implementation, called first
+ * for the MM flow control, and then as the MM flow control output
+ * callback in order to perform BVC flow control */
+int bssgp_fc_in(struct bssgp_flow_control *fc, struct msgb *msg,
+		uint32_t llc_pdu_len, void *priv);
+
+/* Initialize the Flow Control parameters for a new MS according to
+ * default values for the BVC specified by BVCI and NSEI */
+int bssgp_fc_ms_init(struct bssgp_flow_control *fc_ms, uint16_t bvci,
+		     uint16_t nsei, uint32_t max_queue_depth);
+
+/* gprs_bssgp_vty.c */
+int bssgp_vty_init(void);
+void bssgp_set_log_ss(int ss);
+
+int bssgp_prim_cb(struct osmo_prim_hdr *oph, void *ctx);
+
+#endif /* _GPRS_BSSGP_H */
diff --git a/src/shared/libosmocore/include/osmocom/gprs/gprs_bssgp_bss.h b/src/shared/libosmocore/include/osmocom/gprs/gprs_bssgp_bss.h
new file mode 100644
index 00000000..f34281e3
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gprs/gprs_bssgp_bss.h
@@ -0,0 +1,75 @@
+#ifndef _BSSGP_BSS_H
+#define _BSSGP_BSS_H
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+
+/* GPRS BSSGP protocol implementation as per 3GPP TS 08.18 */
+
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+uint8_t *bssgp_msgb_tlli_put(struct msgb *msg, uint32_t tlli);
+
+int bssgp_tx_suspend(uint16_t nsei, uint32_t tlli,
+		     const struct gprs_ra_id *ra_id);
+
+int bssgp_tx_resume(uint16_t nsei, uint32_t tlli,
+		    const struct gprs_ra_id *ra_id, uint8_t suspend_ref);
+
+int bssgp_tx_ra_capa_upd(struct bssgp_bvc_ctx *bctx, uint32_t tlli, uint8_t tag);
+
+int bssgp_tx_radio_status_tlli(struct bssgp_bvc_ctx *bctx, uint8_t cause,
+				uint32_t tlli);
+
+int bssgp_tx_radio_status_tmsi(struct bssgp_bvc_ctx *bctx, uint8_t cause,
+				uint32_t tmsi);
+
+int bssgp_tx_radio_status_imsi(struct bssgp_bvc_ctx *bctx, uint8_t cause,
+				const char *imsi);
+
+int bssgp_tx_flush_ll_ack(struct bssgp_bvc_ctx *bctx, uint32_t tlli,
+			   uint8_t action, uint16_t bvci_new,
+			   uint32_t num_octets);
+
+int bssgp_tx_llc_discarded(struct bssgp_bvc_ctx *bctx, uint32_t tlli,
+			   uint8_t num_frames, uint32_t num_octets);
+
+int bssgp_tx_bvc_block(struct bssgp_bvc_ctx *bctx, uint8_t cause);
+
+int bssgp_tx_bvc_unblock(struct bssgp_bvc_ctx *bctx);
+
+int bssgp_tx_bvc_reset(struct bssgp_bvc_ctx *bctx, uint16_t bvci, uint8_t cause);
+
+int bssgp_tx_ul_ud(struct bssgp_bvc_ctx *bctx, uint32_t tlli,
+		   const uint8_t *qos_profile, struct msgb *llc_pdu);
+
+int bssgp_rx_paging(struct bssgp_paging_info *pinfo,
+		    struct msgb *msg);
+
+int bssgp_tx_fc_bvc(struct bssgp_bvc_ctx *bctx, uint8_t tag,
+		    uint32_t bucket_size, uint32_t bucket_leak_rate,
+		    uint16_t bmax_default_ms, uint32_t r_default_ms,
+		    uint8_t *bucket_full_ratio, uint32_t *queue_delay_ms);
+
+int bssgp_tx_fc_ms(struct bssgp_bvc_ctx *bctx, uint32_t tlli, uint8_t tag,
+		   uint32_t ms_bucket_size, uint32_t bucket_leak_rate,
+		   uint8_t *bucket_full_ratio);
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gprs/gprs_msgb.h b/src/shared/libosmocore/include/osmocom/gprs/gprs_msgb.h
new file mode 100644
index 00000000..f4c85547
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gprs/gprs_msgb.h
@@ -0,0 +1,37 @@
+#ifndef _LIBGB_MSGB_H
+#define _LIBGB_MSGB_H
+
+#include <stdint.h>
+/* the data structure stored in msgb->cb for libgb apps */
+struct libgb_msgb_cb {
+	unsigned char *bssgph;
+	unsigned char *llch;
+
+	/* Cell Identifier */
+	unsigned char *bssgp_cell_id;
+
+	/* Identifiers of a BTS, equal to 'struct bssgp_bts_ctx' */
+	uint16_t nsei;
+	uint16_t bvci;
+
+	/* Identifier of a MS (inside BTS), equal to 'struct sgsn_mm_ctx' */
+	uint32_t tlli;
+} __attribute__((packed));
+#define LIBGB_MSGB_CB(__msgb)	((struct libgb_msgb_cb *)&((__msgb)->cb[0]))
+#define msgb_tlli(__x)		LIBGB_MSGB_CB(__x)->tlli
+#define msgb_nsei(__x)		LIBGB_MSGB_CB(__x)->nsei
+#define msgb_bvci(__x)		LIBGB_MSGB_CB(__x)->bvci
+#define msgb_gmmh(__x)		(__x)->l3h
+#define msgb_bssgph(__x)	LIBGB_MSGB_CB(__x)->bssgph
+#define msgb_bssgp_len(__x)	((__x)->tail - (uint8_t *)msgb_bssgph(__x))
+#define msgb_bcid(__x)		LIBGB_MSGB_CB(__x)->bssgp_cell_id
+#define msgb_llch(__x)		LIBGB_MSGB_CB(__x)->llch
+
+/* logging contexts */
+#define GPRS_CTX_NSVC	0
+#define GPRS_CTX_BVC	1
+
+#include <osmocom/core/logging.h>
+int gprs_log_filter_fn(const struct log_context *ctx,
+			struct log_target *tar);
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gprs/gprs_ns.h b/src/shared/libosmocore/include/osmocom/gprs/gprs_ns.h
new file mode 100644
index 00000000..a7f32b25
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gprs/gprs_ns.h
@@ -0,0 +1,189 @@
+#ifndef _GPRS_NS_H
+#define _GPRS_NS_H
+
+#include <stdint.h>
+
+/* Our Implementation */
+#include <netinet/in.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/select.h>
+#include <osmocom/gprs/gprs_msgb.h>
+
+#include <osmocom/gprs/protocol/gsm_08_16.h>
+
+#define NS_TIMERS_COUNT 7
+#define NS_TIMERS "(tns-block|tns-block-retries|tns-reset|tns-reset-retries|tns-test|tns-alive|tns-alive-retries)"
+#define NS_TIMERS_HELP	\
+	"(un)blocking Timer (Tns-block) timeout\n"		\
+	"(un)blocking Timer (Tns-block) number of retries\n"	\
+	"Reset Timer (Tns-reset) timeout\n"			\
+	"Reset Timer (Tns-reset) number of retries\n"		\
+	"Test Timer (Tns-test) timeout\n"			\
+	"Alive Timer (Tns-alive) timeout\n"			\
+	"Alive Timer (Tns-alive) number of retries\n"
+
+enum ns_timeout {
+	NS_TOUT_TNS_BLOCK,
+	NS_TOUT_TNS_BLOCK_RETRIES,
+	NS_TOUT_TNS_RESET,
+	NS_TOUT_TNS_RESET_RETRIES,
+	NS_TOUT_TNS_TEST,
+	NS_TOUT_TNS_ALIVE,
+	NS_TOUT_TNS_ALIVE_RETRIES,
+};
+
+#define NSE_S_BLOCKED	0x0001
+#define NSE_S_ALIVE	0x0002
+
+/*! \brief Osmocom NS link layer types */
+enum gprs_ns_ll {
+	GPRS_NS_LL_UDP,		/*!< NS/UDP/IP */
+	GPRS_NS_LL_E1,		/*!< NS/E1 */
+	GPRS_NS_LL_FR_GRE,	/*!< NS/FR/GRE/IP */
+};
+
+/*! \brief Osmoco NS events */
+enum gprs_ns_evt {
+	GPRS_NS_EVT_UNIT_DATA,
+};
+
+struct gprs_nsvc;
+/*! \brief Osmocom GPRS callback function type */
+typedef int gprs_ns_cb_t(enum gprs_ns_evt event, struct gprs_nsvc *nsvc,
+			 struct msgb *msg, uint16_t bvci);
+
+/*! \brief An instance of the NS protocol stack */
+struct gprs_ns_inst {
+	/*! \brief callback to the user for incoming UNIT DATA IND */
+	gprs_ns_cb_t *cb;
+
+	/*! \brief linked lists of all NSVC in this instance */
+	struct llist_head gprs_nsvcs;
+
+	/*! \brief a NSVC object that's needed to deal with packets for
+	 * 	   unknown NSVC */
+	struct gprs_nsvc *unknown_nsvc;
+
+	uint16_t timeout[NS_TIMERS_COUNT];
+
+	/*! \brief NS-over-IP specific bits */
+	struct {
+		struct osmo_fd fd;
+		uint32_t local_ip;
+		uint16_t local_port;
+	} nsip;
+	/*! \brief NS-over-FR-over-GRE-over-IP specific bits */
+	struct {
+		struct osmo_fd fd;
+		uint32_t local_ip;
+		unsigned int enabled:1;
+	} frgre;
+};
+
+enum nsvc_timer_mode {
+	/* standard timers */
+	NSVC_TIMER_TNS_TEST,
+	NSVC_TIMER_TNS_ALIVE,
+	NSVC_TIMER_TNS_RESET,
+	_NSVC_TIMER_NR,
+};
+
+/*! \brief Structure representing a single NS-VC */
+struct gprs_nsvc {
+	/*! \brief list of NS-VCs within NS Instance */
+	struct llist_head list;
+	/*! \brief pointer to NS Instance */
+	struct gprs_ns_inst *nsi;
+
+	uint16_t nsei;	/*! \brief end-to-end significance */
+	uint16_t nsvci;	/*! \brief uniquely identifies NS-VC at SGSN */
+
+	uint32_t state;
+	uint32_t remote_state;
+
+	struct osmo_timer_list timer;
+	enum nsvc_timer_mode timer_mode;
+	int alive_retries;
+
+	unsigned int remote_end_is_sgsn:1;
+	unsigned int persistent:1;
+
+	struct rate_ctr_group *ctrg;
+
+	/*! \brief which link-layer are we based on? */
+	enum gprs_ns_ll ll;
+
+	union {
+		struct {
+			struct sockaddr_in bts_addr;
+		} ip;
+		struct {
+			struct sockaddr_in bts_addr;
+		} frgre;
+	};
+};
+
+/* Create a new NS protocol instance */
+struct gprs_ns_inst *gprs_ns_instantiate(gprs_ns_cb_t *cb, void *ctx);
+
+/* Destroy a NS protocol instance */
+void gprs_ns_destroy(struct gprs_ns_inst *nsi);
+
+/* Listen for incoming GPRS packets via NS/UDP */
+int gprs_ns_nsip_listen(struct gprs_ns_inst *nsi);
+
+/* Establish a connection (from the BSS) to the SGSN */
+struct gprs_nsvc *gprs_ns_nsip_connect(struct gprs_ns_inst *nsi,
+					struct sockaddr_in *dest,
+					uint16_t nsei, uint16_t nsvci);
+
+
+struct sockaddr_in;
+
+/* main function for higher layers (BSSGP) to send NS messages */
+int gprs_ns_sendmsg(struct gprs_ns_inst *nsi, struct msgb *msg);
+
+int gprs_ns_tx_reset(struct gprs_nsvc *nsvc, uint8_t cause);
+int gprs_ns_tx_block(struct gprs_nsvc *nsvc, uint8_t cause);
+int gprs_ns_tx_unblock(struct gprs_nsvc *nsvc);
+
+/* Listen for incoming GPRS packets via NS/FR/GRE */
+int gprs_ns_frgre_listen(struct gprs_ns_inst *nsi);
+
+struct gprs_nsvc *gprs_nsvc_create(struct gprs_ns_inst *nsi, uint16_t nsvci);
+void gprs_nsvc_delete(struct gprs_nsvc *nsvc);
+struct gprs_nsvc *gprs_nsvc_by_nsei(struct gprs_ns_inst *nsi, uint16_t nsei);
+struct gprs_nsvc *gprs_nsvc_by_nsvci(struct gprs_ns_inst *nsi, uint16_t nsvci);
+
+/* Initiate a RESET procedure (including timer start, ...)*/
+void gprs_nsvc_reset(struct gprs_nsvc *nsvc, uint8_t cause);
+
+/* Add NS-specific VTY stuff */
+int gprs_ns_vty_init(struct gprs_ns_inst *nsi);
+
+#define NS_ALLOC_SIZE	2048
+#define NS_ALLOC_HEADROOM 20
+static inline struct msgb *gprs_ns_msgb_alloc(void)
+{
+	return msgb_alloc_headroom(NS_ALLOC_SIZE, NS_ALLOC_HEADROOM, "GPRS/NS");
+}
+
+enum signal_ns {
+	S_NS_RESET,
+	S_NS_BLOCK,
+	S_NS_UNBLOCK,
+	S_NS_ALIVE_EXP,	/* Tns-alive expired more than N times */
+};
+
+struct ns_signal_data {
+	struct gprs_nsvc *nsvc;
+	uint8_t cause;
+};
+
+void gprs_ns_set_log_ss(int ss);
+
+/*! }@ */
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gprs/gprs_ns_frgre.h b/src/shared/libosmocore/include/osmocom/gprs/gprs_ns_frgre.h
new file mode 100644
index 00000000..abcd43ff
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gprs/gprs_ns_frgre.h
@@ -0,0 +1,6 @@
+#ifndef _GPRS_NS_FRGRE_H
+#define _GPRS_NS_FRGRE_H
+
+int gprs_ns_frgre_sendmsg(struct gprs_nsvc *nsvc, struct msgb *msg);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gprs/protocol/gsm_08_16.h b/src/shared/libosmocore/include/osmocom/gprs/protocol/gsm_08_16.h
new file mode 100644
index 00000000..4c3eda32
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gprs/protocol/gsm_08_16.h
@@ -0,0 +1,85 @@
+#ifndef _OSMO_08_16_H
+#define _OSMO_08_16_H
+
+/* GPRS Networks Service (NS) messages on the Gb interface
+ * 3GPP TS 08.16 version 8.0.1 Release 1999 / ETSI TS 101 299 V8.0.1 (2002-05)
+ * 3GPP TS 48.016 version 6.5.0 Release 6 / ETSI TS 148 016 V6.5.0 (2005-11) */
+
+#include <stdint.h>
+
+/*! \addtogroup libgb
+ *  @{
+ */
+
+/*! \file gprs_ns.h */
+
+/*! \brief Common header of GPRS NS */
+struct gprs_ns_hdr {
+	uint8_t pdu_type;	/*!< NS PDU type */
+	uint8_t data[0];	/*!< variable-length payload */
+} __attribute__((packed));
+
+/*! \brief NS PDU Type (TS 08.16, Section 10.3.7, Table 14) */
+enum ns_pdu_type {
+	NS_PDUT_UNITDATA	= 0x00,
+	NS_PDUT_RESET		= 0x02,
+	NS_PDUT_RESET_ACK	= 0x03,
+	NS_PDUT_BLOCK		= 0x04,
+	NS_PDUT_BLOCK_ACK	= 0x05,
+	NS_PDUT_UNBLOCK		= 0x06,
+	NS_PDUT_UNBLOCK_ACK	= 0x07,
+	NS_PDUT_STATUS		= 0x08,
+	NS_PDUT_ALIVE		= 0x0a,
+	NS_PDUT_ALIVE_ACK	= 0x0b,
+	/* TS 48.016 Section 10.3.7, Table 10.3.7.1 */
+	SNS_PDUT_ACK		= 0x0c,
+	SNS_PDUT_ADD		= 0x0d,
+	SNS_PDUT_CHANGE_WEIGHT	= 0x0e,
+	SNS_PDUT_CONFIG		= 0x0f,
+	SNS_PDUT_CONFIG_ACK	= 0x10,
+	SNS_PDUT_DELETE		= 0x11,
+	SNS_PDUT_SIZE		= 0x12,
+	SNS_PDUT_SIZE_ACK	= 0x13,
+};
+
+/*! \brief NS Control IE (TS 08.16, Section 10.3, Table 12) */
+enum ns_ctrl_ie {
+	NS_IE_CAUSE		= 0x00,
+	NS_IE_VCI		= 0x01,
+	NS_IE_PDU		= 0x02,
+	NS_IE_BVCI		= 0x03,
+	NS_IE_NSEI		= 0x04,
+	/* TS 48.016 Section 10.3, Table 10.3.1 */
+	NS_IE_IPv4_LIST		= 0x05,
+	NS_IE_IPv6_LIST		= 0x06,
+	NS_IE_MAX_NR_NSVC	= 0x07,
+	NS_IE_IPv4_EP_NR	= 0x08,
+	NS_IE_IPv6_EP_NR	= 0x09,
+	NS_IE_RESET_FLAG	= 0x0a,
+	NS_IE_IP_ADDR		= 0x0b,
+};
+
+/*! \brief NS Cause (TS 08.16, Section 10.3.2, Table 13) */
+enum ns_cause {
+	NS_CAUSE_TRANSIT_FAIL		= 0x00,
+	NS_CAUSE_OM_INTERVENTION	= 0x01,
+	NS_CAUSE_EQUIP_FAIL		= 0x02,
+	NS_CAUSE_NSVC_BLOCKED		= 0x03,
+	NS_CAUSE_NSVC_UNKNOWN		= 0x04,
+	NS_CAUSE_BVCI_UNKNOWN		= 0x05,
+	NS_CAUSE_SEM_INCORR_PDU		= 0x08,
+	NS_CAUSE_PDU_INCOMP_PSTATE	= 0x0a,
+	NS_CAUSE_PROTO_ERR_UNSPEC	= 0x0b,
+	NS_CAUSE_INVAL_ESSENT_IE	= 0x0c,
+	NS_CAUSE_MISSING_ESSENT_IE	= 0x0d,
+	/* TS 48.016 Section 10.3.2, Table 10.3.2.1 */
+	NS_CAUSE_INVAL_NR_IPv4_EP	= 0x0e,
+	NS_CAUSE_INVAL_NR_IPv6_EP	= 0x0f,
+	NS_CAUSE_INVAL_NR_NS_VC		= 0x10,
+	NS_CAUSE_INVAL_WEIGH		= 0x11,
+	NS_CAUSE_UNKN_IP_EP		= 0x12,
+	NS_CAUSE_UNKN_IP_ADDR		= 0x13,
+	NS_CAUSE_UNKN_IP_TEST_FAILED	= 0x14,
+};
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gprs/protocol/gsm_08_18.h b/src/shared/libosmocore/include/osmocom/gprs/protocol/gsm_08_18.h
new file mode 100644
index 00000000..3a351eaa
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gprs/protocol/gsm_08_18.h
@@ -0,0 +1,144 @@
+#ifndef _OSMO_08_18_H
+#define _OSMO_08_18_H
+
+#include <stdint.h>
+
+/*! \brief Fixed BVCI definitions (Section 5.4.1) */
+#define BVCI_SIGNALLING	0x0000
+#define BVCI_PTM	0x0001
+
+/*! \brief BSSGP PDU types (Section 11.3.26 / Table 11.27) */
+enum bssgp_pdu_type {
+	/* PDUs between RL and BSSGP SAPs */
+	BSSGP_PDUT_DL_UNITDATA		= 0x00,
+	BSSGP_PDUT_UL_UNITDATA		= 0x01,
+	BSSGP_PDUT_RA_CAPABILITY	= 0x02,
+	BSSGP_PDUT_PTM_UNITDATA		= 0x03,
+	/* PDUs between GMM SAPs */
+	BSSGP_PDUT_PAGING_PS		= 0x06,
+	BSSGP_PDUT_PAGING_CS		= 0x07,
+	BSSGP_PDUT_RA_CAPA_UDPATE	= 0x08,
+	BSSGP_PDUT_RA_CAPA_UPDATE_ACK	= 0x09,
+	BSSGP_PDUT_RADIO_STATUS		= 0x0a,
+	BSSGP_PDUT_SUSPEND		= 0x0b,
+	BSSGP_PDUT_SUSPEND_ACK		= 0x0c,
+	BSSGP_PDUT_SUSPEND_NACK		= 0x0d,
+	BSSGP_PDUT_RESUME		= 0x0e,
+	BSSGP_PDUT_RESUME_ACK		= 0x0f,
+	BSSGP_PDUT_RESUME_NACK		= 0x10,
+	/* PDus between NM SAPs */
+	BSSGP_PDUT_BVC_BLOCK		= 0x20,
+	BSSGP_PDUT_BVC_BLOCK_ACK	= 0x21,
+	BSSGP_PDUT_BVC_RESET		= 0x22,
+	BSSGP_PDUT_BVC_RESET_ACK	= 0x23,
+	BSSGP_PDUT_BVC_UNBLOCK		= 0x24,
+	BSSGP_PDUT_BVC_UNBLOCK_ACK	= 0x25,
+	BSSGP_PDUT_FLOW_CONTROL_BVC	= 0x26,
+	BSSGP_PDUT_FLOW_CONTROL_BVC_ACK	= 0x27,
+	BSSGP_PDUT_FLOW_CONTROL_MS	= 0x28,
+	BSSGP_PDUT_FLOW_CONTROL_MS_ACK	= 0x29,
+	BSSGP_PDUT_FLUSH_LL		= 0x2a,
+	BSSGP_PDUT_FLUSH_LL_ACK		= 0x2b,
+	BSSGP_PDUT_LLC_DISCARD		= 0x2c,
+	BSSGP_PDUT_SGSN_INVOKE_TRACE	= 0x40,
+	BSSGP_PDUT_STATUS		= 0x41,
+	/* PDUs between PFM SAP's */
+	BSSGP_PDUT_DOWNLOAD_BSS_PFC	= 0x50,
+	BSSGP_PDUT_CREATE_BSS_PFC	= 0x51,
+	BSSGP_PDUT_CREATE_BSS_PFC_ACK	= 0x52,
+	BSSGP_PDUT_CREATE_BSS_PFC_NACK	= 0x53,
+	BSSGP_PDUT_MODIFY_BSS_PFC	= 0x54,
+	BSSGP_PDUT_MODIFY_BSS_PFC_ACK	= 0x55,
+	BSSGP_PDUT_DELETE_BSS_PFC	= 0x56,
+	BSSGP_PDUT_DELETE_BSS_PFC_ACK	= 0x57,
+};
+
+/*! \brief BSSGP User-Data header (Section 10.2.1 and 10.2.2) */
+struct bssgp_ud_hdr {
+	uint8_t pdu_type;	/*!< BSSGP PDU type */
+	uint32_t tlli;		/*!< Temporary Link-Local Identifier */
+	uint8_t qos_profile[3];	/*!< QoS profile */
+	uint8_t data[0];	/* optional/conditional IEs as TLVs */
+} __attribute__((packed));
+
+/*! \brief BSSGP normal header */
+struct bssgp_normal_hdr {
+	uint8_t pdu_type;	/*!< BSSGP PDU type */
+	uint8_t data[0];	/*!< optional/conditional IEs as TLVs */
+};
+
+/*! \brief BSSGP Information Element Identifiers */
+enum bssgp_iei_type {
+	BSSGP_IE_ALIGNMENT		= 0x00,
+	BSSGP_IE_BMAX_DEFAULT_MS	= 0x01,
+	BSSGP_IE_BSS_AREA_ID		= 0x02,
+	BSSGP_IE_BUCKET_LEAK_RATE	= 0x03,
+	BSSGP_IE_BVCI			= 0x04,
+	BSSGP_IE_BVC_BUCKET_SIZE	= 0x05,
+	BSSGP_IE_BVC_MEASUREMENT	= 0x06,
+	BSSGP_IE_CAUSE			= 0x07,
+	BSSGP_IE_CELL_ID		= 0x08,
+	BSSGP_IE_CHAN_NEEDED		= 0x09,
+	BSSGP_IE_DRX_PARAMS		= 0x0a,
+	BSSGP_IE_EMLPP_PRIO		= 0x0b,
+	BSSGP_IE_FLUSH_ACTION		= 0x0c,
+	BSSGP_IE_IMSI			= 0x0d,
+	BSSGP_IE_LLC_PDU		= 0x0e,
+	BSSGP_IE_LLC_FRAMES_DISCARDED	= 0x0f,
+	BSSGP_IE_LOCATION_AREA		= 0x10,
+	BSSGP_IE_MOBILE_ID		= 0x11,
+	BSSGP_IE_MS_BUCKET_SIZE		= 0x12,
+	BSSGP_IE_MS_RADIO_ACCESS_CAP	= 0x13,
+	BSSGP_IE_OMC_ID			= 0x14,
+	BSSGP_IE_PDU_IN_ERROR		= 0x15,
+	BSSGP_IE_PDU_LIFETIME		= 0x16,
+	BSSGP_IE_PRIORITY		= 0x17,
+	BSSGP_IE_QOS_PROFILE		= 0x18,
+	BSSGP_IE_RADIO_CAUSE		= 0x19,
+	BSSGP_IE_RA_CAP_UPD_CAUSE	= 0x1a,
+	BSSGP_IE_ROUTEING_AREA		= 0x1b,
+	BSSGP_IE_R_DEFAULT_MS		= 0x1c,
+	BSSGP_IE_SUSPEND_REF_NR		= 0x1d,
+	BSSGP_IE_TAG			= 0x1e,
+	BSSGP_IE_TLLI			= 0x1f,
+	BSSGP_IE_TMSI			= 0x20,
+	BSSGP_IE_TRACE_REFERENC		= 0x21,
+	BSSGP_IE_TRACE_TYPE		= 0x22,
+	BSSGP_IE_TRANSACTION_ID		= 0x23,
+	BSSGP_IE_TRIGGER_ID		= 0x24,
+	BSSGP_IE_NUM_OCT_AFF		= 0x25,
+	BSSGP_IE_LSA_ID_LIST		= 0x26,
+	BSSGP_IE_LSA_INFORMATION	= 0x27,
+	BSSGP_IE_PACKET_FLOW_ID		= 0x28,
+	BSSGP_IE_PACKET_FLOW_TIMER	= 0x29,
+	BSSGP_IE_AGG_BSS_QOS_PROFILE	= 0x3a,
+	BSSGP_IE_FEATURE_BITMAP		= 0x3b,
+	BSSGP_IE_BUCKET_FULL_RATIO	= 0x3c,
+	BSSGP_IE_SERVICE_UTRAN_CCO	= 0x3d,
+};
+
+/*! \brief Cause coding (Section 11.3.8 / Table 11.10) */
+enum gprs_bssgp_cause {
+	BSSGP_CAUSE_PROC_OVERLOAD	= 0x00,
+	BSSGP_CAUSE_EQUIP_FAIL		= 0x01,
+	BSSGP_CAUSE_TRASIT_NET_FAIL	= 0x02,
+	BSSGP_CAUSE_CAPA_GREATER_0KPBS	= 0x03,
+	BSSGP_CAUSE_UNKNOWN_MS		= 0x04,
+	BSSGP_CAUSE_UNKNOWN_BVCI	= 0x05,
+	BSSGP_CAUSE_CELL_TRAF_CONG	= 0x06,
+	BSSGP_CAUSE_SGSN_CONG		= 0x07,
+	BSSGP_CAUSE_OML_INTERV		= 0x08,
+	BSSGP_CAUSE_BVCI_BLOCKED	= 0x09,
+	BSSGP_CAUSE_PFC_CREATE_FAIL	= 0x0a,
+	BSSGP_CAUSE_SEM_INCORR_PDU	= 0x20,
+	BSSGP_CAUSE_INV_MAND_INF	= 0x21,
+	BSSGP_CAUSE_MISSING_MAND_IE	= 0x22,
+	BSSGP_CAUSE_MISSING_COND_IE	= 0x23,
+	BSSGP_CAUSE_UNEXP_COND_IE	= 0x24,
+	BSSGP_CAUSE_COND_IE_ERR		= 0x25,
+	BSSGP_CAUSE_PDU_INCOMP_STATE	= 0x26,
+	BSSGP_CAUSE_PROTO_ERR_UNSPEC	= 0x27,
+	BSSGP_CAUSE_PDU_INCOMP_FEAT	= 0x28,
+};
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/a5.h b/src/shared/libosmocore/include/osmocom/gsm/a5.h
new file mode 100644
index 00000000..649dbab1
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/a5.h
@@ -0,0 +1,63 @@
+/*
+ * a5.h
+ *
+ * Copyright (C) 2011  Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef __OSMO_A5_H__
+#define __OSMO_A5_H__
+
+#include <stdint.h>
+
+#include <osmocom/core/bits.h>
+
+/*! \defgroup a5 GSM A5 ciphering algorithm
+ *  @{
+ */
+
+/*! \file gsm/a5.h
+ *  \brief Osmocom GSM A5 ciphering algorithm header
+ */
+
+/*! \brief Converts a frame number into the 22 bit number used in A5/x
+ *  \param[in] fn The true framenumber
+ *  \return 22 bit word
+ */
+static inline uint32_t
+osmo_a5_fn_count(uint32_t fn)
+{
+	int t1 = fn / (26 * 51);
+	int t2 = fn % 26;
+	int t3 = fn % 51;
+	return (t1 << 11) | (t3 << 5) | t2;
+}
+
+	/* Notes:
+	 *  - key must be 8 bytes long (or NULL for A5/0)
+	 *  - the dl and ul pointer must be either NULL or 114 bits long
+	 *  - fn is the _real_ GSM frame number.
+	 *    (converted internally to fn_count)
+	 */
+void osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul);
+void osmo_a5_1(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul);
+void osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul);
+
+/*! @} */
+
+#endif /* __OSMO_A5_H__ */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/abis_nm.h b/src/shared/libosmocore/include/osmocom/gsm/abis_nm.h
new file mode 100644
index 00000000..320ac3e5
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/abis_nm.h
@@ -0,0 +1,40 @@
+#ifndef _OSMO_GSM_ABIS_NM_H
+#define _OSMO_GSM_ABIS_NM_H
+
+/*! \defgroup oml A-bis OML
+ *  @{
+ */
+
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_12_21.h>
+
+/*! \file abis_nm.h */
+
+enum abis_nm_msgtype;
+enum gsm_phys_chan_config;
+
+extern const enum abis_nm_msgtype abis_nm_reports[4];
+extern const enum abis_nm_msgtype abis_nm_no_ack_nack[3];
+extern const enum abis_nm_msgtype abis_nm_sw_load_msgs[9];
+extern const enum abis_nm_msgtype abis_nm_nacks[33];
+
+extern const struct value_string abis_nm_obj_class_names[];
+extern const struct value_string abis_nm_adm_state_names[];
+
+const char *abis_nm_nack_cause_name(uint8_t cause);
+const char *abis_nm_nack_name(uint8_t nack);
+const char *abis_nm_event_type_name(uint8_t cause);
+const char *abis_nm_severity_name(uint8_t cause);
+extern const struct tlv_definition abis_nm_att_tlvdef;
+const char *abis_nm_opstate_name(uint8_t os);
+const char *abis_nm_avail_name(uint8_t avail);
+const char *abis_nm_test_name(uint8_t test);
+void abis_nm_debugp_foh(int ss, struct abis_om_fom_hdr *foh);
+
+int abis_nm_chcomb4pchan(enum gsm_phys_chan_config pchan);
+enum abis_nm_chan_comb abis_nm_pchan4chcomb(uint8_t chcomb);
+
+/*! @} */
+
+#endif /* _OSMO_GSM_ABIS_NM_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/comp128.h b/src/shared/libosmocore/include/osmocom/gsm/comp128.h
new file mode 100644
index 00000000..e4587d4f
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/comp128.h
@@ -0,0 +1,22 @@
+/*
+ * COMP128 header
+ *
+ * See comp128.c for details
+ */
+
+#ifndef __COMP128_H__
+#define __COMP128_H__
+
+#include <stdint.h>
+
+/*
+ * Performs the COMP128 algorithm (used as A3/A8)
+ * ki    : uint8_t [16]
+ * srand : uint8_t [16]
+ * sres  : uint8_t [4]
+ * kc    : uint8_t [8]
+ */
+void comp128(const uint8_t *ki, const uint8_t *srand, uint8_t *sres, uint8_t *kc);
+
+#endif /* __COMP128_H__ */
+
diff --git a/src/shared/libosmocore/include/osmocom/gsm/gan.h b/src/shared/libosmocore/include/osmocom/gsm/gan.h
new file mode 100644
index 00000000..ab4c1e4e
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/gan.h
@@ -0,0 +1,9 @@
+#ifndef _OSMO_GSM_GAN_H
+#define  _OSMO_GSM_GAN_H
+
+#include <osmocom/core/utils.h>
+
+extern const struct value_string gan_msgt_vals[];
+static const struct value_string gan_pdisc_vals[];
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smc.h b/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smc.h
new file mode 100644
index 00000000..2140db43
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smc.h
@@ -0,0 +1,63 @@
+#ifndef _GSM0411_SMC_H
+#define _GSM0411_SMC_H
+
+#include <osmocom/core/timer.h>
+#include <osmocom/gsm/protocol/gsm_04_11.h>
+
+#define GSM411_MMSMS_EST_REQ		0x310
+#define GSM411_MMSMS_EST_IND		0x312
+#define GSM411_MMSMS_EST_CNF		0x311
+#define GSM411_MMSMS_REL_REQ		0x320
+#define GSM411_MMSMS_REL_IND		0x322
+#define GSM411_MMSMS_DATA_REQ		0x330
+#define GSM411_MMSMS_DATA_IND		0x332
+#define GSM411_MMSMS_UNIT_DATA_REQ	0x340
+#define GSM411_MMSMS_UNIT_DATA_IND	0x342
+#define GSM411_MMSMS_ERR_IND		0x372
+
+#define GSM411_MNSMS_ABORT_REQ		0x101
+#define GSM411_MNSMS_DATA_REQ		0x102
+#define GSM411_MNSMS_DATA_IND		0x103
+#define GSM411_MNSMS_EST_REQ		0x104
+#define GSM411_MNSMS_EST_IND		0x105
+#define GSM411_MNSMS_ERROR_IND		0x106
+#define GSM411_MNSMS_REL_REQ		0x107
+
+struct gsm411_smc_inst {
+	int network;		/* is this a MO (0) or MT (1) transfer */
+	int (*mn_recv) (struct gsm411_smc_inst *inst, int msg_type,
+			struct msgb *msg);
+	int (*mm_send) (struct gsm411_smc_inst *inst, int msg_type,
+			struct msgb *msg, int cp_msg_type);
+
+	enum gsm411_cp_state cp_state;
+	struct osmo_timer_list cp_timer;
+	struct msgb *cp_msg;	/* store pending message */
+	int cp_rel;		/* store pending release */
+	int cp_retx;		/* retry counter */
+	int cp_max_retr;	/* maximum retry */
+	int cp_tc1;		/* timer value TC1* */
+
+};
+
+extern const struct value_string gsm411_cp_cause_strs[];
+
+/* init a new instance */
+void gsm411_smc_init(struct gsm411_smc_inst *inst, int network,
+	int (*mn_recv) (struct gsm411_smc_inst *inst, int msg_type,
+			struct msgb *msg),
+	int (*mm_send) (struct gsm411_smc_inst *inst, int msg_type,
+			struct msgb *msg, int cp_msg_type));
+
+/* clear instance */
+void gsm411_smc_clear(struct gsm411_smc_inst *inst);
+
+/* message from upper layer */
+int gsm411_smc_send(struct gsm411_smc_inst *inst, int msg_type,
+	struct msgb *msg);
+
+/* message from lower layer */
+int gsm411_smc_recv(struct gsm411_smc_inst *inst, int msg_type,
+	struct msgb *msg, int cp_msg_type);
+
+#endif /* _GSM0411_SMC_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smr.h b/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smr.h
new file mode 100644
index 00000000..5ea8584d
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/gsm0411_smr.h
@@ -0,0 +1,45 @@
+#ifndef _GSM0411_SMR_H
+#define _GSM0411_SMR_H
+
+#include <osmocom/gsm/protocol/gsm_04_11.h>
+
+#define GSM411_SM_RL_DATA_REQ		0x401
+#define GSM411_SM_RL_DATA_IND		0x402
+#define GSM411_SM_RL_MEM_AVAIL_REQ	0x403
+#define GSM411_SM_RL_MEM_AVAIL_IND	0x404
+#define GSM411_SM_RL_REPORT_REQ		0x405
+#define GSM411_SM_RL_REPORT_IND		0x406
+
+struct gsm411_smr_inst {
+	int network;		/* is this a MO (0) or MT (1) transfer */
+	int (*rl_recv) (struct gsm411_smr_inst *inst, int msg_type,
+			struct msgb *msg);
+	int (*mn_send) (struct gsm411_smr_inst *inst, int msg_type,
+			struct msgb *msg);
+
+	enum gsm411_rp_state rp_state;
+	struct osmo_timer_list rp_timer;
+};
+
+extern const struct value_string gsm411_rp_cause_strs[];
+
+/* init a new instance */
+void gsm411_smr_init(struct gsm411_smr_inst *inst, int network,
+	int (*rl_recv) (struct gsm411_smr_inst *inst, int msg_type,
+			struct msgb *msg),
+	int (*mn_send) (struct gsm411_smr_inst *inst, int msg_type,
+			struct msgb *msg));
+
+/* clear instance */
+void gsm411_smr_clear(struct gsm411_smr_inst *inst);
+
+/* message from upper layer */
+int gsm411_smr_send(struct gsm411_smr_inst *inst, int msg_type,
+	struct msgb *msg);
+
+/* message from lower layer */
+int gsm411_smr_recv(struct gsm411_smr_inst *inst, int msg_type,
+	struct msgb *msg);
+
+#endif /* _GSM0411_SMR_H */
+
diff --git a/src/shared/libosmocore/include/osmocom/gsm/gsm0411_utils.h b/src/shared/libosmocore/include/osmocom/gsm/gsm0411_utils.h
new file mode 100644
index 00000000..d29ca631
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/gsm0411_utils.h
@@ -0,0 +1,36 @@
+#ifndef _GSM0411_UTILS_H
+#define _GSM0411_UTILS_H
+
+/* Turn int into semi-octet representation: 98 => 0x89 */
+uint8_t gsm411_bcdify(uint8_t value);
+
+/* Turn semi-octet representation into int: 0x89 => 98 */
+uint8_t gsm411_unbcdify(uint8_t value);
+
+struct msgb *gsm411_msgb_alloc(void);
+
+/* Generate 03.40 TP-SCTS */
+void gsm340_gen_scts(uint8_t *scts, time_t time);
+
+/* Decode 03.40 TP-SCTS (into utc/gmt timestamp) */
+time_t gsm340_scts(uint8_t *scts);
+
+/* decode validity period. return minutes */
+unsigned long gsm340_validity_period(uint8_t sms_vpf, uint8_t *sms_vp);
+
+/* determine coding alphabet dependent on GSM 03.38 Section 4 DCS */
+enum sms_alphabet gsm338_get_sms_alphabet(uint8_t dcs);
+
+/* generate a TPDU address field compliant with 03.40 sec. 9.1.2.5 */
+int gsm340_gen_oa(uint8_t *oa, unsigned int oa_len, uint8_t type,
+	uint8_t plan, const char *number);
+
+/* Prefix msg with a RP header */
+int gsm411_push_rp_header(struct msgb *msg, uint8_t rp_msg_type,
+	uint8_t rp_msg_ref);
+
+/* Prefix msg with a 04.08/04.11 CP header */
+int gsm411_push_cp_header(struct msgb *msg, uint8_t proto, uint8_t trans,
+			     uint8_t msg_type);
+
+#endif /* _GSM0411_UTILS_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/gsm0480.h b/src/shared/libosmocore/include/osmocom/gsm/gsm0480.h
new file mode 100644
index 00000000..d6626d60
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/gsm0480.h
@@ -0,0 +1,26 @@
+#ifndef gsm0480_h
+#define gsm0480_h
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/protocol/gsm_04_80.h>
+
+#define MAX_LEN_USSD_STRING	31
+
+struct ussd_request {
+	char text[MAX_LEN_USSD_STRING + 1];
+	uint8_t transaction_id;
+	uint8_t invoke_id;
+};
+
+int gsm0480_decode_ussd_request(const struct gsm48_hdr *hdr, uint16_t len,
+				struct ussd_request *request);
+
+struct msgb *gsm0480_create_ussd_resp(uint8_t invoke_id, uint8_t trans_id, const char *text);
+struct msgb *gsm0480_create_unstructuredSS_Notify(int alertPattern, const char *text);
+struct msgb *gsm0480_create_notifySS(const char *text);
+
+int gsm0480_wrap_invoke(struct msgb *msg, int op, int link_id);
+int gsm0480_wrap_facility(struct msgb *msg);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/gsm0502.h b/src/shared/libosmocore/include/osmocom/gsm/gsm0502.h
new file mode 100644
index 00000000..46b629e4
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/gsm0502.h
@@ -0,0 +1,38 @@
+#ifndef OSMOCOM_GSM_0502_H
+#define OSMOCOM_GSM_0502_H
+
+#include <stdint.h>
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+
+/* Table 5 Clause 7 TS 05.02 */
+static inline unsigned int
+gsm0502_get_n_pag_blocks(struct gsm48_control_channel_descr *chan_desc)
+{
+	if (chan_desc->ccch_conf == RSL_BCCH_CCCH_CONF_1_C)
+		return 3 - chan_desc->bs_ag_blks_res;
+	else
+		return 9 - chan_desc->bs_ag_blks_res;
+}
+
+/* Chapter 6.5.2 of TS 05.02 */
+static inline unsigned int
+gsm0502_get_ccch_group(uint64_t imsi, unsigned int bs_cc_chans,
+			unsigned int n_pag_blocks)
+{
+	return (imsi % 1000) % (bs_cc_chans * n_pag_blocks) / n_pag_blocks;
+}
+
+/* Chapter 6.5.2 of TS 05.02 */
+static inline unsigned int
+gsm0502_get_paging_group(uint64_t imsi, unsigned int bs_cc_chans,
+			 int n_pag_blocks)
+{
+	return (imsi % 1000) % (bs_cc_chans * n_pag_blocks) % n_pag_blocks;
+}
+
+unsigned int
+gsm0502_calc_paging_group(struct gsm48_control_channel_descr *chan_desc, uint64_t imsi);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/gsm0808.h b/src/shared/libosmocore/include/osmocom/gsm/gsm0808.h
new file mode 100644
index 00000000..5380dd9e
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/gsm0808.h
@@ -0,0 +1,50 @@
+/* (C) 2009,2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009,2010 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+#ifndef OSMOCORE_GSM0808_H
+#define OSMOCORE_GSM0808_H
+
+#include "tlv.h"
+
+struct msgb;
+
+struct msgb *gsm0808_create_layer3(struct msgb *msg, uint16_t netcode, uint16_t countrycode, int lac, uint16_t ci);
+struct msgb *gsm0808_create_reset(void);
+struct msgb *gsm0808_create_clear_command(uint8_t reason);
+struct msgb *gsm0808_create_clear_complete(void);
+struct msgb *gsm0808_create_cipher_complete(struct msgb *layer3, uint8_t alg_id);
+struct msgb *gsm0808_create_cipher_reject(uint8_t cause);
+struct msgb *gsm0808_create_classmark_update(const uint8_t *cm2, uint8_t cm2_len,
+					     const uint8_t *cm3, uint8_t cm3_len);
+struct msgb *gsm0808_create_sapi_reject(uint8_t link_id);
+struct msgb *gsm0808_create_assignment_completed(uint8_t rr_cause,
+						 uint8_t chosen_channel, uint8_t encr_alg_id,
+						 uint8_t speech_mode);
+struct msgb *gsm0808_create_assignment_failure(uint8_t cause, uint8_t *rr_cause);
+struct msgb *gsm0808_create_clear_rqst(uint8_t cause);
+
+struct msgb *gsm0808_create_dtap(struct msgb *msg, uint8_t link_id);
+void gsm0808_prepend_dtap_header(struct msgb *msg, uint8_t link_id);
+
+const struct tlv_definition *gsm0808_att_tlvdef(void);
+
+const char *gsm0808_bssmap_name(uint8_t msg_type);
+const char *gsm0808_bssap_name(uint8_t msg_type);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/gsm48.h b/src/shared/libosmocore/include/osmocom/gsm/gsm48.h
new file mode 100644
index 00000000..1e7498a9
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/gsm48.h
@@ -0,0 +1,40 @@
+#ifndef _OSMOCORE_GSM48_H
+#define _OSMOCORE_GSM48_H
+
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/gsm48_ie.h>
+
+/* A parsed GPRS routing area */
+struct gprs_ra_id {
+	uint16_t	mnc;
+	uint16_t	mcc;
+	uint16_t	lac;
+	uint8_t		rac;
+};
+
+extern const struct tlv_definition gsm48_att_tlvdef;
+extern const struct tlv_definition gsm48_rr_att_tlvdef;
+extern const struct tlv_definition gsm48_mm_att_tlvdef;
+const char *gsm48_cc_state_name(uint8_t state);
+const char *gsm48_cc_msg_name(uint8_t msgtype);
+const char *rr_cause_name(uint8_t cause);
+
+int gsm48_decode_lai(struct gsm48_loc_area_id *lai, uint16_t *mcc,
+		     uint16_t *mnc, uint16_t *lac);
+void gsm48_generate_lai(struct gsm48_loc_area_id *lai48, uint16_t mcc,
+			uint16_t mnc, uint16_t lac);
+int gsm48_generate_mid_from_tmsi(uint8_t *buf, uint32_t tmsi);
+int gsm48_generate_mid_from_imsi(uint8_t *buf, const char *imsi);
+
+/* Convert Mobile Identity (10.5.1.4) to string */
+int gsm48_mi_to_string(char *string, const int str_len,
+			const uint8_t *mi, const int mi_len);
+
+/* Parse Routeing Area Identifier */
+void gsm48_parse_ra(struct gprs_ra_id *raid, const uint8_t *buf);
+int gsm48_construct_ra(uint8_t *buf, const struct gprs_ra_id *raid);
+
+int gsm48_number_of_paging_subchannels(struct gsm48_control_channel_descr *chan_desc);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/gsm48_ie.h b/src/shared/libosmocore/include/osmocom/gsm/gsm48_ie.h
new file mode 100644
index 00000000..2e576429
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/gsm48_ie.h
@@ -0,0 +1,117 @@
+#ifndef _OSMOCORE_GSM48_IE_H
+#define _OSMOCORE_GSM48_IE_H
+
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/mncc.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+/* decode a 'called/calling/connect party BCD number' as in 10.5.4.7 */
+int gsm48_decode_bcd_number(char *output, int output_len,
+			    const uint8_t *bcd_lv, int h_len);
+
+/* convert a ASCII phone number to 'called/calling/connect party BCD number' */
+int gsm48_encode_bcd_number(uint8_t *bcd_lv, uint8_t max_len,
+			    int h_len, const char *input);
+/* decode 'bearer capability' */
+int gsm48_decode_bearer_cap(struct gsm_mncc_bearer_cap *bcap,
+			     const uint8_t *lv);
+/* encode 'bearer capability' */
+int gsm48_encode_bearer_cap(struct msgb *msg, int lv_only,
+			     const struct gsm_mncc_bearer_cap *bcap);
+/* decode 'call control cap' */
+int gsm48_decode_cccap(struct gsm_mncc_cccap *ccap, const uint8_t *lv);
+/* encode 'call control cap' */
+int gsm48_encode_cccap(struct msgb *msg,
+			const struct gsm_mncc_cccap *ccap);
+/* decode 'called party BCD number' */
+int gsm48_decode_called(struct gsm_mncc_number *called,
+			 const uint8_t *lv);
+/* encode 'called party BCD number' */
+int gsm48_encode_called(struct msgb *msg,
+			 const struct gsm_mncc_number *called);
+/* decode callerid of various IEs */
+int gsm48_decode_callerid(struct gsm_mncc_number *callerid,
+			 const uint8_t *lv);
+/* encode callerid of various IEs */
+int gsm48_encode_callerid(struct msgb *msg, int ie, int max_len,
+			   const struct gsm_mncc_number *callerid);
+/* decode 'cause' */
+int gsm48_decode_cause(struct gsm_mncc_cause *cause,
+			const uint8_t *lv);
+/* encode 'cause' */
+int gsm48_encode_cause(struct msgb *msg, int lv_only,
+			const struct gsm_mncc_cause *cause);
+/* decode 'calling number' */
+int gsm48_decode_calling(struct gsm_mncc_number *calling,
+			 const uint8_t *lv);
+/* encode 'calling number' */
+int gsm48_encode_calling(struct msgb *msg, 
+			  const struct gsm_mncc_number *calling);
+/* decode 'connected number' */
+int gsm48_decode_connected(struct gsm_mncc_number *connected,
+			 const uint8_t *lv);
+/* encode 'connected number' */
+int gsm48_encode_connected(struct msgb *msg,
+			    const struct gsm_mncc_number *connected);
+/* decode 'redirecting number' */
+int gsm48_decode_redirecting(struct gsm_mncc_number *redirecting,
+			 const uint8_t *lv);
+/* encode 'redirecting number' */
+int gsm48_encode_redirecting(struct msgb *msg,
+			      const struct gsm_mncc_number *redirecting);
+/* decode 'facility' */
+int gsm48_decode_facility(struct gsm_mncc_facility *facility,
+			   const uint8_t *lv);
+/* encode 'facility' */
+int gsm48_encode_facility(struct msgb *msg, int lv_only,
+			   const struct gsm_mncc_facility *facility);
+/* decode 'notify' */
+int gsm48_decode_notify(int *notify, const uint8_t *v);
+/* encode 'notify' */
+int gsm48_encode_notify(struct msgb *msg, int notify);
+/* decode 'signal' */
+int gsm48_decode_signal(int *signal, const uint8_t *v);
+/* encode 'signal' */
+int gsm48_encode_signal(struct msgb *msg, int signal);
+/* decode 'keypad' */
+int gsm48_decode_keypad(int *keypad, const uint8_t *lv);
+/* encode 'keypad' */
+int gsm48_encode_keypad(struct msgb *msg, int keypad);
+/* decode 'progress' */
+int gsm48_decode_progress(struct gsm_mncc_progress *progress,
+			   const uint8_t *lv);
+/* encode 'progress' */
+int gsm48_encode_progress(struct msgb *msg, int lv_only,
+			   const struct gsm_mncc_progress *p);
+/* decode 'user-user' */
+int gsm48_decode_useruser(struct gsm_mncc_useruser *uu,
+			   const uint8_t *lv);
+/* encode 'useruser' */
+int gsm48_encode_useruser(struct msgb *msg, int lv_only,
+			   const struct gsm_mncc_useruser *uu);
+/* decode 'ss version' */
+int gsm48_decode_ssversion(struct gsm_mncc_ssversion *ssv,
+			    const uint8_t *lv);
+/* encode 'ss version' */
+int gsm48_encode_ssversion(struct msgb *msg,
+			   const struct gsm_mncc_ssversion *ssv);
+/* decode 'more data' does not require a function, because it has no value */
+/* encode 'more data' */
+int gsm48_encode_more(struct msgb *msg);
+
+/* structure of one frequency */
+struct gsm_sysinfo_freq {
+	/* if the frequency included in the sysinfo */
+	uint8_t	mask;
+} __attribute__ ((packed));
+
+/* decode "Cell Channel Description" (10.5.2.1b) and other frequency lists */
+int gsm48_decode_freq_list(struct gsm_sysinfo_freq *f, uint8_t *cd,
+			   uint8_t len, uint8_t mask, uint8_t frqt);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/gsm_utils.h b/src/shared/libosmocore/include/osmocom/gsm/gsm_utils.h
new file mode 100644
index 00000000..6d316727
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/gsm_utils.h
@@ -0,0 +1,151 @@
+/* GSM utility functions, e.g. coding and decoding */
+/*
+ * (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
+ * (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009-2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef GSM_UTILS_H
+#define GSM_UTILS_H
+
+#include <stdint.h>
+
+#define ADD_MODULO(sum, delta, modulo) do {	\
+	if ((sum += delta) >= modulo)		\
+		sum -= modulo;			\
+	} while (0)
+
+#define GSM_MAX_FN	(26*51*2048)
+
+struct gsm_time {
+	uint32_t	fn;	/* FN count */
+	uint16_t	t1;	/* FN div (26*51) */
+	uint8_t		t2;	/* FN modulo 26 */
+	uint8_t		t3;	/* FN modulo 51 */
+	uint8_t		tc;
+};
+
+enum gsm_band {
+	GSM_BAND_850	= 1,
+	GSM_BAND_900	= 2,
+	GSM_BAND_1800	= 4,
+	GSM_BAND_1900	= 8,
+	GSM_BAND_450	= 0x10,
+	GSM_BAND_480	= 0x20,
+	GSM_BAND_750	= 0x40,
+	GSM_BAND_810	= 0x80,
+};
+
+const char *gsm_band_name(enum gsm_band band);
+enum gsm_band gsm_band_parse(const char *mhz);
+
+int gsm_7bit_decode(char *decoded, const uint8_t *user_data, uint8_t length);
+int gsm_7bit_decode_hdr(char *decoded, const uint8_t *user_data, uint8_t length, uint8_t ud_hdr_ind);
+int gsm_7bit_encode(uint8_t *result, const char *data);
+
+int gsm_septets2octets(uint8_t *result, uint8_t *rdata, uint8_t septet_len, uint8_t padding);
+int gsm_septet_encode(uint8_t *result, const char *data);
+uint8_t gsm_get_octet_len(const uint8_t sept_len);
+
+unsigned int ms_class_gmsk_dbm(enum gsm_band band, int ms_class);
+
+int ms_pwr_ctl_lvl(enum gsm_band band, unsigned int dbm);
+int ms_pwr_dbm(enum gsm_band band, uint8_t lvl);
+
+/* According to TS 08.05 Chapter 8.1.4 */
+int rxlev2dbm(uint8_t rxlev);
+uint8_t dbm2rxlev(int dbm);
+
+/* According to GSM 04.08 Chapter 10.5.1.6 */
+static inline int ms_cm2_a5n_support(uint8_t *cm2, int n) {
+	switch (n) {
+		case 0: return 1;
+		case 1: return (cm2[0] & (1<<3)) ? 0 : 1;
+		case 2: return (cm2[2] & (1<<0)) ? 1 : 0;
+		case 3: return (cm2[2] & (1<<1)) ? 1 : 0;
+		default:
+			return 0;
+	}
+}
+
+/* According to GSM 04.08 Chapter 10.5.2.29 */
+static inline int rach_max_trans_val2raw(int val) { return (val >> 1) & 3; }
+static inline int rach_max_trans_raw2val(int raw) {
+	const int tbl[4] = { 1, 2, 4, 7 };
+	return tbl[raw & 3];
+}
+
+#define	ARFCN_PCS	0x8000
+#define	ARFCN_UPLINK	0x4000
+#define	ARFCN_FLAG_MASK	0xf000	/* Reserve the upper 5 bits for flags */
+
+enum gsm_band gsm_arfcn2band(uint16_t arfcn);
+
+/* Convert an ARFCN to the frequency in MHz * 10 */
+uint16_t gsm_arfcn2freq10(uint16_t arfcn, int uplink);
+
+/* Convert from frame number to GSM time */
+void gsm_fn2gsmtime(struct gsm_time *time, uint32_t fn);
+
+/* Convert from GSM time to frame number */
+uint32_t gsm_gsmtime2fn(struct gsm_time *time);
+
+/* GSM TS 03.03 Chapter 2.6 */
+enum gprs_tlli_type {
+	TLLI_LOCAL,
+	TLLI_FOREIGN,
+	TLLI_RANDOM,
+	TLLI_AUXILIARY,
+	TLLI_RESERVED,
+};
+
+/* TS 03.03 Chapter 2.6 */
+int gprs_tlli_type(uint32_t tlli);
+
+uint32_t gprs_tmsi2tlli(uint32_t p_tmsi, enum gprs_tlli_type type);
+
+/* Osmocom internal, not part of any gsm spec */
+enum gsm_phys_chan_config {
+	GSM_PCHAN_NONE,
+	GSM_PCHAN_CCCH,
+	GSM_PCHAN_CCCH_SDCCH4,
+	GSM_PCHAN_TCH_F,
+	GSM_PCHAN_TCH_H,
+	GSM_PCHAN_SDCCH8_SACCH8C,
+	GSM_PCHAN_PDCH,		/* GPRS PDCH */
+	GSM_PCHAN_TCH_F_PDCH,	/* TCH/F if used, PDCH otherwise */
+	GSM_PCHAN_UNKNOWN,
+	_GSM_PCHAN_MAX
+};
+
+/* Osmocom internal, not part of any gsm spec */
+enum gsm_chan_t {
+	GSM_LCHAN_NONE,
+	GSM_LCHAN_SDCCH,
+	GSM_LCHAN_TCH_F,
+	GSM_LCHAN_TCH_H,
+	GSM_LCHAN_UNKNOWN,
+	GSM_LCHAN_CCCH,
+	GSM_LCHAN_PDTCH,
+	_GSM_LCHAN_MAX
+};
+
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/lapd_core.h b/src/shared/libosmocore/include/osmocom/gsm/lapd_core.h
new file mode 100644
index 00000000..0f4e8899
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/lapd_core.h
@@ -0,0 +1,171 @@
+#ifndef _OSMOCOM_LAPD_H
+#define _OSMOCOM_LAPD_H
+
+#include <stdint.h>
+
+#include <osmocom/core/timer.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/prim.h>
+
+/*! \defgroup lapd LAPD implementation common part
+ *  @{
+ */
+
+/*! \file lapd.h */
+
+/* primitive related sutff */
+
+/*! \brief LAPD related primitives (L2<->L3 SAP)*/
+enum osmo_dl_prim {
+	PRIM_DL_UNIT_DATA,	/*!< \brief DL-UNIT-DATA */
+	PRIM_DL_DATA,		/*!< \brief DL-DATA */
+	PRIM_DL_EST,		/*!< \brief DL-ESTABLISH */
+	PRIM_DL_REL,		/*!< \brief DL-RLEEASE */
+	PRIM_DL_SUSP,		/*!< \brief DL-SUSPEND */
+	PRIM_DL_RES,		/*!< \brief DL-RESUME */
+	PRIM_DL_RECON,		/*!< \brief DL-RECONNECT */
+	PRIM_MDL_ERROR,		/*!< \brief MDL-ERROR */
+};
+
+/* Uses the same values as RLL, so no conversion for GSM is required. */
+#define MDL_CAUSE_T200_EXPIRED		0x01
+#define MDL_CAUSE_REEST_REQ		0x02
+#define MDL_CAUSE_UNSOL_UA_RESP		0x03
+#define MDL_CAUSE_UNSOL_DM_RESP		0x04
+#define MDL_CAUSE_UNSOL_DM_RESP_MF	0x05
+#define MDL_CAUSE_UNSOL_SPRV_RESP	0x06
+#define MDL_CAUSE_SEQ_ERR		0x07
+#define MDL_CAUSE_UFRM_INC_PARAM	0x08
+#define MDL_CAUSE_SFRM_INC_PARAM	0x09
+#define MDL_CAUSE_IFRM_INC_MBITS	0x0a
+#define MDL_CAUSE_IFRM_INC_LEN		0x0b
+#define MDL_CAUSE_FRM_UNIMPL		0x0c
+#define MDL_CAUSE_SABM_MF		0x0d
+#define MDL_CAUSE_SABM_INFO_NOTALL	0x0e
+#define MDL_CAUSE_FRMR			0x0f
+
+/*! \brief for MDL-ERROR.ind */
+struct mdl_error_ind_param {
+	uint8_t cause;		/*!< \brief generic cause value */
+};
+
+/*! \brief for DL-REL.req */
+struct dl_rel_req_param {
+	uint8_t mode;		/*!< \brief release mode */
+};
+
+/*! \brief primitive header for LAPD DL-SAP primitives */
+struct osmo_dlsap_prim {
+	struct osmo_prim_hdr oph; /*!< \brief generic primitive header */
+	union {
+		struct mdl_error_ind_param error_ind;
+		struct dl_rel_req_param rel_req;
+	} u;			/*!< \brief request-specific data */
+};
+
+/*! \brief LAPD mode/role */
+enum lapd_mode {
+	LAPD_MODE_USER,		/*!< \brief behave like user */
+	LAPD_MODE_NETWORK,	/*!< \brief behave like network */
+};
+
+/*! \brief LAPD state (Figure B.2/Q.921)*/
+enum lapd_state {
+	LAPD_STATE_NULL = 0,
+	LAPD_STATE_TEI_UNASS,
+	LAPD_STATE_ASS_TEI_WAIT,
+	LAPD_STATE_EST_TEI_WAIT,
+	LAPD_STATE_IDLE,
+	LAPD_STATE_SABM_SENT,
+	LAPD_STATE_DISC_SENT,
+	LAPD_STATE_MF_EST,
+	LAPD_STATE_TIMER_RECOV,
+};
+
+/*! \brief LAPD message format (I / S / U) */
+enum lapd_format {
+	LAPD_FORM_UKN = 0,
+	LAPD_FORM_I,
+	LAPD_FORM_S,
+	LAPD_FORM_U,
+};
+
+/*! \brief LAPD message context */
+struct lapd_msg_ctx {
+	struct lapd_datalink *dl;
+	int n201;
+	/* address */
+	uint8_t cr;
+	uint8_t sapi;
+	uint8_t tei;
+	uint8_t lpd;
+	/* control */
+	uint8_t format;
+	uint8_t p_f; /* poll / final bit */
+	uint8_t n_send;
+	uint8_t n_recv;
+	uint8_t s_u; /* S or repectivly U function bits */
+	/* length */
+	int	length;
+	uint8_t	more;
+};
+
+struct lapd_cr_ent {
+	uint8_t cmd;
+	uint8_t resp;
+};
+
+struct lapd_history {
+	struct msgb *msg; /* message to be sent / NULL, if histoy is empty */
+	int	more; /* if message is fragmented */
+};
+
+/*! \brief LAPD datalink */
+struct lapd_datalink {
+	int (*send_dlsap)(struct osmo_dlsap_prim *dp,
+	        struct lapd_msg_ctx *lctx);
+	int (*send_ph_data_req)(struct lapd_msg_ctx *lctx, struct msgb *msg);
+	struct {
+		/*! \brief filled-in once we set the lapd_mode above */
+		struct lapd_cr_ent loc2rem;
+		struct lapd_cr_ent rem2loc;
+	} cr;
+	enum lapd_mode mode; /*!< \brief current mode of link */
+	int use_sabme; /*!< \brief use SABME instead of SABM */
+	int reestablish; /*!< \brief enable reestablish support */
+	int n200, n200_est_rel; /*!< \brief number of retranmissions */
+	struct lapd_msg_ctx lctx; /*!< \brief LAPD context */
+	int maxf; /*!< \brief maximum frame size (after defragmentation) */ 
+	uint8_t k; /*!< \brief maximum number of unacknowledged frames */
+	uint8_t v_range; /*!< \brief range of sequence numbers */
+	uint8_t v_send;	/*!< \brief seq nr of next I frame to be transmitted */
+	uint8_t v_ack;	/*!< \brief last frame ACKed by peer */
+	uint8_t v_recv;	/*!< \brief seq nr of next I frame expected to be received */
+	uint32_t state; /*!< \brief LAPD state (\ref lapd_state) */
+	int seq_err_cond; /*!< \brief condition of sequence error */
+	uint8_t own_busy; /*!< \brief receiver busy on our side */
+	uint8_t peer_busy; /*!< \brief receiver busy on remote side */
+	int t200_sec, t200_usec; /*!< \brief retry timer (default 1 sec) */
+	int t203_sec, t203_usec; /*!< \brief retry timer (default 10 secs) */
+	struct osmo_timer_list t200; /*!< \brief T200 timer */
+	struct osmo_timer_list t203; /*!< \brief T203 timer */
+	uint8_t retrans_ctr; /*!< \brief re-transmission counter */
+	struct llist_head tx_queue; /*!< \brief frames to L1 */
+	struct llist_head send_queue; /*!< \brief frames from L3 */
+	struct msgb *send_buffer; /*!< \brief current frame transmitting */
+	int send_out; /*!< \brief how much was sent from send_buffer */
+	struct lapd_history *tx_hist; /*!< \brief tx history structure array */
+	uint8_t range_hist; /*!< \brief range of history buffer 2..2^n */
+	struct msgb *rcv_buffer; /*!< \brief buffer to assemble the received message */
+	struct msgb *cont_res; /*!< \brief buffer to store content resolution data on network side, to detect multiple phones on same channel */
+};
+
+void lapd_dl_init(struct lapd_datalink *dl, uint8_t k, uint8_t v_range,
+	int maxf);
+void lapd_dl_exit(struct lapd_datalink *dl);
+void lapd_dl_reset(struct lapd_datalink *dl);
+int lapd_set_mode(struct lapd_datalink *dl, enum lapd_mode mode);
+int lapd_ph_data_ind(struct msgb *msg, struct lapd_msg_ctx *lctx);
+int lapd_recv_dlsap(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx);
+
+#endif /* _OSMOCOM_LAPD_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/lapdm.h b/src/shared/libosmocore/include/osmocom/gsm/lapdm.h
new file mode 100644
index 00000000..571fd460
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/lapdm.h
@@ -0,0 +1,162 @@
+#ifndef _OSMOCOM_LAPDM_H
+#define _OSMOCOM_LAPDM_H
+
+#include <osmocom/gsm/lapd_core.h>
+
+/*! \defgroup lapdm LAPDm implementation according to GSM TS 04.06
+ *  @{
+ */
+
+/*! \file lapdm.h */
+
+/* primitive related sutff */
+
+/*! \brief LAPDm related primitives (L1<->L2 SAP) */
+enum osmo_ph_prim {
+	PRIM_PH_DATA,		/*!< \brief PH-DATA */
+	PRIM_PH_RACH,		/*!< \brief PH-RANDOM_ACCESS */
+	PRIM_PH_CONN,		/*!< \brief PH-CONNECT */
+	PRIM_PH_EMPTY_FRAME,	/*!< \brief PH-EMPTY_FRAME */
+	PRIM_PH_RTS,		/*!< \brief PH-RTS */
+};
+
+/*! \brief for PH-RANDOM_ACCESS.req */
+struct ph_rach_req_param {
+	uint8_t ra;		/*!< \brief Random Access */
+	uint8_t ta;		/*!< \brief Timing Advance */
+	uint8_t tx_power;	/*!< \brief Transmit Power */
+	uint8_t is_combined_ccch;/*!< \brief Are we using a combined CCCH? */
+	uint16_t offset;	/*!< \brief Timing Offset */
+};
+
+/*! \brief for PH-RANDOM_ACCESS.ind */
+struct ph_rach_ind_param {
+	uint8_t ra;		/*!< \brief Random Access */
+	uint8_t acc_delay;	/*!< \brief Delay in bit periods */
+	uint32_t fn;		/*!< \brief GSM Frame Number at time of RA */
+};
+
+/*! \brief for PH-[UNIT]DATA.{req,ind} */
+struct ph_data_param {
+	uint8_t link_id;	/*!< \brief Link Identifier (Like RSL) */
+	uint8_t chan_nr;	/*!< \brief Channel Number (Like RSL) */
+};
+
+/*! \brief for PH-CONN.ind */
+struct ph_conn_ind_param {
+	uint32_t fn;		/*!< \brief GSM Frame Number */
+};
+
+/*! \brief primitive header for LAPDm PH-SAP primitives */
+struct osmo_phsap_prim {
+	struct osmo_prim_hdr oph; /*!< \brief generic primitive header */
+	union {
+		struct ph_data_param data;
+		struct ph_rach_req_param rach_req;
+		struct ph_rach_ind_param rach_ind;
+		struct ph_conn_ind_param conn_ind;
+	} u;			/*!< \brief request-specific data */
+};
+
+/*! \brief LAPDm mode/role */
+enum lapdm_mode {
+	LAPDM_MODE_MS,		/*!< \brief behave like a MS (mobile phone) */
+	LAPDM_MODE_BTS,		/*!< \brief behave like a BTS (network) */
+};
+
+struct lapdm_entity;
+
+/*! \brief LAPDm message context */
+struct lapdm_msg_ctx {
+	struct lapdm_datalink *dl;
+	int lapdm_fmt;
+	uint8_t chan_nr;
+	uint8_t link_id;
+	uint8_t ta_ind;		/* TA indicated by network */
+	uint8_t tx_power_ind;	/* MS power indicated by network */
+};
+
+/*! \brief LAPDm datalink like TS 04.06 / Section 3.5.2 */
+struct lapdm_datalink {
+	struct lapd_datalink dl; /* \brief common LAPD */
+	struct lapdm_msg_ctx mctx; /*!< \brief context of established connection */
+
+	struct lapdm_entity *entity; /*!< \brief LAPDm entity we are part of */
+};
+
+/*! \brief LAPDm datalink SAPIs */
+enum lapdm_dl_sapi {
+	DL_SAPI0	= 0,	/*!< \brief SAPI 0 */
+	DL_SAPI3	= 1,	/*!< \brief SAPI 1 */
+	_NR_DL_SAPI
+};
+
+typedef int (*lapdm_cb_t)(struct msgb *msg, struct lapdm_entity *le, void *ctx);
+
+#define LAPDM_ENT_F_EMPTY_FRAME		0x0001
+#define LAPDM_ENT_F_POLLING_ONLY	0x0002
+
+/*! \brief a LAPDm Entity */
+struct lapdm_entity {
+	/*! \brief the SAPIs of the LAPDm entity */
+	struct lapdm_datalink datalink[_NR_DL_SAPI];
+	int last_tx_dequeue; /*!< \brief last entity that was dequeued */
+	int tx_pending; /*!< \brief currently a pending frame not confirmed by L1 */
+	enum lapdm_mode mode; /*!< \brief are we in BTS mode or MS mode */
+	unsigned int flags;
+
+	void *l1_ctx;	/*!< \brief context for layer1 instance */
+	void *l3_ctx;	/*!< \brief context for layer3 instance */
+
+	osmo_prim_cb l1_prim_cb;/*!< \brief callback for sending prims to L1 */
+	lapdm_cb_t l3_cb;	/*!< \brief callback for sending stuff to L3 */
+
+	/*! \brief pointer to \ref lapdm_channel of which we're part */
+	struct lapdm_channel *lapdm_ch;
+
+	uint8_t ta;		/* TA used and indicated to network */
+	uint8_t tx_power;	/* MS power used and indicated to network */
+};
+
+/*! \brief the two lapdm_entities that form a GSM logical channel (ACCH + DCCH) */
+struct lapdm_channel {
+	struct llist_head list;		/*!< \brief internal linked list */
+	char *name;			/*!< \brief human-readable name */
+	struct lapdm_entity lapdm_acch;	/*!< \brief Associated Control Channel */
+	struct lapdm_entity lapdm_dcch;	/*!< \brief Dedicated Control Channel */
+};
+
+const char *get_rsl_name(int value);
+extern const char *lapdm_state_names[];
+
+/* initialize a LAPDm entity */
+void lapdm_entity_init(struct lapdm_entity *le, enum lapdm_mode mode, int t200);
+void lapdm_channel_init(struct lapdm_channel *lc, enum lapdm_mode mode);
+
+/* deinitialize a LAPDm entity */
+void lapdm_entity_exit(struct lapdm_entity *le);
+void lapdm_channel_exit(struct lapdm_channel *lc);
+
+/* input into layer2 (from layer 1) */
+int lapdm_phsap_up(struct osmo_prim_hdr *oph, struct lapdm_entity *le);
+
+/* input into layer2 (from layer 3) */
+int lapdm_rslms_recvmsg(struct msgb *msg, struct lapdm_channel *lc);
+
+void lapdm_channel_set_l3(struct lapdm_channel *lc, lapdm_cb_t cb, void *ctx);
+void lapdm_channel_set_l1(struct lapdm_channel *lc, osmo_prim_cb cb, void *ctx);
+
+int lapdm_entity_set_mode(struct lapdm_entity *le, enum lapdm_mode mode);
+int lapdm_channel_set_mode(struct lapdm_channel *lc, enum lapdm_mode mode);
+
+void lapdm_entity_reset(struct lapdm_entity *le);
+void lapdm_channel_reset(struct lapdm_channel *lc);
+
+void lapdm_entity_set_flags(struct lapdm_entity *le, unsigned int flags);
+void lapdm_channel_set_flags(struct lapdm_channel *lc, unsigned int flags);
+
+int lapdm_phsap_dequeue_prim(struct lapdm_entity *le, struct osmo_phsap_prim *pp);
+
+/*! @} */
+
+#endif /* _OSMOCOM_LAPDM_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/mncc.h b/src/shared/libosmocore/include/osmocom/gsm/mncc.h
new file mode 100644
index 00000000..a51267e0
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/mncc.h
@@ -0,0 +1,85 @@
+#ifndef _OSMOCORE_MNCC_H
+#define _OSMOCORE_MNCC_H
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+#define GSM_MAX_FACILITY       128
+#define GSM_MAX_SSVERSION      128
+#define GSM_MAX_USERUSER       128
+
+/* Expanded fields from GSM TS 04.08, Table 10.5.102 */
+struct gsm_mncc_bearer_cap {
+	int		transfer;	/* Information Transfer Capability */
+	int 		mode;		/* Transfer Mode */
+	int		coding;		/* Coding Standard */
+	int		radio;		/* Radio Channel Requirement */
+	int		speech_ctm;	/* CTM text telephony indication */
+	int		speech_ver[8];	/* Speech version indication */
+	struct {
+		enum gsm48_bcap_ra		rate_adaption;
+		enum gsm48_bcap_sig_access	sig_access;
+		int				async;
+		int				nr_stop_bits;
+		int				nr_data_bits;
+		enum gsm48_bcap_user_rate	user_rate;
+		enum gsm48_bcap_parity		parity;
+		enum gsm48_bcap_interm_rate	interm_rate;
+		enum gsm48_bcap_transp		transp;
+		enum gsm48_bcap_modem_type	modem_type;
+	} data;
+};
+
+struct gsm_mncc_number {
+	int 		type;
+	int 		plan;
+	int		present;
+	int		screen;
+	char		number[33];
+};
+
+struct gsm_mncc_cause {
+	int		location;
+	int		coding;
+	int		rec;
+	int		rec_val;
+	int		value;
+	int		diag_len;
+	char		diag[32];
+};
+
+struct gsm_mncc_useruser {
+	int		proto;
+	char		info[GSM_MAX_USERUSER + 1]; /* + termination char */
+};
+
+struct gsm_mncc_progress {
+	int		coding;
+	int		location;
+	int 		descr;
+};
+
+struct gsm_mncc_facility {
+	int		len;
+	char		info[GSM_MAX_FACILITY];
+};
+
+struct gsm_mncc_ssversion {
+	int		len;
+	char		info[GSM_MAX_SSVERSION];
+};
+
+struct gsm_mncc_cccap {
+	int		dtmf;
+	int		pcp;
+};
+
+enum {
+	GSM_MNCC_BCAP_SPEECH	= 0,
+	GSM_MNCC_BCAP_UNR_DIG	= 1,
+	GSM_MNCC_BCAP_AUDIO	= 2,
+	GSM_MNCC_BCAP_FAX_G3	= 3,
+	GSM_MNCC_BCAP_OTHER_ITC = 5,
+	GSM_MNCC_BCAP_RESERVED	= 7,
+};
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/prim.h b/src/shared/libosmocore/include/osmocom/gsm/prim.h
new file mode 100644
index 00000000..5beb2007
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/prim.h
@@ -0,0 +1,18 @@
+#ifndef OSMO_GSM_PRIM_H
+#define OSMO_GSM_PRIM_H
+
+#include <osmocom/core/prim.h>
+
+/* enumeration of GSM related SAPs */
+enum osmo_gsm_sap {
+	SAP_GSM_PH	= _SAP_GSM_BASE,
+	SAP_GSM_DL,
+	SAP_GSM_MDL,
+
+	SAP_BSSGP_GMM,
+	SAP_BSSGP_LL,
+	SAP_BSSGP_NM,
+	SAP_BSSGP_PFM,
+};
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_03_41.h b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_03_41.h
new file mode 100644
index 00000000..54365cbc
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_03_41.h
@@ -0,0 +1,51 @@
+#ifndef PROTO_GSM_03_41_H
+#define PROTO_GSM_03_41_H
+
+#include <stdint.h>
+
+/* GSM TS 03.41 definitions also TS 23.041*/
+
+/* Chapter 9.3.2 */
+struct gsm341_ms_message {
+	struct {
+		uint8_t code_hi:6;
+		uint8_t gs:2;
+		uint8_t update:4;
+		uint8_t code_lo:4;
+	} serial;
+	uint16_t msg_id;
+	struct {
+		uint8_t language:4;
+		uint8_t group:4;
+	} dcs;
+	struct {
+		uint8_t total:4;
+		uint8_t current:4;
+	} page;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* Chapter 9.4.1.3 */
+struct gsm341_etws_message {
+	struct {
+		uint8_t code_hi:4;
+		uint8_t popup:1;
+		uint8_t alert:1;
+		uint8_t gs:2;
+		uint8_t update:4;
+		uint8_t code_lo:4;
+	} serial;
+	uint16_t msg_id;
+	uint16_t warning_type;
+	uint8_t data[0];
+} __attribute__((packed));
+
+#define GSM341_MSG_CODE(ms) ((ms)->serial.code_lo | ((ms)->serial.code_hi << 4))
+
+/* Section 9.3.2.1 - Geographical Scope */
+#define GSM341_GS_CELL_WIDE_IMMED	0
+#define GSM341_GS_PLMN_WIDE		1
+#define GSM341_GS_LA_WIDE		2
+#define GSM341_GS_CELL_WIDE		3
+
+#endif /* PROTO_GSM_03_41_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_08.h b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_08.h
new file mode 100644
index 00000000..172ef678
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_08.h
@@ -0,0 +1,1339 @@
+#ifndef PROTO_GSM_04_08_H
+#define PROTO_GSM_04_08_H
+
+#include <stdint.h>
+
+/* GSM TS 04.08  definitions */
+struct gsm_lchan;
+
+/* Chapter 10.5.1.5 */
+struct gsm48_classmark1 {
+	uint8_t pwr_lev:3,
+		 a5_1:1,
+		 es_ind:1,
+		 rev_lev:2,
+		 spare:1;
+} __attribute__ ((packed));
+
+/* Chapter 10.5.1.6 */
+struct gsm48_classmark2 {
+	uint8_t pwr_lev:3,
+		 a5_1:1,
+		 es_ind:1,
+		 rev_lev:2,
+		 spare:1;
+	uint8_t	fc:1,
+		 vgcs:1,
+		 vbs:1,
+		 sm_cap:1,
+		 ss_scr:2,
+		 ps_cap:1,
+		 spare2:1;
+	uint8_t	a5_2:1,
+		 a5_3:1,
+		 cmsp:1,
+		 solsa:1,
+		 spare3:1,
+		 lcsva_cap:1,
+		 spare4:1,
+		 cm3:1;
+} __attribute__ ((packed));
+
+/* Chapter 10.5.2.1b.3 */
+struct gsm48_range_1024 {
+	uint8_t	w1_hi:2,
+		 f0:1,
+		 form_id:5;
+	uint8_t	w1_lo;
+	uint8_t	w2_hi;
+	uint8_t	w3_hi:7,
+		 w2_lo:1;
+	uint8_t	w4_hi:6,
+		 w3_lo:2;
+	uint8_t	w5_hi:6,
+		 w4_lo:2;
+	uint8_t	w6_hi:6,
+		 w5_lo:2;
+	uint8_t	w7_hi:6,
+		 w6_lo:2;
+	uint8_t	w8_hi:6,
+		 w7_lo:2;
+	uint8_t	w9:7,
+		 w8_lo:1;
+	uint8_t	w11_hi:1,
+		 w10:7;
+	uint8_t	w12_hi:2,
+		 w11_lo:6;
+	uint8_t	w13_hi:3,
+		 w12_lo:5;
+	uint8_t	w14_hi:4,
+		 w13_lo:4;
+	uint8_t	w15_hi:5,
+		 w14_lo:3;
+	uint8_t	w16:6,
+		 w15_lo:2;
+} __attribute__ ((packed));
+
+/* Chapter 10.5.2.1b.4 */
+struct gsm48_range_512 {
+	uint8_t	orig_arfcn_hi:1,
+		 form_id:7;
+	uint8_t	orig_arfcn_mid;
+	uint8_t	w1_hi:7,
+		 orig_arfcn_lo:1;
+	uint8_t	w2_hi:6,
+		 w1_lo:2;
+	uint8_t	w3_hi:6,
+		 w2_lo:2;
+	uint8_t	w4_hi:6,
+		 w3_lo:2;
+	uint8_t	w5:7,
+		 w4_lo:1;
+	uint8_t	w7_hi:1,
+		 w6:7;
+	uint8_t	w8_hi:2,
+		 w7_lo:6;
+	uint8_t	w9_hi:4,
+		 w8_lo:4;
+	uint8_t	w10:6,
+		 w9_lo:2;
+	uint8_t	w12_hi:2,
+		 w11:6;
+	uint8_t	w13_hi:4,
+		 w12_lo:4;
+	uint8_t	w14:6,
+		 w13_lo:2;
+	uint8_t	w16_hi:2,
+		 w15:6;
+	uint8_t	w17:5,
+		 w16_lo:3;
+} __attribute__ ((packed));
+
+/* Chapter 10.5.2.1b.5 */
+struct gsm48_range_256 {
+	uint8_t	orig_arfcn_hi:1,
+		 form_id:7;
+	uint8_t	orig_arfcn_mid;
+	uint8_t	w1_hi:7,
+		 orig_arfcn_lo:1;
+	uint8_t	w2:7,
+		 w1_lo:1;
+	uint8_t	w4_hi:1,
+		 w3:7;
+	uint8_t	w5_hi:3,
+		 w4_lo:5;
+	uint8_t	w6_hi:5,
+		 w5_lo:3;
+	uint8_t	w8_hi:1,
+		 w7:6,
+		 w6_lo:1;
+	uint8_t	w9_hi:4,
+		 w8_lo:4;
+	uint8_t	w11_hi:2,
+		 w10:5,
+		 w9_lo:1;
+	uint8_t	w12:5,
+		 w11_lo:3;
+	uint8_t	w14_hi:3,
+		 w13:5;
+	uint8_t	w16_hi:1,
+		 w15:5,
+		 w14_lo:2;
+	uint8_t	w18_hi:1,
+		 w17:4,
+		 w16_lo:3;
+	uint8_t	w20_hi:1,
+		 w19:4,
+		 w18_lo:3;
+	uint8_t	spare:1,
+		 w21:4,
+		 w20_lo:3;
+} __attribute__ ((packed));
+
+/* Chapter 10.5.2.1b.6 */
+struct gsm48_range_128 {
+	uint8_t	orig_arfcn_hi:1,
+		 form_id:7;
+	uint8_t	orig_arfcn_mid;
+	uint8_t	w1:7,
+		 orig_arfcn_lo:1;
+	uint8_t	w3_hi:2,
+		 w2:6;
+	uint8_t	w4_hi:4,
+		 w3_lo:4;
+	uint8_t	w6_hi:2,
+		 w5:5,
+		 w4_lo:1;
+	uint8_t	w7:5,
+		 w6_lo:3;
+	uint8_t	w9:4,
+		 w8:4;
+	uint8_t	w11:4,
+		 w10:4;
+	uint8_t	w13:4,
+		 w12:4;
+	uint8_t	w15:4,
+		 w14:4;
+	uint8_t	w18_hi:2,
+		 w17:3,
+		 w16:3;
+	uint8_t	w21_hi:1,
+		 w20:3,
+		 w19:3,
+		 w18_lo:1;
+	uint8_t	w23:3,
+		 w22:3,
+		 w21_lo:2;
+	uint8_t	w26_hi:2,
+		 w25:3,
+		 w24:3;
+	uint8_t	spare:1,
+		 w28:3,
+		 w27:3,
+		 w26_lo:1;
+} __attribute__ ((packed));
+
+/* Chapter 10.5.2.1b.7 */
+struct gsm48_var_bit {
+	uint8_t	orig_arfcn_hi:1,
+		 form_id:7;
+	uint8_t	orig_arfcn_mid;
+	uint8_t	rrfcn1_7:7,
+		 orig_arfcn_lo:1;
+	uint8_t rrfcn8_111[13];
+} __attribute__ ((packed));
+
+/* Chapter 10.5.2.5 */
+struct gsm48_chan_desc {
+	uint8_t chan_nr;
+	union {
+		struct {
+			uint8_t maio_high:4,
+				 h:1,
+				 tsc:3;
+			uint8_t hsn:6,
+				 maio_low:2;
+		} __attribute__ ((packed)) h1;
+		struct {
+			uint8_t arfcn_high:2,
+				 spare:2,
+				 h:1,
+				 tsc:3;
+			uint8_t arfcn_low;
+		} __attribute__ ((packed)) h0;
+	} __attribute__ ((packed));
+} __attribute__ ((packed));
+
+/* Chapter 10.5.2.20 */
+struct gsm48_meas_res {
+	uint8_t	rxlev_full:6,
+		 dtx_used:1,
+		 ba_used:1;
+	uint8_t	rxlev_sub:6,
+		 meas_valid:1,
+		 spare:1;
+	uint8_t	no_nc_n_hi:1,
+		 rxqual_sub:3,
+		 rxqual_full:3,
+		 spare2:1;
+	uint8_t	rxlev_nc1:6,
+		 no_nc_n_lo:2;
+	uint8_t	bsic_nc1_hi:3,
+		 bcch_f_nc1:5;
+	uint8_t	rxlev_nc2_hi:5,
+		 bsic_nc1_lo:3;
+	uint8_t	bsic_nc2_hi:2,
+		 bcch_f_nc2:5,
+		 rxlev_nc2_lo:1;
+	uint8_t	rxlev_nc3_hi:4,
+		 bsic_nc2_lo:4;
+	uint8_t	bsic_nc3_hi:1,
+		 bcch_f_nc3:5,
+		 rxlev_nc3_lo:2;
+	uint8_t	rxlev_nc4_hi:3,
+		 bsic_nc3_lo:5;
+	uint8_t	bcch_f_nc4:5,
+		 rxlev_nc4_lo:3;
+	uint8_t	rxlev_nc5_hi:2,
+		 bsic_nc4:6;
+	uint8_t	bcch_f_nc5_hi:4,
+		 rxlev_nc5_lo:4;
+	uint8_t	rxlev_nc6_hi:1,
+		 bsic_nc5:6,
+		 bcch_f_nc5_lo:1;
+	uint8_t	bcch_f_nc6_hi:3,
+		 rxlev_nc6_lo:5;
+	uint8_t	bsic_nc6:6,
+		 bcch_f_nc6_lo:2;
+} __attribute__ ((packed));
+
+/* Chapter 10.5.2.21aa */
+struct gsm48_multi_rate_conf {
+	uint8_t smod : 2,
+		 spare: 1,
+		 icmi : 1,
+		 nscb : 1,
+		 ver : 3;
+	uint8_t m4_75 : 1,
+		 m5_15 : 1,
+		 m5_90 : 1,
+		 m6_70 : 1,
+		 m7_40 : 1,
+		 m7_95 : 1,
+		 m10_2 : 1,
+		 m12_2 : 1;
+} __attribute__((packed));
+
+/* Chapter 10.5.2.28(a) */
+struct gsm48_power_cmd {
+	uint8_t power_level:5,
+		 spare:2,
+		 atc:1;
+} __attribute__((packed));
+
+/* Chapter 10.5.2.29 */
+struct gsm48_rach_control {
+	uint8_t re :1,
+		 cell_bar :1,
+		 tx_integer :4,
+		 max_trans :2;
+	uint8_t t2;
+	uint8_t t3;
+} __attribute__ ((packed));
+
+
+/* Chapter 10.5.2.30 */
+struct gsm48_req_ref {
+	uint8_t ra;
+	uint8_t t3_high:3,
+		 t1:5;
+	uint8_t t2:5,
+		 t3_low:3;
+} __attribute__ ((packed));
+
+/* Chapter 10.5.2.38 */
+struct gsm48_start_time {
+	uint8_t t3_high:3,
+		 t1:5;
+	uint8_t t2:5,
+		 t3_low:3;
+} __attribute__ ((packed));
+
+/* Chapter 10.5.2.39 */
+struct gsm48_sync_ind {
+	uint8_t si:2,
+		 rot:1,
+		 nci:1,
+		 sync_ie:4;
+} __attribute__((packed));
+
+/*
+ * Chapter 9.1.5/9.1.6
+ *
+ * For 9.1.6 the chan_desc has the meaning of 10.5.2.5a
+ */
+struct gsm48_chan_mode_modify {
+	struct gsm48_chan_desc chan_desc;
+	uint8_t mode;
+} __attribute__ ((packed));
+
+enum gsm48_chan_mode {
+	GSM48_CMODE_SIGN	= 0x00,
+	GSM48_CMODE_SPEECH_V1	= 0x01,
+	GSM48_CMODE_SPEECH_EFR	= 0x21,
+	GSM48_CMODE_SPEECH_AMR	= 0x41,
+	GSM48_CMODE_DATA_14k5	= 0x0f,
+	GSM48_CMODE_DATA_12k0	= 0x03,
+	GSM48_CMODE_DATA_6k0	= 0x0b,
+	GSM48_CMODE_DATA_3k6	= 0x23,
+};
+
+/* Chapter 9.1.2 */
+struct gsm48_ass_cmd {
+	/* Semantic is from 10.5.2.5a */
+	struct gsm48_chan_desc chan_desc;
+	uint8_t power_command;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* Chapter 9.1.13 */
+struct gsm48_frq_redef {
+	/* Semantic is from 10.5.2.5a */
+	struct gsm48_chan_desc chan_desc;
+	uint8_t mob_alloc_len;
+	uint8_t mob_alloc[0];
+} __attribute__((packed));
+
+/* Chapter 10.5.2.2 */
+struct gsm48_cell_desc {
+	uint8_t bcc:3,
+		 ncc:3,
+		 arfcn_hi:2;
+	uint8_t arfcn_lo;
+} __attribute__((packed));
+
+/* Chapter 9.1.15 */
+struct gsm48_ho_cmd {
+	struct gsm48_cell_desc cell_desc;
+	struct gsm48_chan_desc chan_desc;
+	uint8_t ho_ref;
+	uint8_t power_command;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* Chapter 9.1.18 */
+struct gsm48_imm_ass {
+	uint8_t l2_plen;
+	uint8_t proto_discr;
+	uint8_t msg_type;
+	uint8_t page_mode;
+	struct gsm48_chan_desc chan_desc;
+	struct gsm48_req_ref req_ref;
+	uint8_t timing_advance;
+	uint8_t mob_alloc_len;
+	uint8_t mob_alloc[0];
+} __attribute__ ((packed));
+
+/* Chapter 9.1.25 */
+struct gsm48_pag_resp {
+	uint8_t spare:4,
+		 key_seq:4;
+	uint32_t classmark2;
+	uint8_t mi_len;
+	uint8_t mi[0];
+} __attribute__ ((packed));
+
+/* Chapter 10.5.1.3 */
+struct gsm48_loc_area_id {
+	uint8_t digits[3];	/* BCD! */
+	uint16_t lac;
+} __attribute__ ((packed));
+
+/* Section 9.2.2 */
+struct gsm48_auth_req {
+	uint8_t key_seq:4,
+	         spare:4;
+	uint8_t rand[16];
+} __attribute__ ((packed));
+
+/* Section 9.2.3 */
+struct gsm48_auth_resp {
+	uint8_t sres[4];
+} __attribute__ ((packed));
+
+/* Section 9.2.15 */
+struct gsm48_loc_upd_req {
+	uint8_t type:4,
+		 key_seq:4;
+	struct gsm48_loc_area_id lai;
+	struct gsm48_classmark1 classmark1;
+	uint8_t mi_len;
+	uint8_t mi[0];
+} __attribute__ ((packed));
+
+/* Section 10.1 */
+struct gsm48_hdr {
+	uint8_t proto_discr;
+	uint8_t msg_type;
+	uint8_t data[0];
+} __attribute__ ((packed));
+
+/* Section 9.1.3x System information Type header */
+struct gsm48_system_information_type_header {
+	uint8_t l2_plen;
+	uint8_t rr_protocol_discriminator :4,
+		skip_indicator:4; 
+	uint8_t system_information;
+} __attribute__ ((packed));
+
+/* Section 10.5.2.4 Cell Selection Parameters */
+struct gsm48_cell_sel_par {
+	uint8_t ms_txpwr_max_ccch:5,	/* GSM 05.08 MS-TXPWR-MAX-CCCH */
+		 cell_resel_hyst:3;	/* GSM 05.08 CELL-RESELECT-HYSTERESIS */
+	uint8_t rxlev_acc_min:6,	/* GSM 05.08 RXLEV-ACCESS-MIN */
+		 neci:1,
+		 acs:1;
+} __attribute__ ((packed));
+
+/* Section 10.5.2.11 Control Channel Description , Figure 10.5.33 */
+struct gsm48_control_channel_descr {
+	uint8_t ccch_conf :3,
+		bs_ag_blks_res :3,
+		att :1,
+		spare1 :1;
+	uint8_t bs_pa_mfrms : 3,
+		spare2 :5;
+	uint8_t t3212;
+} __attribute__ ((packed));
+
+struct gsm48_cell_options {
+	uint8_t radio_link_timeout:4,
+		 dtx:2,
+		 pwrc:1,
+		 spare:1;
+} __attribute__ ((packed));
+
+/* Section 9.2.9 CM service request */
+struct gsm48_service_request {
+	uint8_t cm_service_type : 4,
+		 cipher_key_seq  : 4;
+	/* length + 3 bytes */
+	uint32_t classmark;
+	uint8_t mi_len;
+	uint8_t mi[0];
+	/* optional priority level */
+} __attribute__ ((packed));
+
+/* Section 9.1.31 System information Type 1 */
+struct gsm48_system_information_type_1 {
+	struct gsm48_system_information_type_header header;
+	uint8_t cell_channel_description[16];
+	struct gsm48_rach_control rach_control;
+	uint8_t rest_octets[0]; /* NCH position on the CCCH */
+} __attribute__ ((packed));
+
+/* Section 9.1.32 System information Type 2 */
+struct gsm48_system_information_type_2 {
+	struct gsm48_system_information_type_header header;
+	uint8_t bcch_frequency_list[16];
+	uint8_t ncc_permitted;
+	struct gsm48_rach_control rach_control;
+} __attribute__ ((packed));
+
+/* Section 9.1.33 System information Type 2bis */
+struct gsm48_system_information_type_2bis {
+	struct gsm48_system_information_type_header header;
+	uint8_t bcch_frequency_list[16];
+	struct gsm48_rach_control rach_control;
+	uint8_t rest_octets[0];
+} __attribute__ ((packed));
+
+/* Section 9.1.34 System information Type 2ter */
+struct gsm48_system_information_type_2ter {
+	struct gsm48_system_information_type_header header;
+	uint8_t ext_bcch_frequency_list[16];
+	uint8_t rest_octets[0];
+} __attribute__ ((packed));
+
+/* Section 9.1.35 System information Type 3 */
+struct gsm48_system_information_type_3 {
+	struct gsm48_system_information_type_header header;
+	uint16_t cell_identity;
+	struct gsm48_loc_area_id lai;
+	struct gsm48_control_channel_descr control_channel_desc;
+	struct gsm48_cell_options cell_options;
+	struct gsm48_cell_sel_par cell_sel_par;
+	struct gsm48_rach_control rach_control;
+	uint8_t rest_octets[0];
+} __attribute__ ((packed));
+
+/* Section 9.1.36 System information Type 4 */
+struct gsm48_system_information_type_4 {
+	struct gsm48_system_information_type_header header;
+	struct gsm48_loc_area_id lai;
+	struct gsm48_cell_sel_par cell_sel_par;
+	struct gsm48_rach_control rach_control;
+	/*	optional CBCH conditional CBCH... followed by
+		mandantory SI 4 Reset Octets
+	 */
+	uint8_t data[0];
+} __attribute__ ((packed));
+
+/* Section 9.1.37 System information Type 5 */
+struct gsm48_system_information_type_5 {
+	uint8_t rr_protocol_discriminator :4,
+		skip_indicator:4; 
+	uint8_t system_information;
+	uint8_t bcch_frequency_list[16];
+} __attribute__ ((packed));
+
+/* Section 9.1.38 System information Type 5bis */
+struct gsm48_system_information_type_5bis {
+        uint8_t rr_protocol_discriminator :4,
+		 skip_indicator:4;
+	uint8_t system_information;
+	uint8_t bcch_frequency_list[16];
+} __attribute__ ((packed));
+
+/* Section 9.1.39 System information Type 5ter */
+struct gsm48_system_information_type_5ter {
+        uint8_t rr_protocol_discriminator :4,
+		 skip_indicator:4;
+	uint8_t system_information;
+	uint8_t bcch_frequency_list[16];
+} __attribute__ ((packed));
+
+/* Section 9.1.40 System information Type 6 */
+struct gsm48_system_information_type_6 {
+	uint8_t rr_protocol_discriminator :4,
+		skip_indicator:4; 
+	uint8_t system_information;
+	uint16_t cell_identity;
+	struct gsm48_loc_area_id lai;
+	struct gsm48_cell_options cell_options;
+	uint8_t ncc_permitted;
+	uint8_t rest_octets[0];
+} __attribute__ ((packed));
+
+/* Section 9.1.43a System Information type 13 */
+struct gsm48_system_information_type_13 {
+	struct gsm48_system_information_type_header header;
+	uint8_t rest_octets[0];
+} __attribute__ ((packed));
+
+/* Section 9.2.12 IMSI Detach Indication */
+struct gsm48_imsi_detach_ind {
+	struct gsm48_classmark1 classmark1;
+	uint8_t mi_len;
+	uint8_t mi[0];
+} __attribute__ ((packed));
+
+/* Section 9.1.1 */
+struct gsm48_add_ass {
+	/* Semantic is from 10.5.2.5 */
+	struct gsm48_chan_desc chan_desc;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* Section 9.1.3 */
+struct gsm48_ass_cpl {
+	uint8_t rr_cause;
+} __attribute__((packed));
+
+/* Section 9.1.4 */
+struct gsm48_ass_fail {
+	uint8_t rr_cause;
+} __attribute__((packed));
+
+/* Section 9.1.3 */
+struct gsm48_ho_cpl {
+	uint8_t rr_cause;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* Section 9.1.4 */
+struct gsm48_ho_fail {
+	uint8_t rr_cause;
+} __attribute__((packed));
+
+/* Section 9.1.7 */
+struct gsm48_chan_rel {
+	uint8_t rr_cause;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* Section 9.1.9 */
+struct gsm48_cip_mode_cmd {
+	uint8_t sc:1,
+		 alg_id:3,
+		 cr:1,
+		 spare:3;
+} __attribute__((packed));
+
+/* Section 9.1.11 */
+struct gsm48_cm_change {
+	uint8_t cm2_len;
+	struct gsm48_classmark2 cm2;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* Section 9.1.19 */
+struct gsm48_imm_ass_ext {
+	uint8_t l2_plen;
+	uint8_t proto_discr;
+	uint8_t msg_type;
+	uint8_t page_mode;
+	struct gsm48_chan_desc chan_desc1;
+	struct gsm48_req_ref req_ref1;
+	uint8_t timing_advance1;
+	struct gsm48_chan_desc chan_desc2;
+	struct gsm48_req_ref req_ref2;
+	uint8_t timing_advance2;
+	uint8_t mob_alloc_len;
+	uint8_t mob_alloc[0];
+} __attribute__ ((packed));
+
+/* Section 9.1.20 */
+struct gsm48_imm_ass_rej {
+	uint8_t l2_plen;
+	uint8_t proto_discr;
+	uint8_t msg_type;
+	uint8_t page_mode;
+	struct gsm48_req_ref req_ref1;
+	uint8_t wait_ind1;
+	struct gsm48_req_ref req_ref2;
+	uint8_t wait_ind2;
+	struct gsm48_req_ref req_ref3;
+	uint8_t wait_ind3;
+	struct gsm48_req_ref req_ref4;
+	uint8_t wait_ind4;
+	uint8_t rest[0];
+} __attribute__ ((packed));
+
+/* Section 9.1.22 */
+struct gsm48_paging1 {
+	uint8_t l2_plen;
+	uint8_t proto_discr;
+	uint8_t msg_type;
+	uint8_t pag_mode:2,
+		 spare:2,
+		 cneed1:2,
+		 cneed2:2;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* Section 9.1.23 */
+struct gsm48_paging2 {
+	uint8_t l2_plen;
+	uint8_t proto_discr;
+	uint8_t msg_type;
+	uint8_t pag_mode:2,
+		 spare:2,
+		 cneed1:2,
+		 cneed2:2;
+	uint32_t tmsi1;
+	uint32_t tmsi2;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* Section 9.1.24 */
+struct gsm48_paging3 {
+	uint8_t l2_plen;
+	uint8_t proto_discr;
+	uint8_t msg_type;
+	uint8_t pag_mode:2,
+		 spare:2,
+		 cneed1:2,
+		 cneed2:2;
+	uint32_t tmsi1;
+	uint32_t tmsi2;
+	uint32_t tmsi3;
+	uint32_t tmsi4;
+	uint8_t cneed3:2,
+		 cneed4:2,
+		 spare2:4;
+	uint8_t rest[0];
+} __attribute__((packed));
+
+/* Section 9.1.25 */
+struct gsm48_pag_rsp {
+	uint8_t key_seq:3,
+		 spare:5;
+	uint8_t cm2_len;
+	struct gsm48_classmark2 cm2;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* Section 9.1.29 */
+struct gsm48_rr_status {
+	uint8_t rr_cause;
+} __attribute__((packed));
+
+/* Section 10.2 + GSM 04.07 12.2.3.1.1 */
+#define GSM48_PDISC_GROUP_CC	0x00
+#define GSM48_PDISC_BCAST_CC	0x01
+#define GSM48_PDISC_PDSS1	0x02
+#define GSM48_PDISC_CC		0x03
+#define GSM48_PDISC_PDSS2	0x04
+#define GSM48_PDISC_MM		0x05
+#define GSM48_PDISC_RR		0x06
+#define GSM48_PDISC_MM_GPRS	0x08
+#define GSM48_PDISC_SMS		0x09
+#define GSM48_PDISC_SM_GPRS	0x0a
+#define GSM48_PDISC_NC_SS	0x0b
+#define GSM48_PDISC_LOC		0x0c
+#define GSM48_PDISC_MASK	0x0f
+#define GSM48_PDISC_USSD	0x11
+
+/* Section 10.4 */
+#define GSM48_MT_RR_INIT_REQ		0x3c
+#define GSM48_MT_RR_ADD_ASS		0x3b
+#define GSM48_MT_RR_IMM_ASS		0x3f
+#define GSM48_MT_RR_IMM_ASS_EXT		0x39
+#define GSM48_MT_RR_IMM_ASS_REJ		0x3a
+
+#define GSM48_MT_RR_CIPH_M_CMD		0x35
+#define GSM48_MT_RR_CIPH_M_COMPL	0x32
+
+#define GSM48_MT_RR_CFG_CHG_CMD		0x30
+#define GSM48_MT_RR_CFG_CHG_ACK		0x31
+#define GSM48_MT_RR_CFG_CHG_REJ		0x33
+
+#define GSM48_MT_RR_ASS_CMD		0x2e
+#define GSM48_MT_RR_ASS_COMPL		0x29
+#define GSM48_MT_RR_ASS_FAIL		0x2f
+#define GSM48_MT_RR_HANDO_CMD		0x2b
+#define GSM48_MT_RR_HANDO_COMPL		0x2c
+#define GSM48_MT_RR_HANDO_FAIL		0x28
+#define GSM48_MT_RR_HANDO_INFO		0x2d
+
+#define GSM48_MT_RR_CELL_CHG_ORDER	0x08
+#define GSM48_MT_RR_PDCH_ASS_CMD	0x23
+
+#define GSM48_MT_RR_CHAN_REL		0x0d
+#define GSM48_MT_RR_PART_REL		0x0a
+#define GSM48_MT_RR_PART_REL_COMP	0x0f
+
+#define GSM48_MT_RR_PAG_REQ_1		0x21
+#define GSM48_MT_RR_PAG_REQ_2		0x22
+#define GSM48_MT_RR_PAG_REQ_3		0x24
+#define GSM48_MT_RR_PAG_RESP		0x27
+#define GSM48_MT_RR_NOTIF_NCH		0x20
+#define GSM48_MT_RR_NOTIF_FACCH		0x25
+#define GSM48_MT_RR_NOTIF_RESP		0x26
+
+#define GSM48_MT_RR_SYSINFO_8		0x18
+#define GSM48_MT_RR_SYSINFO_1		0x19
+#define GSM48_MT_RR_SYSINFO_2		0x1a
+#define GSM48_MT_RR_SYSINFO_3		0x1b
+#define GSM48_MT_RR_SYSINFO_4		0x1c
+#define GSM48_MT_RR_SYSINFO_5		0x1d
+#define GSM48_MT_RR_SYSINFO_6		0x1e
+#define GSM48_MT_RR_SYSINFO_7		0x1f
+
+#define GSM48_MT_RR_SYSINFO_2bis	0x02
+#define GSM48_MT_RR_SYSINFO_2ter	0x03
+#define GSM48_MT_RR_SYSINFO_5bis	0x05
+#define GSM48_MT_RR_SYSINFO_5ter	0x06
+#define GSM48_MT_RR_SYSINFO_9		0x04
+#define GSM48_MT_RR_SYSINFO_13		0x00
+
+#define GSM48_MT_RR_SYSINFO_16		0x3d
+#define GSM48_MT_RR_SYSINFO_17		0x3e
+
+#define GSM48_MT_RR_CHAN_MODE_MODIF	0x10
+#define GSM48_MT_RR_STATUS		0x12
+#define GSM48_MT_RR_CHAN_MODE_MODIF_ACK	0x17
+#define GSM48_MT_RR_FREQ_REDEF		0x14
+#define GSM48_MT_RR_MEAS_REP		0x15
+#define GSM48_MT_RR_CLSM_CHG		0x16
+#define GSM48_MT_RR_CLSM_ENQ		0x13
+#define GSM48_MT_RR_EXT_MEAS_REP	0x36
+#define GSM48_MT_RR_EXT_MEAS_REP_ORD	0x37
+#define GSM48_MT_RR_GPRS_SUSP_REQ	0x34
+
+#define GSM48_MT_RR_VGCS_UPL_GRANT	0x08
+#define GSM48_MT_RR_UPLINK_RELEASE	0x0e
+#define GSM48_MT_RR_UPLINK_FREE		0x0c
+#define GSM48_MT_RR_UPLINK_BUSY		0x2a
+#define GSM48_MT_RR_TALKER_IND		0x11
+
+#define GSM48_MT_RR_APP_INFO		0x38
+
+/* Table 10.2/3GPP TS 04.08 */
+#define GSM48_MT_MM_IMSI_DETACH_IND	0x01
+#define GSM48_MT_MM_LOC_UPD_ACCEPT	0x02
+#define GSM48_MT_MM_LOC_UPD_REJECT	0x04
+#define GSM48_MT_MM_LOC_UPD_REQUEST	0x08
+
+#define GSM48_MT_MM_AUTH_REJ		0x11
+#define GSM48_MT_MM_AUTH_REQ		0x12
+#define GSM48_MT_MM_AUTH_RESP		0x14
+#define GSM48_MT_MM_ID_REQ		0x18
+#define GSM48_MT_MM_ID_RESP		0x19
+#define GSM48_MT_MM_TMSI_REALL_CMD	0x1a
+#define GSM48_MT_MM_TMSI_REALL_COMPL	0x1b
+
+#define GSM48_MT_MM_CM_SERV_ACC		0x21
+#define GSM48_MT_MM_CM_SERV_REJ		0x22
+#define GSM48_MT_MM_CM_SERV_ABORT	0x23
+#define GSM48_MT_MM_CM_SERV_REQ		0x24
+#define GSM48_MT_MM_CM_SERV_PROMPT	0x25
+#define GSM48_MT_MM_CM_REEST_REQ	0x28
+#define GSM48_MT_MM_ABORT		0x29
+
+#define GSM48_MT_MM_NULL		0x30
+#define GSM48_MT_MM_STATUS		0x31
+#define GSM48_MT_MM_INFO		0x32
+
+/* Table 10.3/3GPP TS 04.08 */
+#define GSM48_MT_CC_ALERTING		0x01
+#define GSM48_MT_CC_CALL_CONF		0x08
+#define GSM48_MT_CC_CALL_PROC		0x02
+#define GSM48_MT_CC_CONNECT		0x07
+#define GSM48_MT_CC_CONNECT_ACK		0x0f
+#define GSM48_MT_CC_EMERG_SETUP		0x0e
+#define GSM48_MT_CC_PROGRESS		0x03
+#define GSM48_MT_CC_ESTAB		0x04
+#define GSM48_MT_CC_ESTAB_CONF		0x06
+#define GSM48_MT_CC_RECALL		0x0b
+#define GSM48_MT_CC_START_CC		0x09
+#define GSM48_MT_CC_SETUP		0x05
+
+#define GSM48_MT_CC_MODIFY		0x17
+#define GSM48_MT_CC_MODIFY_COMPL	0x1f
+#define GSM48_MT_CC_MODIFY_REJECT	0x13
+#define GSM48_MT_CC_USER_INFO		0x10
+#define GSM48_MT_CC_HOLD		0x18
+#define GSM48_MT_CC_HOLD_ACK		0x19
+#define GSM48_MT_CC_HOLD_REJ		0x1a
+#define GSM48_MT_CC_RETR		0x1c
+#define GSM48_MT_CC_RETR_ACK		0x1d
+#define GSM48_MT_CC_RETR_REJ		0x1e
+
+#define GSM48_MT_CC_DISCONNECT		0x25
+#define GSM48_MT_CC_RELEASE		0x2d
+#define GSM48_MT_CC_RELEASE_COMPL	0x2a
+
+#define GSM48_MT_CC_CONG_CTRL		0x39
+#define GSM48_MT_CC_NOTIFY		0x3e
+#define GSM48_MT_CC_STATUS		0x3d
+#define GSM48_MT_CC_STATUS_ENQ		0x34
+#define GSM48_MT_CC_START_DTMF		0x35
+#define GSM48_MT_CC_STOP_DTMF		0x31
+#define GSM48_MT_CC_STOP_DTMF_ACK	0x32
+#define GSM48_MT_CC_START_DTMF_ACK	0x36
+#define GSM48_MT_CC_START_DTMF_REJ	0x37
+#define GSM48_MT_CC_FACILITY		0x3a
+
+/* FIXME: Table 10.4 / 10.4a (GPRS) */
+
+/* Section 10.5.3.3 CM service type */
+#define GSM48_CMSERV_MO_CALL_PACKET	1
+#define GSM48_CMSERV_EMERGENCY		2
+#define GSM48_CMSERV_SMS		4
+#define GSM48_CMSERV_SUP_SERV		8
+#define GSM48_CMSERV_VGCS		9
+#define GSM48_CMSERV_VBS		10
+#define GSM48_CMSERV_LOC_SERV		11
+
+/* Section 10.5.2.26, Table 10.5.64 */
+#define GSM48_PM_MASK		0x03
+#define GSM48_PM_NORMAL		0x00
+#define GSM48_PM_EXTENDED	0x01
+#define GSM48_PM_REORG		0x02
+#define GSM48_PM_SAME		0x03
+
+/* Chapter 10.5.3.5 / Table 10.5.93 */
+#define GSM48_LUPD_NORMAL	0x0
+#define GSM48_LUPD_PERIODIC	0x1
+#define GSM48_LUPD_IMSI_ATT	0x2
+#define GSM48_LUPD_RESERVED	0x3
+
+/* Table 10.5.4 */
+#define GSM_MI_TYPE_MASK	0x07
+#define GSM_MI_TYPE_NONE	0x00
+#define GSM_MI_TYPE_IMSI	0x01
+#define GSM_MI_TYPE_IMEI	0x02
+#define GSM_MI_TYPE_IMEISV	0x03
+#define GSM_MI_TYPE_TMSI	0x04
+#define GSM_MI_ODD		0x08
+
+#define GSM48_IE_MOBILE_ID	0x17	/* 10.5.1.4 */
+#define GSM48_IE_NAME_LONG	0x43	/* 10.5.3.5a */
+#define GSM48_IE_NAME_SHORT	0x45	/* 10.5.3.5a */
+#define GSM48_IE_UTC		0x46	/* 10.5.3.8 */
+#define GSM48_IE_NET_TIME_TZ	0x47	/* 10.5.3.9 */
+#define GSM48_IE_LSA_IDENT	0x48	/* 10.5.3.11 */
+
+#define GSM48_IE_BEARER_CAP	0x04	/* 10.5.4.5 */
+#define GSM48_IE_CAUSE		0x08	/* 10.5.4.11 */
+#define GSM48_IE_CC_CAP		0x15	/* 10.5.4.5a */
+#define GSM48_IE_ALERT		0x19	/* 10.5.4.26 */
+#define GSM48_IE_FACILITY	0x1c	/* 10.5.4.15 */
+#define GSM48_IE_PROGR_IND	0x1e	/* 10.5.4.21 */
+#define GSM48_IE_AUX_STATUS	0x24	/* 10.5.4.4 */
+#define GSM48_IE_NOTIFY		0x27	/* 10.5.4.20 */
+#define GSM48_IE_KPD_FACILITY	0x2c	/* 10.5.4.17 */
+#define GSM48_IE_SIGNAL		0x34	/* 10.5.4.23 */
+#define GSM48_IE_CONN_BCD	0x4c	/* 10.5.4.13 */
+#define GSM48_IE_CONN_SUB	0x4d	/* 10.5.4.14 */
+#define GSM48_IE_CALLING_BCD	0x5c	/* 10.5.4.9 */
+#define GSM48_IE_CALLING_SUB	0x5d	/* 10.5.4.10 */
+#define GSM48_IE_CALLED_BCD	0x5e	/* 10.5.4.7 */
+#define GSM48_IE_CALLED_SUB	0x6d	/* 10.5.4.8 */
+#define GSM48_IE_REDIR_BCD	0x74	/* 10.5.4.21a */
+#define GSM48_IE_REDIR_SUB	0x75	/* 10.5.4.21b */
+#define GSM48_IE_LOWL_COMPAT	0x7c	/* 10.5.4.18 */
+#define GSM48_IE_HIGHL_COMPAT	0x7d	/* 10.5.4.16 */
+#define GSM48_IE_USER_USER	0x7e	/* 10.5.4.25 */
+#define GSM48_IE_SS_VERS	0x7f	/* 10.5.4.24 */
+#define GSM48_IE_MORE_DATA	0xa0	/* 10.5.4.19 */
+#define GSM48_IE_CLIR_SUPP	0xa1	/* 10.5.4.11a */
+#define GSM48_IE_CLIR_INVOC	0xa2	/* 10.5.4.11b */
+#define GSM48_IE_REV_C_SETUP	0xa3	/* 10.5.4.22a */
+#define GSM48_IE_REPEAT_CIR	0xd1	/* 10.5.4.22 */
+#define GSM48_IE_REPEAT_SEQ	0xd3	/* 10.5.4.22 */
+
+/* Section 10.5.4.11 / Table 10.5.122 */
+#define GSM48_CAUSE_CS_GSM	0x60
+
+/* Section 9.1.2 / Table 9.3 */
+/* RR elements */
+#define GSM48_IE_VGCS_TARGET	0x01
+//#define GSM48_IE_VGCS_T_MODE_I	0x01
+#define GSM48_IE_FRQSHORT_AFTER	0x02
+#define GSM48_IE_MUL_RATE_CFG	0x03	/* 10.5.2.21aa */
+#define GSM48_IE_FREQ_L_AFTER	0x05
+#define GSM48_IE_MSLOT_DESC	0x10
+#define GSM48_IE_CHANMODE_2	0x11
+#define GSM48_IE_FRQSHORT_BEFORE 0x12
+//#define GSM48_IE_FRQSHORT_BEFOR 0x12
+#define GSM48_IE_CHANMODE_3	0x13
+#define GSM48_IE_CHANMODE_4	0x14
+#define GSM48_IE_CHANMODE_5	0x15
+#define GSM48_IE_CHANMODE_6	0x16
+#define GSM48_IE_CHANMODE_7	0x17
+#define GSM48_IE_CHANMODE_8	0x18
+#define GSM48_IE_CHANDESC_2	0x64
+#define GSM48_IE_MA_AFTER	0x72
+#define GSM48_IE_START_TIME	0x7c
+#define GSM48_IE_FREQ_L_BEFORE	0x19
+//#define GSM48_IE_FRQLIST_BEFORE	0x19
+#define GSM48_IE_CH_DESC_1_BEFORE	0x1c
+//#define GSM48_IE_CHDES_1_BEFORE 0x1c
+#define GSM48_IE_CH_DESC_2_BEFORE	0x1d
+//#define GSM48_IE_CHDES_2_BEFORE	0x1d
+#define GSM48_IE_F_CH_SEQ_BEFORE	0x1e
+//#define GSM48_IE_FRQSEQ_BEFORE	0x1e
+#define GSM48_IE_CLASSMARK3	0x20
+#define GSM48_IE_MA_BEFORE	0x21
+#define GSM48_IE_RR_PACKET_UL	0x22
+#define GSM48_IE_RR_PACKET_DL	0x23
+#define GSM48_IE_CELL_CH_DESC	0x62
+#define GSM48_IE_CHANMODE_1	0x63
+#define GSM48_IE_CHDES_2_AFTER	0x64
+#define GSM48_IE_MODE_SEC_CH	0x66
+#define GSM48_IE_F_CH_SEQ_AFTER	0x69
+#define GSM48_IE_MA_AFTER	0x72
+#define GSM48_IE_BA_RANGE	0x73
+#define GSM48_IE_GROUP_CHDES	0x74
+#define GSM48_IE_BA_LIST_PREF	0x75
+#define GSM48_IE_MOB_OVSERV_DIF	0x77
+#define GSM48_IE_REALTIME_DIFF	0x7b
+#define GSM48_IE_START_TIME	0x7c
+#define GSM48_IE_TIMING_ADVANCE	0x7d
+#define GSM48_IE_GROUP_CIP_SEQ	0x80
+#define GSM48_IE_CIP_MODE_SET	0x90
+#define GSM48_IE_GPRS_RESUMPT	0xc0
+#define GSM48_IE_SYNC_IND	0xd0
+/* System Information 4 (types are equal IEs above) */
+#define GSM48_IE_CBCH_CHAN_DESC	0x64
+#define GSM48_IE_CBCH_MOB_AL	0x72
+
+/* Additional MM elements */
+#define GSM48_IE_LOCATION_AREA	0x13
+#define GSM48_IE_PRIORITY_LEV	0x80
+#define GSM48_IE_FOLLOW_ON_PROC	0xa1
+#define GSM48_IE_CTS_PERMISSION	0xa2
+
+/* Section 10.5.4.23 / Table 10.5.130 */
+enum gsm48_signal_val {
+	GSM48_SIGNAL_DIALTONE	= 0x00,
+	GSM48_SIGNAL_RINGBACK	= 0x01,
+	GSM48_SIGNAL_INTERCEPT	= 0x02,
+	GSM48_SIGNAL_NET_CONG	= 0x03,
+	GSM48_SIGNAL_BUSY	= 0x04,
+	GSM48_SIGNAL_CONFIRM	= 0x05,
+	GSM48_SIGNAL_ANSWER	= 0x06,
+	GSM48_SIGNAL_CALL_WAIT	= 0x07,
+	GSM48_SIGNAL_OFF_HOOK	= 0x08,
+	GSM48_SIGNAL_OFF	= 0x3f,
+	GSM48_SIGNAL_ALERT_OFF	= 0x4f,
+};
+
+enum gsm48_cause_loc {
+	GSM48_CAUSE_LOC_USER		= 0x00,
+	GSM48_CAUSE_LOC_PRN_S_LU	= 0x01,
+	GSM48_CAUSE_LOC_PUN_S_LU	= 0x02,
+	GSM48_CAUSE_LOC_TRANS_NET	= 0x03,
+	GSM48_CAUSE_LOC_PUN_S_RU	= 0x04,
+	GSM48_CAUSE_LOC_PRN_S_RU	= 0x05,
+	/* not defined */
+	GSM48_CAUSE_LOC_INN_NET		= 0x07,
+	GSM48_CAUSE_LOC_NET_BEYOND	= 0x0a,
+};
+
+/* Section 10.5.2.31 RR Cause / Table 10.5.70 */
+enum gsm48_rr_cause {
+	GSM48_RR_CAUSE_NORMAL		= 0x00,
+	GSM48_RR_CAUSE_ABNORMAL_UNSPEC	= 0x01,
+	GSM48_RR_CAUSE_ABNORMAL_UNACCT	= 0x02,
+	GSM48_RR_CAUSE_ABNORMAL_TIMER	= 0x03,
+	GSM48_RR_CAUSE_ABNORMAL_NOACT	= 0x04,
+	GSM48_RR_CAUSE_PREMPTIVE_REL	= 0x05,
+	GSM48_RR_CAUSE_HNDOVER_IMP	= 0x06,
+	GSM48_RR_CAUSE_CHAN_MODE_UNACCT	= 0x07,
+	GSM48_RR_CAUSE_FREQ_NOT_IMPL	= 0x08,
+	GSM48_RR_CAUSE_CALL_CLEARED	= 0x41,
+	GSM48_RR_CAUSE_SEMANT_INCORR	= 0x5f,
+	GSM48_RR_CAUSE_INVALID_MAND_INF = 0x60,
+	GSM48_RR_CAUSE_MSG_TYPE_N	= 0x61,
+	GSM48_RR_CAUSE_MSG_TYPE_N_COMPAT= 0x62,
+	GSM48_RR_CAUSE_COND_IE_ERROR	= 0x64,
+	GSM48_RR_CAUSE_NO_CELL_ALLOC_A	= 0x65,
+	GSM48_RR_CAUSE_PROT_ERROR_UNSPC = 0x6f,
+};
+
+/* Section 10.5.4.11 CC Cause / Table 10.5.123 */
+enum gsm48_cc_cause {
+	GSM48_CC_CAUSE_UNASSIGNED_NR	= 1,
+	GSM48_CC_CAUSE_NO_ROUTE		= 3,
+	GSM48_CC_CAUSE_CHAN_UNACCEPT	= 6,
+	GSM48_CC_CAUSE_OP_DET_BARRING	= 8,
+	GSM48_CC_CAUSE_NORM_CALL_CLEAR	= 16,
+	GSM48_CC_CAUSE_USER_BUSY	= 17,
+	GSM48_CC_CAUSE_USER_NOTRESPOND	= 18,
+	GSM48_CC_CAUSE_USER_ALERTING_NA	= 19,
+	GSM48_CC_CAUSE_CALL_REJECTED	= 21,
+	GSM48_CC_CAUSE_NUMBER_CHANGED	= 22,
+	GSM48_CC_CAUSE_PRE_EMPTION	= 25,
+	GSM48_CC_CAUSE_NONSE_USER_CLR	= 26,
+	GSM48_CC_CAUSE_DEST_OOO		= 27,
+	GSM48_CC_CAUSE_INV_NR_FORMAT	= 28,
+	GSM48_CC_CAUSE_FACILITY_REJ	= 29,
+	GSM48_CC_CAUSE_RESP_STATUS_INQ	= 30,
+	GSM48_CC_CAUSE_NORMAL_UNSPEC	= 31,
+	GSM48_CC_CAUSE_NO_CIRCUIT_CHAN	= 34,
+	GSM48_CC_CAUSE_NETWORK_OOO	= 38,
+	GSM48_CC_CAUSE_TEMP_FAILURE	= 41,
+	GSM48_CC_CAUSE_SWITCH_CONG	= 42,
+	GSM48_CC_CAUSE_ACC_INF_DISCARD	= 43,
+	GSM48_CC_CAUSE_REQ_CHAN_UNAVAIL	= 44,
+	GSM48_CC_CAUSE_RESOURCE_UNAVAIL	= 47,
+	GSM48_CC_CAUSE_QOS_UNAVAIL	= 49,
+	GSM48_CC_CAUSE_REQ_FAC_NOT_SUBSC= 50,
+	GSM48_CC_CAUSE_INC_BARRED_CUG	= 55,
+	GSM48_CC_CAUSE_BEARER_CAP_UNAUTH= 57,
+	GSM48_CC_CAUSE_BEARER_CA_UNAVAIL= 58,
+	GSM48_CC_CAUSE_SERV_OPT_UNAVAIL	= 63,
+	GSM48_CC_CAUSE_BEARERSERV_UNIMPL= 65,
+	GSM48_CC_CAUSE_ACM_GE_ACM_MAX	= 68,
+	GSM48_CC_CAUSE_REQ_FAC_NOTIMPL	= 69,
+	GSM48_CC_CAUSE_RESTR_BCAP_AVAIL	= 70,
+	GSM48_CC_CAUSE_SERV_OPT_UNIMPL	= 79,
+	GSM48_CC_CAUSE_INVAL_TRANS_ID	= 81,
+	GSM48_CC_CAUSE_USER_NOT_IN_CUG	= 87,
+	GSM48_CC_CAUSE_INCOMPAT_DEST	= 88,
+	GSM48_CC_CAUSE_INVAL_TRANS_NET	= 91,
+	GSM48_CC_CAUSE_SEMANTIC_INCORR	= 95,
+	GSM48_CC_CAUSE_INVAL_MAND_INF	= 96,
+	GSM48_CC_CAUSE_MSGTYPE_NOTEXIST	= 97,
+	GSM48_CC_CAUSE_MSGTYPE_INCOMPAT	= 98,
+	GSM48_CC_CAUSE_IE_NOTEXIST	= 99,
+	GSM48_CC_CAUSE_COND_IE_ERR	= 100,
+	GSM48_CC_CAUSE_MSG_INCOMP_STATE	= 101,
+	GSM48_CC_CAUSE_RECOVERY_TIMER	= 102,
+	GSM48_CC_CAUSE_PROTO_ERR	= 111,
+	GSM48_CC_CAUSE_INTERWORKING	= 127,
+};
+
+/* Annex G, GSM specific cause values for mobility management */
+enum gsm48_reject_value {
+	GSM48_REJECT_IMSI_UNKNOWN_IN_HLR	= 2,
+	GSM48_REJECT_ILLEGAL_MS			= 3,
+	GSM48_REJECT_IMSI_UNKNOWN_IN_VLR	= 4,
+	GSM48_REJECT_IMEI_NOT_ACCEPTED		= 5,
+	GSM48_REJECT_ILLEGAL_ME			= 6,
+	GSM48_REJECT_PLMN_NOT_ALLOWED		= 11,
+	GSM48_REJECT_LOC_NOT_ALLOWED		= 12,
+	GSM48_REJECT_ROAMING_NOT_ALLOWED	= 13,
+	GSM48_REJECT_NETWORK_FAILURE		= 17,
+	GSM48_REJECT_CONGESTION			= 22,
+	GSM48_REJECT_SRV_OPT_NOT_SUPPORTED	= 32,
+	GSM48_REJECT_RQD_SRV_OPT_NOT_SUPPORTED	= 33,
+	GSM48_REJECT_SRV_OPT_TMP_OUT_OF_ORDER	= 34,
+	GSM48_REJECT_CALL_CAN_NOT_BE_IDENTIFIED	= 38,
+	GSM48_REJECT_INCORRECT_MESSAGE		= 95,
+	GSM48_REJECT_INVALID_MANDANTORY_INF	= 96,
+	GSM48_REJECT_MSG_TYPE_NOT_IMPLEMENTED	= 97,
+	GSM48_REJECT_MSG_TYPE_NOT_COMPATIBLE	= 98,
+	GSM48_REJECT_INF_ELEME_NOT_IMPLEMENTED	= 99,
+	GSM48_REJECT_CONDTIONAL_IE_ERROR	= 100,
+	GSM48_REJECT_MSG_NOT_COMPATIBLE		= 101,
+	GSM48_REJECT_PROTOCOL_ERROR		= 111,
+
+	/* according to G.6 Additional cause codes for GMM */
+	GSM48_REJECT_GPRS_NOT_ALLOWED		= 7,
+	GSM48_REJECT_SERVICES_NOT_ALLOWED	= 8,
+	GSM48_REJECT_MS_IDENTITY_NOT_DERVIVABLE = 9,
+	GSM48_REJECT_IMPLICITLY_DETACHED	= 10,
+	GSM48_REJECT_GPRS_NOT_ALLOWED_IN_PLMN	= 14,
+	GSM48_REJECT_MSC_TMP_NOT_REACHABLE	= 16,
+};
+
+enum chreq_type {
+	CHREQ_T_EMERG_CALL,
+	CHREQ_T_CALL_REEST_TCH_F,
+	CHREQ_T_CALL_REEST_TCH_H,
+	CHREQ_T_CALL_REEST_TCH_H_DBL,
+	CHREQ_T_SDCCH,
+	CHREQ_T_TCH_F,
+	CHREQ_T_VOICE_CALL_TCH_H,
+	CHREQ_T_DATA_CALL_TCH_H,
+	CHREQ_T_LOCATION_UPD,
+	CHREQ_T_PAG_R_ANY_NECI0,
+	CHREQ_T_PAG_R_ANY_NECI1,
+	CHREQ_T_PAG_R_TCH_F,
+	CHREQ_T_PAG_R_TCH_FH,
+	CHREQ_T_LMU,
+	CHREQ_T_RESERVED_SDCCH,
+	CHREQ_T_RESERVED_IGNORE,
+};
+
+/* Chapter 11.3 */
+#define GSM48_T301	180, 0
+#define GSM48_T303	30, 0
+#define GSM48_T305	30, 0
+#define GSM48_T306	30, 0
+#define GSM48_T308	10, 0
+#define GSM48_T310	180, 0
+#define GSM48_T313	30, 0
+#define GSM48_T323	30, 0
+#define GSM48_T331	30, 0
+#define GSM48_T333	30, 0
+#define GSM48_T334	25, 0 /* min 15 */
+#define GSM48_T338	30, 0
+#define GSM48_T303_MS	30, 0
+#define GSM48_T305_MS	30, 0
+#define GSM48_T308_MS	30, 0
+#define GSM48_T310_MS	30, 0
+#define GSM48_T313_MS	30, 0
+#define GSM48_T323_MS	30, 0
+#define GSM48_T332_MS	30, 0
+#define GSM48_T335_MS	30, 0
+
+/* Chapter 5.1.2.2 */
+#define	GSM_CSTATE_NULL			0
+#define	GSM_CSTATE_INITIATED		1
+#define	GSM_CSTATE_MM_CONNECTION_PEND	2 /* see 10.5.4.6 */
+#define	GSM_CSTATE_MO_CALL_PROC		3
+#define	GSM_CSTATE_CALL_DELIVERED	4
+#define	GSM_CSTATE_CALL_PRESENT		6
+#define	GSM_CSTATE_CALL_RECEIVED	7
+#define	GSM_CSTATE_CONNECT_REQUEST	8
+#define	GSM_CSTATE_MO_TERM_CALL_CONF	9
+#define	GSM_CSTATE_ACTIVE		10
+#define	GSM_CSTATE_DISCONNECT_REQ	12
+#define	GSM_CSTATE_DISCONNECT_IND	12
+#define	GSM_CSTATE_RELEASE_REQ		19
+#define	GSM_CSTATE_MO_ORIG_MODIFY	26
+#define	GSM_CSTATE_MO_TERM_MODIFY	27
+#define	GSM_CSTATE_CONNECT_IND		28
+
+#define SBIT(a) (1 << a)
+#define ALL_STATES 0xffffffff
+
+/* Table 10.5.3/3GPP TS 04.08: Location Area Identification information element */
+#define GSM_LAC_RESERVED_DETACHED       0x0
+#define GSM_LAC_RESERVED_ALL_BTS        0xfffe
+
+/* GSM 04.08 Bearer Capability: Information Transfer Capability */
+enum gsm48_bcap_itcap {
+	GSM48_BCAP_ITCAP_SPEECH		= 0,
+	GSM48_BCAP_ITCAP_UNR_DIG_INF	= 1,
+	GSM48_BCAP_ITCAP_3k1_AUDIO	= 2,
+	GSM48_BCAP_ITCAP_FAX_G3		= 3,
+	GSM48_BCAP_ITCAP_OTHER		= 5,
+	GSM48_BCAP_ITCAP_RESERVED	= 7,
+};
+
+/* GSM 04.08 Bearer Capability: Transfer Mode */
+enum gsm48_bcap_tmod {
+	GSM48_BCAP_TMOD_CIRCUIT		= 0,
+	GSM48_BCAP_TMOD_PACKET		= 1,
+};
+
+/* GSM 04.08 Bearer Capability: Coding Standard */
+enum gsm48_bcap_coding {
+	GSM48_BCAP_CODING_GSM_STD	= 0,
+};
+
+/* GSM 04.08 Bearer Capability: Radio Channel Requirements */
+enum gsm48_bcap_rrq {
+	GSM48_BCAP_RRQ_FR_ONLY	= 1,
+	GSM48_BCAP_RRQ_DUAL_HR	= 2,
+	GSM48_BCAP_RRQ_DUAL_FR	= 3,
+};
+
+/* GSM 04.08 Bearer Capability: Rate Adaption */
+enum gsm48_bcap_ra {
+	GSM48_BCAP_RA_NONE	= 0,
+	GSM48_BCAP_RA_V110_X30	= 1,
+	GSM48_BCAP_RA_X31	= 2,
+	GSM48_BCAP_RA_OTHER	= 3,
+};
+
+/* GSM 04.08 Bearer Capability: Signalling access protocol */
+enum gsm48_bcap_sig_access {
+	GSM48_BCAP_SA_I440_I450	= 1,
+	GSM48_BCAP_SA_X21	= 2,
+	GSM48_BCAP_SA_X28_DP_IN	= 3,
+	GSM48_BCAP_SA_X28_DP_UN	= 4,
+	GSM48_BCAP_SA_X28_NDP	= 5,
+	GSM48_BCAP_SA_X32	= 6,
+};
+
+/* GSM 04.08 Bearer Capability: User Rate */
+enum gsm48_bcap_user_rate {
+	GSM48_BCAP_UR_300	= 1,
+	GSM48_BCAP_UR_1200	= 2,
+	GSM48_BCAP_UR_2400	= 3,
+	GSM48_BCAP_UR_4800	= 4,
+	GSM48_BCAP_UR_9600	= 5,
+	GSM48_BCAP_UR_12000	= 6,
+	GSM48_BCAP_UR_1200_75	= 7,
+};
+
+/* GSM 04.08 Bearer Capability: Parity */
+enum gsm48_bcap_parity {
+	GSM48_BCAP_PAR_ODD	= 0,
+	GSM48_BCAP_PAR_EVEN	= 2,
+	GSM48_BCAP_PAR_NONE	= 3,
+	GSM48_BCAP_PAR_ZERO	= 4,
+	GSM48_BCAP_PAR_ONE	= 5,
+};
+
+/* GSM 04.08 Bearer Capability: Intermediate Rate */
+enum gsm48_bcap_interm_rate {
+	GSM48_BCAP_IR_8k	= 2,
+	GSM48_BCAP_IR_16k	= 3,
+};
+
+/* GSM 04.08 Bearer Capability: Transparency */
+enum gsm48_bcap_transp {
+	GSM48_BCAP_TR_TRANSP	= 0,
+	GSM48_BCAP_TR_RLP	= 1,
+	GSM48_BCAP_TR_TR_PREF	= 2,
+	GSM48_BCAP_TR_RLP_PREF	= 3,
+};
+
+/* GSM 04.08 Bearer Capability: Modem Type */
+enum gsm48_bcap_modem_type {
+	GSM48_BCAP_MT_NONE	= 0,
+	GSM48_BCAP_MT_V21	= 1,
+	GSM48_BCAP_MT_V22	= 2,
+	GSM48_BCAP_MT_V22bis	= 3,
+	GSM48_BCAP_MT_V23	= 4,
+	GSM48_BCAP_MT_V26ter	= 5,
+	GSM48_BCAP_MT_V32	= 6,
+	GSM48_BCAP_MT_UNDEF	= 7,
+	GSM48_BCAP_MT_AUTO_1	= 8,
+};
+
+/* GSM 04.08 Bearer Capability: Speech Version Indication */
+enum gsm48_bcap_speech_ver {
+	GSM48_BCAP_SV_FR	= 0,
+	GSM48_BCAP_SV_HR	= 1,
+	GSM48_BCAP_SV_EFR	= 2,
+	GSM48_BCAP_SV_AMR_F	= 4,
+	GSM48_BCAP_SV_AMR_H	= 5,
+};
+
+#define GSM48_TMSI_LEN	5
+#define GSM48_MID_TMSI_LEN	(GSM48_TMSI_LEN + 2)
+#define GSM48_MI_SIZE 32
+
+/* Chapter 10.4.4.15 */
+struct gsm48_ra_id {
+	uint8_t digits[3];	/* MCC + MNC BCD digits */
+	uint16_t lac;		/* Location Area Code */
+	uint8_t rac;		/* Routing Area Code */
+} __attribute__ ((packed));
+
+#define GSM48_CELL_CHAN_DESC_SIZE	16
+
+#define GSM_MACBLOCK_LEN	23
+#define GSM_MACBLOCK_PADDING	0x2b
+
+#endif /* PROTO_GSM_04_08_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_11.h b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_11.h
new file mode 100644
index 00000000..f37152fe
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_11.h
@@ -0,0 +1,190 @@
+#ifndef PROTO_GSM_04_11_H
+#define PROTO_GSM_04_11_H
+
+#include <stdint.h>
+
+/* GSM TS 04.11  definitions */
+
+/* Chapter 5.2.3: SMC-CS states at the user/network side */
+enum gsm411_cp_state {
+	GSM411_CPS_IDLE 		= 0,
+	GSM411_CPS_MM_CONN_PENDING	= 1,	/* only MT ! */
+	GSM411_CPS_WAIT_CP_ACK		= 2,
+	GSM411_CPS_MM_ESTABLISHED	= 3,
+};
+
+/* Chapter 6.2.2: SMR states at the user/network side */
+enum gsm411_rp_state {
+	GSM411_RPS_IDLE			= 0,
+	GSM411_RPS_WAIT_FOR_RP_ACK	= 1,
+	GSM411_RPS_WAIT_TO_TX_RP_ACK	= 3,
+	GSM411_RPS_WAIT_FOR_RETRANS_T	= 4,
+};
+
+/* Chapter 8.1.2 (refers to GSM 04.07 Chapter 11.2.3.1.1 */
+#define GSM411_PDISC_SMS	0x09
+
+/* Chapter 8.1.3 */
+#define GSM411_MT_CP_DATA	0x01
+#define GSM411_MT_CP_ACK	0x04
+#define GSM411_MT_CP_ERROR	0x10
+
+enum gsm411_cp_ie {
+	GSM411_CP_IE_USER_DATA		= 0x01,	/* 8.1.4.1 */
+	GSM411_CP_IE_CAUSE		= 0x02,	/* 8.1.4.2. */
+};
+
+/* Section 8.1.4.2 / Table 8.2 */
+enum gsm411_cp_cause {
+	GSM411_CP_CAUSE_NET_FAIL	= 17,
+	GSM411_CP_CAUSE_CONGESTION	= 22,
+	GSM411_CP_CAUSE_INV_TRANS_ID	= 81,
+	GSM411_CP_CAUSE_SEMANT_INC_MSG	= 95,
+	GSM411_CP_CAUSE_INV_MAND_INF	= 96,
+	GSM411_CP_CAUSE_MSGTYPE_NOTEXIST= 97,
+	GSM411_CP_CAUSE_MSG_INCOMP_STATE= 98,
+	GSM411_CP_CAUSE_IE_NOTEXIST	= 99,
+	GSM411_CP_CAUSE_PROTOCOL_ERR	= 111,
+};
+
+/* Chapter 8.2.2 */
+#define GSM411_MT_RP_DATA_MO	0x00
+#define GSM411_MT_RP_DATA_MT	0x01
+#define GSM411_MT_RP_ACK_MO	0x02
+#define GSM411_MT_RP_ACK_MT	0x03
+#define GSM411_MT_RP_ERROR_MO	0x04
+#define GSM411_MT_RP_ERROR_MT	0x05
+#define GSM411_MT_RP_SMMA_MO	0x06
+
+enum gsm411_rp_ie {
+	GSM411_IE_RP_USER_DATA		= 0x41,	/* 8.2.5.3 */
+	GSM411_IE_RP_CAUSE		= 0x42,	/* 8.2.5.4 */
+};
+
+/* Chapter 8.2.5.4 Table 8.4 */
+enum gsm411_rp_cause {
+	/* valid only for MO */
+	GSM411_RP_CAUSE_MO_NUM_UNASSIGNED	= 1,
+	GSM411_RP_CAUSE_MO_OP_DET_BARR		= 8,
+	GSM411_RP_CAUSE_MO_CALL_BARRED		= 10,
+	GSM411_RP_CAUSE_MO_SMS_REJECTED		= 21,
+	GSM411_RP_CAUSE_MO_DEST_OUT_OF_ORDER	= 27,
+	GSM411_RP_CAUSE_MO_UNIDENTIFIED_SUBSCR	= 28,
+	GSM411_RP_CAUSE_MO_FACILITY_REJ		= 29,
+	GSM411_RP_CAUSE_MO_UNKNOWN_SUBSCR	= 30,
+	GSM411_RP_CAUSE_MO_NET_OUT_OF_ORDER	= 38,
+	GSM411_RP_CAUSE_MO_TEMP_FAIL		= 41,
+	GSM411_RP_CAUSE_MO_CONGESTION		= 42,
+	GSM411_RP_CAUSE_MO_RES_UNAVAIL		= 47,
+	GSM411_RP_CAUSE_MO_REQ_FAC_NOTSUBSCR	= 50,
+	GSM411_RP_CAUSE_MO_REQ_FAC_NOTIMPL	= 69,
+	GSM411_RP_CAUSE_MO_INTERWORKING		= 127,
+	/* valid only for MT */
+	GSM411_RP_CAUSE_MT_MEM_EXCEEDED		= 22,
+	/* valid for both directions */
+	GSM411_RP_CAUSE_INV_TRANS_REF		= 81,
+	GSM411_RP_CAUSE_SEMANT_INC_MSG		= 95,
+	GSM411_RP_CAUSE_INV_MAND_INF		= 96,
+	GSM411_RP_CAUSE_MSGTYPE_NOTEXIST	= 97,
+	GSM411_RP_CAUSE_MSG_INCOMP_STATE	= 98,
+	GSM411_RP_CAUSE_IE_NOTEXIST		= 99,
+	GSM411_RP_CAUSE_PROTOCOL_ERR		= 111,
+};
+
+/* Chapter 10: Timers */
+#define GSM411_TMR_TR1M		40, 0	/* 35 < x < 45 seconds */
+#define GSM411_TMR_TRAM		30, 0	/* 25 < x < 35 seconds */
+#define GSM411_TMR_TR2M		15, 0	/* 12 < x < 20 seconds */
+
+#define GSM411_TMR_TC1A		30, 0	/* TR1M - 10 */
+#define GSM411_TMR_TC1A_SEC	30	/* TR1M - 10 */
+
+/* Chapter 8.2.1 */
+struct gsm411_rp_hdr {
+	uint8_t len;
+	uint8_t msg_type;
+	uint8_t msg_ref;
+	uint8_t data[0];
+} __attribute__ ((packed));
+
+/* our own enum, not related to on-air protocol */
+enum sms_alphabet {
+	DCS_NONE,
+	DCS_7BIT_DEFAULT,
+	DCS_UCS2,
+	DCS_8BIT_DATA,
+};
+
+/* GSM 03.40 / Chapter 9.2.3.1: TP-Message-Type-Indicator */
+#define GSM340_SMS_DELIVER_SC2MS	0x00
+#define GSM340_SMS_DELIVER_REP_MS2SC	0x00
+#define GSM340_SMS_STATUS_REP_SC2MS	0x02
+#define GSM340_SMS_COMMAND_MS2SC	0x02
+#define GSM340_SMS_SUBMIT_MS2SC		0x01
+#define GSM340_SMS_SUBMIT_REP_SC2MS	0x01
+#define GSM340_SMS_RESSERVED		0x03
+
+/* GSM 03.40 / Chapter 9.2.3.2: TP-More-Messages-to-Send */
+#define GSM340_TP_MMS_MORE		0
+#define GSM340_TP_MMS_NO_MORE		1
+
+/* GSM 03.40 / Chapter 9.2.3.3: TP-Validity-Period-Format */
+#define GSM340_TP_VPF_NONE		0
+#define GSM340_TP_VPF_RELATIVE		2
+#define GSM340_TP_VPF_ENHANCED		1
+#define GSM340_TP_VPF_ABSOLUTE		3
+
+/* GSM 03.40 / Chapter 9.2.3.4: TP-Status-Report-Indication */
+#define GSM340_TP_SRI_NONE		0
+#define GSM340_TP_SRI_PRESENT		1
+
+/* GSM 03.40 / Chapter 9.2.3.5: TP-Status-Report-Request */
+#define GSM340_TP_SRR_NONE		0
+#define GSM340_TP_SRR_REQUESTED		1
+
+/* GSM 03.40 / Chapter 9.2.3.9: TP-Protocol-Identifier */
+/* telematic interworking (001 or 111 in bits 7-5) */
+#define GSM340_TP_PID_IMPLICIT		0x00
+#define GSM340_TP_PID_TELEX		0x01
+#define GSM340_TP_PID_FAX_G3		0x02
+#define GSM340_TP_PID_FAX_G4		0x03
+#define GSM340_TP_PID_VOICE		0x04
+#define GSM430_TP_PID_ERMES		0x05
+#define GSM430_TP_PID_NATIONAL_PAGING	0x06
+#define GSM430_TP_PID_VIDEOTEX		0x07
+#define GSM430_TP_PID_TELETEX_UNSPEC	0x08
+#define GSM430_TP_PID_TELETEX_PSPDN	0x09
+#define GSM430_TP_PID_TELETEX_CSPDN	0x0a
+#define GSM430_TP_PID_TELETEX_PSTN	0x0b
+#define GSM430_TP_PID_TELETEX_ISDN	0x0c
+#define GSM430_TP_PID_TELETEX_UCI	0x0d
+#define GSM430_TP_PID_MSG_HANDLING	0x10
+#define GSM430_TP_PID_MSG_X400		0x11
+#define GSM430_TP_PID_EMAIL		0x12
+#define GSM430_TP_PID_GSM_MS		0x1f
+/* if bit 7 = 0 and bit 6 = 1 */
+#define GSM430_TP_PID_SMS_TYPE_0	0
+#define GSM430_TP_PID_SMS_TYPE_1	1
+#define GSM430_TP_PID_SMS_TYPE_2	2
+#define GSM430_TP_PID_SMS_TYPE_3	3
+#define GSM430_TP_PID_SMS_TYPE_4	4
+#define GSM430_TP_PID_SMS_TYPE_5	5
+#define GSM430_TP_PID_SMS_TYPE_6	6
+#define GSM430_TP_PID_SMS_TYPE_7	7
+#define GSM430_TP_PID_RETURN_CALL_MSG	0x1f
+#define GSM430_TP_PID_ME_DATA_DNLOAD	0x3d
+#define GSM430_TP_PID_ME_DE_PERSONAL	0x3e
+#define GSM430_TP_PID_ME_SIM_DNLOAD	0x3f
+
+/* GSM 03.38 Chapter 4: SMS Data Coding Scheme */
+#define GSM338_DCS_00_
+
+#define GSM338_DCS_1110_7BIT		(0 << 2)
+#define GSM338_DCS_1111_7BIT		(0 << 2)
+#define GSM338_DCS_1111_8BIT_DATA	(1 << 2)
+#define GSM338_DCS_1111_CLASS0		0
+#define GSM338_DCS_1111_CLASS1_ME	1
+#define GSM338_DCS_1111_CLASS2_SIM	2
+#define GSM338_DCS_1111_CLASS3_TE	3	/* See TS 07.05 */
+
+#endif /* PROTO_GSM_04_11_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_12.h b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_12.h
new file mode 100644
index 00000000..9b1538a5
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_12.h
@@ -0,0 +1,31 @@
+#ifndef PROTO_GSM_04_12_H
+#define PROTO_GSM_04_12_H
+
+#include <stdint.h>
+
+/* GSM TS 04.12 definitions for Short Message Service Cell Broadcast */
+
+#define GSM412_SEQ_FST_BLOCK		0x0
+#define GSM412_SEQ_SND_BLOCK		0x1
+#define GSM412_SEQ_TRD_BLOCK		0x2
+#define GSM412_SEQ_FTH_BLOCK		0x3
+#define GSM412_SEQ_FST_SCHED_BLOCK	0x8
+#define GSM412_SEQ_NULL_MSG		0xf
+
+struct gsm412_block_type {
+	uint8_t	seq_nr : 4,
+		lb : 1,
+		lpd : 2,
+		spare : 1;
+} __attribute__((packed));
+
+struct gsm412_sched_msg {
+	uint8_t beg_slot_nr : 6,
+		type : 2;
+	uint8_t end_slot_nr : 6,
+		spare1 : 1, spare2: 1;
+	uint8_t cbsms_msg_map[6];
+	uint8_t data[0];
+} __attribute__((packed));
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_80.h b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_80.h
new file mode 100644
index 00000000..fa5c9451
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_04_80.h
@@ -0,0 +1,126 @@
+#ifndef PROTO_GSM_04_80_H
+#define PROTO_GSM_04_80_H
+
+/* GSM TS 04.80  definitions (Supplementary Services Specification, Formats and Coding) */
+
+/* Section 3.4 */
+#define GSM0480_MTYPE_RELEASE_COMPLETE	0x2A
+#define GSM0480_MTYPE_FACILITY			0x3A
+#define GSM0480_MTYPE_REGISTER			0x3B
+
+/* Section 3.5 */
+#define GSM0480_IE_FACILITY			0x1C
+#define GSM0480_IE_SS_VERSION			0x7F
+
+/* Section 3.6.2 */
+#define GSM0480_CTYPE_INVOKE			0xA1
+#define GSM0480_CTYPE_RETURN_RESULT		0xA2
+#define GSM0480_CTYPE_RETURN_ERROR		0xA3
+#define GSM0480_CTYPE_REJECT			0xA4
+
+/* Section 3.6.3 */
+#define GSM0480_COMPIDTAG_INVOKE_ID		0x02
+#define GSM0480_COMPIDTAG_LINKED_ID		0x80
+
+/* Section 3.6.4 */
+#define GSM0480_OPERATION_CODE			0x02
+
+/* Section 3.6.5 */
+#define GSM_0480_SEQUENCE_TAG			0x30
+#define GSM_0480_SET_TAG			0x31
+
+/* Section 3.6.6 */
+#define GSM_0480_ERROR_CODE_TAG			0x02
+
+/* Section 3.6.7 */
+/* Table 3.13 */
+#define GSM_0480_PROBLEM_CODE_TAG_GENERAL	0x80
+#define GSM_0480_PROBLEM_CODE_TAG_INVOKE	0x81
+#define GSM_0480_PROBLEM_CODE_TAG_RETURN_RESULT	0x82
+#define GSM_0480_PROBLEM_CODE_TAG_RETURN_ERROR	0x83
+
+/* Table 3.14 */
+#define GSM_0480_GEN_PROB_CODE_UNRECOGNISED	0x00
+#define GSM_0480_GEN_PROB_CODE_MISTYPED		0x01
+#define GSM_0480_GEN_PROB_CODE_BAD_STRUCTURE	0x02
+
+/* Table 3.15 */
+#define GSM_0480_INVOKE_PROB_CODE_DUPLICATE_INVOKE_ID		0x00
+#define GSM_0480_INVOKE_PROB_CODE_UNRECOGNISED_OPERATION	0x01
+#define GSM_0480_INVOKE_PROB_CODE_MISTYPED_PARAMETER		0x02
+#define GSM_0480_INVOKE_PROB_CODE_RESOURCE_LIMITATION		0x03
+#define GSM_0480_INVOKE_PROB_CODE_INITIATING_RELEASE		0x04
+#define GSM_0480_INVOKE_PROB_CODE_UNRECOGNISED_LINKED_ID	0x05
+#define GSM_0480_INVOKE_PROB_CODE_UNEXPECTED_LINKED_RESPONSE	0x06
+#define GSM_0480_INVOKE_PROB_CODE_UNEXPECTED_LINKED_OPERATION	0x07
+
+/* Table 3.16 */
+#define GSM_0480_RESULT_PROB_CODE_UNRECOGNISED_INVOKE_ID	0x00
+#define GSM_0480_RESULT_PROB_CODE_RETURN_RESULT_UNEXPECTED	0x01
+#define GSM_0480_RESULT_PROB_CODE_MISTYPED_PARAMETER		0x02
+
+/* Table 3.17 */
+#define GSM_0480_ERROR_PROB_CODE_UNRECOGNISED_INVOKE_ID		0x00
+#define GSM_0480_ERROR_PROB_CODE_RETURN_ERROR_UNEXPECTED	0x01
+#define GSM_0480_ERROR_PROB_CODE_UNRECOGNISED_ERROR		0x02
+#define GSM_0480_ERROR_PROB_CODE_UNEXPECTED_ERROR		0x03
+#define GSM_0480_ERROR_PROB_CODE_MISTYPED_PARAMETER		0x04
+
+/* Section 4.5 */
+#define GSM0480_OP_CODE_REGISTER_SS		0x0A
+#define GSM0480_OP_CODE_ERASE_SS		0x0B
+#define GSM0480_OP_CODE_ACTIVATE_SS		0x0C
+#define GSM0480_OP_CODE_DEACTIVATE_SS		0x0D
+#define GSM0480_OP_CODE_INTERROGATE_SS		0x0E
+#define GSM0480_OP_CODE_NOTIFY_SS		0x10
+#define GSM0480_OP_CODE_REGISTER_PASSWORD	0x11
+#define GSM0480_OP_CODE_GET_PASSWORD		0x12
+#define GSM0480_OP_CODE_PROCESS_USS_DATA	0x13
+#define GSM0480_OP_CODE_FORWARD_CHECK_SS_IND	0x26
+#define GSM0480_OP_CODE_PROCESS_USS_REQ		0x3B
+#define GSM0480_OP_CODE_USS_REQUEST		0x3C
+#define GSM0480_OP_CODE_USS_NOTIFY		0x3D
+#define GSM0480_OP_CODE_FORWARD_CUG_INFO	0x78
+#define GSM0480_OP_CODE_SPLIT_MPTY		0x79
+#define GSM0480_OP_CODE_RETRIEVE_MPTY		0x7A
+#define GSM0480_OP_CODE_HOLD_MPTY		0x7B
+#define GSM0480_OP_CODE_BUILD_MPTY		0x7C
+#define GSM0480_OP_CODE_FORWARD_CHARGE_ADVICE	0x7D
+
+#define GSM0480_ERR_CODE_UNKNOWN_SUBSCRIBER			0x01
+#define GSM0480_ERR_CODE_ILLEGAL_SUBSCRIBER			0x09
+#define GSM0480_ERR_CODE_BEARER_SERVICE_NOT_PROVISIONED		0x0A
+#define GSM0480_ERR_CODE_TELESERVICE_NOT_PROVISIONED		0x0B
+#define GSM0480_ERR_CODE_ILLEGAL_EQUIPMENT			0x0C
+#define GSM0480_ERR_CODE_CALL_BARRED				0x0D
+#define GSM0480_ERR_CODE_ILLEGAL_SS_OPERATION			0x10
+#define GSM0480_ERR_CODE_SS_ERROR_STATUS			0x11
+#define GSM0480_ERR_CODE_SS_NOT_AVAILABLE			0x12
+#define GSM0480_ERR_CODE_SS_SUBSCRIPTION_VIOLATION		0x13
+#define GSM0480_ERR_CODE_SS_INCOMPATIBILITY			0x14
+#define GSM0480_ERR_CODE_FACILITY_NOT_SUPPORTED			0x15
+#define GSM0480_ERR_CODE_ABSENT_SUBSCRIBER			0x1B
+#define GSM0480_ERR_CODE_SYSTEM_FAILURE				0x22
+#define GSM0480_ERR_CODE_DATA_MISSING				0x23
+#define GSM0480_ERR_CODE_UNEXPECTED_DATA_VALUE			0x24
+#define GSM0480_ERR_CODE_PW_REGISTRATION_FAILURE		0x25
+#define GSM0480_ERR_CODE_NEGATIVE_PW_CHECK			0x26
+#define GSM0480_ERR_CODE_NUM_PW_ATTEMPTS_VIOLATION		0x2B
+#define GSM0480_ERR_CODE_UNKNOWN_ALPHABET			0x47
+#define GSM0480_ERR_CODE_USSD_BUSY				0x48
+#define GSM0480_ERR_CODE_MAX_MPTY_PARTICIPANTS			0x7E
+#define GSM0480_ERR_CODE_RESOURCES_NOT_AVAILABLE		0x7F
+
+/* ASN.1 type-tags */
+#define ASN1_BOOLEAN_TAG		0x01
+#define ASN1_INTEGER_TAG		0x02
+#define ASN1_BIT_STRING_TAG		0x03
+#define ASN1_OCTET_STRING_TAG		0x04
+#define ASN1_NULL_TYPE_TAG		0x05
+#define ASN1_OBJECT_ID_TAG		0x06
+#define ASN1_UTF8_STRING_TAG		0x0C
+#define ASN1_PRINTABLE_STRING_TAG	0x13
+#define ASN1_IA5_STRING_TAG		0x16
+#define ASN1_UNICODE_STRING_TAG		0x1E
+
+#endif /* PROTO_GSM_04_80_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_08_08.h b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_08_08.h
new file mode 100644
index 00000000..6b8f9359
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_08_08.h
@@ -0,0 +1,303 @@
+/* From GSM08.08 */
+
+#ifndef GSM_0808_H
+#define GSM_0808_H
+
+#include <stdlib.h>
+
+/*
+ * this is from GSM 03.03 CGI but is copied in GSM 08.08
+ * in § 3.2.2.27 for Cell Identifier List
+ */
+enum CELL_IDENT {
+	CELL_IDENT_WHOLE_GLOBAL		= 0,
+	CELL_IDENT_LAC_AND_CI		= 1,
+	CELL_IDENT_CI			= 2,
+	CELL_IDENT_NO_CELL		= 3,
+	CELL_IDENT_LAI_AND_LAC		= 4,
+	CELL_IDENT_LAC			= 5,
+	CELL_IDENT_BSS			= 6,
+	CELL_IDENT_UTRAN_PLMN_LAC_RNC	= 8,
+	CELL_IDENT_UTRAN_RNC		= 9,
+	CELL_IDENT_UTRAN_LAC_RNC	= 10,
+};
+
+
+/* GSM 08.06 § 6.3 */
+enum BSSAP_MSG_TYPE {
+	BSSAP_MSG_BSS_MANAGEMENT    = 0x0,
+	BSSAP_MSG_DTAP		    = 0x1,
+};
+
+struct bssmap_header {
+	uint8_t type;
+	uint8_t length;
+} __attribute__((packed));
+
+struct dtap_header {
+	uint8_t type;
+	uint8_t link_id;
+	uint8_t length;
+} __attribute__((packed));
+
+
+enum BSS_MAP_MSG_TYPE {
+	BSS_MAP_MSG_RESERVED_0		= 0,
+
+	/* ASSIGNMENT MESSAGES */
+	BSS_MAP_MSG_ASSIGMENT_RQST	= 1,
+	BSS_MAP_MSG_ASSIGMENT_COMPLETE	= 2,
+	BSS_MAP_MSG_ASSIGMENT_FAILURE	= 3,
+
+	/*  HANDOVER MESSAGES */
+	BSS_MAP_MSG_HANDOVER_RQST		= 16,
+	BSS_MAP_MSG_HANDOVER_REQUIRED		= 17,
+	BSS_MAP_MSG_HANDOVER_RQST_ACKNOWLEDGE= 18,
+	BSS_MAP_MSG_HANDOVER_CMD		= 19,
+	BSS_MAP_MSG_HANDOVER_COMPLETE		= 20,
+	BSS_MAP_MSG_HANDOVER_SUCCEEDED		= 21,
+	BSS_MAP_MSG_HANDOVER_FAILURE		= 22,
+	BSS_MAP_MSG_HANDOVER_PERFORMED		= 23,
+	BSS_MAP_MSG_HANDOVER_CANDIDATE_ENQUIRE	= 24,
+	BSS_MAP_MSG_HANDOVER_CANDIDATE_RESPONSE	= 25,
+	BSS_MAP_MSG_HANDOVER_REQUIRED_REJECT	= 26,
+	BSS_MAP_MSG_HANDOVER_DETECT		= 27,
+
+	/* RELEASE MESSAGES */
+	BSS_MAP_MSG_CLEAR_CMD		= 32,
+	BSS_MAP_MSG_CLEAR_COMPLETE		= 33,
+	BSS_MAP_MSG_CLEAR_RQST		= 34,
+	BSS_MAP_MSG_RESERVED_1			= 35,
+	BSS_MAP_MSG_RESERVED_2			= 36,
+	BSS_MAP_MSG_SAPI_N_REJECT		= 37,
+	BSS_MAP_MSG_CONFUSION			= 38,
+
+	/* OTHER CONNECTION RELATED MESSAGES */
+	BSS_MAP_MSG_SUSPEND			= 40,
+	BSS_MAP_MSG_RESUME			= 41,
+	BSS_MAP_MSG_CONNECTION_ORIENTED_INFORMATION = 42,
+	BSS_MAP_MSG_PERFORM_LOCATION_RQST	= 43,
+	BSS_MAP_MSG_LSA_INFORMATION		= 44,
+	BSS_MAP_MSG_PERFORM_LOCATION_RESPONSE	= 45,
+	BSS_MAP_MSG_PERFORM_LOCATION_ABORT	= 46,
+	BSS_MAP_MSG_COMMON_ID			= 47,
+
+	/* GENERAL MESSAGES */
+	BSS_MAP_MSG_RESET			= 48,
+	BSS_MAP_MSG_RESET_ACKNOWLEDGE		= 49,
+	BSS_MAP_MSG_OVERLOAD			= 50,
+	BSS_MAP_MSG_RESERVED_3			= 51,
+	BSS_MAP_MSG_RESET_CIRCUIT		= 52,
+	BSS_MAP_MSG_RESET_CIRCUIT_ACKNOWLEDGE	= 53,
+	BSS_MAP_MSG_MSC_INVOKE_TRACE		= 54,
+	BSS_MAP_MSG_BSS_INVOKE_TRACE		= 55,
+	BSS_MAP_MSG_CONNECTIONLESS_INFORMATION	= 58,
+
+	/* TERRESTRIAL RESOURCE MESSAGES */
+	BSS_MAP_MSG_BLOCK			= 64,
+	BSS_MAP_MSG_BLOCKING_ACKNOWLEDGE	= 65,
+	BSS_MAP_MSG_UNBLOCK			= 66,
+	BSS_MAP_MSG_UNBLOCKING_ACKNOWLEDGE	= 67,
+	BSS_MAP_MSG_CIRCUIT_GROUP_BLOCK		= 68,
+	BSS_MAP_MSG_CIRCUIT_GROUP_BLOCKING_ACKNOWLEDGE	= 69,
+	BSS_MAP_MSG_CIRCUIT_GROUP_UNBLOCK	= 70,
+	BSS_MAP_MSG_CIRCUIT_GROUP_UNBLOCKING_ACKNOWLEDGE = 71,
+	BSS_MAP_MSG_UNEQUIPPED_CIRCUIT		= 72,
+	BSS_MAP_MSG_CHANGE_CIRCUIT		= 78,
+	BSS_MAP_MSG_CHANGE_CIRCUIT_ACKNOWLEDGE	= 79,
+
+	/* RADIO RESOURCE MESSAGES */
+	BSS_MAP_MSG_RESOURCE_RQST		= 80,
+	BSS_MAP_MSG_RESOURCE_INDICATION		= 81,
+	BSS_MAP_MSG_PAGING			= 82,
+	BSS_MAP_MSG_CIPHER_MODE_CMD		= 83,
+	BSS_MAP_MSG_CLASSMARK_UPDATE		= 84,
+	BSS_MAP_MSG_CIPHER_MODE_COMPLETE	= 85,
+	BSS_MAP_MSG_QUEUING_INDICATION		= 86,
+	BSS_MAP_MSG_COMPLETE_LAYER_3		= 87,
+	BSS_MAP_MSG_CLASSMARK_RQST		= 88,
+	BSS_MAP_MSG_CIPHER_MODE_REJECT		= 89,
+	BSS_MAP_MSG_LOAD_INDICATION		= 90,
+
+	/* VGCS/VBS */
+	BSS_MAP_MSG_VGCS_VBS_SETUP		= 4,
+	BSS_MAP_MSG_VGCS_VBS_SETUP_ACK		= 5,
+	BSS_MAP_MSG_VGCS_VBS_SETUP_REFUSE	= 6,
+	BSS_MAP_MSG_VGCS_VBS_ASSIGNMENT_RQST	= 7,
+	BSS_MAP_MSG_VGCS_VBS_ASSIGNMENT_RESULT	= 28,
+	BSS_MAP_MSG_VGCS_VBS_ASSIGNMENT_FAILURE	= 29,
+	BSS_MAP_MSG_VGCS_VBS_QUEUING_INDICATION	= 30,
+	BSS_MAP_MSG_UPLINK_RQST		= 31,
+	BSS_MAP_MSG_UPLINK_RQST_ACKNOWLEDGE	= 39,
+	BSS_MAP_MSG_UPLINK_RQST_CONFIRMATION	= 73,
+	BSS_MAP_MSG_UPLINK_RELEASE_INDICATION	= 74,
+	BSS_MAP_MSG_UPLINK_REJECT_CMD	= 75,
+	BSS_MAP_MSG_UPLINK_RELEASE_CMD	= 76,
+	BSS_MAP_MSG_UPLINK_SEIZED_CMD	= 77,
+};
+
+enum GSM0808_IE_CODING {
+	GSM0808_IE_CIRCUIT_IDENTITY_CODE	= 1,
+	GSM0808_IE_RESERVED_0			= 2,
+	GSM0808_IE_RESOURCE_AVAILABLE		= 3,
+	GSM0808_IE_CAUSE			= 4,
+	GSM0808_IE_CELL_IDENTIFIER		= 5,
+	GSM0808_IE_PRIORITY			= 6,
+	GSM0808_IE_LAYER_3_HEADER_INFORMATION	= 7,
+	GSM0808_IE_IMSI				= 8,
+	GSM0808_IE_TMSI				= 9,
+	GSM0808_IE_ENCRYPTION_INFORMATION	= 10,
+	GSM0808_IE_CHANNEL_TYPE			= 11,
+	GSM0808_IE_PERIODICITY			= 12,
+	GSM0808_IE_EXTENDED_RESOURCE_INDICATOR	= 13,
+	GSM0808_IE_NUMBER_OF_MSS		= 14,
+	GSM0808_IE_RESERVED_1			= 15,
+	GSM0808_IE_RESERVED_2			= 16,
+	GSM0808_IE_RESERVED_3			= 17,
+	GSM0808_IE_CLASSMARK_INFORMATION_T2	= 18,
+	GSM0808_IE_CLASSMARK_INFORMATION_T3	= 19,
+	GSM0808_IE_INTERFERENCE_BAND_TO_USE	= 20,
+	GSM0808_IE_RR_CAUSE			= 21,
+	GSM0808_IE_RESERVED_4			= 22,
+	GSM0808_IE_LAYER_3_INFORMATION		= 23,
+	GSM0808_IE_DLCI				= 24,
+	GSM0808_IE_DOWNLINK_DTX_FLAG		= 25,
+	GSM0808_IE_CELL_IDENTIFIER_LIST		= 26,
+	GSM0808_IE_RESPONSE_RQST		= 27,
+	GSM0808_IE_RESOURCE_INDICATION_METHOD	= 28,
+	GSM0808_IE_CLASSMARK_INFORMATION_TYPE_1	= 29,
+	GSM0808_IE_CIRCUIT_IDENTITY_CODE_LIST	= 30,
+	GSM0808_IE_DIAGNOSTIC			= 31,
+	GSM0808_IE_LAYER_3_MESSAGE_CONTENTS	= 32,
+	GSM0808_IE_CHOSEN_CHANNEL		= 33,
+	GSM0808_IE_TOTAL_RESOURCE_ACCESSIBLE	= 34,
+	GSM0808_IE_CIPHER_RESPONSE_MODE		= 35,
+	GSM0808_IE_CHANNEL_NEEDED		= 36,
+	GSM0808_IE_TRACE_TYPE			= 37,
+	GSM0808_IE_TRIGGERID			= 38,
+	GSM0808_IE_TRACE_REFERENCE		= 39,
+	GSM0808_IE_TRANSACTIONID		= 40,
+	GSM0808_IE_MOBILE_IDENTITY		= 41,
+	GSM0808_IE_OMCID			= 42,
+	GSM0808_IE_FORWARD_INDICATOR		= 43,
+	GSM0808_IE_CHOSEN_ENCR_ALG		= 44,
+	GSM0808_IE_CIRCUIT_POOL			= 45,
+	GSM0808_IE_CIRCUIT_POOL_LIST		= 46,
+	GSM0808_IE_TIME_INDICATION		= 47,
+	GSM0808_IE_RESOURCE_SITUATION		= 48,
+	GSM0808_IE_CURRENT_CHANNEL_TYPE_1	= 49,
+	GSM0808_IE_QUEUEING_INDICATOR		= 50,
+	GSM0808_IE_SPEECH_VERSION		= 64,
+	GSM0808_IE_ASSIGNMENT_REQUIREMENT	= 51,
+	GSM0808_IE_TALKER_FLAG			= 53,
+	GSM0808_IE_CONNECTION_RELEASE_RQSTED	= 54,
+	GSM0808_IE_GROUP_CALL_REFERENCE		= 55,
+	GSM0808_IE_EMLPP_PRIORITY		= 56,
+	GSM0808_IE_CONFIG_EVO_INDI		= 57,
+	GSM0808_IE_OLD_BSS_TO_NEW_BSS_INFORMATION	= 58,
+	GSM0808_IE_LSA_IDENTIFIER		= 59,
+	GSM0808_IE_LSA_IDENTIFIER_LIST		= 60,
+	GSM0808_IE_LSA_INFORMATION		= 61,
+	GSM0808_IE_LCS_QOS			= 62,
+	GSM0808_IE_LSA_ACCESS_CTRL_SUPPR	= 63,
+	GSM0808_IE_LCS_PRIORITY			= 67,
+	GSM0808_IE_LOCATION_TYPE		= 68,
+	GSM0808_IE_LOCATION_ESTIMATE		= 69,
+	GSM0808_IE_POSITIONING_DATA		= 70,
+	GSM0808_IE_LCS_CAUSE			= 71,
+	GSM0808_IE_LCS_CLIENT_TYPE		= 72,
+	GSM0808_IE_APDU				= 73,
+	GSM0808_IE_NETWORK_ELEMENT_IDENTITY	= 74,
+	GSM0808_IE_GPS_ASSISTANCE_DATA		= 75,
+	GSM0808_IE_DECIPHERING_KEYS		= 76,
+	GSM0808_IE_RETURN_ERROR_RQST		= 77,
+	GSM0808_IE_RETURN_ERROR_CAUSE		= 78,
+	GSM0808_IE_SEGMENTATION			= 79,
+	GSM0808_IE_SERVICE_HANDOVER		= 80,
+	GSM0808_IE_SOURCE_RNC_TO_TARGET_RNC_TRANSPARENT_UMTS	= 81,
+	GSM0808_IE_SOURCE_RNC_TO_TARGET_RNC_TRANSPARENT_CDMA2000= 82,
+	GSM0808_IE_RESERVED_5			= 65,
+	GSM0808_IE_RESERVED_6			= 66,
+};
+
+enum gsm0808_cause {
+	GSM0808_CAUSE_RADIO_INTERFACE_MESSAGE_FAILURE			= 0,
+	GSM0808_CAUSE_RADIO_INTERFACE_FAILURE				= 1,
+	GSM0808_CAUSE_UPLINK_QUALITY					= 2,
+	GSM0808_CAUSE_UPLINK_STRENGTH					= 3,
+	GSM0808_CAUSE_DOWNLINK_QUALITY					= 4,
+	GSM0808_CAUSE_DOWNLINK_STRENGTH					= 5,
+	GSM0808_CAUSE_DISTANCE						= 6,
+	GSM0808_CAUSE_O_AND_M_INTERVENTION				= 7,
+	GSM0808_CAUSE_RESPONSE_TO_MSC_INVOCATION			= 8,
+	GSM0808_CAUSE_CALL_CONTROL					= 9,
+	GSM0808_CAUSE_RADIO_INTERFACE_FAILURE_REVERSION			= 10,
+	GSM0808_CAUSE_HANDOVER_SUCCESSFUL				= 11,
+	GSM0808_CAUSE_BETTER_CELL					= 12,
+	GSM0808_CAUSE_DIRECTED_RETRY					= 13,
+	GSM0808_CAUSE_JOINED_GROUP_CALL_CHANNEL				= 14,
+	GSM0808_CAUSE_TRAFFIC						= 15,
+	GSM0808_CAUSE_EQUIPMENT_FAILURE					= 32,
+	GSM0808_CAUSE_NO_RADIO_RESOURCE_AVAILABLE			= 33,
+	GSM0808_CAUSE_RQSTED_TERRESTRIAL_RESOURCE_UNAVAILABLE	= 34,
+	GSM0808_CAUSE_CCCH_OVERLOAD					= 35,
+	GSM0808_CAUSE_PROCESSOR_OVERLOAD				= 36,
+	GSM0808_CAUSE_BSS_NOT_EQUIPPED					= 37,
+	GSM0808_CAUSE_MS_NOT_EQUIPPED					= 38,
+	GSM0808_CAUSE_INVALID_CELL					= 39,
+	GSM0808_CAUSE_TRAFFIC_LOAD					= 40,
+	GSM0808_CAUSE_PREEMPTION					= 41,
+	GSM0808_CAUSE_RQSTED_TRANSCODING_RATE_ADAPTION_UNAVAILABLE	= 48,
+	GSM0808_CAUSE_CIRCUIT_POOL_MISMATCH				= 49,
+	GSM0808_CAUSE_SWITCH_CIRCUIT_POOL				= 50,
+	GSM0808_CAUSE_RQSTED_SPEECH_VERSION_UNAVAILABLE		= 51,
+	GSM0808_CAUSE_LSA_NOT_ALLOWED					= 52,
+	GSM0808_CAUSE_CIPHERING_ALGORITHM_NOT_SUPPORTED			= 64,
+	GSM0808_CAUSE_TERRESTRIAL_CIRCUIT_ALREADY_ALLOCATED		= 80,
+	GSM0808_CAUSE_INVALID_MESSAGE_CONTENTS				= 81,
+	GSM0808_CAUSE_INFORMATION_ELEMENT_OR_FIELD_MISSING		= 82,
+	GSM0808_CAUSE_INCORRECT_VALUE					= 83,
+	GSM0808_CAUSE_UNKNOWN_MESSAGE_TYPE				= 84,
+	GSM0808_CAUSE_UNKNOWN_INFORMATION_ELEMENT			= 85,
+	GSM0808_CAUSE_PROTOCOL_ERROR_BETWEEN_BSS_AND_MSC		= 96,
+};
+
+/* GSM 08.08 3.2.2.11 Channel Type */
+enum gsm0808_chan_indicator {
+	GSM0808_CHAN_SPEECH = 1,
+	GSM0808_CHAN_DATA   = 2,
+	GSM0808_CHAN_SIGN   = 3,
+};
+
+enum gsm0808_chan_rate_type_data {
+	GSM0808_DATA_FULL_BM	= 0x8,
+	GSM0808_DATA_HALF_LM	= 0x9,
+	GSM0808_DATA_FULL_RPREF	= 0xa,
+	GSM0808_DATA_HALF_PREF	= 0xb,
+	GSM0808_DATA_FULL_PREF_NO_CHANGE	= 0x1a,
+	GSM0808_DATA_HALF_PREF_NO_CHANGE	= 0x1b,
+	GSM0808_DATA_MULTI_MASK	= 0x20,
+	GSM0808_DATA_MULTI_MASK_NO_CHANGE	= 0x30,
+};
+
+enum gsm0808_chan_rate_type_speech {
+	GSM0808_SPEECH_FULL_BM	= 0x8,
+	GSM0808_SPEECH_HALF_LM	= 0x9,
+	GSM0808_SPEECH_FULL_PREF= 0xa,
+	GSM0808_SPEECH_HALF_PREF= 0xb,
+	GSM0808_SPEECH_FULL_PREF_NO_CHANGE	= 0x1a,
+	GSM0808_SPEECH_HALF_PREF_NO_CHANGE	= 0x1b,
+	GSM0808_SPEECH_PERM	= 0xf,
+	GSM0808_SPEECH_PERM_NO_CHANGE = 0x1f,
+};
+
+enum gsm0808_permitted_speech {
+	GSM0808_PERM_FR1	= 0x01,
+	GSM0808_PERM_FR2	= 0x11,
+	GSM0808_PERM_FR3	= 0x21,
+	GSM0808_PERM_HR1	= GSM0808_PERM_FR1 | 0x4,
+	GSM0808_PERM_HR2	= GSM0808_PERM_FR2 | 0x4,
+	GSM0808_PERM_HR3	= GSM0808_PERM_FR3 | 0x4,
+};
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_08_58.h b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_08_58.h
new file mode 100644
index 00000000..57a8f687
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_08_58.h
@@ -0,0 +1,577 @@
+#ifndef PROTO_GSM_08_58_H
+#define PROTO_GSM_08_58_H
+
+/* GSM Radio Signalling Link messages on the A-bis interface 
+ * 3GPP TS 08.58 version 8.6.0 Release 1999 / ETSI TS 100 596 V8.6.0 */
+
+/* (C) 2008 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+/*! \addtogroup rsl
+ *  @{
+ */
+
+/*! \file gsm_08_58.h */
+
+/*! \brief RSL common header */
+struct abis_rsl_common_hdr {
+	uint8_t	msg_discr;	/*!< \brief message discriminator (ABIS_RSL_MDISC_*) */
+	uint8_t	msg_type;	/*!< \brief message type (\ref abis_rsl_msgtype) */
+	uint8_t	data[0];	/*!< \brief actual payload data */
+} __attribute__ ((packed));
+
+/* \brief RSL RLL header (Chapter 8.3) */
+struct abis_rsl_rll_hdr {
+	struct abis_rsl_common_hdr c;
+	uint8_t	ie_chan;	/*!< \brief \ref RSL_IE_CHAN_NR (tag) */
+	uint8_t	chan_nr;	/*!< \brief RSL channel number (value) */
+	uint8_t	ie_link_id;	/*!< \brief \ref RSL_IE_LINK_IDENT (tag) */
+	uint8_t	link_id;	/*!< \brief RSL link identifier (value) */
+	uint8_t	data[0];	/*!< \brief message payload data */
+} __attribute__ ((packed));
+
+/* \brief RSL Dedicated Channel header (Chapter 8.3 and 8.4) */
+struct abis_rsl_dchan_hdr {
+	struct abis_rsl_common_hdr c;
+	uint8_t	ie_chan;	/*!< \brief \ref RSL_IE_CHAN_NR (tag) */
+	uint8_t	chan_nr;	/*!< \brief RSL channel number (value) */
+	uint8_t	data[0];	/*!< \brief message payload data */
+} __attribute__ ((packed));
+
+/* \brief RSL Common Channel header (Chapter 8.5) */
+struct abis_rsl_cchan_hdr {
+	struct abis_rsl_common_hdr c;
+	uint8_t	ie_chan;	/*!< \brief \ref RSL_IE_CHAN_NR (tag) */
+	uint8_t	chan_nr;	/*!< \brief RSL channel number (value) */
+	uint8_t	data[0];	/*!< \brief message payload data */
+} __attribute__ ((packed));
+
+
+/* Chapter 9.1 */
+/* \brief RSL Message Discriminator: RLL */
+#define ABIS_RSL_MDISC_RLL		0x02
+/* \brief RSL Message Discriminator: Dedicated Channel */
+#define ABIS_RSL_MDISC_DED_CHAN		0x08
+/* \brief RSL Message Discriminator: Common Channel */
+#define ABIS_RSL_MDISC_COM_CHAN		0x0c
+/* \brief RSL Message Discriminator: TRX Management */
+#define ABIS_RSL_MDISC_TRX		0x10
+/* \brief RSL Message Discriminator: Location Service */
+#define ABIS_RSL_MDISC_LOC		0x20
+/* \brief RSL Message Discriminator: ip.access */
+#define ABIS_RSL_MDISC_IPACCESS		0x7e
+#define ABIS_RSL_MDISC_TRANSP		0x01
+
+/* \brief Check if given RSL message discriminator is transparent */
+#define ABIS_RSL_MDISC_IS_TRANSP(x)	(x & 0x01)
+
+/* \brief RSL Message Tyoe (Chapter 9.1) */
+enum abis_rsl_msgtype {
+	/* Radio Link Layer Management */
+	RSL_MT_DATA_REQ			= 0x01,
+	RSL_MT_DATA_IND,
+	RSL_MT_ERROR_IND,
+	RSL_MT_EST_REQ,
+	RSL_MT_EST_CONF,
+	RSL_MT_EST_IND,
+	RSL_MT_REL_REQ,
+	RSL_MT_REL_CONF,
+	RSL_MT_REL_IND,
+	RSL_MT_UNIT_DATA_REQ,
+	RSL_MT_UNIT_DATA_IND,		/* 0x0b */
+	RSL_MT_SUSP_REQ,		/* non-standard elements */
+	RSL_MT_SUSP_CONF,
+	RSL_MT_RES_REQ,
+	RSL_MT_RECON_REQ,		/* 0x0f */
+
+	/* Common Channel Management / TRX Management */
+	RSL_MT_BCCH_INFO			= 0x11,
+	RSL_MT_CCCH_LOAD_IND,
+	RSL_MT_CHAN_RQD,
+	RSL_MT_DELETE_IND,
+	RSL_MT_PAGING_CMD,
+	RSL_MT_IMMEDIATE_ASSIGN_CMD,
+	RSL_MT_SMS_BC_REQ,
+	RSL_MT_CHAN_CONF,		/* non-standard element */
+	/* empty */
+	RSL_MT_RF_RES_IND			= 0x19,
+	RSL_MT_SACCH_FILL,
+	RSL_MT_OVERLOAD,
+	RSL_MT_ERROR_REPORT,
+	RSL_MT_SMS_BC_CMD,
+	RSL_MT_CBCH_LOAD_IND,
+	RSL_MT_NOT_CMD,			/* 0x1f */
+
+	/* Dedicate Channel Management */
+	RSL_MT_CHAN_ACTIV			= 0x21,
+	RSL_MT_CHAN_ACTIV_ACK,
+	RSL_MT_CHAN_ACTIV_NACK,
+	RSL_MT_CONN_FAIL,
+	RSL_MT_DEACTIVATE_SACCH,
+	RSL_MT_ENCR_CMD,
+	RSL_MT_HANDO_DET,
+	RSL_MT_MEAS_RES,
+	RSL_MT_MODE_MODIFY_REQ,
+	RSL_MT_MODE_MODIFY_ACK,
+	RSL_MT_MODE_MODIFY_NACK,
+	RSL_MT_PHY_CONTEXT_REQ,
+	RSL_MT_PHY_CONTEXT_CONF,
+	RSL_MT_RF_CHAN_REL,
+	RSL_MT_MS_POWER_CONTROL,
+	RSL_MT_BS_POWER_CONTROL,		/* 0x30 */
+	RSL_MT_PREPROC_CONFIG,
+	RSL_MT_PREPROC_MEAS_RES,
+	RSL_MT_RF_CHAN_REL_ACK,
+	RSL_MT_SACCH_INFO_MODIFY,
+	RSL_MT_TALKER_DET,
+	RSL_MT_LISTENER_DET,
+	RSL_MT_REMOTE_CODEC_CONF_REP,
+	RSL_MT_RTD_REP,
+	RSL_MT_PRE_HANDO_NOTIF,
+	RSL_MT_MR_CODEC_MOD_REQ,
+	RSL_MT_MR_CODEC_MOD_ACK,
+	RSL_MT_MR_CODEC_MOD_NACK,
+	RSL_MT_MR_CODEC_MOD_PER,
+	RSL_MT_TFO_REP,
+	RSL_MT_TFO_MOD_REQ,		/* 0x3f */
+	RSL_MT_LOCATION_INFO		= 0x41,
+
+	/* ip.access specific RSL message types */
+	RSL_MT_IPAC_DIR_RETR_ENQ	= 0x40,
+	RSL_MT_IPAC_PDCH_ACT		= 0x48,
+	RSL_MT_IPAC_PDCH_ACT_ACK,
+	RSL_MT_IPAC_PDCH_ACT_NACK,
+	RSL_MT_IPAC_PDCH_DEACT		= 0x4b,
+	RSL_MT_IPAC_PDCH_DEACT_ACK,
+	RSL_MT_IPAC_PDCH_DEACT_NACK,
+	RSL_MT_IPAC_CONNECT_MUX		= 0x50,
+	RSL_MT_IPAC_CONNECT_MUX_ACK,
+	RSL_MT_IPAC_CONNECT_MUX_NACK,
+	RSL_MT_IPAC_BIND_MUX		= 0x53,
+	RSL_MT_IPAC_BIND_MUX_ACK,
+	RSL_MT_IPAC_BIND_MUX_NACK,
+	RSL_MT_IPAC_DISC_MUX		= 0x56,
+	RSL_MT_IPAC_DISC_MUX_ACK,
+	RSL_MT_IPAC_DISC_MUX_NACK,
+	RSL_MT_IPAC_CRCX		= 0x70,		/* Bind to local BTS RTP port */
+	RSL_MT_IPAC_CRCX_ACK,
+	RSL_MT_IPAC_CRCX_NACK,
+	RSL_MT_IPAC_MDCX		= 0x73,
+	RSL_MT_IPAC_MDCX_ACK,
+	RSL_MT_IPAC_MDCX_NACK,
+	RSL_MT_IPAC_DLCX_IND		= 0x76,
+	RSL_MT_IPAC_DLCX		= 0x77,
+	RSL_MT_IPAC_DLCX_ACK,
+	RSL_MT_IPAC_DLCX_NACK,
+};
+
+/*! \brief Siemens vendor-specific RSL message types */
+enum abis_rsl_msgtype_siemens {
+	RSL_MT_SIEMENS_MRPCI		= 0x41,
+	RSL_MT_SIEMENS_INTRAC_HO_COND_IND = 0x42,
+	RSL_MT_SIEMENS_INTERC_HO_COND_IND = 0x43,
+	RSL_MT_SIEMENS_FORCED_HO_REQ	= 0x44,
+	RSL_MT_SIEMENS_PREF_AREA_REQ	= 0x45,
+	RSL_MT_SIEMENS_PREF_AREA	= 0x46,
+	RSL_MT_SIEMENS_START_TRACE	= 0x47,
+	RSL_MT_SIEMENS_START_TRACE_ACK	= 0x48,
+	RSL_MT_SIEMENS_STOP_TRACE	= 0x49,
+	RSL_MT_SIEMENS_TRMR		= 0x4a,
+	RSL_MT_SIEMENS_HO_FAIL_IND	= 0x4b,
+	RSL_MT_SIEMENS_STOP_TRACE_ACK	= 0x4c,
+	RSL_MT_SIEMENS_UPLF		= 0x4d,
+	RSL_MT_SIEMENS_UPLB		= 0x4e,
+	RSL_MT_SIEMENS_SET_SYS_INFO_10	= 0x4f,
+	RSL_MT_SIEMENS_MODIF_COND_IND	= 0x50,
+};
+
+/*! \brief RSL Information Element Identifiers (Chapter 9.3) */
+enum abis_rsl_ie {
+	RSL_IE_CHAN_NR			= 0x01,
+	RSL_IE_LINK_IDENT,
+	RSL_IE_ACT_TYPE,
+	RSL_IE_BS_POWER,
+	RSL_IE_CHAN_IDENT,
+	RSL_IE_CHAN_MODE,
+	RSL_IE_ENCR_INFO,
+	RSL_IE_FRAME_NUMBER,
+	RSL_IE_HANDO_REF,
+	RSL_IE_L1_INFO,
+	RSL_IE_L3_INFO,
+	RSL_IE_MS_IDENTITY,
+	RSL_IE_MS_POWER,
+	RSL_IE_PAGING_GROUP,
+	RSL_IE_PAGING_LOAD,
+	RSL_IE_PYHS_CONTEXT		= 0x10,
+	RSL_IE_ACCESS_DELAY,
+	RSL_IE_RACH_LOAD,
+	RSL_IE_REQ_REFERENCE,
+	RSL_IE_RELEASE_MODE,
+	RSL_IE_RESOURCE_INFO,
+	RSL_IE_RLM_CAUSE,
+	RSL_IE_STARTNG_TIME,
+	RSL_IE_TIMING_ADVANCE,
+	RSL_IE_UPLINK_MEAS,
+	RSL_IE_CAUSE,
+	RSL_IE_MEAS_RES_NR,
+	RSL_IE_MSG_ID,
+	/* reserved */
+	RSL_IE_SYSINFO_TYPE		= 0x1e,
+	RSL_IE_MS_POWER_PARAM,
+	RSL_IE_BS_POWER_PARAM,
+	RSL_IE_PREPROC_PARAM,
+	RSL_IE_PREPROC_MEAS,
+	RSL_IE_IMM_ASS_INFO,		/* Phase 1 (3.6.0), later Full below */
+	RSL_IE_SMSCB_INFO		= 0x24,
+	RSL_IE_MS_TIMING_OFFSET,
+	RSL_IE_ERR_MSG,
+	RSL_IE_FULL_BCCH_INFO,
+	RSL_IE_CHAN_NEEDED,
+	RSL_IE_CB_CMD_TYPE,
+	RSL_IE_SMSCB_MSG,
+	RSL_IE_FULL_IMM_ASS_INFO,
+	RSL_IE_SACCH_INFO,
+	RSL_IE_CBCH_LOAD_INFO,
+	RSL_IE_SMSCB_CHAN_INDICATOR,
+	RSL_IE_GROUP_CALL_REF,
+	RSL_IE_CHAN_DESC		= 0x30,
+	RSL_IE_NCH_DRX_INFO,
+	RSL_IE_CMD_INDICATOR,
+	RSL_IE_EMLPP_PRIO,
+	RSL_IE_UIC,
+	RSL_IE_MAIN_CHAN_REF,
+	RSL_IE_MR_CONFIG,
+	RSL_IE_MR_CONTROL,
+	RSL_IE_SUP_CODEC_TYPES,
+	RSL_IE_CODEC_CONFIG,
+	RSL_IE_RTD,
+	RSL_IE_TFO_STATUS,
+	RSL_IE_LLP_APDU,
+	/* Siemens vendor-specific */
+	RSL_IE_SIEMENS_MRPCI		= 0x40,
+	RSL_IE_SIEMENS_PREF_AREA_TYPE	= 0x43,
+	RSL_IE_SIEMENS_ININ_CELL_HO_PAR	= 0x45,
+	RSL_IE_SIEMENS_TRACE_REF_NR	= 0x46,
+	RSL_IE_SIEMENS_INT_TRACE_IDX	= 0x47,
+	RSL_IE_SIEMENS_L2_HDR_INFO	= 0x48,
+	RSL_IE_SIEMENS_HIGHEST_RATE	= 0x4e,
+	RSL_IE_SIEMENS_SUGGESTED_RATE	= 0x4f,
+
+	/* ip.access */
+	RSL_IE_IPAC_SRTP_CONFIG	= 0xe0,
+	RSL_IE_IPAC_PROXY_UDP	= 0xe1,
+	RSL_IE_IPAC_BSCMPL_TOUT	= 0xe2,
+	RSL_IE_IPAC_REMOTE_IP	= 0xf0,
+	RSL_IE_IPAC_REMOTE_PORT	= 0xf1,
+	RSL_IE_IPAC_RTP_PAYLOAD	= 0xf2,
+	RSL_IE_IPAC_LOCAL_PORT	= 0xf3,
+	RSL_IE_IPAC_SPEECH_MODE	= 0xf4,
+	RSL_IE_IPAC_LOCAL_IP	= 0xf5,
+	RSL_IE_IPAC_CONN_STAT	= 0xf6,
+	RSL_IE_IPAC_HO_C_PARMS	= 0xf7,
+	RSL_IE_IPAC_CONN_ID	= 0xf8,
+	RSL_IE_IPAC_RTP_CSD_FMT	= 0xf9,
+	RSL_IE_IPAC_RTP_JIT_BUF	= 0xfa,
+	RSL_IE_IPAC_RTP_COMPR	= 0xfb,
+	RSL_IE_IPAC_RTP_PAYLOAD2= 0xfc,
+	RSL_IE_IPAC_RTP_MPLEX	= 0xfd,
+	RSL_IE_IPAC_RTP_MPLEX_ID= 0xfe,
+};
+
+/* Chapter 9.3.1 */
+#define RSL_CHAN_NR_MASK	0xf8
+#define RSL_CHAN_Bm_ACCHs	0x08
+#define RSL_CHAN_Lm_ACCHs	0x10	/* .. 0x18 */
+#define RSL_CHAN_SDCCH4_ACCH	0x20	/* .. 0x38 */
+#define RSL_CHAN_SDCCH8_ACCH	0x40	/* ...0x78 */
+#define RSL_CHAN_BCCH		0x80
+#define RSL_CHAN_RACH		0x88
+#define RSL_CHAN_PCH_AGCH	0x90
+
+/* Chapter 9.3.3 */
+#define RSL_ACT_TYPE_INITIAL	0x00
+#define RSL_ACT_TYPE_REACT	0x80
+#define RSL_ACT_INTRA_IMM_ASS	0x00
+#define RSL_ACT_INTRA_NORM_ASS	0x01
+#define RSL_ACT_INTER_ASYNC	0x02
+#define RSL_ACT_INTER_SYNC	0x03
+#define RSL_ACT_SECOND_ADD	0x04
+#define RSL_ACT_SECOND_MULTI	0x05
+
+/*! \brief RSL Channel Mode IF (Chapter 9.3.6) */
+struct rsl_ie_chan_mode {
+	uint8_t dtx_dtu;
+	uint8_t spd_ind;
+	uint8_t chan_rt;
+	uint8_t chan_rate;
+} __attribute__ ((packed));
+#define RSL_CMOD_DTXu		0x01	/* uplink */
+#define RSL_CMOD_DTXd		0x02	/* downlink */
+enum rsl_cmod_spd {
+	RSL_CMOD_SPD_SPEECH	= 0x01,
+	RSL_CMOD_SPD_DATA	= 0x02,
+	RSL_CMOD_SPD_SIGN	= 0x03,
+};
+#define RSL_CMOD_CRT_SDCCH	0x01
+#define RSL_CMOD_CRT_TCH_Bm	0x08	/* full-rate */
+#define RSL_CMOD_CRT_TCH_Lm	0x09	/* half-rate */
+/* FIXME: More CRT types */
+/* Speech */
+#define RSL_CMOD_SP_GSM1	0x01
+#define RSL_CMOD_SP_GSM2	0x11
+#define RSL_CMOD_SP_GSM3	0x21
+/* non-transparent data */
+#define RSL_CMOD_CSD_NT_43k5	0x74
+#define RSL_CMOD_CSD_NT_28k8	0x71
+#define RSL_CMOD_CSD_NT_14k5	0x58
+#define RSL_CMOD_CSD_NT_12k0	0x50
+#define RSL_CMOD_CSD_NT_6k0	0x51
+/* legacy #defines with wrong name */
+#define RSL_CMOD_SP_NT_14k5	RSL_CMOD_CSD_NT_14k5
+#define RSL_CMOD_SP_NT_12k0	RSL_CMOD_CSD_NT_12k0
+#define RSL_CMOD_SP_NT_6k0	RSL_CMOD_CSD_NT_6k0
+/* transparent data */
+#define RSL_CMOD_CSD_T_32000	0x38
+#define RSL_CMOD_CSD_T_29000	0x39
+#define RSL_CMOD_CSD_T_14400	0x18
+#define RSL_CMOD_CSD_T_9600	0x10
+#define RSL_CMOD_CSD_T_4800	0x11
+#define RSL_CMOD_CSD_T_2400	0x12
+#define RSL_CMOD_CSD_T_1200	0x13
+#define RSL_CMOD_CSD_T_600	0x14
+#define RSL_CMOD_CSD_T_1200_75	0x15
+
+/*! \brief RSL Channel Identification IE (Chapter 9.3.5) */
+struct rsl_ie_chan_ident {
+	/* GSM 04.08 10.5.2.5 */
+	struct {
+		uint8_t iei;
+		uint8_t chan_nr;	/* enc_chan_nr */
+		uint8_t oct3;
+		uint8_t oct4;
+	} chan_desc;
+#if 0	/* spec says we need this but Abissim doesn't use it */
+	struct {
+		uint8_t tag;
+		uint8_t len;
+	} mobile_alloc;
+#endif
+} __attribute__ ((packed));
+
+/* Chapter 9.3.22 */
+#define RLL_CAUSE_T200_EXPIRED		0x01
+#define RLL_CAUSE_REEST_REQ		0x02
+#define RLL_CAUSE_UNSOL_UA_RESP		0x03
+#define RLL_CAUSE_UNSOL_DM_RESP		0x04
+#define RLL_CAUSE_UNSOL_DM_RESP_MF	0x05
+#define RLL_CAUSE_UNSOL_SPRV_RESP	0x06
+#define RLL_CAUSE_SEQ_ERR		0x07
+#define RLL_CAUSE_UFRM_INC_PARAM	0x08
+#define RLL_CAUSE_SFRM_INC_PARAM	0x09
+#define RLL_CAUSE_IFRM_INC_MBITS	0x0a
+#define RLL_CAUSE_IFRM_INC_LEN		0x0b
+#define RLL_CAUSE_FRM_UNIMPL		0x0c
+#define RLL_CAUSE_SABM_MF		0x0d
+#define RLL_CAUSE_SABM_INFO_NOTALL	0x0e
+
+/* Chapter 9.3.26 */
+#define RSL_ERRCLS_NORMAL		0x00
+#define RSL_ERRCLS_RESOURCE_UNAVAIL	0x20
+#define RSL_ERRCLS_SERVICE_UNAVAIL	0x30
+#define RSL_ERRCLS_SERVICE_UNIMPL	0x40
+#define RSL_ERRCLS_INVAL_MSG		0x50
+#define RSL_ERRCLS_PROTO_ERROR		0x60
+#define RSL_ERRCLS_INTERWORKING		0x70
+
+/* normal event */
+#define RSL_ERR_RADIO_IF_FAIL		0x00
+#define RSL_ERR_RADIO_LINK_FAIL		0x01
+#define RSL_ERR_HANDOVER_ACC_FAIL	0x02
+#define RSL_ERR_TALKER_ACC_FAIL		0x03
+#define RSL_ERR_OM_INTERVENTION		0x07
+#define RSL_ERR_NORMAL_UNSPEC		0x0f
+#define RSL_ERR_T_MSRFPCI_EXP		0x18
+/* resource unavailable */
+#define RSL_ERR_EQUIPMENT_FAIL		0x20
+#define RSL_ERR_RR_UNAVAIL		0x21
+#define RSL_ERR_TERR_CH_FAIL		0x22
+#define RSL_ERR_CCCH_OVERLOAD		0x23
+#define RSL_ERR_ACCH_OVERLOAD		0x24
+#define RSL_ERR_PROCESSOR_OVERLOAD	0x25
+#define RSL_ERR_RES_UNAVAIL		0x2f
+/* service or option not available */
+#define RSL_ERR_TRANSC_UNAVAIL		0x30
+#define RSL_ERR_SERV_OPT_UNAVAIL	0x3f
+/* service or option not implemented */
+#define RSL_ERR_ENCR_UNIMPL		0x40
+#define RSL_ERR_SERV_OPT_UNIMPL		0x4f
+/* invalid message */
+#define RSL_ERR_RCH_ALR_ACTV_ALLOC	0x50
+#define RSL_ERR_INVALID_MESSAGE		0x5f
+/* protocol error */
+#define RSL_ERR_MSG_DISCR		0x60
+#define RSL_ERR_MSG_TYPE		0x61
+#define RSL_ERR_MSG_SEQ			0x62
+#define RSL_ERR_IE_ERROR		0x63
+#define RSL_ERR_MAND_IE_ERROR		0x64
+#define RSL_ERR_OPT_IE_ERROR		0x65
+#define RSL_ERR_IE_NONEXIST		0x66
+#define RSL_ERR_IE_LENGTH		0x67
+#define RSL_ERR_IE_CONTENT		0x68
+#define RSL_ERR_PROTO			0x6f
+/* interworking */
+#define RSL_ERR_INTERWORKING		0x7f
+
+/* Chapter 9.3.30 */
+#define RSL_SYSTEM_INFO_8	0x00
+#define RSL_SYSTEM_INFO_1	0x01
+#define RSL_SYSTEM_INFO_2	0x02
+#define RSL_SYSTEM_INFO_3	0x03
+#define RSL_SYSTEM_INFO_4	0x04
+#define RSL_SYSTEM_INFO_5	0x05
+#define RSL_SYSTEM_INFO_6	0x06
+#define RSL_SYSTEM_INFO_7	0x07
+#define RSL_SYSTEM_INFO_16	0x08
+#define RSL_SYSTEM_INFO_17	0x09
+#define RSL_SYSTEM_INFO_2bis	0x0a
+#define RSL_SYSTEM_INFO_2ter	0x0b
+#define RSL_SYSTEM_INFO_5bis	0x0d
+#define RSL_SYSTEM_INFO_5ter	0x0e
+#define RSL_SYSTEM_INFO_10	0x0f
+#define RSL_EXT_MEAS_ORDER	0x47
+#define RSL_MEAS_INFO		0x48
+#define RSL_SYSTEM_INFO_13	0x28
+#define RSL_SYSTEM_INFO_2quater	0x29
+#define RSL_SYSTEM_INFO_9	0x2a
+#define RSL_SYSTEM_INFO_18	0x2b
+#define RSL_SYSTEM_INFO_19	0x2c
+#define RSL_SYSTEM_INFO_20	0x2d
+
+/* Chapter 9.3.40 */
+#define RSL_CHANNEED_ANY	0x00
+#define RSL_CHANNEED_SDCCH	0x01
+#define RSL_CHANNEED_TCH_F	0x02
+#define RSL_CHANNEED_TCH_ForH	0x03
+
+/*! \brief RSL Cell Broadcast Command (Chapter 9.3.45) */
+struct rsl_ie_cb_cmd_type {
+	uint8_t last_block:2;
+	uint8_t spare:1;
+	uint8_t def_bcast:1;
+	uint8_t command:4;
+} __attribute__ ((packed));
+/* ->command */
+#define RSL_CB_CMD_TYPE_NORMAL		0x00
+#define RSL_CB_CMD_TYPE_SCHEDULE	0x08
+#define RSL_CB_CMD_TYPE_DEFAULT		0x0e
+#define RSL_CB_CMD_TYPE_NULL		0x0f
+/* ->def_bcast */
+#define RSL_CB_CMD_DEFBCAST_NORMAL	0
+#define RSL_CB_CMD_DEFBCAST_NULL	1
+/* ->last_block */
+#define RSL_CB_CMD_LASTBLOCK_4		0
+#define RSL_CB_CMD_LASTBLOCK_1		1
+#define RSL_CB_CMD_LASTBLOCK_2		2
+#define RSL_CB_CMD_LASTBLOCK_3		3
+
+/* Chapter 3.3.2.3 Brocast control channel */
+/* CCCH-CONF, NC is not combined */
+#define RSL_BCCH_CCCH_CONF_1_NC	0x00
+#define RSL_BCCH_CCCH_CONF_1_C	0x01
+#define RSL_BCCH_CCCH_CONF_2_NC	0x02
+#define RSL_BCCH_CCCH_CONF_3_NC	0x04
+#define RSL_BCCH_CCCH_CONF_4_NC	0x06
+
+/* BS-PA-MFRMS */
+#define RSL_BS_PA_MFRMS_2	0x00
+#define RSL_BS_PA_MFRMS_3	0x01
+#define RSL_BS_PA_MFRMS_4	0x02
+#define RSL_BS_PA_MFRMS_5	0x03
+#define RSL_BS_PA_MFRMS_6	0x04
+#define RSL_BS_PA_MFRMS_7	0x05
+#define RSL_BS_PA_MFRMS_8	0x06
+#define RSL_BS_PA_MFRMS_9	0x07
+
+/* RSL_IE_IPAC_RTP_PAYLOAD[2] */
+enum rsl_ipac_rtp_payload {
+	RSL_IPAC_RTP_GSM	= 1,
+	RSL_IPAC_RTP_EFR,
+	RSL_IPAC_RTP_AMR,
+	RSL_IPAC_RTP_CSD,
+	RSL_IPAC_RTP_MUX,
+};
+
+/* RSL_IE_IPAC_SPEECH_MODE, lower four bits */
+enum rsl_ipac_speech_mode_s {
+	RSL_IPAC_SPEECH_GSM_FR = 0,	/* GSM FR (Type 1, FS) */
+	RSL_IPAC_SPEECH_GSM_EFR = 1,	/* GSM EFR (Type 2, FS) */
+	RSL_IPAC_SPEECH_GSM_AMR_FR = 2,	/* GSM AMR/FR (Type 3, FS) */
+	RSL_IPAC_SPEECH_GSM_HR = 3,	/* GSM HR (Type 1, HS) */
+	RSL_IPAC_SPEECH_GSM_AMR_HR = 5,	/* GSM AMR/hr (Type 3, HS) */
+	RSL_IPAC_SPEECH_AS_RTP = 0xf,	/* As specified by RTP Payload IE */
+};
+/* RSL_IE_IPAC_SPEECH_MODE, upper four bits */
+enum rsl_ipac_speech_mode_m {
+	RSL_IPAC_SPEECH_M_RXTX = 0,	/* Send and Receive */
+	RSL_IPAC_SPEECH_M_RX = 1,	/* Receive only */
+	RSL_IPAC_SPEECH_M_TX = 2,	/* Send only */
+};
+
+/* RSL_IE_IPAC_RTP_CSD_FMT, lower four bits */
+enum rsl_ipac_rtp_csd_format_d {
+	RSL_IPAC_RTP_CSD_EXT_TRAU = 0,
+	RSL_IPAC_RTP_CSD_NON_TRAU = 1,
+	RSL_IPAC_RTP_CSD_TRAU_BTS = 2,
+	RSL_IPAC_RTP_CSD_IWF_FREE = 3,
+};
+/* RSL_IE_IPAC_RTP_CSD_FMT, upper four bits */
+enum rsl_ipac_rtp_csd_format_ir {
+	RSL_IPAC_RTP_CSD_IR_8k = 0,
+	RSL_IPAC_RTP_CSD_IR_16k = 1,
+	RSL_IPAC_RTP_CSD_IR_32k = 2,
+	RSL_IPAC_RTP_CSD_IR_64k = 3,
+};
+
+/* Siemens vendor-specific RSL extensions */
+struct rsl_mrpci {
+	uint8_t power_class:3,
+		 vgcs_capable:1,
+		 vbs_capable:1,
+		 gsm_phase:2;
+} __attribute__ ((packed));
+
+enum rsl_mrpci_pwrclass {
+	RSL_MRPCI_PWRC_1	= 0,
+	RSL_MRPCI_PWRC_2	= 1,
+	RSL_MRPCI_PWRC_3	= 2,
+	RSL_MRPCI_PWRC_4	= 3,
+	RSL_MRPCI_PWRC_5	= 4,
+};
+enum rsl_mrpci_phase {
+	RSL_MRPCI_PHASE_1	= 0,
+	/* reserved */
+	RSL_MRPCI_PHASE_2	= 2,
+	RSL_MRPCI_PHASE_2PLUS	= 3,
+};
+
+/*! @} */
+
+#endif /* PROTO_GSM_08_58_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_12_21.h b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_12_21.h
new file mode 100644
index 00000000..694df938
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_12_21.h
@@ -0,0 +1,748 @@
+#ifndef PROTO_GSM_12_21_H
+#define PROTO_GSM_12_21_H
+
+/* GSM Network Management messages on the A-bis interface 
+ * 3GPP TS 12.21 version 8.0.0 Release 1999 / ETSI TS 100 623 V8.0.0 */
+
+/* (C) 2008-2009 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \addtogroup oml
+ *  @{
+ */
+
+/*! \file gsm_12_21.h */
+
+#include <stdint.h>
+#include <osmocom/gsm/tlv.h>
+
+/*! \brief generic header in front of every OML message according to TS 08.59 */
+struct abis_om_hdr {
+	/*! \brief Message Discriminator \ref abis_oml_mdisc */
+	uint8_t	mdisc;
+	/*! \brief Placement (like \ref ABIS_OM_PLACEMENT_ONLY) */
+	uint8_t	placement;
+	/*! \brief Sequence Number (if \ref ABIS_OM_PLACEMENT_MIDDLE) */
+	uint8_t	sequence;
+	/*! \brief Length in octets */
+	uint8_t	length;
+	/*! \brief actual payload data */
+	uint8_t	data[0];
+} __attribute__ ((packed));
+
+/*! \brief Message Discriminator for Formatted Object Messages */
+#define ABIS_OM_MDISC_FOM		0x80
+/*! \brief Message Discriminator for Man Machine Interface */
+#define ABIS_OM_MDISC_MMI		0x40
+/*! \brief Message Discriminator for TRAU management */
+#define ABIS_OM_MDISC_TRAU		0x20
+/*! \brief Message Discriminator for Manufacturer Specific Messages */
+#define ABIS_OM_MDISC_MANUF		0x10
+
+/*! \brief Entire OML message is in the L2 frame */
+#define ABIS_OM_PLACEMENT_ONLY		0x80
+/*! \brief First fragment of OML message is in this L2 frame */
+#define ABIS_OM_PLACEMENT_FIRST 	0x40
+/*! \brief Middle fragment of OML message is in this L2 frame */
+#define ABIS_OM_PLACEMENT_MIDDLE	0x20
+/*! \brief Last fragment of OML message is in this L2 frame */
+#define ABIS_OM_PLACEMENT_LAST		0x10
+
+/*! \brief OML Object Instance */
+struct abis_om_obj_inst {
+	uint8_t	bts_nr;	/*!< \brief BTS Number */
+	uint8_t	trx_nr;	/*!< \brief TRX Number */
+	uint8_t	ts_nr;	/*!< \brief Timeslot Number */
+} __attribute__ ((packed));
+
+/*! \brief OML Object Instance */
+struct abis_om_fom_hdr {
+	uint8_t	msg_type;	/*!< \brief Message Type (\ref abis_nm_msgtype) */
+	uint8_t	obj_class;	/*!< \brief Object Class (\ref abis_nm_obj_class) */
+	struct abis_om_obj_inst	obj_inst; /*!< \brief Object Instance */
+	uint8_t	data[0];	/*!< \brief Data */
+} __attribute__ ((packed));
+
+/*! \brief Size of the OML FOM header in octets */
+#define ABIS_OM_FOM_HDR_SIZE	(sizeof(struct abis_om_hdr) + sizeof(struct abis_om_fom_hdr))
+
+/*! \brief OML Message Type (Section 9.1) */
+enum abis_nm_msgtype {
+	/* SW Download Management Messages */
+	NM_MT_LOAD_INIT			= 0x01,
+	NM_MT_LOAD_INIT_ACK,
+	NM_MT_LOAD_INIT_NACK,
+	NM_MT_LOAD_SEG,
+	NM_MT_LOAD_SEG_ACK,
+	NM_MT_LOAD_ABORT,
+	NM_MT_LOAD_END,
+	NM_MT_LOAD_END_ACK,
+	NM_MT_LOAD_END_NACK,
+	NM_MT_SW_ACT_REQ,		/* BTS->BSC */
+	NM_MT_SW_ACT_REQ_ACK,
+	NM_MT_SW_ACT_REQ_NACK,
+	NM_MT_ACTIVATE_SW,		/* BSC->BTS */
+	NM_MT_ACTIVATE_SW_ACK,
+	NM_MT_ACTIVATE_SW_NACK,
+	NM_MT_SW_ACTIVATED_REP,		/* 0x10 */
+	/* A-bis Interface Management Messages */
+	NM_MT_ESTABLISH_TEI		= 0x21,
+	NM_MT_ESTABLISH_TEI_ACK,
+	NM_MT_ESTABLISH_TEI_NACK,
+	NM_MT_CONN_TERR_SIGN,
+	NM_MT_CONN_TERR_SIGN_ACK,
+	NM_MT_CONN_TERR_SIGN_NACK,
+	NM_MT_DISC_TERR_SIGN,
+	NM_MT_DISC_TERR_SIGN_ACK,
+	NM_MT_DISC_TERR_SIGN_NACK,
+	NM_MT_CONN_TERR_TRAF,
+	NM_MT_CONN_TERR_TRAF_ACK,
+	NM_MT_CONN_TERR_TRAF_NACK,
+	NM_MT_DISC_TERR_TRAF,
+	NM_MT_DISC_TERR_TRAF_ACK,
+	NM_MT_DISC_TERR_TRAF_NACK,
+	/* Transmission Management Messages */
+	NM_MT_CONN_MDROP_LINK		= 0x31,
+	NM_MT_CONN_MDROP_LINK_ACK,
+	NM_MT_CONN_MDROP_LINK_NACK,
+	NM_MT_DISC_MDROP_LINK,
+	NM_MT_DISC_MDROP_LINK_ACK,
+	NM_MT_DISC_MDROP_LINK_NACK,
+	/* Air Interface Management Messages */
+	NM_MT_SET_BTS_ATTR		= 0x41,
+	NM_MT_SET_BTS_ATTR_ACK,
+	NM_MT_SET_BTS_ATTR_NACK,
+	NM_MT_SET_RADIO_ATTR,
+	NM_MT_SET_RADIO_ATTR_ACK,
+	NM_MT_SET_RADIO_ATTR_NACK,
+	NM_MT_SET_CHAN_ATTR,
+	NM_MT_SET_CHAN_ATTR_ACK,
+	NM_MT_SET_CHAN_ATTR_NACK,
+	/* Test Management Messages */
+	NM_MT_PERF_TEST			= 0x51,
+	NM_MT_PERF_TEST_ACK,
+	NM_MT_PERF_TEST_NACK,
+	NM_MT_TEST_REP,
+	NM_MT_SEND_TEST_REP,
+	NM_MT_SEND_TEST_REP_ACK,
+	NM_MT_SEND_TEST_REP_NACK,
+	NM_MT_STOP_TEST,
+	NM_MT_STOP_TEST_ACK,
+	NM_MT_STOP_TEST_NACK,
+	/* State Management and Event Report Messages */
+	NM_MT_STATECHG_EVENT_REP	= 0x61,
+	NM_MT_FAILURE_EVENT_REP,
+	NM_MT_STOP_EVENT_REP,
+	NM_MT_STOP_EVENT_REP_ACK,
+	NM_MT_STOP_EVENT_REP_NACK,
+	NM_MT_REST_EVENT_REP,
+	NM_MT_REST_EVENT_REP_ACK,
+	NM_MT_REST_EVENT_REP_NACK,
+	NM_MT_CHG_ADM_STATE,
+	NM_MT_CHG_ADM_STATE_ACK,
+	NM_MT_CHG_ADM_STATE_NACK,
+	NM_MT_CHG_ADM_STATE_REQ,
+	NM_MT_CHG_ADM_STATE_REQ_ACK,
+	NM_MT_CHG_ADM_STATE_REQ_NACK,
+	NM_MT_REP_OUTST_ALARMS		= 0x93,
+	NM_MT_REP_OUTST_ALARMS_ACK,
+	NM_MT_REP_OUTST_ALARMS_NACK,
+	/* Equipment Management Messages */
+	NM_MT_CHANGEOVER		= 0x71,
+	NM_MT_CHANGEOVER_ACK,
+	NM_MT_CHANGEOVER_NACK,
+	NM_MT_OPSTART,
+	NM_MT_OPSTART_ACK,
+	NM_MT_OPSTART_NACK,
+	NM_MT_REINIT,
+	NM_MT_REINIT_ACK,
+	NM_MT_REINIT_NACK,
+	NM_MT_SET_SITE_OUT,		/* BS11: get alarm ?!? */
+	NM_MT_SET_SITE_OUT_ACK,
+	NM_MT_SET_SITE_OUT_NACK,
+	NM_MT_CHG_HW_CONF		= 0x90,
+	NM_MT_CHG_HW_CONF_ACK,
+	NM_MT_CHG_HW_CONF_NACK,
+	/* Measurement Management Messages */
+	NM_MT_MEAS_RES_REQ		= 0x8a,
+	NM_MT_MEAS_RES_RESP,
+	NM_MT_STOP_MEAS,
+	NM_MT_START_MEAS,
+	/* Other Messages */
+	NM_MT_GET_ATTR			= 0x81,
+	NM_MT_GET_ATTR_RESP,
+	NM_MT_GET_ATTR_NACK,
+	NM_MT_SET_ALARM_THRES,
+	NM_MT_SET_ALARM_THRES_ACK,
+	NM_MT_SET_ALARM_THRES_NACK,
+};
+
+/*! \brief Siemens specific OML Message Types */
+enum abis_nm_msgtype_bs11 {
+	NM_MT_BS11_RESET_RESOURCE	= 0x74,
+
+	NM_MT_BS11_BEGIN_DB_TX		= 0xa3,
+	NM_MT_BS11_BEGIN_DB_TX_ACK,
+	NM_MT_BS11_BEGIN_DB_TX_NACK,
+	NM_MT_BS11_END_DB_TX		= 0xa6,
+	NM_MT_BS11_END_DB_TX_ACK,
+	NM_MT_BS11_END_DB_TX_NACK,
+	NM_MT_BS11_CREATE_OBJ		= 0xa9,
+	NM_MT_BS11_CREATE_OBJ_ACK,
+	NM_MT_BS11_CREATE_OBJ_NACK,
+	NM_MT_BS11_DELETE_OBJ		= 0xac,
+	NM_MT_BS11_DELETE_OBJ_ACK,
+	NM_MT_BS11_DELETE_OBJ_NACK,
+
+	NM_MT_BS11_SET_ATTR		= 0xd0,
+	NM_MT_BS11_SET_ATTR_ACK,
+	NM_MT_BS11_SET_ATTR_NACK,
+	NM_MT_BS11_LMT_SESSION		= 0xdc,
+
+	NM_MT_BS11_GET_STATE		= 0xe3,
+	NM_MT_BS11_GET_STATE_ACK,
+	NM_MT_BS11_LMT_LOGON		= 0xe5,
+	NM_MT_BS11_LMT_LOGON_ACK,
+	NM_MT_BS11_RESTART		= 0xe7,
+	NM_MT_BS11_RESTART_ACK,
+	NM_MT_BS11_DISCONNECT		= 0xe9,
+	NM_MT_BS11_DISCONNECT_ACK,
+	NM_MT_BS11_LMT_LOGOFF		= 0xec,
+	NM_MT_BS11_LMT_LOGOFF_ACK,
+	NM_MT_BS11_RECONNECT		= 0xf1,
+	NM_MT_BS11_RECONNECT_ACK,
+};
+
+/*! \brief ip.access specific OML Message Types */
+enum abis_nm_msgtype_ipacc {
+	NM_MT_IPACC_RESTART		= 0x87,
+	NM_MT_IPACC_RESTART_ACK,
+	NM_MT_IPACC_RESTART_NACK,
+	NM_MT_IPACC_RSL_CONNECT		= 0xe0,
+	NM_MT_IPACC_RSL_CONNECT_ACK,
+	NM_MT_IPACC_RSL_CONNECT_NACK,
+	NM_MT_IPACC_RSL_DISCONNECT	= 0xe3,
+	NM_MT_IPACC_RSL_DISCONNECT_ACK,
+	NM_MT_IPACC_RSL_DISCONNECT_NACK,
+	NM_MT_IPACC_CONN_TRAF		= 0xe6,
+	NM_MT_IPACC_CONN_TRAF_ACK,
+	NM_MT_IPACC_CONN_TRAF_NACK,
+	NM_MT_IPACC_DEF_BOOT_SW		= 0xec,
+	NM_MT_IPACC_DEF_BOOT_SW_ACK,
+	MN_MT_IPACC_DEF_BOOT_SW_NACK,
+	NM_MT_IPACC_SET_NVATTR		= 0xef,
+	NM_MT_IPACC_SET_NVATTR_ACK,
+	NM_MT_IPACC_SET_NVATTR_NACK,
+	NM_MT_IPACC_GET_NVATTR		= 0xf2,
+	NM_MT_IPACC_GET_NVATTR_ACK,
+	NM_MT_IPACC_GET_NVATTR_NACK,
+	NM_MT_IPACC_SET_ATTR		= 0xf5,
+	NM_MT_IPACC_SET_ATTR_ACK,
+	NM_MT_IPACC_SET_ATTR_NACK,
+};
+
+enum abis_nm_bs11_cell_alloc {
+	NM_BS11_CANR_GSM	= 0x00,
+	NM_BS11_CANR_DCS1800	= 0x01,
+};
+
+/*! \brief OML Object Class (Section 9.2) */
+enum abis_nm_obj_class {
+	NM_OC_SITE_MANAGER		= 0x00,
+	NM_OC_BTS,
+	NM_OC_RADIO_CARRIER,
+	NM_OC_CHANNEL,
+	NM_OC_BASEB_TRANSC,
+	/* RFU: 05-FE */
+
+	NM_OC_IPAC_E1_TRUNK		= 0x0e,
+	NM_OC_IPAC_E1_PORT		= 0x0f,
+	NM_OC_IPAC_E1_CHAN		= 0x10,
+	NM_OC_IPAC_CLK_MODULE		= 0x22,
+
+	NM_OC_BS11_ADJC			= 0xa0,
+	NM_OC_BS11_HANDOVER		= 0xa1,
+	NM_OC_BS11_PWR_CTRL		= 0xa2,
+	NM_OC_BS11_BTSE			= 0xa3,		/* LMT? */
+	NM_OC_BS11_RACK			= 0xa4,
+	NM_OC_BS11			= 0xa5,		/* 01: ALCO */
+	NM_OC_BS11_TEST			= 0xa6,
+	NM_OC_BS11_ENVABTSE		= 0xa8,
+	NM_OC_BS11_BPORT		= 0xa9,
+
+	NM_OC_GPRS_NSE			= 0xf0,
+	NM_OC_GPRS_CELL			= 0xf1,
+	NM_OC_GPRS_NSVC			= 0xf2,
+
+	NM_OC_NULL			= 0xff,
+};
+
+/*! \brief OML Attributes / IEs (Section 9.4) */
+enum abis_nm_attr {
+	NM_ATT_ABIS_CHANNEL	= 0x01,
+	NM_ATT_ADD_INFO,
+	NM_ATT_ADD_TEXT,
+	NM_ATT_ADM_STATE,
+	NM_ATT_ARFCN_LIST,
+	NM_ATT_AUTON_REPORT,
+	NM_ATT_AVAIL_STATUS,
+	NM_ATT_BCCH_ARFCN,
+	NM_ATT_BSIC,
+	NM_ATT_BTS_AIR_TIMER,
+	NM_ATT_CCCH_L_I_P,
+	NM_ATT_CCCH_L_T,
+	NM_ATT_CHAN_COMB,
+	NM_ATT_CONN_FAIL_CRIT,
+	NM_ATT_DEST,
+	/* res */
+	NM_ATT_EVENT_TYPE	= 0x11, /* BS11: file data ?!? */
+	NM_ATT_FILE_ID,
+	NM_ATT_FILE_VERSION,
+	NM_ATT_GSM_TIME,
+	NM_ATT_HSN,
+	NM_ATT_HW_CONFIG,
+	NM_ATT_HW_DESC,
+	NM_ATT_INTAVE_PARAM,
+	NM_ATT_INTERF_BOUND,
+	NM_ATT_LIST_REQ_ATTR,
+	NM_ATT_MAIO,
+	NM_ATT_MANUF_STATE,
+	NM_ATT_MANUF_THRESH,
+	NM_ATT_MANUF_ID,
+	NM_ATT_MAX_TA,
+	NM_ATT_MDROP_LINK,	/* 0x20 */
+	NM_ATT_MDROP_NEXT,
+	NM_ATT_NACK_CAUSES,
+	NM_ATT_NY1,
+	NM_ATT_OPER_STATE,
+	NM_ATT_OVERL_PERIOD,
+	NM_ATT_PHYS_CONF,
+	NM_ATT_POWER_CLASS,
+	NM_ATT_POWER_THRESH,
+	NM_ATT_PROB_CAUSE,
+	NM_ATT_RACH_B_THRESH,
+	NM_ATT_LDAVG_SLOTS,
+	NM_ATT_RAD_SUBC,
+	NM_ATT_RF_MAXPOWR_R,
+	NM_ATT_SITE_INPUTS,
+	NM_ATT_SITE_OUTPUTS,
+	NM_ATT_SOURCE,		/* 0x30 */
+	NM_ATT_SPEC_PROB,
+	NM_ATT_START_TIME,
+	NM_ATT_T200,
+	NM_ATT_TEI,
+	NM_ATT_TEST_DUR,
+	NM_ATT_TEST_NO,
+	NM_ATT_TEST_REPORT,
+	NM_ATT_VSWR_THRESH,
+	NM_ATT_WINDOW_SIZE,
+	/* Res  */
+	NM_ATT_BS11_RSSI_OFFS	= 0x3d,
+	NM_ATT_BS11_TXPWR	= 0x3e,
+	NM_ATT_BS11_DIVERSITY	= 0x3f,
+	/* Res  */
+	NM_ATT_TSC		= 0x40,
+	NM_ATT_SW_CONFIG,
+	NM_ATT_SW_DESCR,
+	NM_ATT_SEVERITY,
+	NM_ATT_GET_ARI,
+	NM_ATT_HW_CONF_CHG,
+	NM_ATT_OUTST_ALARM,
+	NM_ATT_FILE_DATA,
+	NM_ATT_MEAS_RES,
+	NM_ATT_MEAS_TYPE,
+
+	NM_ATT_BS11_ESN_FW_CODE_NO	= 0x4c,
+	NM_ATT_BS11_ESN_HW_CODE_NO	= 0x4f,
+
+	NM_ATT_BS11_ESN_PCB_SERIAL	= 0x55,
+	NM_ATT_BS11_EXCESSIVE_DISTANCE	= 0x58,
+
+	NM_ATT_BS11_ALL_TEST_CATG	= 0x60,
+	NM_ATT_BS11_BTSLS_HOPPING,
+	NM_ATT_BS11_CELL_ALLOC_NR,
+	NM_ATT_BS11_CELL_GLOBAL_ID,
+	NM_ATT_BS11_ENA_INTERF_CLASS	= 0x66,
+	NM_ATT_BS11_ENA_INT_INTEC_HANDO	= 0x67,
+	NM_ATT_BS11_ENA_INT_INTRC_HANDO	= 0x68,
+	NM_ATT_BS11_ENA_MS_PWR_CTRL	= 0x69,
+	NM_ATT_BS11_ENA_PWR_BDGT_HO	= 0x6a,
+	NM_ATT_BS11_ENA_PWR_CTRL_RLFW	= 0x6b,
+	NM_ATT_BS11_ENA_RXLEV_HO	= 0x6c,
+	NM_ATT_BS11_ENA_RXQUAL_HO	= 0x6d,
+	NM_ATT_BS11_FACCH_QUAL		= 0x6e,
+
+	NM_ATT_IPACC_DST_IP		= 0x80,
+	NM_ATT_IPACC_DST_IP_PORT	= 0x81,
+	NM_ATT_IPACC_SSRC		= 0x82,
+	NM_ATT_IPACC_RTP_PAYLD_TYPE	= 0x83,
+	NM_ATT_IPACC_BASEB_ID		= 0x84,
+	NM_ATT_IPACC_STREAM_ID		= 0x85,
+	NM_ATT_IPACC_NV_FLAGS		= 0x86,
+	NM_ATT_IPACC_FREQ_CTRL		= 0x87,
+	NM_ATT_IPACC_PRIM_OML_CFG	= 0x88,
+	NM_ATT_IPACC_SEC_OML_CFG	= 0x89,
+	NM_ATT_IPACC_IP_IF_CFG		= 0x8a,		/* IP interface */
+	NM_ATT_IPACC_IP_GW_CFG		= 0x8b,		/* IP gateway */
+	NM_ATT_IPACC_IN_SERV_TIME	= 0x8c,
+	NM_ATT_IPACC_TRX_BTS_ASS	= 0x8d,
+	NM_ATT_IPACC_LOCATION		= 0x8e,		/* string describing location */
+	NM_ATT_IPACC_PAGING_CFG		= 0x8f,
+	NM_ATT_IPACC_FILE_DATA		= 0x90,
+	NM_ATT_IPACC_UNIT_ID		= 0x91,		/* Site/BTS/TRX */
+	NM_ATT_IPACC_PARENT_UNIT_ID	= 0x92,
+	NM_ATT_IPACC_UNIT_NAME		= 0x93,		/* default: nbts-<mac-as-string> */
+	NM_ATT_IPACC_SNMP_CFG		= 0x94,
+	NM_ATT_IPACC_PRIM_OML_CFG_LIST	= 0x95,
+	NM_ATT_IPACC_PRIM_OML_FB_TOUT	= 0x96,
+	NM_ATT_IPACC_CUR_SW_CFG		= 0x97,
+	NM_ATT_IPACC_TIMING_BUS		= 0x98,
+	NM_ATT_IPACC_CGI		= 0x99,
+	NM_ATT_IPACC_RAC		= 0x9a,
+	NM_ATT_IPACC_OBJ_VERSION	= 0x9b,
+	NM_ATT_IPACC_GPRS_PAGING_CFG	= 0x9c,
+	NM_ATT_IPACC_NSEI		= 0x9d,
+	NM_ATT_IPACC_BVCI		= 0x9e,
+	NM_ATT_IPACC_NSVCI		= 0x9f,
+	NM_ATT_IPACC_NS_CFG		= 0xa0,
+	NM_ATT_IPACC_BSSGP_CFG		= 0xa1,
+	NM_ATT_IPACC_NS_LINK_CFG	= 0xa2,
+	NM_ATT_IPACC_RLC_CFG		= 0xa3,	
+	NM_ATT_IPACC_ALM_THRESH_LIST	= 0xa4,
+	NM_ATT_IPACC_MONIT_VAL_LIST	= 0xa5,
+	NM_ATT_IPACC_TIB_CONTROL	= 0xa6,
+	NM_ATT_IPACC_SUPP_FEATURES	= 0xa7,
+	NM_ATT_IPACC_CODING_SCHEMES	= 0xa8,
+	NM_ATT_IPACC_RLC_CFG_2		= 0xa9,
+	NM_ATT_IPACC_HEARTB_TOUT	= 0xaa,
+	NM_ATT_IPACC_UPTIME		= 0xab,
+	NM_ATT_IPACC_RLC_CFG_3		= 0xac,
+	NM_ATT_IPACC_SSL_CFG		= 0xad,
+	NM_ATT_IPACC_SEC_POSSIBLE	= 0xae,
+	NM_ATT_IPACC_IML_SSL_STATE	= 0xaf,
+	NM_ATT_IPACC_REVOC_DATE		= 0xb0,
+
+
+	NM_ATT_BS11_RF_RES_IND_PER	= 0x8f,
+	
+	NM_ATT_BS11_RX_LEV_MIN_CELL	= 0x90,
+	NM_ATT_BS11_ABIS_EXT_TIME	= 0x91,
+	NM_ATT_BS11_TIMER_HO_REQUEST	= 0x92,
+	NM_ATT_BS11_TIMER_NCELL		= 0x93,
+	NM_ATT_BS11_TSYNC		= 0x94,
+	NM_ATT_BS11_TTRAU		= 0x95,
+	NM_ATT_BS11_EMRG_CFG_MEMBER	= 0x9b,
+	NM_ATT_BS11_TRX_AREA		= 0x9f,
+
+	NM_ATT_BS11_BCCH_RECONF		= 0xd7,
+	NM_ATT_BS11_BIT_ERR_THESH	= 0xa0,
+	NM_ATT_BS11_BOOT_SW_VERS	= 0xa1,
+	NM_ATT_BS11_CCLK_ACCURACY	= 0xa3,
+	NM_ATT_BS11_CCLK_TYPE		= 0xa4,
+	NM_ATT_BS11_INP_IMPEDANCE	= 0xaa,
+	NM_ATT_BS11_L1_PROT_TYPE	= 0xab,
+	NM_ATT_BS11_LINE_CFG		= 0xac,
+	NM_ATT_BS11_LI_PORT_1		= 0xad,
+	NM_ATT_BS11_LI_PORT_2		= 0xae,
+
+	NM_ATT_BS11_L1_REM_ALM_TYPE	= 0xb0,
+	NM_ATT_BS11_SW_LOAD_INTENDED	= 0xbb,
+	NM_ATT_BS11_SW_LOAD_SAFETY	= 0xbc,
+	NM_ATT_BS11_SW_LOAD_STORED	= 0xbd,
+
+	NM_ATT_BS11_VENDOR_NAME		= 0xc1,
+	NM_ATT_BS11_HOPPING_MODE	= 0xc5,
+	NM_ATT_BS11_LMT_LOGON_SESSION	= 0xc6,
+	NM_ATT_BS11_LMT_LOGIN_TIME	= 0xc7,
+	NM_ATT_BS11_LMT_USER_ACC_LEV	= 0xc8,
+	NM_ATT_BS11_LMT_USER_NAME	= 0xc9,
+
+	NM_ATT_BS11_L1_CONTROL_TS	= 0xd8,
+	NM_ATT_BS11_RADIO_MEAS_GRAN	= 0xdc,	/* in SACCH multiframes */
+	NM_ATT_BS11_RADIO_MEAS_REP	= 0xdd,
+
+	NM_ATT_BS11_SH_LAPD_INT_TIMER	= 0xe8,
+
+	NM_ATT_BS11_BTS_STATE		= 0xf0,
+	NM_ATT_BS11_E1_STATE		= 0xf1,
+	NM_ATT_BS11_PLL			= 0xf2,
+	NM_ATT_BS11_RX_OFFSET		= 0xf3,
+	NM_ATT_BS11_ANT_TYPE		= 0xf4,
+	NM_ATT_BS11_PLL_MODE		= 0xfc,
+	NM_ATT_BS11_PASSWORD		= 0xfd,
+};
+#define NM_ATT_BS11_FILE_DATA	NM_ATT_EVENT_TYPE
+
+/*! \brief OML Administrative State (Section 9.4.4) */
+enum abis_nm_adm_state {
+	NM_STATE_LOCKED		= 0x01,
+	NM_STATE_UNLOCKED	= 0x02,
+	NM_STATE_SHUTDOWN	= 0x03,
+	NM_STATE_NULL		= 0xff,
+};
+
+/*! \brief OML Availability State (Section 9.4.7) */
+enum abis_nm_avail_state {
+	NM_AVSTATE_IN_TEST	= 1,
+	NM_AVSTATE_POWER_OFF	= 2,
+	NM_AVSTATE_OFF_LINE	= 3,
+	NM_AVSTATE_DEPENDENCY	= 5,
+	NM_AVSTATE_DEGRADED	= 6,
+	NM_AVSTATE_NOT_INSTALLED= 7,
+	NM_AVSTATE_OK		= 0xff,
+};
+
+/*! \brief OML Operational State */
+enum abis_nm_op_state {
+	NM_OPSTATE_DISABLED	= 1,
+	NM_OPSTATE_ENABLED	= 2,
+	NM_OPSTATE_NULL		= 0xff,
+};
+
+/* \brief Channel Combination (Section 9.4.13) */
+enum abis_nm_chan_comb {
+	NM_CHANC_TCHFull	= 0x00,	/* TCH/F + TCH/H + SACCH/TF */
+	NM_CHANC_TCHHalf	= 0x01, /* TCH/H(0,1) + FACCH/H(0,1) +
+					   SACCH/TH(0,1) */
+	NM_CHANC_TCHHalf2	= 0x02, /* TCH/H(0) + FACCH/H(0) + SACCH/TH(0) +
+					   TCH/H(1) */
+	NM_CHANC_SDCCH		= 0x03,	/* SDCCH/8 + SACCH/8 */
+	NM_CHANC_mainBCCH	= 0x04,	/* FCCH + SCH + BCCH + CCCH */
+	NM_CHANC_BCCHComb	= 0x05,	/* FCCH + SCH + BCCH + CCCH + SDCCH/4 +
+					   SACCH/C4 */
+	NM_CHANC_BCCH		= 0x06,	/* BCCH + CCCH */
+	NM_CHANC_BCCH_CBCH	= 0x07,	/* CHANC_BCCHComb + CBCH */
+	NM_CHANC_SDCCH_CBCH	= 0x08,	/* CHANC_SDCCH8 + CBCH */
+	/* ip.access */
+	NM_CHANC_IPAC_bPDCH	= 0x0b,	/* PBCCH + PCCCH + PDTCH/F + PACCH/F +
+					   PTCCH/F */
+	NM_CHANC_IPAC_cPDCH	= 0x0c, /* PBCCH + PDTCH/F + PACCH/F + PTCCH/F */
+	NM_CHANC_IPAC_PDCH	= 0x0d,	/* PDTCH/F + PACCH/F + PTCCH/F */
+	NM_CHANC_IPAC_TCHFull_PDCH = 0x80,
+	NM_CHANC_IPAC_TCHFull_TCHHalf = 0x81,
+};
+
+/*! \brief Event Type (Section 9.4.16) */
+enum abis_nm_event_type {
+	NM_EVT_COMM_FAIL	= 0x00,
+	NM_EVT_QOS_FAIL		= 0x01,
+	NM_EVT_PROC_FAIL	= 0x02,
+	NM_EVT_EQUIP_FAIL	= 0x03,
+	NM_EVT_ENV_FAIL		= 0x04,
+};
+
+/*! \brief Perceived Severity (Section: 9.4.63) */
+enum abis_nm_severity {
+	NM_SEVER_CEASED		= 0x00,
+	NM_SEVER_CRITICAL	= 0x01,
+	NM_SEVER_MAJOR		= 0x02,
+	NM_SEVER_MINOR		= 0x03,
+	NM_SEVER_WARNING	= 0x04,
+	NM_SEVER_INDETERMINATE	= 0x05,
+};
+
+/*! \brief Probable Cause Type (Section 9.4.43) */
+enum abis_nm_pcause_type {
+	NM_PCAUSE_T_X721	= 0x01,
+	NM_PCAUSE_T_GSM		= 0x02,
+	NM_PCAUSE_T_MANUF	= 0x03,
+};
+
+/*! \brief NACK causes (Section 9.4.36) */
+enum abis_nm_nack_cause {
+	/* General Nack Causes */
+	NM_NACK_INCORR_STRUCT		= 0x01,
+	NM_NACK_MSGTYPE_INVAL		= 0x02,
+	NM_NACK_OBJCLASS_INVAL		= 0x05,
+	NM_NACK_OBJCLASS_NOTSUPP	= 0x06,
+	NM_NACK_BTSNR_UNKN		= 0x07,
+	NM_NACK_TRXNR_UNKN		= 0x08,
+	NM_NACK_OBJINST_UNKN		= 0x09,
+	NM_NACK_ATTRID_INVAL		= 0x0c,
+	NM_NACK_ATTRID_NOTSUPP		= 0x0d,
+	NM_NACK_PARAM_RANGE		= 0x0e,
+	NM_NACK_ATTRLIST_INCONSISTENT	= 0x0f,
+	NM_NACK_SPEC_IMPL_NOTSUPP	= 0x10,
+	NM_NACK_CANT_PERFORM		= 0x11,
+	/* Specific Nack Causes */
+	NM_NACK_RES_NOTIMPL		= 0x19,
+	NM_NACK_RES_NOTAVAIL		= 0x1a,
+	NM_NACK_FREQ_NOTAVAIL		= 0x1b,
+	NM_NACK_TEST_NOTSUPP		= 0x1c,
+	NM_NACK_CAPACITY_RESTR		= 0x1d,
+	NM_NACK_PHYSCFG_NOTPERFORM	= 0x1e,
+	NM_NACK_TEST_NOTINIT		= 0x1f,
+	NM_NACK_PHYSCFG_NOTRESTORE	= 0x20,
+	NM_NACK_TEST_NOSUCH		= 0x21,
+	NM_NACK_TEST_NOSTOP		= 0x22,
+	NM_NACK_MSGINCONSIST_PHYSCFG	= 0x23,
+	NM_NACK_FILE_INCOMPLETE		= 0x25,
+	NM_NACK_FILE_NOTAVAIL		= 0x26,
+	NM_NACK_FILE_NOTACTIVATE	= 0x27,
+	NM_NACK_REQ_NOT_GRANT		= 0x28,
+	NM_NACK_WAIT			= 0x29,
+	NM_NACK_NOTH_REPORT_EXIST	= 0x2a,
+	NM_NACK_MEAS_NOTSUPP		= 0x2b,
+	NM_NACK_MEAS_NOTSTART		= 0x2c,
+};
+
+/*! \brief Abis OML Channel (Section 9.4.1) */
+struct abis_nm_channel {
+	uint8_t	attrib;
+	uint8_t	bts_port;	/*!< \brief BTS port number */
+	uint8_t	timeslot;	/*!< \brief E1 timeslot */
+	uint8_t	subslot;	/*!< \brief E1 sub-slot */
+} __attribute__ ((packed));
+
+/*! \brief Siemens BS-11 specific objects in the SienemsHW (0xA5) object class */
+enum abis_bs11_objtype {
+	BS11_OBJ_ALCO		= 0x01,
+	BS11_OBJ_BBSIG		= 0x02,	/* obj_class: 0,1 */
+	BS11_OBJ_TRX1		= 0x03,	/* only DEACTIVATE TRX1 */
+	BS11_OBJ_CCLK		= 0x04,
+	BS11_OBJ_GPSU		= 0x06,
+	BS11_OBJ_LI		= 0x07,
+	BS11_OBJ_PA		= 0x09,	/* obj_class: 0, 1*/
+};
+
+/*! \brief Siemens BS11 TRX power */
+enum abis_bs11_trx_power {
+	BS11_TRX_POWER_GSM_2W	= 0x06,
+	BS11_TRX_POWER_GSM_250mW= 0x07,
+	BS11_TRX_POWER_GSM_80mW	= 0x08,
+	BS11_TRX_POWER_GSM_30mW	= 0x09,
+	BS11_TRX_POWER_DCS_3W	= 0x0a,
+	BS11_TRX_POWER_DCS_1W6	= 0x0b,
+	BS11_TRX_POWER_DCS_500mW= 0x0c,
+	BS11_TRX_POWER_DCS_160mW= 0x0d,
+};
+
+/*! \brief Siemens BS11 PLL mode */
+enum abis_bs11_li_pll_mode {
+	BS11_LI_PLL_LOCKED	= 2,
+	BS11_LI_PLL_STANDALONE	= 3,
+};
+
+/*! \brief Siemens BS11 E1 line configuration */
+enum abis_bs11_line_cfg {
+	BS11_LINE_CFG_STAR	= 0x00,
+	BS11_LINE_CFG_MULTIDROP	= 0x01,
+	BS11_LINE_CFG_LOOP	= 0x02,
+};
+
+/*! \brief Siemens BS11 boot phase */
+enum abis_bs11_phase {
+	BS11_STATE_SOFTWARE_RQD		= 0x01,
+	BS11_STATE_LOAD_SMU_INTENDED	= 0x11,
+	BS11_STATE_LOAD_SMU_SAFETY	= 0x21,
+	BS11_STATE_LOAD_FAILED		= 0x31,
+	BS11_STATE_LOAD_DIAGNOSTIC	= 0x41,
+	BS11_STATE_WARM_UP		= 0x51,
+	BS11_STATE_WARM_UP_2		= 0x52,
+	BS11_STATE_WAIT_MIN_CFG		= 0x62,
+	BS11_STATE_MAINTENANCE		= 0x72,
+	BS11_STATE_LOAD_MBCCU		= 0x92,
+	BS11_STATE_WAIT_MIN_CFG_2	= 0xA2,
+	BS11_STATE_NORMAL		= 0x03,
+	BS11_STATE_ABIS_LOAD		= 0x13,
+};
+
+/*! \brief ip.access test number */
+enum abis_nm_ipacc_test_no {
+	NM_IPACC_TESTNO_RLOOP_ANT	= 0x01,
+	NM_IPACC_TESTNO_RLOOP_XCVR	= 0x02,
+	NM_IPACC_TESTNO_FUNC_OBJ	= 0x03,
+	NM_IPACC_TESTNO_CHAN_USAGE	= 0x40,
+	NM_IPACC_TESTNO_BCCH_CHAN_USAGE	= 0x41,
+	NM_IPACC_TESTNO_FREQ_SYNC	= 0x42,
+	NM_IPACC_TESTNO_BCCH_INFO	= 0x43,
+	NM_IPACC_TESTNO_TX_BEACON	= 0x44,
+	NM_IPACC_TESTNO_SYSINFO_MONITOR	= 0x45,
+	NM_IPACC_TESTNO_BCCCH_MONITOR	= 0x46,
+};
+
+/*! \brief first byte after length inside NM_ATT_TEST_REPORT */
+enum abis_nm_ipacc_test_res {
+	NM_IPACC_TESTRES_SUCCESS	= 0,
+	NM_IPACC_TESTRES_TIMEOUT	= 1,
+	NM_IPACC_TESTRES_NO_CHANS	= 2,
+	NM_IPACC_TESTRES_PARTIAL	= 3,
+	NM_IPACC_TESTRES_STOPPED	= 4,
+};
+
+/*! \brief internal IE inside NM_ATT_TEST_REPORT */
+enum abis_nm_ipacc_testres_ie {
+	NM_IPACC_TR_IE_FREQ_ERR_LIST	= 3,
+	NM_IPACC_TR_IE_CHAN_USAGE	= 4,
+	NM_IPACC_TR_IE_BCCH_INFO	= 6,
+	NM_IPACC_TR_IE_RESULT_DETAILS	= 8,
+	NM_IPACC_TR_IE_FREQ_ERR		= 18,
+};
+
+/*! \brief ip.access IEI */
+enum ipac_eie {
+	NM_IPAC_EIE_ARFCN_WHITE		= 0x01,
+	NM_IPAC_EIE_ARFCH_BLACK		= 0x02,
+	NM_IPAC_EIE_FREQ_ERR_LIST	= 0x03,
+	NM_IPAC_EIE_CHAN_USE_LIST	= 0x04,
+	NM_IPAC_EIE_BCCH_INFO_TYPE	= 0x05,
+	NM_IPAC_EIE_BCCH_INFO		= 0x06,
+	NM_IPAC_EIE_CONFIG		= 0x07,
+	NM_IPAC_EIE_RES_DETAILS		= 0x08,
+	NM_IPAC_EIE_RXLEV_THRESH	= 0x09,
+	NM_IPAC_EIE_FREQ_SYNC_OPTS	= 0x0a,
+	NM_IPAC_EIE_MAC_ADDR		= 0x0b,
+	NM_IPAC_EIE_HW_SW_COMPAT_NR	= 0x0c,
+	NM_IPAC_EIE_MANUF_SER_NR	= 0x0d,
+	NM_IPAC_EIE_OEM_ID		= 0x0e,
+	NM_IPAC_EIE_DATE_TIME_MANUF	= 0x0f,
+	NM_IPAC_EIE_DATE_TIME_CALIB	= 0x10,
+	NM_IPAC_EIE_BEACON_INFO		= 0x11,
+	NM_IPAC_EIE_FREQ_ERR		= 0x12,
+	/* FIXME */
+	NM_IPAC_EIE_FREQ_BANDS		= 0x1c,
+	NM_IPAC_EIE_MAX_TA		= 0x1d,
+	NM_IPAC_EIE_CIPH_ALGOS		= 0x1e,
+	NM_IPAC_EIE_CHAN_TYPES		= 0x1f,
+	NM_IPAC_EIE_CHAN_MODES		= 0x20,
+	NM_IPAC_EIE_GPRS_CODING		= 0x21,
+	NM_IPAC_EIE_RTP_FEATURES	= 0x22,
+	NM_IPAC_EIE_RSL_FEATURES	= 0x23,
+	NM_IPAC_EIE_BTS_HW_CLASS	= 0x24,
+	NM_IPAC_EIE_BTS_ID		= 0x25,
+};
+
+/*! \brief ip.access NWL BCCH information type */
+enum ipac_bcch_info_type {
+	IPAC_BINF_RXLEV			= (1 << 8),
+	IPAC_BINF_RXQUAL		= (1 << 9),
+	IPAC_BINF_FREQ_ERR_QUAL		= (1 << 10),
+	IPAC_BINF_FRAME_OFFSET		= (1 << 11),
+	IPAC_BINF_FRAME_NR_OFFSET	= (1 << 12),
+	IPAC_BINF_BSIC			= (1 << 13),
+	IPAC_BINF_CGI			= (1 << 14),
+	IPAC_BINF_NEIGH_BA_SI2		= (1 << 15),
+	IPAC_BINF_NEIGH_BA_SI2bis	= (1 << 0),
+	IPAC_BINF_NEIGH_BA_SI2ter	= (1 << 1),
+	IPAC_BINF_CELL_ALLOC		= (1 << 2),
+};
+
+/*! @} */
+
+#endif /* PROTO_GSM_12_21_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_44_318.h b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_44_318.h
new file mode 100644
index 00000000..cd5ec05a
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/protocol/gsm_44_318.h
@@ -0,0 +1,200 @@
+#ifndef PROTO_GSM_44_318_H
+#define PROTO_GSM_44_318_H
+
+#include <stdint.h>
+
+/* Definitions according to 3GPP TS 44.318 6.8.0 Release 6 */
+
+/* Table 11.1.1.2.1: Protocol Discriminator */
+enum gan_pdisc {
+	GA_PDISC_RC			= 0,
+	GA_PDISC_CSR			= 1,
+	GA_PDISC_PSR			= 2,
+};
+
+/* Table 11.1.1.4.1: Message types for URR */
+
+enum gan_msg_type {
+	GA_MT_RC_DISCOVERY_REQUEST	= 0x01,
+	GA_MT_RC_DISCOVERY_ACCEPT	= 0x02,
+	GA_MT_RC_DISCOVERY_REJECT	= 0x03,
+
+	GA_MT_RC_REGISTER_REQUEST	= 0x10,
+	GA_MT_RC_REGISTER_ACCEPT	= 0x11,
+	GA_MT_RC_REGISTER_REDIRECT	= 0x12,
+	GA_MT_RC_REGISTER_REJECT	= 0x13,
+	GA_MT_RC_DEREGISTER		= 0x14,
+	GA_MT_RC_REGISTER_UPDATE_UL	= 0x15,
+	GA_MT_RC_REGISTER_UPDATE_DL	= 0x16,
+	GA_MT_RC_CELL_BCAST_INFO	= 0x17,
+
+	GA_MT_CSR_CIPH_MODE_CMD		= 0x20,
+	GA_MT_CSR_CIPH_MODE_COMPL	= 0x21,
+
+	GA_MT_CSR_ACT_CHAN		= 0x30,
+	GA_MT_CSR_ACT_CHAN_ACK		= 0x31,
+	GA_MT_CSR_ACT_CHAN_COMPL	= 0x32,
+	GA_MT_CSR_ACT_CHAN_FAIL		= 0x33,
+	GA_MT_CSR_CHAN_MODE_MOD		= 0x34,
+	GA_MT_CSR_CHAN_MODE_MOD_ACK	= 0x35,
+
+	GA_MT_CSR_RELEASE		= 0x40,
+	GA_MT_CSR_RELEASE_COMPL		= 0x41,
+	GA_MT_CSR_CLEAR_REQ		= 0x42,
+
+	GA_MT_CSR_HO_ACCESS		= 0x50,
+	GA_MT_CSR_HO_COMPL		= 0x51,
+	GA_MT_CSR_UL_QUAL_IND		= 0x52,
+	GA_MT_CSR_HO_INFO		= 0x53,
+	GA_MT_CSR_HO_CMD		= 0x54,
+	GA_MT_CSR_HO_FAIL		= 0x55,
+
+	GA_MT_CSR_PAGING_REQ		= 0x60,
+	GA_MT_CSR_PAGING_RESP		= 0x61,
+
+	GA_MT_CSR_UL_DIRECT_XFER	= 0x70,
+	GA_MT_CSR_DL_DIRECT_XFER	= 0x72,
+	GA_MT_CSR_STATUS		= 0x73,
+	GA_MT_RC_KEEPALIVE		= 0x74,
+	GA_MT_CSR_CM_ENQ		= 0x75,
+	GA_MT_CSR_CM_CHANGE		= 0x76,
+	GA_MT_PSR_GPRS_SUSPEND_REQ	= 0x77,
+	GA_RC_SYNC_INFO			= 0x78,
+	GA_CSR_UTRAN_CM_CHG		= 0x79,
+
+	GA_MT_CSR_REQUEST		= 0x80,
+	GA_MT_CSR_REQUEST_ACCEPT	= 0x81,
+	GA_MT_CSR_REQUEST_REJECT	= 0x82,
+};
+
+/* All tables in 10.1.x and 10.2.x / Table 11.2.1 */
+enum gan_iei {
+	GA_IE_MI		= 1,
+	GA_IE_GAN_RELEASE_IND	= 2,
+	GA_IE_RADIO_IE		= 3,
+	GA_IE_GERAN_CELL_ID	= 4,
+	GA_IE_LAC		= 5,
+	GA_IE_GERAN_COV_IND	= 6,
+	GA_IE_GAN_CM		= 7,
+	GA_IE_GEO_LOC		= 8,
+	GA_IE_DEF_SEGW_IP	= 9,
+	GA_IE_DEF_SEGW_FQDN	= 10,
+	GA_IE_REDIR_CTR		= 11,
+	GA_IE_DISCOV_REJ_CAUSE	= 12,
+	GA_IE_GANC_CELL_DESC	= 13,
+	GA_IE_GANC_CTRL_CH_DESC	= 14,
+	GA_IE_GERAN_CELL_ID_LIST= 15,
+	GA_IE_TU3907_TIMER	= 16,
+	GA_IE_RR_STATE		= 17,
+	GA_IE_RAI		= 18,
+	GA_IE_GAN_BAND		= 19,
+	GA_IE_GARC_GACSR_STATE	= 20,
+	GA_IE_REG_REJ_CAUSE	= 21,
+	GA_IE_TU3906_TIMER	= 22,
+	GA_IE_TU3910_TIMER	= 23,
+	GA_IE_TU3902_TIMER	= 24,
+	GA_IE_L3_MSG		= 26,
+	GA_IE_CHAN_MODE		= 27,
+	GA_IE_MS_CLASSMARK2	= 28,
+	GA_IE_RR_CAUSE		= 29,
+	GA_EI_CIPH_MODE_SET	= 30,
+	GA_IE_GPRS_RESUMPTION	= 31,
+	GA_IE_HO_FROM_GAN_CMD	= 32,
+	GA_IE_UL_QUAL_IND	= 33,
+	GA_IE_TLLI		= 34,
+	GA_IE_PFI		= 35,
+	GA_IE_SUSP_CAUSE	= 36,
+	GA_IE_TU3920_TIMER	= 37,
+	GA_IE_REQD_QOS		= 38,
+	GA_IE_P_DEACT_CAUSE	= 39,
+	GA_IE_REQD_UL_RATE	= 40,
+	GA_IE_RAC		= 41,
+	GA_IE_AP_LOCATION	= 42,
+	GA_IE_TU4001_TIMER	= 43,
+	GA_IE_LOC_STATUS	= 44,
+	GA_IE_CIPH_RESP		= 45,
+	GA_IE_CIPH_RAND		= 46,
+	GA_IE_CIPH_MAC		= 47,
+	GA_IE_CKSN		= 48,
+	GA_IE_SAPI_ID		= 49,
+	GA_IE_EST_CAUSE		= 50,
+	GA_IE_CHAN_NEEDED	= 51,
+	GA_IE_PDU_IN_ERROR	= 52,
+	GA_IE_SAMPLE_SIZE	= 53,
+	GA_IE_PAYLOAD_TYPE	= 54,
+	GA_IE_MULTIRATE_CONF	= 55,
+	GA_IE_MS_CLASSMARK3	= 56,
+	GA_IE_LLC_PDU		= 57,
+	GA_IE_LOC_BLACKL_IND	= 58,
+	GA_IE_RESET_IND		= 59,
+	GA_IE_TU4003_TIMER	= 60,
+	GA_IE_AP_SERV_NAME	= 61,
+	GA_IE_SERV_ZONE_INFO	= 62,
+	GA_IE_RTP_RED_CONF	= 63,
+	GA_IE_UTRAN_CLASSMARK	= 64,
+	GA_IE_CM_ENQ_MASK	= 65,
+	GA_IE_UTRAN_CELLID_LIST = 66,
+	GA_IE_SERV_GANC_TBL_IND	= 67,
+	GA_IE_AP_REG_IND	= 68,
+	GA_IE_GAN_PLMN_LIST	= 69,
+	GA_IE_REQD_GAN_SERV	= 71,
+	GA_IE_BCAST_CONTAINER	= 72,
+	GA_IE_3G_CELL_ID	= 73,
+	GA_IE_MS_RADIO_ID	= 96,
+	GA_IE_DEF_GANC_IP	= 97,
+	GA_IE_DEF_GANC_FQDN	= 98,
+	GA_IE_GPRS_IP_ADDR	= 99,
+	GA_IE_GPRS_UDP_PORT	= 100,
+	GA_IE_GANC_TCP_PORT	= 103,
+	GA_IE_RTP_UDP_PORT	= 104,
+	GA_IE_RTCP_UDP_PORT	= 105,
+	GA_IE_GERAN_RCV_SIGL_LIST = 106,
+	GA_IE_UTRAN_RCV_SIGL_LIST = 107,
+};
+
+/* 11.1.1 GA-RC and GA-CSR Message header IE */
+struct gan_rc_csr_hdr {
+	uint16_t len;
+	uint8_t pdisc:4,
+		skip_ind:4;
+	uint8_t msg_type;
+	uint8_t data[0];
+} __attribute__((packed));
+
+/* 11.2.14.1: GAN Control Channel Description IE */
+struct gan_cch_desc_ie {
+	uint8_t spare:1,
+		ecmc:1,
+		nmo:2,
+		gprs:1,
+		dtm:1,
+		att:1,
+		mscr:1;
+#if 0
+	uint8_t mscr:1,
+		att:1,
+		dtm:1,
+		gprs:1,
+		nmo:2,
+		ecmc:1,
+		spare:1;
+#endif
+	uint8_t t3212;
+	uint8_t rac;
+	uint8_t sgsnr:1,
+		ecmp:1,
+		re:1,
+		pfcfm:1,
+		tgecs:2,
+		spare2:2;
+#if 0
+	uint8_t spare2:2,
+		tgecs:2,
+		pfcfm:1,
+		re:1,
+		ecmp:1,
+		sgsnr:1;
+#endif
+	uint8_t access_class[2];
+} __attribute__((packed));
+#endif /* PROTO_GSM_44_318_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/protocol/ipaccess.h b/src/shared/libosmocore/include/osmocom/gsm/protocol/ipaccess.h
new file mode 100644
index 00000000..5d98a21f
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/protocol/ipaccess.h
@@ -0,0 +1,94 @@
+#ifndef _OSMO_PROTO_IPACCESS_H
+#define _OSMO_PROTO_IPACCESS_H
+
+#include <stdint.h>
+
+#define IPA_TCP_PORT_OML	3002
+#define IPA_TCP_PORT_RSL	3003
+
+struct ipaccess_head {
+	uint16_t len;	/* network byte order */
+	uint8_t proto;
+	uint8_t data[0];
+} __attribute__ ((packed));
+
+struct ipaccess_head_ext {
+	uint8_t proto;
+	uint8_t data[0];
+} __attribute__ ((packed));
+
+enum ipaccess_proto {
+	IPAC_PROTO_RSL		= 0x00,
+	IPAC_PROTO_IPACCESS	= 0xfe,
+	IPAC_PROTO_SCCP		= 0xfd,
+	IPAC_PROTO_OML		= 0xff,
+
+
+	/* OpenBSC extensions */
+	IPAC_PROTO_OSMO		= 0xee,
+	IPAC_PROTO_MGCP_OLD	= 0xfc,
+};
+
+enum ipaccess_proto_ext {
+	IPAC_PROTO_EXT_CTRL	= 0x00,
+	IPAC_PROTO_EXT_MGCP	= 0x01,
+	IPAC_PROTO_EXT_LAC	= 0x02,
+	IPAC_PROTO_EXT_SMSC	= 0x03,
+};
+
+enum ipaccess_msgtype {
+	IPAC_MSGT_PING		= 0x00,
+	IPAC_MSGT_PONG		= 0x01,
+	IPAC_MSGT_ID_GET	= 0x04,
+	IPAC_MSGT_ID_RESP	= 0x05,
+	IPAC_MSGT_ID_ACK	= 0x06,
+
+	/* OpenBSC extension */
+	IPAC_MSGT_SCCP_OLD	= 0xff,
+};
+
+enum ipaccess_id_tags {
+	IPAC_IDTAG_SERNR		= 0x00,
+	IPAC_IDTAG_UNITNAME		= 0x01,
+	IPAC_IDTAG_LOCATION1		= 0x02,
+	IPAC_IDTAG_LOCATION2		= 0x03,
+	IPAC_IDTAG_EQUIPVERS		= 0x04,
+	IPAC_IDTAG_SWVERSION		= 0x05,
+	IPAC_IDTAG_IPADDR		= 0x06,
+	IPAC_IDTAG_MACADDR		= 0x07,
+	IPAC_IDTAG_UNIT			= 0x08,
+};
+
+/*
+ * Firmware specific header
+ */
+struct sdp_firmware {
+	char magic[4];
+	char more_magic[2];
+	uint16_t more_more_magic;
+	uint32_t header_length;
+	uint32_t file_length;
+	char sw_part[20];
+	char text1[64];
+	char time[12];
+	char date[14];
+	char text2[10];
+	char version[20];
+	uint16_t table_offset;
+	/* stuff i don't know */
+} __attribute__((packed));
+
+struct sdp_header_entry {
+	uint16_t something1;
+	char text1[64];
+	char time[12];
+	char date[14];
+	char text2[10];
+	char version[20];
+	uint32_t length;
+	uint32_t addr1;
+	uint32_t addr2;
+	uint32_t start;
+} __attribute__((packed));
+
+#endif /* _OSMO_PROTO_IPACCESS_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/rsl.h b/src/shared/libosmocore/include/osmocom/gsm/rsl.h
new file mode 100644
index 00000000..b8e4157a
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/rsl.h
@@ -0,0 +1,55 @@
+#ifndef _OSMOCORE_RSL_H
+#define _OSMOCORE_RSL_H
+
+#include <stdint.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+
+/*! \defgroup rsl RSL
+ *  @{
+ */
+
+/*! \file rsl.h */
+
+void rsl_init_rll_hdr(struct abis_rsl_rll_hdr *dh, uint8_t msg_type);
+
+void rsl_init_cchan_hdr(struct abis_rsl_cchan_hdr *ch, uint8_t msg_type);
+
+extern const struct tlv_definition rsl_att_tlvdef;
+
+/*! \brief Parse RSL TLV structure using \ref tlv_parse */
+#define rsl_tlv_parse(dec, buf, len)     \
+			tlv_parse(dec, &rsl_att_tlvdef, buf, len, 0, 0)
+
+/* encode channel number as per Section 9.3.1 */
+uint8_t rsl_enc_chan_nr(uint8_t type, uint8_t subch, uint8_t timeslot);
+/* decode channel number as per Section 9.3.1 */
+int rsl_dec_chan_nr(uint8_t chan_nr, uint8_t *type, uint8_t *subch, uint8_t *timeslot);
+/* Turns channel number into a string */
+const char *rsl_chan_nr_str(uint8_t chan_nr);
+
+
+const char *rsl_err_name(uint8_t err);
+const char *rsl_rlm_cause_name(uint8_t err);
+const char *rsl_msg_name(uint8_t err);
+const char *rsl_ipac_msg_name(uint8_t msg_type);
+
+/* Section 3.3.2.3 TS 05.02. I think this looks like a table */
+int rsl_ccch_conf_to_bs_cc_chans(int ccch_conf);
+
+/* Push a RSL RLL header */
+void rsl_rll_push_hdr(struct msgb *msg, uint8_t msg_type, uint8_t chan_nr,
+		      uint8_t link_id, int transparent);
+
+/* Push a RSL RLL header with L3_INFO IE */
+void rsl_rll_push_l3(struct msgb *msg, uint8_t msg_type, uint8_t chan_nr,
+		     uint8_t link_id, int transparent);
+
+/* Allocate msgb and fill with simple RSL RLL header */
+struct msgb *rsl_rll_simple(uint8_t msg_type, uint8_t chan_nr,
+			    uint8_t link_id, int transparent);
+
+/*! @} */
+
+#endif /* _OSMOCORE_RSL_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/rxlev_stat.h b/src/shared/libosmocore/include/osmocom/gsm/rxlev_stat.h
new file mode 100644
index 00000000..415509dc
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/rxlev_stat.h
@@ -0,0 +1,22 @@
+#ifndef _OSMOCORE_RXLEV_STATS_H
+#define _OSMOCORE_RXLEV_STATS_H
+
+#define NUM_RXLEVS 32
+#define NUM_ARFCNS 1024
+
+struct rxlev_stats {
+	/* the maximum number of ARFCN's is 1024, and there are 32 RxLevels,
+	 * so in we keep one 1024bit-bitvec for each RxLev */
+	uint8_t rxlev_buckets[NUM_RXLEVS][NUM_ARFCNS/8];
+};
+
+void rxlev_stat_input(struct rxlev_stats *st, uint16_t arfcn, uint8_t rxlev);
+
+/* get the next ARFCN that has the specified Rxlev */
+int16_t rxlev_stat_get_next(const struct rxlev_stats *st, uint8_t rxlev, int16_t arfcn);
+
+void rxlev_stat_reset(struct rxlev_stats *st);
+
+void rxlev_stat_dump(const struct rxlev_stats *st);
+
+#endif /* _OSMOCORE_RXLEV_STATS_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/sysinfo.h b/src/shared/libosmocore/include/osmocom/gsm/sysinfo.h
new file mode 100644
index 00000000..06feb1de
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/sysinfo.h
@@ -0,0 +1,43 @@
+#ifndef _OSMO_GSM_SYSINFO_H
+#define _OSMO_GSM_SYSINFO_H
+
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+enum osmo_sysinfo_type {
+	SYSINFO_TYPE_NONE,
+	SYSINFO_TYPE_1,
+	SYSINFO_TYPE_2,
+	SYSINFO_TYPE_3,
+	SYSINFO_TYPE_4,
+	SYSINFO_TYPE_5,
+	SYSINFO_TYPE_6,
+	SYSINFO_TYPE_7,
+	SYSINFO_TYPE_8,
+	SYSINFO_TYPE_9,
+	SYSINFO_TYPE_10,
+	SYSINFO_TYPE_13,
+	SYSINFO_TYPE_16,
+	SYSINFO_TYPE_17,
+	SYSINFO_TYPE_18,
+	SYSINFO_TYPE_19,
+	SYSINFO_TYPE_20,
+	SYSINFO_TYPE_2bis,
+	SYSINFO_TYPE_2ter,
+	SYSINFO_TYPE_2quater,
+	SYSINFO_TYPE_5bis,
+	SYSINFO_TYPE_5ter,
+	SYSINFO_TYPE_EMO,
+	SYSINFO_TYPE_MEAS_INFO,
+	/* FIXME all the various bis and ter */
+	_MAX_SYSINFO_TYPE
+};
+
+typedef uint8_t sysinfo_buf_t[GSM_MACBLOCK_LEN];
+
+extern const struct value_string osmo_sitype_strs[_MAX_SYSINFO_TYPE];
+
+uint8_t osmo_sitype2rsl(enum osmo_sysinfo_type si_type);
+enum osmo_sysinfo_type osmo_rsl2sitype(uint8_t rsl_si);
+
+#endif /* _OSMO_GSM_SYSINFO_H */
diff --git a/src/shared/libosmocore/include/osmocom/gsm/tlv.h b/src/shared/libosmocore/include/osmocom/gsm/tlv.h
new file mode 100644
index 00000000..9c0319d9
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/gsm/tlv.h
@@ -0,0 +1,415 @@
+#ifndef _TLV_H
+#define _TLV_H
+
+#include <stdint.h>
+#include <string.h>
+
+#include <osmocom/core/msgb.h>
+
+/*! \defgroup tlv GSM L3 compatible TLV parser
+ *  @{
+ */
+/*! \file tlv.h */
+
+/* Terminology / wording
+		tag	length		value	(in bits)
+
+	    V	-	-		8
+	   LV	-	8		N * 8
+	  TLV	8	8		N * 8
+	TL16V	8	16		N * 8
+	TLV16	8	8		N * 16
+	 TvLV	8	8/16		N * 8
+	vTvLV	8/16	8/16		N * 8
+
+*/
+
+/*! \brief gross length of a LV type field */
+#define LV_GROSS_LEN(x)		(x+1)
+/*! \brief gross length of a TLV type field */
+#define TLV_GROSS_LEN(x)	(x+2)
+/*! \brief gross length of a TLV16 type field */
+#define TLV16_GROSS_LEN(x)	((2*x)+2)
+/*! \brief gross length of a TL16V type field */
+#define TL16V_GROSS_LEN(x)	(x+3)
+/*! \brief gross length of a L16TV type field */
+#define L16TV_GROSS_LEN(x)	(x+3)
+
+/*! \brief maximum length of TLV of one byte length */
+#define TVLV_MAX_ONEBYTE	0x7f
+
+/*! \brief gross length of a TVLV type field */
+static inline uint16_t TVLV_GROSS_LEN(uint16_t len)
+{
+	if (len <= TVLV_MAX_ONEBYTE)
+		return TLV_GROSS_LEN(len);
+	else
+		return TL16V_GROSS_LEN(len);
+}
+
+/*! \brief gross length of vTvL header (tag+len) */
+static inline uint16_t VTVL_GAN_GROSS_LEN(uint16_t tag, uint16_t len)
+{
+	uint16_t ret = 2;
+
+	if (tag > TVLV_MAX_ONEBYTE)
+		ret++;
+
+	if (len > TVLV_MAX_ONEBYTE)
+		ret++;
+
+	return ret;
+}
+
+/*! \brief gross length of vTvLV (tag+len+val) */
+static inline uint16_t VTVLV_GAN_GROSS_LEN(uint16_t tag, uint16_t len)
+{
+	uint16_t ret;
+
+	if (len <= TVLV_MAX_ONEBYTE)
+		return TLV_GROSS_LEN(len);
+	else
+		return TL16V_GROSS_LEN(len);
+
+	if (tag > TVLV_MAX_ONEBYTE)
+		ret += 1;
+
+	return ret;
+}
+
+/* TLV generation */
+
+/*! \brief put (append) a LV field */
+static inline uint8_t *lv_put(uint8_t *buf, uint8_t len,
+				const uint8_t *val)
+{
+	*buf++ = len;
+	memcpy(buf, val, len);
+	return buf + len;
+}
+
+/*! \brief put (append) a TLV field */
+static inline uint8_t *tlv_put(uint8_t *buf, uint8_t tag, uint8_t len,
+				const uint8_t *val)
+{
+	*buf++ = tag;
+	*buf++ = len;
+	memcpy(buf, val, len);
+	return buf + len;
+}
+
+/*! \brief put (append) a TLV16 field */
+static inline uint8_t *tlv16_put(uint8_t *buf, uint8_t tag, uint8_t len,
+				const uint16_t *val)
+{
+	*buf++ = tag;
+	*buf++ = len;
+	memcpy(buf, val, len*2);
+	return buf + len*2;
+}
+
+/*! \brief put (append) a TL16V field */
+static inline uint8_t *tl16v_put(uint8_t *buf, uint8_t tag, uint16_t len,
+				const uint8_t *val)
+{
+	*buf++ = tag;
+	*buf++ = len >> 8;
+	*buf++ = len & 0xff;
+	memcpy(buf, val, len);
+	return buf + len*2;
+}
+
+/*! \brief put (append) a TvLV field */
+static inline uint8_t *tvlv_put(uint8_t *buf, uint8_t tag, uint16_t len,
+				 const uint8_t *val)
+{
+	uint8_t *ret;
+
+	if (len <= TVLV_MAX_ONEBYTE) {
+		ret = tlv_put(buf, tag, len, val);
+		buf[1] |= 0x80;
+	} else
+		ret = tl16v_put(buf, tag, len, val);
+
+	return ret;
+}
+
+/*! \brief put (append) a variable-length tag or variable-length length * */
+static inline uint8_t *vt_gan_put(uint8_t *buf, uint16_t tag)
+{
+	if (tag > TVLV_MAX_ONEBYTE) {
+		/* two-byte TAG */
+		*buf++ = 0x80 | (tag >> 8);
+		*buf++ = (tag & 0xff);
+	} else
+		*buf++ = tag;
+
+	return buf;
+}
+
+/* \brief put (append) vTvL (GAN) field (tag + length)*/
+static inline uint8_t *vtvl_gan_put(uint8_t *buf, uint16_t tag, uint16_t len)
+{
+	uint8_t *ret;
+
+	ret = vt_gan_put(buf, tag);
+	return vt_gan_put(ret, len);
+}
+
+/* \brief put (append) vTvLV (GAN) field (tag + length + val) */
+static inline uint8_t *vtvlv_gan_put(uint8_t *buf, uint16_t tag, uint16_t len,
+				      const uint8_t *val)
+{
+	uint8_t *ret;
+
+	ret = vtvl_gan_put(buf, tag, len );
+
+	memcpy(ret, val, len);
+	ret = buf + len;
+
+	return ret;
+}
+
+/*! \brief put (append) a TLV16 field to \ref msgb */
+static inline uint8_t *msgb_tlv16_put(struct msgb *msg, uint8_t tag, uint8_t len, const uint16_t *val)
+{
+	uint8_t *buf = msgb_put(msg, TLV16_GROSS_LEN(len));
+	return tlv16_put(buf, tag, len, val);
+}
+
+/*! \brief put (append) a TL16V field to \ref msgb */
+static inline uint8_t *msgb_tl16v_put(struct msgb *msg, uint8_t tag, uint16_t len,
+					const uint8_t *val)
+{
+	uint8_t *buf = msgb_put(msg, TL16V_GROSS_LEN(len));
+	return tl16v_put(buf, tag, len, val);
+}
+
+/*! \brief put (append) a TvLV field to \ref msgb */
+static inline uint8_t *msgb_tvlv_put(struct msgb *msg, uint8_t tag, uint16_t len,
+				      const uint8_t *val)
+{
+	uint8_t *buf = msgb_put(msg, TVLV_GROSS_LEN(len));
+	return tvlv_put(buf, tag, len, val);
+}
+
+/*! \brief put (append) a vTvLV field to \ref msgb */
+static inline uint8_t *msgb_vtvlv_gan_put(struct msgb *msg, uint16_t tag,
+					  uint16_t len, const uint8_t *val)
+{
+	uint8_t *buf = msgb_put(msg, VTVLV_GAN_GROSS_LEN(tag, len));
+	return vtvlv_gan_put(buf, tag, len, val);
+}
+
+/*! \brief put (append) a L16TV field to \ref msgb */
+static inline uint8_t *msgb_l16tv_put(struct msgb *msg, uint16_t len, uint8_t tag,
+                                       const uint8_t *val)
+{
+	uint8_t *buf = msgb_put(msg, L16TV_GROSS_LEN(len));
+
+	*buf++ = len >> 8;
+	*buf++ = len & 0xff;
+	*buf++ = tag;
+	memcpy(buf, val, len);
+	return buf + len;
+}
+
+/*! \brief put (append) a V field */
+static inline uint8_t *v_put(uint8_t *buf, uint8_t val)
+{
+	*buf++ = val;
+	return buf;
+}
+
+/*! \brief put (append) a TV field */
+static inline uint8_t *tv_put(uint8_t *buf, uint8_t tag, 
+				uint8_t val)
+{
+	*buf++ = tag;
+	*buf++ = val;
+	return buf;
+}
+
+/*! \brief put (append) a TVfixed field */
+static inline uint8_t *tv_fixed_put(uint8_t *buf, uint8_t tag,
+				    unsigned int len, const uint8_t *val)
+{
+	*buf++ = tag;
+	memcpy(buf, val, len);
+	return buf + len;
+}
+
+/*! \brief put (append) a TV16 field
+ *  \param[in,out] buf data buffer
+ *  \param[in] tag Tag value
+ *  \param[in] val Value (in host byte order!)
+ */
+static inline uint8_t *tv16_put(uint8_t *buf, uint8_t tag, 
+				 uint16_t val)
+{
+	*buf++ = tag;
+	*buf++ = val >> 8;
+	*buf++ = val & 0xff;
+	return buf;
+}
+
+/*! \brief put (append) a LV field to a \ref msgb
+ *  \returns pointer to first byte after newly-put information */
+static inline uint8_t *msgb_lv_put(struct msgb *msg, uint8_t len, const uint8_t *val)
+{
+	uint8_t *buf = msgb_put(msg, LV_GROSS_LEN(len));
+	return lv_put(buf, len, val);
+}
+
+/*! \brief put (append) a TLV field to a \ref msgb
+ *  \returns pointer to first byte after newly-put information */
+static inline uint8_t *msgb_tlv_put(struct msgb *msg, uint8_t tag, uint8_t len, const uint8_t *val)
+{
+	uint8_t *buf = msgb_put(msg, TLV_GROSS_LEN(len));
+	return tlv_put(buf, tag, len, val);
+}
+
+/*! \brief put (append) a TV field to a \ref msgb
+ *  \returns pointer to first byte after newly-put information */
+static inline uint8_t *msgb_tv_put(struct msgb *msg, uint8_t tag, uint8_t val)
+{
+	uint8_t *buf = msgb_put(msg, 2);
+	return tv_put(buf, tag, val);
+}
+
+/*! \brief put (append) a TVfixed field to a \ref msgb
+ *  \returns pointer to first byte after newly-put information */
+static inline uint8_t *msgb_tv_fixed_put(struct msgb *msg, uint8_t tag,
+					unsigned int len, const uint8_t *val)
+{
+	uint8_t *buf = msgb_put(msg, 1+len);
+	return tv_fixed_put(buf, tag, len, val);
+}
+
+/*! \brief put (append) a V field to a \ref msgb
+ *  \returns pointer to first byte after newly-put information */
+static inline uint8_t *msgb_v_put(struct msgb *msg, uint8_t val)
+{
+	uint8_t *buf = msgb_put(msg, 1);
+	return v_put(buf, val);
+}
+
+/*! \brief put (append) a TV16 field to a \ref msgb
+ *  \returns pointer to first byte after newly-put information */
+static inline uint8_t *msgb_tv16_put(struct msgb *msg, uint8_t tag, uint16_t val)
+{
+	uint8_t *buf = msgb_put(msg, 3);
+	return tv16_put(buf, tag, val);
+}
+
+/*! \brief push (prepend) a TLV field to a \ref msgb
+ *  \returns pointer to first byte of newly-pushed information */
+static inline uint8_t *msgb_tlv_push(struct msgb *msg, uint8_t tag, uint8_t len, const uint8_t *val)
+{
+	uint8_t *buf = msgb_push(msg, TLV_GROSS_LEN(len));
+	tlv_put(buf, tag, len, val);
+	return buf;
+}
+
+/*! \brief push (prepend) a TV field to a \ref msgb
+ *  \returns pointer to first byte of newly-pushed information */
+static inline uint8_t *msgb_tv_push(struct msgb *msg, uint8_t tag, uint8_t val)
+{
+	uint8_t *buf = msgb_push(msg, 2);
+	tv_put(buf, tag, val);
+	return buf;
+}
+
+/*! \brief push (prepend) a TV16 field to a \ref msgb
+ *  \returns pointer to first byte of newly-pushed information */
+static inline uint8_t *msgb_tv16_push(struct msgb *msg, uint8_t tag, uint16_t val)
+{
+	uint8_t *buf = msgb_push(msg, 3);
+	tv16_put(buf, tag, val);
+	return buf;
+}
+
+/*! \brief push (prepend) a TvLV field to a \ref msgb
+ *  \returns pointer to first byte of newly-pushed information */
+static inline uint8_t *msgb_tvlv_push(struct msgb *msg, uint8_t tag, uint16_t len,
+				      const uint8_t *val)
+{
+	uint8_t *buf = msgb_push(msg, TVLV_GROSS_LEN(len));
+	tvlv_put(buf, tag, len, val);
+	return buf;
+}
+
+/* \brief push (prepend) a vTvL header to a \ref msgb
+ */
+static inline uint8_t *msgb_vtvl_gan_push(struct msgb *msg, uint16_t tag,
+					   uint16_t len)
+{
+	uint8_t *buf = msgb_push(msg, VTVL_GAN_GROSS_LEN(tag, len));
+	vtvl_gan_put(buf, tag, len);
+	return buf;
+}
+
+
+static inline uint8_t *msgb_vtvlv_gan_push(struct msgb *msg, uint16_t tag,
+					   uint16_t len, const uint8_t *val)
+{
+	uint8_t *buf = msgb_push(msg, VTVLV_GAN_GROSS_LEN(tag, len));
+	vtvlv_gan_put(buf, tag, len, val);
+	return buf;
+}
+
+/* TLV parsing */
+
+/*! \brief Entry in a TLV parser array */
+struct tlv_p_entry {
+	uint16_t len;		/*!< \brief length */
+	const uint8_t *val;	/*!< \brief pointer to value */
+};
+
+/*! \brief TLV type */
+enum tlv_type {
+	TLV_TYPE_NONE,		/*!< \brief no type */
+	TLV_TYPE_FIXED,		/*!< \brief fixed-length value-only */
+	TLV_TYPE_T,		/*!< \brief tag-only */
+	TLV_TYPE_TV,		/*!< \brief tag-value (8bit) */
+	TLV_TYPE_TLV,		/*!< \brief tag-length-value */
+	TLV_TYPE_TL16V,		/*!< \brief tag, 16 bit length, value */
+	TLV_TYPE_TvLV,		/*!< \brief tag, variable length, value */
+	TLV_TYPE_SINGLE_TV,	/*!< \brief tag and value (both 4 bit) in 1 byte */
+	TLV_TYPE_vTvLV_GAN,	/*!< \brief variable-length tag, variable-length length */
+};
+
+/*! \brief Definition of a single IE (Information Element) */
+struct tlv_def {
+	enum tlv_type type;	/*!< \brief TLV type */
+	uint8_t fixed_len;	/*!< \brief length in case of \ref TLV_TYPE_FIXED */
+};
+
+/*! \brief Definition of All 256 IE / TLV */
+struct tlv_definition {
+	struct tlv_def def[256];
+};
+
+/*! \brief result of the TLV parser */
+struct tlv_parsed {
+	struct tlv_p_entry lv[256];
+};
+
+extern struct tlv_definition tvlv_att_def;
+extern struct tlv_definition vtvlv_gan_att_def;
+
+int tlv_parse_one(uint8_t *o_tag, uint16_t *o_len, const uint8_t **o_val,
+                  const struct tlv_definition *def,
+                  const uint8_t *buf, int buf_len);
+int tlv_parse(struct tlv_parsed *dec, const struct tlv_definition *def,
+	      const uint8_t *buf, int buf_len, uint8_t lv_tag, uint8_t lv_tag2);
+/* take a master (src) tlvdev and fill up all empty slots in 'dst' */
+void tlv_def_patch(struct tlv_definition *dst, const struct tlv_definition *src);
+
+#define TLVP_PRESENT(x, y)	((x)->lv[y].val)
+#define TLVP_LEN(x, y)		(x)->lv[y].len
+#define TLVP_VAL(x, y)		(x)->lv[y].val
+
+/*! @} */
+
+#endif /* _TLV_H */
diff --git a/src/shared/libosmocore/include/osmocom/vty/buffer.h b/src/shared/libosmocore/include/osmocom/vty/buffer.h
new file mode 100644
index 00000000..c9467a91
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/vty/buffer.h
@@ -0,0 +1,102 @@
+/*
+ * Buffering to output and input.
+ * Copyright (C) 1998 Kunihiro Ishiguro
+ *
+ * This file is part of GNU Zebra.
+ *
+ * GNU Zebra is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2, or (at your
+ * option) any later version.
+ *
+ * GNU Zebra is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GNU Zebra; see the file COPYING.  If not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef _ZEBRA_BUFFER_H
+#define _ZEBRA_BUFFER_H
+
+#include <sys/types.h>
+
+/* Create a new buffer.  Memory will be allocated in chunks of the given
+   size.  If the argument is 0, the library will supply a reasonable
+   default size suitable for buffering socket I/O. */
+struct buffer *buffer_new(void *ctx, size_t);
+
+/* Free all data in the buffer. */
+void buffer_reset(struct buffer *);
+
+/* This function first calls buffer_reset to release all buffered data.
+   Then it frees the struct buffer itself. */
+void buffer_free(struct buffer *);
+
+/* Add the given data to the end of the buffer. */
+extern void buffer_put(struct buffer *, const void *, size_t);
+/* Add a single character to the end of the buffer. */
+extern void buffer_putc(struct buffer *, u_char);
+/* Add a NUL-terminated string to the end of the buffer. */
+extern void buffer_putstr(struct buffer *, const char *);
+
+/* Combine all accumulated (and unflushed) data inside the buffer into a
+   single NUL-terminated string allocated using XMALLOC(MTYPE_TMP).  Note
+   that this function does not alter the state of the buffer, so the data
+   is still inside waiting to be flushed. */
+char *buffer_getstr(struct buffer *);
+
+/* Returns 1 if there is no pending data in the buffer.  Otherwise returns 0. */
+int buffer_empty(struct buffer *);
+
+typedef enum {
+	/* An I/O error occurred.  The buffer should be destroyed and the
+	   file descriptor should be closed. */
+	BUFFER_ERROR = -1,
+
+	/* The data was written successfully, and the buffer is now empty
+	   (there is no pending data waiting to be flushed). */
+	BUFFER_EMPTY = 0,
+
+	/* There is pending data in the buffer waiting to be flushed.  Please
+	   try flushing the buffer when select indicates that the file descriptor
+	   is writeable. */
+	BUFFER_PENDING = 1
+} buffer_status_t;
+
+/* Try to write this data to the file descriptor.  Any data that cannot
+   be written immediately is added to the buffer queue. */
+extern buffer_status_t buffer_write(struct buffer *, int fd,
+				    const void *, size_t);
+
+/* This function attempts to flush some (but perhaps not all) of
+   the queued data to the given file descriptor. */
+extern buffer_status_t buffer_flush_available(struct buffer *, int fd);
+
+/* The following 2 functions (buffer_flush_all and buffer_flush_window)
+   are for use in lib/vty.c only.  They should not be used elsewhere. */
+
+/* Call buffer_flush_available repeatedly until either all data has been
+   flushed, or an I/O error has been encountered, or the operation would
+   block. */
+extern buffer_status_t buffer_flush_all(struct buffer *, int fd);
+
+/* Attempt to write enough data to the given fd to fill a window of the
+   given width and height (and remove the data written from the buffer).
+
+   If !no_more, then a message saying " --More-- " is appended.
+   If erase is true, then first overwrite the previous " --More-- " message
+   with spaces.
+
+   Any write error (including EAGAIN or EINTR) will cause this function
+   to return -1 (because the logic for handling the erase and more features
+   is too complicated to retry the write later).
+*/
+extern buffer_status_t buffer_flush_window(struct buffer *, int fd, int width,
+					   int height, int erase, int no_more);
+
+#endif				/* _ZEBRA_BUFFER_H */
diff --git a/src/shared/libosmocore/include/osmocom/vty/command.h b/src/shared/libosmocore/include/osmocom/vty/command.h
new file mode 100644
index 00000000..8fbb4824
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/vty/command.h
@@ -0,0 +1,374 @@
+/*
+ * Zebra configuration command interface routine
+ * Copyright (C) 1997, 98 Kunihiro Ishiguro
+ *
+ * This file is part of GNU Zebra.
+ *
+ * GNU Zebra is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2, or (at your
+ * option) any later version.
+ *
+ * GNU Zebra is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GNU Zebra; see the file COPYING.  If not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef _ZEBRA_COMMAND_H
+#define _ZEBRA_COMMAND_H
+
+#include <stdio.h>
+#include <sys/types.h>
+#include "vector.h"
+
+/*! \defgroup command VTY Command
+ *  @{
+ */
+/*! \file command.h */
+
+/*! \brief Host configuration variable */
+struct host {
+	/*! \brief Host name of this router. */
+	char *name;
+
+	/*! \brief Password for vty interface. */
+	char *password;
+	char *password_encrypt;
+
+	/*! \brief Enable password */
+	char *enable;
+	char *enable_encrypt;
+
+	/*! \brief System wide terminal lines. */
+	int lines;
+
+	/*! \brief Log filename. */
+	char *logfile;
+
+	/*! \brief config file name of this host */
+	char *config;
+
+	/*! \brief Flags for services */
+	int advanced;
+	int encrypt;
+
+	/*! \brief Banner configuration. */
+	const char *motd;
+	char *motdfile;
+
+	/*! \brief VTY application information */
+	const struct vty_app_info *app_info;
+};
+
+/*! \brief There are some command levels which called from command node. */
+enum node_type {
+	AUTH_NODE,		/*!< \brief Authentication mode of vty interface. */
+	VIEW_NODE,		/*!< \brief View node. Default mode of vty interface. */
+	AUTH_ENABLE_NODE,	/*!< \brief Authentication mode for change enable. */
+	ENABLE_NODE,		/*!< \brief Enable node. */
+	CONFIG_NODE,		/*!< \brief Config node. Default mode of config file. */
+	SERVICE_NODE,		/*!< \brief Service node. */
+	DEBUG_NODE,		/*!< \brief Debug node. */
+	CFG_LOG_NODE,		/*!< \brief Configure the logging */
+
+	VTY_NODE,		/*!< \brief Vty node. */
+
+	L_E1INP_NODE,		/*!< \brief E1 line in libosmo-abis. */
+	L_IPA_NODE,		/*!< \brief IPA proxying commands in libosmo-abis. */
+	L_NS_NODE,		/*!< \brief NS node in libosmo-gb. */
+	L_BSSGP_NODE,		/*!< \brief BSSGP node in libosmo-gb. */
+
+	_LAST_OSMOVTY_NODE
+};
+
+#include "vty.h"
+
+/*! \brief Node which has some commands and prompt string and
+ * configuration function pointer . */
+struct cmd_node {
+	/*! \brief Node index */
+	enum node_type node;
+
+	/*! \brief Prompt character at vty interface. */
+	const char *prompt;
+
+	/*! \brief Is this node's configuration goes to vtysh ? */
+	int vtysh;
+
+	/*! \brief Node's configuration write function */
+	int (*func) (struct vty *);
+
+	/*! \brief Vector of this node's command list. */
+	vector cmd_vector;
+};
+
+enum {
+	CMD_ATTR_DEPRECATED = 1,
+	CMD_ATTR_HIDDEN,
+};
+
+/*! \brief Structure of a command element */
+struct cmd_element {
+	const char *string;	/*!< \brief Command specification by string. */
+	int (*func) (struct cmd_element *, struct vty *, int, const char *[]);
+	const char *doc;	/*!< \brief Documentation of this command. */
+	int daemon;		/*!< \brief Daemon to which this command belong. */
+	vector strvec;		/*!< \brief Pointing out each description vector. */
+	unsigned int cmdsize;	/*!< \brief Command index count. */
+	char *config;		/*!< \brief Configuration string */
+	vector subconfig;	/*!< \brief Sub configuration string */
+	u_char attr;		/*!< \brief Command attributes */
+};
+
+/*! \brief Command description structure. */
+struct desc {
+	const char *cmd;	/*!< \brief Command string. */
+	const char *str;	/*!< \brief Command's description. */
+};
+
+/*! \brief Return value of the commands. */
+#define CMD_SUCCESS              0
+#define CMD_WARNING              1
+#define CMD_ERR_NO_MATCH         2
+#define CMD_ERR_AMBIGUOUS        3
+#define CMD_ERR_INCOMPLETE       4
+#define CMD_ERR_EXEED_ARGC_MAX   5
+#define CMD_ERR_NOTHING_TODO     6
+#define CMD_COMPLETE_FULL_MATCH  7
+#define CMD_COMPLETE_MATCH       8
+#define CMD_COMPLETE_LIST_MATCH  9
+#define CMD_SUCCESS_DAEMON      10
+
+/* Argc max counts. */
+#define CMD_ARGC_MAX   256
+
+/* Turn off these macros when uisng cpp with extract.pl */
+#ifndef VTYSH_EXTRACT_PL
+
+/* helper defines for end-user DEFUN* macros */
+#define DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, attrs, dnum) \
+  static struct cmd_element cmdname = \
+  { \
+    .string = cmdstr, \
+    .func = funcname, \
+    .doc = helpstr, \
+    .attr = attrs, \
+    .daemon = dnum, \
+  };
+
+/* global (non static) cmd_element */
+#define gDEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, attrs, dnum) \
+  struct cmd_element cmdname = \
+  { \
+    .string = cmdstr, \
+    .func = funcname, \
+    .doc = helpstr, \
+    .attr = attrs, \
+    .daemon = dnum, \
+  };
+
+#define DEFUN_CMD_FUNC_DECL(funcname) \
+  static int funcname (struct cmd_element *, struct vty *, int, const char *[]); \
+
+#define DEFUN_CMD_FUNC_TEXT(funcname) \
+  static int funcname \
+    (struct cmd_element *self, struct vty *vty, int argc, const char *argv[])
+
+/*! \brief Macro for defining a VTY node and function
+ *  \param[in] funcname Name of the function implementing the node
+ *  \param[in] cmdname Name of the command node
+ *  \param[in] cmdstr String with syntax of node
+ *  \param[in] helpstr String with help message of node
+ */
+#define DEFUN(funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_CMD_FUNC_DECL(funcname) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, 0, 0) \
+  DEFUN_CMD_FUNC_TEXT(funcname)
+
+/*! \brief Macro for defining a non-static (global) VTY node and function
+ *  \param[in] funcname Name of the function implementing the node
+ *  \param[in] cmdname Name of the command node
+ *  \param[in] cmdstr String with syntax of node
+ *  \param[in] helpstr String with help message of node
+ */
+#define gDEFUN(funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_CMD_FUNC_DECL(funcname) \
+  gDEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, 0, 0) \
+  DEFUN_CMD_FUNC_TEXT(funcname)
+
+#define DEFUN_ATTR(funcname, cmdname, cmdstr, helpstr, attr) \
+  DEFUN_CMD_FUNC_DECL(funcname) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, attr, 0) \
+  DEFUN_CMD_FUNC_TEXT(funcname)
+
+#define DEFUN_HIDDEN(funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_ATTR (funcname, cmdname, cmdstr, helpstr, CMD_ATTR_HIDDEN)
+
+#define DEFUN_DEPRECATED(funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_ATTR (funcname, cmdname, cmdstr, helpstr, CMD_ATTR_DEPRECATED) \
+
+/* DEFUN_NOSH for commands that vtysh should ignore */
+#define DEFUN_NOSH(funcname, cmdname, cmdstr, helpstr) \
+  DEFUN(funcname, cmdname, cmdstr, helpstr)
+
+/* DEFSH for vtysh. */
+#define DEFSH(daemon, cmdname, cmdstr, helpstr) \
+  DEFUN_CMD_ELEMENT(NULL, cmdname, cmdstr, helpstr, 0, daemon) \
+
+/* DEFUN + DEFSH */
+#define DEFUNSH(daemon, funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_CMD_FUNC_DECL(funcname) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, 0, daemon) \
+  DEFUN_CMD_FUNC_TEXT(funcname)
+
+/* DEFUN + DEFSH with attributes */
+#define DEFUNSH_ATTR(daemon, funcname, cmdname, cmdstr, helpstr, attr) \
+  DEFUN_CMD_FUNC_DECL(funcname) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, attr, daemon) \
+  DEFUN_CMD_FUNC_TEXT(funcname)
+
+#define DEFUNSH_HIDDEN(daemon, funcname, cmdname, cmdstr, helpstr) \
+  DEFUNSH_ATTR (daemon, funcname, cmdname, cmdstr, helpstr, CMD_ATTR_HIDDEN)
+
+#define DEFUNSH_DEPRECATED(daemon, funcname, cmdname, cmdstr, helpstr) \
+  DEFUNSH_ATTR (daemon, funcname, cmdname, cmdstr, helpstr, CMD_ATTR_DEPRECATED)
+
+/* ALIAS macro which define existing command's alias. */
+#define ALIAS(funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, 0, 0)
+
+/* global (non static) cmd_element */
+#define gALIAS(funcname, cmdname, cmdstr, helpstr) \
+  gDEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, 0, 0)
+
+#define ALIAS_ATTR(funcname, cmdname, cmdstr, helpstr, attr) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, attr, 0)
+
+#define ALIAS_HIDDEN(funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, CMD_ATTR_HIDDEN, 0)
+
+#define ALIAS_DEPRECATED(funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, CMD_ATTR_DEPRECATED, 0)
+
+#define ALIAS_SH(daemon, funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, 0, daemon)
+
+#define ALIAS_SH_HIDDEN(daemon, funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, CMD_ATTR_HIDDEN, daemon)
+
+#define ALIAS_SH_DEPRECATED(daemon, funcname, cmdname, cmdstr, helpstr) \
+  DEFUN_CMD_ELEMENT(funcname, cmdname, cmdstr, helpstr, CMD_ATTR_DEPRECATED, daemon)
+
+#endif				/* VTYSH_EXTRACT_PL */
+
+/* Some macroes */
+#define CMD_OPTION(S)   ((S[0]) == '[')
+#define CMD_VARIABLE(S) (((S[0]) >= 'A' && (S[0]) <= 'Z') || ((S[0]) == '<'))
+#define CMD_VARARG(S)   ((S[0]) == '.')
+#define CMD_RANGE(S)	((S[0] == '<'))
+
+#define CMD_IPV4(S)	   ((strcmp ((S), "A.B.C.D") == 0))
+#define CMD_IPV4_PREFIX(S) ((strcmp ((S), "A.B.C.D/M") == 0))
+#define CMD_IPV6(S)        ((strcmp ((S), "X:X::X:X") == 0))
+#define CMD_IPV6_PREFIX(S) ((strcmp ((S), "X:X::X:X/M") == 0))
+
+/* Common descriptions. */
+#define SHOW_STR "Show running system information\n"
+#define IP_STR "IP information\n"
+#define IPV6_STR "IPv6 information\n"
+#define NO_STR "Negate a command or set its defaults\n"
+#define CLEAR_STR "Reset functions\n"
+#define RIP_STR "RIP information\n"
+#define BGP_STR "BGP information\n"
+#define OSPF_STR "OSPF information\n"
+#define NEIGHBOR_STR "Specify neighbor router\n"
+#define DEBUG_STR "Debugging functions (see also 'undebug')\n"
+#define UNDEBUG_STR "Disable debugging functions (see also 'debug')\n"
+#define ROUTER_STR "Enable a routing process\n"
+#define AS_STR "AS number\n"
+#define MBGP_STR "MBGP information\n"
+#define MATCH_STR "Match values from routing table\n"
+#define SET_STR "Set values in destination routing protocol\n"
+#define OUT_STR "Filter outgoing routing updates\n"
+#define IN_STR  "Filter incoming routing updates\n"
+#define V4NOTATION_STR "specify by IPv4 address notation(e.g. 0.0.0.0)\n"
+#define OSPF6_NUMBER_STR "Specify by number\n"
+#define INTERFACE_STR "Interface infomation\n"
+#define IFNAME_STR "Interface name(e.g. ep0)\n"
+#define IP6_STR "IPv6 Information\n"
+#define OSPF6_STR "Open Shortest Path First (OSPF) for IPv6\n"
+#define OSPF6_ROUTER_STR "Enable a routing process\n"
+#define OSPF6_INSTANCE_STR "<1-65535> Instance ID\n"
+#define SECONDS_STR "<1-65535> Seconds\n"
+#define ROUTE_STR "Routing Table\n"
+#define PREFIX_LIST_STR "Build a prefix list\n"
+#define OSPF6_DUMP_TYPE_LIST \
+"(neighbor|interface|area|lsa|zebra|config|dbex|spf|route|lsdb|redistribute|hook|asbr|prefix|abr)"
+#define ISIS_STR "IS-IS information\n"
+#define AREA_TAG_STR "[area tag]\n"
+
+#define CONF_BACKUP_EXT ".sav"
+
+/* IPv4 only machine should not accept IPv6 address for peer's IP
+   address.  So we replace VTY command string like below. */
+#ifdef HAVE_IPV6
+#define NEIGHBOR_CMD       "neighbor (A.B.C.D|X:X::X:X) "
+#define NO_NEIGHBOR_CMD    "no neighbor (A.B.C.D|X:X::X:X) "
+#define NEIGHBOR_ADDR_STR  "Neighbor address\nIPv6 address\n"
+#define NEIGHBOR_CMD2      "neighbor (A.B.C.D|X:X::X:X|WORD) "
+#define NO_NEIGHBOR_CMD2   "no neighbor (A.B.C.D|X:X::X:X|WORD) "
+#define NEIGHBOR_ADDR_STR2 "Neighbor address\nNeighbor IPv6 address\nNeighbor tag\n"
+#else
+#define NEIGHBOR_CMD       "neighbor A.B.C.D "
+#define NO_NEIGHBOR_CMD    "no neighbor A.B.C.D "
+#define NEIGHBOR_ADDR_STR  "Neighbor address\n"
+#define NEIGHBOR_CMD2      "neighbor (A.B.C.D|WORD) "
+#define NO_NEIGHBOR_CMD2   "no neighbor (A.B.C.D|WORD) "
+#define NEIGHBOR_ADDR_STR2 "Neighbor address\nNeighbor tag\n"
+#endif				/* HAVE_IPV6 */
+
+/* Prototypes. */
+void install_node(struct cmd_node *, int (*)(struct vty *));
+void install_default(enum node_type);
+void install_element(enum node_type, struct cmd_element *);
+void install_element_ve(struct cmd_element *cmd);
+void sort_node(void);
+
+/* Concatenates argv[shift] through argv[argc-1] into a single NUL-terminated
+   string with a space between each element (allocated using
+   XMALLOC(MTYPE_TMP)).  Returns NULL if shift >= argc. */
+char *argv_concat(const char **argv, int argc, int shift);
+
+vector cmd_make_strvec(const char *);
+void cmd_free_strvec(vector);
+vector cmd_describe_command();
+char **cmd_complete_command();
+const char *cmd_prompt(enum node_type);
+int config_from_file(struct vty *, FILE *);
+enum node_type node_parent(enum node_type);
+int cmd_execute_command(vector, struct vty *, struct cmd_element **, int);
+int cmd_execute_command_strict(vector, struct vty *, struct cmd_element **);
+void config_replace_string(struct cmd_element *, char *, ...);
+void cmd_init(int);
+
+/* Export typical functions. */
+extern struct cmd_element config_exit_cmd;
+extern struct cmd_element config_help_cmd;
+extern struct cmd_element config_list_cmd;
+extern struct cmd_element config_end_cmd;
+char *host_config_file();
+void host_config_set(const char *);
+
+/* This is called from main when a daemon is invoked with -v or --version. */
+void print_version(int print_copyright);
+
+extern void *tall_vty_cmd_ctx;
+
+/*! @} */
+#endif				/* _ZEBRA_COMMAND_H */
diff --git a/src/shared/libosmocore/include/osmocom/vty/logging.h b/src/shared/libosmocore/include/osmocom/vty/logging.h
new file mode 100644
index 00000000..e0011bf9
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/vty/logging.h
@@ -0,0 +1,12 @@
+#ifndef _VTY_LOGGING_H
+#define _VTY_LOGGING_H
+
+#define LOGGING_STR	"Configure log message to this terminal\n"
+#define FILTER_STR	"Filter log messages\n"
+
+struct log_info;
+void logging_vty_add_cmds(const struct log_info *cat);
+struct vty;
+struct log_target *osmo_log_vty2tgt(struct vty *vty);
+
+#endif /* _VTY_LOGGING_H */
diff --git a/src/shared/libosmocore/include/osmocom/vty/misc.h b/src/shared/libosmocore/include/osmocom/vty/misc.h
new file mode 100644
index 00000000..db4f4a77
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/vty/misc.h
@@ -0,0 +1,19 @@
+#ifndef OSMO_VTY_MISC_H
+#define OSMO_VTY_MISC_H
+
+#include <osmocom/vty/vty.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/core/utils.h>
+
+#define VTY_DO_LOWER		1
+char *vty_cmd_string_from_valstr(void *ctx, const struct value_string *vals,
+				 const char *prefix, const char *sep,
+				 const char *end, int do_lower);
+
+void vty_out_rate_ctr_group(struct vty *vty, const char *prefix,
+                            struct rate_ctr_group *ctrg);
+
+int osmo_vty_write_config_file(const char *filename);
+int osmo_vty_save_config_file(void);
+
+#endif
diff --git a/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h b/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h
new file mode 100644
index 00000000..3c222014
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/vty/telnet_interface.h
@@ -0,0 +1,56 @@
+/* minimalistic telnet/network interface it might turn into a wire interface */
+/* (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef TELNET_INTERFACE_H
+#define TELNET_INTERFACE_H
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/select.h>
+
+#include <osmocom/vty/vty.h>
+
+/*! \defgroup telnet_interface Telnet Interface
+ *  @{
+ */
+
+/*! \file telnet_interface.h */
+
+/*! \brief A telnet connection */
+struct telnet_connection {
+	/*! \brief linked list header for internal management */
+	struct llist_head entry;
+	/*! \brief private data pointer passed through */
+	void *priv;
+	/*! \brief filedsecriptor (socket ) */
+	struct osmo_fd fd;
+	/*! \brief VTY instance associated with telnet connection */
+	struct vty *vty;
+	/*! \brief logging target associated with this telnet connection */
+	struct log_target *dbg;
+};
+
+int telnet_init(void *tall_ctx, void *priv, int port);
+int telnet_init_dynif(void *tall_ctx, void *priv, const char *ip, int port);
+
+void telnet_exit(void);
+
+/*! @} */
+
+#endif /* TELNET_INTERFACE_H */
diff --git a/src/shared/libosmocore/include/osmocom/vty/vector.h b/src/shared/libosmocore/include/osmocom/vty/vector.h
new file mode 100644
index 00000000..22a184d6
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/vty/vector.h
@@ -0,0 +1,64 @@
+/*
+ * Generic vector interface header.
+ * Copyright (C) 1997, 98 Kunihiro Ishiguro
+ *
+ * This file is part of GNU Zebra.
+ *
+ * GNU Zebra is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2, or (at your option) any
+ * later version.
+ *
+ * GNU Zebra is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GNU Zebra; see the file COPYING.  If not, write to the Free
+ * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ */
+
+#ifndef _ZEBRA_VECTOR_H
+#define _ZEBRA_VECTOR_H
+
+/* struct for vector */
+struct _vector {
+	unsigned int active;	/* number of active slots */
+	unsigned int alloced;	/* number of allocated slot */
+	void **index;		/* index to data */
+};
+typedef struct _vector *vector;
+
+#define VECTOR_MIN_SIZE 1
+
+/* (Sometimes) usefull macros.  This macro convert index expression to
+ array expression. */
+/* Reference slot at given index, caller must ensure slot is active */
+#define vector_slot(V,I)  ((V)->index[(I)])
+/* Number of active slots.
+ * Note that this differs from vector_count() as it the count returned
+ * will include any empty slots
+ */
+#define vector_active(V) ((V)->active)
+
+/* Prototypes. */
+vector vector_init(unsigned int size);
+void vector_ensure(vector v, unsigned int num);
+int vector_empty_slot(vector v);
+int vector_set(vector v, void *val);
+int vector_set_index(vector v, unsigned int i, void *val);
+void vector_unset(vector v, unsigned int i);
+unsigned int vector_count(vector v);
+void vector_only_wrapper_free(vector v);
+void vector_only_index_free(void *index);
+void vector_free(vector v);
+vector vector_copy(vector v);
+
+void *vector_lookup(vector, unsigned int);
+void *vector_lookup_ensure(vector, unsigned int);
+
+extern void *tall_vty_vec_ctx;
+
+#endif				/* _ZEBRA_VECTOR_H */
diff --git a/src/shared/libosmocore/include/osmocom/vty/vty.h b/src/shared/libosmocore/include/osmocom/vty/vty.h
new file mode 100644
index 00000000..e656abf6
--- /dev/null
+++ b/src/shared/libosmocore/include/osmocom/vty/vty.h
@@ -0,0 +1,195 @@
+#ifndef _VTY_H
+#define _VTY_H
+
+#include <stdio.h>
+#include <stdarg.h>
+
+/*! \defgroup vty VTY (Virtual TTY) interface
+ *  @{
+ */
+/*! \file vty.h */
+
+/* GCC have printf type attribute check.  */
+#ifdef __GNUC__
+#define VTY_PRINTF_ATTRIBUTE(a,b) __attribute__ ((__format__ (__printf__, a, b)))
+#else
+#define VTY_PRINTF_ATTRIBUTE(a,b)
+#endif				/* __GNUC__ */
+
+/* Does the I/O error indicate that the operation should be retried later? */
+#define ERRNO_IO_RETRY(EN) \
+	(((EN) == EAGAIN) || ((EN) == EWOULDBLOCK) || ((EN) == EINTR))
+
+/* Vty read buffer size. */
+#define VTY_READ_BUFSIZ 512
+
+#define VTY_BUFSIZ 512
+#define VTY_MAXHIST 20
+
+/*! \brief VTY events */
+enum event {
+	VTY_SERV,
+	VTY_READ,
+	VTY_WRITE,
+	VTY_CLOSED,
+	VTY_TIMEOUT_RESET,
+#ifdef VTYSH
+	VTYSH_SERV,
+	VTYSH_READ,
+	VTYSH_WRITE
+#endif				/* VTYSH */
+};
+
+enum vty_type {
+	VTY_TERM,
+	VTY_FILE,
+	VTY_SHELL,
+	VTY_SHELL_SERV
+};
+
+/*! Internal representation of a single VTY */
+struct vty {
+	/*! \brief underlying file (if any) */
+	FILE *file;
+
+	/*! \brief private data, specified by creator */
+	void *priv;
+
+	/*! \brief File descripter of this vty. */
+	int fd;
+
+	/*! \brief Is this vty connect to file or not */
+	enum vty_type type;
+
+	/*! \brief Node status of this vty */
+	int node;
+
+	/*! \brief Failure count */
+	int fail;
+
+	/*! \brief Output buffer. */
+	struct buffer *obuf;
+
+	/*! \brief Command input buffer */
+	char *buf;
+
+	/*! \brief Command cursor point */
+	int cp;
+
+	/*! \brief Command length */
+	int length;
+
+	/*! \brief Command max length. */
+	int max;
+
+	/*! \brief Histry of command */
+	char *hist[VTY_MAXHIST];
+
+	/*! \brief History lookup current point */
+	int hp;
+
+	/*! \brief History insert end point */
+	int hindex;
+
+	/*! \brief For current referencing point of interface, route-map,
+	   access-list etc... */
+	void *index;
+
+	/*! \brief For multiple level index treatment such as key chain and key. */
+	void *index_sub;
+
+	/*! \brief For escape character. */
+	unsigned char escape;
+
+	/*! \brief Current vty status. */
+	enum { VTY_NORMAL, VTY_CLOSE, VTY_MORE, VTY_MORELINE } status;
+
+	/*! \brief IAC handling
+	 *
+	 * IAC handling: was the last character received the IAC
+	 * (interpret-as-command) escape character (and therefore the next
+	 * character will be the command code)?  Refer to Telnet RFC 854. */
+	unsigned char iac;
+
+	/*! \brief IAC SB (option subnegotiation) handling */
+	unsigned char iac_sb_in_progress;
+	/* At the moment, we care only about the NAWS (window size) negotiation,
+	 * and that requires just a 5-character buffer (RFC 1073):
+	 * <NAWS char> <16-bit width> <16-bit height> */
+#define TELNET_NAWS_SB_LEN 5
+	/*! \brief sub-negotiation buffer */
+	unsigned char sb_buf[TELNET_NAWS_SB_LEN];
+	/*! \brief How many subnegotiation characters have we received?  
+	 *
+	 * We just drop those that do not fit in the buffer. */
+	size_t sb_len;
+
+	/*! \brief Window width */
+	int width;
+	/*! \brief Widnow height */
+	int height;
+
+	/*! \brief Configure lines. */
+	int lines;
+
+	int monitor;
+
+	/*! \brief In configure mode. */
+	int config;
+};
+
+/* Small macro to determine newline is newline only or linefeed needed. */
+#define VTY_NEWLINE  ((vty->type == VTY_TERM) ? "\r\n" : "\n")
+
+static inline const char *vty_newline(struct vty *vty)
+{
+	return VTY_NEWLINE;
+}
+
+/*! Information an application registers with the VTY */
+struct vty_app_info {
+	/*! \brief name of the application */
+	const char *name;
+	/*! \brief version string of the application */
+	const char *version;
+	/*! \brief copyright string of the application */
+	const char *copyright;
+	/*! \brief \ref talloc context */
+	void *tall_ctx;
+	/*! \brief call-back for returning to parent n ode */
+	enum node_type (*go_parent_cb)(struct vty *vty);
+	/*! \brief call-back to determine if node is config node */
+	int (*is_config_node)(struct vty *vty, int node);
+};
+
+/* Prototypes. */
+void vty_init(struct vty_app_info *app_info);
+int vty_read_config_file(const char *file_name, void *priv);
+void vty_init_vtysh (void);
+void vty_reset (void);
+struct vty *vty_new (void);
+struct vty *vty_create (int vty_sock, void *priv);
+int vty_out (struct vty *, const char *, ...) VTY_PRINTF_ATTRIBUTE(2, 3);
+int vty_out_newline(struct vty *);
+int vty_read(struct vty *vty);
+//void vty_time_print (struct vty *, int);
+void vty_close (struct vty *);
+char *vty_get_cwd (void);
+void vty_log (const char *level, const char *proto, const char *fmt, va_list);
+int vty_config_lock (struct vty *);
+int vty_config_unlock (struct vty *);
+int vty_shell (struct vty *);
+int vty_shell_serv (struct vty *);
+void vty_hello (struct vty *);
+void *vty_current_index(struct vty *);
+int vty_current_node(struct vty *vty);
+enum node_type vty_go_parent(struct vty *vty);
+
+extern void *tall_vty_ctx;
+
+extern struct cmd_element cfg_description_cmd;
+extern struct cmd_element cfg_no_description_cmd;
+
+/*! @} */
+
+#endif
diff --git a/src/shared/libosmocore/libosmocodec.pc.in b/src/shared/libosmocore/libosmocodec.pc.in
new file mode 100644
index 00000000..3030230b
--- /dev/null
+++ b/src/shared/libosmocore/libosmocodec.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: Osmocom Codec related utilities Library
+Description: C Utility Library
+Version: @VERSION@
+Libs: -L${libdir} -losmocodec
+Cflags: -I${includedir}/
+
diff --git a/src/shared/libosmocore/libosmocore.pc.in b/src/shared/libosmocore/libosmocore.pc.in
new file mode 100644
index 00000000..7c298693
--- /dev/null
+++ b/src/shared/libosmocore/libosmocore.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: Osmocom Core Library
+Description: C Utility Library
+Version: @VERSION@
+Libs: -L${libdir} -losmocore
+Cflags: -I${includedir}/
+
diff --git a/src/shared/libosmocore/libosmogb.pc.in b/src/shared/libosmocore/libosmogb.pc.in
new file mode 100644
index 00000000..33cacaf6
--- /dev/null
+++ b/src/shared/libosmocore/libosmogb.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: Osmocom GPRS Gb Library
+Description: Osmocom GPRS Gb Interface (NS/BSSGP) Library
+Version: @VERSION@
+Libs: -L${libdir} -losmogb -losmovty
+Cflags: -I${includedir}/ -fno-strict-aliasing
+
diff --git a/src/shared/libosmocore/libosmogsm.pc.in b/src/shared/libosmocore/libosmogsm.pc.in
new file mode 100644
index 00000000..753bb3a1
--- /dev/null
+++ b/src/shared/libosmocore/libosmogsm.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: Osmocom GSM Core Library
+Description: GSM Core Library
+Version: @VERSION@
+Libs: -L${libdir} -losmogsm
+Cflags: -I${includedir}/
+
diff --git a/src/shared/libosmocore/libosmovty.pc.in b/src/shared/libosmocore/libosmovty.pc.in
new file mode 100644
index 00000000..2cc0b5f8
--- /dev/null
+++ b/src/shared/libosmocore/libosmovty.pc.in
@@ -0,0 +1,11 @@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: Osmocom VTY Interface Library
+Description: C Utility Library
+Version: @VERSION@
+Libs: -L${libdir} -losmovty
+Cflags: -I${includedir}/
+
diff --git a/src/shared/libosmocore/m4/DUMMY b/src/shared/libosmocore/m4/DUMMY
new file mode 100644
index 00000000..fda557ad
--- /dev/null
+++ b/src/shared/libosmocore/m4/DUMMY
@@ -0,0 +1 @@
+Dummply placeholder.
diff --git a/src/shared/libosmocore/src/Makefile.am b/src/shared/libosmocore/src/Makefile.am
new file mode 100644
index 00000000..d719df7c
--- /dev/null
+++ b/src/shared/libosmocore/src/Makefile.am
@@ -0,0 +1,42 @@
+# This is _NOT_ the library release version, it's an API version.
+# Please read Chapter 6 "Library interface versions" of the libtool documentation before making any modification
+LIBVERSION=4:0:0
+
+INCLUDES = $(all_includes) -I$(top_srcdir)/include -I$(top_builddir)/include
+AM_CFLAGS = -Wall
+
+lib_LTLIBRARIES = libosmocore.la
+
+libosmocore_la_SOURCES = timer.c select.c signal.c msgb.c bits.c \
+			 bitvec.c statistics.c \
+			 write_queue.c utils.c socket.c \
+			 logging.c logging_syslog.c rate_ctr.c \
+			 gsmtap_util.c crc16.c panic.c backtrace.c \
+			 conv.c application.c rbtree.c \
+			 crc8gen.c crc16gen.c crc32gen.c crc64gen.c
+
+BUILT_SOURCES = crc8gen.c crc16gen.c crc32gen.c crc64gen.c
+
+if ENABLE_PLUGIN
+libosmocore_la_SOURCES += plugin.c
+libosmocore_la_LDFLAGS = -version-info $(LIBVERSION) $(LIBRARY_DL)
+else
+libosmocore_la_LDFLAGS = -version-info $(LIBVERSION)
+endif
+
+if ENABLE_TALLOC
+libosmocore_la_SOURCES += talloc.c
+else
+libosmocore_la_LIBADD = -ltalloc
+endif
+
+if ENABLE_MSGFILE
+libosmocore_la_SOURCES += msgfile.c
+endif
+
+if ENABLE_SERIAL
+libosmocore_la_SOURCES += serial.c
+endif
+
+crc%gen.c: crcXXgen.c.tpl
+	$(AM_V_GEN)sed -e's/XX/$*/g' $< > $@
diff --git a/src/shared/libosmocore/src/application.c b/src/shared/libosmocore/src/application.c
new file mode 100644
index 00000000..e0d989e5
--- /dev/null
+++ b/src/shared/libosmocore/src/application.c
@@ -0,0 +1,154 @@
+/* Utility functions to setup applications */
+/*
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2011 by Holger Hans Peter Freyther
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \file application.c
+ *  \brief Routines for helping with the osmocom application setup.
+ */
+
+/*! \mainpage libosmocore Documentation
+ * \section sec_intro Introduction
+ * This library is a collection of common code used in various
+ * sub-projects inside the Osmocom family of projects.  It includes a
+ * logging framework, select() loop abstraction, timers with callbacks,
+ * bit vectors, bit packing/unpacking, convolutional decoding, GSMTAP, a
+ * generic plugin interface, statistics counters, memory allocator,
+ * socket abstraction, message buffers, etc.
+ * \n\n
+ * Please note that C language projects inside Osmocom are typically
+ * single-threaded event-loop state machine designs.  As such,
+ * routines in libosmocore are not thread-safe.  If you must use them in
+ * a multi-threaded context, you have to add your own locking.
+ *
+ * \section sec_copyright Copyright and License
+ * Copyright © 2008-2011 - Harald Welte, Holger Freyther and contributors\n
+ * All rights reserved. \n\n
+ * The source code of libosmocore is licensed under the terms of the GNU
+ * General Public License as published by the Free Software Foundation;
+ * either version 2 of the License, or (at your option) any later
+ * version.\n
+ * See <http://www.gnu.org/licenses/> or COPYING included in the source
+ * code package istelf.\n
+ * The information detailed here is provided AS IS with NO WARRANTY OF
+ * ANY KIND, INCLUDING THE WARRANTY OF DESIGN, MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE.
+ * \n\n
+ *
+ * \section sec_contact Contact and Support
+ * Community-based support is available at the OpenBSC mailing list
+ * <http://lists.osmocom.org/mailman/listinfo/openbsc>\n
+ * Commercial support options available upon request from
+ * <http://sysmocom.de/>
+ */
+
+#include <osmocom/core/application.h>
+#include <osmocom/core/logging.h>
+
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <sys/stat.h>
+
+struct log_target *osmo_stderr_target;
+
+/*! \brief Ignore \ref SIGPIPE, \ref SIGALRM, \ref SIGHUP and \ref SIGIO */
+void osmo_init_ignore_signals(void)
+{
+	/* Signals that by default would terminate */
+	signal(SIGPIPE, SIG_IGN);
+	signal(SIGALRM, SIG_IGN);
+	signal(SIGHUP, SIG_IGN);
+	signal(SIGIO, SIG_IGN);
+}
+
+/*! \brief Initialize the osmocom logging framework
+ *  \param[in] log_info Array of available logging sub-systems
+ *  \returns 0 on success, -1 in case of error
+ *
+ * This function initializes the osmocom logging systems.  It also
+ * creates the default (stderr) logging target.
+ */
+int osmo_init_logging(const struct log_info *log_info)
+{
+	log_init(log_info, NULL);
+	osmo_stderr_target = log_target_create_stderr();
+	if (!osmo_stderr_target)
+		return -1;
+
+	log_add_target(osmo_stderr_target);
+	log_set_all_filter(osmo_stderr_target, 1);
+	return 0;
+}
+
+/*! \brief Turn the current process into a background daemon
+ *
+ * This function will fork the process, exit the parent and set umask,
+ * create a new session, close stdin/stdout/stderr and chdir to /tmp
+ */
+int osmo_daemonize(void)
+{
+	int rc;
+	pid_t pid, sid;
+
+	/* Check if parent PID == init, in which case we are already a daemon */
+	if (getppid() == 1)
+		return -EEXIST;
+
+	/* Fork from the parent process */
+	pid = fork();
+	if (pid < 0) {
+		/* some error happened */
+		return pid;
+	}
+
+	if (pid > 0) {
+		/* if we have received a positive PID, then we are the parent
+		 * and can exit */
+		exit(0);
+	}
+
+	/* FIXME: do we really want this? */
+	umask(0);
+
+	/* Create a new session and set process group ID */
+	sid = setsid();
+	if (sid < 0)
+		return sid;
+
+	/* Change to the /tmp directory, which prevents the CWD from being locked
+	 * and unable to remove it */
+	rc = chdir("/tmp");
+	if (rc < 0)
+		return rc;
+
+	/* Redirect stdio to /dev/null */
+/* since C89/C99 says stderr is a macro, we can safely do this! */
+#ifdef stderr
+	freopen("/dev/null", "r", stdin);
+	freopen("/dev/null", "w", stdout);
+	freopen("/dev/null", "w", stderr);
+#endif
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/backtrace.c b/src/shared/libosmocore/src/backtrace.c
new file mode 100644
index 00000000..5b93becb
--- /dev/null
+++ b/src/shared/libosmocore/src/backtrace.c
@@ -0,0 +1,90 @@
+/*
+ * (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \file backtrace.c
+ *  \brief Routines realted to generating call back traces
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/logging.h>
+#include "config.h"
+
+#ifdef HAVE_EXECINFO_H
+#include <execinfo.h>
+
+static void _osmo_backtrace(int use_printf, int subsys, int level)
+{
+	int i, nptrs;
+	void *buffer[100];
+	char **strings;
+
+	nptrs = backtrace(buffer, ARRAY_SIZE(buffer));
+	if (use_printf)
+		printf("backtrace() returned %d addresses\n", nptrs);
+	else
+		LOGP(subsys, level, "backtrace() returned %d addresses\n",
+		     nptrs);
+
+	strings = backtrace_symbols(buffer, nptrs);
+	if (!strings)
+		return;
+
+	for (i = 1; i < nptrs; i++) {
+		if (use_printf)
+			printf("%s\n", strings[i]);
+		else
+			LOGP(subsys, level, "\t%s\n", strings[i]);
+	}
+
+	free(strings);
+}
+
+/*! \brief Generate and print a call back-trace
+ *
+ * This function will generate a function call back-trace of the
+ * current process and print it to stdout. */
+void osmo_generate_backtrace(void)
+{
+	_osmo_backtrace(1, 0, 0);
+}
+
+/*! \brief Generate and log a call back-trace
+ *
+ * This function will generate a function call back-trace of the
+ * current process and log it to the specified subsystem and
+ * level using the libosmocore logging subsystem */
+void osmo_log_backtrace(int subsys, int level)
+{
+	_osmo_backtrace(0, subsys, level);
+}
+#else
+void osmo_generate_backtrace(void)
+{
+	printf("This platform has no backtrace function\n");
+}
+void osmo_log_backtrace(int subsys, int level)
+{
+	LOGP(subsys, level, "This platform has no backtrace function\n");
+}
+#endif
diff --git a/src/shared/libosmocore/src/bits.c b/src/shared/libosmocore/src/bits.c
new file mode 100644
index 00000000..4c67bddb
--- /dev/null
+++ b/src/shared/libosmocore/src/bits.c
@@ -0,0 +1,188 @@
+
+#include <stdint.h>
+
+#include <osmocom/core/bits.h>
+
+/*! \addtogroup bits
+ *  @{
+ */
+
+/*! \file bits.c
+ *  \brief Osmocom bit level support code
+ */
+
+
+/*! \brief convert unpacked bits to packed bits, return length in bytes
+ *  \param[out] out output buffer of packed bits
+ *  \param[in] in input buffer of unpacked bits
+ *  \param[in] num_bits number of bits
+ */
+int osmo_ubit2pbit(pbit_t *out, const ubit_t *in, unsigned int num_bits)
+{
+	unsigned int i;
+	uint8_t curbyte = 0;
+	pbit_t *outptr = out;
+
+	for (i = 0; i < num_bits; i++) {
+		uint8_t bitnum = 7 - (i % 8);
+
+		curbyte |= (in[i] << bitnum);
+
+		if(i % 8 == 7){
+			*outptr++ = curbyte;
+			curbyte = 0;
+		}
+	}
+	/* we have a non-modulo-8 bitcount */
+	if (i % 8)
+		*outptr++ = curbyte;
+
+	return outptr - out;
+}
+
+/*! \brief convert packed bits to unpacked bits, return length in bytes
+ *  \param[out] out output buffer of unpacked bits
+ *  \param[in] in input buffer of packed bits
+ *  \param[in] num_bits number of bits
+ */
+int osmo_pbit2ubit(ubit_t *out, const pbit_t *in, unsigned int num_bits)
+{
+	unsigned int i;
+	ubit_t *cur = out;
+	ubit_t *limit = out + num_bits;
+
+	for (i = 0; i < (num_bits/8)+1; i++) {
+		pbit_t byte = in[i];
+		*cur++ = (byte >> 7) & 1;
+		if (cur >= limit)
+			break;
+		*cur++ = (byte >> 6) & 1;
+		if (cur >= limit)
+			break;
+		*cur++ = (byte >> 5) & 1;
+		if (cur >= limit)
+			break;
+		*cur++ = (byte >> 4) & 1;
+		if (cur >= limit)
+			break;
+		*cur++ = (byte >> 3) & 1;
+		if (cur >= limit)
+			break;
+		*cur++ = (byte >> 2) & 1;
+		if (cur >= limit)
+			break;
+		*cur++ = (byte >> 1) & 1;
+		if (cur >= limit)
+			break;
+		*cur++ = (byte >> 0) & 1;
+		if (cur >= limit)
+			break;
+	}
+	return cur - out;
+}
+
+/*! \brief convert unpacked bits to packed bits (extended options)
+ *  \param[out] out output buffer of packed bits
+ *  \param[in] out_ofs offset into output buffer
+ *  \param[in] in input buffer of unpacked bits
+ *  \param[in] in_ofs offset into input buffer
+ *  \param[in] num_bits number of bits
+ *  \param[in] lsb_mode Encode bits in LSB orde instead of MSB
+ *  \returns length in bytes (max written offset of output buffer + 1)
+ */
+int osmo_ubit2pbit_ext(pbit_t *out, unsigned int out_ofs,
+                       const ubit_t *in, unsigned int in_ofs,
+                       unsigned int num_bits, int lsb_mode)
+{
+	int i, op, bn;
+	for (i=0; i<num_bits; i++) {
+		op = out_ofs + i;
+		bn = lsb_mode ? (op&7) : (7-(op&7));
+		if (in[in_ofs+i])
+			out[op>>3] |= 1 << bn;
+		else
+			out[op>>3] &= ~(1 << bn);
+	}
+	return ((out_ofs + num_bits - 1) >> 3) + 1;
+}
+
+/*! \brief convert packed bits to unpacked bits (extended options)
+ *  \param[out] out output buffer of unpacked bits
+ *  \param[in] out_ofs offset into output buffer
+ *  \param[in] in input buffer of packed bits
+ *  \param[in] in_ofs offset into input buffer
+ *  \param[in] num_bits number of bits
+ *  \param[in] lsb_mode Encode bits in LSB orde instead of MSB
+ *  \returns length in bytes (max written offset of output buffer + 1)
+ */
+int osmo_pbit2ubit_ext(ubit_t *out, unsigned int out_ofs,
+                       const pbit_t *in, unsigned int in_ofs,
+                       unsigned int num_bits, int lsb_mode)
+{
+	int i, ip, bn;
+	for (i=0; i<num_bits; i++) {
+		ip = in_ofs + i;
+		bn = lsb_mode ? (ip&7) : (7-(ip&7));
+		out[out_ofs+i] = !!(in[ip>>3] & (1<<bn));
+	}
+	return out_ofs + num_bits;
+}
+
+/* generalized bit reversal function, Chapter 7 "Hackers Delight" */
+uint32_t osmo_bit_reversal(uint32_t x, enum osmo_br_mode k)
+{
+	if (k &  1) x = (x & 0x55555555) <<  1 | (x & 0xAAAAAAAA) >>  1;
+	if (k &  2) x = (x & 0x33333333) <<  2 | (x & 0xCCCCCCCC) >>  2;
+	if (k &  4) x = (x & 0x0F0F0F0F) <<  4 | (x & 0xF0F0F0F0) >>  4;
+	if (k &  8) x = (x & 0x00FF00FF) <<  8 | (x & 0xFF00FF00) >>  8;
+	if (k & 16) x = (x & 0x0000FFFF) << 16 | (x & 0xFFFF0000) >> 16;
+
+	return x;
+}
+
+/* generalized bit reversal function, Chapter 7 "Hackers Delight" */
+uint32_t osmo_revbytebits_32(uint32_t x)
+{
+	x = (x & 0x55555555) <<  1 | (x & 0xAAAAAAAA) >>  1;
+	x = (x & 0x33333333) <<  2 | (x & 0xCCCCCCCC) >>  2;
+	x = (x & 0x0F0F0F0F) <<  4 | (x & 0xF0F0F0F0) >>  4;
+
+	return x;
+}
+
+uint32_t osmo_revbytebits_8(uint8_t x)
+{
+	x = (x & 0x55) <<  1 | (x & 0xAA) >>  1;
+	x = (x & 0x33) <<  2 | (x & 0xCC) >>  2;
+	x = (x & 0x0F) <<  4 | (x & 0xF0) >>  4;
+
+	return x;
+}
+
+void osmo_revbytebits_buf(uint8_t *buf, int len)
+{
+	unsigned int i;
+	unsigned int unaligned_cnt;
+	int len_remain = len;
+
+	unaligned_cnt = ((unsigned long)buf & 3);
+	for (i = 0; i < unaligned_cnt; i++) {
+		buf[i] = osmo_revbytebits_8(buf[i]);
+		len_remain--;
+		if (len_remain <= 0)
+			return;
+	}
+
+	for (i = unaligned_cnt; i < len; i += 4) {
+		uint32_t *cur = (uint32_t *) (buf + i);
+		*cur = osmo_revbytebits_32(*cur);
+		len_remain -= 4;
+	}
+
+	for (i = len - len_remain; i < len; i++) {
+		buf[i] = osmo_revbytebits_8(buf[i]);
+		len_remain--;
+	}
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/bitvec.c b/src/shared/libosmocore/src/bitvec.c
new file mode 100644
index 00000000..714c11b7
--- /dev/null
+++ b/src/shared/libosmocore/src/bitvec.c
@@ -0,0 +1,264 @@
+/* bit vector utility routines */
+
+/* (C) 2009 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \addtogroup bitvec
+ *  @{
+ */
+
+/*! \file bitvec.c
+ *  \brief Osmocom bit vector abstraction
+ */
+
+#include <errno.h>
+#include <stdint.h>
+
+#include <osmocom/core/bitvec.h>
+
+#define BITNUM_FROM_COMP(byte, bit)	((byte*8)+bit)
+
+static inline unsigned int bytenum_from_bitnum(unsigned int bitnum)
+{
+	unsigned int bytenum = bitnum / 8;
+
+	return bytenum;
+}
+
+/* convert ZERO/ONE/L/H to a bitmask at given pos in a byte */
+static uint8_t bitval2mask(enum bit_value bit, uint8_t bitnum)
+{
+	int bitval;
+
+	switch (bit) {
+	case ZERO:
+		bitval = (0 << bitnum);
+		break;
+	case ONE:
+		bitval = (1 << bitnum);
+		break;
+	case L:
+		bitval = ((0x2b ^ (0 << bitnum)) & (1 << bitnum));
+		break;
+	case H:
+		bitval = ((0x2b ^ (1 << bitnum)) & (1 << bitnum));
+		break;
+	default:
+		return 0;
+	}
+	return bitval;
+}
+
+/*! \brief check if the bit is 0 or 1 for a given position inside a bitvec
+ *  \param[in] bv the bit vector on which to check
+ *  \param[in] bitnr the bit number inside the bit vector to check
+ *  \returns 
+ */
+enum bit_value bitvec_get_bit_pos(const struct bitvec *bv, unsigned int bitnr)
+{
+	unsigned int bytenum = bytenum_from_bitnum(bitnr);
+	unsigned int bitnum = 7 - (bitnr % 8);
+	uint8_t bitval;
+
+	if (bytenum >= bv->data_len)
+		return -EINVAL;
+
+	bitval = bitval2mask(ONE, bitnum);
+
+	if (bv->data[bytenum] & bitval)
+		return ONE;
+
+	return ZERO;
+}
+
+/*! \brief check if the bit is L or H for a given position inside a bitvec
+ *  \param[in] bv the bit vector on which to check
+ *  \param[in] bitnr the bit number inside the bit vector to check
+ */
+enum bit_value bitvec_get_bit_pos_high(const struct bitvec *bv,
+					unsigned int bitnr)
+{
+	unsigned int bytenum = bytenum_from_bitnum(bitnr);
+	unsigned int bitnum = 7 - (bitnr % 8);
+	uint8_t bitval;
+
+	if (bytenum >= bv->data_len)
+		return -EINVAL;
+
+	bitval = bitval2mask(H, bitnum);
+
+	if ((bv->data[bytenum] & (1 << bitnum)) == bitval)
+		return H;
+
+	return L;
+}
+
+/*! \brief get the Nth set bit inside the bit vector
+ *  \param[in] bv the bit vector to use
+ *  \param[in] n the bit number to get
+ *  \returns the bit number (offset) of the Nth set bit in \a bv
+ */
+unsigned int bitvec_get_nth_set_bit(const struct bitvec *bv, unsigned int n)
+{
+	unsigned int i, k = 0;
+
+	for (i = 0; i < bv->data_len*8; i++) {
+		if (bitvec_get_bit_pos(bv, i) == ONE) {
+			k++;
+			if (k == n)
+				return i;
+		}
+	}
+
+	return 0;
+}
+
+/*! \brief set a bit at given position in a bit vector
+ *  \param[in] bv bit vector on which to operate
+ *  \param[in] bitnum number of bit to be set
+ *  \param[in] bit value to which the bit is to be set
+ */
+int bitvec_set_bit_pos(struct bitvec *bv, unsigned int bitnr,
+			enum bit_value bit)
+{
+	unsigned int bytenum = bytenum_from_bitnum(bitnr);
+	unsigned int bitnum = 7 - (bitnr % 8);
+	uint8_t bitval;
+
+	if (bytenum >= bv->data_len)
+		return -EINVAL;
+
+	/* first clear the bit */
+	bitval = bitval2mask(ONE, bitnum);
+	bv->data[bytenum] &= ~bitval;
+
+	/* then set it to desired value */
+	bitval = bitval2mask(bit, bitnum);
+	bv->data[bytenum] |= bitval;
+
+	return 0;
+}
+
+/*! \brief set the next bit inside a bitvec
+ *  \param[in] bv bit vector to be used
+ *  \param[in] bit value of the bit to be set
+ */
+int bitvec_set_bit(struct bitvec *bv, enum bit_value bit)
+{
+	int rc;
+
+	rc = bitvec_set_bit_pos(bv, bv->cur_bit, bit);
+	if (!rc)
+		bv->cur_bit++;
+
+	return rc;
+}
+
+/*! \brief get the next bit (low/high) inside a bitvec */
+int bitvec_get_bit_high(struct bitvec *bv)
+{
+	int rc;
+
+	rc = bitvec_get_bit_pos_high(bv, bv->cur_bit);
+	if (rc >= 0)
+		bv->cur_bit++;
+
+	return rc;
+}
+
+/*! \brief set multiple bits (based on array of bitvals) at current pos
+ *  \param[in] bv bit vector
+ *  \param[in] bits array of \ref bit_value
+ *  \param[in] count number of bits to set
+ */
+int bitvec_set_bits(struct bitvec *bv, enum bit_value *bits, int count)
+{
+	int i, rc;
+
+	for (i = 0; i < count; i++) {
+		rc = bitvec_set_bit(bv, bits[i]);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+/*! \brief set multiple bits (based on numeric value) at current pos */
+int bitvec_set_uint(struct bitvec *bv, unsigned int ui, int num_bits)
+{
+	int i, rc;
+
+	for (i = 0; i < num_bits; i++) {
+		int bit = 0;
+		if (ui & (1 << (num_bits - i - 1)))
+			bit = 1;
+		rc = bitvec_set_bit(bv, bit);
+		if (rc)
+			return rc;
+	}
+
+	return 0;
+}
+
+/*! \brief get multiple bits (based on numeric value) from current pos */
+int bitvec_get_uint(struct bitvec *bv, int num_bits)
+{
+	int i;
+	unsigned int ui = 0;
+
+	for (i = 0; i < num_bits; i++) {
+		int bit = bitvec_get_bit_pos(bv, bv->cur_bit);
+		if (bit < 0)
+			return bit;
+		if (bit)
+			ui |= (1 << (num_bits - i - 1));
+		bv->cur_bit++;
+	}
+
+	return ui;
+}
+
+/*! \brief pad all remaining bits up to num_bits */
+int bitvec_spare_padding(struct bitvec *bv, unsigned int up_to_bit)
+{
+	unsigned int i;
+
+	for (i = bv->cur_bit; i <= up_to_bit; i++)
+		bitvec_set_bit(bv, L);
+
+	return 0;
+}
+
+/*! \brief find first bit set in bit vector */
+int bitvec_find_bit_pos(const struct bitvec *bv, unsigned int n,
+			enum bit_value val)
+{
+	unsigned int i;
+
+	for (i = n; i < bv->data_len*8; i++) {
+		if (bitvec_get_bit_pos(bv, i) == val)
+			return i;
+	}
+
+	return -1;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/codec/Makefile.am b/src/shared/libosmocore/src/codec/Makefile.am
new file mode 100644
index 00000000..665768c6
--- /dev/null
+++ b/src/shared/libosmocore/src/codec/Makefile.am
@@ -0,0 +1,11 @@
+# This is _NOT_ the library release version, it's an API version.
+# Please read Chapter 6 "Library interface versions" of the libtool documentation before making any modification
+LIBVERSION=0:0:0
+
+INCLUDES = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS = -Wall
+
+lib_LTLIBRARIES = libosmocodec.la
+
+libosmocodec_la_SOURCES = gsm610.c gsm620.c gsm660.c gsm690.c
+libosmocodec_la_LDFLAGS = -version-info $(LIBVERSION)
diff --git a/src/shared/libosmocore/src/codec/gsm610.c b/src/shared/libosmocore/src/codec/gsm610.c
new file mode 100644
index 00000000..35f6011d
--- /dev/null
+++ b/src/shared/libosmocore/src/codec/gsm610.c
@@ -0,0 +1,294 @@
+/* GSM 06.10 - GSM FR codec */
+
+/*
+ * (C) 2010 Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+/* GSM FR - subjective importance bit ordering */
+	/* This array encodes GSM 05.03 Table 2.
+	 * It's also GSM 06.10 Table A.2.1a
+	 *
+	 * It converts between serial parameter output by the encoder and the
+	 * order needed before channel encoding.
+	 */
+const uint16_t gsm610_bitorder[260] = {
+	0,	/* LARc0:5 */
+	47,	/* Xmaxc0:5 */
+	103,	/* Xmaxc1:5 */
+	159,	/* Xmaxc2:5 */
+	215,	/* Xmaxc3:5 */
+	1,	/* LARc0:4 */
+	6,	/* LARc1:5 */
+	12,	/* LARc2:4 */
+	2,	/* LARc0:3 */
+	7,	/* LARc1:4 */
+	13,	/* LARc2:3 */
+	17,	/* LARc3:4 */
+	36,	/* Nc0:6 */
+	92,	/* Nc1:6 */
+	148,	/* Nc2:6 */
+	204,	/* Nc3:6 */
+	48,	/* Xmaxc0:4 */
+	104,	/* Xmaxc1:4 */
+	160,	/* Xmaxc2:4 */
+	216,	/* Xmaxc3:4 */
+	8,	/* LARc1:3 */
+	22,	/* LARc4:3 */
+	26,	/* LARc5:3 */
+	37,	/* Nc0:5 */
+	93,	/* Nc1:5 */
+	149,	/* Nc2:5 */
+	205,	/* Nc3:5 */
+	38,	/* Nc0:4 */
+	94,	/* Nc1:4 */
+	150,	/* Nc2:4 */
+	206,	/* Nc3:4 */
+	39,	/* Nc0:3 */
+	95,	/* Nc1:3 */
+	151,	/* Nc2:3 */
+	207,	/* Nc3:3 */
+	40,	/* Nc0:2 */
+	96,	/* Nc1:2 */
+	152,	/* Nc2:2 */
+	208,	/* Nc3:2 */
+	49,	/* Xmaxc0:3 */
+	105,	/* Xmaxc1:3 */
+	161,	/* Xmaxc2:3 */
+	217,	/* Xmaxc3:3 */
+	3,	/* LARc0:2 */
+	18,	/* LARc3:3 */
+	30,	/* LARc6:2 */
+	41,	/* Nc0:1 */
+	97,	/* Nc1:1 */
+	153,	/* Nc2:1 */
+	209,	/* Nc3:1 */
+	23,	/* LARc4:2 */
+	27,	/* LARc5:2 */
+	43,	/* bc0:1 */
+	99,	/* bc1:1 */
+	155,	/* bc2:1 */
+	211,	/* bc3:1 */
+	42,	/* Nc0:0 */
+	98,	/* Nc1:0 */
+	154,	/* Nc2:0 */
+	210,	/* Nc3:0 */
+	45,	/* Mc0:1 */
+	101,	/* Mc1:1 */
+	157,	/* Mc2:1 */
+	213,	/* Mc3:1 */
+	4,	/* LARc0:1 */
+	9,	/* LARc1:2 */
+	14,	/* LARc2:2 */
+	33,	/* LARc7:2 */
+	19,	/* LARc3:2 */
+	24,	/* LARc4:1 */
+	31,	/* LARc6:1 */
+	44,	/* bc0:0 */
+	100,	/* bc1:0 */
+	156,	/* bc2:0 */
+	212,	/* bc3:0 */
+	50,	/* Xmaxc0:2 */
+	106,	/* Xmaxc1:2 */
+	162,	/* Xmaxc2:2 */
+	218,	/* Xmaxc3:2 */
+	53,	/* xmc0_0:2 */
+	56,	/* xmc0_1:2 */
+	59,	/* xmc0_2:2 */
+	62,	/* xmc0_3:2 */
+	65,	/* xmc0_4:2 */
+	68,	/* xmc0_5:2 */
+	71,	/* xmc0_6:2 */
+	74,	/* xmc0_7:2 */
+	77,	/* xmc0_8:2 */
+	80,	/* xmc0_9:2 */
+	83,	/* xmc0_10:2 */
+	86,	/* xmc0_11:2 */
+	89,	/* xmc0_12:2 */
+	109,	/* xmc1_0:2 */
+	112,	/* xmc1_1:2 */
+	115,	/* xmc1_2:2 */
+	118,	/* xmc1_3:2 */
+	121,	/* xmc1_4:2 */
+	124,	/* xmc1_5:2 */
+	127,	/* xmc1_6:2 */
+	130,	/* xmc1_7:2 */
+	133,	/* xmc1_8:2 */
+	136,	/* xmc1_9:2 */
+	139,	/* xmc1_10:2 */
+	142,	/* xmc1_11:2 */
+	145,	/* xmc1_12:2 */
+	165,	/* xmc2_0:2 */
+	168,	/* xmc2_1:2 */
+	171,	/* xmc2_2:2 */
+	174,	/* xmc2_3:2 */
+	177,	/* xmc2_4:2 */
+	180,	/* xmc2_5:2 */
+	183,	/* xmc2_6:2 */
+	186,	/* xmc2_7:2 */
+	189,	/* xmc2_8:2 */
+	192,	/* xmc2_9:2 */
+	195,	/* xmc2_10:2 */
+	198,	/* xmc2_11:2 */
+	201,	/* xmc2_12:2 */
+	221,	/* xmc3_0:2 */
+	224,	/* xmc3_1:2 */
+	227,	/* xmc3_2:2 */
+	230,	/* xmc3_3:2 */
+	233,	/* xmc3_4:2 */
+	236,	/* xmc3_5:2 */
+	239,	/* xmc3_6:2 */
+	242,	/* xmc3_7:2 */
+	245,	/* xmc3_8:2 */
+	248,	/* xmc3_9:2 */
+	251,	/* xmc3_10:2 */
+	254,	/* xmc3_11:2 */
+	257,	/* xmc3_12:2 */
+	46,	/* Mc0:0 */
+	102,	/* Mc1:0 */
+	158,	/* Mc2:0 */
+	214,	/* Mc3:0 */
+	51,	/* Xmaxc0:1 */
+	107,	/* Xmaxc1:1 */
+	163,	/* Xmaxc2:1 */
+	219,	/* Xmaxc3:1 */
+	54,	/* xmc0_0:1 */
+	57,	/* xmc0_1:1 */
+	60,	/* xmc0_2:1 */
+	63,	/* xmc0_3:1 */
+	66,	/* xmc0_4:1 */
+	69,	/* xmc0_5:1 */
+	72,	/* xmc0_6:1 */
+	75,	/* xmc0_7:1 */
+	78,	/* xmc0_8:1 */
+	81,	/* xmc0_9:1 */
+	84,	/* xmc0_10:1 */
+	87,	/* xmc0_11:1 */
+	90,	/* xmc0_12:1 */
+	110,	/* xmc1_0:1 */
+	113,	/* xmc1_1:1 */
+	116,	/* xmc1_2:1 */
+	119,	/* xmc1_3:1 */
+	122,	/* xmc1_4:1 */
+	125,	/* xmc1_5:1 */
+	128,	/* xmc1_6:1 */
+	131,	/* xmc1_7:1 */
+	134,	/* xmc1_8:1 */
+	137,	/* xmc1_9:1 */
+	140,	/* xmc1_10:1 */
+	143,	/* xmc1_11:1 */
+	146,	/* xmc1_12:1 */
+	166,	/* xmc2_0:1 */
+	169,	/* xmc2_1:1 */
+	172,	/* xmc2_2:1 */
+	175,	/* xmc2_3:1 */
+	178,	/* xmc2_4:1 */
+	181,	/* xmc2_5:1 */
+	184,	/* xmc2_6:1 */
+	187,	/* xmc2_7:1 */
+	190,	/* xmc2_8:1 */
+	193,	/* xmc2_9:1 */
+	196,	/* xmc2_10:1 */
+	199,	/* xmc2_11:1 */
+	202,	/* xmc2_12:1 */
+	222,	/* xmc3_0:1 */
+	225,	/* xmc3_1:1 */
+	228,	/* xmc3_2:1 */
+	231,	/* xmc3_3:1 */
+	234,	/* xmc3_4:1 */
+	237,	/* xmc3_5:1 */
+	240,	/* xmc3_6:1 */
+	243,	/* xmc3_7:1 */
+	246,	/* xmc3_8:1 */
+	249,	/* xmc3_9:1 */
+	252,	/* xmc3_10:1 */
+	255,	/* xmc3_11:1 */
+	258,	/* xmc3_12:1 */
+	5,	/* LARc0:0 */
+	10,	/* LARc1:1 */
+	15,	/* LARc2:1 */
+	28,	/* LARc5:1 */
+	32,	/* LARc6:0 */
+	34,	/* LARc7:1 */
+	35,	/* LARc7:0 */
+	16,	/* LARc2:0 */
+	20,	/* LARc3:1 */
+	21,	/* LARc3:0 */
+	25,	/* LARc4:0 */
+	52,	/* Xmaxc0:0 */
+	108,	/* Xmaxc1:0 */
+	164,	/* Xmaxc2:0 */
+	220,	/* Xmaxc3:0 */
+	55,	/* xmc0_0:0 */
+	58,	/* xmc0_1:0 */
+	61,	/* xmc0_2:0 */
+	64,	/* xmc0_3:0 */
+	67,	/* xmc0_4:0 */
+	70,	/* xmc0_5:0 */
+	73,	/* xmc0_6:0 */
+	76,	/* xmc0_7:0 */
+	79,	/* xmc0_8:0 */
+	82,	/* xmc0_9:0 */
+	85,	/* xmc0_10:0 */
+	88,	/* xmc0_11:0 */
+	91,	/* xmc0_12:0 */
+	111,	/* xmc1_0:0 */
+	114,	/* xmc1_1:0 */
+	117,	/* xmc1_2:0 */
+	120,	/* xmc1_3:0 */
+	123,	/* xmc1_4:0 */
+	126,	/* xmc1_5:0 */
+	129,	/* xmc1_6:0 */
+	132,	/* xmc1_7:0 */
+	135,	/* xmc1_8:0 */
+	138,	/* xmc1_9:0 */
+	141,	/* xmc1_10:0 */
+	144,	/* xmc1_11:0 */
+	147,	/* xmc1_12:0 */
+	167,	/* xmc2_0:0 */
+	170,	/* xmc2_1:0 */
+	173,	/* xmc2_2:0 */
+	176,	/* xmc2_3:0 */
+	179,	/* xmc2_4:0 */
+	182,	/* xmc2_5:0 */
+	185,	/* xmc2_6:0 */
+	188,	/* xmc2_7:0 */
+	191,	/* xmc2_8:0 */
+	194,	/* xmc2_9:0 */
+	197,	/* xmc2_10:0 */
+	200,	/* xmc2_11:0 */
+	203,	/* xmc2_12:0 */
+	223,	/* xmc3_0:0 */
+	226,	/* xmc3_1:0 */
+	229,	/* xmc3_2:0 */
+	232,	/* xmc3_3:0 */
+	235,	/* xmc3_4:0 */
+	238,	/* xmc3_5:0 */
+	241,	/* xmc3_6:0 */
+	244,	/* xmc3_7:0 */
+	247,	/* xmc3_8:0 */
+	250,	/* xmc3_9:0 */
+	253,	/* xmc3_10:0 */
+	256,	/* xmc3_11:0 */
+	259,	/* xmc3_12:0 */
+	11,	/* LARc1:0 */
+	29,	/* LARc5:0 */
+};
diff --git a/src/shared/libosmocore/src/codec/gsm620.c b/src/shared/libosmocore/src/codec/gsm620.c
new file mode 100644
index 00000000..fa570e4f
--- /dev/null
+++ b/src/shared/libosmocore/src/codec/gsm620.c
@@ -0,0 +1,262 @@
+/* GSM 06.20 - GSM HR codec */
+
+/*
+ * (C) 2010 Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+/* GSM HR unvoiced (mode=0) frames - subjective importance bit ordering */
+	/* This array encode mapping between GSM 05.03 Table 3a (bits
+	 * ordering before channel coding on TCH) and GSM 06.20 Table B.1
+	 * (bit ordering on A-bis */
+const uint16_t gsm620_unvoiced_bitorder[112] = {
+	3,	/* R0:1 */
+	25,	/* LPC 3:7 */
+	52,	/* GSP 0-1:2 */
+	71,	/* GSP 0-2:2 */
+	90,	/* GSP 0-3:2 */
+	109,	/* GSP 0-4:2 */
+	15,	/* LPC 1:0 */
+	23,	/* LPC 2:1 */
+	22,	/* LPC 2:2 */
+	21,	/* LPC 2:3 */
+	20,	/* LPC 2:4 */
+	19,	/* LPC 2:5 */
+	31,	/* LPC 3:1 */
+	30,	/* LPC 3:2 */
+	29,	/* LPC 3:3 */
+	28,	/* LPC 3:4 */
+	27,	/* LPC 3:5 */
+	26,	/* LPC 3:6 */
+	61,	/* Code 1-2:0 */
+	68,	/* Code 2-2:0 */
+	67,	/* Code 2-2:1 */
+	66,	/* Code 2-2:2 */
+	65,	/* Code 2-2:3 */
+	64,	/* Code 2-2:4 */
+	63,	/* Code 2-2:5 */
+	62,	/* Code 2-2:6 */
+	80,	/* Code 1-3:0 */
+	79,	/* Code 1-3:1 */
+	78,	/* Code 1-3:2 */
+	77,	/* Code 1-3:3 */
+	76,	/* Code 1-3:4 */
+	75,	/* Code 1-3:5 */
+	74,	/* Code 1-3:6 */
+	84,	/* Code 2-3:3 */
+	83,	/* Code 2-3:4 */
+	82,	/* Code 2-3:5 */
+	81,	/* Code 2-3:6 */
+	32,	/* LPC 3:0 */
+	4,	/* R0:0 */
+	33,	/* INT-LPC:0 */
+	60,	/* Code 1-2:1 */
+	59,	/* Code 1-2:2 */
+	58,	/* Code 1-2:3 */
+	57,	/* Code 1-2:4 */
+	56,	/* Code 1-2:5 */
+	55,	/* Code 1-2:6 */
+	49,	/* Code 2-1:0 */
+	48,	/* Code 2-1:1 */
+	47,	/* Code 2-1:2 */
+	46,	/* Code 2-1:3 */
+	45,	/* Code 2-1:4 */
+	44,	/* Code 2-1:5 */
+	43,	/* Code 2-1:6 */
+	42,	/* Code 1-1:0 */
+	41,	/* Code 1-1:1 */
+	40,	/* Code 1-1:2 */
+	39,	/* Code 1-1:3 */
+	38,	/* Code 1-1:4 */
+	37,	/* Code 1-1:5 */
+	36,	/* Code 1-1:6 */
+	111,	/* GSP 0-4:0 */
+	92,	/* GSP 0-3:0 */
+	73,	/* GSP 0-2:0 */
+	54,	/* GSP 0-1:0 */
+	24,	/* LPC 2:0 */
+	110,	/* GSP 0-4:1 */
+	91,	/* GSP 0-3:1 */
+	72,	/* GSP 0-2:1 */
+	53,	/* GSP 0-1:1 */
+	14,	/* LPC 1:1 */
+	13,	/* LPC 1:2 */
+	12,	/* LPC 1:3 */
+	11,	/* LPC 1:4 */
+	10,	/* LPC 1:5 */
+	108,	/* GSP 0-4:3 */
+	89,	/* GSP 0-3:3 */
+	70,	/* GSP 0-2:3 */
+	51,	/* GSP 0-1:3 */
+	18,	/* LPC 2:6 */
+	17,	/* LPC 2:7 */
+	16,	/* LPC 2:8 */
+	107,	/* GSP 0-4:4 */
+	88,	/* GSP 0-3:4 */
+	69,	/* GSP 0-2:4 */
+	50,	/* GSP 0-1:4 */
+	9,	/* LPC 1:6 */
+	8,	/* LPC 1:7 */
+	7,	/* LPC 1:8 */
+	6,	/* LPC 1:9 */
+	2,	/* R0:2 */
+	5,	/* LPC 1:10 */
+	1,	/* R0:3 */
+	0,	/* R0:4 */
+	35,	/* Mode:0 */
+	34,	/* Mode:1 */
+	106,	/* Code 2-4:0 */
+	105,	/* Code 2-4:1 */
+	104,	/* Code 2-4:2 */
+	103,	/* Code 2-4:3 */
+	102,	/* Code 2-4:4 */
+	101,	/* Code 2-4:5 */
+	100,	/* Code 2-4:6 */
+	99,	/* Code 1-4:0 */
+	98,	/* Code 1-4:1 */
+	97,	/* Code 1-4:2 */
+	96,	/* Code 1-4:3 */
+	95,	/* Code 1-4:4 */
+	94,	/* Code 1-4:5 */
+	93,	/* Code 1-4:6 */
+	87,	/* Code 2-3:0 */
+	86,	/* Code 2-3:1 */
+	85,	/* Code 2-3:2 */
+};
+
+/* GSM HR voiced (mode=1,2,3) frames - subjective importance bit ordering */
+	/* This array encode mapping between GSM 05.03 Table 3b (bits
+	 * ordering before channel coding on TCH) and GSM 06.20 Table B.2
+	 * (bit ordering on A-bis */
+const uint16_t gsm620_voiced_bitorder[112] = {
+	13,	/* LPC 1:2 */
+	14,	/* LPC 1:1 */
+	20,	/* LPC 2:4 */
+	19,	/* LPC 2:5 */
+	18,	/* LPC 2:6 */
+	53,	/* GSP 0-1:4 */
+	71,	/* GSP 0-2:4 */
+	89,	/* GSP 0-3:4 */
+	107,	/* GSP 0-4:4 */
+	54,	/* GSP 0-1:3 */
+	72,	/* GSP 0-2:3 */
+	90,	/* GSP 0-3:3 */
+	108,	/* GSP 0-4:3 */
+	55,	/* GSP 0-1:2 */
+	73,	/* GSP 0-2:2 */
+	91,	/* GSP 0-3:2 */
+	109,	/* GSP 0-4:2 */
+	52,	/* Code 1:0 */
+	51,	/* Code 1:1 */
+	50,	/* Code 1:2 */
+	49,	/* Code 1:3 */
+	48,	/* Code 1:4 */
+	47,	/* Code 1:5 */
+	46,	/* Code 1:6 */
+	45,	/* Code 1:7 */
+	44,	/* Code 1:8 */
+	65,	/* Code 2:5 */
+	64,	/* Code 2:6 */
+	63,	/* Code 2:7 */
+	62,	/* Code 2:8 */
+	70,	/* Code 2:0 */
+	69,	/* Code 2:1 */
+	68,	/* Code 2:2 */
+	80,	/* Code 3:8 */
+	66,	/* Code 2:4 */
+	67,	/* Code 2:3 */
+	56,	/* GSP 0-1:1 */
+	74,	/* GSP 0-2:1 */
+	92,	/* GSP 0-3:1 */
+	110,	/* GSP 0-4:1 */
+	57,	/* GSP 0-1:0 */
+	75,	/* GSP 0-2:0 */
+	93,	/* GSP 0-3:0 */
+	111,	/* GSP 0-4:0 */
+	33,	/* INT-LPC:0 */
+	24,	/* LPC 2:0 */
+	32,	/* LPC 3:0 */
+	97,	/* LAG 4:0 */
+	31,	/* LPC 3:1 */
+	23,	/* LPC 2:1 */
+	96,	/* LAG 4:1 */
+	79,	/* LAG 3:0 */
+	61,	/* LAG 2:0 */
+	43,	/* LAG 1:0 */
+	95,	/* LAG 4:2 */
+	78,	/* LAG 3:1 */
+	60,	/* LAG 2:1 */
+	42,	/* LAG 1:1 */
+	30,	/* LPC 3:2 */
+	29,	/* LPC 3:3 */
+	28,	/* LPC 3:4 */
+	22,	/* LPC 2:2 */
+	27,	/* LPC 3:5 */
+	26,	/* LPC 3:6 */
+	21,	/* LPC 2:3 */
+	4,	/* R0:0 */
+	25,	/* LPC 3:7 */
+	15,	/* LPC 1:0 */
+	94,	/* LAG 4:3 */
+	77,	/* LAG 3:2 */
+	59,	/* LAG 2:2 */
+	41,	/* LAG 1:2 */
+	3,	/* R0:1 */
+	76,	/* LAG 3:3 */
+	58,	/* LAG 2:3 */
+	40,	/* LAG 1:3 */
+	39,	/* LAG 1:4 */
+	17,	/* LPC 2:7 */
+	16,	/* LPC 2:8 */
+	12,	/* LPC 1:3 */
+	11,	/* LPC 1:4 */
+	10,	/* LPC 1:5 */
+	9,	/* LPC 1:6 */
+	2,	/* R0:2 */
+	38,	/* LAG 1:5 */
+	37,	/* LAG 1:6 */
+	36,	/* LAG 1:7 */
+	8,	/* LPC 1:7 */
+	7,	/* LPC 1:8 */
+	6,	/* LPC 1:9 */
+	5,	/* LPC 1:10 */
+	1,	/* R0:3 */
+	0,	/* R0:4 */
+	35,	/* Mode:0 */
+	34,	/* Mode:1 */
+	106,	/* Code 4:0 */
+	105,	/* Code 4:1 */
+	104,	/* Code 4:2 */
+	103,	/* Code 4:3 */
+	102,	/* Code 4:4 */
+	101,	/* Code 4:5 */
+	100,	/* Code 4:6 */
+	99,	/* Code 4:7 */
+	98,	/* Code 4:8 */
+	88,	/* Code 3:0 */
+	87,	/* Code 3:1 */
+	86,	/* Code 3:2 */
+	85,	/* Code 3:3 */
+	84,	/* Code 3:4 */
+	83,	/* Code 3:5 */
+	82,	/* Code 3:6 */
+	81,	/* Code 3:7 */
+};
diff --git a/src/shared/libosmocore/src/codec/gsm660.c b/src/shared/libosmocore/src/codec/gsm660.c
new file mode 100644
index 00000000..c044a2ab
--- /dev/null
+++ b/src/shared/libosmocore/src/codec/gsm660.c
@@ -0,0 +1,256 @@
+/* GSM 06.60 - GSM EFR Codec */
+
+/*
+ * (C) 2010 Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+/* GSM EFR - subjective importance bit ordering */
+	/* This array encodes GSM 05.03 Table 6.
+	 *
+	 * It converts between serial parameter output (as described in
+	 * GSM 06.60 Table 6 and GSM 05.03 Table 5) and the order needed
+	 * before channel encoding. CRC poly and bit repetition must be
+	 * applied prior to this table, as in GSM 05.03 3.1.1, to get 260
+	 * bits from a 244 bits raw EFR frame.
+	 */
+const uint16_t gsm660_bitorder[260] = {
+	 38,  39,  40,  41,  42,  43,		/*   0 -> LTP-LAG 1: b8..b3 */
+	145, 146, 147, 148, 149, 150,		/*   6 -> LTP-LAG 3: b8..b3 */
+	 93,  94,				/*  12 -> LTP-LAG 2: b5..b4 */
+	200, 201,				/*  14 -> LTP-LAG 4: b5..b4 */
+	 47,					/*  16 -> LTP-GAIN 1: b3    */
+	 88,					/*  17 -> FCB-GAIN 1: b4    */
+	 99,					/*  18 -> LTP-GAIN 2: b3    */
+	140,					/*  19 -> FCB-GAIN 2: b4    */
+	 44,					/*  20 -> LTP-LAG 1: b2     */
+	151,					/*  21 -> LTP-LAG 3: b2     */
+	 95,					/*  22 -> LTP-LAG 2: b3     */
+	202,					/*  23 -> LTP-LAG 4: b3     */
+	  1,   2,				/*  24 -> LPC 1: b5..b4     */
+	  7,					/*  26 -> LPC 2: b7         */
+	  9,					/*  27 -> LPC 2: b5         */
+	 17,  18,				/*  28 -> LPC 3: b6..b5     */
+	 23,					/*  30 -> LPC 3: b0         */
+	 45,  46,				/*  31 -> LTP-LAG 1: b1..b0 */
+	152, 153,				/*  33 -> LTP-LAG 3: b1..b0 */
+	 96,					/*  35 -> LTP-LAG 2: b2     */
+	203,					/*  36 -> LTP-LAG 4: b2     */
+	  3,   4,				/*  37 -> LPC 1: b3..b2     */
+	 10,  11,				/*  39 -> LPC 2: b4..b3     */
+	 15,					/*  41 -> LPC 3: b8         */
+	  8,					/*  42 -> LPC 2: b6         */
+	  5,   6,				/*  43 -> LPC 1: b1..b0     */
+	 12,					/*  45 -> LPC 2: b2         */
+	 16,					/*  46 -> LPC 3: b7         */
+	 19,					/*  47 -> LPC 3: b4         */
+	 97,					/*  48 -> LTP-LAG 2: b1     */
+	204,					/*  49 -> LTP-LAG 4: b1     */
+	  0,					/*  50 -> LPC 1: b6         */
+	 13,  14,				/*  51 -> LPC 2: b1..b0     */
+	 20,					/*  53 -> LPC 3: b3         */
+	 24,  25,				/*  54 -> LPC 4: b7..b6     */
+	 27,					/*  56 -> LPC 4: b4         */
+	154,					/*  57 -> LTP-GAIN 3: b3    */
+	206,					/*  58 -> LTP-GAIN 4: b3    */
+	195,					/*  59 -> FCB-GAIN 3: b4    */
+	247,					/*  60 -> FCB-GAIN 4: b4    */
+	 89,					/*  61 -> FCB-GAIN 1: b3    */
+	141,					/*  62 -> FCB-GAIN 2: b3    */
+	196,					/*  63 -> FCB-GAIN 3: b3    */
+	248,					/*  64 -> FCB-GAIN 4: b3    */
+	252, 253, 254, 255, 256, 257, 258, 259,	/*  65 -> CRC-POLY: b7..b0  */
+	 48,					/*  73 -> LTP-GAIN 1: b2    */
+	100,					/*  74 -> LTP-GAIN 2: b2    */
+	155,					/*  75 -> LTP-GAIN 3: b2    */
+	207,					/*  76 -> LTP-GAIN 4: b2    */
+	 21,  22,				/*  77 -> LPC 3: b2..b1     */
+	 26,					/*  79 -> LPC 4: b5         */
+	 28,					/*  80 -> LPC 4: b3         */
+	 51,					/*  81 -> PULSE 1_1: b3     */
+	 55,					/*  82 -> PULSE 1_2: b3     */
+	 59,					/*  83 -> PULSE 1_3: b3     */
+	 63,					/*  84 -> PULSE 1_4: b3     */
+	 67,					/*  85 -> PULSE 1_5: b3     */
+	103,					/*  86 -> PULSE 2_1: b3     */
+	107,					/*  87 -> PULSE 2_2: b3     */
+	111,					/*  88 -> PULSE 2_3: b3     */
+	115,					/*  89 -> PULSE 2_4: b3     */
+	119,					/*  90 -> PULSE 2_5: b3     */
+	158,					/*  91 -> PULSE 3_1: b3     */
+	162,					/*  92 -> PULSE 3_2: b3     */
+	166,					/*  93 -> PULSE 3_3: b3     */
+	170,					/*  94 -> PULSE 3_4: b3     */
+	174,					/*  95 -> PULSE 3_5: b3     */
+	210,					/*  96 -> PULSE 4_1: b3     */
+	214,					/*  97 -> PULSE 4_2: b3     */
+	218,					/*  98 -> PULSE 4_3: b3     */
+	222,					/*  99 -> PULSE 4_4: b3     */
+	226,					/* 100 -> PULSE 4_5: b3     */
+	 90,					/* 101 -> FCB-GAIN 1: b2    */
+	142,					/* 102 -> FCB-GAIN 2: b2    */
+	197,					/* 103 -> FCB-GAIN 3: b2    */
+	249,					/* 104 -> FCB-GAIN 4: b2    */
+	 49,					/* 105 -> LTP-GAIN 1: b1    */
+	101,					/* 106 -> LTP-GAIN 2: b1    */
+	156,					/* 107 -> LTP-GAIN 3: b1    */
+	208,					/* 108 -> LTP-GAIN 4: b1    */
+	 29,  30,  31,				/* 109 -> LPC 4: b2..b0     */
+	 32,  33,  34,  35,			/* 112 -> LPC 5: b5..b2     */
+	 98,					/* 116 -> LTP-LAG 2: b0     */
+	205,					/* 117 -> LTP-LAG 4: b0     */
+	 52,					/* 118 -> PULSE 1_1: b2     */
+	 56,					/* 119 -> PULSE 1_2: b2     */
+	 60,					/* 120 -> PULSE 1_3: b2     */
+	 64,					/* 121 -> PULSE 1_4: b2     */
+	 68,					/* 122 -> PULSE 1_5: b2     */
+	104,					/* 123 -> PULSE 2_1: b2     */
+	108,					/* 124 -> PULSE 2_2: b2     */
+	112,					/* 125 -> PULSE 2_3: b2     */
+	116,					/* 126 -> PULSE 2_4: b2     */
+	120,					/* 127 -> PULSE 2_5: b2     */
+	159,					/* 128 -> PULSE 3_1: b2     */
+	163,					/* 129 -> PULSE 3_2: b2     */
+	167,					/* 130 -> PULSE 3_3: b2     */
+	171,					/* 131 -> PULSE 3_4: b2     */
+	175,					/* 132 -> PULSE 3_5: b2     */
+	211,					/* 133 -> PULSE 4_1: b2     */
+	215,					/* 134 -> PULSE 4_2: b2     */
+	219,					/* 135 -> PULSE 4_3: b2     */
+	223,					/* 136 -> PULSE 4_4: b2     */
+	227,					/* 137 -> PULSE 4_5: b2     */
+	 53,					/* 138 -> PULSE 1_1: b1     */
+	 57,					/* 139 -> PULSE 1_2: b1     */
+	 61,					/* 140 -> PULSE 1_3: b1     */
+	 65,					/* 141 -> PULSE 1_4: b1     */
+	105,					/* 142 -> PULSE 2_1: b1     */
+	109,					/* 143 -> PULSE 2_2: b1     */
+	113,					/* 144 -> PULSE 2_3: b1     */
+	117,					/* 145 -> PULSE 2_4: b1     */
+	160,					/* 146 -> PULSE 3_1: b1     */
+	164,					/* 147 -> PULSE 3_2: b1     */
+	168,					/* 148 -> PULSE 3_3: b1     */
+	172,					/* 149 -> PULSE 3_4: b1     */
+	212,					/* 150 -> PULSE 4_1: b1     */
+	220,					/* 151 -> PULSE 4_3: b1     */
+	224,					/* 152 -> PULSE 4_4: b1     */
+	 91,					/* 153 -> FCB-GAIN 1: b1    */
+	143,					/* 154 -> FCB-GAIN 2: b1    */
+	198,					/* 155 -> FCB-GAIN 3: b1    */
+	250,					/* 156 -> FCB-GAIN 4: b1    */
+	 50,					/* 157 -> LTP-GAIN 1: b0    */
+	102,					/* 158 -> LTP-GAIN 2: b0    */
+	157,					/* 159 -> LTP-GAIN 3: b0    */
+	209,					/* 160 -> LTP-GAIN 4: b0    */
+	 92,					/* 161 -> FCB-GAIN 1: b0    */
+	144,					/* 162 -> FCB-GAIN 2: b0    */
+	199,					/* 163 -> FCB-GAIN 3: b0    */
+	251,					/* 164 -> FCB-GAIN 4: b0    */
+	 54,					/* 165 -> PULSE 1_1: b0     */
+	 58,					/* 166 -> PULSE 1_2: b0     */
+	 62,					/* 167 -> PULSE 1_3: b0     */
+	 66,					/* 168 -> PULSE 1_4: b0     */
+	106,					/* 169 -> PULSE 2_1: b0     */
+	110,					/* 170 -> PULSE 2_2: b0     */
+	114,					/* 171 -> PULSE 2_3: b0     */
+	118,					/* 172 -> PULSE 2_4: b0     */
+	161,					/* 173 -> PULSE 3_1: b0     */
+	165,					/* 174 -> PULSE 3_2: b0     */
+	169,					/* 175 -> PULSE 3_3: b0     */
+	173,					/* 176 -> PULSE 3_4: b0     */
+	213,					/* 177 -> PULSE 4_1: b0     */
+	221,					/* 178 -> PULSE 4_3: b0     */
+	225,					/* 179 -> PULSE 4_4: b0     */
+	 36,  37,				/* 180 -> LPC 5: b1..b0     */
+	 69,					/* 182 -> PULSE 1_5: b1     */
+	 71,  72,				/* 183 -> PULSE 1_5: b1..b1 */
+	121,					/* 185 -> PULSE 2_5: b1     */
+	123, 124,				/* 186 -> PULSE 2_5: b1..b1 */
+	176,					/* 188 -> PULSE 3_5: b1     */
+	178, 179,				/* 189 -> PULSE 3_5: b1..b1 */
+	228,					/* 191 -> PULSE 4_5: b1     */
+	230, 231,				/* 192 -> PULSE 4_5: b1..b1 */
+	216, 217,				/* 194 -> PULSE 4_2: b1..b0 */
+	 70,					/* 196 -> PULSE 1_5: b0     */
+	122,					/* 197 -> PULSE 2_5: b0     */
+	177,					/* 198 -> PULSE 3_5: b0     */
+	229,					/* 199 -> PULSE 4_5: b0     */
+	 73,					/* 200 -> PULSE 1_6: b2     */
+	 76,					/* 201 -> PULSE 1_7: b2     */
+	 79,					/* 202 -> PULSE 1_8: b2     */
+	 82,					/* 203 -> PULSE 1_9: b2     */
+	 85,					/* 204 -> PULSE 1_10: b2    */
+	125,					/* 205 -> PULSE 2_6: b2     */
+	128,					/* 206 -> PULSE 2_7: b2     */
+	131,					/* 207 -> PULSE 2_8: b2     */
+	134,					/* 208 -> PULSE 2_9: b2     */
+	137,					/* 209 -> PULSE 2_10: b2    */
+	180,					/* 210 -> PULSE 3_6: b2     */
+	183,					/* 211 -> PULSE 3_7: b2     */
+	186,					/* 212 -> PULSE 3_8: b2     */
+	189,					/* 213 -> PULSE 3_9: b2     */
+	192,					/* 214 -> PULSE 3_10: b2    */
+	232,					/* 215 -> PULSE 4_6: b2     */
+	235,					/* 216 -> PULSE 4_7: b2     */
+	238,					/* 217 -> PULSE 4_8: b2     */
+	241,					/* 218 -> PULSE 4_9: b2     */
+	244,					/* 219 -> PULSE 4_10: b2    */
+	 74,					/* 220 -> PULSE 1_6: b1     */
+	 77,					/* 221 -> PULSE 1_7: b1     */
+	 80,					/* 222 -> PULSE 1_8: b1     */
+	 83,					/* 223 -> PULSE 1_9: b1     */
+	 86,					/* 224 -> PULSE 1_10: b1    */
+	126,					/* 225 -> PULSE 2_6: b1     */
+	129,					/* 226 -> PULSE 2_7: b1     */
+	132,					/* 227 -> PULSE 2_8: b1     */
+	135,					/* 228 -> PULSE 2_9: b1     */
+	138,					/* 229 -> PULSE 2_10: b1    */
+	181,					/* 230 -> PULSE 3_6: b1     */
+	184,					/* 231 -> PULSE 3_7: b1     */
+	187,					/* 232 -> PULSE 3_8: b1     */
+	190,					/* 233 -> PULSE 3_9: b1     */
+	193,					/* 234 -> PULSE 3_10: b1    */
+	233,					/* 235 -> PULSE 4_6: b1     */
+	236,					/* 236 -> PULSE 4_7: b1     */
+	239,					/* 237 -> PULSE 4_8: b1     */
+	242,					/* 238 -> PULSE 4_9: b1     */
+	245,					/* 239 -> PULSE 4_10: b1    */
+	 75,					/* 240 -> PULSE 1_6: b0     */
+	 78,					/* 241 -> PULSE 1_7: b0     */
+	 81,					/* 242 -> PULSE 1_8: b0     */
+	 84,					/* 243 -> PULSE 1_9: b0     */
+	 87,					/* 244 -> PULSE 1_10: b0    */
+	127,					/* 245 -> PULSE 2_6: b0     */
+	130,					/* 246 -> PULSE 2_7: b0     */
+	133,					/* 247 -> PULSE 2_8: b0     */
+	136,					/* 248 -> PULSE 2_9: b0     */
+	139,					/* 249 -> PULSE 2_10: b0    */
+	182,					/* 250 -> PULSE 3_6: b0     */
+	185,					/* 251 -> PULSE 3_7: b0     */
+	188,					/* 252 -> PULSE 3_8: b0     */
+	191,					/* 253 -> PULSE 3_9: b0     */
+	194,					/* 254 -> PULSE 3_10: b0    */
+	234,					/* 255 -> PULSE 4_6: b0     */
+	237,					/* 256 -> PULSE 4_7: b0     */
+	240,					/* 257 -> PULSE 4_8: b0     */
+	243,					/* 258 -> PULSE 4_9: b0     */
+	246,					/* 259 -> PULSE 4_10: b0    */
+};
diff --git a/src/shared/libosmocore/src/codec/gsm690.c b/src/shared/libosmocore/src/codec/gsm690.c
new file mode 100644
index 00000000..fdf3302f
--- /dev/null
+++ b/src/shared/libosmocore/src/codec/gsm690.c
@@ -0,0 +1,210 @@
+/* GSM 06.90 - GSM AMR Codec */
+
+/*
+ * (C) 2010 Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+/*
+ * These table map between the raw encoder parameter output and
+ * the format used before channel coding. Both in GSM and in various
+ * file/network format (same tables used in several specs).
+ */
+
+/* AMR 12.2 kbits - subjective importance bit ordering */
+	/* This array encodes GSM 05.03 Table 7
+	 * It's also TS 26.101 Table B.8
+	 */
+const uint16_t gsm690_12_2_bitorder[244] = {
+	  0,   1,   2,   3,   4,   5,   6,   7,   8,   9,
+	 10,  11,  12,  13,  14,  23,  15,  16,  17,  18,
+	 19,  20,  21,  22,  24,  25,  26,  27,  28,  38,
+	141,  39, 142,  40, 143,  41, 144,  42, 145,  43,
+	146,  44, 147,  45, 148,  46, 149,  47,  97, 150,
+	200,  48,  98, 151, 201,  49,  99, 152, 202,  86,
+	136, 189, 239,  87, 137, 190, 240,  88, 138, 191,
+	241,  91, 194,  92, 195,  93, 196,  94, 197,  95,
+	198,  29,  30,  31,  32,  33,  34,  35,  50, 100,
+	153, 203,  89, 139, 192, 242,  51, 101, 154, 204,
+	 55, 105, 158, 208,  90, 140, 193, 243,  59, 109,
+	162, 212,  63, 113, 166, 216,  67, 117, 170, 220,
+	 36,  37,  54,  53,  52,  58,  57,  56,  62,  61,
+	 60,  66,  65,  64,  70,  69,  68, 104, 103, 102,
+	108, 107, 106, 112, 111, 110, 116, 115, 114, 120,
+	119, 118, 157, 156, 155, 161, 160, 159, 165, 164,
+	163, 169, 168, 167, 173, 172, 171, 207, 206, 205,
+	211, 210, 209, 215, 214, 213, 219, 218, 217, 223,
+	222, 221,  73,  72,  71,  76,  75,  74,  79,  78,
+	 77,  82,  81,  80,  85,  84,  83, 123, 122, 121,
+	126, 125, 124, 129, 128, 127, 132, 131, 130, 135,
+	134, 133, 176, 175, 174, 179, 178, 177, 182, 181,
+	180, 185, 184, 183, 188, 187, 186, 226, 225, 224,
+	229, 228, 227, 232, 231, 230, 235, 234, 233, 238,
+	237, 236,  96, 199,
+};
+
+/* AMR 10.2 kbits - subjective importance bit ordering */
+	/* This array encodes GSM 05.03 Table 8
+	 * It's also TS 26.101 Table B.7
+	 */
+const uint16_t gsm690_10_2_bitorder[204] = {
+	  7,   6,   5,   4,   3,   2,   1,   0,  16,  15,
+	 14,  13,  12,  11,  10,   9,   8,  26,  27,  28,
+	 29,  30,  31, 115, 116, 117, 118, 119, 120,  72,
+	 73, 161, 162,  65,  68,  69, 108, 111, 112, 154,
+	157, 158, 197, 200, 201,  32,  33, 121, 122,  74,
+	 75, 163, 164,  66, 109, 155, 198,  19,  23,  21,
+	 22,  18,  17,  20,  24,  25,  37,  36,  35,  34,
+	 80,  79,  78,  77, 126, 125, 124, 123, 169, 168,
+	167, 166,  70,  67,  71, 113, 110, 114, 159, 156,
+	160, 202, 199, 203,  76, 165,  81,  82,  92,  91,
+	 93,  83,  95,  85,  84,  94, 101, 102,  96, 104,
+	 86, 103,  87,  97, 127, 128, 138, 137, 139, 129,
+	141, 131, 130, 140, 147, 148, 142, 150, 132, 149,
+	133, 143, 170, 171, 181, 180, 182, 172, 184, 174,
+	173, 183, 190, 191, 185, 193, 175, 192, 176, 186,
+	 38,  39,  49,  48,  50,  40,  52,  42,  41,  51,
+	 58,  59,  53,  61,  43,  60,  44,  54, 194, 179,
+	189, 196, 177, 195, 178, 187, 188, 151, 136, 146,
+	153, 134, 152, 135, 144, 145, 105,  90, 100, 107,
+	 88, 106,  89,  98,  99,  62,  47,  57,  64,  45,
+	 63,  46,  55,  56,
+};
+
+/* AMR 7.95 kbits - subjective importance bit ordering */
+	/* This array encodes GSM 05.03 Table 9
+	 * It's also TS 26.101 Table B.6
+	 */
+const uint16_t gsm690_7_95_bitorder[159] = {
+	  8,   7,   6,   5,   4,   3,   2,  14,  16,   9,
+	 10,  12,  13,  15,  11,  17,  20,  22,  24,  23,
+	 19,  18,  21,  56,  88, 122, 154,  57,  89, 123,
+	155,  58,  90, 124, 156,  52,  84, 118, 150,  53,
+	 85, 119, 151,  27,  93,  28,  94,  29,  95,  30,
+	 96,  31,  97,  61, 127,  62, 128,  63, 129,  59,
+	 91, 125, 157,  32,  98,  64, 130,   1,   0,  25,
+	 26,  33,  99,  34, 100,  65, 131,  66, 132,  54,
+	 86, 120, 152,  60,  92, 126, 158,  55,  87, 121,
+	153, 117, 116, 115,  46,  78, 112, 144,  43,  75,
+	109, 141,  40,  72, 106, 138,  36,  68, 102, 134,
+	114, 149, 148, 147, 146,  83,  82,  81,  80,  51,
+	 50,  49,  48,  47,  45,  44,  42,  39,  35,  79,
+	 77,  76,  74,  71,  67, 113, 111, 110, 108, 105,
+	101, 145, 143, 142, 140, 137, 133,  41,  73, 107,
+	139,  37,  69, 103, 135,  38,  70, 104, 136,
+};
+
+/* AMR 7.4 kbits - subjective importance bit ordering */
+	/* This array encodes GSM 05.03 Table 10
+	 * It's also TS 26.101 Table B.5
+	 */
+const uint16_t gsm690_7_4_bitorder[148] = {
+	  0,   1,   2,   3,   4,   5,   6,   7,   8,   9,
+	 10,  11,  12,  13,  14,  15,  16,  26,  87,  27,
+	 88,  28,  89,  29,  90,  30,  91,  51,  80, 112,
+	141,  52,  81, 113, 142,  54,  83, 115, 144,  55,
+	 84, 116, 145,  58, 119,  59, 120,  21,  22,  23,
+	 17,  18,  19,  31,  60,  92, 121,  56,  85, 117,
+	146,  20,  24,  25,  50,  79, 111, 140,  57,  86,
+	118, 147,  49,  78, 110, 139,  48,  77,  53,  82,
+	114, 143, 109, 138,  47,  76, 108, 137,  32,  33,
+	 61,  62,  93,  94, 122, 123,  41,  42,  43,  44,
+	 45,  46,  70,  71,  72,  73,  74,  75, 102, 103,
+	104, 105, 106, 107, 131, 132, 133, 134, 135, 136,
+	 34,  63,  95, 124,  35,  64,  96, 125,  36,  65,
+	 97, 126,  37,  66,  98, 127,  38,  67,  99, 128,
+	 39,  68, 100, 129,  40,  69, 101, 130,
+};
+
+/* AMR 6.7 kbits - subjective importance bit ordering */
+	/* This array encodes GSM 05.03 Table 11
+	 * It's also TS 26.101 Table B.4
+	 */
+const uint16_t gsm690_6_7_bitorder[134] = {
+	  0,   1,   4,   3,   5,   6,  13,   7,   2,   8,
+	  9,  11,  15,  12,  14,  10,  28,  82,  29,  83,
+	 27,  81,  26,  80,  30,  84,  16,  55, 109,  56,
+	110,  31,  85,  57, 111,  48,  73, 102, 127,  32,
+	 86,  51,  76, 105, 130,  52,  77, 106, 131,  58,
+	112,  33,  87,  19,  23,  53,  78, 107, 132,  21,
+	 22,  18,  17,  20,  24,  25,  50,  75, 104, 129,
+	 47,  72, 101, 126,  54,  79, 108, 133,  46,  71,
+	100, 125, 128, 103,  74,  49,  45,  70,  99, 124,
+	 42,  67,  96, 121,  39,  64,  93, 118,  38,  63,
+	 92, 117,  35,  60,  89, 114,  34,  59,  88, 113,
+	 44,  69,  98, 123,  43,  68,  97, 122,  41,  66,
+	 95, 120,  40,  65,  94, 119,  37,  62,  91, 116,
+	 36,  61,  90, 115,
+};
+
+/* AMR 5.9 kbits - subjective importance bit ordering */
+	/* This array encodes GSM 05.03 Table 12
+	 * It's also TS 26.101 Table B.3
+	 */
+const uint16_t gsm690_5_9_bitorder[118] = {
+	  0,   1,   4,   5,   3,   6,   7,   2,  13,  15,
+	  8,   9,  11,  12,  14,  10,  16,  28,  74,  29,
+	 75,  27,  73,  26,  72,  30,  76,  51,  97,  50,
+	 71,  96, 117,  31,  77,  52,  98,  49,  70,  95,
+	116,  53,  99,  32,  78,  33,  79,  48,  69,  94,
+	115,  47,  68,  93, 114,  46,  67,  92, 113,  19,
+	 21,  23,  22,  18,  17,  20,  24, 111,  43,  89,
+	110,  64,  65,  44,  90,  25,  45,  66,  91, 112,
+	 54, 100,  40,  61,  86, 107,  39,  60,  85, 106,
+	 36,  57,  82, 103,  35,  56,  81, 102,  34,  55,
+	 80, 101,  42,  63,  88, 109,  41,  62,  87, 108,
+	 38,  59,  84, 105,  37,  58,  83, 104,
+};
+
+/* AMR 5.15 kbits - subjective importance bit ordering */
+	/* This array encodes GSM 05.03 Table 13
+	 * It's also TS 26.101 Table B.2
+	 */
+const uint16_t gsm690_5_15_bitorder[103] = {
+	  7,   6,   5,   4,   3,   2,   1,   0,  15,  14,
+	 13,  12,  11,  10,   9,   8,  23,  24,  25,  26,
+	 27,  46,  65,  84,  45,  44,  43,  64,  63,  62,
+	 83,  82,  81, 102, 101, 100,  42,  61,  80,  99,
+	 28,  47,  66,  85,  18,  41,  60,  79,  98,  29,
+	 48,  67,  17,  20,  22,  40,  59,  78,  97,  21,
+	 30,  49,  68,  86,  19,  16,  87,  39,  38,  58,
+	 57,  77,  35,  54,  73,  92,  76,  96,  95,  36,
+	 55,  74,  93,  32,  51,  33,  52,  70,  71,  89,
+	 90,  31,  50,  69,  88,  37,  56,  75,  94,  34,
+	 53,  72,  91,
+};
+
+/* AMR 4.75 kbits - subjective importance bit ordering */
+	/* This array encodes GSM 05.03 Table 14
+	 * It's also TS 26.101 Table B.1
+	 */
+const uint16_t gsm690_4_75_bitorder[95] = {
+	  0,   1,   2,   3,   4,   5,   6,   7,   8,   9,
+	 10,  11,  12,  13,  14,  15,  23,  24,  25,  26,
+	 27,  28,  48,  49,  61,  62,  82,  83,  47,  46,
+	 45,  44,  81,  80,  79,  78,  17,  18,  20,  22,
+	 77,  76,  75,  74,  29,  30,  43,  42,  41,  40,
+	 38,  39,  16,  19,  21,  50,  51,  59,  60,  63,
+	 64,  72,  73,  84,  85,  93,  94,  32,  33,  35,
+	 36,  53,  54,  56,  57,  66,  67,  69,  70,  87,
+	 88,  90,  91,  34,  55,  68,  89,  37,  58,  71,
+	 92,  31,  52,  65,  86,
+};
diff --git a/src/shared/libosmocore/src/conv.c b/src/shared/libosmocore/src/conv.c
new file mode 100644
index 00000000..ebc3eda7
--- /dev/null
+++ b/src/shared/libosmocore/src/conv.c
@@ -0,0 +1,631 @@
+/*
+ * conv.c
+ *
+ * Generic convolutional encoding / decoding
+ *
+ * Copyright (C) 2011  Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/*! \addtogroup conv
+ *  @{
+ */
+
+/*! \file conv.c
+ *  \file Osmocom convolutional encoder and decoder
+ */
+#include "config.h"
+#ifdef HAVE_ALLOCA_H
+#include <alloca.h>
+#endif
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <osmocom/core/bits.h>
+#include <osmocom/core/conv.h>
+
+
+/* ------------------------------------------------------------------------ */
+/* Common                                                                   */
+/* ------------------------------------------------------------------------ */
+
+int
+osmo_conv_get_input_length(const struct osmo_conv_code *code, int len)
+{
+	return len <= 0 ? code->len : len;
+}
+
+int
+osmo_conv_get_output_length(const struct osmo_conv_code *code, int len)
+{
+	int pbits, in_len, out_len;
+
+	/* Input length */
+	in_len = osmo_conv_get_input_length(code, len);
+
+	/* Output length */
+	out_len = in_len * code->N;
+
+	if (code->term == CONV_TERM_FLUSH)
+		out_len += code->N * (code->K - 1);
+
+	/* Count punctured bits */
+	if (code->puncture) {
+		for (pbits=0; code->puncture[pbits] >= 0; pbits++);
+		out_len -= pbits;
+	}
+
+	return out_len;
+}
+
+
+/* ------------------------------------------------------------------------ */
+/* Encoding                                                                 */
+/* ------------------------------------------------------------------------ */
+
+/*! \brief Initialize a convolutional encoder
+ *  \param[in,out] encoder Encoder state to initialize
+ *  \param[in] code Description of convolutional code
+ */
+void
+osmo_conv_encode_init(struct osmo_conv_encoder *encoder,
+                      const struct osmo_conv_code *code)
+{
+	memset(encoder, 0x00, sizeof(struct osmo_conv_encoder));
+	encoder->code = code;
+}
+
+void
+osmo_conv_encode_load_state(struct osmo_conv_encoder *encoder,
+                            const ubit_t *input)
+{
+	int i;
+	uint8_t state = 0;
+
+	for (i=0; i<(encoder->code->K-1); i++)
+		state = (state << 1) | input[i];
+
+	encoder->state = state;
+}
+
+static inline int
+_conv_encode_do_output(struct osmo_conv_encoder *encoder,
+                       uint8_t out, ubit_t *output)
+{
+	const struct osmo_conv_code *code = encoder->code;
+	int o_idx = 0;
+	int j;
+
+	if (code->puncture) {
+		for (j=0; j<code->N; j++)
+		{
+			int bit_no = code->N - j - 1;
+			int r_idx = encoder->i_idx * code->N + j;
+
+			if (code->puncture[encoder->p_idx] == r_idx)
+				encoder->p_idx++;
+			else
+				output[o_idx++] = (out >> bit_no) & 1;
+		}
+	} else {
+		for (j=0; j<code->N; j++)
+		{
+			int bit_no = code->N - j - 1;
+			output[o_idx++] = (out >> bit_no) & 1;
+		}
+	}
+
+	return o_idx;
+}
+
+int
+osmo_conv_encode_raw(struct osmo_conv_encoder *encoder,
+                     const ubit_t *input, ubit_t *output, int n)
+{
+	const struct osmo_conv_code *code = encoder->code;
+	uint8_t state;
+	int i;
+	int o_idx;
+
+	o_idx = 0;
+	state = encoder->state;
+
+	for (i=0; i<n; i++) {
+		int bit = input[i];
+		uint8_t out;
+
+		out   = code->next_output[state][bit];
+		state = code->next_state[state][bit];
+
+		o_idx += _conv_encode_do_output(encoder, out, &output[o_idx]);
+
+		encoder->i_idx++;
+	}
+
+	encoder->state = state;
+
+	return o_idx;
+}
+
+int
+osmo_conv_encode_flush(struct osmo_conv_encoder *encoder,
+                       ubit_t *output)
+{
+	const struct osmo_conv_code *code = encoder->code;
+	uint8_t state;
+	int n;
+	int i;
+	int o_idx;
+
+	n = code->K - 1;
+
+	o_idx = 0;
+	state = encoder->state;
+
+	for (i=0; i<n; i++) {
+		uint8_t out;
+
+		if (code->next_term_output) {
+			out   = code->next_term_output[state];
+			state = code->next_term_state[state];
+		} else {
+			out   = code->next_output[state][0];
+			state = code->next_state[state][0];
+		}
+
+		o_idx += _conv_encode_do_output(encoder, out, &output[o_idx]);
+
+		encoder->i_idx++;
+	}
+
+	encoder->state = state;
+
+	return o_idx;
+}
+
+/*! \brief All-in-one convolutional encoding function
+ *  \param[in] code description of convolutional code to be used
+ *  \param[in] input array of unpacked bits (uncoded)
+ *  \param[out] output array of unpacked bits (encoded)
+ *  \return Number of produced output bits
+ *
+ * This is an all-in-one function, taking care of
+ * \ref osmo_conv_init, \ref osmo_conv_encode_load_state,
+ * \ref osmo_conv_encode_raw and \ref osmo_conv_encode_flush as needed.
+ */
+int
+osmo_conv_encode(const struct osmo_conv_code *code,
+                 const ubit_t *input, ubit_t *output)
+{
+	struct osmo_conv_encoder encoder;
+	int l;
+
+	osmo_conv_encode_init(&encoder, code);
+
+	if (code->term == CONV_TERM_TAIL_BITING) {
+		int eidx = code->len - code->K + 1;
+		osmo_conv_encode_load_state(&encoder, &input[eidx]);
+	}
+
+	l = osmo_conv_encode_raw(&encoder, input, output, code->len);
+
+	if (code->term == CONV_TERM_FLUSH)
+		l += osmo_conv_encode_flush(&encoder, &output[l]);
+
+	return l;
+}
+
+
+/* ------------------------------------------------------------------------ */
+/* Decoding (viterbi)                                                       */
+/* ------------------------------------------------------------------------ */
+
+#define MAX_AE 0x00ffffff
+
+void
+osmo_conv_decode_init(struct osmo_conv_decoder *decoder,
+                      const struct osmo_conv_code *code, int len, int start_state)
+{
+	int n_states;
+
+	/* Init */
+	if (len <= 0)
+		len =  code->len;
+
+	n_states = 1 << (code->K - 1);
+
+	memset(decoder, 0x00, sizeof(struct osmo_conv_decoder));
+
+	decoder->code = code;
+	decoder->n_states = n_states;
+	decoder->len = len;
+
+	/* Allocate arrays */
+	decoder->ae      = malloc(sizeof(unsigned int) * n_states);
+	decoder->ae_next = malloc(sizeof(unsigned int) * n_states);
+
+	decoder->state_history = malloc(sizeof(uint8_t) * n_states * (len + decoder->code->K - 1));
+
+	/* Classic reset */
+	osmo_conv_decode_reset(decoder, start_state);
+}
+
+void
+osmo_conv_decode_reset(struct osmo_conv_decoder *decoder, int start_state)
+{
+	int i;
+
+	/* Reset indexes */
+	decoder->o_idx = 0;
+	decoder->p_idx = 0;
+
+	/* Initial error */
+	if (start_state < 0) {
+		/* All states possible */
+		memset(decoder->ae, 0x00, sizeof(unsigned int) * decoder->n_states);
+	} else {
+		/* Fixed start state */
+		for (i=0; i<decoder->n_states; i++) {
+			decoder->ae[i] = (i == start_state) ? 0 : MAX_AE;
+		}
+	}
+}
+
+void
+osmo_conv_decode_rewind(struct osmo_conv_decoder *decoder)
+{
+	int i;
+	unsigned int min_ae = MAX_AE;
+
+	/* Reset indexes */
+	decoder->o_idx = 0;
+	decoder->p_idx = 0;
+
+	/* Initial error normalize (remove constant) */
+	for (i=0; i<decoder->n_states; i++) {
+		if (decoder->ae[i] < min_ae)
+			min_ae = decoder->ae[i];
+	}
+
+	for (i=0; i<decoder->n_states; i++)
+		decoder->ae[i] -= min_ae;
+}
+
+void
+osmo_conv_decode_deinit(struct osmo_conv_decoder *decoder)
+{
+	free(decoder->ae);
+	free(decoder->ae_next);
+	free(decoder->state_history);
+
+	memset(decoder, 0x00, sizeof(struct osmo_conv_decoder));
+}
+
+int
+osmo_conv_decode_scan(struct osmo_conv_decoder *decoder,
+                      const sbit_t *input, int n)
+{
+	const struct osmo_conv_code *code = decoder->code;
+
+	int i, s, b, j;
+
+	int n_states;
+	unsigned int *ae;
+	unsigned int *ae_next;
+	uint8_t *state_history;
+	sbit_t *in_sym;
+
+	int i_idx, p_idx;
+
+	/* Prepare */
+	n_states = decoder->n_states;
+
+	ae      = decoder->ae;
+	ae_next = decoder->ae_next;
+	state_history = &decoder->state_history[n_states * decoder->o_idx];
+
+	in_sym  = alloca(sizeof(sbit_t) * code->N);
+
+	i_idx = 0;
+	p_idx = decoder->p_idx;
+
+	/* Scan the treillis */
+	for (i=0; i<n; i++)
+	{
+		/* Reset next accumulated error */
+		for (s=0; s<n_states; s++) {
+			ae_next[s] = MAX_AE;
+		}
+
+		/* Get input */
+		if (code->puncture) {
+			/* Hard way ... */
+			for (j=0; j<code->N; j++) {
+				int idx = ((decoder->o_idx + i) * code->N) + j;
+				if (idx == code->puncture[p_idx]) {
+					in_sym[j] = 0;	/* Undefined */
+					p_idx++;
+				} else {
+					in_sym[j] = input[i_idx];
+					i_idx++;
+				}
+			}
+		} else {
+			/* Easy, just copy N bits */
+			memcpy(in_sym, &input[i_idx], code->N);
+			i_idx += code->N;
+		}
+
+		/* Scan all state */
+		for (s=0; s<n_states; s++)
+		{
+			/* Scan possible input bits */
+			for (b=0; b<2; b++)
+			{
+				int nae, ov, e;
+				uint8_t m;
+
+				/* Next output and state */
+				uint8_t out   = code->next_output[s][b];
+				uint8_t state = code->next_state[s][b];
+
+				/* New error for this path */
+				nae = ae[s];			/* start from last error */
+				m = 1 << (code->N - 1);		/* mask for 'out' bit selection */
+
+				for (j=0; j<code->N; j++) {
+					int is = (int)in_sym[j];
+					if (is) {
+						ov = (out & m) ? -127 : 127; /* sbit_t value for it */
+						e = is - ov;                 /* raw error for this bit */
+						nae += (e * e) >> 9;         /* acc the squared/scaled value */
+					}
+					m >>= 1;                     /* next mask bit */
+				}
+
+				/* Is it survivor ? */
+				if (ae_next[state] > nae) {
+					ae_next[state] = nae;
+					state_history[(n_states * i) + state] = s;
+				}
+			}
+		}
+
+		/* Copy accumulated error */
+		memcpy(ae, ae_next, sizeof(unsigned int) * n_states);
+	}
+
+	/* Update decoder state */
+	decoder->p_idx = p_idx;
+	decoder->o_idx += n;
+
+	return i_idx;
+}
+
+int
+osmo_conv_decode_flush(struct osmo_conv_decoder *decoder,
+                       const sbit_t *input)
+{
+	const struct osmo_conv_code *code = decoder->code;
+
+	int i, s, j;
+
+	int n_states;
+	unsigned int *ae;
+	unsigned int *ae_next;
+	uint8_t *state_history;
+	sbit_t *in_sym;
+
+	int i_idx, p_idx;
+
+	/* Prepare */
+	n_states = decoder->n_states;
+
+	ae      = decoder->ae;
+	ae_next = decoder->ae_next;
+	state_history = &decoder->state_history[n_states * decoder->o_idx];
+
+	in_sym  = alloca(sizeof(sbit_t) * code->N);
+
+	i_idx = 0;
+	p_idx = decoder->p_idx;
+
+	/* Scan the treillis */
+	for (i=0; i<code->K-1; i++)
+	{
+		/* Reset next accumulated error */
+		for (s=0; s<n_states; s++) {
+			ae_next[s] = MAX_AE;
+		}
+
+		/* Get input */
+		if (code->puncture) {
+			/* Hard way ... */
+			for (j=0; j<code->N; j++) {
+				int idx = ((decoder->o_idx + i) * code->N) + j;
+				if (idx == code->puncture[p_idx]) {
+					in_sym[j] = 0;	/* Undefined */
+					p_idx++;
+				} else {
+					in_sym[j] = input[i_idx];
+					i_idx++;
+				}
+			}
+		} else {
+			/* Easy, just copy N bits */
+			memcpy(in_sym, &input[i_idx], code->N);
+			i_idx += code->N;
+		}
+
+		/* Scan all state */
+		for (s=0; s<n_states; s++)
+		{
+			int nae, ov, e;
+			uint8_t m;
+
+			/* Next output and state */
+			uint8_t out;
+			uint8_t state;
+
+			if (code->next_term_output) {
+				out   = code->next_term_output[s];
+				state = code->next_term_state[s];
+			} else {
+				out   = code->next_output[s][0];
+				state = code->next_state[s][0];
+			}
+
+			/* New error for this path */
+			nae = ae[s];			/* start from last error */
+			m = 1 << (code->N - 1);		/* mask for 'out' bit selection */
+
+			for (j=0; j<code->N; j++) {
+				int is = (int)in_sym[j];
+				if (is) {
+					ov = (out & m) ? -127 : 127; /* sbit_t value for it */
+					e = is - ov;                 /* raw error for this bit */
+					nae += (e * e) >> 9;         /* acc the squared/scaled value */
+				}
+				m >>= 1;                     /* next mask bit */
+			}
+
+			/* Is it survivor ? */
+			if (ae_next[state] > nae) {
+				ae_next[state] = nae;
+				state_history[(n_states * i) + state] = s;
+			}
+		}
+
+		/* Copy accumulated error */
+		memcpy(ae, ae_next, sizeof(unsigned int) * n_states);
+	}
+
+	/* Update decoder state */
+	decoder->p_idx = p_idx;
+	decoder->o_idx += code->K - 1;
+
+	return i_idx;
+}
+
+int
+osmo_conv_decode_get_output(struct osmo_conv_decoder *decoder,
+                            ubit_t *output, int has_flush, int end_state)
+{
+	const struct osmo_conv_code *code = decoder->code;
+
+	int min_ae;
+	uint8_t min_state, cur_state;
+	int i, s, n;
+
+	uint8_t *sh_ptr;
+
+	/* End state ? */
+	if (end_state < 0) {
+		/* Find state with least error */
+		min_ae = MAX_AE;
+		min_state = 0xff;
+
+		for (s=0; s<decoder->n_states; s++)
+		{
+			if (decoder->ae[s] < min_ae) {
+				min_ae = decoder->ae[s];
+				min_state = s;
+			}
+		}
+
+		if (min_state == 0xff)
+			return -1;
+	} else {
+		min_state = (uint8_t) end_state;
+		min_ae = decoder->ae[end_state];
+	}
+
+	/* Traceback */
+	cur_state = min_state;
+
+	n = decoder->o_idx;
+
+	sh_ptr = &decoder->state_history[decoder->n_states * (n-1)];
+
+		/* No output for the K-1 termination input bits */
+	if (has_flush) {
+		for (i=0; i<code->K-1; i++) {
+			cur_state = sh_ptr[cur_state];
+			sh_ptr -= decoder->n_states;
+		}
+		n -= code->K - 1;
+	}
+
+		/* Generate output backward */
+	for (i=n-1; i>=0; i--)
+	{
+		min_state = cur_state;
+		cur_state = sh_ptr[cur_state];
+
+		sh_ptr -= decoder->n_states;
+
+		if (code->next_state[cur_state][0] == min_state)
+			output[i] = 0;
+		else
+			output[i] = 1;
+	}
+
+	return min_ae;
+}
+
+/*! \brief All-in-one convolutional decoding function
+ *  \param[in] code description of convolutional code to be used
+ *  \param[in] input array of soft bits (coded)
+ *  \param[out] output array of unpacked bits (decoded)
+ *
+ * This is an all-in-one function, taking care of
+ * \ref osmo_conv_decode_init, \ref osmo_conv_decode_scan,
+ * \ref osmo_conv_decode_flush, \ref osmo_conv_decode_get_output and
+ * \ref osmo_conv_decode_deinit.
+ */
+int
+osmo_conv_decode(const struct osmo_conv_code *code,
+                 const sbit_t *input, ubit_t *output)
+{
+	struct osmo_conv_decoder decoder;
+	int rv, l;
+
+	osmo_conv_decode_init(&decoder, code, 0, 0);
+
+	if (code->term == CONV_TERM_TAIL_BITING) {
+		osmo_conv_decode_scan(&decoder, input, code->len);
+		osmo_conv_decode_rewind(&decoder);
+	}
+
+	l = osmo_conv_decode_scan(&decoder, input, code->len);
+
+	if (code->term == CONV_TERM_FLUSH)
+		l = osmo_conv_decode_flush(&decoder, &input[l]);
+
+	rv = osmo_conv_decode_get_output(&decoder, output,
+		code->term == CONV_TERM_FLUSH,		/* has_flush */
+		code->term == CONV_TERM_FLUSH ? 0 : -1	/* end_state */
+	);
+
+	osmo_conv_decode_deinit(&decoder);
+
+	return rv;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/crc16.c b/src/shared/libosmocore/src/crc16.c
new file mode 100644
index 00000000..2741cf53
--- /dev/null
+++ b/src/shared/libosmocore/src/crc16.c
@@ -0,0 +1,62 @@
+/*
+ * This was copied from the linux kernel and adjusted for our types.
+ */
+/*
+ *      crc16.c
+ *
+ * This source code is licensed under the GNU General Public License,
+ * Version 2. See the file COPYING for more details.
+ */
+
+#include <osmocom/core/crc16.h>
+
+/** CRC table for the CRC-16. The poly is 0x8005 (x^16 + x^15 + x^2 + 1) */
+uint16_t const osmo_crc16_table[256] = {
+	0x0000, 0xC0C1, 0xC181, 0x0140, 0xC301, 0x03C0, 0x0280, 0xC241,
+	0xC601, 0x06C0, 0x0780, 0xC741, 0x0500, 0xC5C1, 0xC481, 0x0440,
+	0xCC01, 0x0CC0, 0x0D80, 0xCD41, 0x0F00, 0xCFC1, 0xCE81, 0x0E40,
+	0x0A00, 0xCAC1, 0xCB81, 0x0B40, 0xC901, 0x09C0, 0x0880, 0xC841,
+	0xD801, 0x18C0, 0x1980, 0xD941, 0x1B00, 0xDBC1, 0xDA81, 0x1A40,
+	0x1E00, 0xDEC1, 0xDF81, 0x1F40, 0xDD01, 0x1DC0, 0x1C80, 0xDC41,
+	0x1400, 0xD4C1, 0xD581, 0x1540, 0xD701, 0x17C0, 0x1680, 0xD641,
+	0xD201, 0x12C0, 0x1380, 0xD341, 0x1100, 0xD1C1, 0xD081, 0x1040,
+	0xF001, 0x30C0, 0x3180, 0xF141, 0x3300, 0xF3C1, 0xF281, 0x3240,
+	0x3600, 0xF6C1, 0xF781, 0x3740, 0xF501, 0x35C0, 0x3480, 0xF441,
+	0x3C00, 0xFCC1, 0xFD81, 0x3D40, 0xFF01, 0x3FC0, 0x3E80, 0xFE41,
+	0xFA01, 0x3AC0, 0x3B80, 0xFB41, 0x3900, 0xF9C1, 0xF881, 0x3840,
+	0x2800, 0xE8C1, 0xE981, 0x2940, 0xEB01, 0x2BC0, 0x2A80, 0xEA41,
+	0xEE01, 0x2EC0, 0x2F80, 0xEF41, 0x2D00, 0xEDC1, 0xEC81, 0x2C40,
+	0xE401, 0x24C0, 0x2580, 0xE541, 0x2700, 0xE7C1, 0xE681, 0x2640,
+	0x2200, 0xE2C1, 0xE381, 0x2340, 0xE101, 0x21C0, 0x2080, 0xE041,
+	0xA001, 0x60C0, 0x6180, 0xA141, 0x6300, 0xA3C1, 0xA281, 0x6240,
+	0x6600, 0xA6C1, 0xA781, 0x6740, 0xA501, 0x65C0, 0x6480, 0xA441,
+	0x6C00, 0xACC1, 0xAD81, 0x6D40, 0xAF01, 0x6FC0, 0x6E80, 0xAE41,
+	0xAA01, 0x6AC0, 0x6B80, 0xAB41, 0x6900, 0xA9C1, 0xA881, 0x6840,
+	0x7800, 0xB8C1, 0xB981, 0x7940, 0xBB01, 0x7BC0, 0x7A80, 0xBA41,
+	0xBE01, 0x7EC0, 0x7F80, 0xBF41, 0x7D00, 0xBDC1, 0xBC81, 0x7C40,
+	0xB401, 0x74C0, 0x7580, 0xB541, 0x7700, 0xB7C1, 0xB681, 0x7640,
+	0x7200, 0xB2C1, 0xB381, 0x7340, 0xB101, 0x71C0, 0x7080, 0xB041,
+	0x5000, 0x90C1, 0x9181, 0x5140, 0x9301, 0x53C0, 0x5280, 0x9241,
+	0x9601, 0x56C0, 0x5780, 0x9741, 0x5500, 0x95C1, 0x9481, 0x5440,
+	0x9C01, 0x5CC0, 0x5D80, 0x9D41, 0x5F00, 0x9FC1, 0x9E81, 0x5E40,
+	0x5A00, 0x9AC1, 0x9B81, 0x5B40, 0x9901, 0x59C0, 0x5880, 0x9841,
+	0x8801, 0x48C0, 0x4980, 0x8941, 0x4B00, 0x8BC1, 0x8A81, 0x4A40,
+	0x4E00, 0x8EC1, 0x8F81, 0x4F40, 0x8D01, 0x4DC0, 0x4C80, 0x8C41,
+	0x4400, 0x84C1, 0x8581, 0x4540, 0x8701, 0x47C0, 0x4680, 0x8641,
+	0x8201, 0x42C0, 0x4380, 0x8341, 0x4100, 0x81C1, 0x8081, 0x4040
+};
+
+/**
+ * crc16 - compute the CRC-16 for the data buffer
+ * @crc:	previous CRC value
+ * @buffer:	data pointer
+ * @len:	number of bytes in the buffer
+ *
+ * Returns the updated CRC value.
+ */
+uint16_t osmo_crc16(uint16_t crc, uint8_t const *buffer, size_t len)
+{
+	while (len--)
+		crc = osmo_crc16_byte(crc, *buffer++);
+	return crc;
+}
diff --git a/src/shared/libosmocore/src/crcXXgen.c.tpl b/src/shared/libosmocore/src/crcXXgen.c.tpl
new file mode 100644
index 00000000..80bf1e2a
--- /dev/null
+++ b/src/shared/libosmocore/src/crcXXgen.c.tpl
@@ -0,0 +1,120 @@
+/*
+ * crcXXgen.c
+ *
+ * Generic CRC routines (for max XX bits poly)
+ *
+ * Copyright (C) 2011  Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/*! \addtogroup crcgen
+ *  @{
+ */
+
+/*! \file crcXXgen.c
+ *  \file Osmocom generic CRC routines (for max XX bits poly)
+ */
+
+#include <stdint.h>
+
+#include <osmocom/core/bits.h>
+#include <osmocom/core/crcXXgen.h>
+
+
+/*! \brief Compute the CRC value of a given array of hard-bits
+ *  \param[in] code The CRC code description to apply
+ *  \param[in] in Array of hard bits
+ *  \param[in] len Length of the array of hard bits
+ *  \returns The CRC value
+ */
+uintXX_t
+osmo_crcXXgen_compute_bits(const struct osmo_crcXXgen_code *code,
+                           const ubit_t *in, int len)
+{
+	const uintXX_t poly = code->poly;
+	uintXX_t crc = code->init;
+	int i, n = code->bits-1;
+
+	for (i=0; i<len; i++) {
+		uintXX_t bit = in[i] & 1;
+		crc ^= (bit << n);
+		if (crc & (1 << n)) {
+			crc <<= 1;
+			crc ^= poly;
+		} else {
+			crc <<= 1;
+		}
+		crc &= (1ULL << code->bits) - 1;
+	}
+
+	crc ^= code->remainder;
+
+	return crc;
+}
+
+
+/*! \brief Checks the CRC value of a given array of hard-bits
+ *  \param[in] code The CRC code description to apply
+ *  \param[in] in Array of hard bits
+ *  \param[in] len Length of the array of hard bits
+ *  \param[in] crc_bits Array of hard bits with the alleged CRC
+ *  \returns 0 if CRC matches. 1 in case of error.
+ *
+ * The crc_bits array must have a length of code->len
+ */
+int
+osmo_crcXXgen_check_bits(const struct osmo_crcXXgen_code *code,
+                         const ubit_t *in, int len, const ubit_t *crc_bits)
+{
+	uintXX_t crc;
+	int i;
+
+	crc = osmo_crcXXgen_compute_bits(code, in, len);
+
+	for (i=0; i<code->bits; i++)
+		if (crc_bits[i] ^ ((crc >> (code->bits-i-1)) & 1))
+			return 1;
+
+	return 0;
+}
+
+
+/*! \brief Computes and writes the CRC value of a given array of bits
+ *  \param[in] code The CRC code description to apply
+ *  \param[in] in Array of hard bits
+ *  \param[in] len Length of the array of hard bits
+ *  \param[in] crc_bits Array of hard bits to write the computed CRC to
+ *
+ * The crc_bits array must have a length of code->len
+ */
+void
+osmo_crcXXgen_set_bits(const struct osmo_crcXXgen_code *code,
+                       const ubit_t *in, int len, ubit_t *crc_bits)
+{
+	uintXX_t crc;
+	int i;
+
+	crc = osmo_crcXXgen_compute_bits(code, in, len);
+
+	for (i=0; i<code->bits; i++)
+		crc_bits[i] = ((crc >> (code->bits-i-1)) & 1);
+}
+
+/*! @} */
+
+/* vim: set syntax=c: */
diff --git a/src/shared/libosmocore/src/gb/Makefile.am b/src/shared/libosmocore/src/gb/Makefile.am
new file mode 100644
index 00000000..04d21085
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/Makefile.am
@@ -0,0 +1,26 @@
+# This is _NOT_ the library release version, it's an API version.
+# Please read Chapter 6 "Library interface versions" of the libtool documentation before making any modification
+LIBVERSION=2:0:0
+
+INCLUDES = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS = -Wall ${GCC_FVISIBILITY_HIDDEN} -fno-strict-aliasing
+
+# FIXME: this should eventually go into a milenage/Makefile.am
+noinst_HEADERS = common_vty.h
+
+if ENABLE_GB
+lib_LTLIBRARIES = libosmogb.la
+
+libosmogb_la_LDFLAGS = $(LTLDFLAGS_OSMOGB) -version-info $(LIBVERSION)
+libosmogb_la_LIBADD = \
+		$(top_builddir)/src/libosmocore.la \
+		$(top_builddir)/src/vty/libosmovty.la \
+		$(top_builddir)/src/gsm/libosmogsm.la
+
+libosmogb_la_SOURCES = gprs_ns.c gprs_ns_frgre.c gprs_ns_vty.c \
+		  gprs_bssgp.c gprs_bssgp_util.c gprs_bssgp_vty.c \
+		  gprs_bssgp_bss.c common_vty.c
+endif
+
+EXTRA_DIST = libosmogb.map
+
diff --git a/src/shared/libosmocore/src/gb/common_vty.c b/src/shared/libosmocore/src/gb/common_vty.c
new file mode 100644
index 00000000..0bd0b6c3
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/common_vty.c
@@ -0,0 +1,90 @@
+/* OpenBSC VTY common helpers */
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2009-2010 by Holger Hans Peter Freyther
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdlib.h>
+#include <string.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/logging.h>
+
+#include <osmocom/vty/telnet_interface.h>
+#include <osmocom/vty/command.h>
+#include <osmocom/vty/buffer.h>
+#include <osmocom/vty/vty.h>
+
+#include <osmocom/gprs/gprs_msgb.h>
+
+#include "common_vty.h"
+
+/* Down vty node level. */
+gDEFUN(libgb_exit,
+       libgb_exit_cmd, "exit", "Exit current mode and down to previous mode\n")
+{
+	switch (vty->node) {
+	case L_NS_NODE:
+	case L_BSSGP_NODE:
+		vty->node = CONFIG_NODE;
+		vty->index = NULL;
+		break;
+	default:
+		break;
+	}
+	return CMD_SUCCESS;
+}
+
+/* End of configuration. */
+gDEFUN(libgb_end,
+       libgb_end_cmd, "end", "End current mode and change to enable mode.")
+{
+	switch (vty->node) {
+	case L_NS_NODE:
+	case L_BSSGP_NODE:
+		vty_config_unlock(vty);
+		vty->node = ENABLE_NODE;
+		vty->index = NULL;
+		vty->index_sub = NULL;
+		break;
+	default:
+		break;
+	}
+	return CMD_SUCCESS;
+}
+
+int gprs_log_filter_fn(const struct log_context *ctx,
+			struct log_target *tar)
+{
+	const struct gprs_nsvc *nsvc = ctx->ctx[GPRS_CTX_NSVC];
+	const struct gprs_bvc *bvc = ctx->ctx[GPRS_CTX_BVC];
+
+	/* Filter on the NS Virtual Connection */
+	if ((tar->filter_map & (1 << FLT_NSVC)) != 0
+	    && nsvc && (nsvc == tar->filter_data[FLT_NSVC]))
+		return 1;
+
+	/* Filter on the NS Virtual Connection */
+	if ((tar->filter_map & (1 << FLT_BVC)) != 0
+	    && bvc && (bvc == tar->filter_data[FLT_BVC]))
+		return 1;
+
+	return 0;
+}
+
+
+int DNS, DBSSGP;
diff --git a/src/shared/libosmocore/src/gb/common_vty.h b/src/shared/libosmocore/src/gb/common_vty.h
new file mode 100644
index 00000000..d8d00407
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/common_vty.h
@@ -0,0 +1,14 @@
+#include <osmocom/vty/command.h>
+#include <osmocom/core/logging.h>
+
+extern int DNS, DBSSGP;
+
+enum log_filter {
+	_FLT_ALL = LOG_FILTER_ALL,	/* libosmocore */
+	FLT_NSVC = 1,
+	FLT_BVC  = 2,
+};
+
+extern struct cmd_element libgb_exit_cmd;
+extern struct cmd_element libgb_end_cmd;
+
diff --git a/src/shared/libosmocore/src/gb/gprs_bssgp.c b/src/shared/libosmocore/src/gb/gprs_bssgp.c
new file mode 100644
index 00000000..e41c7efb
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_bssgp.c
@@ -0,0 +1,1159 @@
+/* GPRS BSSGP protocol implementation as per 3GPP TS 08.18 */
+
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * TODO:
+ *  o  properly count incoming BVC-RESET packets in counter group
+ *  o  set log context as early as possible for outgoing packets
+ */
+
+#include <errno.h>
+#include <stdint.h>
+
+#include <netinet/in.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/rate_ctr.h>
+
+#include <osmocom/gprs/gprs_bssgp.h>
+#include <osmocom/gprs/gprs_ns.h>
+
+#include "common_vty.h"
+
+void *bssgp_tall_ctx = NULL;
+
+static const struct rate_ctr_desc bssgp_ctr_description[] = {
+	{ "packets.in",	"Packets at BSSGP Level ( In)" },
+	{ "packets.out","Packets at BSSGP Level (Out)" },
+	{ "bytes.in",	"Bytes at BSSGP Level   ( In)" },
+	{ "bytes.out",	"Bytes at BSSGP Level   (Out)" },
+	{ "blocked",	"BVC Blocking count" },
+	{ "discarded",	"BVC LLC Discarded count" },
+};
+
+static const struct rate_ctr_group_desc bssgp_ctrg_desc = {
+	.group_name_prefix = "bssgp.bss_ctx",
+	.group_description = "BSSGP Peer Statistics",
+	.num_ctr = ARRAY_SIZE(bssgp_ctr_description),
+	.ctr_desc = bssgp_ctr_description,
+};
+
+LLIST_HEAD(bssgp_bvc_ctxts);
+
+static int _bssgp_tx_dl_ud(struct bssgp_flow_control *fc, struct msgb *msg,
+			   uint32_t llc_pdu_len, void *priv);
+
+/* Find a BTS Context based on parsed RA ID and Cell ID */
+struct bssgp_bvc_ctx *btsctx_by_raid_cid(const struct gprs_ra_id *raid, uint16_t cid)
+{
+	struct bssgp_bvc_ctx *bctx;
+
+	llist_for_each_entry(bctx, &bssgp_bvc_ctxts, list) {
+		if (!memcmp(&bctx->ra_id, raid, sizeof(bctx->ra_id)) &&
+		    bctx->cell_id == cid)
+			return bctx;
+	}
+	return NULL;
+}
+
+/* Find a BTS context based on BVCI+NSEI tuple */
+struct bssgp_bvc_ctx *btsctx_by_bvci_nsei(uint16_t bvci, uint16_t nsei)
+{
+	struct bssgp_bvc_ctx *bctx;
+
+	llist_for_each_entry(bctx, &bssgp_bvc_ctxts, list) {
+		if (bctx->nsei == nsei && bctx->bvci == bvci)
+			return bctx;
+	}
+	return NULL;
+}
+
+struct bssgp_bvc_ctx *btsctx_alloc(uint16_t bvci, uint16_t nsei)
+{
+	struct bssgp_bvc_ctx *ctx;
+
+	ctx = talloc_zero(bssgp_tall_ctx, struct bssgp_bvc_ctx);
+	if (!ctx)
+		return NULL;
+	ctx->bvci = bvci;
+	ctx->nsei = nsei;
+	/* FIXME: BVCI is not unique, only BVCI+NSEI ?!? */
+	ctx->ctrg = rate_ctr_group_alloc(ctx, &bssgp_ctrg_desc, bvci);
+	ctx->fc = talloc_zero(ctx, struct bssgp_flow_control);
+	/* cofigure for 2Mbit, 30 packets in queue */
+	bssgp_fc_init(ctx->fc, 100000, 2*1024*1024/8, 30, &_bssgp_tx_dl_ud);
+
+	llist_add(&ctx->list, &bssgp_bvc_ctxts);
+
+	return ctx;
+}
+
+/* Chapter 10.4.5: Flow Control BVC ACK */
+static int bssgp_tx_fc_bvc_ack(uint16_t nsei, uint8_t tag, uint16_t ns_bvci)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = ns_bvci;
+
+	bgph->pdu_type = BSSGP_PDUT_FLOW_CONTROL_BVC_ACK;
+	msgb_tvlv_put(msg, BSSGP_IE_TAG, 1, &tag);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* 10.3.7 SUSPEND-ACK PDU */
+int bssgp_tx_suspend_ack(uint16_t nsei, uint32_t tlli,
+			 const struct gprs_ra_id *ra_id, uint8_t suspend_ref)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint32_t _tlli;
+	uint8_t ra[6];
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_SUSPEND_ACK;
+
+	_tlli = htonl(tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &_tlli);
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+	msgb_tvlv_put(msg, BSSGP_IE_SUSPEND_REF_NR, 1, &suspend_ref);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* 10.3.8 SUSPEND-NACK PDU */
+int bssgp_tx_suspend_nack(uint16_t nsei, uint32_t tlli,
+			  const struct gprs_ra_id *ra_id,
+			  uint8_t *cause)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint32_t _tlli;
+	uint8_t ra[6];
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_SUSPEND_NACK;
+
+	_tlli = htonl(tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &_tlli);
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+	if (cause)
+		msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, cause);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* 10.3.10 RESUME-ACK PDU */
+int bssgp_tx_resume_ack(uint16_t nsei, uint32_t tlli,
+			const struct gprs_ra_id *ra_id)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint32_t _tlli;
+	uint8_t ra[6];
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_RESUME_ACK;
+
+	_tlli = htonl(tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &_tlli);
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* 10.3.11 RESUME-NACK PDU */
+int bssgp_tx_resume_nack(uint16_t nsei, uint32_t tlli,
+			 const struct gprs_ra_id *ra_id, uint8_t *cause)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint32_t _tlli;
+	uint8_t ra[6];
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_SUSPEND_NACK;
+
+	_tlli = htonl(tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &_tlli);
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+	if (cause)
+		msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, cause);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+uint16_t bssgp_parse_cell_id(struct gprs_ra_id *raid, const uint8_t *buf)
+{
+	/* 6 octets RAC */
+	gsm48_parse_ra(raid, buf);
+	/* 2 octets CID */
+	return ntohs(*(uint16_t *) (buf+6));
+}
+
+int bssgp_create_cell_id(uint8_t *buf, const struct gprs_ra_id *raid,
+			 uint16_t cid)
+{
+	uint16_t *out_cid = (uint16_t *) (buf + 6);
+	/* 6 octets RAC */
+	gsm48_construct_ra(buf, raid);
+	/* 2 octets CID */
+	*out_cid = htons(cid);
+
+	return 8;
+}
+
+/* Chapter 8.4 BVC-Reset Procedure */
+static int bssgp_rx_bvc_reset(struct msgb *msg, struct tlv_parsed *tp,	
+			      uint16_t ns_bvci)
+{
+	struct osmo_bssgp_prim nmp;
+	struct bssgp_bvc_ctx *bctx;
+	uint16_t nsei = msgb_nsei(msg);
+	uint16_t bvci;
+
+	bvci = ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BVCI));
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx RESET cause=%s\n", bvci,
+		bssgp_cause_str(*TLVP_VAL(tp, BSSGP_IE_CAUSE)));
+
+	/* look-up or create the BTS context for this BVC */
+	bctx = btsctx_by_bvci_nsei(bvci, nsei);
+	if (!bctx)
+		bctx = btsctx_alloc(bvci, nsei);
+
+	/* As opposed to NS-VCs, BVCs are NOT blocked after RESET */
+	bctx->state &= ~BVC_S_BLOCKED;
+
+	/* When we receive a BVC-RESET PDU (at least of a PTP BVCI), the BSS
+	 * informs us about its RAC + Cell ID, so we can create a mapping */
+	if (bvci != 0 && bvci != 1) {
+		if (!TLVP_PRESENT(tp, BSSGP_IE_CELL_ID)) {
+			LOGP(DBSSGP, LOGL_ERROR, "BSSGP BVCI=%u Rx RESET "
+				"missing mandatory IE\n", bvci);
+			return -EINVAL;
+		}
+		/* actually extract RAC / CID */
+		bctx->cell_id = bssgp_parse_cell_id(&bctx->ra_id,
+						TLVP_VAL(tp, BSSGP_IE_CELL_ID));
+		LOGP(DBSSGP, LOGL_NOTICE, "Cell %u-%u-%u-%u CI %u on BVCI %u\n",
+			bctx->ra_id.mcc, bctx->ra_id.mnc, bctx->ra_id.lac,
+			bctx->ra_id.rac, bctx->cell_id, bvci);
+	}
+
+	/* Send NM_BVC_RESET.ind to NM */
+	memset(&nmp, 0, sizeof(nmp));
+	nmp.nsei = nsei;
+	nmp.bvci = bvci;
+	nmp.tp = tp;
+	nmp.ra_id = &bctx->ra_id;
+	osmo_prim_init(&nmp.oph, SAP_BSSGP_NM, PRIM_NM_BVC_RESET,
+			PRIM_OP_INDICATION, msg);
+	bssgp_prim_cb(&nmp.oph, NULL);
+
+	/* Acknowledge the RESET to the BTS */
+	bssgp_tx_simple_bvci(BSSGP_PDUT_BVC_RESET_ACK,
+			     nsei, bvci, ns_bvci);
+	return 0;
+}
+
+static int bssgp_rx_bvc_block(struct msgb *msg, struct tlv_parsed *tp)
+{
+	struct osmo_bssgp_prim nmp;
+	uint16_t bvci;
+	struct bssgp_bvc_ctx *ptp_ctx;
+
+	bvci = ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BVCI));
+	if (bvci == BVCI_SIGNALLING) {
+		/* 8.3.2: Signalling BVC shall never be blocked */
+		LOGP(DBSSGP, LOGL_ERROR, "NSEI=%u/BVCI=%u "
+			"received block for signalling BVC!?!\n",
+			msgb_nsei(msg), msgb_bvci(msg));
+		return 0;
+	}
+
+	LOGP(DBSSGP, LOGL_INFO, "BSSGP Rx BVCI=%u BVC-BLOCK\n", bvci);
+
+	ptp_ctx = btsctx_by_bvci_nsei(bvci, msgb_nsei(msg));
+	if (!ptp_ctx)
+		return bssgp_tx_status(BSSGP_CAUSE_UNKNOWN_BVCI, &bvci, msg);
+
+	ptp_ctx->state |= BVC_S_BLOCKED;
+	rate_ctr_inc(&ptp_ctx->ctrg->ctr[BSSGP_CTR_BLOCKED]);
+
+	/* Send NM_BVC_BLOCK.ind to NM */
+	memset(&nmp, 0, sizeof(nmp));
+	nmp.nsei = msgb_nsei(msg);
+	nmp.bvci = bvci;
+	nmp.tp = tp;
+	osmo_prim_init(&nmp.oph, SAP_BSSGP_NM, PRIM_NM_BVC_BLOCK,
+			PRIM_OP_INDICATION, msg);
+	bssgp_prim_cb(&nmp.oph, NULL);
+
+	/* We always acknowledge the BLOCKing */
+	return bssgp_tx_simple_bvci(BSSGP_PDUT_BVC_BLOCK_ACK, msgb_nsei(msg),
+				    bvci, msgb_bvci(msg));
+};
+
+static int bssgp_rx_bvc_unblock(struct msgb *msg, struct tlv_parsed *tp)
+{
+	struct osmo_bssgp_prim nmp;
+	uint16_t bvci;
+	struct bssgp_bvc_ctx *ptp_ctx;
+
+	bvci = ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BVCI));
+	if (bvci == BVCI_SIGNALLING) {
+		/* 8.3.2: Signalling BVC shall never be blocked */
+		LOGP(DBSSGP, LOGL_ERROR, "NSEI=%u/BVCI=%u "
+			"received unblock for signalling BVC!?!\n",
+			msgb_nsei(msg), msgb_bvci(msg));
+		return 0;
+	}
+
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx BVC-UNBLOCK\n", bvci);
+
+	ptp_ctx = btsctx_by_bvci_nsei(bvci, msgb_nsei(msg));
+	if (!ptp_ctx)
+		return bssgp_tx_status(BSSGP_CAUSE_UNKNOWN_BVCI, &bvci, msg);
+
+	ptp_ctx->state &= ~BVC_S_BLOCKED;
+
+	/* Send NM_BVC_UNBLOCK.ind to NM */
+	memset(&nmp, 0, sizeof(nmp));
+	nmp.nsei = msgb_nsei(msg);
+	nmp.bvci = bvci;
+	nmp.tp = tp;
+	osmo_prim_init(&nmp.oph, SAP_BSSGP_NM, PRIM_NM_BVC_UNBLOCK,
+			PRIM_OP_INDICATION, msg);
+	bssgp_prim_cb(&nmp.oph, NULL);
+
+	/* We always acknowledge the unBLOCKing */
+	return bssgp_tx_simple_bvci(BSSGP_PDUT_BVC_UNBLOCK_ACK, msgb_nsei(msg),
+				    bvci, msgb_bvci(msg));
+};
+
+/* Uplink unit-data */
+static int bssgp_rx_ul_ud(struct msgb *msg, struct tlv_parsed *tp,
+			  struct bssgp_bvc_ctx *ctx)
+{
+	struct osmo_bssgp_prim gbp;
+	struct bssgp_ud_hdr *budh = (struct bssgp_ud_hdr *) msgb_bssgph(msg);
+
+	/* extract TLLI and parse TLV IEs */
+	msgb_tlli(msg) = ntohl(budh->tlli);
+
+	DEBUGP(DBSSGP, "BSSGP TLLI=0x%08x Rx UPLINK-UNITDATA\n", msgb_tlli(msg));
+
+	/* Cell ID and LLC_PDU are the only mandatory IE */
+	if (!TLVP_PRESENT(tp, BSSGP_IE_CELL_ID) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_LLC_PDU)) {
+		LOGP(DBSSGP, LOGL_ERROR, "BSSGP TLLI=0x%08x Rx UL-UD "
+			"missing mandatory IE\n", msgb_tlli(msg));
+		return bssgp_tx_status(BSSGP_CAUSE_MISSING_MAND_IE, NULL, msg);
+	}
+
+	/* store pointer to LLC header and CELL ID in msgb->cb */
+	msgb_llch(msg) = (uint8_t *) TLVP_VAL(tp, BSSGP_IE_LLC_PDU);
+	msgb_bcid(msg) = (uint8_t *) TLVP_VAL(tp, BSSGP_IE_CELL_ID);
+
+	/* Send BSSGP_UL_UD.ind to NM */
+	memset(&gbp, 0, sizeof(gbp));
+	gbp.nsei = ctx->nsei;
+	gbp.bvci = ctx->bvci;
+	gbp.tlli = msgb_tlli(msg);
+	gbp.tp = tp;
+	osmo_prim_init(&gbp.oph, SAP_BSSGP_LL, PRIM_BSSGP_UL_UD,
+			PRIM_OP_INDICATION, msg);
+	return bssgp_prim_cb(&gbp.oph, NULL);
+}
+
+static int bssgp_rx_suspend(struct msgb *msg, struct tlv_parsed *tp,
+			    struct bssgp_bvc_ctx *ctx)
+{
+	struct osmo_bssgp_prim gbp;
+	struct gprs_ra_id raid;
+	uint32_t tlli;
+	int rc;
+
+	if (!TLVP_PRESENT(tp, BSSGP_IE_TLLI) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_ROUTEING_AREA)) {
+		LOGP(DBSSGP, LOGL_ERROR, "BSSGP BVCI=%u Rx SUSPEND "
+			"missing mandatory IE\n", ctx->bvci);
+		return bssgp_tx_status(BSSGP_CAUSE_MISSING_MAND_IE, NULL, msg);
+	}
+
+	tlli = ntohl(*(uint32_t *)TLVP_VAL(tp, BSSGP_IE_TLLI));
+
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u TLLI=0x%08x Rx SUSPEND\n",
+		ctx->bvci, tlli);
+
+	gsm48_parse_ra(&raid, TLVP_VAL(tp, BSSGP_IE_ROUTEING_AREA));
+
+	/* Inform GMM about the SUSPEND request */
+	memset(&gbp, 0, sizeof(gbp));
+	gbp.nsei = msgb_nsei(msg);
+	gbp.bvci = ctx->bvci;
+	gbp.tlli = tlli;
+	gbp.ra_id = &raid;
+	osmo_prim_init(&gbp.oph, SAP_BSSGP_GMM, PRIM_BSSGP_GMM_SUSPEND,
+			PRIM_OP_REQUEST, msg);
+
+	rc = bssgp_prim_cb(&gbp.oph, NULL);
+	if (rc < 0)
+		return bssgp_tx_suspend_nack(msgb_nsei(msg), tlli, &raid, NULL);
+
+	bssgp_tx_suspend_ack(msgb_nsei(msg), tlli, &raid, 0);
+
+	return 0;
+}
+
+static int bssgp_rx_resume(struct msgb *msg, struct tlv_parsed *tp,
+			   struct bssgp_bvc_ctx *ctx)
+{
+	struct osmo_bssgp_prim gbp;
+	struct gprs_ra_id raid;
+	uint32_t tlli;
+	uint8_t suspend_ref;
+	int rc;
+
+	if (!TLVP_PRESENT(tp, BSSGP_IE_TLLI) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_ROUTEING_AREA) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_SUSPEND_REF_NR)) {
+		LOGP(DBSSGP, LOGL_ERROR, "BSSGP BVCI=%u Rx RESUME "
+			"missing mandatory IE\n", ctx->bvci);
+		return bssgp_tx_status(BSSGP_CAUSE_MISSING_MAND_IE, NULL, msg);
+	}
+
+	tlli = ntohl(*(uint32_t *)TLVP_VAL(tp, BSSGP_IE_TLLI));
+	suspend_ref = *TLVP_VAL(tp, BSSGP_IE_SUSPEND_REF_NR);
+
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u TLLI=0x%08x Rx RESUME\n", ctx->bvci, tlli);
+
+	gsm48_parse_ra(&raid, TLVP_VAL(tp, BSSGP_IE_ROUTEING_AREA));
+
+	/* Inform GMM about the RESUME request */
+	memset(&gbp, 0, sizeof(gbp));
+	gbp.nsei = msgb_nsei(msg);
+	gbp.bvci = ctx->bvci;
+	gbp.tlli = tlli;
+	gbp.ra_id = &raid;
+	gbp.u.resume.suspend_ref = suspend_ref;
+	osmo_prim_init(&gbp.oph, SAP_BSSGP_GMM, PRIM_BSSGP_GMM_RESUME,
+			PRIM_OP_REQUEST, msg);
+
+	rc = bssgp_prim_cb(&gbp.oph, NULL);
+	if (rc < 0)
+		return bssgp_tx_resume_nack(msgb_nsei(msg), tlli, &raid,
+					    NULL);
+
+	bssgp_tx_resume_ack(msgb_nsei(msg), tlli, &raid);
+	return 0;
+}
+
+
+static int bssgp_rx_llc_disc(struct msgb *msg, struct tlv_parsed *tp,
+			     struct bssgp_bvc_ctx *ctx)
+{
+	struct osmo_bssgp_prim nmp;
+	uint32_t tlli = 0;
+
+	if (!TLVP_PRESENT(tp, BSSGP_IE_TLLI) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_LLC_FRAMES_DISCARDED) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_BVCI) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_NUM_OCT_AFF)) {
+		LOGP(DBSSGP, LOGL_ERROR, "BSSGP BVCI=%u Rx LLC DISCARDED "
+			"missing mandatory IE\n", ctx->bvci);
+	}
+
+	if (TLVP_PRESENT(tp, BSSGP_IE_TLLI))
+		tlli = ntohl(*(uint32_t *)TLVP_VAL(tp, BSSGP_IE_TLLI));
+
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u TLLI=%08x Rx LLC DISCARDED\n",
+		ctx->bvci, tlli);
+
+	rate_ctr_inc(&ctx->ctrg->ctr[BSSGP_CTR_DISCARDED]);
+
+	/* send NM_LLC_DISCARDED to NM */
+	memset(&nmp, 0, sizeof(nmp));
+	nmp.nsei = msgb_nsei(msg);
+	nmp.bvci = ctx->bvci;
+	nmp.tlli = tlli;
+	nmp.tp = tp;
+	osmo_prim_init(&nmp.oph, SAP_BSSGP_NM, PRIM_NM_LLC_DISCARDED,
+			PRIM_OP_INDICATION, msg);
+
+	return bssgp_prim_cb(&nmp.oph, NULL);
+}
+
+/* One element (msgb) in a BSSGP Flow Control queue */
+struct bssgp_fc_queue_element {
+	/* linked list of queue elements */
+	struct llist_head list;
+	/* The message that we have enqueued */
+	struct msgb *msg;
+	/* Length of the LLC PDU part of the contained message */
+	uint32_t llc_pdu_len;
+	/* private pointer passed to the flow control out_cb function */
+	void *priv;
+};
+
+static int fc_queue_timer_cfg(struct bssgp_flow_control *fc);
+static int bssgp_fc_needs_queueing(struct bssgp_flow_control *fc, uint32_t pdu_len);
+
+static void fc_timer_cb(void *data)
+{
+	struct bssgp_flow_control *fc = data;
+	struct bssgp_fc_queue_element *fcqe;
+	struct timeval time_now;
+
+	/* if the queue is empty, we return without sending something
+	 * and without re-starting the timer */
+	if (llist_empty(&fc->queue))
+		return;
+
+	/* get the first entry from the queue */
+	fcqe = llist_entry(fc->queue.next, struct bssgp_fc_queue_element,
+			   list);
+
+	if (bssgp_fc_needs_queueing(fc, fcqe->llc_pdu_len)) {
+		LOGP(DBSSGP, LOGL_NOTICE, "BSSGP-FC: fc_timer_cb() but still "
+			"not able to send PDU of %u bytes\n", fcqe->llc_pdu_len);
+		/* make sure we re-start the timer */
+		fc_queue_timer_cfg(fc);
+		return;
+	}
+
+	/* remove from the queue */
+	llist_del(&fcqe->list);
+
+	fc->queue_depth--;
+
+	/* record the time we transmitted this PDU */
+	gettimeofday(&time_now, NULL);
+	fc->time_last_pdu = time_now;
+
+	/* call the output callback for this FC instance */
+	fc->out_cb(fcqe->priv, fcqe->msg, fcqe->llc_pdu_len, NULL);
+
+	/* we expect that out_cb will in the end free the msgb once
+	 * it is no longer needed */
+
+	/* but we have to free the queue element ourselves */
+	talloc_free(fcqe);
+
+	/* re-configure the timer for the next PDU */
+	fc_queue_timer_cfg(fc);
+}
+
+/* configure/schedule the flow control timer to expire once the bucket
+ * will have leaked a sufficient number of bytes to transmit the next
+ * PDU in the queue */
+static int fc_queue_timer_cfg(struct bssgp_flow_control *fc)
+{
+	struct bssgp_fc_queue_element *fcqe;
+	uint32_t msecs;
+
+	if (llist_empty(&fc->queue))
+		return 0;
+
+	fcqe = llist_entry(&fc->queue.next, struct bssgp_fc_queue_element,
+			   list);
+
+	/* Calculate the point in time at which we will have leaked
+	 * a sufficient number of bytes from the bucket to transmit
+	 * the first PDU in the queue */
+	msecs = (fcqe->llc_pdu_len * 1000) / fc->bucket_leak_rate;
+	/* FIXME: add that time to fc->time_last_pdu and subtract it from
+	 * current time */
+
+	fc->timer.data = fc;
+	fc->timer.cb = &fc_timer_cb;
+	osmo_timer_schedule(&fc->timer, msecs / 1000, (msecs % 1000) * 1000);
+
+	return 0;
+}
+
+/* Enqueue a PDU in the flow control queue for delayed transmission */
+static int fc_enqueue(struct bssgp_flow_control *fc, struct msgb *msg,
+		      uint32_t llc_pdu_len, void *priv)
+{
+	struct bssgp_fc_queue_element *fcqe;
+
+	if (fc->queue_depth >= fc->max_queue_depth)
+		return -ENOSPC;
+
+	fcqe = talloc_zero(fc, struct bssgp_fc_queue_element);
+	if (!fcqe)
+		return -ENOMEM;
+	fcqe->msg = msg;
+	fcqe->llc_pdu_len = llc_pdu_len;
+	fcqe->priv = priv;
+
+	llist_add_tail(&fcqe->list, &fc->queue);
+
+	fc->queue_depth++;
+
+	/* re-configure the timer for dequeueing the pdu */
+	fc_queue_timer_cfg(fc);
+
+	return 0;
+}
+
+/* According to Section 8.2 */
+static int bssgp_fc_needs_queueing(struct bssgp_flow_control *fc, uint32_t pdu_len)
+{
+	struct timeval time_now, time_diff;
+	int64_t bucket_predicted;
+	uint32_t csecs_elapsed, leaked;
+
+	/* B' = B + L(p) - (Tc - Tp)*R */
+
+	/* compute number of centi-seconds that have elapsed since transmitting
+	 * the last PDU (Tc - Tp) */
+	gettimeofday(&time_now, NULL);
+	timersub(&time_now, &fc->time_last_pdu, &time_diff);
+	csecs_elapsed = time_diff.tv_sec*100 + time_diff.tv_usec/10000;
+
+	/* compute number of bytes that have leaked in the elapsed number
+	 * of centi-seconds */
+	leaked = csecs_elapsed * (fc->bucket_leak_rate / 100);
+	/* add the current PDU length to the last bucket level */
+	bucket_predicted = fc->bucket_counter + pdu_len;
+	/* ... and subtract the number of leaked bytes */
+	bucket_predicted -= leaked;
+
+	if (bucket_predicted < pdu_len) {
+		/* this is just to make sure the bucket doesn't underflow */
+		bucket_predicted = pdu_len;
+		goto pass;
+	}
+
+	if (bucket_predicted <= fc->bucket_size_max) {
+		/* the bucket is not full yet, we can pass the packet */
+		fc->bucket_counter = bucket_predicted;
+		goto pass;
+	}
+
+	/* bucket is full, PDU needs to be delayed */
+	return 1;
+
+pass:
+	/* if we reach here, the PDU can pass */
+	return 0;
+}
+
+/* output callback for BVC flow control */
+static int _bssgp_tx_dl_ud(struct bssgp_flow_control *fc, struct msgb *msg,
+			   uint32_t llc_pdu_len, void *priv)
+{
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* input function of the flow control implementation, called first
+ * for the MM flow control, and then as the MM flow control output
+ * callback in order to perform BVC flow control */
+int bssgp_fc_in(struct bssgp_flow_control *fc, struct msgb *msg,
+		uint32_t llc_pdu_len, void *priv)
+{
+	struct timeval time_now;
+
+	if (llc_pdu_len > fc->bucket_size_max) {
+		LOGP(DBSSGP, LOGL_NOTICE, "Single PDU (size=%u) is larger "
+		     "than maximum bucket size (%u)!\n", llc_pdu_len,
+		     fc->bucket_size_max);
+		return -EIO;
+	}
+
+	if (bssgp_fc_needs_queueing(fc, llc_pdu_len)) {
+		return fc_enqueue(fc, msg, llc_pdu_len, priv);
+	} else {
+		/* record the time we transmitted this PDU */
+		gettimeofday(&time_now, NULL);
+		fc->time_last_pdu = time_now;
+		return fc->out_cb(priv, msg, llc_pdu_len, NULL);
+	}
+}
+
+
+/* Initialize the Flow Control structure */
+void bssgp_fc_init(struct bssgp_flow_control *fc,
+		   uint32_t bucket_size_max, uint32_t bucket_leak_rate,
+		   uint32_t max_queue_depth,
+		   int (*out_cb)(struct bssgp_flow_control *fc, struct msgb *msg,
+				 uint32_t llc_pdu_len, void *priv))
+{
+	fc->out_cb = out_cb;
+	fc->bucket_size_max = bucket_size_max;
+	fc->bucket_leak_rate = bucket_leak_rate;
+	fc->max_queue_depth = max_queue_depth;
+	INIT_LLIST_HEAD(&fc->queue);
+	gettimeofday(&fc->time_last_pdu, NULL);
+}
+
+/* Initialize the Flow Control parameters for a new MS according to
+ * default values for the BVC specified by BVCI and NSEI */
+int bssgp_fc_ms_init(struct bssgp_flow_control *fc_ms, uint16_t bvci,
+		     uint16_t nsei, uint32_t max_queue_depth)
+{
+	struct bssgp_bvc_ctx *ctx;
+
+	ctx = btsctx_by_bvci_nsei(bvci, nsei);
+	if (!ctx)
+		return -ENODEV;
+
+	/* output call-back of per-MS FC is per-CTX FC */
+	bssgp_fc_init(fc_ms, ctx->bmax_default_ms, ctx->r_default_ms,
+			max_queue_depth, bssgp_fc_in);
+
+	return 0;
+}
+
+static int bssgp_rx_fc_bvc(struct msgb *msg, struct tlv_parsed *tp,
+			   struct bssgp_bvc_ctx *bctx)
+{
+
+	DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx Flow Control BVC\n",
+		bctx->bvci);
+
+	if (!TLVP_PRESENT(tp, BSSGP_IE_TAG) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_BVC_BUCKET_SIZE) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_BUCKET_LEAK_RATE) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_BMAX_DEFAULT_MS) ||
+	    !TLVP_PRESENT(tp, BSSGP_IE_R_DEFAULT_MS)) {
+		LOGP(DBSSGP, LOGL_ERROR, "BSSGP BVCI=%u Rx FC BVC "
+			"missing mandatory IE\n", bctx->bvci);
+		return bssgp_tx_status(BSSGP_CAUSE_MISSING_MAND_IE, NULL, msg);
+	}
+
+	/* 11.3.5 Bucket Size in 100 octets unit */
+	bctx->fc->bucket_size_max = 100 *
+		ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BVC_BUCKET_SIZE));
+	/* 11.3.4 Bucket Leak Rate in 100 bits/sec unit */
+	bctx->fc->bucket_leak_rate = 100 *
+		ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BUCKET_LEAK_RATE)) / 8;
+	/* 11.3.2 in octets */
+	bctx->bmax_default_ms =
+		ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_BMAX_DEFAULT_MS));
+	/* 11.3.32 Bucket Leak rate in 100bits/sec unit */
+	bctx->r_default_ms = 100 *
+		ntohs(*(uint16_t *)TLVP_VAL(tp, BSSGP_IE_R_DEFAULT_MS)) / 8;
+
+	/* Send FLOW_CONTROL_BVC_ACK */
+	return bssgp_tx_fc_bvc_ack(msgb_nsei(msg), *TLVP_VAL(tp, BSSGP_IE_TAG),
+				   msgb_bvci(msg));
+}
+
+/* Receive a BSSGP PDU from a BSS on a PTP BVCI */
+static int bssgp_rx_ptp(struct msgb *msg, struct tlv_parsed *tp,
+			struct bssgp_bvc_ctx *bctx)
+{
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_bssgph(msg);
+	uint8_t pdu_type = bgph->pdu_type;
+	int rc = 0;
+
+	/* If traffic is received on a BVC that is marked as blocked, the
+	 * received PDU shall not be accepted and a STATUS PDU (Cause value:
+	 * BVC Blocked) shall be sent to the peer entity on the signalling BVC */
+	if (bctx->state & BVC_S_BLOCKED && pdu_type != BSSGP_PDUT_STATUS) {
+		uint16_t bvci = msgb_bvci(msg);
+		return bssgp_tx_status(BSSGP_CAUSE_BVCI_BLOCKED, &bvci, msg);
+	}
+
+	switch (pdu_type) {
+	case BSSGP_PDUT_UL_UNITDATA:
+		/* some LLC data from the MS */
+		rc = bssgp_rx_ul_ud(msg, tp, bctx);
+		break;
+	case BSSGP_PDUT_RA_CAPABILITY:
+		/* BSS requests RA capability or IMSI */
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx RA CAPABILITY UPDATE\n",
+			bctx->bvci);
+		/* FIXME: send GMM_RA_CAPABILITY_UPDATE.ind to GMM */
+		/* FIXME: send RA_CAPA_UPDATE_ACK */
+		break;
+	case BSSGP_PDUT_RADIO_STATUS:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx RADIO STATUS\n", bctx->bvci);
+		/* BSS informs us of some exception */
+		/* FIXME: send GMM_RADIO_STATUS.ind to GMM */
+		break;
+	case BSSGP_PDUT_FLOW_CONTROL_BVC:
+		/* BSS informs us of available bandwidth in Gb interface */
+		rc = bssgp_rx_fc_bvc(msg, tp, bctx);
+		break;
+	case BSSGP_PDUT_FLOW_CONTROL_MS:
+		/* BSS informs us of available bandwidth to one MS */
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx Flow Control MS\n",
+			bctx->bvci);
+		/* FIXME: actually implement flow control */
+		/* FIXME: Send FLOW_CONTROL_MS_ACK */
+		break;
+	case BSSGP_PDUT_STATUS:
+		/* Some exception has occurred */
+		/* FIXME: send NM_STATUS.ind to NM */
+	case BSSGP_PDUT_DOWNLOAD_BSS_PFC:
+	case BSSGP_PDUT_CREATE_BSS_PFC_ACK:
+	case BSSGP_PDUT_CREATE_BSS_PFC_NACK:
+	case BSSGP_PDUT_MODIFY_BSS_PFC:
+	case BSSGP_PDUT_DELETE_BSS_PFC_ACK:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx PDU type 0x%02x not [yet] "
+			"implemented\n", bctx->bvci, pdu_type);
+		rc = bssgp_tx_status(BSSGP_CAUSE_PDU_INCOMP_FEAT, NULL, msg);
+		break;
+	/* those only exist in the SGSN -> BSS direction */
+	case BSSGP_PDUT_DL_UNITDATA:
+	case BSSGP_PDUT_PAGING_PS:
+	case BSSGP_PDUT_PAGING_CS:
+	case BSSGP_PDUT_RA_CAPA_UPDATE_ACK:
+	case BSSGP_PDUT_FLOW_CONTROL_BVC_ACK:
+	case BSSGP_PDUT_FLOW_CONTROL_MS_ACK:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u PDU type 0x%02x only exists "
+			"in DL\n", bctx->bvci, pdu_type);
+		bssgp_tx_status(BSSGP_CAUSE_PROTO_ERR_UNSPEC, NULL, msg);
+		rc = -EINVAL;
+		break;
+	default:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u PDU type 0x%02x unknown\n",
+			bctx->bvci, pdu_type);
+		rc = bssgp_tx_status(BSSGP_CAUSE_PROTO_ERR_UNSPEC, NULL, msg);
+		break;
+	}
+
+	return rc;
+}
+
+/* Receive a BSSGP PDU from a BSS on a SIGNALLING BVCI */
+static int bssgp_rx_sign(struct msgb *msg, struct tlv_parsed *tp,
+			 struct bssgp_bvc_ctx *bctx)
+{
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_bssgph(msg);
+	uint8_t pdu_type = bgph->pdu_type;
+	int rc = 0;
+	uint16_t ns_bvci = msgb_bvci(msg);
+
+	switch (bgph->pdu_type) {
+	case BSSGP_PDUT_SUSPEND:
+		/* MS wants to suspend */
+		rc = bssgp_rx_suspend(msg, tp, bctx);
+		break;
+	case BSSGP_PDUT_RESUME:
+		/* MS wants to resume */
+		rc = bssgp_rx_resume(msg, tp, bctx);
+		break;
+	case BSSGP_PDUT_FLUSH_LL_ACK:
+		/* BSS informs us it has performed LL FLUSH */
+		DEBUGP(DBSSGP, "BSSGP Rx BVCI=%u FLUSH LL ACK\n", bctx->bvci);
+		/* FIXME: send NM_FLUSH_LL.res to NM */
+		break;
+	case BSSGP_PDUT_LLC_DISCARD:
+		/* BSS informs that some LLC PDU's have been discarded */
+		rc = bssgp_rx_llc_disc(msg, tp, bctx);
+		break;
+	case BSSGP_PDUT_BVC_BLOCK:
+		/* BSS tells us that BVC shall be blocked */
+		if (!TLVP_PRESENT(tp, BSSGP_IE_BVCI) ||
+		    !TLVP_PRESENT(tp, BSSGP_IE_CAUSE)) {
+			LOGP(DBSSGP, LOGL_ERROR, "BSSGP Rx BVC-BLOCK "
+				"missing mandatory IE\n");
+			goto err_mand_ie;
+		}
+		rc = bssgp_rx_bvc_block(msg, tp);
+		break;
+	case BSSGP_PDUT_BVC_UNBLOCK:
+		/* BSS tells us that BVC shall be unblocked */
+		if (!TLVP_PRESENT(tp, BSSGP_IE_BVCI)) {
+			LOGP(DBSSGP, LOGL_ERROR, "BSSGP Rx BVC-UNBLOCK "
+				"missing mandatory IE\n");
+			goto err_mand_ie;
+		}
+		rc = bssgp_rx_bvc_unblock(msg, tp);
+		break;
+	case BSSGP_PDUT_BVC_RESET:
+		/* BSS tells us that BVC init is required */
+		if (!TLVP_PRESENT(tp, BSSGP_IE_BVCI) ||
+		    !TLVP_PRESENT(tp, BSSGP_IE_CAUSE)) {
+			LOGP(DBSSGP, LOGL_ERROR, "BSSGP Rx BVC-RESET "
+				"missing mandatory IE\n");
+			goto err_mand_ie;
+		}
+		rc = bssgp_rx_bvc_reset(msg, tp, ns_bvci);
+		break;
+	case BSSGP_PDUT_STATUS:
+		/* Some exception has occurred */
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx BVC STATUS\n", bctx->bvci);
+		/* FIXME: send NM_STATUS.ind to NM */
+		break;
+	/* those only exist in the SGSN -> BSS direction */
+	case BSSGP_PDUT_PAGING_PS:
+	case BSSGP_PDUT_PAGING_CS:
+	case BSSGP_PDUT_SUSPEND_ACK:
+	case BSSGP_PDUT_SUSPEND_NACK:
+	case BSSGP_PDUT_RESUME_ACK:
+	case BSSGP_PDUT_RESUME_NACK:
+	case BSSGP_PDUT_FLUSH_LL:
+	case BSSGP_PDUT_BVC_BLOCK_ACK:
+	case BSSGP_PDUT_BVC_UNBLOCK_ACK:
+	case BSSGP_PDUT_SGSN_INVOKE_TRACE:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx PDU type 0x%02x only exists "
+			"in DL\n", bctx->bvci, pdu_type);
+		bssgp_tx_status(BSSGP_CAUSE_PROTO_ERR_UNSPEC, NULL, msg);
+		rc = -EINVAL;
+		break;
+	default:
+		DEBUGP(DBSSGP, "BSSGP BVCI=%u Rx PDU type 0x%02x unknown\n",
+			bctx->bvci, pdu_type);
+		rc = bssgp_tx_status(BSSGP_CAUSE_PROTO_ERR_UNSPEC, NULL, msg);
+		break;
+	}
+
+	return rc;
+err_mand_ie:
+	return bssgp_tx_status(BSSGP_CAUSE_MISSING_MAND_IE, NULL, msg);
+}
+
+/* We expect msgb_bssgph() to point to the BSSGP header */
+int bssgp_rcvmsg(struct msgb *msg)
+{
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_bssgph(msg);
+	struct bssgp_ud_hdr *budh = (struct bssgp_ud_hdr *) msgb_bssgph(msg);
+	struct tlv_parsed tp;
+	struct bssgp_bvc_ctx *bctx;
+	uint8_t pdu_type = bgph->pdu_type;
+	uint16_t ns_bvci = msgb_bvci(msg);
+	int data_len;
+	int rc = 0;
+
+	/* Identifiers from DOWN: NSEI, BVCI (both in msg->cb) */
+
+	/* UNITDATA BSSGP headers have TLLI in front */
+	if (pdu_type != BSSGP_PDUT_UL_UNITDATA &&
+	    pdu_type != BSSGP_PDUT_DL_UNITDATA) {
+		data_len = msgb_bssgp_len(msg) - sizeof(*bgph);
+		rc = bssgp_tlv_parse(&tp, bgph->data, data_len);
+	} else {
+		data_len = msgb_bssgp_len(msg) - sizeof(*budh);
+		rc = bssgp_tlv_parse(&tp, budh->data, data_len);
+	}
+
+	/* look-up or create the BTS context for this BVC */
+	bctx = btsctx_by_bvci_nsei(ns_bvci, msgb_nsei(msg));
+	/* Only a RESET PDU can create a new BVC context */
+	if (!bctx && pdu_type != BSSGP_PDUT_BVC_RESET) {
+		LOGP(DBSSGP, LOGL_NOTICE, "NSEI=%u/BVCI=%u Rejecting PDU "
+			"type %u for unknown BVCI\n", msgb_nsei(msg), ns_bvci,
+			pdu_type);
+		return bssgp_tx_status(BSSGP_CAUSE_UNKNOWN_BVCI, NULL, msg);
+	}
+
+	if (bctx) {
+		log_set_context(GPRS_CTX_BVC, bctx);
+		rate_ctr_inc(&bctx->ctrg->ctr[BSSGP_CTR_PKTS_IN]);
+		rate_ctr_add(&bctx->ctrg->ctr[BSSGP_CTR_BYTES_IN],
+			     msgb_bssgp_len(msg));
+	}
+
+	if (ns_bvci == BVCI_SIGNALLING)
+		rc = bssgp_rx_sign(msg, &tp, bctx);
+	else if (ns_bvci == BVCI_PTM)
+		rc = bssgp_tx_status(BSSGP_CAUSE_PDU_INCOMP_FEAT, NULL, msg);
+	else
+		rc = bssgp_rx_ptp(msg, &tp, bctx);
+
+	return rc;
+}
+
+int bssgp_tx_dl_ud(struct msgb *msg, uint16_t pdu_lifetime,
+		   struct bssgp_dl_ud_par *dup)
+{
+	struct bssgp_bvc_ctx *bctx;
+	struct bssgp_ud_hdr *budh;
+	uint8_t llc_pdu_tlv_hdr_len = 2;
+	uint8_t *llc_pdu_tlv;
+	uint16_t msg_len = msg->len;
+	uint16_t bvci = msgb_bvci(msg);
+	uint16_t nsei = msgb_nsei(msg);
+	uint16_t _pdu_lifetime = htons(pdu_lifetime); /* centi-seconds */
+	uint16_t drx_params;
+
+	/* Identifiers from UP: TLLI, BVCI, NSEI (all in msgb->cb) */
+	if (bvci <= BVCI_PTM ) {
+		LOGP(DBSSGP, LOGL_ERROR, "Cannot send DL-UD to BVCI %u\n",
+			bvci);
+		return -EINVAL;
+	}
+
+	bctx = btsctx_by_bvci_nsei(bvci, nsei);
+	if (!bctx) {
+		LOGP(DBSSGP, LOGL_ERROR, "Cannot send DL-UD to unknown BVCI %u\n",
+			bvci);
+		return -ENODEV;
+	}
+
+	if (msg->len > TVLV_MAX_ONEBYTE)
+		llc_pdu_tlv_hdr_len += 1;
+
+	/* prepend the tag and length of the LLC-PDU TLV */
+	llc_pdu_tlv = msgb_push(msg, llc_pdu_tlv_hdr_len);
+	llc_pdu_tlv[0] = BSSGP_IE_LLC_PDU;
+	if (llc_pdu_tlv_hdr_len > 2) {
+		llc_pdu_tlv[1] = msg_len >> 8;
+		llc_pdu_tlv[2] = msg_len & 0xff;
+	} else {
+		llc_pdu_tlv[1] = msg_len & 0x7f;
+		llc_pdu_tlv[1] |= 0x80;
+	}
+
+	/* FIXME: optional elements: Alignment, UTRAN CCO, LSA, PFI */
+
+	if (dup) {
+		/* Old TLLI to help BSS map from old->new */
+		if (dup->tlli) {
+			uint32_t tlli = htonl(*dup->tlli);
+			msgb_tvlv_push(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &tlli);
+		}
+
+		/* IMSI */
+		if (dup->imsi && strlen(dup->imsi)) {
+			uint8_t mi[10];
+			int imsi_len = gsm48_generate_mid_from_imsi(mi, dup->imsi);
+			if (imsi_len > 2)
+				msgb_tvlv_push(msg, BSSGP_IE_IMSI,
+						imsi_len-2, mi+2);
+		}
+
+		/* DRX parameters */
+		drx_params = htons(dup->drx_parms);
+		msgb_tvlv_push(msg, BSSGP_IE_DRX_PARAMS, 2,
+				(uint8_t *) &drx_params);
+
+		/* FIXME: Priority */
+
+		/* MS Radio Access Capability */
+		if (dup->ms_ra_cap.len)
+			msgb_tvlv_push(msg, BSSGP_IE_MS_RADIO_ACCESS_CAP,
+					dup->ms_ra_cap.len, dup->ms_ra_cap.v);
+
+	}
+
+	/* prepend the pdu lifetime */
+	msgb_tvlv_push(msg, BSSGP_IE_PDU_LIFETIME, 2, (uint8_t *)&_pdu_lifetime);
+
+	/* prepend the QoS profile, TLLI and pdu type */
+	budh = (struct bssgp_ud_hdr *) msgb_push(msg, sizeof(*budh));
+	memcpy(budh->qos_profile, dup->qos_profile, sizeof(budh->qos_profile));
+	budh->tlli = htonl(msgb_tlli(msg));
+	budh->pdu_type = BSSGP_PDUT_DL_UNITDATA;
+
+	rate_ctr_inc(&bctx->ctrg->ctr[BSSGP_CTR_PKTS_OUT]);
+	rate_ctr_add(&bctx->ctrg->ctr[BSSGP_CTR_BYTES_OUT], msg->len);
+
+	/* Identifiers down: BVCI, NSEI (in msgb->cb) */
+
+	/* check if we have to go through per-ms flow control or can go
+	 * directly to the per-BSS flow control */
+	if (dup->fc)
+		return bssgp_fc_in(dup->fc, msg, msg_len, bctx->fc);
+	else
+		return bssgp_fc_in(bctx->fc, msg, msg_len, NULL);
+}
+
+/* Send a single GMM-PAGING.req to a given NSEI/NS-BVCI */
+int bssgp_tx_paging(uint16_t nsei, uint16_t ns_bvci,
+		     struct bssgp_paging_info *pinfo)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t drx_params = htons(pinfo->drx_params);
+	uint8_t mi[10];
+	int imsi_len = gsm48_generate_mid_from_imsi(mi, pinfo->imsi);
+	uint8_t ra[6];
+
+	if (imsi_len < 2)
+		return -EINVAL;
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = ns_bvci;
+
+	if (pinfo->mode == BSSGP_PAGING_PS)
+		bgph->pdu_type = BSSGP_PDUT_PAGING_PS;
+	else
+		bgph->pdu_type = BSSGP_PDUT_PAGING_CS;
+	/* IMSI */
+	msgb_tvlv_put(msg, BSSGP_IE_IMSI, imsi_len-2, mi+2);
+	/* DRX Parameters */
+	msgb_tvlv_put(msg, BSSGP_IE_DRX_PARAMS, 2,
+			(uint8_t *) &drx_params);
+	/* Scope */
+	switch (pinfo->scope) {
+	case BSSGP_PAGING_BSS_AREA:
+		{
+			uint8_t null = 0;
+			msgb_tvlv_put(msg, BSSGP_IE_BSS_AREA_ID, 1, &null);
+		}
+		break;
+	case BSSGP_PAGING_LOCATION_AREA:
+		gsm48_construct_ra(ra, &pinfo->raid);
+		msgb_tvlv_put(msg, BSSGP_IE_LOCATION_AREA, 4, ra);
+		break;
+	case BSSGP_PAGING_ROUTEING_AREA:
+		gsm48_construct_ra(ra, &pinfo->raid);
+		msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+		break;
+	case BSSGP_PAGING_BVCI:
+		{
+			uint16_t bvci = htons(pinfo->bvci);
+			msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *)&bvci);
+		}
+		break;
+	}
+	/* QoS profile mandatory for PS */
+	if (pinfo->mode == BSSGP_PAGING_PS)
+		msgb_tvlv_put(msg, BSSGP_IE_QOS_PROFILE, 3, pinfo->qos);
+
+	/* Optional (P-)TMSI */
+	if (pinfo->ptmsi) {
+		uint32_t ptmsi = htonl(*pinfo->ptmsi);
+		msgb_tvlv_put(msg, BSSGP_IE_TMSI, 4, (uint8_t *) &ptmsi);
+	}
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+void bssgp_set_log_ss(int ss)
+{
+	DBSSGP = ss;
+}
diff --git a/src/shared/libosmocore/src/gb/gprs_bssgp_bss.c b/src/shared/libosmocore/src/gb/gprs_bssgp_bss.c
new file mode 100644
index 00000000..7d4c07ce
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_bssgp_bss.c
@@ -0,0 +1,556 @@
+/* GPRS BSSGP protocol implementation as per 3GPP TS 08.18 */
+
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <errno.h>
+#include <stdint.h>
+
+#include <netinet/in.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+#include <osmocom/gprs/gprs_bssgp_bss.h>
+#include <osmocom/gprs/gprs_ns.h>
+
+#include "common_vty.h"
+
+uint8_t *bssgp_msgb_tlli_put(struct msgb *msg, uint32_t tlli)
+{
+	uint32_t _tlli = htonl(tlli);
+	return msgb_tvlv_put(msg, BSSGP_IE_TLLI, 4, (uint8_t *) &_tlli);
+}
+
+/*! \brief GMM-SUSPEND.req (Chapter 10.3.6) */
+int bssgp_tx_suspend(uint16_t nsei, uint32_t tlli,
+		     const struct gprs_ra_id *ra_id)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint8_t ra[6];
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=0) Tx SUSPEND (TLLI=0x%04x)\n",
+		tlli);
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_SUSPEND;
+
+	bssgp_msgb_tlli_put(msg, tlli);
+
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief GMM-RESUME.req (Chapter 10.3.9) */
+int bssgp_tx_resume(uint16_t nsei, uint32_t tlli,
+		    const struct gprs_ra_id *ra_id, uint8_t suspend_ref)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint8_t ra[6];
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=0) Tx RESUME (TLLI=0x%04x)\n",
+		tlli);
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_RESUME;
+
+	bssgp_msgb_tlli_put(msg, tlli);
+
+	gsm48_construct_ra(ra, ra_id);
+	msgb_tvlv_put(msg, BSSGP_IE_ROUTEING_AREA, 6, ra);
+
+	msgb_tvlv_put(msg, BSSGP_IE_SUSPEND_REF_NR, 1, &suspend_ref);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit RA-CAPABILITY-UPDATE (10.3.3) */
+int bssgp_tx_ra_capa_upd(struct bssgp_bvc_ctx *bctx, uint32_t tlli, uint8_t tag)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx RA-CAPA-UPD (TLLI=0x%04x)\n",
+		bctx->bvci, tlli);
+
+	/* set NSEI and BVCI in msgb cb */
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = bctx->bvci;
+
+	bgph->pdu_type = BSSGP_PDUT_RA_CAPA_UDPATE;
+	bssgp_msgb_tlli_put(msg, tlli);
+
+	msgb_tvlv_put(msg, BSSGP_IE_TAG, 1, &tag);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* first common part of RADIO-STATUS */
+static struct msgb *common_tx_radio_status(struct bssgp_bvc_ctx *bctx)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+		(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx RADIO-STATUS ",
+		bctx->bvci);
+
+	/* set NSEI and BVCI in msgb cb */
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = bctx->bvci;
+
+	bgph->pdu_type = BSSGP_PDUT_RADIO_STATUS;
+
+	return msg;
+}
+
+/* second common part of RADIO-STATUS */
+static int common_tx_radio_status2(struct msgb *msg, uint8_t cause)
+{
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, &cause);
+	LOGPC(DBSSGP, LOGL_NOTICE, "CAUSE=%u\n", cause);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit RADIO-STATUS for TLLI (10.3.5) */
+int bssgp_tx_radio_status_tlli(struct bssgp_bvc_ctx *bctx, uint8_t cause,
+				uint32_t tlli)
+{
+	struct msgb *msg = common_tx_radio_status(bctx);
+
+	if (!msg)
+		return -ENOMEM;
+	bssgp_msgb_tlli_put(msg, tlli);
+	LOGPC(DBSSGP, LOGL_NOTICE, "TLLI=0x%08x ", tlli);
+
+	return common_tx_radio_status2(msg, cause);
+}
+
+/*! \brief Transmit RADIO-STATUS for TMSI (10.3.5) */
+int bssgp_tx_radio_status_tmsi(struct bssgp_bvc_ctx *bctx, uint8_t cause,
+				uint32_t tmsi)
+{
+	struct msgb *msg = common_tx_radio_status(bctx);
+	uint32_t _tmsi = htonl(tmsi);
+
+	if (!msg)
+		return -ENOMEM;
+	msgb_tvlv_put(msg, BSSGP_IE_TMSI, 4, (uint8_t *)&_tmsi);
+	LOGPC(DBSSGP, LOGL_NOTICE, "TMSI=0x%08x ", tmsi);
+
+	return common_tx_radio_status2(msg, cause);
+}
+
+/*! \brief Transmit RADIO-STATUS for IMSI (10.3.5) */
+int bssgp_tx_radio_status_imsi(struct bssgp_bvc_ctx *bctx, uint8_t cause,
+				const char *imsi)
+{
+	struct msgb *msg = common_tx_radio_status(bctx);
+	uint8_t mi[10];
+	int imsi_len = gsm48_generate_mid_from_imsi(mi, imsi);
+
+	if (!msg)
+		return -ENOMEM;
+
+	/* strip the MI type and length values (2 bytes) */
+	if (imsi_len > 2)
+		msgb_tvlv_put(msg, BSSGP_IE_IMSI, imsi_len-2, mi+2);
+	LOGPC(DBSSGP, LOGL_NOTICE, "IMSI=%s ", imsi);
+
+	return common_tx_radio_status2(msg, cause);
+}
+
+/*! \brief Transmit FLUSH-LL-ACK (Chapter 10.4.2) */
+int bssgp_tx_flush_ll_ack(struct bssgp_bvc_ctx *bctx, uint32_t tlli,
+			   uint8_t action, uint16_t bvci_new,
+			   uint32_t num_octets)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci_new = htons(bvci_new);
+	uint32_t _oct_aff = htonl(num_octets & 0xFFFFFF);
+
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_FLUSH_LL_ACK;
+
+	bssgp_msgb_tlli_put(msg, tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_FLUSH_ACTION, 1, &action);
+	if (action == 1) /* transferred */
+		msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci_new);
+	msgb_tvlv_put(msg, BSSGP_IE_NUM_OCT_AFF, 3, (uint8_t *) &_oct_aff);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit LLC-DISCARDED (Chapter 10.4.3) */
+int bssgp_tx_llc_discarded(struct bssgp_bvc_ctx *bctx, uint32_t tlli,
+			   uint8_t num_frames, uint32_t num_octets)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci = htons(bctx->bvci);
+	uint32_t _oct_aff = htonl(num_octets & 0xFFFFFF);
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx LLC-DISCARDED "
+	     "TLLI=0x%04x, FRAMES=%u, OCTETS=%u\n", bctx->bvci, tlli,
+	     num_frames, num_octets);
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_LLC_DISCARD;
+
+	bssgp_msgb_tlli_put(msg, tlli);
+
+	msgb_tvlv_put(msg, BSSGP_IE_LLC_FRAMES_DISCARDED, 1, &num_frames);
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	msgb_tvlv_put(msg, BSSGP_IE_NUM_OCT_AFF, 3, ((uint8_t *) &_oct_aff) + 1);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit a BVC-BLOCK message (Chapter 10.4.8) */
+int bssgp_tx_bvc_block(struct bssgp_bvc_ctx *bctx, uint8_t cause)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci = htons(bctx->bvci);
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx BVC-BLOCK "
+	     "CAUSE=%u\n", bctx->bvci, cause);
+
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_BVC_BLOCK;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, &cause);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit a BVC-UNBLOCK message (Chapter 10.4.10) */
+int bssgp_tx_bvc_unblock(struct bssgp_bvc_ctx *bctx)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci = htons(bctx->bvci);
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx BVC-BLOCK\n", bctx->bvci);
+
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_BVC_UNBLOCK;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit a BVC-RESET message (Chapter 10.4.12) */
+int bssgp_tx_bvc_reset(struct bssgp_bvc_ctx *bctx, uint16_t bvci, uint8_t cause)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci = htons(bvci);
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP (BVCI=%u) Tx BVC-RESET "
+	     "CAUSE=%u\n", bvci, cause);
+
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = 0; /* Signalling */
+	bgph->pdu_type = BSSGP_PDUT_BVC_RESET;
+
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, &cause);
+	if (bvci != BVCI_PTM) {
+		uint8_t bssgp_cid[8];
+		bssgp_create_cell_id(bssgp_cid, &bctx->ra_id, bctx->cell_id);
+		msgb_tvlv_put(msg, BSSGP_IE_CELL_ID, sizeof(bssgp_cid), bssgp_cid);
+	}
+	/* Optional: Feature Bitmap */
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit a FLOW_CONTROL-BVC (Chapter 10.4.4)
+ *  \param[in] bctx BVC Context
+ *  \param[in] tag Additional tag to identify acknowledge
+ *  \param[in] bucket_size Maximum bucket size in octets
+ *  \param[in] bucket_leak_rate Bucket leak rate in octets/sec
+ *  \param[in] bmax_default_ms Maximum bucket size default for MS
+ *  \param[in] r_default_ms Bucket leak rate default for MS in octets/sec
+ *  \param[in] bucket_full_ratio Ratio (in percent) of queue filling
+ *  \param[in] queue_delay_ms Average queuing delay in milliseconds
+ */
+int bssgp_tx_fc_bvc(struct bssgp_bvc_ctx *bctx, uint8_t tag,
+		    uint32_t bucket_size, uint32_t bucket_leak_rate,
+		    uint16_t bmax_default_ms, uint32_t r_default_ms,
+		    uint8_t *bucket_full_ratio, uint32_t *queue_delay_ms)
+{
+	struct msgb *msg;
+	struct bssgp_normal_hdr *bgph;
+	uint16_t e_bucket_size, e_leak_rate, e_bmax_default_ms, e_r_default_ms;
+	uint16_t e_queue_delay = 0; /* to make gcc happy */
+
+	if ((bucket_size / 100) > 0xffff)
+		return -EINVAL;
+	e_bucket_size = bucket_size / 100;
+
+	if ((bucket_leak_rate * 8 / 100) > 0xffff)
+		return -EINVAL;
+	e_leak_rate = (bucket_leak_rate * 8) / 100;
+
+	if ((bmax_default_ms / 100) > 0xffff)
+		return -EINVAL;
+	e_bmax_default_ms = bmax_default_ms / 100;
+
+	if ((r_default_ms * 8 / 100) > 0xffff)
+		return -EINVAL;
+	e_r_default_ms = (r_default_ms * 8) / 100;
+
+	if (queue_delay_ms) {
+		if ((*queue_delay_ms / 10) > 60000)
+			return -EINVAL;
+		else if (*queue_delay_ms == 0xFFFFFFFF)
+			e_queue_delay = 0xFFFF;
+		else
+			e_queue_delay = *queue_delay_ms / 10;
+	}
+
+	msg = bssgp_msgb_alloc();
+	bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = bctx->bvci;
+	bgph->pdu_type = BSSGP_PDUT_FLOW_CONTROL_BVC;
+
+	msgb_tvlv_put(msg, BSSGP_IE_TAG, sizeof(tag), (uint8_t *)&tag);
+	msgb_tvlv_put(msg, BSSGP_IE_BVC_BUCKET_SIZE,
+		     sizeof(e_bucket_size), (uint8_t *) &e_bucket_size);
+	msgb_tvlv_put(msg, BSSGP_IE_BUCKET_LEAK_RATE,
+		      sizeof(e_leak_rate), (uint8_t *) &e_leak_rate);
+	msgb_tvlv_put(msg, BSSGP_IE_BMAX_DEFAULT_MS,
+		      sizeof(e_bmax_default_ms),
+					(uint8_t *) &e_bmax_default_ms);
+	msgb_tvlv_put(msg, BSSGP_IE_R_DEFAULT_MS,
+		      sizeof(e_r_default_ms), (uint8_t *) &e_r_default_ms);
+	if (bucket_full_ratio)
+		msgb_tvlv_put(msg, BSSGP_IE_BUCKET_FULL_RATIO,
+			      1, bucket_full_ratio);
+	if (queue_delay_ms)
+		msgb_tvlv_put(msg, BSSGP_IE_BVC_MEASUREMENT,
+			      sizeof(e_queue_delay),
+			      (uint8_t *) &e_queue_delay);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief Transmit a FLOW_CONTROL-MS (Chapter 10.4.6)
+ *  \param[in] bctx BVC Context
+ *  \param[in] tlli TLLI to identify MS
+ *  \param[in] tag Additional tag to identify acknowledge
+ *  \param[in] ms_bucket_size Maximum bucket size in octets
+ *  \param[in] bucket_leak_rate Bucket leak rate in octets/sec
+ *  \param[in] bucket_full_ratio Ratio (in percent) of queue filling
+ */
+int bssgp_tx_fc_ms(struct bssgp_bvc_ctx *bctx, uint32_t tlli, uint8_t tag,
+		   uint32_t ms_bucket_size, uint32_t bucket_leak_rate,
+		   uint8_t *bucket_full_ratio)
+{
+	struct msgb *msg;
+	struct bssgp_normal_hdr *bgph;
+	uint16_t e_bucket_size, e_leak_rate;
+	uint32_t e_tlli;
+
+	if ((ms_bucket_size / 100) > 0xffff)
+		return -EINVAL;
+	e_bucket_size = ms_bucket_size / 100;
+
+	if ((bucket_leak_rate * 8 / 100) > 0xffff)
+		return -EINVAL;
+	e_leak_rate = (bucket_leak_rate * 8) / 100;
+
+	msg = bssgp_msgb_alloc();
+	bgph = (struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = bctx->bvci;
+	bgph->pdu_type = BSSGP_PDUT_FLOW_CONTROL_MS;
+
+	e_tlli = htonl(tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_TLLI, sizeof(e_tlli), (uint8_t *)&e_tlli);
+	msgb_tvlv_put(msg, BSSGP_IE_TAG, sizeof(tag), (uint8_t *)&tag);
+	msgb_tvlv_put(msg, BSSGP_IE_MS_BUCKET_SIZE,
+		      sizeof(e_bucket_size), (uint8_t *) &e_bucket_size);
+	msgb_tvlv_put(msg, BSSGP_IE_BUCKET_LEAK_RATE,
+		      sizeof(e_leak_rate), (uint8_t *) &e_leak_rate);
+	if (bucket_full_ratio)
+		msgb_tvlv_put(msg, BSSGP_IE_BUCKET_FULL_RATIO,
+			      1, bucket_full_ratio);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/*! \brief RL-UL-UNITDATA.req (Chapter 10.2.2)
+ *  \param[in] bctx BVC Context
+ *  \param[in] tlli TLLI to identify MS
+ *  \param[in] qos_profile Pointer to three octests of QoS profile
+ *  \param[in] llc_pdu msgb pointer containing UL Unitdata IE payload
+ */
+int bssgp_tx_ul_ud(struct bssgp_bvc_ctx *bctx, uint32_t tlli,
+		   const uint8_t *qos_profile, struct msgb *llc_pdu)
+{
+	struct msgb *msg = llc_pdu;
+	uint8_t bssgp_cid[8];
+	uint8_t bssgp_align[3] = {0, 0, 0};
+	struct bssgp_ud_hdr *budh;
+	int align = sizeof(*budh);
+
+	/* FIXME: Optional LSA Identifier List, PFI */
+
+	/* Cell Identifier */
+	bssgp_create_cell_id(bssgp_cid, &bctx->ra_id, bctx->cell_id);
+	align += 2; /* add T+L */
+	align += sizeof(bssgp_cid);
+
+	/* First push alignment IE */
+	align += 2; /* add T+L */
+	align = (4 - align) & 3; /* how many octest are required to align? */
+	msgb_tvlv_push(msg, BSSGP_IE_ALIGNMENT, align, bssgp_align);
+
+	/* Push other IEs */
+	msgb_tvlv_push(msg, BSSGP_IE_CELL_ID, sizeof(bssgp_cid), bssgp_cid);
+
+	/* User Data Header */
+	budh = (struct bssgp_ud_hdr *) msgb_push(msg, sizeof(*budh));
+	budh->tlli = htonl(tlli);
+	memcpy(budh->qos_profile, qos_profile, 3);
+	budh->pdu_type = BSSGP_PDUT_UL_UNITDATA;
+
+	/* set NSEI and BVCI in msgb cb */
+	msgb_nsei(msg) = bctx->nsei;
+	msgb_bvci(msg) = bctx->bvci;
+
+	rate_ctr_inc(&bctx->ctrg->ctr[BSSGP_CTR_PKTS_OUT]);
+	rate_ctr_add(&bctx->ctrg->ctr[BSSGP_CTR_BYTES_OUT], msg->len);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* Parse a single GMM-PAGING.req to a given NSEI/NS-BVCI */
+int bssgp_rx_paging(struct bssgp_paging_info *pinfo,
+		    struct msgb *msg)
+{
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_bssgph(msg);
+	struct tlv_parsed tp;
+	uint8_t ra[6];
+	int rc, data_len;
+
+	memset(ra, 0, sizeof(ra));
+
+	data_len = msgb_bssgp_len(msg) - sizeof(*bgph);
+	rc = bssgp_tlv_parse(&tp, bgph->data, data_len);
+	if (rc < 0)
+		goto err_mand_ie;
+
+	switch (bgph->pdu_type) {
+	case BSSGP_PDUT_PAGING_PS:
+		pinfo->mode = BSSGP_PAGING_PS;
+		break;
+	case BSSGP_PDUT_PAGING_CS:
+		pinfo->mode = BSSGP_PAGING_CS;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	/* IMSI */
+	if (!TLVP_PRESENT(&tp, BSSGP_IE_IMSI))
+		goto err_mand_ie;
+	if (!pinfo->imsi)
+		pinfo->imsi = talloc_zero_size(pinfo, 16);
+	gsm48_mi_to_string(pinfo->imsi, sizeof(pinfo->imsi),
+			   TLVP_VAL(&tp, BSSGP_IE_IMSI),
+			   TLVP_LEN(&tp, BSSGP_IE_IMSI));
+
+	/* DRX Parameters */
+	if (!TLVP_PRESENT(&tp, BSSGP_IE_DRX_PARAMS))
+		goto err_mand_ie;
+	pinfo->drx_params = ntohs(*(uint16_t *)TLVP_VAL(&tp, BSSGP_IE_DRX_PARAMS));
+
+	/* Scope */
+	if (TLVP_PRESENT(&tp, BSSGP_IE_BSS_AREA_ID)) {
+		pinfo->scope = BSSGP_PAGING_BSS_AREA;
+	} else if (TLVP_PRESENT(&tp, BSSGP_IE_LOCATION_AREA)) {
+		pinfo->scope = BSSGP_PAGING_LOCATION_AREA;
+		memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_LOCATION_AREA),
+			TLVP_LEN(&tp, BSSGP_IE_LOCATION_AREA));
+		gsm48_parse_ra(&pinfo->raid, ra);
+	} else if (TLVP_PRESENT(&tp, BSSGP_IE_ROUTEING_AREA)) {
+		pinfo->scope = BSSGP_PAGING_ROUTEING_AREA;
+		memcpy(ra, TLVP_VAL(&tp, BSSGP_IE_ROUTEING_AREA),
+			TLVP_LEN(&tp, BSSGP_IE_ROUTEING_AREA));
+		gsm48_parse_ra(&pinfo->raid, ra);
+	} else if (TLVP_PRESENT(&tp, BSSGP_IE_BVCI)) {
+		pinfo->scope = BSSGP_PAGING_BVCI;
+		pinfo->bvci = ntohs(*(uint16_t *)TLVP_VAL(&tp, BSSGP_IE_BVCI));
+	} else
+		return -EINVAL;
+
+	/* QoS profile mandatory for PS */
+	if (pinfo->mode == BSSGP_PAGING_PS) {
+		if (!TLVP_PRESENT(&tp, BSSGP_IE_QOS_PROFILE))
+			goto err_cond_ie;
+		if (TLVP_LEN(&tp, BSSGP_IE_QOS_PROFILE) < 3)
+			goto err;
+
+		memcpy(&pinfo->qos, TLVP_VAL(&tp, BSSGP_IE_QOS_PROFILE),
+			3);
+	}
+
+	/* Optional (P-)TMSI */
+	if (TLVP_PRESENT(&tp, BSSGP_IE_TMSI) &&
+	    TLVP_LEN(&tp, BSSGP_IE_TMSI) >= 4)
+		if (!pinfo->ptmsi)
+			pinfo->ptmsi = talloc_zero_size(pinfo, sizeof(uint32_t));
+		*(pinfo->ptmsi) = ntohl(*(uint32_t *)
+					TLVP_VAL(&tp, BSSGP_IE_TMSI));
+
+	return 0;
+
+err_mand_ie:
+err_cond_ie:
+err:
+	/* FIXME */
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/gb/gprs_bssgp_util.c b/src/shared/libosmocore/src/gb/gprs_bssgp_util.c
new file mode 100644
index 00000000..ae4647ef
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_bssgp_util.c
@@ -0,0 +1,117 @@
+/* GPRS BSSGP protocol implementation as per 3GPP TS 08.18 */
+
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <errno.h>
+#include <stdint.h>
+
+#include <netinet/in.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+#include <osmocom/gprs/gprs_ns.h>
+
+#include "common_vty.h"
+
+struct gprs_ns_inst *bssgp_nsi;
+
+/* BSSGP Protocol specific, not implementation specific */
+/* FIXME: This needs to go into libosmocore after finished */
+
+/* Chapter 11.3.9 / Table 11.10: Cause coding */
+static const struct value_string bssgp_cause_strings[] = {
+	{ BSSGP_CAUSE_PROC_OVERLOAD,	"Processor overload" },
+	{ BSSGP_CAUSE_EQUIP_FAIL,	"Equipment Failure" },
+	{ BSSGP_CAUSE_TRASIT_NET_FAIL,	"Transit netowkr service failure" },
+	{ BSSGP_CAUSE_CAPA_GREATER_0KPBS,"Transmission capacity modified" },
+	{ BSSGP_CAUSE_UNKNOWN_MS,	"Unknown MS" },
+	{ BSSGP_CAUSE_UNKNOWN_BVCI,	"Unknown BVCI" },
+	{ BSSGP_CAUSE_CELL_TRAF_CONG,	"Cell traffic congestion" },
+	{ BSSGP_CAUSE_SGSN_CONG,	"SGSN congestion" },
+	{ BSSGP_CAUSE_OML_INTERV,	"O&M intervention" },
+	{ BSSGP_CAUSE_BVCI_BLOCKED,	"BVCI blocked" },
+	{ BSSGP_CAUSE_PFC_CREATE_FAIL,	"PFC create failure" },
+	{ BSSGP_CAUSE_SEM_INCORR_PDU,	"Semantically incorrect PDU" },
+	{ BSSGP_CAUSE_INV_MAND_INF,	"Invalid mandatory information" },
+	{ BSSGP_CAUSE_MISSING_MAND_IE,	"Missing mandatory IE" },
+	{ BSSGP_CAUSE_MISSING_COND_IE,	"Missing conditional IE" },
+	{ BSSGP_CAUSE_UNEXP_COND_IE,	"Unexpected conditional IE" },
+	{ BSSGP_CAUSE_COND_IE_ERR,	"Conditional IE error" },
+	{ BSSGP_CAUSE_PDU_INCOMP_STATE,	"PDU incompatible with protocol state" },
+	{ BSSGP_CAUSE_PROTO_ERR_UNSPEC,	"Protocol error - unspecified" },
+	{ BSSGP_CAUSE_PDU_INCOMP_FEAT, 	"PDU not compatible with feature set" },
+	{ 0, NULL },
+};
+
+const char *bssgp_cause_str(enum gprs_bssgp_cause cause)
+{
+	return get_value_string(bssgp_cause_strings, cause);
+}
+
+
+struct msgb *bssgp_msgb_alloc(void)
+{
+	return msgb_alloc_headroom(4096, 128, "BSSGP");
+}
+
+/* Transmit a simple response such as BLOCK/UNBLOCK/RESET ACK/NACK */
+int bssgp_tx_simple_bvci(uint8_t pdu_type, uint16_t nsei,
+			 uint16_t bvci, uint16_t ns_bvci)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+	uint16_t _bvci;
+
+	msgb_nsei(msg) = nsei;
+	msgb_bvci(msg) = ns_bvci;
+
+	bgph->pdu_type = pdu_type;
+	_bvci = htons(bvci);
+	msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
+
+/* Chapter 10.4.14: Status */
+int bssgp_tx_status(uint8_t cause, uint16_t *bvci, struct msgb *orig_msg)
+{
+	struct msgb *msg = bssgp_msgb_alloc();
+	struct bssgp_normal_hdr *bgph =
+			(struct bssgp_normal_hdr *) msgb_put(msg, sizeof(*bgph));
+
+	LOGP(DBSSGP, LOGL_NOTICE, "BSSGP BVCI=%u Tx STATUS, cause=%s\n",
+		bvci ? *bvci : 0, bssgp_cause_str(cause));
+	msgb_nsei(msg) = msgb_nsei(orig_msg);
+	msgb_bvci(msg) = 0;
+
+	bgph->pdu_type = BSSGP_PDUT_STATUS;
+	msgb_tvlv_put(msg, BSSGP_IE_CAUSE, 1, &cause);
+	if (bvci) {
+		uint16_t _bvci = htons(*bvci);
+		msgb_tvlv_put(msg, BSSGP_IE_BVCI, 2, (uint8_t *) &_bvci);
+	}
+	msgb_tvlv_put(msg, BSSGP_IE_PDU_IN_ERROR,
+		      msgb_bssgp_len(orig_msg), msgb_bssgph(orig_msg));
+
+	return gprs_ns_sendmsg(bssgp_nsi, msg);
+}
diff --git a/src/shared/libosmocore/src/gb/gprs_bssgp_vty.c b/src/shared/libosmocore/src/gb/gprs_bssgp_vty.c
new file mode 100644
index 00000000..7017c504
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_bssgp_vty.c
@@ -0,0 +1,197 @@
+/* VTY interface for our GPRS BSS Gateway Protocol (BSSGP) implementation */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stdint.h>
+
+#include <arpa/inet.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/gprs/gprs_ns.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+
+#include <osmocom/vty/vty.h>
+#include <osmocom/vty/command.h>
+#include <osmocom/vty/logging.h>
+#include <osmocom/vty/telnet_interface.h>
+#include <osmocom/vty/misc.h>
+
+#include "common_vty.h"
+
+/* FIXME: this should go to some common file as it is copied
+ * in vty_interface.c of the BSC */
+static const struct value_string gprs_bssgp_timer_strs[] = {
+	{ 0, NULL }
+};
+
+static void log_set_bvc_filter(struct log_target *target,
+				struct bssgp_bvc_ctx *bctx)
+{
+	if (bctx) {
+		target->filter_map |= (1 << FLT_BVC);
+		target->filter_data[FLT_BVC] = bctx;
+	} else if (target->filter_data[FLT_NSVC]) {
+		target->filter_map = ~(1 << FLT_BVC);
+		target->filter_data[FLT_BVC] = NULL;
+	}
+}
+
+static struct cmd_node bssgp_node = {
+	L_BSSGP_NODE,
+	"%s(bssgp)#",
+	1,
+};
+
+static int config_write_bssgp(struct vty *vty)
+{
+	vty_out(vty, "bssgp%s", VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_bssgp, cfg_bssgp_cmd,
+      "bssgp",
+      "Configure the GPRS BSS Gateway Protocol")
+{
+	vty->node = L_BSSGP_NODE;
+	return CMD_SUCCESS;
+}
+
+static void dump_bvc(struct vty *vty, struct bssgp_bvc_ctx *bvc, int stats)
+{
+	vty_out(vty, "NSEI %5u, BVCI %5u, RA-ID: %u-%u-%u-%u, CID: %u, "
+		"STATE: %s%s", bvc->nsei, bvc->bvci, bvc->ra_id.mcc,
+		bvc->ra_id.mnc, bvc->ra_id.lac, bvc->ra_id.rac, bvc->cell_id,
+		bvc->state & BVC_S_BLOCKED ? "BLOCKED" : "UNBLOCKED",
+		VTY_NEWLINE);
+
+	if (stats) {
+		struct bssgp_flow_control *fc = bvc->fc;
+
+		vty_out_rate_ctr_group(vty, " ", bvc->ctrg);
+
+		if (fc)
+			vty_out(vty, "FC-BVC(bucket_max: %uoct, leak_rate: "
+				"%uoct/s, cur_tokens: %uoct, max_q_d: %u, "
+				"cur_q_d: %u)\n", fc->bucket_size_max,
+				fc->bucket_leak_rate, fc->bucket_counter,
+				fc->max_queue_depth, fc->queue_depth);
+	}
+}
+
+static void dump_bssgp(struct vty *vty, int stats)
+{
+	struct bssgp_bvc_ctx *bvc;
+
+	llist_for_each_entry(bvc, &bssgp_bvc_ctxts, list) {
+		dump_bvc(vty, bvc, stats);
+	}
+}
+
+#define BSSGP_STR "Show information about the BSSGP protocol\n"
+
+DEFUN(show_bssgp, show_bssgp_cmd, "show bssgp",
+	SHOW_STR BSSGP_STR)
+{
+	dump_bssgp(vty, 0);
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_bssgp_stats, show_bssgp_stats_cmd, "show bssgp stats",
+	SHOW_STR BSSGP_STR
+	"Include statistics\n")
+{
+	dump_bssgp(vty, 1);
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_bvc, show_bvc_cmd, "show bssgp nsei <0-65535> [stats]",
+	SHOW_STR BSSGP_STR
+	"Show all BVCs on one NSE\n"
+	"The NSEI\n" "Include Statistics\n")
+{
+	struct bssgp_bvc_ctx *bvc;
+	uint16_t nsei = atoi(argv[1]);
+	int show_stats = 0;
+
+	if (argc >= 2)
+		show_stats = 1;
+
+	llist_for_each_entry(bvc, &bssgp_bvc_ctxts, list) {
+		if (bvc->nsei != nsei)
+			continue;
+		dump_bvc(vty, bvc, show_stats);
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(logging_fltr_bvc,
+      logging_fltr_bvc_cmd,
+      "logging filter bvc nsei <0-65535> bvci <0-65535>",
+	LOGGING_STR FILTER_STR
+	"Filter based on BSSGP Virtual Connection\n"
+	"NSEI of the BVC to be filtered\n"
+	"Network Service Entity Identifier (NSEI)\n"
+	"BVCI of the BVC to be filtered\n"
+	"BSSGP Virtual Connection Identifier (BVCI)\n")
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+	struct bssgp_bvc_ctx *bvc;
+	uint16_t nsei = atoi(argv[0]);
+	uint16_t bvci = atoi(argv[1]);
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	bvc = btsctx_by_bvci_nsei(bvci, nsei);
+	if (!bvc) {
+		vty_out(vty, "No BVC by that identifier%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	log_set_bvc_filter(tgt, bvc);
+	return CMD_SUCCESS;
+}
+
+int bssgp_vty_init(void)
+{
+	install_element_ve(&show_bssgp_cmd);
+	install_element_ve(&show_bssgp_stats_cmd);
+	install_element_ve(&show_bvc_cmd);
+	install_element_ve(&logging_fltr_bvc_cmd);
+
+	install_element(CFG_LOG_NODE, &logging_fltr_bvc_cmd);
+
+	install_element(CONFIG_NODE, &cfg_bssgp_cmd);
+	install_node(&bssgp_node, config_write_bssgp);
+	install_element(L_BSSGP_NODE, &libgb_exit_cmd);
+	install_element(L_BSSGP_NODE, &libgb_end_cmd);
+	//install_element(L_BSSGP_NODE, &cfg_bssgp_timer_cmd);
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/gb/gprs_ns.c b/src/shared/libosmocore/src/gb/gprs_ns.c
new file mode 100644
index 00000000..cdcf36e1
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_ns.c
@@ -0,0 +1,1115 @@
+/* GPRS Networks Service (NS) messages on the Gb interface
+ * 3GPP TS 08.16 version 8.0.1 Release 1999 / ETSI TS 101 299 V8.0.1 (2002-05) */
+
+/* (C) 2009-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/*! \addtogroup libgb
+ *  @{
+ */
+
+/*! \file gprs_ns.c */
+
+/*!
+ * GPRS Networks Service (NS) messages on the Gb interface
+ * 3GPP TS 08.16 version 8.0.1 Release 1999 / ETSI TS 101 299 V8.0.1 (2002-05) 
+ *
+ * Some introduction into NS:  NS is used typically on top of frame relay,
+ * but in the ip.access world it is encapsulated in UDP packets.  It serves
+ * as an intermediate shim betwen BSSGP and the underlying medium.  It doesn't
+ * do much, apart from providing congestion notification and status indication.
+ *
+ * Terms:
+ * 	NS		Network Service
+ *	NSVC		NS Virtual Connection
+ *	NSEI		NS Entity Identifier
+ *	NSVL		NS Virtual Link
+ *	NSVLI		NS Virtual Link Identifier
+ *	BVC		BSSGP Virtual Connection
+ *	BVCI		BSSGP Virtual Connection Identifier
+ *	NSVCG		NS Virtual Connection Goup
+ *	Blocked		NS-VC cannot be used for user traffic
+ *	Alive		Ability of a NS-VC to provide communication
+ *
+ *  There can be multiple BSSGP virtual connections over one (group of) NSVC's.  BSSGP will
+ * therefore identify the BSSGP virtual connection by a BVCI passed down to NS.
+ * NS then has to firgure out which NSVC's are responsible for this BVCI.
+ * Those mappings are administratively configured.
+ */
+
+/* This implementation has the following limitations:
+ *  o Only one NS-VC for each NSE: No load-sharing function
+ *  o NSVCI 65535 and 65534 are reserved for internal use
+ *  o Only UDP is supported as of now, no frame relay support
+ *  o The IP Sub-Network-Service (SNS) as specified in 48.016 is not implemented
+ *  o There are no BLOCK and UNBLOCK timers (yet?)
+ */
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stdint.h>
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/gprs/gprs_ns.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+#include <osmocom/gprs/gprs_ns_frgre.h>
+
+#include "common_vty.h"
+
+static const struct tlv_definition ns_att_tlvdef = {
+	.def = {
+		[NS_IE_CAUSE]	= { TLV_TYPE_TvLV, 0 },
+		[NS_IE_VCI]	= { TLV_TYPE_TvLV, 0 },
+		[NS_IE_PDU]	= { TLV_TYPE_TvLV, 0 },
+		[NS_IE_BVCI]	= { TLV_TYPE_TvLV, 0 },
+		[NS_IE_NSEI]	= { TLV_TYPE_TvLV, 0 },
+	},
+};
+
+enum ns_ctr {
+	NS_CTR_PKTS_IN,
+	NS_CTR_PKTS_OUT,
+	NS_CTR_BYTES_IN,
+	NS_CTR_BYTES_OUT,
+	NS_CTR_BLOCKED,
+	NS_CTR_DEAD,
+};
+
+static const struct rate_ctr_desc nsvc_ctr_description[] = {
+	{ "packets.in", "Packets at NS Level ( In)" },
+	{ "packets.out","Packets at NS Level (Out)" },
+	{ "bytes.in",	"Bytes at NS Level   ( In)" },
+	{ "bytes.out",	"Bytes at NS Level   (Out)" },
+	{ "blocked",	"NS-VC Block count        " },
+	{ "dead",	"NS-VC gone dead count    " },
+};
+
+static const struct rate_ctr_group_desc nsvc_ctrg_desc = {
+	.group_name_prefix = "ns.nsvc",
+	.group_description = "NSVC Peer Statistics",
+	.num_ctr = ARRAY_SIZE(nsvc_ctr_description),
+	.ctr_desc = nsvc_ctr_description,
+};
+
+/*! \brief Lookup struct gprs_nsvc based on NSVCI
+ *  \param[in] nsi NS instance in which to search
+ *  \param[in] nsvci NSVCI to be searched
+ *  \returns gprs_nsvc of respective NSVCI
+ */
+struct gprs_nsvc *gprs_nsvc_by_nsvci(struct gprs_ns_inst *nsi, uint16_t nsvci)
+{
+	struct gprs_nsvc *nsvc;
+	llist_for_each_entry(nsvc, &nsi->gprs_nsvcs, list) {
+		if (nsvc->nsvci == nsvci)
+			return nsvc;
+	}
+	return NULL;
+}
+
+/*! \brief Lookup struct gprs_nsvc based on NSEI
+ *  \param[in] nsi NS instance in which to search
+ *  \param[in] nsei NSEI to be searched
+ *  \returns gprs_nsvc of respective NSEI
+ */
+struct gprs_nsvc *gprs_nsvc_by_nsei(struct gprs_ns_inst *nsi, uint16_t nsei)
+{
+	struct gprs_nsvc *nsvc;
+	llist_for_each_entry(nsvc, &nsi->gprs_nsvcs, list) {
+		if (nsvc->nsei == nsei)
+			return nsvc;
+	}
+	return NULL;
+}
+
+/* Lookup struct gprs_nsvc based on remote peer socket addr */
+static struct gprs_nsvc *nsvc_by_rem_addr(struct gprs_ns_inst *nsi,
+					  struct sockaddr_in *sin)
+{
+	struct gprs_nsvc *nsvc;
+	llist_for_each_entry(nsvc, &nsi->gprs_nsvcs, list) {
+		if (nsvc->ip.bts_addr.sin_addr.s_addr ==
+					sin->sin_addr.s_addr &&
+		    nsvc->ip.bts_addr.sin_port == sin->sin_port)
+			return nsvc;
+	}
+	return NULL;
+}
+
+static void gprs_ns_timer_cb(void *data);
+
+struct gprs_nsvc *gprs_nsvc_create(struct gprs_ns_inst *nsi, uint16_t nsvci)
+{
+	struct gprs_nsvc *nsvc;
+
+	LOGP(DNS, LOGL_INFO, "NSVCI=%u Creating NS-VC\n", nsvci);
+
+	nsvc = talloc_zero(nsi, struct gprs_nsvc);
+	nsvc->nsvci = nsvci;
+	/* before RESET procedure: BLOCKED and DEAD */
+	nsvc->state = NSE_S_BLOCKED;
+	nsvc->nsi = nsi;
+	nsvc->timer.cb = gprs_ns_timer_cb;
+	nsvc->timer.data = nsvc;
+	nsvc->ctrg = rate_ctr_group_alloc(nsvc, &nsvc_ctrg_desc, nsvci);
+
+	llist_add(&nsvc->list, &nsi->gprs_nsvcs);
+
+	return nsvc;
+}
+
+/*! \brief Delete given NS-VC
+ *  \param[in] nsvc gprs_nsvc to be deleted
+ */
+void gprs_nsvc_delete(struct gprs_nsvc *nsvc)
+{
+	if (osmo_timer_pending(&nsvc->timer))
+		osmo_timer_del(&nsvc->timer);
+	llist_del(&nsvc->list);
+	talloc_free(nsvc);
+}
+
+static void ns_osmo_signal_dispatch(struct gprs_nsvc *nsvc, unsigned int signal,
+			       uint8_t cause)
+{
+	struct ns_signal_data nssd;
+
+	nssd.nsvc = nsvc;
+	nssd.cause = cause;
+
+	osmo_signal_dispatch(SS_L_NS, signal, &nssd);
+}
+
+/* Section 10.3.2, Table 13 */
+static const struct value_string ns_cause_str[] = {
+	{ NS_CAUSE_TRANSIT_FAIL,	"Transit network failure" },
+	{ NS_CAUSE_OM_INTERVENTION, 	"O&M intervention" },
+	{ NS_CAUSE_EQUIP_FAIL,		"Equipment failure" },
+	{ NS_CAUSE_NSVC_BLOCKED,	"NS-VC blocked" },
+	{ NS_CAUSE_NSVC_UNKNOWN,	"NS-VC unknown" },
+	{ NS_CAUSE_BVCI_UNKNOWN,	"BVCI unknown" },
+	{ NS_CAUSE_SEM_INCORR_PDU,	"Semantically incorrect PDU" },
+	{ NS_CAUSE_PDU_INCOMP_PSTATE,	"PDU not compatible with protocol state" },
+	{ NS_CAUSE_PROTO_ERR_UNSPEC,	"Protocol error, unspecified" },
+	{ NS_CAUSE_INVAL_ESSENT_IE,	"Invalid essential IE" },
+	{ NS_CAUSE_MISSING_ESSENT_IE,	"Missing essential IE" },
+	{ 0, NULL }
+};
+
+/*! \brief Obtain a human-readable string for NS cause value */
+const char *gprs_ns_cause_str(enum ns_cause cause)
+{
+	return get_value_string(ns_cause_str, cause);
+}
+
+static int nsip_sendmsg(struct gprs_nsvc *nsvc, struct msgb *msg);
+extern int grps_ns_frgre_sendmsg(struct gprs_nsvc *nsvc, struct msgb *msg);
+
+static int gprs_ns_tx(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	int ret;
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	/* Increment number of Uplink bytes */
+	rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_PKTS_OUT]);
+	rate_ctr_add(&nsvc->ctrg->ctr[NS_CTR_BYTES_OUT], msgb_l2len(msg));
+
+	switch (nsvc->ll) {
+	case GPRS_NS_LL_UDP:
+		ret = nsip_sendmsg(nsvc, msg);
+		break;
+	case GPRS_NS_LL_FR_GRE:
+		ret = gprs_ns_frgre_sendmsg(nsvc, msg);
+		break;
+	default:
+		LOGP(DNS, LOGL_ERROR, "unsupported NS linklayer %u\n", nsvc->ll);
+		msgb_free(msg);
+		ret = -EIO;
+		break;
+	}
+	return ret;
+}
+
+static int gprs_ns_tx_simple(struct gprs_nsvc *nsvc, uint8_t pdu_type)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	struct gprs_ns_hdr *nsh;
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	if (!msg)
+		return -ENOMEM;
+
+	msg->l2h = msgb_put(msg, sizeof(*nsh));
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+
+	nsh->pdu_type = pdu_type;
+
+	return gprs_ns_tx(nsvc, msg);
+}
+
+/*! \brief Transmit a NS-RESET on a given NSVC
+ *  \param[in] nsvc NS-VC used for transmission
+ *  \paam[in] cause Numeric NS cause value
+ */
+int gprs_ns_tx_reset(struct gprs_nsvc *nsvc, uint8_t cause)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	struct gprs_ns_hdr *nsh;
+	uint16_t nsvci = htons(nsvc->nsvci);
+	uint16_t nsei = htons(nsvc->nsei);
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	if (!msg)
+		return -ENOMEM;
+
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Tx NS RESET (NSVCI=%u, cause=%s)\n",
+		nsvc->nsei, nsvc->nsvci, gprs_ns_cause_str(cause));
+
+	msg->l2h = msgb_put(msg, sizeof(*nsh));
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+	nsh->pdu_type = NS_PDUT_RESET;
+
+	msgb_tvlv_put(msg, NS_IE_CAUSE, 1, &cause);
+	msgb_tvlv_put(msg, NS_IE_VCI, 2, (uint8_t *) &nsvci);
+	msgb_tvlv_put(msg, NS_IE_NSEI, 2, (uint8_t *) &nsei);
+
+	return gprs_ns_tx(nsvc, msg);
+
+}
+
+/*! \brief Transmit a NS-STATUS on a given NSVC
+ *  \param[in] nsvc NS-VC to be used for transmission
+ *  \param[in] cause Numeric NS cause value
+ *  \param[in] bvci BVCI to be reset within NSVC
+ *  \param[in] orig_msg message causing the STATUS */
+int gprs_ns_tx_status(struct gprs_nsvc *nsvc, uint8_t cause,
+		      uint16_t bvci, struct msgb *orig_msg)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	struct gprs_ns_hdr *nsh;
+	uint16_t nsvci = htons(nsvc->nsvci);
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	bvci = htons(bvci);
+
+	if (!msg)
+		return -ENOMEM;
+
+	LOGP(DNS, LOGL_NOTICE, "NSEI=%u Tx NS STATUS (NSVCI=%u, cause=%s)\n",
+		nsvc->nsei, nsvc->nsvci, gprs_ns_cause_str(cause));
+
+	msg->l2h = msgb_put(msg, sizeof(*nsh));
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+	nsh->pdu_type = NS_PDUT_STATUS;
+
+	msgb_tvlv_put(msg, NS_IE_CAUSE, 1, &cause);
+
+	/* Section 9.2.7.1: Static conditions for NS-VCI */
+	if (cause == NS_CAUSE_NSVC_BLOCKED ||
+	    cause == NS_CAUSE_NSVC_UNKNOWN)
+		msgb_tvlv_put(msg, NS_IE_VCI, 2, (uint8_t *)&nsvci);
+
+	/* Section 9.2.7.2: Static conditions for NS PDU */
+	switch (cause) {
+	case NS_CAUSE_SEM_INCORR_PDU:
+	case NS_CAUSE_PDU_INCOMP_PSTATE:
+	case NS_CAUSE_PROTO_ERR_UNSPEC:
+	case NS_CAUSE_INVAL_ESSENT_IE:
+	case NS_CAUSE_MISSING_ESSENT_IE:
+		msgb_tvlv_put(msg, NS_IE_PDU, msgb_l2len(orig_msg),
+			      orig_msg->l2h);
+		break;
+	default:
+		break;
+	}
+
+	/* Section 9.2.7.3: Static conditions for BVCI */
+	if (cause == NS_CAUSE_BVCI_UNKNOWN)
+		msgb_tvlv_put(msg, NS_IE_VCI, 2, (uint8_t *)&bvci);
+
+	return gprs_ns_tx(nsvc, msg);
+}
+
+/*! \brief Transmit a NS-BLOCK on a tiven NS-VC
+ *  \param[in] nsvc NS-VC on which the NS-BLOCK is to be transmitted
+ *  \param[in] cause Numeric NS Cause value
+ *  \returns 0 in case of success
+ */
+int gprs_ns_tx_block(struct gprs_nsvc *nsvc, uint8_t cause)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	struct gprs_ns_hdr *nsh;
+	uint16_t nsvci = htons(nsvc->nsvci);
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	if (!msg)
+		return -ENOMEM;
+
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Tx NS BLOCK (NSVCI=%u, cause=%s)\n",
+		nsvc->nsei, nsvc->nsvci, gprs_ns_cause_str(cause));
+
+	/* be conservative and mark it as blocked even now! */
+	nsvc->state |= NSE_S_BLOCKED;
+	rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_BLOCKED]);
+
+	msg->l2h = msgb_put(msg, sizeof(*nsh));
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+	nsh->pdu_type = NS_PDUT_BLOCK;
+
+	msgb_tvlv_put(msg, NS_IE_CAUSE, 1, &cause);
+	msgb_tvlv_put(msg, NS_IE_VCI, 2, (uint8_t *) &nsvci);
+
+	return gprs_ns_tx(nsvc, msg);
+}
+
+/*! \brief Transmit a NS-UNBLOCK on a given NS-VC
+ *  \param[in] nsvc NS-VC on which the NS-UNBLOCK is to be transmitted
+ *  \returns 0 in case of success
+ */
+int gprs_ns_tx_unblock(struct gprs_nsvc *nsvc)
+{
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Tx NS UNBLOCK (NSVCI=%u)\n",
+		nsvc->nsei, nsvc->nsvci);
+
+	return gprs_ns_tx_simple(nsvc, NS_PDUT_UNBLOCK);
+}
+
+/*! \brief Transmit a NS-ALIVE on a given NS-VC
+ *  \param[in] nsvc NS-VC on which the NS-ALIVE is to be transmitted
+ *  \returns 0 in case of success
+ */
+int gprs_ns_tx_alive(struct gprs_nsvc *nsvc)
+{
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	LOGP(DNS, LOGL_DEBUG, "NSEI=%u Tx NS ALIVE (NSVCI=%u)\n",
+		nsvc->nsei, nsvc->nsvci);
+
+	return gprs_ns_tx_simple(nsvc, NS_PDUT_ALIVE);
+}
+
+/*! \brief Transmit a NS-ALIVE-ACK on a given NS-VC
+ *  \param[in] nsvc NS-VC on which the NS-ALIVE-ACK is to be transmitted
+ *  \returns 0 in case of success
+ */
+int gprs_ns_tx_alive_ack(struct gprs_nsvc *nsvc)
+{
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	LOGP(DNS, LOGL_DEBUG, "NSEI=%u Tx NS ALIVE_ACK (NSVCI=%u)\n",
+		nsvc->nsei, nsvc->nsvci);
+
+	return gprs_ns_tx_simple(nsvc, NS_PDUT_ALIVE_ACK);
+}
+
+static const enum ns_timeout timer_mode_tout[_NSVC_TIMER_NR] = {
+	[NSVC_TIMER_TNS_RESET]	= NS_TOUT_TNS_RESET,
+	[NSVC_TIMER_TNS_ALIVE]	= NS_TOUT_TNS_ALIVE,
+	[NSVC_TIMER_TNS_TEST]	= NS_TOUT_TNS_TEST,
+};
+
+static const struct value_string timer_mode_strs[] = {
+	{ NSVC_TIMER_TNS_RESET, "tns-reset" },
+	{ NSVC_TIMER_TNS_ALIVE, "tns-alive" },
+	{ NSVC_TIMER_TNS_TEST, "tns-test" },
+	{ 0, NULL }
+};
+
+static void nsvc_start_timer(struct gprs_nsvc *nsvc, enum nsvc_timer_mode mode)
+{
+	enum ns_timeout tout = timer_mode_tout[mode];
+	unsigned int seconds = nsvc->nsi->timeout[tout];
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	DEBUGP(DNS, "NSEI=%u Starting timer in mode %s (%u seconds)\n",
+		nsvc->nsei, get_value_string(timer_mode_strs, mode),
+		seconds);
+		
+	if (osmo_timer_pending(&nsvc->timer))
+		osmo_timer_del(&nsvc->timer);
+
+	nsvc->timer_mode = mode;
+	osmo_timer_schedule(&nsvc->timer, seconds, 0);
+}
+
+static void gprs_ns_timer_cb(void *data)
+{
+	struct gprs_nsvc *nsvc = data;
+	enum ns_timeout tout = timer_mode_tout[nsvc->timer_mode];
+	unsigned int seconds = nsvc->nsi->timeout[tout];
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	DEBUGP(DNS, "NSEI=%u Timer expired in mode %s (%u seconds)\n",
+		nsvc->nsei, get_value_string(timer_mode_strs, nsvc->timer_mode),
+		seconds);
+		
+	switch (nsvc->timer_mode) {
+	case NSVC_TIMER_TNS_ALIVE:
+		/* Tns-alive case: we expired without response ! */
+		nsvc->alive_retries++;
+		if (nsvc->alive_retries >
+			nsvc->nsi->timeout[NS_TOUT_TNS_ALIVE_RETRIES]) {
+			/* mark as dead and blocked */
+			nsvc->state = NSE_S_BLOCKED;
+			rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_BLOCKED]);
+			rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_DEAD]);
+			LOGP(DNS, LOGL_NOTICE,
+				"NSEI=%u Tns-alive expired more then "
+				"%u times, blocking NS-VC\n", nsvc->nsei,
+				nsvc->nsi->timeout[NS_TOUT_TNS_ALIVE_RETRIES]);
+			ns_osmo_signal_dispatch(nsvc, S_NS_ALIVE_EXP, 0);
+			ns_osmo_signal_dispatch(nsvc, S_NS_BLOCK, NS_CAUSE_NSVC_BLOCKED);
+			return;
+		}
+		/* Tns-test case: send NS-ALIVE PDU */
+		gprs_ns_tx_alive(nsvc);
+		/* start Tns-alive timer */
+		nsvc_start_timer(nsvc, NSVC_TIMER_TNS_ALIVE);
+		break;
+	case NSVC_TIMER_TNS_TEST:
+		/* Tns-test case: send NS-ALIVE PDU */
+		gprs_ns_tx_alive(nsvc);
+		/* start Tns-alive timer (transition into faster
+		 * alive retransmissions) */
+		nsvc->alive_retries = 0;
+		nsvc_start_timer(nsvc, NSVC_TIMER_TNS_ALIVE);
+		break;
+	case NSVC_TIMER_TNS_RESET:
+		/* Chapter 7.3: Re-send the RESET */
+		gprs_ns_tx_reset(nsvc, NS_CAUSE_OM_INTERVENTION);
+		/* Re-start Tns-reset timer */
+		nsvc_start_timer(nsvc, NSVC_TIMER_TNS_RESET);
+		break;
+	case _NSVC_TIMER_NR:
+		break;
+	}
+}
+
+/* Section 9.2.6 */
+static int gprs_ns_tx_reset_ack(struct gprs_nsvc *nsvc)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	struct gprs_ns_hdr *nsh;
+	uint16_t nsvci, nsei;
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+	if (!msg)
+		return -ENOMEM;
+
+	nsvci = htons(nsvc->nsvci);
+	nsei = htons(nsvc->nsei);
+
+	msg->l2h = msgb_put(msg, sizeof(*nsh));
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+
+	nsh->pdu_type = NS_PDUT_RESET_ACK;
+
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Tx NS RESET ACK (NSVCI=%u)\n",
+		nsvc->nsei, nsvc->nsvci);
+
+	msgb_tvlv_put(msg, NS_IE_VCI, 2, (uint8_t *)&nsvci);
+	msgb_tvlv_put(msg, NS_IE_NSEI, 2, (uint8_t *)&nsei);
+
+	return gprs_ns_tx(nsvc, msg);
+}
+
+/*! \brief High-level function for transmitting a NS-UNITDATA messsage
+ *  \param[in] nsi NS-instance on which we shall transmit
+ *  \param[in] msg struct msgb to be trasnmitted
+ *
+ * This function obtains the NS-VC by the msgb_nsei(msg) and then checks
+ * if the NS-VC is ALIVEV and not BLOCKED.  After that, it adds a NS
+ * header for the NS-UNITDATA message type and sends it off.
+ *
+ * Section 9.2.10: transmit side / NS-UNITDATA-REQUEST primitive 
+ */
+int gprs_ns_sendmsg(struct gprs_ns_inst *nsi, struct msgb *msg)
+{
+	struct gprs_nsvc *nsvc;
+	struct gprs_ns_hdr *nsh;
+	uint16_t bvci = msgb_bvci(msg);
+
+	nsvc = gprs_nsvc_by_nsei(nsi, msgb_nsei(msg));
+	if (!nsvc) {
+		LOGP(DNS, LOGL_ERROR, "Unable to resolve NSEI %u "
+			"to NS-VC!\n", msgb_nsei(msg));
+		msgb_free(msg);
+		return -EINVAL;
+	}
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	if (!(nsvc->state & NSE_S_ALIVE)) {
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u is not alive, cannot send\n",
+			nsvc->nsei);
+		msgb_free(msg);
+		return -EBUSY;
+	}
+	if (nsvc->state & NSE_S_BLOCKED) {
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u is blocked, cannot send\n",
+			nsvc->nsei);
+		msgb_free(msg);
+		return -EBUSY;
+	}
+
+	msg->l2h = msgb_push(msg, sizeof(*nsh) + 3);
+	nsh = (struct gprs_ns_hdr *) msg->l2h;
+	if (!nsh) {
+		LOGP(DNS, LOGL_ERROR, "Not enough headroom for NS header\n");
+		msgb_free(msg);
+		return -EIO;
+	}
+
+	nsh->pdu_type = NS_PDUT_UNITDATA;
+	/* spare octet in data[0] */
+	nsh->data[1] = bvci >> 8;
+	nsh->data[2] = bvci & 0xff;
+
+	return gprs_ns_tx(nsvc, msg);
+}
+
+/* Section 9.2.10: receive side */
+static int gprs_ns_rx_unitdata(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *)msg->l2h;
+	uint16_t bvci;
+
+	if (nsvc->state & NSE_S_BLOCKED)
+		return gprs_ns_tx_status(nsvc, NS_CAUSE_NSVC_BLOCKED,
+					 0, msg);
+
+	/* spare octet in data[0] */
+	bvci = nsh->data[1] << 8 | nsh->data[2];
+	msgb_bssgph(msg) = &nsh->data[3];
+	msgb_bvci(msg) = bvci;
+
+	/* call upper layer (BSSGP) */
+	return nsvc->nsi->cb(GPRS_NS_EVT_UNIT_DATA, nsvc, msg, bvci);
+}
+
+/* Section 9.2.7 */
+static int gprs_ns_rx_status(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
+	struct tlv_parsed tp;
+	uint8_t cause;
+	int rc;
+
+	LOGP(DNS, LOGL_NOTICE, "NSEI=%u Rx NS STATUS ", nsvc->nsei);
+
+	rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
+			msgb_l2len(msg) - sizeof(*nsh), 0, 0);
+	if (rc < 0) {
+		LOGPC(DNS, LOGL_NOTICE, "Error during TLV Parse\n");
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u Rx NS STATUS: "
+			"Error during TLV Parse\n", nsvc->nsei);
+		return rc;
+	}
+
+	if (!TLVP_PRESENT(&tp, NS_IE_CAUSE)) {
+		LOGPC(DNS, LOGL_INFO, "missing cause IE\n");
+		return -EINVAL;
+	}
+
+	cause = *TLVP_VAL(&tp, NS_IE_CAUSE);
+	LOGPC(DNS, LOGL_NOTICE, "cause=%s\n", gprs_ns_cause_str(cause));
+
+	return 0;
+}
+
+/* Section 7.3 */
+static int gprs_ns_rx_reset(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
+	struct tlv_parsed tp;
+	uint8_t *cause;
+	uint16_t *nsvci, *nsei;
+	int rc;
+
+	rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
+			msgb_l2len(msg) - sizeof(*nsh), 0, 0);
+	if (rc < 0) {
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u Rx NS RESET "
+			"Error during TLV Parse\n", nsvc->nsei);
+		return rc;
+	}
+
+	if (!TLVP_PRESENT(&tp, NS_IE_CAUSE) ||
+	    !TLVP_PRESENT(&tp, NS_IE_VCI) ||
+	    !TLVP_PRESENT(&tp, NS_IE_NSEI)) {
+		LOGP(DNS, LOGL_ERROR, "NS RESET Missing mandatory IE\n");
+		gprs_ns_tx_status(nsvc, NS_CAUSE_MISSING_ESSENT_IE, 0, msg);
+		return -EINVAL;
+	}
+
+	cause = (uint8_t *) TLVP_VAL(&tp, NS_IE_CAUSE);
+	nsvci = (uint16_t *) TLVP_VAL(&tp, NS_IE_VCI);
+	nsei = (uint16_t *) TLVP_VAL(&tp, NS_IE_NSEI);
+
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS RESET (NSVCI=%u, cause=%s)\n",
+		nsvc->nsvci, nsvc->nsei, gprs_ns_cause_str(*cause));
+
+	/* Mark NS-VC as blocked and alive */
+	nsvc->state = NSE_S_BLOCKED | NSE_S_ALIVE;
+
+	nsvc->nsei = ntohs(*nsei);
+	nsvc->nsvci = ntohs(*nsvci);
+
+	/* start the test procedure */
+	gprs_ns_tx_simple(nsvc, NS_PDUT_ALIVE);
+	nsvc_start_timer(nsvc, NSVC_TIMER_TNS_TEST);
+
+	/* inform interested parties about the fact that this NSVC
+	 * has received RESET */
+	ns_osmo_signal_dispatch(nsvc, S_NS_RESET, *cause);
+
+	return gprs_ns_tx_reset_ack(nsvc);
+}
+
+static int gprs_ns_rx_block(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
+	struct tlv_parsed tp;
+	uint8_t *cause;
+	int rc;
+
+	LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS BLOCK\n", nsvc->nsei);
+
+	nsvc->state |= NSE_S_BLOCKED;
+
+	rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
+			msgb_l2len(msg) - sizeof(*nsh), 0, 0);
+	if (rc < 0) {
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u Rx NS BLOCK "
+			"Error during TLV Parse\n", nsvc->nsei);
+		return rc;
+	}
+
+	if (!TLVP_PRESENT(&tp, NS_IE_CAUSE) ||
+	    !TLVP_PRESENT(&tp, NS_IE_VCI)) {
+		LOGP(DNS, LOGL_ERROR, "NS RESET Missing mandatory IE\n");
+		gprs_ns_tx_status(nsvc, NS_CAUSE_MISSING_ESSENT_IE, 0, msg);
+		return -EINVAL;
+	}
+
+	cause = (uint8_t *) TLVP_VAL(&tp, NS_IE_CAUSE);
+	//nsvci = (uint16_t *) TLVP_VAL(&tp, NS_IE_VCI);
+
+	ns_osmo_signal_dispatch(nsvc, S_NS_BLOCK, *cause);
+	rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_BLOCKED]);
+
+	return gprs_ns_tx_simple(nsvc, NS_PDUT_BLOCK_ACK);
+}
+
+/*! \brief Receive incoming NS message from underlying transport layer
+ *  \param nsi NS instance to which the data belongs
+ *  \param[in] msg message buffer containing newly-received data
+ *  \param[in] saddr socketaddr from which data was received
+ *  \param[in] ll link-layer type in which data was received
+ *  \returns 0 in case of success, < 0 in case of error
+ *
+ * This is the main entry point int othe NS imlementation where frames
+ * from the underlying transport (normally UDP) enter.
+ */
+int gprs_ns_rcvmsg(struct gprs_ns_inst *nsi, struct msgb *msg,
+		   struct sockaddr_in *saddr, enum gprs_ns_ll ll)
+{
+	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
+	struct gprs_nsvc *nsvc;
+	int rc = 0;
+
+	/* look up the NSVC based on source address */
+	nsvc = nsvc_by_rem_addr(nsi, saddr);
+	if (!nsvc) {
+		struct tlv_parsed tp;
+		uint16_t nsei;
+		if (nsh->pdu_type == NS_PDUT_STATUS) {
+			LOGP(DNS, LOGL_INFO, "Ignoring NS STATUS from %s:%u "
+			     "for non-existing NS-VC\n",
+			     inet_ntoa(saddr->sin_addr), ntohs(saddr->sin_port));
+			return 0;
+		}
+		/* Only the RESET procedure creates a new NSVC */
+		if (nsh->pdu_type != NS_PDUT_RESET) {
+			/* Since we have no NSVC, we have to use a fake */
+			nsvc = nsi->unknown_nsvc;
+			log_set_context(GPRS_CTX_NSVC, nsvc);
+			LOGP(DNS, LOGL_INFO, "Rejecting NS PDU type 0x%0x "
+				"from %s:%u for non-existing NS-VC\n",
+				nsh->pdu_type, inet_ntoa(saddr->sin_addr),
+				ntohs(saddr->sin_port));
+			nsvc->nsvci = nsvc->nsei = 0xfffe;
+			nsvc->ip.bts_addr = *saddr;
+			nsvc->state = NSE_S_ALIVE;
+			nsvc->ll = ll;
+#if 0
+			return gprs_ns_tx_reset(nsvc, NS_CAUSE_PDU_INCOMP_PSTATE);
+#else
+			return gprs_ns_tx_status(nsvc,
+						NS_CAUSE_PDU_INCOMP_PSTATE, 0,
+						msg);
+#endif
+		}
+		rc = tlv_parse(&tp, &ns_att_tlvdef, nsh->data,
+				msgb_l2len(msg) - sizeof(*nsh), 0, 0);
+		if (rc < 0) {
+			LOGP(DNS, LOGL_ERROR, "Rx NS RESET Error %d during "
+				"TLV Parse\n", rc);
+			return rc;
+		}
+		if (!TLVP_PRESENT(&tp, NS_IE_CAUSE) ||
+		    !TLVP_PRESENT(&tp, NS_IE_VCI) ||
+		    !TLVP_PRESENT(&tp, NS_IE_NSEI)) {
+			LOGP(DNS, LOGL_ERROR, "NS RESET Missing mandatory IE\n");
+			gprs_ns_tx_status(nsvc, NS_CAUSE_MISSING_ESSENT_IE, 0,
+					  msg);
+			return -EINVAL;
+		}
+		nsei = ntohs(*(uint16_t *)TLVP_VAL(&tp, NS_IE_NSEI));
+		/* Check if we already know this NSEI, the remote end might
+		 * simply have changed addresses, or it is a SGSN */
+		nsvc = gprs_nsvc_by_nsei(nsi, nsei);
+		if (!nsvc) {
+			nsvc = gprs_nsvc_create(nsi, 0xffff);
+			nsvc->ll = ll;
+			log_set_context(GPRS_CTX_NSVC, nsvc);
+			LOGP(DNS, LOGL_INFO, "Creating NS-VC for BSS at %s:%u\n",
+				inet_ntoa(saddr->sin_addr), ntohs(saddr->sin_port));
+		}
+		/* Update the remote peer IP address/port */
+		nsvc->ip.bts_addr = *saddr;
+	} else
+		msgb_nsei(msg) = nsvc->nsei;
+
+	log_set_context(GPRS_CTX_NSVC, nsvc);
+
+	/* Increment number of Incoming bytes */
+	rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_PKTS_IN]);
+	rate_ctr_add(&nsvc->ctrg->ctr[NS_CTR_BYTES_IN], msgb_l2len(msg));
+
+	switch (nsh->pdu_type) {
+	case NS_PDUT_ALIVE:
+		/* If we're dead and blocked and suddenly receive a
+		 * NS-ALIVE out of the blue, we might have been re-started
+		 * and should send a NS-RESET to make sure everything recovers
+		 * fine. */
+		if (nsvc->state == NSE_S_BLOCKED)
+			rc = gprs_ns_tx_reset(nsvc, NS_CAUSE_PDU_INCOMP_PSTATE);
+		else
+			rc = gprs_ns_tx_alive_ack(nsvc);
+		break;
+	case NS_PDUT_ALIVE_ACK:
+		/* stop Tns-alive and start Tns-test */
+		nsvc_start_timer(nsvc, NSVC_TIMER_TNS_TEST);
+		if (nsvc->remote_end_is_sgsn) {
+			/* FIXME: this should be one level higher */
+			if (nsvc->state & NSE_S_BLOCKED)
+				rc = gprs_ns_tx_unblock(nsvc);
+		}
+		break;
+	case NS_PDUT_UNITDATA:
+		/* actual user data */
+		rc = gprs_ns_rx_unitdata(nsvc, msg);
+		break;
+	case NS_PDUT_STATUS:
+		rc = gprs_ns_rx_status(nsvc, msg);
+		break;
+	case NS_PDUT_RESET:
+		rc = gprs_ns_rx_reset(nsvc, msg);
+		break;
+	case NS_PDUT_RESET_ACK:
+		LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS RESET ACK\n", nsvc->nsei);
+		/* mark NS-VC as blocked + active */
+		nsvc->state = NSE_S_BLOCKED | NSE_S_ALIVE;
+		nsvc->remote_state = NSE_S_BLOCKED | NSE_S_ALIVE;
+		rate_ctr_inc(&nsvc->ctrg->ctr[NS_CTR_BLOCKED]);
+		if (nsvc->persistent || nsvc->remote_end_is_sgsn) {
+			/* stop RESET timer */
+			osmo_timer_del(&nsvc->timer);
+		}
+		/* Initiate TEST proc.: Send ALIVE and start timer */
+		rc = gprs_ns_tx_simple(nsvc, NS_PDUT_ALIVE);
+		nsvc_start_timer(nsvc, NSVC_TIMER_TNS_TEST);
+		break;
+	case NS_PDUT_UNBLOCK:
+		/* Section 7.2: unblocking procedure */
+		LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS UNBLOCK\n", nsvc->nsei);
+		nsvc->state &= ~NSE_S_BLOCKED;
+		ns_osmo_signal_dispatch(nsvc, S_NS_UNBLOCK, 0);
+		rc = gprs_ns_tx_simple(nsvc, NS_PDUT_UNBLOCK_ACK);
+		break;
+	case NS_PDUT_UNBLOCK_ACK:
+		LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS UNBLOCK ACK\n", nsvc->nsei);
+		/* mark NS-VC as unblocked + active */
+		nsvc->state = NSE_S_ALIVE;
+		nsvc->remote_state = NSE_S_ALIVE;
+		ns_osmo_signal_dispatch(nsvc, S_NS_UNBLOCK, 0);
+		break;
+	case NS_PDUT_BLOCK:
+		rc = gprs_ns_rx_block(nsvc, msg);
+		break;
+	case NS_PDUT_BLOCK_ACK:
+		LOGP(DNS, LOGL_INFO, "NSEI=%u Rx NS BLOCK ACK\n", nsvc->nsei);
+		/* mark remote NS-VC as blocked + active */
+		nsvc->remote_state = NSE_S_BLOCKED | NSE_S_ALIVE;
+		break;
+	default:
+		LOGP(DNS, LOGL_NOTICE, "NSEI=%u Rx Unknown NS PDU type 0x%02x\n",
+			nsvc->nsei, nsh->pdu_type);
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+/*! \brief Create a new GPRS NS instance
+ *  \param[in] cb Call-back function for incoming BSSGP data
+ *  \returns dynamically allocated gprs_ns_inst
+ */
+struct gprs_ns_inst *gprs_ns_instantiate(gprs_ns_cb_t *cb, void *ctx)
+{
+	struct gprs_ns_inst *nsi = talloc_zero(ctx, struct gprs_ns_inst);
+
+	nsi->cb = cb;
+	INIT_LLIST_HEAD(&nsi->gprs_nsvcs);
+	nsi->timeout[NS_TOUT_TNS_BLOCK] = 3;
+	nsi->timeout[NS_TOUT_TNS_BLOCK_RETRIES] = 3;
+	nsi->timeout[NS_TOUT_TNS_RESET] = 3;
+	nsi->timeout[NS_TOUT_TNS_RESET_RETRIES] = 3;
+	nsi->timeout[NS_TOUT_TNS_TEST] = 30;
+	nsi->timeout[NS_TOUT_TNS_ALIVE] = 3;
+	nsi->timeout[NS_TOUT_TNS_ALIVE_RETRIES] = 10;
+
+	/* Create the dummy NSVC that we use for sending
+	 * messages to non-existant/unknown NS-VC's */
+	nsi->unknown_nsvc = gprs_nsvc_create(nsi, 0xfffe);
+	llist_del(&nsi->unknown_nsvc->list);
+
+	return nsi;
+}
+
+/*! \brief Destroy an entire NS instance
+ *  \param nsi gprs_ns_inst that is to be destroyed
+ *
+ *  This function releases all resources associated with the
+ *  NS-instance.
+ */
+void gprs_ns_destroy(struct gprs_ns_inst *nsi)
+{
+	struct gprs_nsvc *nsvc, *nsvc2;
+
+	/* delete all NSVCs and clear their timers */
+	llist_for_each_entry_safe(nsvc, nsvc2, &nsi->gprs_nsvcs, list)
+		gprs_nsvc_delete(nsvc);
+
+	/* close socket and unregister */
+	if (nsi->nsip.fd.data) {
+		close(nsi->nsip.fd.fd);
+		osmo_fd_unregister(&nsi->nsip.fd);
+	}
+
+	/* free the NSI */
+	talloc_free(nsi);
+}
+
+
+/* NS-over-IP code, according to 3GPP TS 48.016 Chapter 6.2
+ * We don't support Size Procedure, Configuration Procedure, ChangeWeight Procedure */
+
+/* Read a single NS-over-IP message */
+static struct msgb *read_nsip_msg(struct osmo_fd *bfd, int *error,
+				  struct sockaddr_in *saddr)
+{
+	struct msgb *msg = gprs_ns_msgb_alloc();
+	int ret = 0;
+	socklen_t saddr_len = sizeof(*saddr);
+
+	if (!msg) {
+		*error = -ENOMEM;
+		return NULL;
+	}
+
+	ret = recvfrom(bfd->fd, msg->data, NS_ALLOC_SIZE - NS_ALLOC_HEADROOM, 0,
+			(struct sockaddr *)saddr, &saddr_len);
+	if (ret < 0) {
+		LOGP(DNS, LOGL_ERROR, "recv error %s during NSIP recv\n",
+			strerror(errno));
+		msgb_free(msg);
+		*error = ret;
+		return NULL;
+	} else if (ret == 0) {
+		msgb_free(msg);
+		*error = ret;
+		return NULL;
+	}
+
+	msg->l2h = msg->data;
+	msgb_put(msg, ret);
+
+	return msg;
+}
+
+static int handle_nsip_read(struct osmo_fd *bfd)
+{
+	int error;
+	struct sockaddr_in saddr;
+	struct gprs_ns_inst *nsi = bfd->data;
+	struct msgb *msg = read_nsip_msg(bfd, &error, &saddr);
+
+	if (!msg)
+		return error;
+
+	error = gprs_ns_rcvmsg(nsi, msg, &saddr, GPRS_NS_LL_UDP);
+
+	msgb_free(msg);
+
+	return error;
+}
+
+static int handle_nsip_write(struct osmo_fd *bfd)
+{
+	/* FIXME: actually send the data here instead of nsip_sendmsg() */
+	return -EIO;
+}
+
+static int nsip_sendmsg(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	int rc;
+	struct gprs_ns_inst *nsi = nsvc->nsi;
+	struct sockaddr_in *daddr = &nsvc->ip.bts_addr;
+
+	rc = sendto(nsi->nsip.fd.fd, msg->data, msg->len, 0,
+		  (struct sockaddr *)daddr, sizeof(*daddr));
+
+	msgb_free(msg);
+
+	return rc;
+}
+
+/* UDP Port 23000 carries the LLC-in-BSSGP-in-NS protocol stack */
+static int nsip_fd_cb(struct osmo_fd *bfd, unsigned int what)
+{
+	int rc = 0;
+
+	if (what & BSC_FD_READ)
+		rc = handle_nsip_read(bfd);
+	if (what & BSC_FD_WRITE)
+		rc = handle_nsip_write(bfd);
+
+	return rc;
+}
+
+/*! \brief Create a listening socket for GPRS NS/UDP/IP
+ *  \param[in] nsi NS protocol instance to listen
+ *  \returns >=0 (fd) in case of success, negative in case of error
+ *
+ *  A call to this function will create a UDP socket bound to the port
+ *  number and IP address specified in the NS protocol instance. The
+ *  file descriptor of the socket will be stored in nsi->nsip.fd.
+ */
+int gprs_ns_nsip_listen(struct gprs_ns_inst *nsi)
+{
+	struct in_addr in;
+	int ret;
+
+	in.s_addr = htonl(nsi->nsip.local_ip);
+
+	nsi->nsip.fd.cb = nsip_fd_cb;
+	nsi->nsip.fd.data = nsi;
+	ret = osmo_sock_init_ofd(&nsi->nsip.fd, AF_INET, SOCK_DGRAM,
+				 IPPROTO_UDP, inet_ntoa(in),
+				 nsi->nsip.local_port, OSMO_SOCK_F_BIND);
+	if (ret < 0)
+		return ret;
+
+
+	return ret;
+}
+
+/*! \brief Initiate a RESET procedure
+ *  \param[in] nsvc NS-VC in which to start the procedure
+ *  \param[in] cause Numeric NS cause value
+ *
+ * This is a high-level function initiating a NS-RESET procedure. It
+ * will not only send a NS-RESET, but also set the state to BLOCKED and
+ * start the Tns-reset timer.
+ */
+void gprs_nsvc_reset(struct gprs_nsvc *nsvc, uint8_t cause)
+{
+	LOGP(DNS, LOGL_INFO, "NSEI=%u RESET procedure based on API request\n",
+		nsvc->nsei);
+
+	/* Mark NS-VC locally as blocked and dead */
+	nsvc->state = NSE_S_BLOCKED;
+	/* Send NS-RESET PDU */
+	if (gprs_ns_tx_reset(nsvc, cause) < 0) {
+		LOGP(DNS, LOGL_ERROR, "NSEI=%u, error resetting NS-VC\n",
+			nsvc->nsei);
+	}
+	/* Start Tns-reset */
+	nsvc_start_timer(nsvc, NSVC_TIMER_TNS_RESET);
+}
+
+/*! \brief Establish a NS connection (from the BSS) to the SGSN
+ *  \param nsi NS-instance
+ *  \param[in] dest Destination IP/Port
+ *  \param[in] nsei NSEI of the to-be-established NS-VC
+ *  \param[in] nsvci NSVCI of the to-be-established NS-VC
+ *  \returns struct gprs_nsvc representing the new NS-VC
+ *
+ * This function will establish a single NS/UDP/IP connection in uplink
+ * (BSS to SGSN) direction.
+ */
+struct gprs_nsvc *gprs_ns_nsip_connect(struct gprs_ns_inst *nsi,
+				struct sockaddr_in *dest, uint16_t nsei,
+				uint16_t nsvci)
+{
+	struct gprs_nsvc *nsvc;
+
+	nsvc = nsvc_by_rem_addr(nsi, dest);
+	if (!nsvc)
+		nsvc = gprs_nsvc_create(nsi, nsvci);
+	nsvc->ip.bts_addr = *dest;
+	nsvc->nsei = nsei;
+	nsvc->nsvci = nsvci;
+	nsvc->remote_end_is_sgsn = 1;
+
+	gprs_nsvc_reset(nsvc, NS_CAUSE_OM_INTERVENTION);
+	return nsvc;
+}
+
+void gprs_ns_set_log_ss(int ss)
+{
+	DNS = ss;
+}
+
+/*! }@ */
diff --git a/src/shared/libosmocore/src/gb/gprs_ns_frgre.c b/src/shared/libosmocore/src/gb/gprs_ns_frgre.c
new file mode 100644
index 00000000..e557c7e8
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_ns_frgre.c
@@ -0,0 +1,346 @@
+/* GPRS Networks Service (NS) messages on the Gb interface
+ * 3GPP TS 08.16 version 8.0.1 Release 1999 / ETSI TS 101 299 V8.0.1 (2002-05) */
+
+/* NS-over-FR-over-GRE implementation */
+
+/* (C) 2009-2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/select.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/gprs/gprs_ns.h>
+
+#include "common_vty.h"
+
+#define GRE_PTYPE_FR	0x6559
+#define GRE_PTYPE_IPv4	0x0800
+#define GRE_PTYPE_KAR	0x0000	/* keepalive response */
+
+struct gre_hdr {
+	uint16_t flags;
+	uint16_t ptype;
+} __attribute__ ((packed));
+
+#if defined(__FreeBSD__) || defined(__APPLE__)
+/**
+ * On BSD the IPv4 struct is called struct ip and instead of iXX
+ * the members are called ip_XX. One could change this code to use
+ * struct ip but that would require to define _BSD_SOURCE and that
+ * might have other complications. Instead make sure struct iphdr
+ * is present on FreeBSD. The below is taken from GLIBC.
+ *
+ * The GNU C Library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ */
+struct iphdr
+  {
+#if BYTE_ORDER == LITTLE_ENDIAN
+    unsigned int ihl:4;
+    unsigned int version:4;
+#elif BYTE_ORDER == BIG_ENDIAN
+    unsigned int version:4;
+    unsigned int ihl:4;
+#endif
+    u_int8_t tos;
+    u_int16_t tot_len;
+    u_int16_t id;
+    u_int16_t frag_off;
+    u_int8_t ttl;
+    u_int8_t protocol;
+    u_int16_t check;
+    u_int32_t saddr;
+    u_int32_t daddr;
+    /*The options start here. */
+  };
+#endif
+
+
+/* IPv4 messages inside the GRE tunnel might be GRE keepalives */
+static int handle_rx_gre_ipv4(struct osmo_fd *bfd, struct msgb *msg,
+				struct iphdr *iph, struct gre_hdr *greh)
+{
+	struct gprs_ns_inst *nsi = bfd->data;
+	int gre_payload_len;
+	struct iphdr *inner_iph;
+	struct gre_hdr *inner_greh;
+	struct sockaddr_in daddr;
+	struct in_addr ia;
+
+	gre_payload_len = msg->len - (iph->ihl*4 + sizeof(*greh));
+
+	inner_iph = (struct iphdr *) ((uint8_t *)greh + sizeof(*greh));
+
+	if (gre_payload_len < inner_iph->ihl*4 + sizeof(*inner_greh)) {
+		LOGP(DNS, LOGL_ERROR, "GRE keepalive too short\n");
+		return -EIO;
+	}
+
+	if (inner_iph->saddr != iph->daddr ||
+	    inner_iph->daddr != iph->saddr) {
+		LOGP(DNS, LOGL_ERROR,
+			"GRE keepalive with wrong tunnel addresses\n");
+		return -EIO;
+	}
+
+	if (inner_iph->protocol != IPPROTO_GRE) {
+		LOGP(DNS, LOGL_ERROR, "GRE keepalive with wrong protocol\n");
+		return -EIO;
+	}
+
+	inner_greh = (struct gre_hdr *) ((uint8_t *)inner_iph + iph->ihl*4);
+	if (inner_greh->ptype != htons(GRE_PTYPE_KAR)) {
+		LOGP(DNS, LOGL_ERROR, "GRE keepalive inner GRE type != 0\n");
+		return -EIO;
+	}
+
+	/* Actually send the response back */
+
+	daddr.sin_family = AF_INET;
+	daddr.sin_addr.s_addr = inner_iph->daddr;
+	daddr.sin_port = IPPROTO_GRE;
+
+	ia.s_addr = iph->saddr;
+	LOGP(DNS, LOGL_DEBUG, "GRE keepalive from %s, responding\n",
+		inet_ntoa(ia));
+
+	return sendto(nsi->frgre.fd.fd, inner_greh,
+		      gre_payload_len - inner_iph->ihl*4, 0,
+		      (struct sockaddr *)&daddr, sizeof(daddr));
+}
+
+static struct msgb *read_nsfrgre_msg(struct osmo_fd *bfd, int *error,
+					struct sockaddr_in *saddr)
+{
+	struct msgb *msg = msgb_alloc(NS_ALLOC_SIZE, "Gb/NS/FR/GRE Rx");
+	int ret = 0;
+	socklen_t saddr_len = sizeof(*saddr);
+	struct iphdr *iph;
+	struct gre_hdr *greh;
+	uint8_t *frh;
+	uint16_t dlci;
+
+	if (!msg) {
+		*error = -ENOMEM;
+		return NULL;
+	}
+
+	ret = recvfrom(bfd->fd, msg->data, NS_ALLOC_SIZE, 0,
+			(struct sockaddr *)saddr, &saddr_len);
+	if (ret < 0) {
+		LOGP(DNS, LOGL_ERROR, "recv error %s during NS-FR-GRE recv\n",
+			strerror(errno));
+		*error = ret;
+		goto out_err;
+	} else if (ret == 0) {
+		*error = ret;
+		goto out_err;
+	}
+
+	msgb_put(msg, ret);
+
+	if (msg->len < sizeof(*iph) + sizeof(*greh) + 2) {
+		LOGP(DNS, LOGL_ERROR, "Short IP packet: %u bytes\n", msg->len);
+		*error = -EIO;
+		goto out_err;
+	}
+
+	iph = (struct iphdr *) msg->data;
+	if (msg->len < (iph->ihl*4 + sizeof(*greh) + 2)) {
+		LOGP(DNS, LOGL_ERROR, "Short IP packet: %u bytes\n", msg->len);
+		*error = -EIO;
+		goto out_err;
+	}
+
+	greh = (struct gre_hdr *) (msg->data + iph->ihl*4);
+	if (greh->flags) {
+		LOGP(DNS, LOGL_NOTICE, "Unknown GRE flags 0x%04x\n",
+			ntohs(greh->flags));
+	}
+
+	switch (ntohs(greh->ptype)) {
+	case GRE_PTYPE_IPv4:
+		/* IPv4 messages might be GRE keepalives */
+		*error = handle_rx_gre_ipv4(bfd, msg, iph, greh);
+		goto out_err;
+		break;
+	case GRE_PTYPE_FR:
+		/* continue as usual */
+		break;
+	default:
+		LOGP(DNS, LOGL_NOTICE, "Unknown GRE protocol 0x%04x != FR\n",
+			ntohs(greh->ptype));
+		*error = -EIO;
+		goto out_err;
+		break;
+	}
+
+	if (msg->len < sizeof(*greh) + 2) {
+		LOGP(DNS, LOGL_ERROR, "Short FR header: %u bytes\n", msg->len);
+		*error = -EIO;
+		goto out_err;
+	}
+
+	frh = (uint8_t *)greh + sizeof(*greh);
+	if (frh[0] & 0x01) {
+		LOGP(DNS, LOGL_NOTICE, "Unsupported single-byte FR address\n");
+		*error = -EIO;
+		goto out_err;
+	}
+	dlci = ((frh[0] & 0xfc) << 2);
+	if ((frh[1] & 0x0f) != 0x01) {
+		LOGP(DNS, LOGL_NOTICE, "Unknown second FR octet 0x%02x\n",
+			frh[1]);
+		*error = -EIO;
+		goto out_err;
+	}
+	dlci |= (frh[1] >> 4);
+
+	msg->l2h = frh+2;
+
+	/* Store DLCI in NETWORK BYTEORDER in sockaddr port member */
+	saddr->sin_port = htons(dlci);
+
+	return msg;
+
+out_err:
+	msgb_free(msg);
+	return NULL;
+}
+
+int gprs_ns_rcvmsg(struct gprs_ns_inst *nsi, struct msgb *msg,
+		   struct sockaddr_in *saddr, enum gprs_ns_ll ll);
+
+static int handle_nsfrgre_read(struct osmo_fd *bfd)
+{
+	int rc;
+	struct sockaddr_in saddr;
+	struct gprs_ns_inst *nsi = bfd->data;
+	struct msgb *msg;
+	uint16_t dlci;
+
+	msg = read_nsfrgre_msg(bfd, &rc, &saddr);
+	if (!msg)
+		return rc;
+
+	dlci = ntohs(saddr.sin_port);
+	if (dlci == 0 || dlci == 1023) {
+		LOGP(DNS, LOGL_INFO, "Received FR on LMI DLCI %u - ignoring\n",
+			dlci);
+		rc = 0;
+		goto out;
+	}
+
+	rc = gprs_ns_rcvmsg(nsi, msg, &saddr, GPRS_NS_LL_FR_GRE);
+out:
+	msgb_free(msg);
+
+	return rc;
+}
+
+static int handle_nsfrgre_write(struct osmo_fd *bfd)
+{
+	/* FIXME: actually send the data here instead of nsip_sendmsg() */
+	return -EIO;
+}
+
+int gprs_ns_frgre_sendmsg(struct gprs_nsvc *nsvc, struct msgb *msg)
+{
+	int rc;
+	struct gprs_ns_inst *nsi = nsvc->nsi;
+	struct sockaddr_in daddr;
+	uint16_t dlci = ntohs(nsvc->frgre.bts_addr.sin_port);
+	uint8_t *frh;
+	struct gre_hdr *greh;
+
+	/* Build socket address for the packet destionation */
+	daddr.sin_family = AF_INET;
+	daddr.sin_addr = nsvc->frgre.bts_addr.sin_addr;
+	daddr.sin_port = IPPROTO_GRE;
+
+	/* Prepend the FR header */
+	frh = msgb_push(msg, 2);
+	frh[0] = (dlci >> 2) & 0xfc;
+	frh[1] = ((dlci & 0xf)<<4) | 0x01;
+
+	/* Prepend the GRE header */
+	greh = (struct gre_hdr *) msgb_push(msg, sizeof(*greh));
+	greh->flags = 0;
+	greh->ptype = htons(GRE_PTYPE_FR);
+
+	rc = sendto(nsi->frgre.fd.fd, msg->data, msg->len, 0,
+		  (struct sockaddr *)&daddr, sizeof(daddr));
+
+	msgb_free(msg);
+
+	return rc;
+}
+
+static int nsfrgre_fd_cb(struct osmo_fd *bfd, unsigned int what)
+{
+	int rc = 0;
+
+	if (what & BSC_FD_READ)
+		rc = handle_nsfrgre_read(bfd);
+	if (what & BSC_FD_WRITE)
+		rc = handle_nsfrgre_write(bfd);
+
+	return rc;
+}
+
+int gprs_ns_frgre_listen(struct gprs_ns_inst *nsi)
+{
+	struct in_addr in;
+	int rc;
+
+	in.s_addr = htonl(nsi->frgre.local_ip);
+
+	/* Make sure we close any existing socket before changing it */
+	if (nsi->frgre.fd.fd)
+		close(nsi->frgre.fd.fd);
+
+	if (!nsi->frgre.enabled)
+		return 0;
+
+	nsi->frgre.fd.cb = nsfrgre_fd_cb;
+	nsi->frgre.fd.data = nsi;
+	rc = osmo_sock_init_ofd(&nsi->frgre.fd, AF_INET, SOCK_RAW,
+				IPPROTO_GRE, inet_ntoa(in), 0,
+				OSMO_SOCK_F_BIND);
+	if (rc < 0) {
+		LOGP(DNS, LOGL_ERROR, "Error creating GRE socket (%s)\n",
+			strerror(errno));
+		return rc;
+	}
+	nsi->frgre.fd.data = nsi;
+
+	return rc;
+}
diff --git a/src/shared/libosmocore/src/gb/gprs_ns_vty.c b/src/shared/libosmocore/src/gb/gprs_ns_vty.c
new file mode 100644
index 00000000..b4436019
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/gprs_ns_vty.c
@@ -0,0 +1,580 @@
+/* VTY interface for our GPRS Networks Service (NS) implementation */
+
+/* (C) 2009-2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <stdint.h>
+
+#include <arpa/inet.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/gprs/gprs_ns.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+
+#include <osmocom/vty/vty.h>
+#include <osmocom/vty/command.h>
+#include <osmocom/vty/logging.h>
+#include <osmocom/vty/telnet_interface.h>
+#include <osmocom/vty/misc.h>
+
+#include "common_vty.h"
+
+static struct gprs_ns_inst *vty_nsi = NULL;
+
+/* FIXME: this should go to some common file as it is copied
+ * in vty_interface.c of the BSC */
+static const struct value_string gprs_ns_timer_strs[] = {
+	{ 0, "tns-block" },
+	{ 1, "tns-block-retries" },
+	{ 2, "tns-reset" },
+	{ 3, "tns-reset-retries" },
+	{ 4, "tns-test" },
+	{ 5, "tns-alive" },
+	{ 6, "tns-alive-retries" },
+	{ 0, NULL }
+};
+
+static void log_set_nsvc_filter(struct log_target *target,
+				struct gprs_nsvc *nsvc)
+{
+	if (nsvc) {
+		target->filter_map |= (1 << FLT_NSVC);
+		target->filter_data[FLT_NSVC] = nsvc;
+	} else if (target->filter_data[FLT_NSVC]) {
+		target->filter_map = ~(1 << FLT_NSVC);
+		target->filter_data[FLT_NSVC] = NULL;
+	}
+}
+
+static struct cmd_node ns_node = {
+	L_NS_NODE,
+	"%s(ns)#",
+	1,
+};
+
+static int config_write_ns(struct vty *vty)
+{
+	struct gprs_nsvc *nsvc;
+	unsigned int i;
+	struct in_addr ia;
+
+	vty_out(vty, "ns%s", VTY_NEWLINE);
+
+	llist_for_each_entry(nsvc, &vty_nsi->gprs_nsvcs, list) {
+		if (!nsvc->persistent)
+			continue;
+		vty_out(vty, " nse %u nsvci %u%s",
+			nsvc->nsei, nsvc->nsvci, VTY_NEWLINE);
+		vty_out(vty, " nse %u remote-role %s%s",
+			nsvc->nsei, nsvc->remote_end_is_sgsn ? "sgsn" : "bss",
+			VTY_NEWLINE);
+		switch (nsvc->ll) {
+		case GPRS_NS_LL_UDP:
+			vty_out(vty, " nse %u encapsulation udp%s", nsvc->nsei,
+				VTY_NEWLINE);
+			vty_out(vty, " nse %u remote-ip %s%s",
+				nsvc->nsei,
+				inet_ntoa(nsvc->ip.bts_addr.sin_addr),
+				VTY_NEWLINE);
+			vty_out(vty, " nse %u remote-port %u%s",
+				nsvc->nsei, ntohs(nsvc->ip.bts_addr.sin_port),
+				VTY_NEWLINE);
+			break;
+		case GPRS_NS_LL_FR_GRE:
+			vty_out(vty, " nse %u encapsulation framerelay-gre%s",
+				nsvc->nsei, VTY_NEWLINE);
+			vty_out(vty, " nse %u remote-ip %s%s",
+				nsvc->nsei,
+				inet_ntoa(nsvc->frgre.bts_addr.sin_addr),
+				VTY_NEWLINE);
+			vty_out(vty, " nse %u fr-dlci %u%s",
+				nsvc->nsei, ntohs(nsvc->frgre.bts_addr.sin_port),
+				VTY_NEWLINE);
+		default:
+			break;
+		}
+	}
+
+	for (i = 0; i < ARRAY_SIZE(vty_nsi->timeout); i++)
+		vty_out(vty, " timer %s %u%s",
+			get_value_string(gprs_ns_timer_strs, i),
+			vty_nsi->timeout[i], VTY_NEWLINE);
+
+	if (vty_nsi->nsip.local_ip) {
+		ia.s_addr = htonl(vty_nsi->nsip.local_ip);
+		vty_out(vty, " encapsulation udp local-ip %s%s",
+			inet_ntoa(ia), VTY_NEWLINE);
+	}
+	if (vty_nsi->nsip.local_port)
+		vty_out(vty, " encapsulation udp local-port %u%s",
+			vty_nsi->nsip.local_port, VTY_NEWLINE);
+
+	vty_out(vty, " encapsulation framerelay-gre enabled %u%s",
+		vty_nsi->frgre.enabled ? 1 : 0, VTY_NEWLINE);
+	if (vty_nsi->frgre.local_ip) {
+		ia.s_addr = htonl(vty_nsi->frgre.local_ip);
+		vty_out(vty, " encapsulation framerelay-gre local-ip %s%s",
+			inet_ntoa(ia), VTY_NEWLINE);
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ns, cfg_ns_cmd,
+      "ns",
+      "Configure the GPRS Network Service")
+{
+	vty->node = L_NS_NODE;
+	return CMD_SUCCESS;
+}
+
+static void dump_nse(struct vty *vty, struct gprs_nsvc *nsvc, int stats)
+{
+	vty_out(vty, "NSEI %5u, NS-VC %5u, Remote: %-4s, %5s %9s",
+		nsvc->nsei, nsvc->nsvci,
+		nsvc->remote_end_is_sgsn ? "SGSN" : "BSS",
+		nsvc->state & NSE_S_ALIVE ? "ALIVE" : "DEAD",
+		nsvc->state & NSE_S_BLOCKED ? "BLOCKED" : "UNBLOCKED");
+	if (nsvc->ll == GPRS_NS_LL_UDP || nsvc->ll == GPRS_NS_LL_FR_GRE)
+		vty_out(vty, ", %s %15s:%u",
+			nsvc->ll == GPRS_NS_LL_UDP ? "UDP   " : "FR-GRE",
+			inet_ntoa(nsvc->ip.bts_addr.sin_addr),
+			ntohs(nsvc->ip.bts_addr.sin_port));
+	vty_out(vty, "%s", VTY_NEWLINE);
+	if (stats)
+		vty_out_rate_ctr_group(vty, " ", nsvc->ctrg);
+}
+
+static void dump_ns(struct vty *vty, struct gprs_ns_inst *nsi, int stats)
+{
+	struct gprs_nsvc *nsvc;
+	struct in_addr ia;
+
+	ia.s_addr = htonl(vty_nsi->nsip.local_ip);
+	vty_out(vty, "Encapsulation NS-UDP-IP     Local IP: %s, UDP Port: %u%s",
+		inet_ntoa(ia), vty_nsi->nsip.local_port, VTY_NEWLINE);
+
+	ia.s_addr = htonl(vty_nsi->frgre.local_ip);
+	vty_out(vty, "Encapsulation NS-FR-GRE-IP  Local IP: %s%s",
+		inet_ntoa(ia), VTY_NEWLINE);
+
+	llist_for_each_entry(nsvc, &nsi->gprs_nsvcs, list) {
+		if (nsvc == nsi->unknown_nsvc)
+			continue;
+		dump_nse(vty, nsvc, stats);
+	}
+}
+
+DEFUN(show_ns, show_ns_cmd, "show ns",
+	SHOW_STR "Display information about the NS protocol")
+{
+	struct gprs_ns_inst *nsi = vty_nsi;
+	dump_ns(vty, nsi, 0);
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_ns_stats, show_ns_stats_cmd, "show ns stats",
+	SHOW_STR
+	"Display information about the NS protocol\n"
+	"Include statistics\n")
+{
+	struct gprs_ns_inst *nsi = vty_nsi;
+	dump_ns(vty, nsi, 1);
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_nse, show_nse_cmd, "show ns (nsei|nsvc) <0-65535> [stats]",
+	SHOW_STR "Display information about the NS protocol\n"
+	"Select one NSE by its NSE Identifier\n"
+	"Select one NSE by its NS-VC Identifier\n"
+	"The Identifier of selected type\n"
+	"Include Statistics\n")
+{
+	struct gprs_ns_inst *nsi = vty_nsi;
+	struct gprs_nsvc *nsvc;
+	uint16_t id = atoi(argv[1]);
+	int show_stats = 0;
+
+	if (!strcmp(argv[0], "nsei"))
+		nsvc = gprs_nsvc_by_nsei(nsi, id);
+	else
+		nsvc = gprs_nsvc_by_nsvci(nsi, id);
+
+	if (!nsvc) {
+		vty_out(vty, "No such NS Entity%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (argc >= 3)
+		show_stats = 1;
+
+	dump_nse(vty, nsvc, show_stats);
+	return CMD_SUCCESS;
+}
+
+#define NSE_CMD_STR "Persistent NS Entity\n" "NS Entity ID (NSEI)\n"
+
+DEFUN(cfg_nse_nsvc, cfg_nse_nsvci_cmd,
+	"nse <0-65535> nsvci <0-65534>",
+	NSE_CMD_STR
+	"NS Virtual Connection\n"
+	"NS Virtual Connection ID (NSVCI)\n"
+	)
+{
+	uint16_t nsei = atoi(argv[0]);
+	uint16_t nsvci = atoi(argv[1]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		nsvc = gprs_nsvc_create(vty_nsi, nsvci);
+		nsvc->nsei = nsei;
+	}
+	nsvc->nsvci = nsvci;
+	/* All NSVCs that are explicitly configured by VTY are
+	 * marked as persistent so we can write them to the config
+	 * file at some later point */
+	nsvc->persistent = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nse_remoteip, cfg_nse_remoteip_cmd,
+	"nse <0-65535> remote-ip A.B.C.D",
+	NSE_CMD_STR
+	"Remote IP Address\n"
+	"Remote IP Address\n")
+{
+	uint16_t nsei = atoi(argv[0]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	inet_aton(argv[1], &nsvc->ip.bts_addr.sin_addr);
+
+	return CMD_SUCCESS;
+
+}
+
+DEFUN(cfg_nse_remoteport, cfg_nse_remoteport_cmd,
+	"nse <0-65535> remote-port <0-65535>",
+	NSE_CMD_STR
+	"Remote UDP Port\n"
+	"Remote UDP Port Number\n")
+{
+	uint16_t nsei = atoi(argv[0]);
+	uint16_t port = atoi(argv[1]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (nsvc->ll != GPRS_NS_LL_UDP) {
+		vty_out(vty, "Cannot set UDP Port on non-UDP NSE%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	nsvc->ip.bts_addr.sin_port = htons(port);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nse_fr_dlci, cfg_nse_fr_dlci_cmd,
+	"nse <0-65535> fr-dlci <16-1007>",
+	NSE_CMD_STR
+	"Frame Relay DLCI\n"
+	"Frame Relay DLCI Number\n")
+{
+	uint16_t nsei = atoi(argv[0]);
+	uint16_t dlci = atoi(argv[1]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (nsvc->ll != GPRS_NS_LL_FR_GRE) {
+		vty_out(vty, "Cannot set FR DLCI on non-FR NSE%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	nsvc->frgre.bts_addr.sin_port = htons(dlci);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nse_encaps, cfg_nse_encaps_cmd,
+	"nse <0-65535> encapsulation (udp|framerelay-gre)",
+	NSE_CMD_STR
+	"Encapsulation for NS\n"
+	"UDP/IP Encapsulation\n" "Frame-Relay/GRE/IP Encapsulation\n")
+{
+	uint16_t nsei = atoi(argv[0]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (!strcmp(argv[1], "udp"))
+		nsvc->ll = GPRS_NS_LL_UDP;
+	else
+		nsvc->ll = GPRS_NS_LL_FR_GRE;
+
+	return CMD_SUCCESS;
+}
+
+
+DEFUN(cfg_nse_remoterole, cfg_nse_remoterole_cmd,
+	"nse <0-65535> remote-role (sgsn|bss)",
+	NSE_CMD_STR
+	"Remote NSE Role\n"
+	"Remote Peer is SGSN\n"
+	"Remote Peer is BSS\n")
+{
+	uint16_t nsei = atoi(argv[0]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (!strcmp(argv[1], "sgsn"))
+		nsvc->remote_end_is_sgsn = 1;
+	else
+		nsvc->remote_end_is_sgsn = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_nse, cfg_no_nse_cmd,
+	"no nse <0-65535>",
+	"Delete Persistent NS Entity\n"
+	"Delete " NSE_CMD_STR)
+{
+	uint16_t nsei = atoi(argv[0]);
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsei);
+	if (!nsvc) {
+		vty_out(vty, "No such NSE (%u)%s", nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (!nsvc->persistent) {
+		vty_out(vty, "NSEI %u is not a persistent NSE%s",
+			nsei, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	nsvc->persistent = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ns_timer, cfg_ns_timer_cmd,
+	"timer " NS_TIMERS " <0-65535>",
+	"Network Service Timer\n"
+	NS_TIMERS_HELP "Timer Value\n")
+{
+	int idx = get_string_value(gprs_ns_timer_strs, argv[0]);
+	int val = atoi(argv[1]);
+
+	if (idx < 0 || idx >= ARRAY_SIZE(vty_nsi->timeout))
+		return CMD_WARNING;
+
+	vty_nsi->timeout[idx] = val;
+
+	return CMD_SUCCESS;
+}
+
+#define ENCAPS_STR "NS encapsulation options\n"
+
+DEFUN(cfg_nsip_local_ip, cfg_nsip_local_ip_cmd,
+      "encapsulation udp local-ip A.B.C.D",
+	ENCAPS_STR "NS over UDP Encapsulation\n"
+	"Set the IP address on which we listen for NS/UDP\n"
+	"IP Address\n")
+{
+	struct in_addr ia;
+
+	inet_aton(argv[0], &ia);
+	vty_nsi->nsip.local_ip = ntohl(ia.s_addr);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nsip_local_port, cfg_nsip_local_port_cmd,
+      "encapsulation udp local-port <0-65535>",
+	ENCAPS_STR "NS over UDP Encapsulation\n"
+	"Set the UDP port on which we listen for NS/UDP\n"
+	"UDP port number\n")
+{
+	unsigned int port = atoi(argv[0]);
+
+	vty_nsi->nsip.local_port = port;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_frgre_local_ip, cfg_frgre_local_ip_cmd,
+      "encapsulation framerelay-gre local-ip A.B.C.D",
+	ENCAPS_STR "NS over Frame Relay over GRE Encapsulation\n"
+	"Set the IP address on which we listen for NS/FR/GRE\n"
+	"IP Address\n")
+{
+	struct in_addr ia;
+
+	if (!vty_nsi->frgre.enabled) {
+		vty_out(vty, "FR/GRE is not enabled%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	inet_aton(argv[0], &ia);
+	vty_nsi->frgre.local_ip = ntohl(ia.s_addr);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_frgre_enable, cfg_frgre_enable_cmd,
+      "encapsulation framerelay-gre enabled (1|0)",
+	ENCAPS_STR "NS over Frame Relay over GRE Encapsulation\n"
+	"Enable or disable Frame Relay over GRE\n"
+	"Enable\n" "Disable\n")
+{
+	int enabled = atoi(argv[0]);
+
+	vty_nsi->frgre.enabled = enabled;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(nsvc_nsei, nsvc_nsei_cmd,
+	"nsvc nsei <0-65535> (block|unblock|reset)",
+	"Perform an operation on a NSVC\n"
+	"NSEI to identify NS-VC Identifier (NS-VCI)\n"
+	"The NSEI\n"
+	"Initiate BLOCK procedure\n"
+	"Initiate UNBLOCK procedure\n"
+	"Initiate RESET procedure\n")
+{
+	uint16_t nsvci = atoi(argv[0]);
+	const char *operation = argv[1];
+	struct gprs_nsvc *nsvc;
+
+	nsvc = gprs_nsvc_by_nsei(vty_nsi, nsvci);
+	if (!nsvc) {
+		vty_out(vty, "No such NSVCI (%u)%s", nsvci, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (!strcmp(operation, "block"))
+		gprs_ns_tx_block(nsvc, NS_CAUSE_OM_INTERVENTION);
+	else if (!strcmp(operation, "unblock"))
+		gprs_ns_tx_unblock(nsvc);
+	else if (!strcmp(operation, "reset"))
+		gprs_nsvc_reset(nsvc, NS_CAUSE_OM_INTERVENTION);
+	else
+		return CMD_WARNING;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(logging_fltr_nsvc,
+      logging_fltr_nsvc_cmd,
+      "logging filter nsvc (nsei|nsvci) <0-65535>",
+	LOGGING_STR FILTER_STR
+	"Filter based on NS Virtual Connection\n"
+	"Identify NS-VC by NSEI\n"
+	"Identify NS-VC by NSVCI\n"
+	"Numeric identifier\n")
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+	struct gprs_nsvc *nsvc;
+	uint16_t id = atoi(argv[1]);
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	if (!strcmp(argv[0], "nsei"))
+		nsvc = gprs_nsvc_by_nsei(vty_nsi, id);
+	else
+		nsvc = gprs_nsvc_by_nsvci(vty_nsi, id);
+
+	if (!nsvc) {
+		vty_out(vty, "No NS-VC by that identifier%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	log_set_nsvc_filter(tgt, nsvc);
+	return CMD_SUCCESS;
+}
+
+int gprs_ns_vty_init(struct gprs_ns_inst *nsi)
+{
+	vty_nsi = nsi;
+
+	install_element_ve(&show_ns_cmd);
+	install_element_ve(&show_ns_stats_cmd);
+	install_element_ve(&show_nse_cmd);
+	install_element_ve(&logging_fltr_nsvc_cmd);
+
+	install_element(CFG_LOG_NODE, &logging_fltr_nsvc_cmd);
+
+	install_element(CONFIG_NODE, &cfg_ns_cmd);
+	install_node(&ns_node, config_write_ns);
+	install_element(L_NS_NODE, &libgb_exit_cmd);
+	install_element(L_NS_NODE, &libgb_end_cmd);
+	install_element(L_NS_NODE, &cfg_nse_nsvci_cmd);
+	install_element(L_NS_NODE, &cfg_nse_remoteip_cmd);
+	install_element(L_NS_NODE, &cfg_nse_remoteport_cmd);
+	install_element(L_NS_NODE, &cfg_nse_fr_dlci_cmd);
+	install_element(L_NS_NODE, &cfg_nse_encaps_cmd);
+	install_element(L_NS_NODE, &cfg_nse_remoterole_cmd);
+	install_element(L_NS_NODE, &cfg_no_nse_cmd);
+	install_element(L_NS_NODE, &cfg_ns_timer_cmd);
+	install_element(L_NS_NODE, &cfg_nsip_local_ip_cmd);
+	install_element(L_NS_NODE, &cfg_nsip_local_port_cmd);
+	install_element(L_NS_NODE, &cfg_frgre_enable_cmd);
+	install_element(L_NS_NODE, &cfg_frgre_local_ip_cmd);
+
+	install_element(ENABLE_NODE, &nsvc_nsei_cmd);
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/gb/libosmogb.map b/src/shared/libosmocore/src/gb/libosmogb.map
new file mode 100644
index 00000000..d65819b4
--- /dev/null
+++ b/src/shared/libosmocore/src/gb/libosmogb.map
@@ -0,0 +1,70 @@
+LIBOSMOGB_1.0 {
+global:
+bssgp_cause_str;
+bssgp_create_cell_id;
+bssgp_fc_in;
+bssgp_fc_init;
+bssgp_fc_ms_init;
+bssgp_msgb_alloc;
+bssgp_msgb_tlli_put;
+bssgp_parse_cell_id;
+bssgp_tx_bvc_block;
+bssgp_tx_bvc_reset;
+bssgp_tx_bvc_unblock;
+bssgp_tx_fc_bvc;
+bssgp_tx_fc_ms;
+bssgp_tx_flush_ll_ack;
+bssgp_tx_llc_discarded;
+bssgp_tx_ra_capa_upd;
+bssgp_tx_radio_status_imsi;
+bssgp_tx_radio_status_tlli;
+bssgp_tx_radio_status_tmsi;
+bssgp_tx_resume;
+bssgp_tx_resume_ack;
+bssgp_tx_resume_nack;
+bssgp_tx_simple_bvci;
+bssgp_tx_status;
+bssgp_tx_suspend;
+bssgp_tx_suspend_ack;
+bssgp_tx_suspend_nack;
+bssgp_tx_ul_ud;
+bssgp_rcvmsg;
+bssgp_rx_paging;
+bssgp_set_log_ss;
+bssgp_tx_dl_ud;
+bssgp_tx_paging;
+bssgp_vty_init;
+bssgp_nsi;
+
+gprs_ns_cause_str;
+gprs_ns_destroy;
+gprs_ns_frgre_listen;
+gprs_ns_frgre_sendmsg;
+gprs_ns_instantiate;
+gprs_ns_nsip_listen;
+gprs_ns_nsip_connect;
+gprs_ns_rcvmsg;
+gprs_ns_sendmsg;
+gprs_ns_set_log_ss;
+gprs_ns_tx_alive;
+gprs_ns_tx_alive_ack;
+gprs_ns_tx_block;
+gprs_ns_tx_reset;
+gprs_ns_tx_status;
+gprs_ns_tx_unblock;
+gprs_ns_vty_init;
+
+gprs_nsvc_create;
+gprs_nsvc_delete;
+gprs_nsvc_reset;
+gprs_nsvc_by_nsvci;
+gprs_nsvc_by_nsei;
+
+gprs_log_filter_fn;
+
+btsctx_alloc;
+btsctx_by_bvci_nsei;
+btsctx_by_raid_cid;
+
+local: *;
+};
diff --git a/src/shared/libosmocore/src/gsm/Makefile.am b/src/shared/libosmocore/src/gsm/Makefile.am
new file mode 100644
index 00000000..0544e0a1
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/Makefile.am
@@ -0,0 +1,27 @@
+# This is _NOT_ the library release version, it's an API version.
+# Please read Chapter 6 "Library interface versions" of the libtool documentation before making any modification
+LIBVERSION=3:0:0
+
+INCLUDES = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS = -Wall ${GCC_FVISIBILITY_HIDDEN}
+
+# FIXME: this should eventually go into a milenage/Makefile.am
+noinst_HEADERS = milenage/aes.h milenage/aes_i.h milenage/aes_wrap.h \
+		 milenage/common.h milenage/crypto.h milenage/includes.h \
+		 milenage/milenage.h
+
+lib_LTLIBRARIES = libosmogsm.la
+
+libosmogsm_la_SOURCES = a5.c rxlev_stat.c tlv_parser.c comp128.c gsm_utils.c \
+                        rsl.c gsm48.c gsm48_ie.c gsm0808.c sysinfo.c \
+			gprs_cipher_core.c gsm0480.c abis_nm.c gsm0502.c \
+			gsm0411_utils.c gsm0411_smc.c gsm0411_smr.c \
+			lapd_core.c lapdm.c \
+			auth_core.c auth_comp128v1.c auth_milenage.c \
+			milenage/aes-encblock.c milenage/aes-internal.c \
+			milenage/aes-internal-enc.c milenage/milenage.c gan.c
+
+libosmogsm_la_LDFLAGS = $(LTLDFLAGS_OSMOGSM) -version-info $(LIBVERSION)
+libosmogsm_la_LIBADD = $(top_builddir)/src/libosmocore.la
+
+EXTRA_DIST = libosmogsm.map
diff --git a/src/shared/libosmocore/src/gsm/a5.c b/src/shared/libosmocore/src/gsm/a5.c
new file mode 100644
index 00000000..356060ab
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/a5.c
@@ -0,0 +1,367 @@
+/*
+ * a5.c
+ *
+ * Full reimplementation of A5/1,2 (split and threadsafe)
+ *
+ * The logic behind the algorithm is taken from "A pedagogical implementation
+ * of the GSM A5/1 and A5/2 "voice privacy" encryption algorithms." by
+ * Marc Briceno, Ian Goldberg, and David Wagner.
+ *
+ * Copyright (C) 2011  Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/*! \addtogroup a5
+ *  @{
+ */
+
+/*! \file gsm/a5.c
+ *  \brief Osmocom GSM A5 ciphering algorithm implementation
+ */
+
+#include <string.h>
+
+#include <osmocom/gsm/a5.h>
+
+/*! \brief Main method to generate a A5/x cipher stream
+ *  \param[in] n Which A5/x method to use
+ *  \param[in] key 8 byte array for the key (as received from the SIM)
+ *  \param[in] fn Frame number
+ *  \param[out] dl Pointer to array of ubits to return Downlink cipher stream
+ *  \param[out] ul Pointer to array of ubits to return Uplink cipher stream
+ *
+ * Currently A5/[0-2] are supported.
+ * Either (or both) of dl/ul can be NULL if not needed.
+ */
+void
+osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul)
+{
+	switch (n)
+	{
+	case 0:
+		if (dl)
+			memset(dl, 0x00, 114);
+		if (ul)
+			memset(ul, 0x00, 114);
+		break;
+
+	case 1:
+		osmo_a5_1(key, fn, dl, ul);
+		break;
+
+	case 2:
+		osmo_a5_2(key, fn, dl, ul);
+		break;
+
+	default:
+		/* a5/[3..7] not supported here/yet */
+		break;
+	}
+}
+
+
+/* ------------------------------------------------------------------------ */
+/* A5/1&2 common stuff                                                                     */
+/* ------------------------------------------------------------------------ */
+
+#define A5_R1_LEN	19
+#define A5_R2_LEN	22
+#define A5_R3_LEN	23
+#define A5_R4_LEN	17	/* A5/2 only */
+
+#define A5_R1_MASK	((1<<A5_R1_LEN)-1)
+#define A5_R2_MASK	((1<<A5_R2_LEN)-1)
+#define A5_R3_MASK	((1<<A5_R3_LEN)-1)
+#define A5_R4_MASK	((1<<A5_R4_LEN)-1)
+
+#define A5_R1_TAPS	0x072000 /* x^19 + x^18 + x^17 + x^14 + 1 */
+#define A5_R2_TAPS	0x300000 /* x^22 + x^21 + 1 */
+#define A5_R3_TAPS	0x700080 /* x^23 + x^22 + x^21 + x^8 + 1 */
+#define A5_R4_TAPS	0x010800 /* x^17 + x^12 + 1 */
+
+/*! \brief Computes parity of a 32-bit word
+ *  \param[in] x 32 bit word
+ *  \return Parity bit (xor of all bits) as 0 or 1
+ */
+static inline uint32_t
+_a5_12_parity(uint32_t x)
+{
+	x ^= x >> 16;
+	x ^= x >> 8;
+	x ^= x >> 4;
+	x &= 0xf;
+	return (0x6996 >> x) & 1;
+}
+
+/*! \brief Compute majority bit from 3 taps
+ *  \param[in] v1 LFSR state ANDed with tap-bit
+ *  \param[in] v2 LFSR state ANDed with tap-bit
+ *  \param[in] v3 LFSR state ANDed with tap-bit
+ *  \return The majority bit (0 or 1)
+ */
+static inline uint32_t
+_a5_12_majority(uint32_t v1, uint32_t v2, uint32_t v3)
+{
+	return (!!v1 + !!v2 + !!v3) >= 2;
+}
+
+/*! \brief Compute the next LFSR state
+ *  \param[in] r Current state
+ *  \param[in] mask LFSR mask
+ *  \param[in] taps LFSR taps
+ *  \return Next state
+ */
+static inline uint32_t
+_a5_12_clock(uint32_t r, uint32_t mask, uint32_t taps)
+{
+	return ((r << 1) & mask) | _a5_12_parity(r & taps);
+}
+
+
+/* ------------------------------------------------------------------------ */
+/* A5/1                                                                     */
+/* ------------------------------------------------------------------------ */
+
+#define A51_R1_CLKBIT	0x000100
+#define A51_R2_CLKBIT	0x000400
+#define A51_R3_CLKBIT	0x000400
+
+/*! \brief GSM A5/1 Clocking function
+ *  \param[in] r Register state
+ *  \param[in] force Non-zero value disable conditional clocking
+ */
+static inline void
+_a5_1_clock(uint32_t r[], int force)
+{
+	int cb[3], maj;
+
+	cb[0] = !!(r[0] & A51_R1_CLKBIT);
+	cb[1] = !!(r[1] & A51_R2_CLKBIT);
+	cb[2] = !!(r[2] & A51_R3_CLKBIT);
+
+	maj = _a5_12_majority(cb[0], cb[1], cb[2]);
+
+	if (force || (maj == cb[0]))
+		r[0] = _a5_12_clock(r[0], A5_R1_MASK, A5_R1_TAPS);
+
+	if (force || (maj == cb[1]))
+		r[1] = _a5_12_clock(r[1], A5_R2_MASK, A5_R2_TAPS);
+
+	if (force || (maj == cb[2]))
+		r[2] = _a5_12_clock(r[2], A5_R3_MASK, A5_R3_TAPS);
+}
+
+/*! \brief GSM A5/1 Output function
+ *  \param[in] r Register state
+ *  \return The A5/1 output function bit
+ */
+static inline uint8_t
+_a5_1_get_output(uint32_t r[])
+{
+	return	(r[0] >> (A5_R1_LEN-1)) ^
+		(r[1] >> (A5_R2_LEN-1)) ^
+		(r[2] >> (A5_R3_LEN-1));
+}
+
+/*! \brief Generate a GSM A5/1 cipher stream
+ *  \param[in] key 8 byte array for the key (as received from the SIM)
+ *  \param[in] fn Frame number
+ *  \param[out] dl Pointer to array of ubits to return Downlink cipher stream
+ *  \param[out] ul Pointer to array of ubits to return Uplink cipher stream
+ *
+ * Either (or both) of dl/ul can be NULL if not needed.
+ */
+void
+osmo_a5_1(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul)
+{
+	uint32_t r[3] = {0, 0, 0};
+	uint32_t fn_count;
+	uint32_t b;
+	int i;
+
+	/* Key load */
+	for (i=0; i<64; i++)
+	{
+		b = ( key[7 - (i>>3)] >> (i&7) ) & 1;
+
+		_a5_1_clock(r, 1);
+
+		r[0] ^= b;
+		r[1] ^= b;
+		r[2] ^= b;
+	}
+
+	/* Frame count load */
+	fn_count = osmo_a5_fn_count(fn);
+
+	for (i=0; i<22; i++)
+	{
+		b = (fn_count >> i) & 1;
+
+		_a5_1_clock(r, 1);
+
+		r[0] ^= b;
+		r[1] ^= b;
+		r[2] ^= b;
+	}
+
+	/* Mix */
+	for (i=0; i<100; i++)
+	{
+		_a5_1_clock(r, 0);
+	}
+
+	/* Output */
+	for (i=0; i<114; i++) {
+		_a5_1_clock(r, 0);
+		if (dl)
+			dl[i] = _a5_1_get_output(r);
+	}
+
+	for (i=0; i<114; i++) {
+		_a5_1_clock(r, 0);
+		if (ul)
+			ul[i] = _a5_1_get_output(r);
+	}
+}
+
+
+/* ------------------------------------------------------------------------ */
+/* A5/2                                                                     */
+/* ------------------------------------------------------------------------ */
+
+#define A52_R4_CLKBIT0	0x000400
+#define A52_R4_CLKBIT1	0x000008
+#define A52_R4_CLKBIT2	0x000080
+
+/*! \brief GSM A5/2 Clocking function
+ *  \param[in] r Register state
+ *  \param[in] force Non-zero value disable conditional clocking
+ */
+static inline void
+_a5_2_clock(uint32_t r[], int force)
+{
+	int cb[3], maj;
+
+	cb[0] = !!(r[3] & A52_R4_CLKBIT0);
+	cb[1] = !!(r[3] & A52_R4_CLKBIT1);
+	cb[2] = !!(r[3] & A52_R4_CLKBIT2);
+
+	maj = (cb[0] + cb[1] + cb[2]) >= 2;
+
+	if (force || (maj == cb[0]))
+		r[0] = _a5_12_clock(r[0], A5_R1_MASK, A5_R1_TAPS);
+
+	if (force || (maj == cb[1]))
+		r[1] = _a5_12_clock(r[1], A5_R2_MASK, A5_R2_TAPS);
+
+	if (force || (maj == cb[2]))
+		r[2] = _a5_12_clock(r[2], A5_R3_MASK, A5_R3_TAPS);
+
+	r[3] = _a5_12_clock(r[3], A5_R4_MASK, A5_R4_TAPS);
+}
+
+/*! \brief GSM A5/2 Output function
+ *  \param[in] r Register state
+ *  \return The A5/2 output function bit
+ */
+static inline uint8_t
+_a5_2_get_output(uint32_t r[])
+{
+	uint8_t b;
+
+	b = (r[0] >> (A5_R1_LEN-1)) ^
+	    (r[1] >> (A5_R2_LEN-1)) ^
+	    (r[2] >> (A5_R3_LEN-1)) ^
+	    _a5_12_majority( r[0] & 0x08000, ~r[0] & 0x04000,  r[0] & 0x1000) ^
+	    _a5_12_majority(~r[1] & 0x10000,  r[1] & 0x02000,  r[1] & 0x0200) ^
+	    _a5_12_majority( r[2] & 0x40000,  r[2] & 0x10000, ~r[2] & 0x2000);
+
+	return b;
+}
+
+/*! \brief Generate a GSM A5/1 cipher stream
+ *  \param[in] key 8 byte array for the key (as received from the SIM)
+ *  \param[in] fn Frame number
+ *  \param[out] dl Pointer to array of ubits to return Downlink cipher stream
+ *  \param[out] ul Pointer to array of ubits to return Uplink cipher stream
+ *
+ * Either (or both) of dl/ul can be NULL if not needed.
+ */
+void
+osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul)
+{
+	uint32_t r[4] = {0, 0, 0, 0};
+	uint32_t fn_count;
+	uint32_t b;
+	int i;
+
+	/* Key load */
+	for (i=0; i<64; i++)
+	{
+		b = ( key[7 - (i>>3)] >> (i&7) ) & 1;
+
+		_a5_2_clock(r, 1);
+
+		r[0] ^= b;
+		r[1] ^= b;
+		r[2] ^= b;
+		r[3] ^= b;
+	}
+
+	/* Frame count load */
+	fn_count = osmo_a5_fn_count(fn);
+
+	for (i=0; i<22; i++)
+	{
+		b = (fn_count >> i) & 1;
+
+		_a5_2_clock(r, 1);
+
+		r[0] ^= b;
+		r[1] ^= b;
+		r[2] ^= b;
+		r[3] ^= b;
+	}
+
+	r[0] |= 1 << 15;
+	r[1] |= 1 << 16;
+	r[2] |= 1 << 18;
+	r[3] |= 1 << 10;
+
+	/* Mix */
+	for (i=0; i<99; i++)
+	{
+		_a5_2_clock(r, 0);
+	}
+
+	/* Output */
+	for (i=0; i<114; i++) {
+		_a5_2_clock(r, 0);
+		if (dl)
+			dl[i] = _a5_2_get_output(r);
+	}
+
+	for (i=0; i<114; i++) {
+		_a5_2_clock(r, 0);
+		if (ul)
+			ul[i] = _a5_2_get_output(r);
+	}
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsm/abis_nm.c b/src/shared/libosmocore/src/gsm/abis_nm.c
new file mode 100644
index 00000000..f6d4003e
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/abis_nm.c
@@ -0,0 +1,455 @@
+/* GSM Network Management (OML) messages on the A-bis interface
+ * 3GPP TS 12.21 version 8.0.0 Release 1999 / ETSI TS 100 623 V8.0.0 */
+
+/* (C) 2008-2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/*! \addtogroup oml
+ *  @{
+ */
+
+/*! \file abis_nm.c */
+
+#include <stdint.h>
+#include <errno.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_12_21.h>
+#include <osmocom/gsm/abis_nm.h>
+
+/*! \brief unidirectional messages from BTS to BSC */
+const enum abis_nm_msgtype abis_nm_reports[4] = {
+	NM_MT_SW_ACTIVATED_REP,
+	NM_MT_TEST_REP,
+	NM_MT_STATECHG_EVENT_REP,
+	NM_MT_FAILURE_EVENT_REP,
+};
+
+/*! \brief messages without ACK/NACK */
+const enum abis_nm_msgtype abis_nm_no_ack_nack[3] = {
+	NM_MT_MEAS_RES_REQ,
+	NM_MT_STOP_MEAS,
+	NM_MT_START_MEAS,
+};
+
+/*! \brief messages related to software load */
+const enum abis_nm_msgtype abis_nm_sw_load_msgs[9] = {
+	NM_MT_LOAD_INIT_ACK,
+	NM_MT_LOAD_INIT_NACK,
+	NM_MT_LOAD_SEG_ACK,
+	NM_MT_LOAD_ABORT,
+	NM_MT_LOAD_END_ACK,
+	NM_MT_LOAD_END_NACK,
+	//NM_MT_SW_ACT_REQ,
+	NM_MT_ACTIVATE_SW_ACK,
+	NM_MT_ACTIVATE_SW_NACK,
+	NM_MT_SW_ACTIVATED_REP,
+};
+
+/*! \brief All NACKs (negative acknowledgements */
+const enum abis_nm_msgtype abis_nm_nacks[33] = {
+	NM_MT_LOAD_INIT_NACK,
+	NM_MT_LOAD_END_NACK,
+	NM_MT_SW_ACT_REQ_NACK,
+	NM_MT_ACTIVATE_SW_NACK,
+	NM_MT_ESTABLISH_TEI_NACK,
+	NM_MT_CONN_TERR_SIGN_NACK,
+	NM_MT_DISC_TERR_SIGN_NACK,
+	NM_MT_CONN_TERR_TRAF_NACK,
+	NM_MT_DISC_TERR_TRAF_NACK,
+	NM_MT_CONN_MDROP_LINK_NACK,
+	NM_MT_DISC_MDROP_LINK_NACK,
+	NM_MT_SET_BTS_ATTR_NACK,
+	NM_MT_SET_RADIO_ATTR_NACK,
+	NM_MT_SET_CHAN_ATTR_NACK,
+	NM_MT_PERF_TEST_NACK,
+	NM_MT_SEND_TEST_REP_NACK,
+	NM_MT_STOP_TEST_NACK,
+	NM_MT_STOP_EVENT_REP_NACK,
+	NM_MT_REST_EVENT_REP_NACK,
+	NM_MT_CHG_ADM_STATE_NACK,
+	NM_MT_CHG_ADM_STATE_REQ_NACK,
+	NM_MT_REP_OUTST_ALARMS_NACK,
+	NM_MT_CHANGEOVER_NACK,
+	NM_MT_OPSTART_NACK,
+	NM_MT_REINIT_NACK,
+	NM_MT_SET_SITE_OUT_NACK,
+	NM_MT_CHG_HW_CONF_NACK,
+	NM_MT_GET_ATTR_NACK,
+	NM_MT_SET_ALARM_THRES_NACK,
+	NM_MT_BS11_BEGIN_DB_TX_NACK,
+	NM_MT_BS11_END_DB_TX_NACK,
+	NM_MT_BS11_CREATE_OBJ_NACK,
+	NM_MT_BS11_DELETE_OBJ_NACK,
+};
+
+static const struct value_string nack_names[] = {
+	{ NM_MT_LOAD_INIT_NACK,		"SOFTWARE LOAD INIT" },
+	{ NM_MT_LOAD_END_NACK,		"SOFTWARE LOAD END" },
+	{ NM_MT_SW_ACT_REQ_NACK,	"SOFTWARE ACTIVATE REQUEST" },
+	{ NM_MT_ACTIVATE_SW_NACK,	"ACTIVATE SOFTWARE" },
+	{ NM_MT_ESTABLISH_TEI_NACK,	"ESTABLISH TEI" },
+	{ NM_MT_CONN_TERR_SIGN_NACK,	"CONNECT TERRESTRIAL SIGNALLING" },
+	{ NM_MT_DISC_TERR_SIGN_NACK,	"DISCONNECT TERRESTRIAL SIGNALLING" },
+	{ NM_MT_CONN_TERR_TRAF_NACK,	"CONNECT TERRESTRIAL TRAFFIC" },
+	{ NM_MT_DISC_TERR_TRAF_NACK,	"DISCONNECT TERRESTRIAL TRAFFIC" },
+	{ NM_MT_CONN_MDROP_LINK_NACK,	"CONNECT MULTI-DROP LINK" },
+	{ NM_MT_DISC_MDROP_LINK_NACK,	"DISCONNECT MULTI-DROP LINK" },
+	{ NM_MT_SET_BTS_ATTR_NACK,	"SET BTS ATTRIBUTE" },
+	{ NM_MT_SET_RADIO_ATTR_NACK,	"SET RADIO ATTRIBUTE" },
+	{ NM_MT_SET_CHAN_ATTR_NACK,	"SET CHANNEL ATTRIBUTE" },
+	{ NM_MT_PERF_TEST_NACK,		"PERFORM TEST" },
+	{ NM_MT_SEND_TEST_REP_NACK,	"SEND TEST REPORT" },
+	{ NM_MT_STOP_TEST_NACK,		"STOP TEST" },
+	{ NM_MT_STOP_EVENT_REP_NACK,	"STOP EVENT REPORT" },
+	{ NM_MT_REST_EVENT_REP_NACK,	"RESET EVENT REPORT" },
+	{ NM_MT_CHG_ADM_STATE_NACK,	"CHANGE ADMINISTRATIVE STATE" },
+	{ NM_MT_CHG_ADM_STATE_REQ_NACK,
+				"CHANGE ADMINISTRATIVE STATE REQUEST" },
+	{ NM_MT_REP_OUTST_ALARMS_NACK,	"REPORT OUTSTANDING ALARMS" },
+	{ NM_MT_CHANGEOVER_NACK,	"CHANGEOVER" },
+	{ NM_MT_OPSTART_NACK,		"OPSTART" },
+	{ NM_MT_REINIT_NACK,		"REINIT" },
+	{ NM_MT_SET_SITE_OUT_NACK,	"SET SITE OUTPUT" },
+	{ NM_MT_CHG_HW_CONF_NACK,	"CHANGE HARDWARE CONFIGURATION" },
+	{ NM_MT_GET_ATTR_NACK,		"GET ATTRIBUTE" },
+	{ NM_MT_SET_ALARM_THRES_NACK,	"SET ALARM THRESHOLD" },
+	{ NM_MT_BS11_BEGIN_DB_TX_NACK,	"BS11 BEGIN DATABASE TRANSMISSION" },
+	{ NM_MT_BS11_END_DB_TX_NACK,	"BS11 END DATABASE TRANSMISSION" },
+	{ NM_MT_BS11_CREATE_OBJ_NACK,	"BS11 CREATE OBJECT" },
+	{ NM_MT_BS11_DELETE_OBJ_NACK,	"BS11 DELETE OBJECT" },
+	{ 0,				NULL }
+};
+
+/*! \brief Get human-readable string for OML NACK message type */
+const char *abis_nm_nack_name(uint8_t nack)
+{
+	return get_value_string(nack_names, nack);
+}
+
+/* Chapter 9.4.36 */
+static const struct value_string nack_cause_names[] = {
+	/* General Nack Causes */
+	{ NM_NACK_INCORR_STRUCT,	"Incorrect message structure" },
+	{ NM_NACK_MSGTYPE_INVAL,	"Invalid message type value" },
+	{ NM_NACK_OBJCLASS_INVAL,	"Invalid Object class value" },
+	{ NM_NACK_OBJCLASS_NOTSUPP,	"Object class not supported" },
+	{ NM_NACK_BTSNR_UNKN,		"BTS no. unknown" },
+	{ NM_NACK_TRXNR_UNKN,		"Baseband Transceiver no. unknown" },
+	{ NM_NACK_OBJINST_UNKN,		"Object Instance unknown" },
+	{ NM_NACK_ATTRID_INVAL,		"Invalid attribute identifier value" },
+	{ NM_NACK_ATTRID_NOTSUPP,	"Attribute identifier not supported" },
+	{ NM_NACK_PARAM_RANGE,		"Parameter value outside permitted range" },
+	{ NM_NACK_ATTRLIST_INCONSISTENT,"Inconsistency in attribute list" },
+	{ NM_NACK_SPEC_IMPL_NOTSUPP,	"Specified implementation not supported" },
+	{ NM_NACK_CANT_PERFORM,		"Message cannot be performed" },
+	/* Specific Nack Causes */
+	{ NM_NACK_RES_NOTIMPL,		"Resource not implemented" },
+	{ NM_NACK_RES_NOTAVAIL,		"Resource not available" },
+	{ NM_NACK_FREQ_NOTAVAIL,	"Frequency not available" },
+	{ NM_NACK_TEST_NOTSUPP,		"Test not supported" },
+	{ NM_NACK_CAPACITY_RESTR,	"Capacity restrictions" },
+	{ NM_NACK_PHYSCFG_NOTPERFORM,	"Physical configuration cannot be performed" },
+	{ NM_NACK_TEST_NOTINIT,		"Test not initiated" },
+	{ NM_NACK_PHYSCFG_NOTRESTORE,	"Physical configuration cannot be restored" },
+	{ NM_NACK_TEST_NOSUCH,		"No such test" },
+	{ NM_NACK_TEST_NOSTOP,		"Test cannot be stopped" },
+	{ NM_NACK_MSGINCONSIST_PHYSCFG,	"Message inconsistent with physical configuration" },
+	{ NM_NACK_FILE_INCOMPLETE,	"Complete file notreceived" },
+	{ NM_NACK_FILE_NOTAVAIL,	"File not available at destination" },
+	{ NM_NACK_FILE_NOTACTIVATE,	"File cannot be activate" },
+	{ NM_NACK_REQ_NOT_GRANT,	"Request not granted" },
+	{ NM_NACK_WAIT,			"Wait" },
+	{ NM_NACK_NOTH_REPORT_EXIST,	"Nothing reportable existing" },
+	{ NM_NACK_MEAS_NOTSUPP,		"Measurement not supported" },
+	{ NM_NACK_MEAS_NOTSTART,	"Measurement not started" },
+	{ 0,				NULL }
+};
+
+/*! \brief Get human-readable string for NACK cause */
+const char *abis_nm_nack_cause_name(uint8_t cause)
+{
+	return get_value_string(nack_cause_names, cause);
+}
+
+/* Chapter 9.4.16: Event Type */
+static const struct value_string event_type_names[] = {
+	{ NM_EVT_COMM_FAIL,		"communication failure" },
+	{ NM_EVT_QOS_FAIL,		"quality of service failure" },
+	{ NM_EVT_PROC_FAIL,		"processing failure" },
+	{ NM_EVT_EQUIP_FAIL,		"equipment failure" },
+	{ NM_EVT_ENV_FAIL,		"environment failure" },
+	{ 0,				NULL }
+};
+
+/*! \brief Get human-readable string for OML event type */
+const char *abis_nm_event_type_name(uint8_t cause)
+{
+	return get_value_string(event_type_names, cause);
+}
+
+/* Chapter 9.4.63: Perceived Severity */
+static const struct value_string severity_names[] = {
+	{ NM_SEVER_CEASED,		"failure ceased" },
+	{ NM_SEVER_CRITICAL,		"critical failure" },
+	{ NM_SEVER_MAJOR,		"major failure" },
+	{ NM_SEVER_MINOR,		"minor failure" },
+	{ NM_SEVER_WARNING,		"warning level failure" },
+	{ NM_SEVER_INDETERMINATE,	"indeterminate failure" },
+	{ 0,				NULL }
+};
+
+/*! \brief Get human-readable string for perceived OML severity */
+const char *abis_nm_severity_name(uint8_t cause)
+{
+	return get_value_string(severity_names, cause);
+}
+
+/*! \brief Attributes that the BSC can set, not only get, according to Section 9.4 */
+const enum abis_nm_attr abis_nm_att_settable[] = {
+	NM_ATT_ADD_INFO,
+	NM_ATT_ADD_TEXT,
+	NM_ATT_DEST,
+	NM_ATT_EVENT_TYPE,
+	NM_ATT_FILE_DATA,
+	NM_ATT_GET_ARI,
+	NM_ATT_HW_CONF_CHG,
+	NM_ATT_LIST_REQ_ATTR,
+	NM_ATT_MDROP_LINK,
+	NM_ATT_MDROP_NEXT,
+	NM_ATT_NACK_CAUSES,
+	NM_ATT_OUTST_ALARM,
+	NM_ATT_PHYS_CONF,
+	NM_ATT_PROB_CAUSE,
+	NM_ATT_RAD_SUBC,
+	NM_ATT_SOURCE,
+	NM_ATT_SPEC_PROB,
+	NM_ATT_START_TIME,
+	NM_ATT_TEST_DUR,
+	NM_ATT_TEST_NO,
+	NM_ATT_TEST_REPORT,
+	NM_ATT_WINDOW_SIZE,
+	NM_ATT_SEVERITY,
+	NM_ATT_MEAS_RES,
+	NM_ATT_MEAS_TYPE,
+};
+
+/*! \brief GSM A-bis OML TLV parser definition */
+const struct tlv_definition abis_nm_att_tlvdef = {
+	.def = {
+		[NM_ATT_ABIS_CHANNEL] =		{ TLV_TYPE_FIXED, 3 },
+		[NM_ATT_ADD_INFO] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_ADD_TEXT] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_ADM_STATE] =		{ TLV_TYPE_TV },
+		[NM_ATT_ARFCN_LIST]=		{ TLV_TYPE_TL16V },
+		[NM_ATT_AUTON_REPORT] =		{ TLV_TYPE_TV },
+		[NM_ATT_AVAIL_STATUS] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_BCCH_ARFCN] =		{ TLV_TYPE_FIXED, 2 },
+		[NM_ATT_BSIC] =			{ TLV_TYPE_TV },
+		[NM_ATT_BTS_AIR_TIMER] =	{ TLV_TYPE_TV },
+		[NM_ATT_CCCH_L_I_P] =		{ TLV_TYPE_TV },
+		[NM_ATT_CCCH_L_T] =		{ TLV_TYPE_TV },
+		[NM_ATT_CHAN_COMB] =		{ TLV_TYPE_TV },
+		[NM_ATT_CONN_FAIL_CRIT] =	{ TLV_TYPE_TL16V },
+		[NM_ATT_DEST] =			{ TLV_TYPE_TL16V },
+		[NM_ATT_EVENT_TYPE] =		{ TLV_TYPE_TV },
+		[NM_ATT_FILE_DATA] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_FILE_ID] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_FILE_VERSION] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_GSM_TIME] =		{ TLV_TYPE_FIXED, 2 },
+		[NM_ATT_HSN] =			{ TLV_TYPE_TV },
+		[NM_ATT_HW_CONFIG] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_HW_DESC] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_INTAVE_PARAM] =		{ TLV_TYPE_TV },
+		[NM_ATT_INTERF_BOUND] =		{ TLV_TYPE_FIXED, 6 },
+		[NM_ATT_LIST_REQ_ATTR] =	{ TLV_TYPE_TL16V },
+		[NM_ATT_MAIO] =			{ TLV_TYPE_TV },
+		[NM_ATT_MANUF_STATE] =		{ TLV_TYPE_TV },
+		[NM_ATT_MANUF_THRESH] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_MANUF_ID] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_MAX_TA] =		{ TLV_TYPE_TV },
+		[NM_ATT_MDROP_LINK] =		{ TLV_TYPE_FIXED, 2 },
+		[NM_ATT_MDROP_NEXT] =		{ TLV_TYPE_FIXED, 2 },
+		[NM_ATT_NACK_CAUSES] =		{ TLV_TYPE_TV },
+		[NM_ATT_NY1] =			{ TLV_TYPE_TV },
+		[NM_ATT_OPER_STATE] =		{ TLV_TYPE_TV },
+		[NM_ATT_OVERL_PERIOD] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_PHYS_CONF] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_POWER_CLASS] =		{ TLV_TYPE_TV },
+		[NM_ATT_POWER_THRESH] =		{ TLV_TYPE_FIXED, 3 },
+		[NM_ATT_PROB_CAUSE] =		{ TLV_TYPE_FIXED, 3 },
+		[NM_ATT_RACH_B_THRESH] =	{ TLV_TYPE_TV },
+		[NM_ATT_LDAVG_SLOTS] =		{ TLV_TYPE_FIXED, 2 },
+		[NM_ATT_RAD_SUBC] =		{ TLV_TYPE_TV },
+		[NM_ATT_RF_MAXPOWR_R] =		{ TLV_TYPE_TV },
+		[NM_ATT_SITE_INPUTS] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_SITE_OUTPUTS] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_SOURCE] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_SPEC_PROB] =		{ TLV_TYPE_TV },
+		[NM_ATT_START_TIME] =		{ TLV_TYPE_FIXED, 2 },
+		[NM_ATT_T200] =			{ TLV_TYPE_FIXED, 7 },
+		[NM_ATT_TEI] =			{ TLV_TYPE_TV },
+		[NM_ATT_TEST_DUR] =		{ TLV_TYPE_FIXED, 2 },
+		[NM_ATT_TEST_NO] =		{ TLV_TYPE_TV },
+		[NM_ATT_TEST_REPORT] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_VSWR_THRESH] =		{ TLV_TYPE_FIXED, 2 },
+		[NM_ATT_WINDOW_SIZE] = 		{ TLV_TYPE_TV },
+		[NM_ATT_TSC] =			{ TLV_TYPE_TV },
+		[NM_ATT_SW_CONFIG] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_SEVERITY] = 		{ TLV_TYPE_TV },
+		[NM_ATT_GET_ARI] =		{ TLV_TYPE_TL16V },
+		[NM_ATT_HW_CONF_CHG] = 		{ TLV_TYPE_TL16V },
+		[NM_ATT_OUTST_ALARM] =		{ TLV_TYPE_TV },
+		[NM_ATT_MEAS_RES] =		{ TLV_TYPE_TL16V },
+	},
+};
+
+/*! \brief Human-readable strings for A-bis OML Object Class */
+const struct value_string abis_nm_obj_class_names[] = {
+	{ NM_OC_SITE_MANAGER,	"SITE-MANAGER" },
+	{ NM_OC_BTS,		"BTS" },
+	{ NM_OC_RADIO_CARRIER,	"RADIO-CARRIER" },
+	{ NM_OC_BASEB_TRANSC,	"BASEBAND-TRANSCEIVER" },
+	{ NM_OC_CHANNEL,	"CHANNEL" },
+	{ NM_OC_BS11_ADJC,	"ADJC" },
+	{ NM_OC_BS11_HANDOVER,	"HANDOVER" },
+	{ NM_OC_BS11_PWR_CTRL,	"POWER-CONTROL" },
+	{ NM_OC_BS11_BTSE,	"BTSE" },
+	{ NM_OC_BS11_RACK,	"RACK" },
+	{ NM_OC_BS11_TEST,	"TEST" },
+	{ NM_OC_BS11_ENVABTSE,	"ENVABTSE" },
+	{ NM_OC_BS11_BPORT,	"BPORT" },
+	{ NM_OC_GPRS_NSE,	"GPRS-NSE" },
+	{ NM_OC_GPRS_CELL,	"GPRS-CELL" },
+	{ NM_OC_GPRS_NSVC,	"GPRS-NSVC" },
+	{ NM_OC_BS11,		"SIEMENSHW" },
+	{ 0,			NULL }
+};
+
+/*! \brief Get human-readable string for OML Operational State */
+const char *abis_nm_opstate_name(uint8_t os)
+{
+	switch (os) {
+	case NM_OPSTATE_DISABLED:
+		return "Disabled";
+	case NM_OPSTATE_ENABLED:
+		return "Enabled";
+	case NM_OPSTATE_NULL:
+		return "NULL";
+	default:
+		return "RFU";
+	}
+}
+
+/* Chapter 9.4.7 */
+static const struct value_string avail_names[] = {
+	{ 0, 	"In test" },
+	{ 1,	"Failed" },
+	{ 2,	"Power off" },
+	{ 3,	"Off line" },
+	/* Not used */
+	{ 5,	"Dependency" },
+	{ 6,	"Degraded" },
+	{ 7,	"Not installed" },
+	{ 0xff, "OK" },
+	{ 0,	NULL }
+};
+
+/*! \brief Get human-readable string for OML Availability State */
+const char *abis_nm_avail_name(uint8_t avail)
+{
+	return get_value_string(avail_names, avail);
+}
+
+static struct value_string test_names[] = {
+	/* FIXME: standard test names */
+	{ NM_IPACC_TESTNO_CHAN_USAGE, "Channel Usage" },
+	{ NM_IPACC_TESTNO_BCCH_CHAN_USAGE, "BCCH Channel Usage" },
+	{ NM_IPACC_TESTNO_FREQ_SYNC, "Frequency Synchronization" },
+	{ NM_IPACC_TESTNO_BCCH_INFO, "BCCH Info" },
+	{ NM_IPACC_TESTNO_TX_BEACON, "Transmit Beacon" },
+	{ NM_IPACC_TESTNO_SYSINFO_MONITOR, "System Info Monitor" },
+	{ NM_IPACC_TESTNO_BCCCH_MONITOR, "BCCH Monitor" },
+	{ 0, NULL }
+};
+
+/*! \brief Get human-readable string for OML test */
+const char *abis_nm_test_name(uint8_t test)
+{
+	return get_value_string(test_names, test);
+}
+
+/*! \brief Human-readable names for OML administrative state */
+const struct value_string abis_nm_adm_state_names[] = {
+	{ NM_STATE_LOCKED,	"Locked" },
+	{ NM_STATE_UNLOCKED,	"Unlocked" },
+	{ NM_STATE_SHUTDOWN,	"Shutdown" },
+	{ NM_STATE_NULL,	"NULL" },
+	{ 0, NULL }
+};
+
+/*! \brief write a human-readable OML header to the debug log
+ *  \param[in] ss Logging sub-system
+ *  \param[in] foh A-bis OML FOM header
+ */
+void abis_nm_debugp_foh(int ss, struct abis_om_fom_hdr *foh)
+{
+	DEBUGP(ss, "OC=%s(%02x) INST=(%02x,%02x,%02x) ",
+		get_value_string(abis_nm_obj_class_names, foh->obj_class),
+		foh->obj_class, foh->obj_inst.bts_nr, foh->obj_inst.trx_nr,
+		foh->obj_inst.ts_nr);
+}
+
+static const enum abis_nm_chan_comb chcomb4pchan[] = {
+	[GSM_PCHAN_NONE]	= 0xff,
+	[GSM_PCHAN_CCCH]	= NM_CHANC_mainBCCH,
+	[GSM_PCHAN_CCCH_SDCCH4]	= NM_CHANC_BCCHComb,
+	[GSM_PCHAN_TCH_F]	= NM_CHANC_TCHFull,
+	[GSM_PCHAN_TCH_H]	= NM_CHANC_TCHHalf,
+	[GSM_PCHAN_SDCCH8_SACCH8C] = NM_CHANC_SDCCH,
+	[GSM_PCHAN_PDCH]	= NM_CHANC_IPAC_PDCH,
+	[GSM_PCHAN_TCH_F_PDCH]	= NM_CHANC_IPAC_TCHFull_PDCH,
+	[GSM_PCHAN_UNKNOWN]	= 0xff,
+	/* FIXME: bounds check */
+};
+
+/*! \brief Obtain OML Channel Combination for phnsical channel config */
+int abis_nm_chcomb4pchan(enum gsm_phys_chan_config pchan)
+{
+	if (pchan < ARRAY_SIZE(chcomb4pchan))
+		return chcomb4pchan[pchan];
+
+	return -EINVAL;
+}
+
+/*! \brief Obtain physical channel config for OML Channel Combination */
+enum abis_nm_chan_comb abis_nm_pchan4chcomb(uint8_t chcomb)
+{
+	int i;
+	for (i = 0; i < ARRAY_SIZE(chcomb4pchan); i++) {
+		if (chcomb4pchan[i] == chcomb)
+			return i;
+	}
+	return GSM_PCHAN_NONE;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsm/auth_comp128v1.c b/src/shared/libosmocore/src/gsm/auth_comp128v1.c
new file mode 100644
index 00000000..41aef71c
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/auth_comp128v1.c
@@ -0,0 +1,47 @@
+
+/* GSM/GPRS/3G authentication core infrastructure */
+
+/* (C) 2010-2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/crypt/auth.h>
+#include <osmocom/gsm/comp128.h>
+
+static int c128v1_gen_vec(struct osmo_auth_vector *vec,
+			  struct osmo_sub_auth_data *aud,
+			  const uint8_t *_rand)
+{
+	comp128(aud->u.gsm.ki, _rand, vec->sres, vec->kc);
+	vec->auth_types = OSMO_AUTH_TYPE_GSM;
+
+	return 0;
+}
+
+static struct osmo_auth_impl c128v1_alg = {
+	.algo = OSMO_AUTH_ALG_COMP128v1,
+	.name = "COMP128v1 (libosmogsm built-in)",
+	.priority = 1000,
+	.gen_vec = &c128v1_gen_vec,
+};
+
+static __attribute__((constructor)) void on_dso_load_c128(void)
+{
+	osmo_auth_register(&c128v1_alg);
+}
diff --git a/src/shared/libosmocore/src/gsm/auth_core.c b/src/shared/libosmocore/src/gsm/auth_core.c
new file mode 100644
index 00000000..5cf8dfcf
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/auth_core.c
@@ -0,0 +1,172 @@
+/* GSM/GPRS/3G authentication core infrastructure */
+
+/* (C) 2010-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/plugin.h>
+
+#include <osmocom/crypt/auth.h>
+
+/*! \addtogroup auth
+ *  @{
+ */
+
+/* \file auth_core.c
+ */
+
+static LLIST_HEAD(osmo_auths);
+
+static struct osmo_auth_impl *selected_auths[_OSMO_AUTH_ALG_NUM];
+
+/*! \brief Register an authentication algorithm implementation with the core
+ *  \param[in] impl Structure describing implementation and it's callbacks
+ *
+ * This function is called by an authentication implementation plugin to
+ * register itself with the authentication core.
+ */
+int osmo_auth_register(struct osmo_auth_impl *impl)
+{
+	if (impl->algo >= ARRAY_SIZE(selected_auths))
+		return -ERANGE;
+
+	llist_add_tail(&impl->list, &osmo_auths);
+
+	/* check if we want to select this implementation over others */
+	if (!selected_auths[impl->algo] ||
+	    (selected_auths[impl->algo]->priority > impl->priority))
+		selected_auths[impl->algo] = impl;
+
+	return 0;
+}
+
+/*! \brief Load all available authentication plugins from the given path
+ *  \param[in] path Path name of the directory containing the plugins
+ *
+ * This function will load all plugins contained in the specified path.
+ */
+int osmo_auth_load(const char *path)
+{
+	/* load all plugins available from path */
+	return osmo_plugin_load_all(path);
+}
+
+/*! \brief Determine if a given authentication algorithm is supported
+ *  \param[in] algo Algorithm which should be checked
+ *
+ * This function is used by an application to determine at runtime if a
+ * given authentication algorithm is supported or not.
+ */
+int osmo_auth_supported(enum osmo_auth_algo algo)
+{
+	if (algo >= ARRAY_SIZE(selected_auths))
+		return -ERANGE;
+
+	if (selected_auths[algo])
+		return 1;
+
+	return 0;
+}
+
+/*! \brief Generate authentication vector
+ *  \param[out] vec Generated authentication vector
+ *  \param[in] aud Subscriber-specific key material
+ *  \param[in] rand Random challenge to be used
+ *
+ * This function performs the core cryptographic function of the AUC,
+ * computing authentication triples/quintuples based on the permanent
+ * subscriber data and a random value.  The result is what is forwarded
+ * by the AUC via HLR and VLR to the MSC which will then be able to
+ * invoke authentication with the MS
+ */
+int osmo_auth_gen_vec(struct osmo_auth_vector *vec,
+		      struct osmo_sub_auth_data *aud,
+		      const uint8_t *_rand)
+{
+	struct osmo_auth_impl *impl = selected_auths[aud->algo];
+	int rc;
+
+	if (!impl)
+		return -ENOENT;
+
+	rc = impl->gen_vec(vec, aud, _rand);
+	if (rc < 0)
+		return rc;
+
+	memcpy(vec->rand, _rand, sizeof(vec->rand));
+
+	return 0;
+}
+
+/*! \brief Generate authentication vector and re-sync sequence
+ *  \param[out] vec Generated authentication vector
+ *  \param[in] aud Subscriber-specific key material
+ *  \param[in] rand_auts RAND value sent by the SIM/MS
+ *  \param[in] auts AUTS value sent by the SIM/MS
+ *  \param[in] rand Random challenge to be used to generate vector
+ *
+ * This function performs a special variant of the  core cryptographic
+ * function of the AUC: computing authentication triples/quintuples
+ * based on the permanent subscriber data, a random value as well as the
+ * AUTS and RAND values returned by the SIM/MS.  This special variant is
+ * needed if the sequence numbers between MS and AUC have for some
+ * reason become diffrent.
+ */
+int osmo_auth_gen_vec_auts(struct osmo_auth_vector *vec,
+			   struct osmo_sub_auth_data *aud,
+			   const uint8_t *rand_auts, const uint8_t *auts,
+			   const uint8_t *_rand)
+{
+	struct osmo_auth_impl *impl = selected_auths[aud->algo];
+
+	if (!impl || !impl->gen_vec_auts)
+		return -ENOENT;
+
+	return impl->gen_vec_auts(vec, aud, rand_auts, auts, _rand);
+}
+
+static const struct value_string auth_alg_vals[] = {
+	{ OSMO_AUTH_ALG_NONE, "None" },
+	{ OSMO_AUTH_ALG_COMP128v1, "COMP128v1" },
+	{ OSMO_AUTH_ALG_COMP128v2, "COMP128v2" },
+	{ OSMO_AUTH_ALG_COMP128v3, "COMP128v3" },
+	{ OSMO_AUTH_ALG_XOR, "XOR" },
+	{ OSMO_AUTH_ALG_MILENAGE, "MILENAGE" },
+	{ 0, NULL }
+};
+
+/*! \brief Get human-readable name of authentication algorithm */
+const char *osmo_auth_alg_name(enum osmo_auth_algo alg)
+{
+	return get_value_string(auth_alg_vals, alg);
+}
+
+/*! \brief Parse human-readable name of authentication algorithm */
+enum osmo_auth_algo osmo_auth_alg_parse(const char *name)
+{
+	return get_string_value(auth_alg_vals, name);
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsm/auth_milenage.c b/src/shared/libosmocore/src/gsm/auth_milenage.c
new file mode 100644
index 00000000..5b2787dd
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/auth_milenage.c
@@ -0,0 +1,120 @@
+/* GSM/GPRS/3G authentication core infrastructure */
+
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/crypt/auth.h>
+#include "milenage/common.h"
+#include "milenage/milenage.h"
+
+static void sqn_u64_to_48bit(uint8_t *sqn, const uint64_t sqn64)
+{
+	sqn[5] = (sqn64 >>  0) & 0xff;
+	sqn[4] = (sqn64 >>  8) & 0xff;
+	sqn[3] = (sqn64 >> 16) & 0xff;
+	sqn[2] = (sqn64 >> 24) & 0xff;
+	sqn[1] = (sqn64 >> 32) & 0xff;
+	sqn[0] = (sqn64 >> 40) & 0xff;
+}
+
+static uint64_t sqn_48bit_to_u64(const uint8_t *sqn)
+{
+	uint64_t sqn64;
+
+	sqn64 = sqn[0];
+	sqn64 <<= 8;
+	sqn64 |= sqn[1];
+	sqn64 <<= 8;
+	sqn64 |= sqn[2];
+	sqn64 <<= 8;
+	sqn64 |= sqn[3];
+	sqn64 <<= 8;
+	sqn64 |= sqn[4];
+	sqn64 <<= 8;
+	sqn64 |= sqn[5];
+
+	return sqn64;
+}
+
+
+static int milenage_gen_vec(struct osmo_auth_vector *vec,
+			    struct osmo_sub_auth_data *aud,
+			    const uint8_t *_rand)
+{
+	size_t res_len = sizeof(vec->res);
+	uint8_t sqn[6];
+	int rc;
+
+	sqn_u64_to_48bit(sqn, aud->u.umts.sqn);
+	milenage_generate(aud->u.umts.opc, aud->u.umts.amf, aud->u.umts.k,
+			  sqn, _rand,
+			  vec->autn, vec->ik, vec->ck, vec->res, &res_len);
+	vec->res_len = res_len;
+	rc = gsm_milenage(aud->u.umts.opc, aud->u.umts.k, _rand, vec->sres, vec->kc);
+	if (rc < 0)
+		return rc;
+
+	vec->auth_types = OSMO_AUTH_TYPE_UMTS | OSMO_AUTH_TYPE_GSM;
+	aud->u.umts.sqn++;
+
+	return 0;
+}
+
+static int milenage_gen_vec_auts(struct osmo_auth_vector *vec,
+				 struct osmo_sub_auth_data *aud,
+				 const uint8_t *auts, const uint8_t *rand_auts,
+				 const uint8_t *_rand)
+{
+	uint8_t sqn_out[6];
+	uint8_t gen_opc[16];
+	uint8_t *opc;
+	int rc;
+
+	/* Check if we only know OP and compute OPC if required */
+	if (aud->type == OSMO_AUTH_TYPE_UMTS && aud->u.umts.opc_is_op) {
+		rc = milenage_opc_gen(gen_opc, aud->u.umts.k,
+				      aud->u.umts.opc);
+		if (rc < 0)
+			return rc;
+		opc = gen_opc;
+	} else
+		opc = aud->u.umts.opc;
+
+	rc = milenage_auts(opc, aud->u.umts.k, rand_auts, auts, sqn_out);
+	if (rc < 0)
+		return rc;
+
+	aud->u.umts.sqn = sqn_48bit_to_u64(sqn_out) + 1;
+
+	return milenage_gen_vec(vec, aud, _rand);
+}
+
+static struct osmo_auth_impl milenage_alg = {
+	.algo = OSMO_AUTH_ALG_MILENAGE,
+	.name = "MILENAGE (libosmogsm built-in)",
+	.priority = 1000,
+	.gen_vec = &milenage_gen_vec,
+	.gen_vec_auts = &milenage_gen_vec_auts,
+};
+
+static __attribute__((constructor)) void on_dso_load_milenage(void)
+{
+	osmo_auth_register(&milenage_alg);
+}
diff --git a/src/shared/libosmocore/src/gsm/comp128.c b/src/shared/libosmocore/src/gsm/comp128.c
new file mode 100644
index 00000000..b7a23820
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/comp128.c
@@ -0,0 +1,230 @@
+/*
+ * COMP128 implementation
+ *
+ *
+ * This code is inspired by original code from :
+ *  Marc Briceno <marc@scard.org>, Ian Goldberg <iang@cs.berkeley.edu>,
+ *  and David Wagner <daw@cs.berkeley.edu>
+ *
+ * But it has been fully rewritten from various PDFs found online describing
+ * the algorithm because the licence of the code referenced above was unclear.
+ * A comment snippet from the original code is included below, it describes
+ * where the doc came from and how the algorithm was reverse engineered.
+ *
+ *
+ * (C) 2009 by Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*
+ * --- SNIP ---
+ *
+ * This code derived from a leaked document from the GSM standards.
+ * Some missing pieces were filled in by reverse-engineering a working SIM.
+ * We have verified that this is the correct COMP128 algorithm.
+ *
+ * The first page of the document identifies it as
+ * 	_Technical Information: GSM System Security Study_.
+ * 	10-1617-01, 10th June 1988.
+ * The bottom of the title page is marked
+ * 	Racal Research Ltd.
+ * 	Worton Drive, Worton Grange Industrial Estate,
+ * 	Reading, Berks. RG2 0SB, England.
+ * 	Telephone: Reading (0734) 868601   Telex: 847152
+ * The relevant bits are in Part I, Section 20 (pages 66--67).  Enjoy!
+ *
+ * Note: There are three typos in the spec (discovered by
+ * reverse-engineering).
+ * First, "z = (2 * x[n] + x[n]) mod 2^(9-j)" should clearly read
+ * "z = (2 * x[m] + x[n]) mod 2^(9-j)".
+ * Second, the "k" loop in the "Form bits from bytes" section is severely
+ * botched: the k index should run only from 0 to 3, and clearly the range
+ * on "the (8-k)th bit of byte j" is also off (should be 0..7, not 1..8,
+ * to be consistent with the subsequent section).
+ * Third, SRES is taken from the first 8 nibbles of x[], not the last 8 as
+ * claimed in the document.  (And the document doesn't specify how Kc is
+ * derived, but that was also easily discovered with reverse engineering.)
+ * All of these typos have been corrected in the following code.
+ *
+ * --- /SNIP ---
+ */
+
+#include <string.h>
+#include <stdint.h>
+
+/* The compression tables (just copied ...) */
+static const uint8_t table_0[512] = {
+ 102, 177, 186, 162,   2, 156, 112,  75,  55,  25,   8,  12, 251, 193, 246, 188,
+ 109, 213, 151,  53,  42,  79, 191, 115, 233, 242, 164, 223, 209, 148, 108, 161,
+ 252,  37, 244,  47,  64, 211,   6, 237, 185, 160, 139, 113,  76, 138,  59,  70,
+  67,  26,  13, 157,  63, 179, 221,  30, 214,  36, 166,  69, 152, 124, 207, 116,
+ 247, 194,  41,  84,  71,   1,  49,  14,  95,  35, 169,  21,  96,  78, 215, 225,
+ 182, 243,  28,  92, 201, 118,   4,  74, 248, 128,  17,  11, 146, 132, 245,  48,
+ 149,  90, 120,  39,  87, 230, 106, 232, 175,  19, 126, 190, 202, 141, 137, 176,
+ 250,  27, 101,  40, 219, 227,  58,  20,  51, 178,  98, 216, 140,  22,  32, 121,
+  61, 103, 203,  72,  29, 110,  85, 212, 180, 204, 150, 183,  15,  66, 172, 196,
+  56, 197, 158,   0, 100,  45, 153,   7, 144, 222, 163, 167,  60, 135, 210, 231,
+ 174, 165,  38, 249, 224,  34, 220, 229, 217, 208, 241,  68, 206, 189, 125, 255,
+ 239,  54, 168,  89, 123, 122,  73, 145, 117, 234, 143,  99, 129, 200, 192,  82,
+ 104, 170, 136, 235,  93,  81, 205, 173, 236,  94, 105,  52,  46, 228, 198,   5,
+  57, 254,  97, 155, 142, 133, 199, 171, 187,  50,  65, 181, 127, 107, 147, 226,
+ 184, 218, 131,  33,  77,  86,  31,  44,  88,  62, 238,  18,  24,  43, 154,  23,
+  80, 159, 134, 111,   9, 114,   3,  91,  16, 130,  83,  10, 195, 240, 253, 119,
+ 177, 102, 162, 186, 156,   2,  75, 112,  25,  55,  12,   8, 193, 251, 188, 246,
+ 213, 109,  53, 151,  79,  42, 115, 191, 242, 233, 223, 164, 148, 209, 161, 108,
+  37, 252,  47, 244, 211,  64, 237,   6, 160, 185, 113, 139, 138,  76,  70,  59,
+  26,  67, 157,  13, 179,  63,  30, 221,  36, 214,  69, 166, 124, 152, 116, 207,
+ 194, 247,  84,  41,   1,  71,  14,  49,  35,  95,  21, 169,  78,  96, 225, 215,
+ 243, 182,  92,  28, 118, 201,  74,   4, 128, 248,  11,  17, 132, 146,  48, 245,
+  90, 149,  39, 120, 230,  87, 232, 106,  19, 175, 190, 126, 141, 202, 176, 137,
+  27, 250,  40, 101, 227, 219,  20,  58, 178,  51, 216,  98,  22, 140, 121,  32,
+ 103,  61,  72, 203, 110,  29, 212,  85, 204, 180, 183, 150,  66,  15, 196, 172,
+ 197,  56,   0, 158,  45, 100,   7, 153, 222, 144, 167, 163, 135,  60, 231, 210,
+ 165, 174, 249,  38,  34, 224, 229, 220, 208, 217,  68, 241, 189, 206, 255, 125,
+  54, 239,  89, 168, 122, 123, 145,  73, 234, 117,  99, 143, 200, 129,  82, 192,
+ 170, 104, 235, 136,  81,  93, 173, 205,  94, 236,  52, 105, 228,  46,   5, 198,
+ 254,  57, 155,  97, 133, 142, 171, 199,  50, 187, 181,  65, 107, 127, 226, 147,
+ 218, 184,  33, 131,  86,  77,  44,  31,  62,  88,  18, 238,  43,  24,  23, 154,
+ 159,  80, 111, 134, 114,   9,  91,   3, 130,  16,  10,  83, 240, 195, 119, 253,
+}, table_1[256] = {
+  19,  11,  80, 114,  43,   1,  69,  94,  39,  18, 127, 117,  97,   3,  85,  43,
+  27, 124,  70,  83,  47,  71,  63,  10,  47,  89,  79,   4,  14,  59,  11,   5,
+  35, 107, 103,  68,  21,  86,  36,  91,  85, 126,  32,  50, 109,  94, 120,   6,
+  53,  79,  28,  45,  99,  95,  41,  34,  88,  68,  93,  55, 110, 125, 105,  20,
+  90,  80,  76,  96,  23,  60,  89,  64, 121,  56,  14,  74, 101,   8,  19,  78,
+  76,  66, 104,  46, 111,  50,  32,   3,  39,   0,  58,  25,  92,  22,  18,  51,
+  57,  65, 119, 116,  22, 109,   7,  86,  59,  93,  62, 110,  78,  99,  77,  67,
+  12, 113,  87,  98, 102,   5,  88,  33,  38,  56,  23,   8,  75,  45,  13,  75,
+  95,  63,  28,  49, 123, 120,  20, 112,  44,  30,  15,  98, 106,   2, 103,  29,
+  82, 107,  42, 124,  24,  30,  41,  16, 108, 100, 117,  40,  73,  40,   7, 114,
+  82, 115,  36, 112,  12, 102, 100,  84,  92,  48,  72,  97,   9,  54,  55,  74,
+ 113, 123,  17,  26,  53,  58,   4,   9,  69, 122,  21, 118,  42,  60,  27,  73,
+ 118, 125,  34,  15,  65, 115,  84,  64,  62,  81,  70,   1,  24, 111, 121,  83,
+ 104,  81,  49, 127,  48, 105,  31,  10,   6,  91,  87,  37,  16,  54, 116, 126,
+  31,  38,  13,   0,  72, 106,  77,  61,  26,  67,  46,  29,  96,  37,  61,  52,
+ 101,  17,  44, 108,  71,  52,  66,  57,  33,  51,  25,  90,   2, 119, 122,  35,
+}, table_2[128] = {
+ 52,  50,  44,   6,  21,  49,  41,  59,  39,  51,  25,  32,  51,  47,  52,  43,
+ 37,   4,  40,  34,  61,  12,  28,   4,  58,  23,   8,  15,  12,  22,   9,  18,
+ 55,  10,  33,  35,  50,   1,  43,   3,  57,  13,  62,  14,   7,  42,  44,  59,
+ 62,  57,  27,   6,   8,  31,  26,  54,  41,  22,  45,  20,  39,   3,  16,  56,
+ 48,   2,  21,  28,  36,  42,  60,  33,  34,  18,   0,  11,  24,  10,  17,  61,
+ 29,  14,  45,  26,  55,  46,  11,  17,  54,  46,   9,  24,  30,  60,  32,   0,
+ 20,  38,   2,  30,  58,  35,   1,  16,  56,  40,  23,  48,  13,  19,  19,  27,
+ 31,  53,  47,  38,  63,  15,  49,   5,  37,  53,  25,  36,  63,  29,   5,   7,
+}, table_3[64] = {
+  1,   5,  29,   6,  25,   1,  18,  23,  17,  19,   0,   9,  24,  25,   6,  31,
+ 28,  20,  24,  30,   4,  27,   3,  13,  15,  16,  14,  18,   4,   3,   8,   9,
+ 20,   0,  12,  26,  21,   8,  28,   2,  29,   2,  15,   7,  11,  22,  14,  10,
+ 17,  21,  12,  30,  26,  27,  16,  31,  11,   7,  13,  23,  10,   5,  22,  19,
+}, table_4[32] = {
+ 15,  12,  10,   4,   1,  14,  11,   7,   5,   0,  14,   7,   1,   2,  13,   8,
+ 10,   3,   4,   9,   6,   0,   3,   2,   5,   6,   8,   9,  11,  13,  15,  12,
+};
+
+static const uint8_t *_comp128_table[5] = { table_0, table_1, table_2, table_3, table_4 };
+
+
+static inline void
+_comp128_compression_round(uint8_t *x, int n, const uint8_t *tbl)
+{
+	int i, j, m, a, b, y, z;
+	m = 4 - n;
+	for (i=0; i<(1<<n); i++)
+		for (j=0; j<(1<<m); j++) {
+			a = j + i * (2<<m);
+			b = a + (1<<m);
+			y = (x[a] + (x[b]<<1)) & ((32<<m)-1);
+			z = ((x[a]<<1) + x[b]) & ((32<<m)-1);
+			x[a] = tbl[y];
+			x[b] = tbl[z];
+		}
+}
+
+static inline void
+_comp128_compression(uint8_t *x)
+{
+	int n;
+	for (n=0; n<5; n++)
+		_comp128_compression_round(x, n, _comp128_table[n]);
+}
+
+static inline void
+_comp128_bitsfrombytes(uint8_t *x, uint8_t *bits)
+{
+	int i;
+	memset(bits, 0x00, 128);
+	for (i=0; i<128; i++)
+		if (x[i>>2] & (1<<(3-(i&3))))
+			bits[i] = 1;
+}
+
+static inline void
+_comp128_permutation(uint8_t *x, uint8_t *bits)
+{
+	int i;
+	memset(&x[16], 0x00, 16);
+	for (i=0; i<128; i++)
+		x[(i>>3)+16] |= bits[(i*17) & 127] << (7-(i&7));
+}
+
+void
+comp128(const uint8_t *ki, const uint8_t *rand, uint8_t *sres, uint8_t *kc)
+{
+	int i;
+	uint8_t x[32], bits[128];
+
+	/* x[16-31] = RAND */
+	memcpy(&x[16], rand, 16);
+
+	/* Round 1-7 */
+	for (i=0; i<7; i++) {
+		/* x[0-15] = Ki */
+		memcpy(x, ki, 16);
+
+		/* Compression */
+		_comp128_compression(x);
+
+		/* FormBitFromBytes */
+		_comp128_bitsfrombytes(x, bits);
+
+		/* Permutation */
+		_comp128_permutation(x, bits);
+	}
+
+	/* Round 8 (final) */
+		/* x[0-15] = Ki */
+	memcpy(x, ki, 16);
+
+		/* Compression */
+	_comp128_compression(x);
+
+	/* Output stage */
+	for (i=0; i<8; i+=2)
+		sres[i>>1] = x[i]<<4 | x[i+1];
+
+	for (i=0; i<12; i+=2)
+		kc[i>>1] = (x[i + 18] << 6) |
+		           (x[i + 19] << 2) |
+		           (x[i + 20] >> 2);
+
+	kc[6] = (x[30]<<6) | (x[31]<<2);
+	kc[7] = 0;
+}
+
diff --git a/src/shared/libosmocore/src/gsm/gan.c b/src/shared/libosmocore/src/gsm/gan.c
new file mode 100644
index 00000000..e041936e
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gan.c
@@ -0,0 +1,77 @@
+/* (C) 2012 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <unistd.h>
+#include <osmocom/core/utils.h>
+
+#include <osmocom/gsm/protocol/gsm_44_318.h>
+
+
+const struct value_string gan_msgt_vals[] = {
+	{ GA_MT_RC_DISCOVERY_REQUEST,	"GA-RC DISCOVERY REQUEST" },
+	{ GA_MT_RC_DISCOVERY_ACCEPT,	"GA-RC DISCOVERY ACCEPT" },
+	{ GA_MT_RC_DISCOVERY_REJECT,	"GA-RC DISCOVERY REJECT" },
+	{ GA_MT_RC_REGISTER_REQUEST,	"GA-RC REGISTER REQUEST" },
+	{ GA_MT_RC_REGISTER_ACCEPT,	"GA-RC REGISTER ACCEPT" },
+	{ GA_MT_RC_REGISTER_REDIRECT,	"GA-RC REGISTER REDIRECT" },
+	{ GA_MT_RC_REGISTER_REJECT,	"GA-RC REGISTER REJECT" },
+	{ GA_MT_RC_DEREGISTER,		"GA-RC DEREGISTER" },
+	{ GA_MT_RC_REGISTER_UPDATE_UL,	"GA-RC REGISTER UPDATE UL" },
+	{ GA_MT_RC_REGISTER_UPDATE_DL,	"GA-RC REGISTER UPDATE DL" },
+	{ GA_MT_RC_CELL_BCAST_INFO,	"GA-RC CELL BROADCAST INFO" },
+	{ GA_MT_CSR_CIPH_MODE_CMD,	"GA-CSR CIPHER MDOE COMMAND" },
+	{ GA_MT_CSR_CIPH_MODE_COMPL,	"GA-CSR CIPHER MODE COMPLETE" },
+	{ GA_MT_CSR_ACT_CHAN,		"GA-CSR ACTIVATE CHANNEL" },
+	{ GA_MT_CSR_ACT_CHAN_ACK,	"GA-CSR ACTIVATE CHANNEL ACK" },
+	{ GA_MT_CSR_ACT_CHAN_COMPL,	"GA-CSR ACTIVATE CHANNEL COMPLETE" },
+	{ GA_MT_CSR_ACT_CHAN_FAIL,	"GA-CSR ACTIVATE CHANNEL FAIL" },
+	{ GA_MT_CSR_CHAN_MODE_MOD,	"GA-CSR CHANNEL MODE MODIFY" },
+	{ GA_MT_CSR_CHAN_MODE_MOD_ACK,	"GA-CSR CHANNEL MODE MODIFY ACK" },
+	{ GA_MT_CSR_RELEASE,		"GA-CSR RELEASE" },
+	{ GA_MT_CSR_RELEASE_COMPL,	"GA-CSR RELEASE COMPLETE" },
+	{ GA_MT_CSR_CLEAR_REQ,		"GA-CSR CLEAR REQUEST" },
+	{ GA_MT_CSR_HO_ACCESS,		"GA-CSR HANDOVER ACCESS" },
+	{ GA_MT_CSR_HO_COMPL,		"GA-CSR HANDOVER COMPLETE" },
+	{ GA_MT_CSR_UL_QUAL_IND,	"GA-CSR UL QUALITY INDICATION" },
+	{ GA_MT_CSR_HO_INFO,		"GA-CSR HANDOVER INFO" },
+	{ GA_MT_CSR_HO_CMD,		"GA-CSR HANDOVER COMMAND" },
+	{ GA_MT_CSR_HO_FAIL,		"GA-CSR HANDOVER FAILURE" },
+	{ GA_MT_CSR_PAGING_REQ,		"GA-CSR PAGING REQUEST" },
+	{ GA_MT_CSR_PAGING_RESP,	"GA-CSR PAGING RESPONSE" },
+	{ GA_MT_CSR_UL_DIRECT_XFER,	"GA-CSR UL DIRECT TRANSFER" },
+	{ GA_MT_CSR_DL_DIRECT_XFER,	"GA-CSR DL DIRECT TRANSFER" },
+	{ GA_MT_CSR_STATUS,		"GA-CSR STATUS" },
+	{ GA_MT_RC_KEEPALIVE,		"GA-CSR KEEPALIVE" },
+	{ GA_MT_CSR_CM_ENQ,		"GA-CSR CLASSMARK ENQUIRY" },
+	{ GA_MT_CSR_CM_CHANGE,		"GA-CSR CLASSMARK CHANGE" },
+	{ GA_MT_PSR_GPRS_SUSPEND_REQ,	"GA-PSR GPRS SUSPEND REQUEST" },
+	{ GA_RC_SYNC_INFO,		"GA-RC SYNCH INFORMATION" },
+	{ GA_CSR_UTRAN_CM_CHG,		"GA-CSR UTRAN CLASSMARK CHANGE" },
+	{ GA_MT_CSR_REQUEST,		"GA-CSR REQUEST" },
+	{ GA_MT_CSR_REQUEST_ACCEPT,	"GA-CSR REQUEST ACCEPT" },
+	{ GA_MT_CSR_REQUEST_REJECT,	"GA-CSR REQUEST REJECT" },
+	{ 0, NULL }
+};
+
+static const struct value_string gan_pdisc_vals[] = {
+	{ GA_PDISC_RC,			"RC" },
+	{ GA_PDISC_CSR,			"CSR" },
+	{ GA_PDISC_PSR,			"PSR" },
+	{ 0, NULL }
+};
+
diff --git a/src/shared/libosmocore/src/gsm/gprs_cipher_core.c b/src/shared/libosmocore/src/gsm/gprs_cipher_core.c
new file mode 100644
index 00000000..b9a22a10
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gprs_cipher_core.c
@@ -0,0 +1,99 @@
+/* GPRS LLC cipher core infrastructure */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <stdint.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/plugin.h>
+
+#include <osmocom/crypt/gprs_cipher.h>
+
+static LLIST_HEAD(gprs_ciphers);
+
+static struct gprs_cipher_impl *selected_ciphers[_GPRS_ALGO_NUM];
+
+/* register a cipher with the core */
+int gprs_cipher_register(struct gprs_cipher_impl *ciph)
+{
+	if (ciph->algo >= ARRAY_SIZE(selected_ciphers))
+		return -ERANGE;
+
+	llist_add_tail(&ciph->list, &gprs_ciphers);
+
+	/* check if we want to select this implementation over others */
+	if (!selected_ciphers[ciph->algo] ||
+	    (selected_ciphers[ciph->algo]->priority > ciph->priority))
+		selected_ciphers[ciph->algo] = ciph;
+
+	return 0;
+}
+
+/* load all available GPRS cipher plugins */
+int gprs_cipher_load(const char *path)
+{
+	/* load all plugins available from path */
+	return osmo_plugin_load_all(path);
+}
+
+/* function to be called by core code */
+int gprs_cipher_run(uint8_t *out, uint16_t len, enum gprs_ciph_algo algo,
+		    uint64_t kc, uint32_t iv, enum gprs_cipher_direction dir)
+{
+	if (algo >= ARRAY_SIZE(selected_ciphers))
+		return -ERANGE;
+
+	if (!selected_ciphers[algo])
+		return -EINVAL;
+
+	if (len > GSM0464_CIPH_MAX_BLOCK)
+		return -ERANGE;
+
+	/* run the actual cipher from the plugin */
+	return selected_ciphers[algo]->run(out, len, kc, iv, dir);
+}
+
+int gprs_cipher_supported(enum gprs_ciph_algo algo)
+{
+	if (algo >= ARRAY_SIZE(selected_ciphers))
+		return -ERANGE;
+
+	if (selected_ciphers[algo])
+		return 1;
+
+	return 0;
+}
+
+/* GSM TS 04.64 / Section A.2.1 : Generation of 'input' */
+uint32_t gprs_cipher_gen_input_ui(uint32_t iov_ui, uint8_t sapi, uint32_t lfn, uint32_t oc)
+{
+	uint32_t sx = ((1<<27) * sapi) + (1<<31);
+
+	return (iov_ui ^ sx) + lfn + oc;
+}
+
+/* GSM TS 04.64 / Section A.2.1 : Generation of 'input' */
+uint32_t gprs_cipher_gen_input_i(uint32_t iov_i, uint32_t lfn, uint32_t oc)
+{
+	return iov_i + lfn + oc;
+}
diff --git a/src/shared/libosmocore/src/gsm/gsm0411_smc.c b/src/shared/libosmocore/src/gsm/gsm0411_smc.c
new file mode 100644
index 00000000..4152ef1c
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gsm0411_smc.c
@@ -0,0 +1,541 @@
+/* Point-to-Point (PP) Short Message Service (SMS)
+ * Support on Mobile Radio Interface
+ * 3GPP TS 04.11 version 7.1.0 Release 1998 / ETSI TS 100 942 V7.1.0 */
+
+/* (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
+ * (C) 2009 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2010 by On-Waves
+ * (C) 2011 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/* Notes on msg:
+ *
+ * Messages from lower layer are freed by lower layer.
+ *
+ * Messages to upper layer are freed after upper layer call returns, so upper
+ * layer cannot use data after returning. Upper layer must not free the msg.
+ *
+ * This implies: Lower layer messages can be forwarded to upper layer.
+ *
+ * Upper layer messages are freed by lower layer, so they must not be freed
+ * after calling lower layer.
+ *
+ *
+ * Notes on release:
+ *
+ * Whenever the process returns to IDLE, the MM connection is released using
+ * MMSMS-REL-REQ. It is allowed to destroy this process while processing
+ * this message.
+ *
+ * There is expeption, if MMSMS-REL-IND is received from lower layer, the
+ * process returns to IDLE without sending MMSMS-REL-REQ.
+ *
+ */
+
+#include <string.h>
+#include <errno.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/timer.h>
+
+#include <osmocom/gsm/gsm0411_utils.h>
+#include <osmocom/gsm/gsm0411_smc.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+static void cp_timer_expired(void *data);
+
+#define MAX_SMS_RETRY 2
+
+/* init a new instance */
+void gsm411_smc_init(struct gsm411_smc_inst *inst, int network,
+	int (*mn_recv) (struct gsm411_smc_inst *inst, int msg_type,
+			struct msgb *msg),
+	int (*mm_send) (struct gsm411_smc_inst *inst, int msg_type,
+			struct msgb *msg, int cp_msg_type))
+{
+	memset(inst, 0, sizeof(*inst));
+	inst->network = network;
+	inst->cp_max_retr = MAX_SMS_RETRY;
+	inst->cp_tc1 = GSM411_TMR_TC1A_SEC / (inst->cp_max_retr + 1);
+	inst->cp_state = GSM411_CPS_IDLE;
+	inst->mn_recv = mn_recv;
+	inst->mm_send = mm_send;
+
+	LOGP(DLSMS, LOGL_INFO, "New SMC instance created\n");
+}
+
+/* clear instance */
+void gsm411_smc_clear(struct gsm411_smc_inst *inst)
+{
+	LOGP(DLSMS, LOGL_INFO, "Clear SMC instance\n");
+
+	osmo_timer_del(&inst->cp_timer);
+
+	/* free stored msg */
+	if (inst->cp_msg) {
+		LOGP(DLSMS, LOGL_INFO, "Dropping pending message\n");
+		msgb_free(inst->cp_msg);
+		inst->cp_msg = NULL;
+	}
+}
+
+const char *smc_state_names[] = {
+	"IDLE",
+	"MM_CONN_PENDING",
+	"WAIT_CP_ACK",
+	"MM_ESTABLISHED",
+};
+
+const struct value_string gsm411_cp_cause_strs[] = {
+	{ GSM411_CP_CAUSE_NET_FAIL,	"Network Failure" },
+	{ GSM411_CP_CAUSE_CONGESTION,	"Congestion" },
+	{ GSM411_CP_CAUSE_INV_TRANS_ID,	"Invalid Transaction ID" },
+	{ GSM411_CP_CAUSE_SEMANT_INC_MSG, "Semantically Incorrect Message" },
+	{ GSM411_CP_CAUSE_INV_MAND_INF,	"Invalid Mandatory Information" },
+	{ GSM411_CP_CAUSE_MSGTYPE_NOTEXIST, "Message Type doesn't exist" },
+	{ GSM411_CP_CAUSE_MSG_INCOMP_STATE,
+				"Message incompatible with protocol state" },
+	{ GSM411_CP_CAUSE_IE_NOTEXIST,	"IE does not exist" },
+	{ GSM411_CP_CAUSE_PROTOCOL_ERR,	"Protocol Error" },
+	{ 0, 0 }
+};
+
+static void new_cp_state(struct gsm411_smc_inst *inst,
+	enum gsm411_cp_state state)
+{
+	LOGP(DLSMS, LOGL_INFO, "New CP state %s -> %s\n",
+		smc_state_names[inst->cp_state], smc_state_names[state]);
+	inst->cp_state = state;
+}
+
+static int gsm411_tx_cp_error(struct gsm411_smc_inst *inst, uint8_t cause)
+{
+	struct msgb *nmsg = gsm411_msgb_alloc();
+	uint8_t *causep;
+
+	LOGP(DLSMS, LOGL_NOTICE, "TX CP-ERROR, cause %d (%s)\n", cause,
+		get_value_string(gsm411_cp_cause_strs, cause));
+
+	causep = msgb_put(nmsg, 1);
+	*causep = cause;
+
+	return inst->mm_send(inst, GSM411_MMSMS_DATA_REQ, nmsg,
+		GSM411_MT_CP_ERROR);
+}
+
+/* establish SMC connection */
+static int gsm411_mnsms_est_req(struct gsm411_smc_inst *inst, struct msgb *msg)
+{
+	struct msgb *nmsg;
+
+	if (inst->cp_msg) {
+		LOGP(DLSMS, LOGL_FATAL, "EST REQ, but we already have an "
+			"cp_msg. This should never happen, please fix!\n");
+		msgb_free(inst->cp_msg);
+	}
+
+	inst->cp_msg = msg;
+	new_cp_state(inst, GSM411_CPS_MM_CONN_PENDING);
+	/* clear stored release flag */
+	inst->cp_rel = 0;
+	/* send MMSMS_EST_REQ */
+	nmsg = gsm411_msgb_alloc();
+	return inst->mm_send(inst, GSM411_MMSMS_EST_REQ, nmsg, 0);
+}
+
+static int gsm411_mmsms_send_msg(struct gsm411_smc_inst *inst)
+{
+	struct msgb *nmsg;
+
+	LOGP(DLSMS, LOGL_INFO, "Send CP data\n");
+	/* reset retry counter */
+	if (inst->cp_state != GSM411_CPS_WAIT_CP_ACK)
+		inst->cp_retx = 0;
+	/* 5.2.3.1.2: enter MO-wait for CP-ACK */
+	/* 5.2.3.2.3: enter MT-wait for CP-ACK */
+	new_cp_state(inst, GSM411_CPS_WAIT_CP_ACK);
+	inst->cp_timer.data = inst;
+	inst->cp_timer.cb = cp_timer_expired;
+	/* 5.3.2.1: Set Timer TC1A */
+	osmo_timer_schedule(&inst->cp_timer, inst->cp_tc1, 0);
+	/* clone cp_msg */
+	nmsg = gsm411_msgb_alloc();
+	memcpy(msgb_put(nmsg, inst->cp_msg->len), inst->cp_msg->data,
+		inst->cp_msg->len);
+	/* send MMSMS_DATA_REQ with CP-DATA */
+	return inst->mm_send(inst, GSM411_MMSMS_DATA_REQ, nmsg,
+				GSM411_MT_CP_DATA);
+}
+
+static int gsm411_mmsms_est_cnf(struct gsm411_smc_inst *inst, struct msgb *msg)
+{
+	if (!inst->cp_msg) {
+		LOGP(DLSMS, LOGL_FATAL, "EST CNF, but we have no cp_msg. This "
+			"should never happen, please fix!\n");
+		return -EINVAL;
+	}
+
+	return gsm411_mmsms_send_msg(inst);
+}
+
+/* SMC TC1* is expired */
+static void cp_timer_expired(void *data)
+{
+	struct gsm411_smc_inst *inst = data;
+	struct msgb *nmsg;
+
+	if (inst->cp_retx == inst->cp_max_retr) {
+
+		LOGP(DLSMS, LOGL_INFO, "TC1* timeout, no more retries.\n");
+		/* 5.3.2.1: enter idle state */
+		new_cp_state(inst, GSM411_CPS_IDLE);
+		/* indicate error */
+		nmsg = gsm411_msgb_alloc();
+		inst->mn_recv(inst, GSM411_MNSMS_ERROR_IND, nmsg);
+		msgb_free(nmsg);
+		/* free pending stored msg */
+		if (inst->cp_msg) {
+			msgb_free(inst->cp_msg);
+			inst->cp_msg = NULL;
+		}
+		/* release MM connection */
+		nmsg = gsm411_msgb_alloc();
+		inst->mm_send(inst, GSM411_MMSMS_REL_REQ, nmsg, 0);
+		return;
+	}
+
+	LOGP(DLSMS, LOGL_INFO, "TC1* timeout, retrying...\n");
+	inst->cp_retx++;
+	gsm411_mmsms_est_cnf(inst, NULL);
+}
+
+static int gsm411_mmsms_cp_ack(struct gsm411_smc_inst *inst, struct msgb *msg)
+{
+	/* free stored msg */
+	if (inst->cp_msg) {
+		msgb_free(inst->cp_msg);
+		inst->cp_msg = NULL;
+	}
+
+	LOGP(DLSMS, LOGL_INFO, "Received CP-ACK\n");
+	/* 5.3.2.1 enter MM Connection established */
+	new_cp_state(inst, GSM411_CPS_MM_ESTABLISHED);
+	/* 5.3.2.1: Reset Timer TC1* */
+	osmo_timer_del(&inst->cp_timer);
+
+	/* pending release? */
+	if (inst->cp_rel) {
+		struct msgb *nmsg;
+
+		LOGP(DLSMS, LOGL_INFO, "We have pending release.\n");
+		new_cp_state(inst, GSM411_CPS_IDLE);
+		/* release MM connection */
+		nmsg = gsm411_msgb_alloc();
+		return inst->mm_send(inst, GSM411_MMSMS_REL_REQ, nmsg, 0);
+	}
+
+	return 0;
+}
+
+static int gsm411_mmsms_cp_data(struct gsm411_smc_inst *inst, struct msgb *msg)
+{
+	struct msgb *nmsg;
+	int mt = GSM411_MNSMS_DATA_IND;
+
+	LOGP(DLSMS, LOGL_INFO, "Received CP-DATA\n");
+	/* 5.3.1 enter MM Connection established (if idle) */
+	if (inst->cp_state == GSM411_CPS_IDLE) {
+		new_cp_state(inst, GSM411_CPS_MM_ESTABLISHED);
+		mt = GSM411_MNSMS_EST_IND;
+		/* clear stored release flag */
+		inst->cp_rel = 0;
+	}
+	/* send MMSMS_DATA_REQ (CP ACK) */
+	nmsg = gsm411_msgb_alloc();
+	inst->mm_send(inst, GSM411_MMSMS_DATA_REQ, nmsg, GSM411_MT_CP_ACK);
+	/* indicate data */
+	inst->mn_recv(inst, mt, msg);
+
+	return 0;
+}
+
+/* send CP DATA */
+static int gsm411_mnsms_data_req(struct gsm411_smc_inst *inst, struct msgb *msg)
+{
+	if (inst->cp_msg) {
+		LOGP(DLSMS, LOGL_FATAL, "DATA REQ, but we already have an "
+			"cp_msg. This should never happen, please fix!\n");
+		msgb_free(inst->cp_msg);
+	}
+
+	/* store and send */
+	inst->cp_msg = msg;
+	return gsm411_mmsms_send_msg(inst);
+}
+
+/* release SMC connection */
+static int gsm411_mnsms_rel_req(struct gsm411_smc_inst *inst, struct msgb *msg)
+{
+	struct msgb *nmsg;
+
+	msgb_free(msg);
+
+	/* discard silently */
+	if (inst->cp_state == GSM411_CPS_IDLE)
+		return 0;
+
+	/* store release, until established or released */
+	if (inst->cp_state != GSM411_CPS_MM_ESTABLISHED) {
+		LOGP(DLSMS, LOGL_NOTICE,
+			"Cannot release yet current state: %s\n",
+			smc_state_names[inst->cp_state]);
+		inst->cp_rel = 1;
+		return 0;
+	}
+
+	/* free stored msg */
+	if (inst->cp_msg) {
+		msgb_free(inst->cp_msg);
+		inst->cp_msg = NULL;
+	}
+
+	new_cp_state(inst, GSM411_CPS_IDLE);
+	/* release MM connection */
+	nmsg = gsm411_msgb_alloc();
+	return inst->mm_send(inst, GSM411_MMSMS_REL_REQ, nmsg, 0);
+}
+
+static int gsm411_mmsms_cp_error(struct gsm411_smc_inst *inst, struct msgb *msg)
+{
+	struct msgb *nmsg;
+
+	/* free stored msg */
+	if (inst->cp_msg) {
+		msgb_free(inst->cp_msg);
+		inst->cp_msg = NULL;
+	}
+
+	LOGP(DLSMS, LOGL_INFO, "Received CP-ERROR\n");
+	/* 5.3.4 enter idle */
+	new_cp_state(inst, GSM411_CPS_IDLE);
+	/* indicate error */
+	inst->mn_recv(inst, GSM411_MNSMS_ERROR_IND, msg);
+	/* release MM connection */
+	nmsg = gsm411_msgb_alloc();
+	return inst->mm_send(inst, GSM411_MMSMS_REL_REQ, nmsg, 0);
+}
+
+static int gsm411_mmsms_rel_ind(struct gsm411_smc_inst *inst, struct msgb *msg)
+{
+	struct msgb *nmsg;
+
+	/* free stored msg */
+	if (inst->cp_msg) {
+		msgb_free(inst->cp_msg);
+		inst->cp_msg = NULL;
+	}
+
+	LOGP(DLSMS, LOGL_INFO, "MM layer is released\n");
+	/* 5.3.4 enter idle */
+	new_cp_state(inst, GSM411_CPS_IDLE);
+	/* indicate error */
+	nmsg = gsm411_msgb_alloc();
+	inst->mn_recv(inst, GSM411_MNSMS_ERROR_IND, nmsg);
+	msgb_free(nmsg);
+
+	return 0;
+}
+
+/* abort SMC connection */
+static int gsm411_mnsms_abort_req(struct gsm411_smc_inst *inst,
+	struct msgb *msg)
+{
+	struct msgb *nmsg;
+
+	/* free stored msg */
+	if (inst->cp_msg) {
+		msgb_free(inst->cp_msg);
+		inst->cp_msg = NULL;
+	}
+
+	/* 5.3.4 go idle */
+	new_cp_state(inst, GSM411_CPS_IDLE);
+	/* send MMSMS_DATA_REQ with CP-ERROR */
+	inst->mm_send(inst, GSM411_MMSMS_DATA_REQ, msg, GSM411_MT_CP_ERROR);
+	/* release MM connection */
+	nmsg = gsm411_msgb_alloc();
+	return inst->mm_send(inst, GSM411_MMSMS_REL_REQ, nmsg, 0);
+}
+
+/* statefull handling for MNSMS SAP messages */
+static struct smcdownstate {
+	uint32_t	states;
+	int		type;
+	const char 	*name;
+	int		(*rout) (struct gsm411_smc_inst *inst,
+					struct msgb *msg);
+} smcdownstatelist[] = {
+	/* establish request */
+	{SBIT(GSM411_CPS_IDLE),
+	GSM411_MNSMS_EST_REQ,
+	 "MNSMS-EST-REQ", gsm411_mnsms_est_req},
+
+	/* release request */
+	{ALL_STATES,
+	GSM411_MNSMS_REL_REQ,
+	 "MNSMS-REL-REQ", gsm411_mnsms_rel_req},
+
+	/* data request */
+	{SBIT(GSM411_CPS_MM_ESTABLISHED),
+	GSM411_MNSMS_DATA_REQ,
+	 "MNSMS-DATA-REQ", gsm411_mnsms_data_req},
+
+	/* abort request */
+	{ALL_STATES - SBIT(GSM411_CPS_IDLE),
+	GSM411_MNSMS_ABORT_REQ,
+	 "MNSMS-ABORT-REQ", gsm411_mnsms_abort_req},
+};
+
+#define SMCDOWNSLLEN \
+	(sizeof(smcdownstatelist) / sizeof(struct smcdownstate))
+
+/* message from upper layer */
+int gsm411_smc_send(struct gsm411_smc_inst *inst, int msg_type,
+	struct msgb *msg)
+{
+	int i, rc;
+
+	/* find function for current state and message */
+	for (i = 0; i < SMCDOWNSLLEN; i++) {
+		if ((msg_type == smcdownstatelist[i].type)
+		  && (SBIT(inst->cp_state) & smcdownstatelist[i].states))
+				break;
+	}
+	if (i == SMCDOWNSLLEN) {
+		LOGP(DLSMS, LOGL_NOTICE, "Message %u unhandled at this state "
+			"%s.\n", msg_type, smc_state_names[inst->cp_state]);
+		msgb_free(msg);
+		return 0;
+	}
+
+	LOGP(DLSMS, LOGL_INFO, "Message %s received in state %s\n",
+		smcdownstatelist[i].name, smc_state_names[inst->cp_state]);
+
+	rc = smcdownstatelist[i].rout(inst, msg);
+
+	return rc;
+}
+
+/* statefull handling for MMSMS SAP messages */
+static struct smcdatastate {
+	uint32_t	states;
+	int		type, cp_type;
+	const char 	*name;
+	int		(*rout) (struct gsm411_smc_inst *inst,
+					struct msgb *msg);
+} smcdatastatelist[] = {
+	/* establish confirm */
+	{SBIT(GSM411_CPS_MM_CONN_PENDING),
+	 GSM411_MMSMS_EST_CNF, 0,
+	 "MMSMS-EST-CNF", gsm411_mmsms_est_cnf},
+
+	/* establish indication (CP DATA) */
+	{SBIT(GSM411_CPS_IDLE),
+	 GSM411_MMSMS_EST_IND, GSM411_MT_CP_DATA,
+	 "MMSMS-EST-IND (CP DATA)", gsm411_mmsms_cp_data},
+
+	/* data indication (CP DATA) */
+	{SBIT(GSM411_CPS_MM_ESTABLISHED),
+	 GSM411_MMSMS_DATA_IND, GSM411_MT_CP_DATA,
+	 "MMSMS-DATA-IND (CP DATA)", gsm411_mmsms_cp_data},
+
+	/* data indication (CP ACK) */
+	{SBIT(GSM411_CPS_WAIT_CP_ACK),
+	 GSM411_MMSMS_DATA_IND, GSM411_MT_CP_ACK,
+	 "MMSMS-DATA-IND (CP ACK)", gsm411_mmsms_cp_ack},
+
+	/* data indication (CP ERROR) */
+	{ALL_STATES,
+	 GSM411_MMSMS_DATA_IND, GSM411_MT_CP_ERROR,
+	 "MMSMS-DATA-IND (CP_ERROR)", gsm411_mmsms_cp_error},
+
+	/* release indication */
+	{ALL_STATES - SBIT(GSM411_CPS_IDLE),
+	 GSM411_MMSMS_REL_IND, 0,
+	 "MMSMS-REL-IND", gsm411_mmsms_rel_ind},
+
+};
+
+#define SMCDATASLLEN \
+	(sizeof(smcdatastatelist) / sizeof(struct smcdatastate))
+
+/* message from lower layer
+ * WARNING: We must not free msg, since it will be performed by the
+ * lower layer. */
+int gsm411_smc_recv(struct gsm411_smc_inst *inst, int msg_type,
+	struct msgb *msg, int cp_msg_type)
+{
+	int i, rc;
+
+	/* find function for current state and message */
+	for (i = 0; i < SMCDATASLLEN; i++) {
+		/* state must machtch, MM message must match
+		 * CP msg must match only in case of MMSMS_DATA_IND
+		 */
+		if ((msg_type == smcdatastatelist[i].type)
+		  && (SBIT(inst->cp_state) & smcdatastatelist[i].states)
+		  && (msg_type != GSM411_MMSMS_DATA_IND
+		   || cp_msg_type == smcdatastatelist[i].cp_type))
+				break;
+	}
+	if (i == SMCDATASLLEN) {
+		LOGP(DLSMS, LOGL_NOTICE, "Message 0x%x/%u unhandled at this "
+			"state %s.\n", msg_type, cp_msg_type,
+			smc_state_names[inst->cp_state]);
+		if (msg_type == GSM411_MMSMS_EST_IND
+		 || msg_type == GSM411_MMSMS_DATA_IND) {
+			struct msgb *nmsg;
+
+			LOGP(DLSMS, LOGL_NOTICE, "RX Unimplemented CP "
+				"msg_type: 0x%02x\n", msg_type);
+			/* 5.3.4 enter idle */
+			new_cp_state(inst, GSM411_CPS_IDLE);
+			/* indicate error */
+			gsm411_tx_cp_error(inst,
+				GSM411_CP_CAUSE_MSGTYPE_NOTEXIST);
+			/* send error indication to upper layer */
+			nmsg = gsm411_msgb_alloc();
+			inst->mn_recv(inst, GSM411_MNSMS_ERROR_IND, nmsg);
+			msgb_free(nmsg);
+			/* release MM connection */
+			nmsg = gsm411_msgb_alloc();
+			return inst->mm_send(inst, GSM411_MMSMS_REL_REQ, nmsg,
+						0);
+		}
+		return 0;
+	}
+
+	LOGP(DLSMS, LOGL_INFO, "Message %s received in state %s\n",
+		smcdatastatelist[i].name, smc_state_names[inst->cp_state]);
+
+	rc = smcdatastatelist[i].rout(inst, msg);
+
+	return rc;
+}
diff --git a/src/shared/libosmocore/src/gsm/gsm0411_smr.c b/src/shared/libosmocore/src/gsm/gsm0411_smr.c
new file mode 100644
index 00000000..7dd8f723
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gsm0411_smr.c
@@ -0,0 +1,451 @@
+/* Point-to-Point (PP) Short Message Service (SMS)
+ * Support on Mobile Radio Interface
+ * 3GPP TS 04.11 version 7.1.0 Release 1998 / ETSI TS 100 942 V7.1.0 */
+
+/* (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
+ * (C) 2009 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2010 by On-Waves
+ * (C) 2011 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/* Notes on msg:
+ *
+ * Messages from lower layer are freed by lower layer.
+ *
+ * Messages to upper layer are freed after upper layer call returns, so upper
+ * layer cannot use data after returning. Upper layer must not free the msg.
+ *
+ * This implies: Lower layer messages can be forwarded to upper layer.
+ *
+ * Upper layer messages are freed by lower layer, so they must not be freed
+ * after calling lower layer.
+ *
+ *
+ * Notes on release:
+ *
+ * Sending Abort/Release (MNSMS-ABORT-REQ or MNSMS-REL-REQ) may cause the
+ * lower layer to become IDLE. Then it is allowed to destroy this instance,
+ * so sending this this MUST be the last thing that is done.
+ *
+ */
+
+
+#include <string.h>
+#include <errno.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/gsm/tlv.h>
+
+#include <osmocom/gsm/gsm0411_utils.h>
+#include <osmocom/gsm/gsm0411_smc.h>
+#include <osmocom/gsm/gsm0411_smr.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+static void rp_timer_expired(void *data);
+
+/* init a new instance */
+void gsm411_smr_init(struct gsm411_smr_inst *inst, int network,
+	int (*rl_recv) (struct gsm411_smr_inst *inst, int msg_type,
+			struct msgb *msg),
+	int (*mn_send) (struct gsm411_smr_inst *inst, int msg_type,
+			struct msgb *msg))
+{
+	memset(inst, 0, sizeof(*inst));
+	inst->network = network;
+	inst->rp_state = GSM411_RPS_IDLE;
+	inst->rl_recv = rl_recv;
+	inst->mn_send = mn_send;
+	inst->rp_timer.data = inst;
+	inst->rp_timer.cb = rp_timer_expired;
+
+	LOGP(DLSMS, LOGL_INFO, "New SMR instance created\n");
+}
+
+/* clear instance */
+void gsm411_smr_clear(struct gsm411_smr_inst *inst)
+{
+	LOGP(DLSMS, LOGL_INFO, "Clear SMR instance\n");
+
+	osmo_timer_del(&inst->rp_timer);
+}
+
+const char *smr_state_names[] = {
+	"IDLE",
+	"WAIT_FOR_RP_ACK",
+	"illegal state 2"
+	"WAIT_TO_TX_RP_ACK",
+	"WAIT_FOR_RETRANS_T",
+};
+
+const struct value_string gsm411_rp_cause_strs[] = {
+	{ GSM411_RP_CAUSE_MO_NUM_UNASSIGNED, "(MO) Number not assigned" },
+	{ GSM411_RP_CAUSE_MO_OP_DET_BARR, "(MO) Operator determined barring" },
+	{ GSM411_RP_CAUSE_MO_CALL_BARRED, "(MO) Call barred" },
+	{ GSM411_RP_CAUSE_MO_SMS_REJECTED, "(MO) SMS rejected" },
+	{ GSM411_RP_CAUSE_MO_DEST_OUT_OF_ORDER, "(MO) Destination out of order" },
+	{ GSM411_RP_CAUSE_MO_UNIDENTIFIED_SUBSCR, "(MO) Unidentified subscriber" },
+	{ GSM411_RP_CAUSE_MO_FACILITY_REJ, "(MO) Facility reject" },
+	{ GSM411_RP_CAUSE_MO_UNKNOWN_SUBSCR, "(MO) Unknown subscriber" },
+	{ GSM411_RP_CAUSE_MO_NET_OUT_OF_ORDER, "(MO) Network out of order" },
+	{ GSM411_RP_CAUSE_MO_TEMP_FAIL, "(MO) Temporary failure" },
+	{ GSM411_RP_CAUSE_MO_CONGESTION, "(MO) Congestion" },
+	{ GSM411_RP_CAUSE_MO_RES_UNAVAIL, "(MO) Resource unavailable" },
+	{ GSM411_RP_CAUSE_MO_REQ_FAC_NOTSUBSCR, "(MO) Requested facility not subscribed" },
+	{ GSM411_RP_CAUSE_MO_REQ_FAC_NOTIMPL, "(MO) Requested facility not implemented" },
+	{ GSM411_RP_CAUSE_MO_INTERWORKING, "(MO) Interworking" },
+	/* valid only for MT */
+	{ GSM411_RP_CAUSE_MT_MEM_EXCEEDED, "(MT) Memory Exceeded" },
+	/* valid for both directions */
+	{ GSM411_RP_CAUSE_INV_TRANS_REF, "Invalid Transaction Reference" },
+	{ GSM411_RP_CAUSE_SEMANT_INC_MSG, "Semantically Incorrect Message" },
+	{ GSM411_RP_CAUSE_INV_MAND_INF, "Invalid Mandatory Information" },
+	{ GSM411_RP_CAUSE_MSGTYPE_NOTEXIST, "Message Type non-existant" },
+	{ GSM411_RP_CAUSE_MSG_INCOMP_STATE, "Message incompatible with protocol state" },
+	{ GSM411_RP_CAUSE_IE_NOTEXIST, "Information Element not existing" },
+	{ GSM411_RP_CAUSE_PROTOCOL_ERR, "Protocol Error" },
+	{ 0, NULL }
+};
+
+static void new_rp_state(struct gsm411_smr_inst *inst,
+	enum gsm411_rp_state state)
+{
+	LOGP(DLSMS, LOGL_INFO, "New RP state %s -> %s\n",
+		smr_state_names[inst->rp_state], smr_state_names[state]);
+	inst->rp_state = state;
+
+	/* stop timer when going idle */
+	if (state == GSM411_RPS_IDLE)
+		osmo_timer_del(&inst->rp_timer);
+}
+
+/* Prefix msg with a RP-DATA header and send as CP-DATA */
+static int gsm411_rp_sendmsg(struct gsm411_smr_inst *inst, struct msgb *msg,
+			     uint8_t rp_msg_type, uint8_t rp_msg_ref,
+			     int mnsms_msg_type)
+{
+	struct gsm411_rp_hdr *rp;
+	uint8_t len = msg->len;
+
+	/* GSM 04.11 RP-DATA header */
+	rp = (struct gsm411_rp_hdr *)msgb_push(msg, sizeof(*rp));
+	rp->len = len + 2;
+	rp->msg_type = rp_msg_type;
+	rp->msg_ref = rp_msg_ref; /* FIXME: Choose randomly */
+
+	return inst->mn_send(inst, mnsms_msg_type, msg);
+}
+
+static int gsm411_send_rp_error(struct gsm411_smr_inst *inst,
+				uint8_t msg_ref, uint8_t cause)
+{
+	struct msgb *msg = gsm411_msgb_alloc();
+
+	msgb_tv_put(msg, 1, cause);
+
+	LOGP(DLSMS, LOGL_NOTICE, "TX: SMS RP ERROR, cause %d (%s)\n", cause,
+		get_value_string(gsm411_rp_cause_strs, cause));
+
+	return gsm411_rp_sendmsg(inst, msg,
+		(inst->network) ? GSM411_MT_RP_ERROR_MT : GSM411_MT_RP_ERROR_MO,
+		msg_ref, GSM411_MNSMS_DATA_REQ);
+}
+
+static int gsm411_send_release(struct gsm411_smr_inst *inst)
+{
+	struct msgb *msg = gsm411_msgb_alloc();
+
+	LOGP(DLSMS, LOGL_DEBUG, "TX: MNSMS-REL-REQ\n");
+
+	return inst->mn_send(inst, GSM411_MNSMS_REL_REQ, msg);
+}
+
+static int gsm411_send_abort(struct gsm411_smr_inst *inst)
+{
+	struct msgb *msg = gsm411_msgb_alloc();
+
+	msgb_tv_put(msg, 1, 111); //FIXME: better idea ? */
+	LOGP(DLSMS, LOGL_DEBUG, "TX: MNSMS-ABORT-REQ\n");
+
+	return inst->mn_send(inst, GSM411_MNSMS_ABORT_REQ, msg);
+}
+
+static int gsm411_send_report(struct gsm411_smr_inst *inst)
+{
+	struct msgb *msg = gsm411_msgb_alloc();
+
+	LOGP(DLSMS, LOGL_DEBUG, "Sending empty SM_RL_REPORT_IND\n");
+
+	return inst->rl_recv(inst, GSM411_SM_RL_REPORT_IND, msg);
+}
+
+static int gsm411_rl_data_req(struct gsm411_smr_inst *inst, struct msgb *msg)
+{
+	LOGP(DLSMS, LOGL_DEBUG,  "TX SMS RP-DATA\n");
+	/* start TR1N and enter 'wait for RP-ACK state' */
+	osmo_timer_schedule(&inst->rp_timer, GSM411_TMR_TR1M);
+	new_rp_state(inst, GSM411_RPS_WAIT_FOR_RP_ACK);
+
+	return inst->mn_send(inst, GSM411_MNSMS_EST_REQ, msg);
+}
+
+static int gsm411_rl_report_req(struct gsm411_smr_inst *inst, struct msgb *msg)
+{
+	LOGP(DLSMS, LOGL_DEBUG,  "TX SMS REPORT\n");
+	new_rp_state(inst, GSM411_RPS_IDLE);
+
+	inst->mn_send(inst, GSM411_MNSMS_DATA_REQ, msg);
+	gsm411_send_release(inst);
+	return 0;
+}
+
+static int gsm411_mnsms_est_ind(struct gsm411_smr_inst *inst, struct msgb *msg)
+{
+	struct gsm48_hdr *gh = (struct gsm48_hdr*)msg->l3h;
+	struct gsm411_rp_hdr *rp_data = (struct gsm411_rp_hdr*)&gh->data;
+	uint8_t msg_type =  rp_data->msg_type & 0x07;
+	int rc;
+
+	/* check direction */
+	if (inst->network == (msg_type & 1)) {
+		LOGP(DLSMS, LOGL_NOTICE, "Invalid RP type 0x%02x\n", msg_type);
+		gsm411_send_rp_error(inst, rp_data->msg_ref,
+					  GSM411_RP_CAUSE_MSG_INCOMP_STATE);
+		new_rp_state(inst, GSM411_RPS_IDLE);
+		gsm411_send_release(inst);
+		return -EINVAL;
+	}
+
+	switch (msg_type) {
+	case GSM411_MT_RP_DATA_MT:
+	case GSM411_MT_RP_DATA_MO:
+		LOGP(DLSMS, LOGL_DEBUG,  "RX SMS RP-DATA\n");
+		/* start TR2N and enter 'wait to send RP-ACK state' */
+		osmo_timer_schedule(&inst->rp_timer, GSM411_TMR_TR2M);
+		new_rp_state(inst, GSM411_RPS_WAIT_TO_TX_RP_ACK);
+		rc = inst->rl_recv(inst, GSM411_SM_RL_DATA_IND, msg);
+		break;
+	case GSM411_MT_RP_SMMA_MO:
+		LOGP(DLSMS, LOGL_DEBUG,  "RX SMS RP-SMMA\n");
+		/* start TR2N and enter 'wait to send RP-ACK state' */
+		osmo_timer_schedule(&inst->rp_timer, GSM411_TMR_TR2M);
+		new_rp_state(inst, GSM411_RPS_WAIT_TO_TX_RP_ACK);
+		rc = inst->rl_recv(inst, GSM411_SM_RL_DATA_IND, msg);
+		break;
+	default:
+		LOGP(DLSMS, LOGL_NOTICE, "Invalid RP type 0x%02x\n", msg_type);
+		gsm411_send_rp_error(inst, rp_data->msg_ref,
+					  GSM411_RP_CAUSE_MSGTYPE_NOTEXIST);
+		new_rp_state(inst, GSM411_RPS_IDLE);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
+
+static int gsm411_mnsms_data_ind_tx(struct gsm411_smr_inst *inst,
+	struct msgb *msg)
+{
+	struct gsm48_hdr *gh = (struct gsm48_hdr*)msg->l3h;
+	struct gsm411_rp_hdr *rp_data = (struct gsm411_rp_hdr*)&gh->data;
+	uint8_t msg_type =  rp_data->msg_type & 0x07;
+	int rc;
+
+	/* check direction */
+	if (inst->network == (msg_type & 1)) {
+		LOGP(DLSMS, LOGL_NOTICE, "Invalid RP type 0x%02x\n", msg_type);
+		gsm411_send_rp_error(inst, rp_data->msg_ref,
+					  GSM411_RP_CAUSE_MSG_INCOMP_STATE);
+		new_rp_state(inst, GSM411_RPS_IDLE);
+		gsm411_send_release(inst);
+		return -EINVAL;
+	}
+
+	switch (msg_type) {
+	case GSM411_MT_RP_ACK_MO:
+	case GSM411_MT_RP_ACK_MT:
+		LOGP(DLSMS, LOGL_DEBUG, "RX SMS RP-ACK\n");
+		new_rp_state(inst, GSM411_RPS_IDLE);
+		inst->rl_recv(inst, GSM411_SM_RL_REPORT_IND, msg);
+		gsm411_send_release(inst);
+		return 0;
+	case GSM411_MT_RP_ERROR_MO:
+	case GSM411_MT_RP_ERROR_MT:
+		LOGP(DLSMS, LOGL_DEBUG, "RX SMS RP-ERROR\n");
+		new_rp_state(inst, GSM411_RPS_IDLE);
+		inst->rl_recv(inst, GSM411_SM_RL_REPORT_IND, msg);
+		gsm411_send_release(inst);
+		return 0;
+	default:
+		LOGP(DLSMS, LOGL_NOTICE, "Invalid RP type 0x%02x\n", msg_type);
+		gsm411_send_rp_error(inst, rp_data->msg_ref,
+					  GSM411_RP_CAUSE_MSGTYPE_NOTEXIST);
+		new_rp_state(inst, GSM411_RPS_IDLE);
+		gsm411_send_release(inst);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+static int gsm411_mnsms_error_ind_tx(struct gsm411_smr_inst *inst,
+	struct msgb *msg)
+{
+	LOGP(DLSMS, LOGL_DEBUG, "RX SMS MNSMS-ERROR-IND\n");
+	new_rp_state(inst, GSM411_RPS_IDLE);
+	inst->rl_recv(inst, GSM411_SM_RL_REPORT_IND, msg);
+	gsm411_send_release(inst);
+	return 0;
+}
+
+static int gsm411_mnsms_error_ind_rx(struct gsm411_smr_inst *inst,
+	struct msgb *msg)
+{
+	LOGP(DLSMS, LOGL_DEBUG, "RX SMS MNSMS-ERROR-IND\n");
+	new_rp_state(inst, GSM411_RPS_IDLE);
+	return inst->rl_recv(inst, GSM411_SM_RL_REPORT_IND, msg);
+}
+
+/* SMR TR1* is expired */
+static void rp_timer_expired(void *data)
+{
+	struct gsm411_smr_inst *inst = data;
+
+	if (inst->rp_state == GSM411_RPS_WAIT_TO_TX_RP_ACK)
+		LOGP(DLSMS, LOGL_DEBUG, "TR2N\n");
+	else
+		LOGP(DLSMS, LOGL_DEBUG, "TR1N\n");
+	gsm411_send_report(inst);
+	gsm411_send_abort(inst);
+}
+
+/* statefull handling for SM-RL SAP messages */
+static struct smrdownstate {
+	uint32_t	states;
+	int		type;
+	const char 	*name;
+	int		(*rout) (struct gsm411_smr_inst *inst,
+					struct msgb *msg);
+} smrdownstatelist[] = {
+	/* data request */
+	{SBIT(GSM411_RPS_IDLE),
+	GSM411_SM_RL_DATA_REQ,
+	 "SM-RL-DATA_REQ", gsm411_rl_data_req},
+
+	/* report request */
+	{SBIT(GSM411_RPS_WAIT_TO_TX_RP_ACK),
+	GSM411_SM_RL_REPORT_REQ,
+	 "SM-RL-REPORT_REQ", gsm411_rl_report_req},
+};
+
+#define SMRDOWNSLLEN \
+	(sizeof(smrdownstatelist) / sizeof(struct smrdownstate))
+
+/* message from upper layer */
+int gsm411_smr_send(struct gsm411_smr_inst *inst, int msg_type,
+	struct msgb *msg)
+{
+	int i, rc;
+
+	/* find function for current state and message */
+	for (i = 0; i < SMRDOWNSLLEN; i++) {
+		if ((msg_type == smrdownstatelist[i].type)
+		  && (SBIT(inst->rp_state) & smrdownstatelist[i].states))
+				break;
+	}
+	if (i == SMRDOWNSLLEN) {
+		LOGP(DLSMS, LOGL_NOTICE, "Message %u unhandled at this state "
+			"%s.\n", msg_type, smr_state_names[inst->rp_state]);
+		msgb_free(msg);
+		return 0;
+	}
+
+	LOGP(DLSMS, LOGL_INFO, "Message %s received in state %s\n",
+		smrdownstatelist[i].name, smr_state_names[inst->rp_state]);
+
+	rc = smrdownstatelist[i].rout(inst, msg);
+
+	return rc;
+}
+
+/* statefull handling for MMSMS SAP messages */
+static struct smrdatastate {
+	uint32_t	states;
+	int		type;
+	const char 	*name;
+	int		(*rout) (struct gsm411_smr_inst *inst,
+					struct msgb *msg);
+} smrdatastatelist[] = {
+	/* establish indication */
+	{SBIT(GSM411_RPS_IDLE),
+	 GSM411_MNSMS_EST_IND,
+	 "MNSMS-EST-IND", gsm411_mnsms_est_ind},
+
+	/* data indication */
+	{SBIT(GSM411_RPS_WAIT_FOR_RP_ACK),
+	 GSM411_MNSMS_DATA_IND,
+	 "MNSMS-DATA-IND", gsm411_mnsms_data_ind_tx},
+
+	/* error indication */
+	{SBIT(GSM411_RPS_WAIT_FOR_RP_ACK),
+	 GSM411_MNSMS_ERROR_IND,
+	 "MNSMS-ERROR-IND", gsm411_mnsms_error_ind_tx},
+
+	/* error indication */
+	{SBIT(GSM411_RPS_WAIT_TO_TX_RP_ACK),
+	 GSM411_MNSMS_ERROR_IND,
+	 "MNSMS-ERROR-IND", gsm411_mnsms_error_ind_rx},
+
+};
+
+#define SMRDATASLLEN \
+	(sizeof(smrdatastatelist) / sizeof(struct smrdatastate))
+
+/* message from lower layer
+ * WARNING: We must not free msg, since it will be performed by the
+ * lower layer. */
+int gsm411_smr_recv(struct gsm411_smr_inst *inst, int msg_type,
+	struct msgb *msg)
+{
+	int i, rc;
+
+	/* find function for current state and message */
+	for (i = 0; i < SMRDATASLLEN; i++) {
+		/* state must machtch, MM message must match
+		 * CP msg must match only in case of MMSMS_DATA_IND
+		 */
+		if ((msg_type == smrdatastatelist[i].type)
+		  && (SBIT(inst->rp_state) & smrdatastatelist[i].states))
+			break;
+	}
+	if (i == SMRDATASLLEN) {
+		LOGP(DLSMS, LOGL_NOTICE, "Message %u unhandled at this state "
+			"%s.\n", msg_type, smr_state_names[inst->rp_state]);
+		return 0;
+	}
+
+	LOGP(DLSMS, LOGL_INFO, "Message %s received in state %s\n",
+		smrdatastatelist[i].name, smr_state_names[inst->rp_state]);
+
+	rc = smrdatastatelist[i].rout(inst, msg);
+
+	return rc;
+}
diff --git a/src/shared/libosmocore/src/gsm/gsm0411_utils.c b/src/shared/libosmocore/src/gsm/gsm0411_utils.c
new file mode 100644
index 00000000..fe69bf41
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gsm0411_utils.c
@@ -0,0 +1,314 @@
+/* Point-to-Point (PP) Short Message Service (SMS)
+ * Support on Mobile Radio Interface
+ * 3GPP TS 04.11 version 7.1.0 Release 1998 / ETSI TS 100 942 V7.1.0 */
+
+/* (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
+ * (C) 2009 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2010 by On-Waves
+ * (C) 2011 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "../../config.h"
+
+#include <time.h>
+#include <string.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/logging.h>
+
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/gsm/protocol/gsm_04_11.h>
+
+#define GSM411_ALLOC_SIZE	1024
+#define GSM411_ALLOC_HEADROOM	128
+
+struct msgb *gsm411_msgb_alloc(void)
+{
+	return msgb_alloc_headroom(GSM411_ALLOC_SIZE, GSM411_ALLOC_HEADROOM,
+				   "GSM 04.11");
+}
+
+/* Turn int into semi-octet representation: 98 => 0x89 */
+uint8_t gsm411_bcdify(uint8_t value)
+{
+	uint8_t ret;
+
+	ret = value / 10;
+	ret |= (value % 10) << 4;
+
+	return ret;
+}
+
+/* Turn semi-octet representation into int: 0x89 => 98 */
+uint8_t gsm411_unbcdify(uint8_t value)
+{
+	uint8_t ret;
+
+	if ((value & 0x0F) > 9 || (value >> 4) > 9)
+		LOGP(DLSMS, LOGL_ERROR,
+		     "gsm411_unbcdify got too big nibble: 0x%02X\n", value);
+
+	ret = (value&0x0F)*10;
+	ret += value>>4;
+
+	return ret;
+}
+
+/* Generate 03.40 TP-SCTS */
+void gsm340_gen_scts(uint8_t *scts, time_t time)
+{
+	struct tm *tm = gmtime(&time);
+
+	*scts++ = gsm411_bcdify(tm->tm_year % 100);
+	*scts++ = gsm411_bcdify(tm->tm_mon + 1);
+	*scts++ = gsm411_bcdify(tm->tm_mday);
+	*scts++ = gsm411_bcdify(tm->tm_hour);
+	*scts++ = gsm411_bcdify(tm->tm_min);
+	*scts++ = gsm411_bcdify(tm->tm_sec);
+#ifdef HAVE_TM_GMTOFF_IN_TM
+	*scts++ = gsm411_bcdify(tm->tm_gmtoff/(60*15));
+#else
+#warning find a portable way to obtain timezone offset
+	*scts++ = 0;
+#endif
+}
+
+/* Decode 03.40 TP-SCTS (into utc/gmt timestamp) */
+time_t gsm340_scts(uint8_t *scts)
+{
+	struct tm tm;
+	uint8_t yr = gsm411_unbcdify(*scts++);
+	int ofs;
+
+	memset(&tm, 0x00, sizeof(struct tm));
+
+	if (yr <= 80)
+		tm.tm_year = 100 + yr;
+	else
+		tm.tm_year = yr;
+	tm.tm_mon  = gsm411_unbcdify(*scts++) - 1;
+	tm.tm_mday = gsm411_unbcdify(*scts++);
+	tm.tm_hour = gsm411_unbcdify(*scts++);
+	tm.tm_min  = gsm411_unbcdify(*scts++);
+	tm.tm_sec  = gsm411_unbcdify(*scts++);
+#ifdef HAVE_TM_GMTOFF_IN_TM
+	tm.tm_gmtoff = gsm411_unbcdify(*scts++) * 15*60;
+#endif
+
+	/* according to gsm 03.40 time zone is
+	   "expressed in quarters of an hour" */
+	ofs = gsm411_unbcdify(*scts++) * 15*60;
+
+	return mktime(&tm) - ofs;
+}
+
+/* Return the default validity period in minutes */
+static unsigned long gsm340_vp_default(void)
+{
+	unsigned long minutes;
+	/* Default validity: two days */
+	minutes = 24 * 60 * 2;
+	return minutes;
+}
+
+/* Decode validity period format 'relative' */
+static unsigned long gsm340_vp_relative(uint8_t *sms_vp)
+{
+	/* Chapter 9.2.3.12.1 */
+	uint8_t vp;
+	unsigned long minutes;
+
+	vp = *(sms_vp);
+	if (vp <= 143)
+		minutes = vp + 1 * 5;
+	else if (vp <= 167)
+		minutes = 12*60 + (vp-143) * 30;
+	else if (vp <= 196)
+		minutes = vp-166 * 60 * 24;
+	else
+		minutes = vp-192 * 60 * 24 * 7;
+	return minutes;
+}
+
+/* Decode validity period format 'absolute' */
+static unsigned long gsm340_vp_absolute(uint8_t *sms_vp)
+{
+	/* Chapter 9.2.3.12.2 */
+	time_t expires, now;
+	unsigned long minutes;
+
+	expires = gsm340_scts(sms_vp);
+	now = time(NULL);
+	if (expires <= now)
+		minutes = 0;
+	else
+		minutes = (expires-now)/60;
+	return minutes;
+}
+
+/* Decode validity period format 'relative in integer representation' */
+static unsigned long gsm340_vp_relative_integer(uint8_t *sms_vp)
+{
+	uint8_t vp;
+	unsigned long minutes;
+	vp = *(sms_vp);
+	if (vp == 0) {
+		LOGP(DLSMS, LOGL_ERROR,
+		     "reserved relative_integer validity period\n");
+		return gsm340_vp_default();
+	}
+	minutes = vp/60;
+	return minutes;
+}
+
+/* Decode validity period format 'relative in semi-octet representation' */
+static unsigned long gsm340_vp_relative_semioctet(uint8_t *sms_vp)
+{
+	unsigned long minutes;
+	minutes = gsm411_unbcdify(*sms_vp++)*60;  /* hours */
+	minutes += gsm411_unbcdify(*sms_vp++);    /* minutes */
+	minutes += gsm411_unbcdify(*sms_vp++)/60; /* seconds */
+	return minutes;
+}
+
+/* decode validity period. return minutes */
+unsigned long gsm340_validity_period(uint8_t sms_vpf, uint8_t *sms_vp)
+{
+	uint8_t fi; /* functionality indicator */
+
+	switch (sms_vpf) {
+	case GSM340_TP_VPF_RELATIVE:
+		return gsm340_vp_relative(sms_vp);
+	case GSM340_TP_VPF_ABSOLUTE:
+		return gsm340_vp_absolute(sms_vp);
+	case GSM340_TP_VPF_ENHANCED:
+		/* Chapter 9.2.3.12.3 */
+		fi = *sms_vp++;
+		/* ignore additional fi */
+		if (fi & (1<<7)) sms_vp++;
+		/* read validity period format */
+		switch (fi & 0x7) {
+		case 0x0:
+			return gsm340_vp_default(); /* no vpf specified */
+		case 0x1:
+			return gsm340_vp_relative(sms_vp);
+		case 0x2:
+			return gsm340_vp_relative_integer(sms_vp);
+		case 0x3:
+			return gsm340_vp_relative_semioctet(sms_vp);
+		default:
+			/* The GSM spec says that the SC should reject any
+			   unsupported and/or undefined values. FIXME */
+			LOGP(DLSMS, LOGL_ERROR,
+			     "Reserved enhanced validity period format\n");
+			return gsm340_vp_default();
+		}
+	case GSM340_TP_VPF_NONE:
+	default:
+		return gsm340_vp_default();
+	}
+}
+
+/* determine coding alphabet dependent on GSM 03.38 Section 4 DCS */
+enum sms_alphabet gsm338_get_sms_alphabet(uint8_t dcs)
+{
+	uint8_t cgbits = dcs >> 4;
+	enum sms_alphabet alpha = DCS_NONE;
+
+	if ((cgbits & 0xc) == 0) {
+		if (cgbits & 2) {
+			LOGP(DLSMS, LOGL_NOTICE,
+			     "Compressed SMS not supported yet\n");
+			return 0xffffffff;
+		}
+
+		switch ((dcs >> 2)&0x03) {
+		case 0:
+			alpha = DCS_7BIT_DEFAULT;
+			break;
+		case 1:
+			alpha = DCS_8BIT_DATA;
+			break;
+		case 2:
+			alpha = DCS_UCS2;
+			break;
+		}
+	} else if (cgbits == 0xc || cgbits == 0xd)
+		alpha = DCS_7BIT_DEFAULT;
+	else if (cgbits == 0xe)
+		alpha = DCS_UCS2;
+	else if (cgbits == 0xf) {
+		if (dcs & 4)
+			alpha = DCS_8BIT_DATA;
+		else
+			alpha = DCS_7BIT_DEFAULT;
+	}
+
+	return alpha;
+}
+
+/* generate a TPDU address field compliant with 03.40 sec. 9.1.2.5 */
+int gsm340_gen_oa(uint8_t *oa, unsigned int oa_len, uint8_t type,
+	uint8_t plan, const char *number)
+{
+	int len_in_bytes;
+
+	/* prevent buffer overflows */
+	if (strlen(number) > 20)
+		number = "";
+
+	oa[1] = 0x80 | (type << 4) | plan;
+
+	len_in_bytes = gsm48_encode_bcd_number(oa, oa_len, 1, number);
+
+	/* GSM 03.40 tells us the length is in 'useful semi-octets' */
+	oa[0] = strlen(number) & 0xff;
+
+	return len_in_bytes;
+}
+
+/* Prefix msg with a RP header */
+int gsm411_push_rp_header(struct msgb *msg, uint8_t rp_msg_type,
+	uint8_t rp_msg_ref)
+{
+	struct gsm411_rp_hdr *rp;
+	uint8_t len = msg->len;
+
+	/* GSM 04.11 RP-DATA header */
+	rp = (struct gsm411_rp_hdr *)msgb_push(msg, sizeof(*rp));
+	rp->len = len + 2;
+	rp->msg_type = rp_msg_type;
+	rp->msg_ref = rp_msg_ref; /* FIXME: Choose randomly */
+
+	return 0;
+}
+
+/* Prefix msg with a 04.08/04.11 CP header */
+int gsm411_push_cp_header(struct msgb *msg, uint8_t proto, uint8_t trans,
+			     uint8_t msg_type)
+{
+	struct gsm48_hdr *gh;
+
+	gh = (struct gsm48_hdr *) msgb_push(msg, sizeof(*gh));
+	/* Outgoing needs the highest bit set */
+	gh->proto_discr = proto | (trans << 4);
+	gh->msg_type = msg_type;
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/gsm/gsm0480.c b/src/shared/libosmocore/src/gsm/gsm0480.c
new file mode 100644
index 00000000..b9b3ed97
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gsm0480.c
@@ -0,0 +1,461 @@
+/* Format functions for GSM 04.80 */
+
+/*
+ * (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009 by Mike Haben <michael.haben@btinternet.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/gsm/gsm0480.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <osmocom/core/logging.h>
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/protocol/gsm_04_80.h>
+
+#include <string.h>
+
+static inline unsigned char *msgb_wrap_with_TL(struct msgb *msgb, uint8_t tag)
+{
+	uint8_t *data = msgb_push(msgb, 2);
+
+	data[0] = tag;
+	data[1] = msgb->len - 2;
+	return data;
+}
+
+static inline unsigned char *msgb_push_TLV1(struct msgb *msgb, uint8_t tag,
+					    uint8_t value)
+{
+	uint8_t *data = msgb_push(msgb, 3);
+
+	data[0] = tag;
+	data[1] = 1;
+	data[2] = value;
+	return data;
+}
+
+/* wrap an invoke around it... the other way around
+ *
+ * 1.) Invoke Component tag
+ * 2.) Invoke ID Tag
+ * 3.) Operation
+ * 4.) Data
+ */
+int gsm0480_wrap_invoke(struct msgb *msg, int op, int link_id)
+{
+	/* 3. operation */
+	msgb_push_TLV1(msg, GSM0480_OPERATION_CODE, op);
+
+	/* 2. invoke id tag */
+	msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, link_id);
+
+	/* 1. component tag */
+	msgb_wrap_with_TL(msg, GSM0480_CTYPE_INVOKE);
+
+	return 0;
+}
+
+/* wrap the GSM 04.08 Facility IE around it */
+int gsm0480_wrap_facility(struct msgb *msg)
+{
+	msgb_wrap_with_TL(msg, GSM0480_IE_FACILITY);
+
+	return 0;
+}
+
+struct msgb *gsm0480_create_unstructuredSS_Notify(int alertPattern, const char *text)
+{
+	struct msgb *msg;
+	uint8_t *seq_len_ptr, *ussd_len_ptr, *data;
+	int len;
+
+	msg = msgb_alloc_headroom(1024, 128, "GSM 04.80");
+	if (!msg)
+		return NULL;
+
+	/* SEQUENCE { */
+	msgb_put_u8(msg, GSM_0480_SEQUENCE_TAG);
+	seq_len_ptr = msgb_put(msg, 1);
+
+	/* DCS { */
+	msgb_put_u8(msg, ASN1_OCTET_STRING_TAG);
+	msgb_put_u8(msg, 1);
+	msgb_put_u8(msg, 0x0F);
+	/* } DCS */
+
+	/* USSD-String { */
+	msgb_put_u8(msg, ASN1_OCTET_STRING_TAG);
+	ussd_len_ptr = msgb_put(msg, 1);
+	data = msgb_put(msg, 0);
+	len = gsm_7bit_encode(data, text);
+	msgb_put(msg, len);
+	ussd_len_ptr[0] = len;
+	/* USSD-String } */
+
+	/* alertingPattern { */
+	msgb_put_u8(msg, ASN1_OCTET_STRING_TAG);
+	msgb_put_u8(msg, 1);
+	msgb_put_u8(msg, alertPattern);
+	/* } alertingPattern */
+
+	seq_len_ptr[0] = 3 + 2 + ussd_len_ptr[0] + 3;
+	/* } SEQUENCE */
+
+	return msg;
+}
+
+struct msgb *gsm0480_create_notifySS(const char *text)
+{
+	struct msgb *msg;
+	uint8_t *data, *tmp_len;
+	uint8_t *seq_len_ptr, *cal_len_ptr, *opt_len_ptr, *nam_len_ptr;
+	int len;
+
+	len = strlen(text);
+	if (len < 1 || len > 160)
+		return NULL;
+
+	msg = msgb_alloc_headroom(1024, 128, "GSM 04.80");
+	if (!msg)
+		return NULL;
+
+	msgb_put_u8(msg, GSM_0480_SEQUENCE_TAG);
+	seq_len_ptr = msgb_put(msg, 1);
+
+	/* ss_code for CNAP { */
+	msgb_put_u8(msg, 0x81);
+	msgb_put_u8(msg, 1);
+	msgb_put_u8(msg, 0x19);
+	/* } ss_code */
+
+
+	/* nameIndicator { */
+	msgb_put_u8(msg, 0xB4);
+	nam_len_ptr = msgb_put(msg, 1);
+
+	/* callingName { */
+	msgb_put_u8(msg, 0xA0);
+	opt_len_ptr = msgb_put(msg, 1);
+	msgb_put_u8(msg, 0xA0);
+	cal_len_ptr = msgb_put(msg, 1);
+
+	/* namePresentationAllowed { */
+	/* add the DCS value */
+	msgb_put_u8(msg, 0x80);
+	msgb_put_u8(msg, 1);
+	msgb_put_u8(msg, 0x0F);
+
+	/* add the lengthInCharacters */
+	msgb_put_u8(msg, 0x81);
+	msgb_put_u8(msg, 1);
+	msgb_put_u8(msg, strlen(text));
+
+	/* add the actual string */
+	msgb_put_u8(msg, 0x82);
+	tmp_len = msgb_put(msg, 1);
+	data = msgb_put(msg, 0);
+	len = gsm_7bit_encode(data, text);
+	tmp_len[0] = len;
+	msgb_put(msg, len);
+
+	/* }; namePresentationAllowed */
+
+	cal_len_ptr[0] = 3 + 3 + 2 + len;
+	opt_len_ptr[0] = cal_len_ptr[0] + 2;
+	/* }; callingName */
+
+	nam_len_ptr[0] = opt_len_ptr[0] + 2;
+	/* ); nameIndicator */
+
+	/* write the lengths... */
+	seq_len_ptr[0] = 3 + nam_len_ptr[0] + 2;
+
+	return msg;
+}
+
+/* Forward declarations */
+static int parse_ussd(const struct gsm48_hdr *hdr,
+		      uint16_t len, struct ussd_request *req);
+static int parse_ussd_info_elements(const uint8_t *ussd_ie, uint16_t len,
+					struct ussd_request *req);
+static int parse_facility_ie(const uint8_t *facility_ie, uint16_t length,
+					struct ussd_request *req);
+static int parse_ss_invoke(const uint8_t *invoke_data, uint16_t length,
+					struct ussd_request *req);
+static int parse_process_uss_req(const uint8_t *uss_req_data, uint16_t length,
+					struct ussd_request *req);
+
+/* Decode a mobile-originated USSD-request message */
+int gsm0480_decode_ussd_request(const struct gsm48_hdr *hdr, uint16_t len,
+				struct ussd_request *req)
+{
+	int rc = 0;
+
+	if (len < sizeof(*hdr) + 2) {
+		LOGP(0, LOGL_DEBUG, "USSD Request is too short.\n");
+		return 0;
+	}
+
+	if ((hdr->proto_discr & 0x0f) == GSM48_PDISC_NC_SS) {
+		req->transaction_id = hdr->proto_discr & 0x70;
+		rc = parse_ussd(hdr, len, req);
+	}
+
+	if (!rc)
+		LOGP(0, LOGL_DEBUG, "Error occurred while parsing received USSD!\n");
+
+	return rc;
+}
+
+static int parse_ussd(const struct gsm48_hdr *hdr, uint16_t len, struct ussd_request *req)
+{
+	int rc = 1;
+	uint8_t msg_type = hdr->msg_type & 0xBF;  /* message-type - section 3.4 */
+
+	switch (msg_type) {
+	case GSM0480_MTYPE_RELEASE_COMPLETE:
+		LOGP(0, LOGL_DEBUG, "USS Release Complete\n");
+		/* could also parse out the optional Cause/Facility data */
+		req->text[0] = 0xFF;
+		break;
+	case GSM0480_MTYPE_REGISTER:
+	case GSM0480_MTYPE_FACILITY:
+		rc &= parse_ussd_info_elements(&hdr->data[0], len - sizeof(*hdr), req);
+		break;
+	default:
+		LOGP(0, LOGL_DEBUG, "Unknown GSM 04.80 message-type field 0x%02x\n",
+			hdr->msg_type);
+		rc = 0;
+		break;
+	}
+
+	return rc;
+}
+
+static int parse_ussd_info_elements(const uint8_t *ussd_ie, uint16_t len,
+				    struct ussd_request *req)
+{
+	int rc = -1;
+	/* Information Element Identifier - table 3.2 & GSM 04.08 section 10.5 */
+	uint8_t iei;
+	uint8_t iei_length;
+
+	iei = ussd_ie[0];
+	iei_length = ussd_ie[1];
+
+	/* If the data does not fit, report an error */
+	if (len - 2 < iei_length)
+		return 0;
+
+	switch (iei) {
+	case GSM48_IE_CAUSE:
+		break;
+	case GSM0480_IE_FACILITY:
+		rc = parse_facility_ie(ussd_ie+2, iei_length, req);
+		break;
+	case GSM0480_IE_SS_VERSION:
+		break;
+	default:
+		LOGP(0, LOGL_DEBUG, "Unhandled GSM 04.08 or 04.80 IEI 0x%02x\n",
+			iei);
+		rc = 0;
+		break;
+	}
+
+	return rc;
+}
+
+static int parse_facility_ie(const uint8_t *facility_ie, uint16_t length,
+						struct ussd_request *req)
+{
+	int rc = 1;
+	uint8_t offset = 0;
+
+	while (offset + 2 <= length) {
+		/* Component Type tag - table 3.7 */
+		uint8_t component_type = facility_ie[offset];
+		uint8_t component_length = facility_ie[offset+1];
+
+		/* size check */
+		if (offset + 2 + component_length > length) {
+			LOGP(0, LOGL_ERROR, "Component does not fit.\n");
+			return 0;
+		}
+
+		switch (component_type) {
+		case GSM0480_CTYPE_INVOKE:
+			rc &= parse_ss_invoke(facility_ie+2,
+						component_length,
+						req);
+			break;
+		case GSM0480_CTYPE_RETURN_RESULT:
+			break;
+		case GSM0480_CTYPE_RETURN_ERROR:
+			break;
+		case GSM0480_CTYPE_REJECT:
+			break;
+		default:
+			LOGP(0, LOGL_DEBUG, "Unknown GSM 04.80 Facility "
+				"Component Type 0x%02x\n", component_type);
+			rc = 0;
+			break;
+		}
+		offset += (component_length+2);
+	};
+
+	return rc;
+}
+
+/* Parse an Invoke component - see table 3.3 */
+static int parse_ss_invoke(const uint8_t *invoke_data, uint16_t length,
+						struct ussd_request *req)
+{
+	int rc = 1;
+	uint8_t offset;
+
+	if (length < 3)
+		return 0;
+
+	/* mandatory part */
+	if (invoke_data[0] != GSM0480_COMPIDTAG_INVOKE_ID) {
+		LOGP(0, LOGL_DEBUG, "Unexpected GSM 04.80 Component-ID tag "
+			"0x%02x (expecting Invoke ID tag)\n", invoke_data[0]);
+	}
+
+	offset = invoke_data[1] + 2;
+	req->invoke_id = invoke_data[2];
+
+	/* look ahead once */
+	if (offset + 1 > length)
+		return 0;
+
+	/* optional part */
+	if (invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID)
+		offset += invoke_data[offset+1] + 2;  /* skip over it */
+
+	/* mandatory part */
+	if (invoke_data[offset] == GSM0480_OPERATION_CODE) {
+		if (offset + 2 > length)
+			return 0;
+		uint8_t operation_code = invoke_data[offset+2];
+		switch (operation_code) {
+		case GSM0480_OP_CODE_PROCESS_USS_REQ:
+			rc = parse_process_uss_req(invoke_data + offset + 3,
+						   length - offset - 3,
+						   req);
+			break;
+		default:
+			LOGP(0, LOGL_DEBUG, "GSM 04.80 operation code 0x%02x "
+				"is not yet handled\n", operation_code);
+			rc = 0;
+			break;
+		}
+	} else {
+		LOGP(0, LOGL_DEBUG, "Unexpected GSM 04.80 Component-ID tag 0x%02x "
+			"(expecting Operation Code tag)\n",
+			invoke_data[0]);
+		rc = 0;
+	}
+
+	return rc;
+}
+
+/* Parse the parameters of a Process UnstructuredSS Request */
+static int parse_process_uss_req(const uint8_t *uss_req_data, uint16_t length,
+					struct ussd_request *req)
+{
+	int rc = 0;
+	int num_chars;
+	uint8_t dcs;
+
+
+	/* we need at least that much */
+	if (length < 8)
+		return 0;
+
+
+	if (uss_req_data[0] == GSM_0480_SEQUENCE_TAG) {
+		if (uss_req_data[2] == ASN1_OCTET_STRING_TAG) {
+			dcs = uss_req_data[4];
+			if ((dcs == 0x0F) &&
+			    (uss_req_data[5] == ASN1_OCTET_STRING_TAG)) {
+				num_chars = (uss_req_data[6] * 8) / 7;
+				/* Prevent a mobile-originated buffer-overrun! */
+				if (num_chars > MAX_LEN_USSD_STRING)
+					num_chars = MAX_LEN_USSD_STRING;
+				gsm_7bit_decode(req->text,
+						&(uss_req_data[7]), num_chars);
+				rc = 1;
+			}
+		}
+	}
+	return rc;
+}
+
+struct msgb *gsm0480_create_ussd_resp(uint8_t invoke_id, uint8_t trans_id, const char *text)
+{
+	struct msgb *msg;
+	struct gsm48_hdr *gh;
+	uint8_t *ptr8;
+	int response_len;
+
+	msg = msgb_alloc_headroom(1024, 128, "GSM 04.80");
+	if (!msg)
+		return NULL;
+
+	/* First put the payload text into the message */
+	ptr8 = msgb_put(msg, 0);
+	response_len = gsm_7bit_encode(ptr8, text);
+	msgb_put(msg, response_len);
+
+	/* Then wrap it as an Octet String */
+	msgb_wrap_with_TL(msg, ASN1_OCTET_STRING_TAG);
+
+	/* Pre-pend the DCS octet string */
+	msgb_push_TLV1(msg, ASN1_OCTET_STRING_TAG, 0x0F);
+
+	/* Then wrap these as a Sequence */
+	msgb_wrap_with_TL(msg, GSM_0480_SEQUENCE_TAG);
+
+	/* Pre-pend the operation code */
+	msgb_push_TLV1(msg, GSM0480_OPERATION_CODE,
+			GSM0480_OP_CODE_PROCESS_USS_REQ);
+
+	/* Wrap the operation code and IA5 string as a sequence */
+	msgb_wrap_with_TL(msg, GSM_0480_SEQUENCE_TAG);
+
+	/* Pre-pend the invoke ID */
+	msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, invoke_id);
+
+	/* Wrap this up as a Return Result component */
+	msgb_wrap_with_TL(msg, GSM0480_CTYPE_RETURN_RESULT);
+
+	/* Wrap the component in a Facility message */
+	msgb_wrap_with_TL(msg, GSM0480_IE_FACILITY);
+
+	/* And finally pre-pend the L3 header */
+	gh = (struct gsm48_hdr *) msgb_push(msg, sizeof(*gh));
+	gh->proto_discr = GSM48_PDISC_NC_SS | trans_id
+					| (1<<7);  /* TI direction = 1 */
+	gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE;
+
+	return msg;
+}
diff --git a/src/shared/libosmocore/src/gsm/gsm0502.c b/src/shared/libosmocore/src/gsm/gsm0502.c
new file mode 100644
index 00000000..df1d8e9e
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gsm0502.c
@@ -0,0 +1,43 @@
+/* Paging helper code */
+
+/* (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/gsm0502.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/gsm/rsl.h>
+
+unsigned int
+gsm0502_calc_paging_group(struct gsm48_control_channel_descr *chan_desc, uint64_t imsi)
+{
+	int ccch_conf;
+	int bs_cc_chans;
+	int blocks;
+	unsigned int group;
+
+	ccch_conf = chan_desc->ccch_conf;
+	bs_cc_chans = rsl_ccch_conf_to_bs_cc_chans(ccch_conf);
+	/* code word + 2, as 2 channels equals 0x0 */
+	blocks = gsm48_number_of_paging_subchannels(chan_desc);
+	group = gsm0502_get_paging_group(imsi, bs_cc_chans, blocks);
+
+	return group;
+}
diff --git a/src/shared/libosmocore/src/gsm/gsm0808.c b/src/shared/libosmocore/src/gsm/gsm0808.c
new file mode 100644
index 00000000..30098278
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gsm0808.c
@@ -0,0 +1,402 @@
+/* (C) 2009,2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009,2010 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/gsm/gsm0808.h>
+#include <osmocom/gsm/protocol/gsm_08_08.h>
+#include <osmocom/gsm/gsm48.h>
+
+#include <arpa/inet.h>
+
+#define BSSMAP_MSG_SIZE 512
+#define BSSMAP_MSG_HEADROOM 128
+
+struct msgb *gsm0808_create_layer3(struct msgb *msg_l3, uint16_t nc, uint16_t cc, int lac, uint16_t _ci)
+{
+	struct msgb* msg;
+	struct {
+		uint8_t ident;
+		struct gsm48_loc_area_id lai;
+		uint16_t ci;
+	} __attribute__ ((packed)) lai_ci;
+
+	msg  = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+				   "bssmap cmpl l3");
+	if (!msg)
+		return NULL;
+
+	/* create layer 3 header */
+	msgb_v_put(msg, BSS_MAP_MSG_COMPLETE_LAYER_3);
+
+	/* create the cell header */
+	lai_ci.ident = CELL_IDENT_WHOLE_GLOBAL;
+	gsm48_generate_lai(&lai_ci.lai, cc, nc, lac);
+	lai_ci.ci = htons(_ci);
+	msgb_tlv_put(msg, GSM0808_IE_CELL_IDENTIFIER, sizeof(lai_ci),
+		     (uint8_t *) &lai_ci);
+
+	/* copy the layer3 data */
+	msgb_tlv_put(msg, GSM0808_IE_LAYER_3_INFORMATION,
+		     msgb_l3len(msg_l3), msg_l3->l3h);
+
+	/* push the bssmap header */
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+
+	return msg;
+}
+
+struct msgb *gsm0808_create_reset(void)
+{
+	uint8_t cause = GSM0808_CAUSE_EQUIPMENT_FAILURE;
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "bssmap: reset");
+	if (!msg)
+		return NULL;
+
+	msgb_v_put(msg, BSS_MAP_MSG_RESET);
+	msgb_tlv_put(msg, GSM0808_IE_CAUSE, 1, &cause);
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+
+	return msg;
+}
+
+struct msgb *gsm0808_create_clear_complete(void)
+{
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "bssmap: clear complete");
+	uint8_t val = BSS_MAP_MSG_CLEAR_COMPLETE;
+	if (!msg)
+		return NULL;
+
+	msg->l3h = msg->data;
+	msgb_tlv_put(msg, BSSAP_MSG_BSS_MANAGEMENT, 1, &val);
+
+	return msg;
+}
+
+struct msgb *gsm0808_create_clear_command(uint8_t reason)
+{
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "bssmap: clear command");
+	if (!msg)
+		return NULL;
+
+	msg->l3h = msgb_tv_put(msg, BSSAP_MSG_BSS_MANAGEMENT, 4);
+	msgb_v_put(msg, BSS_MAP_MSG_CLEAR_CMD);
+	msgb_tlv_put(msg, GSM0808_IE_CAUSE, 1, &reason);
+
+	return msg;
+}
+
+struct msgb *gsm0808_create_cipher_complete(struct msgb *layer3, uint8_t alg_id)
+{
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "cipher-complete");
+	if (!msg)
+		return NULL;
+
+        /* send response with BSS override for A5/1... cheating */
+	msgb_v_put(msg, BSS_MAP_MSG_CIPHER_MODE_COMPLETE);
+
+	/* include layer3 in case we have at least two octets */
+	if (layer3 && msgb_l3len(layer3) > 2) {
+		msg->l4h = msgb_tlv_put(msg, GSM0808_IE_LAYER_3_MESSAGE_CONTENTS,
+					msgb_l3len(layer3), layer3->l3h);
+	}
+
+	/* and the optional BSS message */
+	msgb_tv_put(msg, GSM0808_IE_CHOSEN_ENCR_ALG, alg_id);
+
+	/* pre-pend the header */
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+
+	return msg;
+}
+
+struct msgb *gsm0808_create_cipher_reject(uint8_t cause)
+{
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "bssmap: clear complete");
+	if (!msg)
+		return NULL;
+
+	msgb_tv_put(msg, BSS_MAP_MSG_CIPHER_MODE_REJECT, cause);
+
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+
+	return msg;
+}
+
+struct msgb *gsm0808_create_classmark_update(const uint8_t *cm2, uint8_t cm2_len,
+					     const uint8_t *cm3, uint8_t cm3_len)
+{
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "classmark-update");
+	if (!msg)
+		return NULL;
+
+	msgb_v_put(msg, BSS_MAP_MSG_CLASSMARK_UPDATE);
+	msgb_tlv_put(msg, GSM0808_IE_CLASSMARK_INFORMATION_T2, cm2_len, cm2);
+	if (cm3)
+		msgb_tlv_put(msg, GSM0808_IE_CLASSMARK_INFORMATION_T3,
+			     cm3_len, cm3);
+
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+
+	return msg;
+}
+
+struct msgb *gsm0808_create_sapi_reject(uint8_t link_id)
+{
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "bssmap: sapi 'n' reject");
+	if (!msg)
+		return NULL;
+
+	msgb_v_put(msg, BSS_MAP_MSG_SAPI_N_REJECT);
+	msgb_v_put(msg, link_id);
+	msgb_v_put(msg, GSM0808_CAUSE_BSS_NOT_EQUIPPED);
+
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+
+	return msg;
+}
+
+struct msgb *gsm0808_create_assignment_completed(uint8_t rr_cause,
+						 uint8_t chosen_channel, uint8_t encr_alg_id,
+						 uint8_t speech_mode)
+{
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+						"bssmap: ass compl");
+	if (!msg)
+		return NULL;
+
+	msgb_v_put(msg, BSS_MAP_MSG_ASSIGMENT_COMPLETE);
+
+	/* write 3.2.2.22 */
+	msgb_tv_put(msg, GSM0808_IE_RR_CAUSE, rr_cause);
+
+	/* write cirtcuit identity  code 3.2.2.2 */
+	/* write cell identifier 3.2.2.17 */
+	/* write chosen channel 3.2.2.33 when BTS picked it */
+	msgb_tv_put(msg, GSM0808_IE_CHOSEN_CHANNEL, chosen_channel);
+
+	/* write chosen encryption algorithm 3.2.2.44 */
+	msgb_tv_put(msg, GSM0808_IE_CHOSEN_ENCR_ALG, encr_alg_id);
+
+	/* write circuit pool 3.2.2.45 */
+	/* write speech version chosen: 3.2.2.51 when BTS picked it */
+	if (speech_mode != 0)
+		msgb_tv_put(msg, GSM0808_IE_SPEECH_VERSION, speech_mode);
+
+	/* write LSA identifier 3.2.2.15 */
+
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+
+	return msg;
+}
+
+struct msgb *gsm0808_create_assignment_failure(uint8_t cause, uint8_t *rr_cause)
+{
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "bssmap: ass fail");
+	if (!msg)
+		return NULL;
+
+	msgb_v_put(msg, BSS_MAP_MSG_ASSIGMENT_FAILURE);
+	msgb_tlv_put(msg, GSM0808_IE_CAUSE, 1, &cause);
+
+	/* RR cause 3.2.2.22 */
+	if (rr_cause)
+		msgb_tv_put(msg, GSM0808_IE_RR_CAUSE, *rr_cause);
+
+	/* Circuit pool 3.22.45 */
+	/* Circuit pool list 3.2.2.46 */
+
+	/* update the size */
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+
+	return msg;
+}
+
+struct msgb *gsm0808_create_clear_rqst(uint8_t cause)
+{
+	struct msgb *msg;
+
+	msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+				  "bssmap: clear rqst");
+	if (!msg)
+		return NULL;
+
+	msgb_v_put(msg, BSS_MAP_MSG_CLEAR_RQST);
+	msgb_tlv_put(msg, GSM0808_IE_CAUSE, 1, &cause);
+	msg->l3h = msgb_tv_push(msg, BSSAP_MSG_BSS_MANAGEMENT, msgb_length(msg));
+
+	return msg;
+}
+
+void gsm0808_prepend_dtap_header(struct msgb *msg, uint8_t link_id)
+{
+	uint8_t *hh = msgb_push(msg, 3);
+	hh[0] = BSSAP_MSG_DTAP;
+	hh[1] = link_id;
+	hh[2] = msg->len - 3;
+}
+
+struct msgb *gsm0808_create_dtap(struct msgb *msg_l3, uint8_t link_id)
+{
+	struct dtap_header *header;
+	uint8_t *data;
+	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
+					       "dtap");
+	if (!msg)
+		return NULL;
+
+	/* DTAP header */
+	msg->l3h = msgb_put(msg, sizeof(*header));
+	header = (struct dtap_header *) &msg->l3h[0];
+	header->type = BSSAP_MSG_DTAP;
+	header->link_id = link_id;
+	header->length = msgb_l3len(msg_l3);
+
+	/* Payload */
+	data = msgb_put(msg, header->length);
+	memcpy(data, msg_l3->l3h, header->length);
+
+	return msg;
+}
+
+static const struct tlv_definition bss_att_tlvdef = {
+	.def = {
+		[GSM0808_IE_IMSI]		    = { TLV_TYPE_TLV },
+		[GSM0808_IE_TMSI]		    = { TLV_TYPE_TLV },
+		[GSM0808_IE_CELL_IDENTIFIER_LIST]   = { TLV_TYPE_TLV },
+		[GSM0808_IE_CHANNEL_NEEDED]	    = { TLV_TYPE_TV },
+		[GSM0808_IE_EMLPP_PRIORITY]	    = { TLV_TYPE_TV },
+		[GSM0808_IE_CHANNEL_TYPE]	    = { TLV_TYPE_TLV },
+		[GSM0808_IE_PRIORITY]		    = { TLV_TYPE_TLV },
+		[GSM0808_IE_CIRCUIT_IDENTITY_CODE]  = { TLV_TYPE_FIXED, 2 },
+		[GSM0808_IE_DOWNLINK_DTX_FLAG]	    = { TLV_TYPE_TV },
+		[GSM0808_IE_INTERFERENCE_BAND_TO_USE] = { TLV_TYPE_TV },
+		[GSM0808_IE_CLASSMARK_INFORMATION_T2] = { TLV_TYPE_TLV },
+		[GSM0808_IE_GROUP_CALL_REFERENCE]   = { TLV_TYPE_TLV },
+		[GSM0808_IE_TALKER_FLAG]	    = { TLV_TYPE_T },
+		[GSM0808_IE_CONFIG_EVO_INDI]	    = { TLV_TYPE_TV },
+		[GSM0808_IE_LSA_ACCESS_CTRL_SUPPR]  = { TLV_TYPE_TV },
+		[GSM0808_IE_SERVICE_HANDOVER]	    = { TLV_TYPE_TLV },
+		[GSM0808_IE_ENCRYPTION_INFORMATION] = { TLV_TYPE_TLV },
+		[GSM0808_IE_CIPHER_RESPONSE_MODE]   = { TLV_TYPE_TV },
+		[GSM0808_IE_CELL_IDENTIFIER]	    = { TLV_TYPE_TLV },
+		[GSM0808_IE_CHOSEN_CHANNEL]	    = { TLV_TYPE_TV },
+		[GSM0808_IE_LAYER_3_INFORMATION]    = { TLV_TYPE_TLV },
+		[GSM0808_IE_SPEECH_VERSION]         = { TLV_TYPE_TV },
+		[GSM0808_IE_CHOSEN_ENCR_ALG]        = { TLV_TYPE_TV },
+	},
+};
+
+const struct tlv_definition *gsm0808_att_tlvdef(void)
+{
+	return &bss_att_tlvdef;
+}
+
+static const struct value_string gsm0808_msgt_names[] = {
+	{ BSS_MAP_MSG_ASSIGMENT_RQST,		"ASSIGNMENT REQ" },
+	{ BSS_MAP_MSG_ASSIGMENT_COMPLETE,	"ASSIGNMENT COMPL" },
+	{ BSS_MAP_MSG_ASSIGMENT_FAILURE,	"ASSIGNMENT FAIL" },
+
+	{ BSS_MAP_MSG_HANDOVER_RQST,		"HANDOVER REQ" },
+	{ BSS_MAP_MSG_HANDOVER_REQUIRED,	"HANDOVER REQUIRED" },
+	{ BSS_MAP_MSG_HANDOVER_RQST_ACKNOWLEDGE,"HANDOVER REQ ACK" },
+	{ BSS_MAP_MSG_HANDOVER_CMD,		"HANDOVER CMD" },
+	{ BSS_MAP_MSG_HANDOVER_COMPLETE,	"HANDOVER COMPLETE" },
+	{ BSS_MAP_MSG_HANDOVER_SUCCEEDED,	"HANDOVER SUCCESS" },
+	{ BSS_MAP_MSG_HANDOVER_FAILURE,		"HANDOVER FAILURE" },
+	{ BSS_MAP_MSG_HANDOVER_PERFORMED,	"HANDOVER PERFORMED" },
+	{ BSS_MAP_MSG_HANDOVER_CANDIDATE_ENQUIRE, "HANDOVER CAND ENQ" },
+	{ BSS_MAP_MSG_HANDOVER_CANDIDATE_RESPONSE, "HANDOVER CAND RESP" },
+	{ BSS_MAP_MSG_HANDOVER_REQUIRED_REJECT,	"HANDOVER REQ REJ" },
+	{ BSS_MAP_MSG_HANDOVER_DETECT,		"HANDOVER DETECT" },
+
+	{ BSS_MAP_MSG_CLEAR_CMD,		"CLEAR COMMAND" },
+	{ BSS_MAP_MSG_CLEAR_COMPLETE,		"CLEAR COMPLETE" },
+	{ BSS_MAP_MSG_CLEAR_RQST,		"CLEAR REQUEST" },
+	{ BSS_MAP_MSG_SAPI_N_REJECT,		"SAPI N REJECT" },
+	{ BSS_MAP_MSG_CONFUSION,		"CONFUSION" },
+
+	{ BSS_MAP_MSG_SUSPEND,			"SUSPEND" },
+	{ BSS_MAP_MSG_RESUME,			"RESUME" },
+	{ BSS_MAP_MSG_CONNECTION_ORIENTED_INFORMATION, "CONN ORIENT INFO" },
+	{ BSS_MAP_MSG_PERFORM_LOCATION_RQST,	"PERFORM LOC REQ" },
+	{ BSS_MAP_MSG_LSA_INFORMATION,		"LSA INFORMATION" },
+	{ BSS_MAP_MSG_PERFORM_LOCATION_RESPONSE, "PERFORM LOC RESP" },
+	{ BSS_MAP_MSG_PERFORM_LOCATION_ABORT,	"PERFORM LOC ABORT" },
+	{ BSS_MAP_MSG_COMMON_ID,		"COMMON ID" },
+
+	{ BSS_MAP_MSG_RESET,			"RESET" },
+	{ BSS_MAP_MSG_RESET_ACKNOWLEDGE,	"RESET ACK" },
+	{ BSS_MAP_MSG_OVERLOAD,			"OVERLOAD" },
+	{ BSS_MAP_MSG_RESET_CIRCUIT,		"RESET CIRCUIT" },
+	{ BSS_MAP_MSG_RESET_CIRCUIT_ACKNOWLEDGE, "RESET CIRCUIT ACK" },
+	{ BSS_MAP_MSG_MSC_INVOKE_TRACE,		"MSC INVOKE TRACE" },
+	{ BSS_MAP_MSG_BSS_INVOKE_TRACE,		"BSS INVOKE TRACE" },
+	{ BSS_MAP_MSG_CONNECTIONLESS_INFORMATION, "CONNLESS INFO" },
+
+	{ BSS_MAP_MSG_BLOCK,			"BLOCK" },
+	{ BSS_MAP_MSG_BLOCKING_ACKNOWLEDGE,	"BLOCK ACK" },
+	{ BSS_MAP_MSG_UNBLOCK,			"UNBLOCK" },
+	{ BSS_MAP_MSG_UNBLOCKING_ACKNOWLEDGE,	"UNBLOCK ACK" },
+	{ BSS_MAP_MSG_CIRCUIT_GROUP_BLOCK,	"CIRC GROUP BLOCK" },
+	{ BSS_MAP_MSG_CIRCUIT_GROUP_BLOCKING_ACKNOWLEDGE, "CIRC GORUP BLOCK ACK" },
+	{ BSS_MAP_MSG_CIRCUIT_GROUP_UNBLOCK,	"CIRC GROUP UNBLOCK" },
+	{ BSS_MAP_MSG_CIRCUIT_GROUP_UNBLOCKING_ACKNOWLEDGE, "CIRC GROUP UNBLOCK ACK" },
+	{ BSS_MAP_MSG_UNEQUIPPED_CIRCUIT,	"UNEQUIPPED CIRCUIT" },
+	{ BSS_MAP_MSG_CHANGE_CIRCUIT,		"CHANGE CIRCUIT" },
+	{ BSS_MAP_MSG_CHANGE_CIRCUIT_ACKNOWLEDGE, "CHANGE CIRCUIT ACK" },
+
+	{ BSS_MAP_MSG_RESOURCE_RQST,		"RESOURCE REQ" },
+	{ BSS_MAP_MSG_RESOURCE_INDICATION,	"RESOURCE IND" },
+	{ BSS_MAP_MSG_PAGING,			"PAGING" },
+	{ BSS_MAP_MSG_CIPHER_MODE_CMD,		"CIPHER MODE CMD" },
+	{ BSS_MAP_MSG_CLASSMARK_UPDATE,		"CLASSMARK UPDATE" },
+	{ BSS_MAP_MSG_CIPHER_MODE_COMPLETE,	"CIPHER MODE COMPLETE" },
+	{ BSS_MAP_MSG_QUEUING_INDICATION,	"QUEUING INDICATION" },
+	{ BSS_MAP_MSG_COMPLETE_LAYER_3,		"COMPLETE LAYER 3" },
+	{ BSS_MAP_MSG_CLASSMARK_RQST,		"CLASSMARK REQ" },
+	{ BSS_MAP_MSG_CIPHER_MODE_REJECT,	"CIPHER MODE REJECT" },
+	{ BSS_MAP_MSG_LOAD_INDICATION,		"LOAD IND" },
+
+	/* FIXME: VGCS/VBS */
+
+	{ 0, NULL }
+};
+
+const char *gsm0808_bssmap_name(uint8_t msg_type)
+{
+	return get_value_string(gsm0808_msgt_names, msg_type);
+}
+
+static const struct value_string gsm0808_bssap_names[] = {
+	{ BSSAP_MSG_BSS_MANAGEMENT, 		"MANAGEMENT" },
+	{ BSSAP_MSG_DTAP,			"DTAP" },
+};
+
+const char *gsm0808_bssap_name(uint8_t msg_type)
+{
+	return get_value_string(gsm0808_bssap_names, msg_type);
+}
diff --git a/src/shared/libosmocore/src/gsm/gsm48.c b/src/shared/libosmocore/src/gsm/gsm48.c
new file mode 100644
index 00000000..ea05d450
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gsm48.c
@@ -0,0 +1,451 @@
+/* GSM Mobile Radio Interface Layer 3 messages
+ * 3GPP TS 04.08 version 7.21.0 Release 1998 / ETSI TS 100 940 V7.21.0 */
+
+/* (C) 2008-2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2008, 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <arpa/inet.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/gsm/gsm0502.h>
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+
+const struct tlv_definition gsm48_att_tlvdef = {
+	.def = {
+		[GSM48_IE_MOBILE_ID]	= { TLV_TYPE_TLV },
+		[GSM48_IE_NAME_LONG]	= { TLV_TYPE_TLV },
+		[GSM48_IE_NAME_SHORT]	= { TLV_TYPE_TLV },
+		[GSM48_IE_UTC]		= { TLV_TYPE_TV },
+		[GSM48_IE_NET_TIME_TZ]	= { TLV_TYPE_FIXED, 7 },
+		[GSM48_IE_LSA_IDENT]	= { TLV_TYPE_TLV },
+
+		[GSM48_IE_BEARER_CAP]	= { TLV_TYPE_TLV },
+		[GSM48_IE_CAUSE]	= { TLV_TYPE_TLV },
+		[GSM48_IE_CC_CAP]	= { TLV_TYPE_TLV },
+		[GSM48_IE_ALERT]	= { TLV_TYPE_TLV },
+		[GSM48_IE_FACILITY]	= { TLV_TYPE_TLV },
+		[GSM48_IE_PROGR_IND]	= { TLV_TYPE_TLV },
+		[GSM48_IE_AUX_STATUS]	= { TLV_TYPE_TLV },
+		[GSM48_IE_NOTIFY]	= { TLV_TYPE_TV },
+		[GSM48_IE_KPD_FACILITY]	= { TLV_TYPE_TV },
+		[GSM48_IE_SIGNAL]	= { TLV_TYPE_TV },
+		[GSM48_IE_CONN_BCD]	= { TLV_TYPE_TLV },
+		[GSM48_IE_CONN_SUB]	= { TLV_TYPE_TLV },
+		[GSM48_IE_CALLING_BCD]	= { TLV_TYPE_TLV },
+		[GSM48_IE_CALLING_SUB]	= { TLV_TYPE_TLV },
+		[GSM48_IE_CALLED_BCD]	= { TLV_TYPE_TLV },
+		[GSM48_IE_CALLED_SUB]	= { TLV_TYPE_TLV },
+		[GSM48_IE_REDIR_BCD]	= { TLV_TYPE_TLV },
+		[GSM48_IE_REDIR_SUB]	= { TLV_TYPE_TLV },
+		[GSM48_IE_LOWL_COMPAT]	= { TLV_TYPE_TLV },
+		[GSM48_IE_HIGHL_COMPAT]	= { TLV_TYPE_TLV },
+		[GSM48_IE_USER_USER]	= { TLV_TYPE_TLV },
+		[GSM48_IE_SS_VERS]	= { TLV_TYPE_TLV },
+		[GSM48_IE_MORE_DATA]	= { TLV_TYPE_T },
+		[GSM48_IE_CLIR_SUPP]	= { TLV_TYPE_T },
+		[GSM48_IE_CLIR_INVOC]	= { TLV_TYPE_T },
+		[GSM48_IE_REV_C_SETUP]	= { TLV_TYPE_T },
+		[GSM48_IE_REPEAT_CIR]   = { TLV_TYPE_T },
+		[GSM48_IE_REPEAT_SEQ]   = { TLV_TYPE_T },
+		/* FIXME: more elements */
+	},
+};
+
+/* RR elements */
+const struct tlv_definition gsm48_rr_att_tlvdef = {
+	.def = {
+		/* NOTE: Don't add IE 17 = MOBILE_ID here, it already used. */
+		[GSM48_IE_VGCS_TARGET]		= { TLV_TYPE_TLV },
+		[GSM48_IE_FRQSHORT_AFTER]	= { TLV_TYPE_FIXED, 9 },
+		[GSM48_IE_MUL_RATE_CFG]		= { TLV_TYPE_TLV },
+		[GSM48_IE_FREQ_L_AFTER]		= { TLV_TYPE_TLV },
+		[GSM48_IE_MSLOT_DESC]		= { TLV_TYPE_TLV },
+		[GSM48_IE_CHANMODE_2]		= { TLV_TYPE_TV },
+		[GSM48_IE_FRQSHORT_BEFORE]	= { TLV_TYPE_FIXED, 9 },
+		[GSM48_IE_CHANMODE_3]		= { TLV_TYPE_TV },
+		[GSM48_IE_CHANMODE_4]		= { TLV_TYPE_TV },
+		[GSM48_IE_CHANMODE_5]		= { TLV_TYPE_TV },
+		[GSM48_IE_CHANMODE_6]		= { TLV_TYPE_TV },
+		[GSM48_IE_CHANMODE_7]		= { TLV_TYPE_TV },
+		[GSM48_IE_CHANMODE_8]		= { TLV_TYPE_TV },
+		[GSM48_IE_FREQ_L_BEFORE]	= { TLV_TYPE_TLV },
+		[GSM48_IE_CH_DESC_1_BEFORE]	= { TLV_TYPE_FIXED, 3 },
+		[GSM48_IE_CH_DESC_2_BEFORE]	= { TLV_TYPE_FIXED, 3 },
+		[GSM48_IE_F_CH_SEQ_BEFORE]	= { TLV_TYPE_FIXED, 9 },
+		[GSM48_IE_CLASSMARK3]		= { TLV_TYPE_TLV },
+		[GSM48_IE_MA_BEFORE]		= { TLV_TYPE_TLV },
+		[GSM48_IE_RR_PACKET_UL]		= { TLV_TYPE_TLV },
+		[GSM48_IE_RR_PACKET_DL]		= { TLV_TYPE_TLV },
+		[GSM48_IE_CELL_CH_DESC]		= { TLV_TYPE_FIXED, 16 },
+		[GSM48_IE_CHANMODE_1]		= { TLV_TYPE_TV },
+		[GSM48_IE_CHDES_2_AFTER]	= { TLV_TYPE_FIXED, 3 },
+		[GSM48_IE_MODE_SEC_CH]		= { TLV_TYPE_TV },
+		[GSM48_IE_F_CH_SEQ_AFTER]		= { TLV_TYPE_FIXED, 9 },
+		[GSM48_IE_MA_AFTER]		= { TLV_TYPE_TLV },
+		[GSM48_IE_BA_RANGE]		= { TLV_TYPE_TLV },
+		[GSM48_IE_GROUP_CHDES]		= { TLV_TYPE_TLV },
+		[GSM48_IE_BA_LIST_PREF]		= { TLV_TYPE_TLV },
+		[GSM48_IE_MOB_OVSERV_DIF]	= { TLV_TYPE_TLV },
+		[GSM48_IE_REALTIME_DIFF]	= { TLV_TYPE_TLV },
+		[GSM48_IE_START_TIME]		= { TLV_TYPE_FIXED, 2 },
+		[GSM48_IE_TIMING_ADVANCE]	= { TLV_TYPE_TV },
+		[GSM48_IE_GROUP_CIP_SEQ]	= { TLV_TYPE_SINGLE_TV },
+		[GSM48_IE_CIP_MODE_SET]		= { TLV_TYPE_SINGLE_TV },
+		[GSM48_IE_GPRS_RESUMPT]		= { TLV_TYPE_SINGLE_TV },
+		[GSM48_IE_SYNC_IND]		= { TLV_TYPE_SINGLE_TV },
+	},
+};
+
+/* MM elements */
+const struct tlv_definition gsm48_mm_att_tlvdef = {
+	.def = {
+		[GSM48_IE_MOBILE_ID]		= { TLV_TYPE_TLV },
+		[GSM48_IE_NAME_LONG]		= { TLV_TYPE_TLV },
+		[GSM48_IE_NAME_SHORT]		= { TLV_TYPE_TLV },
+		[GSM48_IE_UTC]			= { TLV_TYPE_TV },
+		[GSM48_IE_NET_TIME_TZ]		= { TLV_TYPE_FIXED, 7 },
+		[GSM48_IE_LSA_IDENT]		= { TLV_TYPE_TLV },
+
+		[GSM48_IE_LOCATION_AREA]	= { TLV_TYPE_FIXED, 5 },
+		[GSM48_IE_PRIORITY_LEV]		= { TLV_TYPE_SINGLE_TV },
+		[GSM48_IE_FOLLOW_ON_PROC]	= { TLV_TYPE_T },
+		[GSM48_IE_CTS_PERMISSION]	= { TLV_TYPE_T },
+	},
+};
+
+static const struct value_string rr_cause_names[] = {
+	{ GSM48_RR_CAUSE_NORMAL,		"Normal event" },
+	{ GSM48_RR_CAUSE_ABNORMAL_UNSPEC,	"Abnormal release, unspecified" },
+	{ GSM48_RR_CAUSE_ABNORMAL_UNACCT,	"Abnormal release, channel unacceptable" },
+	{ GSM48_RR_CAUSE_ABNORMAL_TIMER,	"Abnormal release, timer expired" },
+	{ GSM48_RR_CAUSE_ABNORMAL_NOACT,	"Abnormal release, no activity on radio path" },
+	{ GSM48_RR_CAUSE_PREMPTIVE_REL,		"Preemptive release" },
+	{ GSM48_RR_CAUSE_HNDOVER_IMP,		"Handover impossible, timing advance out of range" },
+	{ GSM48_RR_CAUSE_CHAN_MODE_UNACCT,	"Channel mode unacceptable" },
+	{ GSM48_RR_CAUSE_FREQ_NOT_IMPL,		"Frequency not implemented" },
+	{ GSM48_RR_CAUSE_CALL_CLEARED,		"Call already cleared" },
+	{ GSM48_RR_CAUSE_SEMANT_INCORR,		"Semantically incorrect message" },
+	{ GSM48_RR_CAUSE_INVALID_MAND_INF,	"Invalid mandatory information" },
+	{ GSM48_RR_CAUSE_MSG_TYPE_N,		"Message type non-existant or not implemented" },
+	{ GSM48_RR_CAUSE_MSG_TYPE_N_COMPAT,	"Message type not compatible with protocol state" },
+	{ GSM48_RR_CAUSE_COND_IE_ERROR,		"Conditional IE error" },
+	{ GSM48_RR_CAUSE_NO_CELL_ALLOC_A,	"No cell allocation available" },
+	{ GSM48_RR_CAUSE_PROT_ERROR_UNSPC,	"Protocol error unspecified" },
+	{ 0,					NULL },
+};
+
+/* FIXME: convert to value_string */
+static const char *cc_state_names[32] = {
+	"NULL",
+	"INITIATED",
+	"MM_CONNECTION_PEND",
+	"MO_CALL_PROC",
+	"CALL_DELIVERED",
+	"illegal state 5",
+	"CALL_PRESENT",
+	"CALL_RECEIVED",
+	"CONNECT_REQUEST",
+	"MO_TERM_CALL_CONF",
+	"ACTIVE",
+	"DISCONNECT_REQ",
+	"DISCONNECT_IND",
+	"illegal state 13",
+	"illegal state 14",
+	"illegal state 15",
+	"illegal state 16",
+	"illegal state 17",
+	"illegal state 18",
+	"RELEASE_REQ",
+	"illegal state 20",
+	"illegal state 21",
+	"illegal state 22",
+	"illegal state 23",
+	"illegal state 24",
+	"illegal state 25",
+	"MO_ORIG_MODIFY",
+	"MO_TERM_MODIFY",
+	"CONNECT_IND",
+	"illegal state 29",
+	"illegal state 30",
+	"illegal state 31",
+};
+
+const char *gsm48_cc_state_name(uint8_t state)
+{
+	if (state < ARRAY_SIZE(cc_state_names))
+		return cc_state_names[state];
+
+	return "invalid";
+}
+
+static const struct value_string cc_msg_names[] = {
+	{ GSM48_MT_CC_ALERTING,		"ALERTING" },
+	{ GSM48_MT_CC_CALL_PROC,	"CALL_PROC" },
+	{ GSM48_MT_CC_PROGRESS,		"PROGRESS" },
+	{ GSM48_MT_CC_ESTAB,		"ESTAB" },
+	{ GSM48_MT_CC_SETUP,		"SETUP" },
+	{ GSM48_MT_CC_ESTAB_CONF,	"ESTAB_CONF" },
+	{ GSM48_MT_CC_CONNECT,		"CONNECT" },
+	{ GSM48_MT_CC_CALL_CONF,	"CALL_CONF" },
+	{ GSM48_MT_CC_START_CC,		"START_CC" },
+	{ GSM48_MT_CC_RECALL,		"RECALL" },
+	{ GSM48_MT_CC_EMERG_SETUP,	"EMERG_SETUP" },
+	{ GSM48_MT_CC_CONNECT_ACK,	"CONNECT_ACK" },
+	{ GSM48_MT_CC_USER_INFO,	"USER_INFO" },
+	{ GSM48_MT_CC_MODIFY_REJECT,	"MODIFY_REJECT" },
+	{ GSM48_MT_CC_MODIFY,		"MODIFY" },
+	{ GSM48_MT_CC_HOLD,		"HOLD" },
+	{ GSM48_MT_CC_HOLD_ACK,		"HOLD_ACK" },
+	{ GSM48_MT_CC_HOLD_REJ,		"HOLD_REJ" },
+	{ GSM48_MT_CC_RETR,		"RETR" },
+	{ GSM48_MT_CC_RETR_ACK,		"RETR_ACK" },
+	{ GSM48_MT_CC_RETR_REJ,		"RETR_REJ" },
+	{ GSM48_MT_CC_MODIFY_COMPL,	"MODIFY_COMPL" },
+	{ GSM48_MT_CC_DISCONNECT,	"DISCONNECT" },
+	{ GSM48_MT_CC_RELEASE_COMPL,	"RELEASE_COMPL" },
+	{ GSM48_MT_CC_RELEASE,		"RELEASE" },
+	{ GSM48_MT_CC_STOP_DTMF,	"STOP_DTMF" },
+	{ GSM48_MT_CC_STOP_DTMF_ACK,	"STOP_DTMF_ACK" },
+	{ GSM48_MT_CC_STATUS_ENQ,	"STATUS_ENQ" },
+	{ GSM48_MT_CC_START_DTMF,	"START_DTMF" },
+	{ GSM48_MT_CC_START_DTMF_ACK,	"START_DTMF_ACK" },
+	{ GSM48_MT_CC_START_DTMF_REJ,	"START_DTMF_REJ" },
+	{ GSM48_MT_CC_CONG_CTRL,	"CONG_CTRL" },
+	{ GSM48_MT_CC_FACILITY,		"FACILITY" },
+	{ GSM48_MT_CC_STATUS,		"STATUS" },
+	{ GSM48_MT_CC_NOTIFY,		"NOTFIY" },
+	{ 0,				NULL }
+};
+
+const char *gsm48_cc_msg_name(uint8_t msgtype)
+{
+	return get_value_string(cc_msg_names, msgtype);
+}
+
+const char *rr_cause_name(uint8_t cause)
+{
+	return get_value_string(rr_cause_names, cause);
+}
+
+static void to_bcd(uint8_t *bcd, uint16_t val)
+{
+	bcd[2] = val % 10;
+	val = val / 10;
+	bcd[1] = val % 10;
+	val = val / 10;
+	bcd[0] = val % 10;
+	val = val / 10;
+}
+
+void gsm48_generate_lai(struct gsm48_loc_area_id *lai48, uint16_t mcc,
+			uint16_t mnc, uint16_t lac)
+{
+	uint8_t bcd[3];
+
+	to_bcd(bcd, mcc);
+	lai48->digits[0] = bcd[0] | (bcd[1] << 4);
+	lai48->digits[1] = bcd[2];
+
+	to_bcd(bcd, mnc);
+	/* FIXME: do we need three-digit MNC? See Table 10.5.3 */
+	if (mnc > 99) {
+		lai48->digits[1] |= bcd[2] << 4;
+		lai48->digits[2] = bcd[0] | (bcd[1] << 4);
+	} else {
+		lai48->digits[1] |= 0xf << 4;
+		lai48->digits[2] = bcd[1] | (bcd[2] << 4);
+	}
+
+	lai48->lac = htons(lac);
+}
+
+/* Attention: this function retunrs true integers, not hex! */
+int gsm48_decode_lai(struct gsm48_loc_area_id *lai, uint16_t *mcc,
+		     uint16_t *mnc, uint16_t *lac)
+{
+	*mcc = (lai->digits[0] & 0x0f) * 100
+	     + (lai->digits[0] >> 4) * 10
+	     + (lai->digits[1] & 0x0f);
+
+	if ((lai->digits[1] & 0xf0) == 0xf0) {
+		*mnc = (lai->digits[2] & 0x0f) * 10
+		     + (lai->digits[2] >> 4);
+	} else {
+		*mnc = (lai->digits[2] & 0x0f) * 100
+		     + (lai->digits[2] >> 4) * 10
+		     + (lai->digits[1] >> 4);
+	}
+	*lac = ntohs(lai->lac);
+
+	return 0;
+}
+
+int gsm48_generate_mid_from_tmsi(uint8_t *buf, uint32_t tmsi)
+{
+	uint32_t *tptr = (uint32_t *) &buf[3];
+
+	buf[0] = GSM48_IE_MOBILE_ID;
+	buf[1] = GSM48_TMSI_LEN;
+	buf[2] = 0xf0 | GSM_MI_TYPE_TMSI;
+	*tptr = htonl(tmsi);
+
+	return 7;
+}
+
+int gsm48_generate_mid_from_imsi(uint8_t *buf, const char *imsi)
+{
+	unsigned int length = strlen(imsi), i, off = 0;
+	uint8_t odd = (length & 0x1) == 1;
+
+	buf[0] = GSM48_IE_MOBILE_ID;
+	buf[2] = osmo_char2bcd(imsi[0]) << 4 | GSM_MI_TYPE_IMSI | (odd << 3);
+
+	/* if the length is even we will fill half of the last octet */
+	if (odd)
+		buf[1] = (length + 1) >> 1;
+	else
+		buf[1] = (length + 2) >> 1;
+
+	for (i = 1; i < buf[1]; ++i) {
+		uint8_t lower, upper;
+
+		lower = osmo_char2bcd(imsi[++off]);
+		if (!odd && off + 1 == length)
+			upper = 0x0f;
+		else
+			upper = osmo_char2bcd(imsi[++off]) & 0x0f;
+
+		buf[2 + i] = (upper << 4) | lower;
+	}
+
+	return 2 + buf[1];
+}
+
+/* Convert Mobile Identity (10.5.1.4) to string */
+int gsm48_mi_to_string(char *string, const int str_len, const uint8_t *mi,
+		       const int mi_len)
+{
+	int i;
+	uint8_t mi_type;
+	char *str_cur = string;
+	uint32_t tmsi;
+
+	mi_type = mi[0] & GSM_MI_TYPE_MASK;
+
+	switch (mi_type) {
+	case GSM_MI_TYPE_NONE:
+		break;
+	case GSM_MI_TYPE_TMSI:
+		/* Table 10.5.4.3, reverse generate_mid_from_tmsi */
+		if (mi_len == GSM48_TMSI_LEN && mi[0] == (0xf0 | GSM_MI_TYPE_TMSI)) {
+			memcpy(&tmsi, &mi[1], 4);
+			tmsi = ntohl(tmsi);
+			return snprintf(string, str_len, "%u", tmsi);
+		}
+		break;
+	case GSM_MI_TYPE_IMSI:
+	case GSM_MI_TYPE_IMEI:
+	case GSM_MI_TYPE_IMEISV:
+		*str_cur++ = osmo_bcd2char(mi[0] >> 4);
+
+                for (i = 1; i < mi_len; i++) {
+			if (str_cur + 2 >= string + str_len)
+				return str_cur - string;
+			*str_cur++ = osmo_bcd2char(mi[i] & 0xf);
+			/* skip last nibble in last input byte when GSM_EVEN */
+			if( (i != mi_len-1) || (mi[0] & GSM_MI_ODD))
+				*str_cur++ = osmo_bcd2char(mi[i] >> 4);
+		}
+		break;
+	default:
+		break;
+	}
+	*str_cur++ = '\0';
+
+	return str_cur - string;
+}
+
+void gsm48_parse_ra(struct gprs_ra_id *raid, const uint8_t *buf)
+{
+	raid->mcc = (buf[0] & 0xf) * 100;
+	raid->mcc += (buf[0] >> 4) * 10;
+	raid->mcc += (buf[1] & 0xf) * 1;
+
+	/* I wonder who came up with the stupidity of encoding the MNC
+	 * differently depending on how many digits its decimal number has! */
+	if ((buf[1] >> 4) == 0xf) {
+		raid->mnc = (buf[2] & 0xf) * 10;
+		raid->mnc += (buf[2] >> 4) * 1;
+	} else {
+		raid->mnc = (buf[2] & 0xf) * 100;
+		raid->mnc += (buf[2] >> 4) * 10;
+		raid->mnc += (buf[1] >> 4) * 1;
+	}
+
+	raid->lac = ntohs(*(uint16_t *)(buf + 3));
+	raid->rac = buf[5];
+}
+
+int gsm48_construct_ra(uint8_t *buf, const struct gprs_ra_id *raid)
+{
+	uint16_t mcc = raid->mcc;
+	uint16_t mnc = raid->mnc;
+	uint16_t _lac;
+
+	buf[0] = ((mcc / 100) % 10) | (((mcc / 10) % 10) << 4);
+	buf[1] = (mcc % 10);
+
+	/* I wonder who came up with the stupidity of encoding the MNC
+	 * differently depending on how many digits its decimal number has! */
+	if (mnc < 100) {
+		buf[1] |= 0xf0;
+		buf[2] = ((mnc / 10) % 10) | ((mnc % 10) << 4);
+	} else {
+		buf[1] |= (mnc % 10) << 4;
+		buf[2] = ((mnc / 100) % 10) | (((mnc / 10) % 10) << 4);
+	}
+
+	_lac = htons(raid->lac);
+	memcpy(buf + 3, &_lac, 2);
+
+	buf[5] = raid->rac;
+
+	return 6;
+}
+
+/* From Table 10.5.33 of GSM 04.08 */
+int gsm48_number_of_paging_subchannels(struct gsm48_control_channel_descr *chan_desc)
+{
+	unsigned int n_pag_blocks = gsm0502_get_n_pag_blocks(chan_desc);
+
+	if (chan_desc->ccch_conf == RSL_BCCH_CCCH_CONF_1_C)
+		return OSMO_MAX(1, n_pag_blocks) * (chan_desc->bs_pa_mfrms + 2);
+	else
+		return n_pag_blocks * (chan_desc->bs_pa_mfrms + 2);
+}
diff --git a/src/shared/libosmocore/src/gsm/gsm48_ie.c b/src/shared/libosmocore/src/gsm/gsm48_ie.c
new file mode 100644
index 00000000..78619b97
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gsm48_ie.c
@@ -0,0 +1,1192 @@
+/* GSM Mobile Radio Interface Layer 3 messages
+ * 3GPP TS 04.08 version 7.21.0 Release 1998 / ETSI TS 100 940 V7.21.0 */
+
+/* (C) 2008 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2009-2010 by Andreas Eversberg
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/mncc.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/gsm48_ie.h>
+
+static const char bcd_num_digits[] = {
+	'0', '1', '2', '3', '4', '5', '6', '7',
+	'8', '9', '*', '#', 'a', 'b', 'c', '\0'
+};
+
+/* decode a 'called/calling/connect party BCD number' as in 10.5.4.7 */
+int gsm48_decode_bcd_number(char *output, int output_len,
+			    const uint8_t *bcd_lv, int h_len)
+{
+	uint8_t in_len = bcd_lv[0];
+	int i;
+
+	for (i = 1 + h_len; i <= in_len; i++) {
+		/* lower nibble */
+		output_len--;
+		if (output_len <= 1)
+			break;
+		*output++ = bcd_num_digits[bcd_lv[i] & 0xf];
+
+		/* higher nibble */
+		output_len--;
+		if (output_len <= 1)
+			break;
+		*output++ = bcd_num_digits[bcd_lv[i] >> 4];
+	}
+	if (output_len >= 1)
+		*output++ = '\0';
+
+	return 0;
+}
+
+/* convert a single ASCII character to call-control BCD */
+static int asc_to_bcd(const char asc)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(bcd_num_digits); i++) {
+		if (bcd_num_digits[i] == asc)
+			return i;
+	}
+	return -EINVAL;
+}
+
+/* convert a ASCII phone number to 'called/calling/connect party BCD number' */
+int gsm48_encode_bcd_number(uint8_t *bcd_lv, uint8_t max_len,
+		      int h_len, const char *input)
+{
+	int in_len = strlen(input);
+	int i;
+	uint8_t *bcd_cur = bcd_lv + 1 + h_len;
+
+	/* two digits per byte, plus type byte */
+	bcd_lv[0] = in_len/2 + h_len;
+	if (in_len % 2)
+		bcd_lv[0]++;
+
+	if (bcd_lv[0] > max_len)
+		return -EIO;
+
+	for (i = 0; i < in_len; i++) {
+		int rc = asc_to_bcd(input[i]);
+		if (rc < 0)
+			return rc;
+		if (i % 2 == 0)
+			*bcd_cur = rc;
+		else
+			*bcd_cur++ |= (rc << 4);
+	}
+	/* append padding nibble in case of odd length */
+	if (i % 2)
+		*bcd_cur++ |= 0xf0;
+
+	/* return how many bytes we used */
+	return (bcd_cur - bcd_lv);
+}
+
+/* TS 04.08 10.5.4.5: decode 'bearer capability' */
+int gsm48_decode_bearer_cap(struct gsm_mncc_bearer_cap *bcap,
+			     const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+	int i, s;
+
+	if (in_len < 1)
+		return -EINVAL;
+
+	bcap->speech_ver[0] = -1; /* end of list, of maximum 7 values */
+
+	/* octet 3 */
+	bcap->transfer = lv[1] & 0x07;
+	bcap->mode = (lv[1] & 0x08) >> 3;
+	bcap->coding = (lv[1] & 0x10) >> 4;
+	bcap->radio = (lv[1] & 0x60) >> 5;
+
+	switch (bcap->transfer) {
+	case GSM_MNCC_BCAP_SPEECH:
+		i = 1;
+		s = 0;
+		while(!(lv[i] & 0x80)) {
+			i++; /* octet 3a etc */
+			if (in_len < i)
+				return 0;
+			bcap->speech_ver[s++] = lv[i] & 0x0f;
+			bcap->speech_ver[s] = -1; /* end of list */
+			if (i == 2) /* octet 3a */
+				bcap->speech_ctm = (lv[i] & 0x20) >> 5;
+			if (s == 7) /* maximum speech versions + end of list */
+				return 0;
+		}
+		break;
+	case GSM_MNCC_BCAP_UNR_DIG:
+	case GSM_MNCC_BCAP_FAX_G3:
+		i = 1;
+		while(!(lv[i] & 0x80)) {
+			i++; /* octet 3a etc */
+			if (in_len < i)
+				return 0;
+			/* ignore them */
+		}
+		/* octet 4: skip */
+		i++;
+		/* octet 5 */
+		i++;
+		if (in_len < i)
+			return 0;
+		bcap->data.rate_adaption = (lv[i] >> 3) & 3;
+		bcap->data.sig_access = lv[i] & 7;
+		while(!(lv[i] & 0x80)) {
+			i++; /* octet 5a etc */
+			if (in_len < i)
+				return 0;
+			/* ignore them */
+		}
+		/* octet 6 */
+		i++;
+		if (in_len < i)
+			return 0;
+		bcap->data.async = lv[i] & 1;
+		if (!(lv[i] & 0x80)) {
+			i++;
+			if (in_len < i)
+				return 0;
+			/* octet 6a */
+			bcap->data.nr_stop_bits = ((lv[i] >> 7) & 1) + 1;
+			if (lv[i] & 0x10)
+				bcap->data.nr_data_bits = 8;
+			else
+				bcap->data.nr_data_bits = 7;
+			bcap->data.user_rate = lv[i]  & 0xf;
+
+			if (!(lv[i] & 0x80)) {
+				i++;
+				if (in_len < i)
+					return 0;
+				/* octet 6b */
+				bcap->data.parity = lv[i] & 7;
+				bcap->data.interm_rate = (lv[i] >> 5) & 3;
+
+				/* octet 6c */
+				if (!(lv[i] & 0x80)) {
+					i++;
+					if (in_len < i)
+						return 0;
+					bcap->data.transp = (lv[i] >> 5) & 3;
+					bcap->data.modem_type = lv[i] & 0x1F;
+				}
+			}
+
+		}
+		break;
+	default:
+		i = 1;
+		while (!(lv[i] & 0x80)) {
+			i++; /* octet 3a etc */
+			if (in_len < i)
+				return 0;
+			/* ignore them */
+		}
+		/* FIXME: implement OCTET 4+ parsing */
+		break;
+	}
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.5: encode 'bearer capability' */
+int gsm48_encode_bearer_cap(struct msgb *msg, int lv_only,
+			     const struct gsm_mncc_bearer_cap *bcap)
+{
+	uint8_t lv[32 + 1];
+	int i = 1, s;
+
+	lv[1] = bcap->transfer;
+	lv[1] |= bcap->mode << 3;
+	lv[1] |= bcap->coding << 4;
+	lv[1] |= bcap->radio << 5;
+
+	switch (bcap->transfer) {
+	case GSM_MNCC_BCAP_SPEECH:
+		for (s = 0; bcap->speech_ver[s] >= 0; s++) {
+			i++; /* octet 3a etc */
+			lv[i] = bcap->speech_ver[s];
+			if (i == 2) /* octet 3a */
+				lv[i] |= bcap->speech_ctm << 5;
+		}
+		lv[i] |= 0x80; /* last IE of octet 3 etc */
+		break;
+	case GSM48_BCAP_ITCAP_UNR_DIG_INF:
+	case GSM48_BCAP_ITCAP_FAX_G3:
+		lv[i++] |= 0x80; /* last IE of octet 3 etc */
+		/* octet 4 */
+		lv[i++] = 0xb8;
+		/* octet 5 */
+		lv[i++] = 0x80 | ((bcap->data.rate_adaption & 3) << 3)
+			  | (bcap->data.sig_access & 7);
+		/* octet 6 */
+		lv[i++] = 0x20 | (bcap->data.async & 1);
+		/* octet 6a */
+		lv[i++] = (bcap->data.user_rate & 0xf) |
+			  (bcap->data.nr_data_bits == 8 ? 0x10 : 0x00) |
+			  (bcap->data.nr_stop_bits == 2 ? 0x40 : 0x00);
+		/* octet 6b */
+		lv[i++] = (bcap->data.parity & 7) |
+			  ((bcap->data.interm_rate & 3) << 5);
+		/* octet 6c */
+		lv[i] = 0x80 | (bcap->data.modem_type & 0x1f);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	lv[0] = i;
+	if (lv_only)
+		msgb_lv_put(msg, lv[0], lv+1);
+	else
+		msgb_tlv_put(msg, GSM48_IE_BEARER_CAP, lv[0], lv+1);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.5a: decode 'call control cap' */
+int gsm48_decode_cccap(struct gsm_mncc_cccap *ccap, const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+
+	if (in_len < 1)
+		return -EINVAL;
+
+	/* octet 3 */
+	ccap->dtmf = lv[1] & 0x01;
+	ccap->pcp = (lv[1] & 0x02) >> 1;
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.5a: encode 'call control cap' */
+int gsm48_encode_cccap(struct msgb *msg,
+			const struct gsm_mncc_cccap *ccap)
+{
+	uint8_t lv[2];
+
+	lv[0] = 1;
+	lv[1] = 0;
+	if (ccap->dtmf)
+		lv [1] |= 0x01;
+	if (ccap->pcp)
+		lv [1] |= 0x02;
+
+	msgb_tlv_put(msg, GSM48_IE_CC_CAP, lv[0], lv+1);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.7: decode 'called party BCD number' */
+int gsm48_decode_called(struct gsm_mncc_number *called,
+			 const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+
+	if (in_len < 1)
+		return -EINVAL;
+
+	/* octet 3 */
+	called->plan = lv[1] & 0x0f;
+	called->type = (lv[1] & 0x70) >> 4;
+
+	/* octet 4..N */
+	gsm48_decode_bcd_number(called->number, sizeof(called->number), lv, 1);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.7: encode 'called party BCD number' */
+int gsm48_encode_called(struct msgb *msg,
+			 const struct gsm_mncc_number *called)
+{
+	uint8_t lv[18];
+	int ret;
+
+	/* octet 3 */
+	lv[1] = 0x80; /* no extension */
+	lv[1] |= called->plan;
+	lv[1] |= called->type << 4;
+
+	/* octet 4..N, octet 2 */
+	ret = gsm48_encode_bcd_number(lv, sizeof(lv), 1, called->number);
+	if (ret < 0)
+		return ret;
+
+	msgb_tlv_put(msg, GSM48_IE_CALLED_BCD, lv[0], lv+1);
+
+	return 0;
+}
+
+/* decode callerid of various IEs */
+int gsm48_decode_callerid(struct gsm_mncc_number *callerid,
+			 const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+	int i = 1;
+
+	if (in_len < 1)
+		return -EINVAL;
+
+	/* octet 3 */
+	callerid->plan = lv[1] & 0x0f;
+	callerid->type = (lv[1] & 0x70) >> 4;
+
+	/* octet 3a */
+	if (!(lv[1] & 0x80)) {
+		callerid->screen = lv[2] & 0x03;
+		callerid->present = (lv[2] & 0x60) >> 5;
+		i = 2;
+	}
+
+	/* octet 4..N */
+	gsm48_decode_bcd_number(callerid->number, sizeof(callerid->number), lv, i);
+
+	return 0;
+}
+
+/* encode callerid of various IEs */
+int gsm48_encode_callerid(struct msgb *msg, int ie, int max_len,
+			   const struct gsm_mncc_number *callerid)
+{
+	uint8_t lv[max_len - 1];
+	int h_len = 1;
+	int ret;
+
+	/* octet 3 */
+	lv[1] = callerid->plan;
+	lv[1] |= callerid->type << 4;
+
+	if (callerid->present || callerid->screen) {
+		/* octet 3a */
+		lv[2] = callerid->screen;
+		lv[2] |= callerid->present << 5;
+		lv[2] |= 0x80;
+		h_len++;
+	} else
+		lv[1] |= 0x80;
+
+	/* octet 4..N, octet 2 */
+	ret = gsm48_encode_bcd_number(lv, sizeof(lv), h_len, callerid->number);
+	if (ret < 0)
+		return ret;
+
+	msgb_tlv_put(msg, ie, lv[0], lv+1);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.11: decode 'cause' */
+int gsm48_decode_cause(struct gsm_mncc_cause *cause,
+			const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+	int i;
+
+	if (in_len < 2)
+		return -EINVAL;
+
+	cause->diag_len = 0;
+
+	/* octet 3 */
+	cause->location = lv[1] & 0x0f;
+	cause->coding = (lv[1] & 0x60) >> 5;
+
+	i = 1;
+	if (!(lv[i] & 0x80)) {
+		i++; /* octet 3a */
+		if (in_len < i+1)
+			return 0;
+		cause->rec = 1;
+		cause->rec_val = lv[i] & 0x7f;
+	}
+	i++;
+
+	/* octet 4 */
+	cause->value = lv[i] & 0x7f;
+	i++;
+
+	if (in_len < i) /* no diag */
+		return 0;
+
+	if (in_len - (i-1) > 32) /* maximum 32 octets */
+		return 0;
+
+	/* octet 5-N */
+	memcpy(cause->diag, lv + i, in_len - (i-1));
+	cause->diag_len = in_len - (i-1);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.11: encode 'cause' */
+int gsm48_encode_cause(struct msgb *msg, int lv_only,
+			const struct gsm_mncc_cause *cause)
+{
+	uint8_t lv[32+4];
+	int i;
+
+	if (cause->diag_len > 32)
+		return -EINVAL;
+
+	/* octet 3 */
+	lv[1] = cause->location;
+	lv[1] |= cause->coding << 5;
+
+	i = 1;
+	if (cause->rec) {
+		i++; /* octet 3a */
+		lv[i] = cause->rec_val;
+	}
+	lv[i] |= 0x80; /* end of octet 3 */
+
+	/* octet 4 */
+	i++;
+	lv[i] = 0x80 | cause->value;
+
+	/* octet 5-N */
+	if (cause->diag_len) {
+		memcpy(lv + i, cause->diag, cause->diag_len);
+		i += cause->diag_len;
+	}
+
+	lv[0] = i;
+	if (lv_only)
+		msgb_lv_put(msg, lv[0], lv+1);
+	else
+		msgb_tlv_put(msg, GSM48_IE_CAUSE, lv[0], lv+1);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.9: decode 'calling number' */
+int gsm48_decode_calling(struct gsm_mncc_number *calling,
+			 const uint8_t *lv)
+{
+	return gsm48_decode_callerid(calling, lv);
+}
+
+/* TS 04.08 10.5.4.9: encode 'calling number' */
+int gsm48_encode_calling(struct msgb *msg, 
+			  const struct gsm_mncc_number *calling)
+{
+	return gsm48_encode_callerid(msg, GSM48_IE_CALLING_BCD, 14, calling);
+}
+
+/* TS 04.08 10.5.4.13: decode 'connected number' */
+int gsm48_decode_connected(struct gsm_mncc_number *connected,
+			 const uint8_t *lv)
+{
+	return gsm48_decode_callerid(connected, lv);
+}
+
+/* TS 04.08 10.5.4.13: encode 'connected number' */
+int gsm48_encode_connected(struct msgb *msg,
+			    const struct gsm_mncc_number *connected)
+{
+	return gsm48_encode_callerid(msg, GSM48_IE_CONN_BCD, 14, connected);
+}
+
+/* TS 04.08 10.5.4.21b: decode 'redirecting number' */
+int gsm48_decode_redirecting(struct gsm_mncc_number *redirecting,
+			 const uint8_t *lv)
+{
+	return gsm48_decode_callerid(redirecting, lv);
+}
+
+/* TS 04.08 10.5.4.21b: encode 'redirecting number' */
+int gsm48_encode_redirecting(struct msgb *msg,
+			      const struct gsm_mncc_number *redirecting)
+{
+	return gsm48_encode_callerid(msg, GSM48_IE_REDIR_BCD, 19, redirecting);
+}
+
+/* TS 04.08 10.5.4.15: decode 'facility' */
+int gsm48_decode_facility(struct gsm_mncc_facility *facility,
+			   const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+
+	if (in_len < 1)
+		return -EINVAL;
+
+	if (in_len > sizeof(facility->info))
+		return -EINVAL;
+
+	memcpy(facility->info, lv+1, in_len);
+	facility->len = in_len;
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.15: encode 'facility' */
+int gsm48_encode_facility(struct msgb *msg, int lv_only,
+			   const struct gsm_mncc_facility *facility)
+{
+	uint8_t lv[GSM_MAX_FACILITY + 1];
+
+	if (facility->len < 1 || facility->len > GSM_MAX_FACILITY)
+		return -EINVAL;
+
+	memcpy(lv+1, facility->info, facility->len);
+	lv[0] = facility->len;
+	if (lv_only)
+		msgb_lv_put(msg, lv[0], lv+1);
+	else
+		msgb_tlv_put(msg, GSM48_IE_FACILITY, lv[0], lv+1);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.20: decode 'notify' */
+int gsm48_decode_notify(int *notify, const uint8_t *v)
+{
+	*notify = v[0] & 0x7f;
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.20: encode 'notify' */
+int gsm48_encode_notify(struct msgb *msg, int notify)
+{
+	msgb_v_put(msg, notify | 0x80);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.23: decode 'signal' */
+int gsm48_decode_signal(int *signal, const uint8_t *v)
+{
+	*signal = v[0];
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.23: encode 'signal' */
+int gsm48_encode_signal(struct msgb *msg, int signal)
+{
+	msgb_tv_put(msg, GSM48_IE_SIGNAL, signal);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.17: decode 'keypad' */
+int gsm48_decode_keypad(int *keypad, const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+
+	if (in_len < 1)
+		return -EINVAL;
+
+	*keypad = lv[1] & 0x7f;
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.17: encode 'keypad' */
+int gsm48_encode_keypad(struct msgb *msg, int keypad)
+{
+	msgb_tv_put(msg, GSM48_IE_KPD_FACILITY, keypad);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.21: decode 'progress' */
+int gsm48_decode_progress(struct gsm_mncc_progress *progress,
+			   const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+
+	if (in_len < 2)
+		return -EINVAL;
+
+	progress->coding = (lv[1] & 0x60) >> 5;
+	progress->location = lv[1] & 0x0f;
+	progress->descr = lv[2] & 0x7f;
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.21: encode 'progress' */
+int gsm48_encode_progress(struct msgb *msg, int lv_only,
+			   const struct gsm_mncc_progress *p)
+{
+	uint8_t lv[3];
+
+	lv[0] = 2;
+	lv[1] = 0x80 | ((p->coding & 0x3) << 5) | (p->location & 0xf);
+	lv[2] = 0x80 | (p->descr & 0x7f);
+	if (lv_only)
+		msgb_lv_put(msg, lv[0], lv+1);
+	else
+		msgb_tlv_put(msg, GSM48_IE_PROGR_IND, lv[0], lv+1);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.25: decode 'user-user' */
+int gsm48_decode_useruser(struct gsm_mncc_useruser *uu,
+			   const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+	char *info = uu->info;
+	int info_len = sizeof(uu->info);
+	int i;
+
+	if (in_len < 1)
+		return -EINVAL;
+
+	uu->proto = lv[1];
+
+	for (i = 2; i <= in_len; i++) {
+		info_len--;
+		if (info_len <= 1)
+			break;
+		*info++ = lv[i];
+	}
+	if (info_len >= 1)
+		*info++ = '\0';
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.25: encode 'useruser' */
+int gsm48_encode_useruser(struct msgb *msg, int lv_only,
+			   const struct gsm_mncc_useruser *uu)
+{
+	uint8_t lv[GSM_MAX_USERUSER + 2];
+
+	if (strlen(uu->info) > GSM_MAX_USERUSER)
+		return -EINVAL;
+
+	lv[0] = 1 + strlen(uu->info);
+	lv[1] = uu->proto;
+	memcpy(lv + 2, uu->info, strlen(uu->info));
+	if (lv_only)
+		msgb_lv_put(msg, lv[0], lv+1);
+	else
+		msgb_tlv_put(msg, GSM48_IE_USER_USER, lv[0], lv+1);
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.24: decode 'ss version' */
+int gsm48_decode_ssversion(struct gsm_mncc_ssversion *ssv,
+			    const uint8_t *lv)
+{
+	uint8_t in_len = lv[0];
+
+	if (in_len < 1 || in_len < sizeof(ssv->info))
+		return -EINVAL;
+
+	memcpy(ssv->info, lv + 1, in_len);
+	ssv->len = in_len;
+
+	return 0;
+}
+
+/* TS 04.08 10.5.4.24: encode 'ss version' */
+int gsm48_encode_ssversion(struct msgb *msg,
+			   const struct gsm_mncc_ssversion *ssv)
+{
+	uint8_t lv[GSM_MAX_SSVERSION + 1];
+
+	if (ssv->len > GSM_MAX_SSVERSION)
+		return -EINVAL;
+
+	lv[0] = ssv->len;
+	memcpy(lv + 1, ssv->info, ssv->len);
+	msgb_tlv_put(msg, GSM48_IE_SS_VERS, lv[0], lv+1);
+
+	return 0;
+}
+
+/* decode 'more data' does not require a function, because it has no value */
+
+/* TS 04.08 10.5.4.19: encode 'more data' */
+int gsm48_encode_more(struct msgb *msg)
+{
+	uint8_t *ie;
+
+	ie = msgb_put(msg, 1);
+	ie[0] = GSM48_IE_MORE_DATA;
+
+	return 0;
+}
+
+static int32_t smod(int32_t n, int32_t m)
+{
+	int32_t res;
+
+	res = n % m;
+
+	if (res <= 0)
+		res += m;
+
+	return res;
+}
+
+/* decode "Cell Channel Description" (10.5.2.1b) and other frequency lists */
+int gsm48_decode_freq_list(struct gsm_sysinfo_freq *f, uint8_t *cd,
+			   uint8_t len, uint8_t mask, uint8_t frqt)
+{
+	int i;
+
+	/* NOTES:
+	 *
+	 * The Range format uses "SMOD" computation.
+	 * e.g. "n SMOD m" equals "((n - 1) % m) + 1"
+	 * A cascade of multiple SMOD computations is simpified:
+	 * "(n SMOD m) SMOD o" equals "(((n - 1) % m) % o) + 1"
+	 *
+	 * The Range format uses 16 octets of data in SYSTEM INFORMATION.
+	 * When used in dedicated messages, the length can be less.
+	 * In this case the ranges are decoded for all frequencies that
+	 * fit in the block of given length.
+	 */
+
+	/* tabula rasa */
+	for (i = 0; i < 1024; i++)
+		f[i].mask &= ~frqt;
+
+	/* 00..XXX. */
+	if ((cd[0] & 0xc0 & mask) == 0x00) {
+		/* Bit map 0 format */
+		if (len < 16)
+			return -EINVAL;
+		for (i = 1; i <= 124; i++)
+			if ((cd[15 - ((i-1) >> 3)] & (1 << ((i-1) & 7))))
+				f[i].mask |= frqt;
+
+		return 0;
+	}
+
+	/* 10..0XX. */
+	if ((cd[0] & 0xc8 & mask) == 0x80) {
+		/* Range 1024 format */
+		uint16_t w[17]; /* 1..16 */
+		struct gsm48_range_1024 *r = (struct gsm48_range_1024 *)cd;
+
+		if (len < 2)
+			return -EINVAL;
+		memset(w, 0, sizeof(w));
+		if (r->f0)
+			f[0].mask |= frqt;
+		w[1] = (r->w1_hi << 8) | r->w1_lo;
+		if (len >= 4)
+			w[2] = (r->w2_hi << 1) | r->w2_lo;
+		if (len >= 5)
+			w[3] = (r->w3_hi << 2) | r->w3_lo;
+		if (len >= 6)
+			w[4] = (r->w4_hi << 2) | r->w4_lo;
+		if (len >= 7)
+			w[5] = (r->w5_hi << 2) | r->w5_lo;
+		if (len >= 8)
+			w[6] = (r->w6_hi << 2) | r->w6_lo;
+		if (len >= 9)
+			w[7] = (r->w7_hi << 2) | r->w7_lo;
+		if (len >= 10)
+			w[8] = (r->w8_hi << 1) | r->w8_lo;
+		if (len >= 10)
+			w[9] = r->w9;
+		if (len >= 11)
+			w[10] = r->w10;
+		if (len >= 12)
+			w[11] = (r->w11_hi << 6) | r->w11_lo;
+		if (len >= 13)
+			w[12] = (r->w12_hi << 5) | r->w12_lo;
+		if (len >= 14)
+			w[13] = (r->w13_hi << 4) | r->w13_lo;
+		if (len >= 15)
+			w[14] = (r->w14_hi << 3) | r->w14_lo;
+		if (len >= 16)
+			w[15] = (r->w15_hi << 2) | r->w15_lo;
+		if (len >= 16)
+			w[16] = r->w16;
+		if (w[1])
+			f[w[1]].mask |= frqt;
+		if (w[2])
+			f[smod(w[1] - 512 + w[2], 1023)].mask |= frqt;
+		if (w[3])
+			f[smod(w[1]       + w[3], 1023)].mask |= frqt;
+		if (w[4])
+			f[smod(w[1] - 512 + smod(w[2] - 256 + w[4], 511), 1023)].mask |= frqt;
+		if (w[5])
+			f[smod(w[1]       + smod(w[3] - 256 + w[5], 511), 1023)].mask |= frqt;
+		if (w[6])
+			f[smod(w[1] - 512 + smod(w[2]       + w[6], 511), 1023)].mask |= frqt;
+		if (w[7])
+			f[smod(w[1]       + smod(w[3]       + w[7], 511), 1023)].mask |= frqt;
+		if (w[8])
+			f[smod(w[1] - 512 + smod(w[2] - 256 + smod(w[4] - 128 + w[8] , 255), 511), 1023)].mask |= frqt;
+		if (w[9])
+			f[smod(w[1]       + smod(w[3] - 256 + smod(w[5] - 128 + w[9] , 255), 511), 1023)].mask |= frqt;
+		if (w[10])
+			f[smod(w[1] - 512 + smod(w[2]       + smod(w[6] - 128 + w[10], 255), 511), 1023)].mask |= frqt;
+		if (w[11])
+			f[smod(w[1]       + smod(w[3]       + smod(w[7] - 128 + w[11], 255), 511), 1023)].mask |= frqt;
+		if (w[12])
+			f[smod(w[1] - 512 + smod(w[2] - 256 + smod(w[4]       + w[12], 255), 511), 1023)].mask |= frqt;
+		if (w[13])
+			f[smod(w[1]       + smod(w[3] - 256 + smod(w[5]       + w[13], 255), 511), 1023)].mask |= frqt;
+		if (w[14])
+			f[smod(w[1] - 512 + smod(w[2]       + smod(w[6]       + w[14], 255), 511), 1023)].mask |= frqt;
+		if (w[15])
+			f[smod(w[1]       + smod(w[3]       + smod(w[7]       + w[15], 255), 511), 1023)].mask |= frqt;
+		if (w[16])
+			f[smod(w[1] - 512 + smod(w[2] - 256 + smod(w[4] - 128 + smod(w[8] - 64 + w[16], 127), 255), 511), 1023)].mask |= frqt;
+
+		return 0;
+	}
+	/* 10..100. */
+	if ((cd[0] & 0xce & mask) == 0x88) {
+		/* Range 512 format */
+		uint16_t w[18]; /* 1..17 */
+		struct gsm48_range_512 *r = (struct gsm48_range_512 *)cd;
+
+		if (len < 4)
+			return -EINVAL;
+		memset(w, 0, sizeof(w));
+		w[0] = (r->orig_arfcn_hi << 9) | (r->orig_arfcn_mid << 1) | r->orig_arfcn_lo;
+		w[1] = (r->w1_hi << 2) | r->w1_lo;
+		if (len >= 5)
+			w[2] = (r->w2_hi << 2) | r->w2_lo;
+		if (len >= 6)
+			w[3] = (r->w3_hi << 2) | r->w3_lo;
+		if (len >= 7)
+			w[4] = (r->w4_hi << 1) | r->w4_lo;
+		if (len >= 7)
+			w[5] = r->w5;
+		if (len >= 8)
+			w[6] = r->w6;
+		if (len >= 9)
+			w[7] = (r->w7_hi << 6) | r->w7_lo;
+		if (len >= 10)
+			w[8] = (r->w8_hi << 4) | r->w8_lo;
+		if (len >= 11)
+			w[9] = (r->w9_hi << 2) | r->w9_lo;
+		if (len >= 11)
+			w[10] = r->w10;
+		if (len >= 12)
+			w[11] = r->w11;
+		if (len >= 13)
+			w[12] = (r->w12_hi << 4) | r->w12_lo;
+		if (len >= 14)
+			w[13] = (r->w13_hi << 2) | r->w13_lo;
+		if (len >= 14)
+			w[14] = r->w14;
+		if (len >= 15)
+			w[15] = r->w15;
+		if (len >= 16)
+			w[16] = (r->w16_hi << 3) | r->w16_lo;
+		if (len >= 16)
+			w[17] = r->w17;
+		f[w[0]].mask |= frqt;
+		if (w[1])
+			f[(w[0] + w[1]) % 1024].mask |= frqt;
+		if (w[2])
+			f[(w[0] + smod(w[1] - 256 + w[2], 511)) % 1024].mask |= frqt;
+		if (w[3])
+			f[(w[0] + smod(w[1]       + w[3], 511)) % 1024].mask |= frqt;
+		if (w[4])
+			f[(w[0] + smod(w[1] - 256 + smod(w[2] - 128 + w[4], 255), 511)) % 1024].mask |= frqt;
+		if (w[5])
+			f[(w[0] + smod(w[1]       + smod(w[3] - 128 + w[5], 255), 511)) % 1024].mask |= frqt;
+		if (w[6])
+			f[(w[0] + smod(w[1] - 256 + smod(w[2]       + w[6], 255), 511)) % 1024].mask |= frqt;
+		if (w[7])
+			f[(w[0] + smod(w[1]       + smod(w[3]       + w[7], 255), 511)) % 1024].mask |= frqt;
+		if (w[8])
+			f[(w[0] + smod(w[1] - 256 + smod(w[2] - 128 + smod(w[4] - 64 + w[8] , 127), 255), 511)) % 1024].mask |= frqt;
+		if (w[9])
+			f[(w[0] + smod(w[1]       + smod(w[3] - 128 + smod(w[5] - 64 + w[9] , 127), 255), 511)) % 1024].mask |= frqt;
+		if (w[10])
+			f[(w[0] + smod(w[1] - 256 + smod(w[2]       + smod(w[6] - 64 + w[10], 127), 255), 511)) % 1024].mask |= frqt;
+		if (w[11])
+			f[(w[0] + smod(w[1]       + smod(w[3]       + smod(w[7] - 64 + w[11], 127), 255), 511)) % 1024].mask |= frqt;
+		if (w[12])
+			f[(w[0] + smod(w[1] - 256 + smod(w[2] - 128 + smod(w[4]      + w[12], 127), 255), 511)) % 1024].mask |= frqt;
+		if (w[13])
+			f[(w[0] + smod(w[1]       + smod(w[3] - 128 + smod(w[5]      + w[13], 127), 255), 511)) % 1024].mask |= frqt;
+		if (w[14])
+			f[(w[0] + smod(w[1] - 256 + smod(w[2]       + smod(w[6]      + w[14], 127), 255), 511)) % 1024].mask |= frqt;
+		if (w[15])
+			f[(w[0] + smod(w[1]       + smod(w[3]       + smod(w[7]      + w[15], 127), 255), 511)) % 1024].mask |= frqt;
+		if (w[16])
+			f[(w[0] + smod(w[1] - 256 + smod(w[2] - 128 + smod(w[4] - 64 + smod(w[8] - 32 + w[16], 63), 127), 255), 511)) % 1024].mask |= frqt;
+		if (w[17])
+			f[(w[0] + smod(w[1]       + smod(w[3] - 128 + smod(w[5] - 64 + smod(w[9] - 32 + w[17], 63), 127), 255), 511)) % 1024].mask |= frqt;
+
+		return 0;
+	}
+	/* 10..101. */
+	if ((cd[0] & 0xce & mask) == 0x8a) {
+		/* Range 256 format */
+		uint16_t w[22]; /* 1..21 */
+		struct gsm48_range_256 *r = (struct gsm48_range_256 *)cd;
+
+		if (len < 4)
+			return -EINVAL;
+		memset(w, 0, sizeof(w));
+		w[0] = (r->orig_arfcn_hi << 9) | (r->orig_arfcn_mid << 1) | r->orig_arfcn_lo;
+		w[1] = (r->w1_hi << 1) | r->w1_lo;
+		if (len >= 4)
+			w[2] = r->w2;
+		if (len >= 5)
+			w[3] = r->w3;
+		if (len >= 6)
+			w[4] = (r->w4_hi << 5) | r->w4_lo;
+		if (len >= 7)
+			w[5] = (r->w5_hi << 3) | r->w5_lo;
+		if (len >= 8)
+			w[6] = (r->w6_hi << 1) | r->w6_lo;
+		if (len >= 8)
+			w[7] = r->w7;
+		if (len >= 9)
+			w[8] = (r->w8_hi << 4) | r->w8_lo;
+		if (len >= 10)
+			w[9] = (r->w9_hi << 1) | r->w9_lo;
+		if (len >= 10)
+			w[10] = r->w10;
+		if (len >= 11)
+			w[11] = (r->w11_hi << 3) | r->w11_lo;
+		if (len >= 11)
+			w[12] = r->w12;
+		if (len >= 12)
+			w[13] = r->w13;
+		if (len >= 13)
+			w[14] = r->w15;
+		if (len >= 13)
+			w[15] = (r->w14_hi << 2) | r->w14_lo;
+		if (len >= 14)
+			w[16] = (r->w16_hi << 3) | r->w16_lo;
+		if (len >= 14)
+			w[17] = r->w17;
+		if (len >= 15)
+			w[18] = r->w19;
+		if (len >= 15)
+			w[19] = (r->w18_hi << 3) | r->w18_lo;
+		if (len >= 16)
+			w[20] = (r->w20_hi << 3) | r->w20_lo;
+		if (len >= 16)
+			w[21] = r->w21;
+		f[w[0]].mask |= frqt;
+		if (w[1])
+			f[(w[0] + w[1]) % 1024].mask |= frqt;
+		if (w[2])
+			f[(w[0] + smod(w[1] - 128 + w[2], 255)) % 1024].mask |= frqt;
+		if (w[3])
+			f[(w[0] + smod(w[1]       + w[3], 255)) % 1024].mask |= frqt;
+		if (w[4])
+			f[(w[0] + smod(w[1] - 128 + smod(w[2] - 64 + w[4], 127), 255)) % 1024].mask |= frqt;
+		if (w[5])
+			f[(w[0] + smod(w[1]       + smod(w[3] - 64 + w[5], 127), 255)) % 1024].mask |= frqt;
+		if (w[6])
+			f[(w[0] + smod(w[1] - 128 + smod(w[2]      + w[6], 127), 255)) % 1024].mask |= frqt;
+		if (w[7])
+			f[(w[0] + smod(w[1]       + smod(w[3]      + w[7], 127), 255)) % 1024].mask |= frqt;
+		if (w[8])
+			f[(w[0] + smod(w[1] - 128 + smod(w[2] - 64 + smod(w[4] - 32 + w[8] , 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[9])
+			f[(w[0] + smod(w[1]       + smod(w[3] - 64 + smod(w[5] - 32 + w[9] , 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[10])
+			f[(w[0] + smod(w[1] - 128 + smod(w[2]      + smod(w[6] - 32 + w[10], 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[11])
+			f[(w[0] + smod(w[1]       + smod(w[3]      + smod(w[7] - 32 + w[11], 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[12])
+			f[(w[0] + smod(w[1] - 128 + smod(w[2] - 64 + smod(w[4]      + w[12], 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[13])
+			f[(w[0] + smod(w[1]       + smod(w[3] - 64 + smod(w[5]      + w[13], 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[14])
+			f[(w[0] + smod(w[1] - 128 + smod(w[2]      + smod(w[6]      + w[14], 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[15])
+			f[(w[0] + smod(w[1]       + smod(w[3]      + smod(w[7]      + w[15], 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[16])
+			f[(w[0] + smod(w[1] - 128 + smod(w[2] - 64 + smod(w[4] - 32 + smod(w[8]  - 16 + w[16], 31), 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[17])
+			f[(w[0] + smod(w[1]       + smod(w[3] - 64 + smod(w[5] - 32 + smod(w[9]  - 16 + w[17], 31), 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[18])
+			f[(w[0] + smod(w[1] - 128 + smod(w[2]      + smod(w[6] - 32 + smod(w[10] - 16 + w[18], 31), 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[19])
+			f[(w[0] + smod(w[1]       + smod(w[3]      + smod(w[7] - 32 + smod(w[11] - 16 + w[19], 31), 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[20])
+			f[(w[0] + smod(w[1] - 128 + smod(w[2] - 64 + smod(w[4]      + smod(w[12] - 16 + w[20], 31), 63), 127), 255)) % 1024].mask |= frqt;
+		if (w[21])
+			f[(w[0] + smod(w[1]       + smod(w[3] - 64 + smod(w[5]      + smod(w[13] - 16 + w[21], 31), 63), 127), 255)) % 1024].mask |= frqt;
+
+		return 0;
+	}
+	/* 10..110. */
+	if ((cd[0] & 0xce & mask) == 0x8c) {
+		/* Range 128 format */
+		uint16_t w[29]; /* 1..28 */
+		struct gsm48_range_128 *r = (struct gsm48_range_128 *)cd;
+
+		if (len < 3)
+			return -EINVAL;
+		memset(w, 0, sizeof(w));
+		w[0] = (r->orig_arfcn_hi << 9) | (r->orig_arfcn_mid << 1) | r->orig_arfcn_lo;
+		w[1] = r->w1;
+		if (len >= 4)
+			w[2] = r->w2;
+		if (len >= 5)
+			w[3] = (r->w3_hi << 4) | r->w3_lo;
+		if (len >= 6)
+			w[4] = (r->w4_hi << 1) | r->w4_lo;
+		if (len >= 6)
+			w[5] = r->w5;
+		if (len >= 7)
+			w[6] = (r->w6_hi << 3) | r->w6_lo;
+		if (len >= 7)
+			w[7] = r->w7;
+		if (len >= 8)
+			w[8] = r->w8;
+		if (len >= 8)
+			w[9] = r->w9;
+		if (len >= 9)
+			w[10] = r->w10;
+		if (len >= 9)
+			w[11] = r->w11;
+		if (len >= 10)
+			w[12] = r->w12;
+		if (len >= 10)
+			w[13] = r->w13;
+		if (len >= 11)
+			w[14] = r->w14;
+		if (len >= 11)
+			w[15] = r->w15;
+		if (len >= 12)
+			w[16] = r->w16;
+		if (len >= 12)
+			w[17] = r->w17;
+		if (len >= 13)
+			w[18] = (r->w18_hi << 1) | r->w18_lo;
+		if (len >= 13)
+			w[19] = r->w19;
+		if (len >= 13)
+			w[20] = r->w20;
+		if (len >= 14)
+			w[21] = (r->w21_hi << 2) | r->w21_lo;
+		if (len >= 14)
+			w[22] = r->w22;
+		if (len >= 14)
+			w[23] = r->w23;
+		if (len >= 15)
+			w[24] = r->w24;
+		if (len >= 15)
+			w[25] = r->w25;
+		if (len >= 16)
+			w[26] = (r->w26_hi << 1) | r->w26_lo;
+		if (len >= 16)
+			w[27] = r->w27;
+		if (len >= 16)
+			w[28] = r->w28;
+		f[w[0]].mask |= frqt;
+		if (w[1])
+			f[(w[0] + w[1]) % 1024].mask |= frqt;
+		if (w[2])
+			f[(w[0] + smod(w[1] - 64 + w[2], 127)) % 1024].mask |= frqt;
+		if (w[3])
+			f[(w[0] + smod(w[1]      + w[3], 127)) % 1024].mask |= frqt;
+		if (w[4])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2] - 32 + w[4], 63), 127)) % 1024].mask |= frqt;
+		if (w[5])
+			f[(w[0] + smod(w[1]      + smod(w[3] - 32 + w[5], 63), 127)) % 1024].mask |= frqt;
+		if (w[6])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2]      + w[6], 63), 127)) % 1024].mask |= frqt;
+		if (w[7])
+			f[(w[0] + smod(w[1]      + smod(w[3]      + w[7], 63), 127)) % 1024].mask |= frqt;
+		if (w[8])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2] - 32 + smod(w[4] - 16 + w[8] , 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[9])
+			f[(w[0] + smod(w[1]      + smod(w[3] - 32 + smod(w[5] - 16 + w[9] , 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[10])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2]      + smod(w[6] - 16 + w[10], 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[11])
+			f[(w[0] + smod(w[1]      + smod(w[3]      + smod(w[7] - 16 + w[11], 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[12])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2] - 32 + smod(w[4]      + w[12], 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[13])
+			f[(w[0] + smod(w[1]      + smod(w[3] - 32 + smod(w[5]      + w[13], 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[14])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2]      + smod(w[6]      + w[14], 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[15])
+			f[(w[0] + smod(w[1]      + smod(w[3]      + smod(w[7]      + w[15], 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[16])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2] - 32 + smod(w[4] - 16 + smod(w[8]  - 8 + w[16], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[17])
+			f[(w[0] + smod(w[1]      + smod(w[3] - 32 + smod(w[5] - 16 + smod(w[9]  - 8 + w[17], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[18])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2]      + smod(w[6] - 16 + smod(w[10] - 8 + w[18], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[19])
+			f[(w[0] + smod(w[1]      + smod(w[3]      + smod(w[7] - 16 + smod(w[11] - 8 + w[19], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[20])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2] - 32 + smod(w[4]      + smod(w[12] - 8 + w[20], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[21])
+			f[(w[0] + smod(w[1]      + smod(w[3] - 32 + smod(w[5]      + smod(w[13] - 8 + w[21], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[22])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2]      + smod(w[6]      + smod(w[14] - 8 + w[22], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[23])
+			f[(w[0] + smod(w[1]      + smod(w[3]      + smod(w[7]      + smod(w[15] - 8 + w[23], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[24])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2] - 32 + smod(w[4] - 16 + smod(w[8]      + w[24], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[25])
+			f[(w[0] + smod(w[1]      + smod(w[3] - 32 + smod(w[5] - 16 + smod(w[9]      + w[25], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[26])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2]      + smod(w[6] - 16 + smod(w[10]     + w[26], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[27])
+			f[(w[0] + smod(w[1]      + smod(w[3]      + smod(w[7] - 16 + smod(w[11]     + w[27], 15), 31), 63), 127)) % 1024].mask |= frqt;
+		if (w[28])
+			f[(w[0] + smod(w[1] - 64 + smod(w[2] - 32 + smod(w[4]      + smod(w[12]     + w[28], 15), 31), 63), 127)) % 1024].mask |= frqt;
+
+		return 0;
+	}
+	/* 10..111. */
+	if ((cd[0] & 0xce & mask) == 0x8e) {
+		/* Variable bitmap format (can be any length >= 3) */
+		uint16_t orig = 0;
+		struct gsm48_var_bit *r = (struct gsm48_var_bit *)cd;
+
+		if (len < 3)
+			return -EINVAL;
+		orig = (r->orig_arfcn_hi << 9) | (r->orig_arfcn_mid << 1) | r->orig_arfcn_lo;
+		f[orig].mask |= frqt;
+		for (i = 1; 2 + (i >> 3) < len; i++)
+			if ((cd[2 + (i >> 3)] & (0x80 >> (i & 7))))
+				f[(orig + i) % 1024].mask |= frqt;
+
+		return 0;
+	}
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/gsm/gsm_utils.c b/src/shared/libosmocore/src/gsm/gsm_utils.c
new file mode 100644
index 00000000..8b1fae08
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/gsm_utils.c
@@ -0,0 +1,606 @@
+/*
+ * (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
+ * (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009-2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010-2012 by Nico Golde <nico@ngolde.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \mainpage libosmogsm Documentation
+ *
+ * \section sec_intro Introduction
+ * This library is a collection of common code used in various
+ * GSM related sub-projects inside the Osmocom family of projects.  It
+ * includes A5/1 and A5/2 ciphers, COMP128v1, a LAPDm implementation,
+ * a GSM TLV parser, SMS utility routines as well as 
+ * protocol definitions for a series of protocols:
+ * 	* Um L2 (04.06)
+ * 	* Um L3 (04.08)
+ * 	* A-bis RSL (08.58)
+ * 	* A-bis OML (08.59, 12.21)
+ * 	* A (08.08)
+ * \n\n
+ * Please note that C language projects inside Osmocom are typically
+ * single-threaded event-loop state machine designs.  As such,
+ * routines in libosmogsm are not thread-safe.  If you must use them in
+ * a multi-threaded context, you have to add your own locking.
+ *
+ * \section sec_copyright Copyright and License
+ * Copyright © 2008-2011 - Harald Welte, Holger Freyther and contributors\n
+ * All rights reserved. \n\n
+ * The source code of libosmogsm is licensed under the terms of the GNU
+ * General Public License as published by the Free Software Foundation;
+ * either version 2 of the License, or (at your option) any later
+ * version.\n
+ * See <http://www.gnu.org/licenses/> or COPYING included in the source
+ * code package istelf.\n
+ * The information detailed here is provided AS IS with NO WARRANTY OF
+ * ANY KIND, INCLUDING THE WARRANTY OF DESIGN, MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE.
+ * \n\n
+ *
+ * \section sec_contact Contact and Support
+ * Community-based support is available at the OpenBSC mailing list
+ * <http://lists.osmocom.org/mailman/listinfo/openbsc>\n
+ * Commercial support options available upon request from
+ * <http://sysmocom.de/>
+ */
+
+//#include <openbsc/gsm_data.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include <errno.h>
+#include <ctype.h>
+
+#include "../../config.h"
+
+/* ETSI GSM 03.38 6.2.1 and 6.2.1.1 default alphabet
+ * Greek symbols at hex positions 0x10 and 0x12-0x1a
+ * left out as they can't be handled with a char and
+ * since most phones don't display or write these
+ * characters this would only needlessly make the code
+ * more complex
+*/
+static unsigned char gsm_7bit_alphabet[] = {
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0a, 0xff, 0xff, 0x0d, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0x20, 0x21, 0x22, 0x23, 0x02, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c,
+	0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
+	0x3c, 0x3d, 0x3e, 0x3f, 0x00, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a,
+	0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59,
+	0x5a, 0x3c, 0x2f, 0x3e, 0x14, 0x11, 0xff, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68,
+	0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
+	0x78, 0x79, 0x7a, 0x28, 0x40, 0x29, 0x3d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0x0c, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x5e, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x40, 0xff, 0x01, 0xff,
+	0x03, 0xff, 0x7b, 0x7d, 0xff, 0xff, 0xff, 0xff, 0xff, 0x5c, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x5b, 0x7e, 0x5d, 0xff, 0x7c, 0xff, 0xff, 0xff,
+	0xff, 0x5b, 0x0e, 0x1c, 0x09, 0xff, 0x1f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x5d,
+	0xff, 0xff, 0xff, 0xff, 0x5c, 0xff, 0x0b, 0xff, 0xff, 0xff, 0x5e, 0xff, 0xff, 0x1e, 0x7f,
+	0xff, 0xff, 0xff, 0x7b, 0x0f, 0x1d, 0xff, 0x04, 0x05, 0xff, 0xff, 0x07, 0xff, 0xff, 0xff,
+	0xff, 0x7d, 0x08, 0xff, 0xff, 0xff, 0x7c, 0xff, 0x0c, 0x06, 0xff, 0xff, 0x7e, 0xff, 0xff
+};
+
+/* GSM 03.38 6.2.1 Character lookup for decoding */
+static int gsm_septet_lookup(uint8_t ch)
+{
+	int i = 0;
+	for (; i < sizeof(gsm_7bit_alphabet); i++) {
+		if (gsm_7bit_alphabet[i] == ch)
+			return i;
+	}
+	return -1;
+}
+
+/* Compute the number of octets from the number of septets, for instance: 47 septets needs 41,125 = 42 octets */
+uint8_t gsm_get_octet_len(const uint8_t sept_len){
+	int octet_len = (sept_len * 7) / 8;
+	if ((sept_len * 7) % 8 != 0)
+		octet_len++;
+
+	return octet_len;
+}
+
+/* GSM 03.38 6.2.1 Character unpacking */
+int gsm_7bit_decode_hdr(char *text, const uint8_t *user_data, uint8_t septet_l, uint8_t ud_hdr_ind)
+{
+	int i = 0;
+	int shift = 0;
+	uint8_t c;
+	uint8_t next_is_ext = 0;
+
+	/* skip the user data header */
+	if (ud_hdr_ind) {
+		/* get user data header length + 1 (for the 'user data header length'-field) */
+		shift = ((user_data[0] + 1) * 8) / 7;
+		if ((((user_data[0] + 1) * 8) % 7) != 0)
+			shift++;
+		septet_l = septet_l - shift;
+	}
+
+	for (i = 0; i < septet_l; i++) {
+		c =
+			((user_data[((i + shift) * 7 + 7) >> 3] <<
+			  (7 - (((i + shift) * 7 + 7) & 7))) |
+			 (user_data[((i + shift) * 7) >> 3] >>
+			  (((i + shift) * 7) & 7))) & 0x7f;
+
+		/* this is an extension character */
+		if (next_is_ext) {
+			next_is_ext = 0;
+			*(text++) = gsm_7bit_alphabet[0x7f + c];
+			continue;
+		}
+
+		if (c == 0x1b && i + 1 < septet_l) {
+			next_is_ext = 1;
+		} else {
+			*(text++) = gsm_septet_lookup(c);
+		}
+	}
+
+	if (ud_hdr_ind)
+		i += shift;
+	*text = '\0';
+
+	return i;
+}
+
+int gsm_7bit_decode(char *text, const uint8_t *user_data, uint8_t septet_l)
+{
+	return gsm_7bit_decode_hdr(text, user_data, septet_l, 0);
+}
+
+/* GSM 03.38 6.2.1 Prepare character packing */
+int gsm_septet_encode(uint8_t *result, const char *data)
+{
+	int i, y = 0;
+	uint8_t ch;
+	for (i = 0; i < strlen(data); i++) {
+		ch = data[i];
+		switch(ch){
+		/* fall-through for extension characters */
+		case 0x0c:
+		case 0x5e:
+		case 0x7b:
+		case 0x7d:
+		case 0x5c:
+		case 0x5b:
+		case 0x7e:
+		case 0x5d:
+		case 0x7c:
+			result[y++] = 0x1b;
+		default:
+			result[y] = gsm_7bit_alphabet[ch];
+			break;
+		}
+		y++;
+	}
+
+	return y;
+}
+
+/* 7bit to octet packing */
+int gsm_septets2octets(uint8_t *result, uint8_t *rdata, uint8_t septet_len, uint8_t padding){
+	int i = 0, z = 0;
+	uint8_t cb, nb;
+	int shift = 0;
+	uint8_t *data = calloc(septet_len + 1, sizeof(uint8_t));
+
+	if (padding) {
+		shift = 7 - padding;
+		/* the first zero is needed for padding */
+		memcpy(data + 1, rdata, septet_len);
+		septet_len++;
+	} else
+		memcpy(data, rdata, septet_len);
+
+	for (i = 0; i < septet_len; i++) {
+		if (shift == 7) {
+			/*
+			 * special end case with the. This is necessary if the
+			 * last septet fits into the previous octet. E.g. 48
+			 * non-extension characters:
+			 *   ....ag ( a = 1100001, g = 1100111)
+			 * result[40] = 100001 XX, result[41] = 1100111 1 */
+			if (i + 1 < septet_len) {
+				shift = 0;
+				continue;
+			} else if (i + 1 == septet_len)
+				break;
+		}
+
+		cb = (data[i] & 0x7f) >> shift;
+		if (i + 1 < septet_len) {
+			nb = (data[i + 1] & 0x7f) << (7 - shift);
+			cb = cb | nb;
+		}
+
+		result[z++] = cb;
+		shift++;
+	}
+
+	free(data);
+
+	return z;
+}
+
+/* GSM 03.38 6.2.1 Character packing */
+int gsm_7bit_encode(uint8_t *result, const char *data)
+{
+	int y = 0;
+
+	/* prepare for the worst case, every character expanding to two bytes */
+	uint8_t *rdata = calloc(strlen(data) * 2, sizeof(uint8_t));
+	y = gsm_septet_encode(rdata, data);
+	gsm_septets2octets(result, rdata, y, 0);
+
+	free(rdata);
+
+	/*
+	 * We don't care about the number of octets, because they are not
+	 * unique. E.g.:
+	 *  1.) 46 non-extension characters + 1 extension character
+	 *         => (46 * 7 bit + (1 * (2 * 7 bit))) / 8 bit =  42 octets
+	 *  2.) 47 non-extension characters
+	 *         => (47 * 7 bit) / 8 bit = 41,125 = 42 octets
+	 *  3.) 48 non-extension characters
+	 *         => (48 * 7 bit) / 8 bit = 42 octects
+	 */
+	return y;
+}
+
+/* convert power class to dBm according to GSM TS 05.05 */
+unsigned int ms_class_gmsk_dbm(enum gsm_band band, int class)
+{
+	switch (band) {
+	case GSM_BAND_450:
+	case GSM_BAND_480:
+	case GSM_BAND_750:
+	case GSM_BAND_900:
+	case GSM_BAND_810:
+	case GSM_BAND_850:
+		if (class == 1)
+			return 43; /* 20W */
+		if (class == 2)
+			return 39; /* 8W */
+		if (class == 3)
+			return 37; /* 5W */
+		if (class == 4)
+			return 33; /* 2W */
+		if (class == 5)
+			return 29; /* 0.8W */
+		break;
+	case GSM_BAND_1800:
+		if (class == 1)
+			return 30; /* 1W */
+		if (class == 2)
+			return 24; /* 0.25W */
+		if (class == 3)
+			return 36; /* 4W */
+		break;
+	case GSM_BAND_1900:
+		if (class == 1)
+			return 30; /* 1W */
+		if (class == 2)
+			return 24; /* 0.25W */
+		if (class == 3)
+			return 33; /* 2W */
+		break;
+	}
+	return -EINVAL;
+}
+
+/* determine power control level for given dBm value, as indicated
+ * by the tables in chapter 4.1.1 of GSM TS 05.05 */
+int ms_pwr_ctl_lvl(enum gsm_band band, unsigned int dbm)
+{
+	switch (band) {
+	case GSM_BAND_450:
+	case GSM_BAND_480:
+	case GSM_BAND_750:
+	case GSM_BAND_900:
+	case GSM_BAND_810:
+	case GSM_BAND_850:
+		if (dbm >= 39)
+			return 0;
+		else if (dbm < 5)
+			return 19;
+		else {
+			/* we are guaranteed to have (5 <= dbm < 39) */
+			return 2 + ((39 - dbm) / 2);
+		}
+		break;
+	case GSM_BAND_1800:
+		if (dbm >= 36)
+			return 29;
+		else if (dbm >= 34)	
+			return 30;
+		else if (dbm >= 32)
+			return 31;
+		else if (dbm == 31)
+			return 0;
+		else {
+			/* we are guaranteed to have (0 <= dbm < 31) */
+			return (30 - dbm) / 2;
+		}
+		break;
+	case GSM_BAND_1900:
+		if (dbm >= 33)
+			return 30;
+		else if (dbm >= 32)
+			return 31;
+		else if (dbm == 31)
+			return 0;
+		else {
+			/* we are guaranteed to have (0 <= dbm < 31) */
+			return (30 - dbm) / 2;
+		}
+		break;
+	}
+	return -EINVAL;
+}
+
+int ms_pwr_dbm(enum gsm_band band, uint8_t lvl)
+{
+	lvl &= 0x1f;
+
+	switch (band) {
+	case GSM_BAND_450:
+	case GSM_BAND_480:
+	case GSM_BAND_750:
+	case GSM_BAND_900:
+	case GSM_BAND_810:
+	case GSM_BAND_850:
+		if (lvl < 2)
+			return 39;
+		else if (lvl < 20)
+			return 39 - ((lvl - 2) * 2) ;
+		else
+			return 5;
+		break;
+	case GSM_BAND_1800:
+		if (lvl < 16)
+			return 30 - (lvl * 2);
+		else if (lvl < 29)
+			return 0;
+		else
+			return 36 - ((lvl - 29) * 2);
+		break;
+	case GSM_BAND_1900:
+		if (lvl < 16)
+			return 30 - (lvl * 2);
+		else if (lvl < 30)
+			return -EINVAL;
+		else
+			return 33 - (lvl - 30);
+		break;
+	}
+	return -EINVAL;
+}
+
+/* According to TS 08.05 Chapter 8.1.4 */
+int rxlev2dbm(uint8_t rxlev)
+{
+	if (rxlev > 63)
+		rxlev = 63;
+
+	return -110 + rxlev;
+}
+
+/* According to TS 08.05 Chapter 8.1.4 */
+uint8_t dbm2rxlev(int dbm)
+{
+	int rxlev = dbm + 110;
+
+	if (rxlev > 63)
+		rxlev = 63;
+	else if (rxlev < 0)
+		rxlev = 0;
+
+	return rxlev;
+}
+
+const char *gsm_band_name(enum gsm_band band)
+{
+	switch (band) {
+	case GSM_BAND_450:
+		return "GSM450";
+	case GSM_BAND_480:
+		return "GSM480";
+	case GSM_BAND_750:
+		return "GSM750";
+	case GSM_BAND_810:
+		return "GSM810";
+	case GSM_BAND_850:
+		return "GSM850";
+	case GSM_BAND_900:
+		return "GSM900";
+	case GSM_BAND_1800:
+		return "DCS1800";
+	case GSM_BAND_1900:
+		return "PCS1900";
+	}
+	return "invalid";
+}
+
+enum gsm_band gsm_band_parse(const char* mhz)
+{
+	while (*mhz && !isdigit(*mhz))
+		mhz++;
+
+	if (*mhz == '\0')
+		return -EINVAL;
+
+	switch (strtol(mhz, NULL, 10)) {
+	case 450:
+		return GSM_BAND_450;
+	case 480:
+		return GSM_BAND_480;
+	case 750:
+		return GSM_BAND_750;
+	case 810:
+		return GSM_BAND_810;
+	case 850:
+		return GSM_BAND_850;
+	case 900:
+		return GSM_BAND_900;
+	case 1800:
+		return GSM_BAND_1800;
+	case 1900:
+		return GSM_BAND_1900;
+	default:
+		return -EINVAL;
+	}
+}
+
+enum gsm_band gsm_arfcn2band(uint16_t arfcn)
+{
+	int is_pcs = arfcn & ARFCN_PCS;
+
+	arfcn &= ~ARFCN_FLAG_MASK;
+
+	if (is_pcs)
+		return GSM_BAND_1900;
+	else if (arfcn <= 124)
+		return GSM_BAND_900;
+	else if (arfcn >= 955 && arfcn <= 1023)
+		return GSM_BAND_900;
+	else if (arfcn >= 128 && arfcn <= 251)
+		return GSM_BAND_850;
+	else if (arfcn >= 512 && arfcn <= 885)
+		return GSM_BAND_1800;
+	else if (arfcn >= 259 && arfcn <= 293)
+		return GSM_BAND_450;
+	else if (arfcn >= 306 && arfcn <= 340)
+		return GSM_BAND_480;
+	else if (arfcn >= 350 && arfcn <= 425)
+		return GSM_BAND_810;
+	else if (arfcn >= 438 && arfcn <= 511)
+		return GSM_BAND_750;
+	else
+		return GSM_BAND_1800;
+}
+
+/* Convert an ARFCN to the frequency in MHz * 10 */
+uint16_t gsm_arfcn2freq10(uint16_t arfcn, int uplink)
+{
+	uint16_t freq10_ul;
+	uint16_t freq10_dl;
+	int is_pcs = arfcn & ARFCN_PCS;
+
+	arfcn &= ~ARFCN_FLAG_MASK;
+
+	if (is_pcs) {
+		/* DCS 1900 */
+		arfcn &= ~ARFCN_PCS;
+		freq10_ul = 18502 + 2 * (arfcn-512);
+		freq10_dl = freq10_ul + 800;
+	} else if (arfcn <= 124) {
+		/* Primary GSM + ARFCN 0 of E-GSM */
+		freq10_ul = 8900 + 2 * arfcn;
+		freq10_dl = freq10_ul + 450;
+	} else if (arfcn >= 955 && arfcn <= 1023) {
+		/* E-GSM and R-GSM */
+		freq10_ul = 8900 + 2 * (arfcn - 1024);
+		freq10_dl = freq10_ul + 450;
+	} else if (arfcn >= 128 && arfcn <= 251) {
+		/* GSM 850 */
+		freq10_ul = 8242 + 2 * (arfcn - 128);
+		freq10_dl = freq10_ul + 450;
+	} else if (arfcn >= 512 && arfcn <= 885) {
+		/* DCS 1800 */
+		freq10_ul = 17102 + 2 * (arfcn - 512);
+		freq10_dl = freq10_ul + 950;
+	} else if (arfcn >= 259 && arfcn <= 293) {
+		/* GSM 450 */
+		freq10_ul = 4506 + 2 * (arfcn - 259);
+		freq10_dl = freq10_ul + 100;
+	} else if (arfcn >= 306 && arfcn <= 340) {
+		/* GSM 480 */
+		freq10_ul = 4790 + 2 * (arfcn - 306);
+		freq10_dl = freq10_ul + 100;
+	} else if (arfcn >= 350 && arfcn <= 425) {
+		/* GSM 810 */
+		freq10_ul = 8060 + 2 * (arfcn - 350);
+		freq10_dl = freq10_ul + 450;
+	} else if (arfcn >= 438 && arfcn <= 511) {
+		/* GSM 750 */
+		freq10_ul = 7472 + 2 * (arfcn - 438);
+		freq10_dl = freq10_ul + 300;
+	} else
+		return 0xffff;
+
+	if (uplink)
+		return freq10_ul;
+	else
+		return freq10_dl;
+}
+
+void gsm_fn2gsmtime(struct gsm_time *time, uint32_t fn)
+{
+	time->fn = fn;
+	time->t1 = time->fn / (26*51);
+	time->t2 = time->fn % 26;
+	time->t3 = time->fn % 51;
+	time->tc = (time->fn / 51) % 8;
+}
+
+uint32_t gsm_gsmtime2fn(struct gsm_time *time)
+{
+	/* TS 05.02 Chapter 4.3.3 TDMA frame number */
+	return (51 * ((time->t3 - time->t2 + 26) % 26) + time->t3 + (26 * 51 * time->t1));
+}
+
+/* TS 03.03 Chapter 2.6 */
+int gprs_tlli_type(uint32_t tlli)
+{
+	if ((tlli & 0xc0000000) == 0xc0000000)
+		return TLLI_LOCAL;
+	else if ((tlli & 0xc0000000) == 0x80000000)
+		return TLLI_FOREIGN;
+	else if ((tlli & 0xf8000000) == 0x78000000)
+		return TLLI_RANDOM;
+	else if ((tlli & 0xf8000000) == 0x70000000)
+		return TLLI_AUXILIARY;
+
+	return TLLI_RESERVED;
+}
+
+uint32_t gprs_tmsi2tlli(uint32_t p_tmsi, enum gprs_tlli_type type)
+{
+	uint32_t tlli;
+	switch (type) {
+	case TLLI_LOCAL:
+		tlli = p_tmsi | 0xc0000000;
+		break;
+	case TLLI_FOREIGN:
+		tlli = (p_tmsi & 0x3fffffff) | 0x80000000;
+		break;
+	default:
+		tlli = 0;
+		break;
+	}
+	return tlli;
+}
diff --git a/src/shared/libosmocore/src/gsm/lapd_core.c b/src/shared/libosmocore/src/gsm/lapd_core.c
new file mode 100644
index 00000000..96099edb
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/lapd_core.c
@@ -0,0 +1,2169 @@
+/* LAPD core implementation */
+
+/* (C) 2010-2011 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010-2011 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \addtogroup lapd
+ *  @{
+ */
+
+/*! \file lapd.c */
+
+/*!
+ * Notes on Buffering: rcv_buffer, tx_queue, tx_hist, send_buffer, send_queue
+ *
+ * RX data is stored in the rcv_buffer (pointer). If the message is complete, it
+ * is removed from rcv_buffer pointer and forwarded to L3. If the RX data is
+ * received while there is an incomplete rcv_buffer, it is appended to it.
+ *
+ * TX data is stored in the send_queue first. When transmitting a frame,
+ * the first message in the send_queue is moved to the send_buffer. There it
+ * resides until all fragments are acknowledged. Fragments to be sent by I
+ * frames are stored in the tx_hist buffer for resend, if required. Also the
+ * current fragment is copied into the tx_queue. There it resides until it is
+ * forwarded to layer 1.
+ *
+ * In case we have SAPI 0, we only have a window size of 1, so the unack-
+ * nowledged message resides always in the send_buffer. In case of a suspend,
+ * it can be written back to the first position of the send_queue.
+ *
+ * The layer 1 normally sends a PH-READY-TO-SEND. But because we use
+ * asynchronous transfer between layer 1 and layer 2 (serial link), we must
+ * send a frame before layer 1 reaches the right timeslot to send it. So we
+ * move the tx_queue to layer 1 when there is not already a pending frame, and
+ * wait until acknowledge after the frame has been sent. If we receive an
+ * acknowledge, we can send the next frame from the buffer, if any.
+ *
+ * The moving of tx_queue to layer 1 may also trigger T200, if desired. Also it
+ * will trigger next I frame, if possible.
+ *
+ * T203 is optional. It will be stated when entering MF EST state. It will also
+ * be started when I or S frame is received in that state . It will be
+ * restarted in the lapd_acknowledge() function, in case outstanding frames
+ * will not trigger T200. It will be stoped, when T200 is started in MF EST
+ * state. It will also be stoped when leaving MF EST state.
+ *
+ */
+
+/* Enable this to test content resolution on network side:
+ * - The first SABM is received, UA is dropped.
+ * - The phone repeats SABM, but it's content is wrong, so it is ignored
+ * - The phone repeats SABM again, content is right, so UA is sent.
+ */
+//#define TEST_CONTENT_RESOLUTION_NETWORK
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/gsm/lapd_core.h>
+
+/* TS 04.06 Table 4 / Section 3.8.1 */
+#define LAPD_U_SABM	0x7
+#define LAPD_U_SABME	0xf
+#define LAPD_U_DM	0x3
+#define LAPD_U_UI	0x0
+#define LAPD_U_DISC	0x8
+#define LAPD_U_UA	0xC
+#define LAPD_U_FRMR	0x11
+
+#define LAPD_S_RR	0x0
+#define LAPD_S_RNR	0x1
+#define LAPD_S_REJ	0x2
+
+#define CR_USER2NET_CMD		0
+#define CR_USER2NET_RESP	1
+#define CR_NET2USER_CMD		1
+#define CR_NET2USER_RESP	0
+
+#define LAPD_HEADROOM	56
+
+#define SBIT(a) (1 << a)
+#define ALL_STATES 0xffffffff
+
+static void lapd_t200_cb(void *data);
+static void lapd_t203_cb(void *data);
+static int lapd_send_i(struct lapd_msg_ctx *lctx, int line);
+static int lapd_est_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx);
+
+/* UTILITY FUNCTIONS */
+
+struct msgb *lapd_msgb_alloc(int length, const char *name)
+{
+	/* adding space for padding, FIXME: add as an option */
+	if (length < 21)
+		length = 21;
+	return msgb_alloc_headroom(length + LAPD_HEADROOM, LAPD_HEADROOM, name);
+}
+
+static inline uint8_t do_mod(uint8_t x, uint8_t m)
+{
+	return x & (m - 1);
+}
+
+static inline uint8_t inc_mod(uint8_t x, uint8_t m)
+{
+	return (x + 1) & (m - 1);
+}
+
+static inline uint8_t add_mod(uint8_t x, uint8_t y, uint8_t m)
+{
+	return (x + y) & (m - 1);
+}
+
+static inline uint8_t sub_mod(uint8_t x, uint8_t y, uint8_t m)
+{
+	return (x - y) & (m - 1); /* handle negative results correctly */
+}
+
+static void lapd_dl_flush_send(struct lapd_datalink *dl)
+{
+	struct msgb *msg;
+
+	/* Flush send-queue */
+	while ((msg = msgb_dequeue(&dl->send_queue)))
+		msgb_free(msg);
+
+	/* Clear send-buffer */
+	if (dl->send_buffer) {
+		msgb_free(dl->send_buffer);
+		dl->send_buffer = NULL;
+	}
+}
+
+static void lapd_dl_flush_hist(struct lapd_datalink *dl)
+{
+	unsigned int i;
+
+	for (i = 0; i < dl->range_hist; i++) {
+		if (dl->tx_hist[i].msg) {
+			msgb_free(dl->tx_hist[i].msg);
+			dl->tx_hist[i].msg = NULL;
+		}
+	}
+}
+
+static void lapd_dl_flush_tx(struct lapd_datalink *dl)
+{
+	struct msgb *msg;
+
+	while ((msg = msgb_dequeue(&dl->tx_queue)))
+		msgb_free(msg);
+	lapd_dl_flush_hist(dl);
+}
+
+/* Figure B.2/Q.921 */
+const char *lapd_state_names[] = {
+	"LAPD_STATE_NULL",
+	"LAPD_STATE_TEI_UNASS",
+	"LAPD_STATE_ASS_TEI_WAIT",
+	"LAPD_STATE_EST_TEI_WAIT",
+	"LAPD_STATE_IDLE",
+	"LAPD_STATE_SABM_SENT",
+	"LAPD_STATE_DISC_SENT",
+	"LAPD_STATE_MF_EST",
+	"LAPD_STATE_TIMER_RECOV",
+
+};
+
+static void lapd_start_t200(struct lapd_datalink *dl)
+{
+	if (osmo_timer_pending(&dl->t200))
+		return;
+	LOGP(DLLAPD, LOGL_INFO, "start T200\n");
+	osmo_timer_schedule(&dl->t200, dl->t200_sec, dl->t200_usec);
+}
+
+static void lapd_start_t203(struct lapd_datalink *dl)
+{
+	if (osmo_timer_pending(&dl->t203))
+		return;
+	LOGP(DLLAPD, LOGL_INFO, "start T203\n");
+	osmo_timer_schedule(&dl->t203, dl->t203_sec, dl->t203_usec);
+}
+
+static void lapd_stop_t200(struct lapd_datalink *dl)
+{
+	if (!osmo_timer_pending(&dl->t200))
+		return;
+	LOGP(DLLAPD, LOGL_INFO, "stop T200\n");
+	osmo_timer_del(&dl->t200);
+}
+
+static void lapd_stop_t203(struct lapd_datalink *dl)
+{
+	if (!osmo_timer_pending(&dl->t203))
+		return;
+	LOGP(DLLAPD, LOGL_INFO, "stop T203\n");
+	osmo_timer_del(&dl->t203);
+}
+
+static void lapd_dl_newstate(struct lapd_datalink *dl, uint32_t state)
+{
+	LOGP(DLLAPD, LOGL_INFO, "new state %s -> %s\n",
+		lapd_state_names[dl->state], lapd_state_names[state]);
+
+	if (state != LAPD_STATE_MF_EST && dl->state == LAPD_STATE_MF_EST) {
+		/* stop T203 on leaving MF EST state, if running */
+		lapd_stop_t203(dl);
+		/* remove content res. (network side) on leaving MF EST state */
+		if (dl->cont_res) {
+			msgb_free(dl->cont_res);
+			dl->cont_res = NULL;
+		}
+	}
+
+	/* start T203 on entering MF EST state, if enabled */
+	if ((dl->t203_sec || dl->t203_usec)
+	 && state == LAPD_STATE_MF_EST && dl->state != LAPD_STATE_MF_EST)
+		lapd_start_t203(dl);
+
+	dl->state = state;
+}
+
+static void *tall_lapd_ctx = NULL;
+
+/* init datalink instance and allocate history */
+void lapd_dl_init(struct lapd_datalink *dl, uint8_t k, uint8_t v_range,
+	int maxf)
+{
+	int m;
+
+	memset(dl, 0, sizeof(*dl));
+	INIT_LLIST_HEAD(&dl->send_queue);
+	INIT_LLIST_HEAD(&dl->tx_queue);
+	dl->reestablish = 1;
+	dl->n200_est_rel = 3;
+	dl->n200 = 3;
+	dl->t200_sec = 1;
+	dl->t200_usec = 0;
+	dl->t200.data = dl;
+	dl->t200.cb = &lapd_t200_cb;
+	dl->t203_sec = 10;
+	dl->t203_usec = 0;
+	dl->t203.data = dl;
+	dl->t203.cb = &lapd_t203_cb;
+	dl->maxf = maxf;
+	if (k > v_range - 1)
+		k = v_range - 1;
+	dl->k = k;
+	dl->v_range = v_range;
+
+	/* Calculate modulo for history array:
+	 * - The history range must be at least k+1.
+	 * - The history range must be 2^x, where x is as low as possible.
+	 */
+	k++;
+	for (m = 0x80; m; m >>= 1) {
+		if ((m & k)) {
+			if (k > m)
+				m <<= 1;
+			dl->range_hist = m;
+			break;
+		}
+	}
+
+	LOGP(DLLAPD, LOGL_INFO, "Init DL layer: sequence range = %d, k = %d, "
+		"history range = %d\n", dl->v_range, dl->k, dl->range_hist);
+
+	lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+
+	if (!tall_lapd_ctx)
+		tall_lapd_ctx = talloc_named_const(NULL, 1, "lapd context");
+	dl->tx_hist = (struct lapd_history *) talloc_zero_array(tall_lapd_ctx,
+					struct log_info, dl->range_hist);
+}
+
+/* reset to IDLE state */
+void lapd_dl_reset(struct lapd_datalink *dl)
+{
+	if (dl->state == LAPD_STATE_IDLE)
+		return;
+	LOGP(DLLAPD, LOGL_INFO, "Resetting LAPDm instance\n");
+	/* enter idle state (and remove eventual cont_res) */
+	lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+	/* flush buffer */
+	lapd_dl_flush_tx(dl);
+	lapd_dl_flush_send(dl);
+	/* Discard partly received L3 message */
+	if (dl->rcv_buffer) {
+		msgb_free(dl->rcv_buffer);
+		dl->rcv_buffer = NULL;
+	}
+	/* stop Timers */
+	lapd_stop_t200(dl);
+	lapd_stop_t203(dl);
+}
+
+/* reset and de-allocate history buffer */
+void lapd_dl_exit(struct lapd_datalink *dl)
+{
+	/* free all ressources except history buffer */
+	lapd_dl_reset(dl);
+	/* free history buffer list */
+	talloc_free(dl->tx_hist);
+}
+
+/*! \brief Set the \ref lapdm_mode of a LAPDm entity */
+int lapd_set_mode(struct lapd_datalink *dl, enum lapd_mode mode)
+{
+	switch (mode) {
+	case LAPD_MODE_USER:
+		dl->cr.loc2rem.cmd = CR_USER2NET_CMD;
+		dl->cr.loc2rem.resp = CR_USER2NET_RESP;
+		dl->cr.rem2loc.cmd = CR_NET2USER_CMD;
+		dl->cr.rem2loc.resp = CR_NET2USER_RESP;
+		break;
+	case LAPD_MODE_NETWORK:
+		dl->cr.loc2rem.cmd = CR_NET2USER_CMD;
+		dl->cr.loc2rem.resp = CR_NET2USER_RESP;
+		dl->cr.rem2loc.cmd = CR_USER2NET_CMD;
+		dl->cr.rem2loc.resp = CR_USER2NET_RESP;
+		break;
+	default:
+		return -EINVAL;
+	}
+	dl->mode = mode;
+
+	return 0;
+}
+
+/* send DL message with optional msgb */
+static int send_dl_l3(uint8_t prim, uint8_t op, struct lapd_msg_ctx *lctx,
+	struct msgb *msg)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	struct osmo_dlsap_prim dp;
+
+	osmo_prim_init(&dp.oph, 0, prim, op, msg);
+	return dl->send_dlsap(&dp, lctx);
+}
+
+/* send simple DL message */
+static inline int send_dl_simple(uint8_t prim, uint8_t op,
+	struct lapd_msg_ctx *lctx)
+{
+	struct msgb *msg = lapd_msgb_alloc(0, "DUMMY");
+
+	return send_dl_l3(prim, op, lctx, msg);
+}
+
+/* send MDL-ERROR INDICATION */
+static int mdl_error(uint8_t cause, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	struct osmo_dlsap_prim dp;
+
+	LOGP(DLLAPD, LOGL_NOTICE, "sending MDL-ERROR-IND cause %d\n",
+		cause);
+	osmo_prim_init(&dp.oph, 0, PRIM_MDL_ERROR, PRIM_OP_INDICATION, NULL);
+	dp.u.error_ind.cause = cause;
+	return dl->send_dlsap(&dp, lctx);
+}
+
+/* send UA response */
+static int lapd_send_ua(struct lapd_msg_ctx *lctx, uint8_t len, uint8_t *data)
+{
+	struct msgb *msg = lapd_msgb_alloc(len, "LAPD UA");
+	struct lapd_msg_ctx nctx;
+	struct lapd_datalink *dl = lctx->dl;
+
+	memcpy(&nctx, lctx, sizeof(nctx));
+	msg->l3h = msgb_put(msg, len);
+	if (len)
+		memcpy(msg->l3h, data, len);
+	/* keep nctx.ldp */
+	/* keep nctx.sapi */
+	/* keep nctx.tei */
+	nctx.cr = dl->cr.loc2rem.resp;
+	nctx.format = LAPD_FORM_U;
+	nctx.s_u = LAPD_U_UA;
+	/* keep nctx.p_f */
+	nctx.length = len;
+	nctx.more = 0;
+
+	return dl->send_ph_data_req(&nctx, msg);
+}
+
+/* send DM response */
+static int lapd_send_dm(struct lapd_msg_ctx *lctx)
+{
+	struct msgb *msg = lapd_msgb_alloc(0, "LAPD DM");
+	struct lapd_msg_ctx nctx;
+	struct lapd_datalink *dl = lctx->dl;
+
+	memcpy(&nctx, lctx, sizeof(nctx));
+	/* keep nctx.ldp */
+	/* keep nctx.sapi */
+	/* keep nctx.tei */
+	nctx.cr = dl->cr.loc2rem.resp;
+	nctx.format = LAPD_FORM_U;
+	nctx.s_u = LAPD_U_DM;
+	/* keep nctx.p_f */
+	nctx.length = 0;
+	nctx.more = 0;
+
+	return dl->send_ph_data_req(&nctx, msg);
+}
+
+/* send RR response / command */
+static int lapd_send_rr(struct lapd_msg_ctx *lctx, uint8_t f_bit, uint8_t cmd)
+{
+	struct msgb *msg = lapd_msgb_alloc(0, "LAPD RR");
+	struct lapd_msg_ctx nctx;
+	struct lapd_datalink *dl = lctx->dl;
+
+	memcpy(&nctx, lctx, sizeof(nctx));
+	/* keep nctx.ldp */
+	/* keep nctx.sapi */
+	/* keep nctx.tei */
+	nctx.cr = (cmd) ? dl->cr.loc2rem.cmd : dl->cr.loc2rem.resp;
+	nctx.format = LAPD_FORM_S;
+	nctx.s_u = LAPD_S_RR;
+	nctx.p_f = f_bit;
+	nctx.n_recv = dl->v_recv;
+	nctx.length = 0;
+	nctx.more = 0;
+
+	return dl->send_ph_data_req(&nctx, msg);
+}
+
+/* send RNR response / command */
+static int lapd_send_rnr(struct lapd_msg_ctx *lctx, uint8_t f_bit, uint8_t cmd)
+{
+	struct msgb *msg = lapd_msgb_alloc(0, "LAPD RNR");
+	struct lapd_msg_ctx nctx;
+	struct lapd_datalink *dl = lctx->dl;
+
+	memcpy(&nctx, lctx, sizeof(nctx));
+	/* keep nctx.ldp */
+	/* keep nctx.sapi */
+	/* keep nctx.tei */
+	nctx.cr = (cmd) ? dl->cr.loc2rem.cmd : dl->cr.loc2rem.resp;
+	nctx.format = LAPD_FORM_S;
+	nctx.s_u = LAPD_S_RNR;
+	nctx.p_f = f_bit;
+	nctx.n_recv = dl->v_recv;
+	nctx.length = 0;
+	nctx.more = 0;
+
+	return dl->send_ph_data_req(&nctx, msg);
+}
+
+/* send REJ response */
+static int lapd_send_rej(struct lapd_msg_ctx *lctx, uint8_t f_bit)
+{
+	struct msgb *msg = lapd_msgb_alloc(0, "LAPD REJ");
+	struct lapd_msg_ctx nctx;
+	struct lapd_datalink *dl = lctx->dl;
+
+	memcpy(&nctx, lctx, sizeof(nctx));
+	/* keep nctx.ldp */
+	/* keep nctx.sapi */
+	/* keep nctx.tei */
+	nctx.cr = dl->cr.loc2rem.resp;
+	nctx.format = LAPD_FORM_S;
+	nctx.s_u = LAPD_S_REJ;
+	nctx.p_f = f_bit;
+	nctx.n_recv = dl->v_recv;
+	nctx.length = 0;
+	nctx.more = 0;
+
+	return dl->send_ph_data_req(&nctx, msg);
+}
+
+/* resend SABM or DISC message */
+static int lapd_send_resend(struct lapd_datalink *dl)
+{
+	struct msgb *msg;
+	uint8_t h = do_mod(dl->v_send, dl->range_hist);
+	int length = dl->tx_hist[h].msg->len;
+	struct lapd_msg_ctx nctx;
+
+	/* assemble message */
+	memcpy(&nctx, &dl->lctx, sizeof(nctx));
+	/* keep nctx.ldp */
+	/* keep nctx.sapi */
+	/* keep nctx.tei */
+	nctx.cr = dl->cr.loc2rem.cmd;
+	nctx.format = LAPD_FORM_U;
+	if (dl->state == LAPD_STATE_SABM_SENT)
+		nctx.s_u = (dl->use_sabme) ? LAPD_U_SABME : LAPD_U_SABM;
+	else
+		nctx.s_u = LAPD_U_DISC;
+	nctx.p_f = 1;
+	nctx.length = length;
+	nctx.more = 0;
+
+	/* Resend SABM/DISC from tx_hist */
+	msg = lapd_msgb_alloc(length, "LAPD resend");
+	msg->l3h = msgb_put(msg, length);
+	if (length)
+		memcpy(msg->l3h, dl->tx_hist[h].msg->data, length);
+
+	return dl->send_ph_data_req(&nctx, msg);
+}
+
+/* reestablish link */
+static int lapd_reestablish(struct lapd_datalink *dl)
+{
+	struct osmo_dlsap_prim dp;
+	struct msgb *msg;
+
+	msg = lapd_msgb_alloc(0, "DUMMY");
+	osmo_prim_init(&dp.oph, 0, PRIM_DL_EST, PRIM_OP_REQUEST, msg);
+	
+	return lapd_est_req(&dp, &dl->lctx);
+}
+
+/* Timer callback on T200 expiry */
+static void lapd_t200_cb(void *data)
+{
+	struct lapd_datalink *dl = data;
+
+	LOGP(DLLAPD, LOGL_INFO, "Timeout T200 (%p) state=%d\n", dl,
+		(int) dl->state);
+
+	switch (dl->state) {
+	case LAPD_STATE_SABM_SENT:
+		/* 5.4.1.3 */
+		if (dl->retrans_ctr + 1 >= dl->n200_est_rel + 1) {
+			/* send RELEASE INDICATION to L3 */
+			send_dl_simple(PRIM_DL_REL, PRIM_OP_INDICATION,
+				&dl->lctx);
+			/* send MDL ERROR INIDCATION to L3 */
+			mdl_error(MDL_CAUSE_T200_EXPIRED, &dl->lctx);
+			/* flush tx and send buffers */
+			lapd_dl_flush_tx(dl);
+			lapd_dl_flush_send(dl);
+			/* go back to idle state */
+			lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+			/* NOTE: we must not change any other states or buffers
+			 * and queues, since we may reconnect after handover
+			 * failure. the buffered messages is replaced there */
+			break;
+		}
+		/* retransmit SABM command */
+		lapd_send_resend(dl);
+		/* increment re-transmission counter */
+		dl->retrans_ctr++;
+		/* restart T200 (PH-READY-TO-SEND) */
+		lapd_start_t200(dl);
+		break;
+	case LAPD_STATE_DISC_SENT:
+		/* 5.4.4.3 */
+		if (dl->retrans_ctr + 1 >= dl->n200_est_rel + 1) {
+			/* send RELEASE INDICATION to L3 */
+			send_dl_simple(PRIM_DL_REL, PRIM_OP_CONFIRM, &dl->lctx);
+			/* send MDL ERROR INIDCATION to L3 */
+			mdl_error(MDL_CAUSE_T200_EXPIRED, &dl->lctx);
+			/* flush tx and send buffers */
+			lapd_dl_flush_tx(dl);
+			lapd_dl_flush_send(dl);
+			/* go back to idle state */
+			lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+			/* NOTE: we must not change any other states or buffers
+			 * and queues, since we may reconnect after handover
+			 * failure. the buffered messages is replaced there */
+			break;
+		}
+		/* retransmit DISC command */
+		lapd_send_resend(dl);
+		/* increment re-transmission counter */
+		dl->retrans_ctr++;
+		/* restart T200 (PH-READY-TO-SEND) */
+		lapd_start_t200(dl);
+		break;
+	case LAPD_STATE_MF_EST:
+		/* 5.5.7 */
+		dl->retrans_ctr = 0;
+		lapd_dl_newstate(dl, LAPD_STATE_TIMER_RECOV);
+		/* fall through */
+	case LAPD_STATE_TIMER_RECOV:
+		dl->retrans_ctr++;
+		if (dl->retrans_ctr < dl->n200) {
+			uint8_t vs = sub_mod(dl->v_send, 1, dl->v_range);
+			uint8_t h = do_mod(vs, dl->range_hist);
+			/* retransmit I frame (V_s-1) with P=1, if any */
+			if (dl->tx_hist[h].msg) {
+				struct msgb *msg;
+				int length = dl->tx_hist[h].msg->len;
+				struct lapd_msg_ctx nctx;
+
+				LOGP(DLLAPD, LOGL_INFO, "retransmit last frame"
+					" V(S)=%d\n", vs);
+				/* Create I frame (segment) from tx_hist */
+				memcpy(&nctx, &dl->lctx, sizeof(nctx));
+				/* keep nctx.ldp */
+				/* keep nctx.sapi */
+				/* keep nctx.tei */
+				nctx.cr = dl->cr.loc2rem.cmd;
+				nctx.format = LAPD_FORM_I;
+				nctx.p_f = 1;
+				nctx.n_send = vs;
+				nctx.n_recv = dl->v_recv;
+				nctx.length = length;
+				nctx.more = dl->tx_hist[h].more;
+				msg = lapd_msgb_alloc(length, "LAPD I resend");
+				msg->l3h = msgb_put(msg, length);
+				memcpy(msg->l3h, dl->tx_hist[h].msg->data,
+					length);
+				dl->send_ph_data_req(&nctx, msg);
+			} else {
+			/* OR send appropriate supervision frame with P=1 */
+				if (!dl->own_busy && !dl->seq_err_cond) {
+					lapd_send_rr(&dl->lctx, 1, 1);
+					/* NOTE: In case of sequence error
+					 * condition, the REJ frame has been
+					 * transmitted when entering the
+					 * condition, so it has not be done
+					 * here
+				 	 */
+				} else if (dl->own_busy) {
+					lapd_send_rnr(&dl->lctx, 1, 1);
+				} else {
+					LOGP(DLLAPD, LOGL_INFO, "unhandled, "
+						"pls. fix\n");
+				}
+			}
+			/* restart T200 (PH-READY-TO-SEND) */
+			lapd_start_t200(dl);
+		} else {
+			/* send MDL ERROR INIDCATION to L3 */
+			mdl_error(MDL_CAUSE_T200_EXPIRED, &dl->lctx);
+			/* reestablish */
+			if (!dl->reestablish)
+				break;
+			LOGP(DLLAPD, LOGL_NOTICE, "N200 reached, performing "
+				"reestablishment.\n");
+			lapd_reestablish(dl);
+		}
+		break;
+	default:
+		LOGP(DLLAPD, LOGL_INFO, "T200 expired in unexpected "
+			"dl->state %d\n", (int) dl->state);
+	}
+}
+
+/* Timer callback on T203 expiry */
+static void lapd_t203_cb(void *data)
+{
+	struct lapd_datalink *dl = data;
+
+	LOGP(DLLAPD, LOGL_INFO, "Timeout T203 (%p) state=%d\n", dl,
+		(int) dl->state);
+
+	if (dl->state != LAPD_STATE_MF_EST) {
+		LOGP(DLLAPD, LOGL_ERROR, "T203 fired outside MF EST state, "
+			"please fix!\n");
+		return;
+	}
+
+	/* set retransmission counter to 0 */
+	dl->retrans_ctr = 0;
+	/* enter timer recovery state */
+	lapd_dl_newstate(dl, LAPD_STATE_TIMER_RECOV);
+	/* transmit a supervisory command with P bit set to 1 as follows: */
+	if (!dl->own_busy) {
+		LOGP(DLLAPD, LOGL_INFO, "transmit an RR poll command\n");
+		/* Send RR with P=1 */
+		lapd_send_rr(&dl->lctx, 1, 1);
+	} else {
+		LOGP(DLLAPD, LOGL_INFO, "transmit an RNR poll command\n");
+		/* Send RNR with P=1 */
+		lapd_send_rnr(&dl->lctx, 1, 1);
+	}
+	/* start T200 */
+	lapd_start_t200(dl);
+}
+
+/* 5.5.3.1: Common function to acknowlege frames up to the given N(R) value */
+static void lapd_acknowledge(struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	uint8_t nr = lctx->n_recv;
+	int s = 0, rej = 0, t200_reset = 0;
+	int i, h;
+
+	/* supervisory frame ? */
+	if (lctx->format == LAPD_FORM_S)
+		s = 1;
+	/* REJ frame ? */
+	if (s && lctx->s_u == LAPD_S_REJ)
+	 	rej = 1;
+
+	/* Flush all transmit buffers of acknowledged frames */
+	for (i = dl->v_ack; i != nr; i = inc_mod(i, dl->v_range)) {
+		h = do_mod(i, dl->range_hist);
+		if (dl->tx_hist[h].msg) {
+			msgb_free(dl->tx_hist[h].msg);
+			dl->tx_hist[h].msg = NULL;
+			LOGP(DLLAPD, LOGL_INFO, "ack frame %d\n", i);
+		}
+	}
+
+	if (dl->state != LAPD_STATE_TIMER_RECOV) {
+		/* When not in the timer recovery condition, the data
+		 * link layer entity shall reset the timer T200 on
+		 * receipt of a valid I frame with N(R) higher than V(A),
+		 * or an REJ with an N(R) equal to V(A). */
+		if ((!rej && nr != dl->v_ack)
+		 || (rej && nr == dl->v_ack)) {
+		 	t200_reset = 1;
+			lapd_stop_t200(dl);
+			/* 5.5.3.1 Note 1 + 2 imply timer recovery cond. */
+		}
+		/* 5.7.4: N(R) sequence error
+		 * N(R) is called valid, if and only if
+		 * (N(R)-V(A)) mod 8 <= (V(S)-V(A)) mod 8.
+		 */
+		if (sub_mod(nr, dl->v_ack, dl->v_range)
+				> sub_mod(dl->v_send, dl->v_ack, dl->v_range)) {
+			LOGP(DLLAPD, LOGL_NOTICE, "N(R) sequence error\n");
+			mdl_error(MDL_CAUSE_SEQ_ERR, lctx);
+		}
+	}
+
+	/* V(A) shall be set to the value of N(R) */
+	dl->v_ack = nr;
+
+	/* If T200 has been stopped by the receipt of an I, RR or RNR frame,
+	 * and if there are outstanding I frames, restart T200 */
+	if (t200_reset && !rej) {
+		if (dl->tx_hist[sub_mod(dl->v_send, 1, dl->range_hist)].msg) {
+			LOGP(DLLAPD, LOGL_INFO, "start T200, due to unacked I "
+				"frame(s)\n");
+			lapd_start_t200(dl);
+		}
+	}
+
+	/* This also does a restart, when I or S frame is received */
+
+	/* Stop T203, if running */
+	lapd_stop_t203(dl);
+	/* Start T203, if T200 is not running in MF EST state, if enabled */
+	if (!osmo_timer_pending(&dl->t200)
+	 && (dl->t203_sec || dl->t203_usec)
+	 && (dl->state == LAPD_STATE_MF_EST)) {
+		lapd_start_t203(dl);
+	}
+}
+
+/* L1 -> L2 */
+
+/* Receive a LAPD U (Unnumbered) message from L1 */
+static int lapd_rx_u(struct msgb *msg, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	int length = lctx->length;
+	int rc = 0;
+	uint8_t prim, op;
+
+	switch (lctx->s_u) {
+	case LAPD_U_SABM:
+	case LAPD_U_SABME:
+		prim = PRIM_DL_EST;
+		op = PRIM_OP_INDICATION;
+
+		LOGP(DLLAPD, LOGL_INFO, "SABM(E) received in state %s\n",
+			lapd_state_names[dl->state]);
+		/* 5.7.1 */
+		dl->seq_err_cond = 0;
+		/* G.2.2 Wrong value of the C/R bit */
+		if (lctx->cr == dl->cr.rem2loc.resp) {
+			LOGP(DLLAPD, LOGL_NOTICE, "SABM response error\n");
+			msgb_free(msg);
+			mdl_error(MDL_CAUSE_FRM_UNIMPL, lctx);
+			return -EINVAL;
+		}
+
+		/* G.4.5 If SABM is received with L>N201 or with M bit
+		 * set, AN MDL-ERROR-INDICATION is sent to MM.
+		 */
+		if (lctx->more || length > lctx->n201) {
+			LOGP(DLLAPD, LOGL_NOTICE, "SABM too large error\n");
+			msgb_free(msg);
+			mdl_error(MDL_CAUSE_UFRM_INC_PARAM, lctx);
+			return -EIO;
+		}
+
+		switch (dl->state) {
+		case LAPD_STATE_IDLE:
+			break;
+		case LAPD_STATE_MF_EST:
+			LOGP(DLLAPD, LOGL_INFO, "SABM command, multiple "
+				"frame established state\n");
+			/* If link is lost on the remote side, we start over
+			 * and send DL-ESTABLISH indication again. */
+			if (dl->v_send != dl->v_recv) {
+				LOGP(DLLAPD, LOGL_INFO, "Remote reestablish\n");
+				mdl_error(MDL_CAUSE_SABM_MF, lctx);
+				break;
+			}
+			/* Ignore SABM if content differs from first SABM. */
+			if (dl->mode == LAPD_MODE_NETWORK && length
+			 && dl->cont_res) {
+#ifdef TEST_CONTENT_RESOLUTION_NETWORK
+				dl->cont_res->data[0] ^= 0x01;
+#endif
+				if (memcmp(dl->cont_res, msg->data, length)) {
+					LOGP(DLLAPD, LOGL_INFO, "Another SABM "
+						"with diffrent content - "
+						"ignoring!\n");
+					msgb_free(msg);
+					return 0;
+				}
+			}
+			/* send UA again */
+			lapd_send_ua(lctx, length, msg->l3h);
+			msgb_free(msg);
+			return 0;
+		case LAPD_STATE_DISC_SENT:
+			/* 5.4.6.2 send DM with F=P */
+			lapd_send_dm(lctx);
+			/* stop Timer T200 */
+			lapd_stop_t200(dl);
+			msgb_free(msg);
+			return send_dl_simple(prim, op, lctx);
+		default:
+			/* collision: Send UA, but still wait for rx UA, then
+			 * change to MF_EST state.
+			 */
+			/* check for contention resoultion */
+			if (dl->tx_hist[0].msg && dl->tx_hist[0].msg->len) {
+				LOGP(DLLAPD, LOGL_NOTICE, "SABM not allowed "
+					"during contention resolution\n");
+				mdl_error(MDL_CAUSE_SABM_INFO_NOTALL, lctx);
+			}
+			lapd_send_ua(lctx, length, msg->l3h);
+			msgb_free(msg);
+			return 0;
+		}
+		/* save message context for further use */
+		memcpy(&dl->lctx, lctx, sizeof(dl->lctx));
+#ifndef TEST_CONTENT_RESOLUTION_NETWORK
+		/* send UA response */
+		lapd_send_ua(lctx, length, msg->l3h);
+#endif
+		/* set Vs, Vr and Va to 0 */
+		dl->v_send = dl->v_recv = dl->v_ack = 0;
+		/* clear tx_hist */
+		lapd_dl_flush_hist(dl);
+		/* enter multiple-frame-established state */
+		lapd_dl_newstate(dl, LAPD_STATE_MF_EST);
+		/* store content resolution data on network side
+		 * Note: cont_res will be removed when changing state again,
+		 * so it must be allocated AFTER lapd_dl_newstate(). */
+		if (dl->mode == LAPD_MODE_NETWORK && length) {
+			dl->cont_res = lapd_msgb_alloc(length, "CONT RES");
+			memcpy(msgb_put(dl->cont_res, length), msg->l3h,
+				length);
+			LOGP(DLLAPD, LOGL_NOTICE, "Store content res.\n");
+		}
+		/* send notification to L3 */
+		if (length == 0) {
+			/* 5.4.1.2 Normal establishment procedures */
+			rc = send_dl_simple(prim, op, lctx);
+			msgb_free(msg);
+		} else {
+			/* 5.4.1.4 Contention resolution establishment */
+			rc = send_dl_l3(prim, op, lctx, msg);
+		}
+		break;
+	case LAPD_U_DM:
+		LOGP(DLLAPD, LOGL_INFO, "DM received in state %s\n",
+			lapd_state_names[dl->state]);
+		/* G.2.2 Wrong value of the C/R bit */
+		if (lctx->cr == dl->cr.rem2loc.cmd) {
+			LOGP(DLLAPD, LOGL_NOTICE, "DM command error\n");
+			msgb_free(msg);
+			mdl_error(MDL_CAUSE_FRM_UNIMPL, lctx);
+			return -EINVAL;
+		}
+		if (!lctx->p_f) {
+			/* 5.4.1.2 DM responses with the F bit set to "0"
+			 * shall be ignored.
+			 */
+			msgb_free(msg);
+			return 0;
+		}
+		switch (dl->state) {
+		case LAPD_STATE_SABM_SENT:
+			break;
+		case LAPD_STATE_MF_EST:
+			if (lctx->p_f) {
+				LOGP(DLLAPD, LOGL_INFO, "unsolicited DM "
+					"response\n");
+				mdl_error(MDL_CAUSE_UNSOL_DM_RESP, lctx);
+			} else {
+				LOGP(DLLAPD, LOGL_INFO, "unsolicited DM "
+					"response, multiple frame established "
+					"state\n");
+				mdl_error(MDL_CAUSE_UNSOL_DM_RESP_MF, lctx);
+				/* reestablish */
+				if (!dl->reestablish) {
+					msgb_free(msg);
+					return 0;
+				}
+				LOGP(DLLAPD, LOGL_NOTICE, "Performing "
+					"reestablishment.\n");
+				lapd_reestablish(dl);
+			}
+			msgb_free(msg);
+			return 0;
+		case LAPD_STATE_TIMER_RECOV:
+			/* FP = 0 (DM is normal in case PF = 1) */
+			if (!lctx->p_f) {
+				LOGP(DLLAPD, LOGL_INFO, "unsolicited DM "
+					"response, multiple frame established "
+					"state\n");
+				mdl_error(MDL_CAUSE_UNSOL_DM_RESP_MF, lctx);
+				msgb_free(msg);
+				/* reestablish */
+				if (!dl->reestablish)
+					return 0;
+				LOGP(DLLAPD, LOGL_NOTICE, "Performing "
+					"reestablishment.\n");
+				return lapd_reestablish(dl);
+			}
+			break;
+		case LAPD_STATE_DISC_SENT:
+			/* stop Timer T200 */
+			lapd_stop_t200(dl);
+			/* go to idle state */
+			lapd_dl_flush_tx(dl);
+			lapd_dl_flush_send(dl);
+			lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+			rc = send_dl_simple(PRIM_DL_REL, PRIM_OP_CONFIRM, lctx);
+			msgb_free(msg);
+			return 0;
+		case LAPD_STATE_IDLE:
+			/* 5.4.5 all other frame types shall be discarded */
+		default:
+			LOGP(DLLAPD, LOGL_INFO, "unsolicited DM response! "
+				"(discarding)\n");
+			msgb_free(msg);
+			return 0;
+		}
+		/* stop timer T200 */
+		lapd_stop_t200(dl);
+		/* go to idle state */
+		lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+		rc = send_dl_simple(PRIM_DL_REL, PRIM_OP_INDICATION, lctx);
+		msgb_free(msg);
+		break;
+	case LAPD_U_UI:
+		LOGP(DLLAPD, LOGL_INFO, "UI received\n");
+		/* G.2.2 Wrong value of the C/R bit */
+		if (lctx->cr == dl->cr.rem2loc.resp) {
+			LOGP(DLLAPD, LOGL_NOTICE, "UI indicates response "
+				"error\n");
+			msgb_free(msg);
+			mdl_error(MDL_CAUSE_FRM_UNIMPL, lctx);
+			return -EINVAL;
+		}
+
+		/* G.4.5 If UI is received with L>N201 or with M bit
+		 * set, AN MDL-ERROR-INDICATION is sent to MM.
+		 */
+		if (length > lctx->n201 || lctx->more) {
+			LOGP(DLLAPD, LOGL_NOTICE, "UI too large error "
+				"(%d > N201(%d) or M=%d)\n", length,
+				lctx->n201, lctx->more);
+			msgb_free(msg);
+			mdl_error(MDL_CAUSE_UFRM_INC_PARAM, lctx);
+			return -EIO;
+		}
+
+		/* do some length checks */
+		if (length == 0) {
+			/* 5.3.3 UI frames received with the length indicator
+			 * set to "0" shall be ignored
+			 */
+			LOGP(DLLAPD, LOGL_INFO, "length=0 (discarding)\n");
+			msgb_free(msg);
+			return 0;
+		}
+		rc = send_dl_l3(PRIM_DL_UNIT_DATA, PRIM_OP_INDICATION, lctx,
+				msg);
+		break;
+	case LAPD_U_DISC:
+		prim = PRIM_DL_REL;
+		op = PRIM_OP_INDICATION;
+
+		LOGP(DLLAPD, LOGL_INFO, "DISC received in state %s\n",
+			lapd_state_names[dl->state]);
+		/* flush tx and send buffers */
+		lapd_dl_flush_tx(dl);
+		lapd_dl_flush_send(dl);
+		/* 5.7.1 */
+		dl->seq_err_cond = 0;
+		/* G.2.2 Wrong value of the C/R bit */
+		if (lctx->cr == dl->cr.rem2loc.resp) {
+			LOGP(DLLAPD, LOGL_NOTICE, "DISC response error\n");
+			msgb_free(msg);
+			mdl_error(MDL_CAUSE_FRM_UNIMPL, lctx);
+			return -EINVAL;
+		}
+		if (length > 0 || lctx->more) {
+			/* G.4.4 If a DISC or DM frame is received with L>0 or
+			 * with the M bit set to "1", an MDL-ERROR-INDICATION
+			 * primitive with cause "U frame with incorrect
+			 * parameters" is sent to the mobile management entity.
+			 */
+			LOGP(DLLAPD, LOGL_NOTICE,
+				"U frame iwth incorrect parameters ");
+			msgb_free(msg);
+			mdl_error(MDL_CAUSE_UFRM_INC_PARAM, lctx);
+			return -EIO;
+		}
+		switch (dl->state) {
+		case LAPD_STATE_IDLE:
+			LOGP(DLLAPD, LOGL_INFO, "DISC in idle state\n");
+			/* send DM with F=P */
+			msgb_free(msg);
+			return lapd_send_dm(lctx);
+		case LAPD_STATE_SABM_SENT:
+			LOGP(DLLAPD, LOGL_INFO, "DISC in SABM state\n");
+			/* 5.4.6.2 send DM with F=P */
+			lapd_send_dm(lctx);
+			/* stop Timer T200 */
+			lapd_stop_t200(dl);
+			/* go to idle state */
+			lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+			msgb_free(msg);
+			return send_dl_simple(PRIM_DL_REL, PRIM_OP_INDICATION,
+				lctx);
+		case LAPD_STATE_MF_EST:
+		case LAPD_STATE_TIMER_RECOV:
+			LOGP(DLLAPD, LOGL_INFO, "DISC in est state\n");
+			break;
+		case LAPD_STATE_DISC_SENT:
+			LOGP(DLLAPD, LOGL_INFO, "DISC in disc state\n");
+			prim = PRIM_DL_REL;
+			op = PRIM_OP_CONFIRM;
+			break;
+		default:
+			lapd_send_ua(lctx, length, msg->l3h);
+			msgb_free(msg);
+			return 0;
+		}
+		/* send UA response */
+		lapd_send_ua(lctx, length, msg->l3h);
+		/* stop Timer T200 */
+		lapd_stop_t200(dl);
+		/* enter idle state, keep tx-buffer with UA response */
+		lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+		/* send notification to L3 */
+		rc = send_dl_simple(prim, op, lctx);
+		msgb_free(msg);
+		break;
+	case LAPD_U_UA:
+		LOGP(DLLAPD, LOGL_INFO, "UA received in state %s\n",
+			lapd_state_names[dl->state]);
+		/* G.2.2 Wrong value of the C/R bit */
+		if (lctx->cr == dl->cr.rem2loc.cmd) {
+			LOGP(DLLAPD, LOGL_NOTICE, "UA indicates command "
+				"error\n");
+			msgb_free(msg);
+			mdl_error(MDL_CAUSE_FRM_UNIMPL, lctx);
+			return -EINVAL;
+		}
+
+		/* G.4.5 If UA is received with L>N201 or with M bit
+		 * set, AN MDL-ERROR-INDICATION is sent to MM.
+		 */
+		if (lctx->more || length > lctx->n201) {
+			LOGP(DLLAPD, LOGL_NOTICE, "UA too large error\n");
+			msgb_free(msg);
+			mdl_error(MDL_CAUSE_UFRM_INC_PARAM, lctx);
+			return -EIO;
+		}
+
+		if (!lctx->p_f) {
+			/* 5.4.1.2 A UA response with the F bit set to "0"
+			 * shall be ignored.
+			 */
+			LOGP(DLLAPD, LOGL_INFO, "F=0 (discarding)\n");
+			msgb_free(msg);
+			return 0;
+		}
+		switch (dl->state) {
+		case LAPD_STATE_SABM_SENT:
+			break;
+		case LAPD_STATE_MF_EST:
+		case LAPD_STATE_TIMER_RECOV:
+			LOGP(DLLAPD, LOGL_INFO, "unsolicited UA response! "
+				"(discarding)\n");
+			mdl_error(MDL_CAUSE_UNSOL_UA_RESP, lctx);
+			msgb_free(msg);
+			return 0;
+		case LAPD_STATE_DISC_SENT:
+			LOGP(DLLAPD, LOGL_INFO, "UA in disconnect state\n");
+			/* stop Timer T200 */
+			lapd_stop_t200(dl);
+			/* go to idle state */
+			lapd_dl_flush_tx(dl);
+			lapd_dl_flush_send(dl);
+			lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+			rc = send_dl_simple(PRIM_DL_REL, PRIM_OP_CONFIRM, lctx);
+			msgb_free(msg);
+			return 0;
+		case LAPD_STATE_IDLE:
+			/* 5.4.5 all other frame types shall be discarded */
+		default:
+			LOGP(DLLAPD, LOGL_INFO, "unsolicited UA response! "
+				"(discarding)\n");
+			msgb_free(msg);
+			return 0;
+		}
+		LOGP(DLLAPD, LOGL_INFO, "UA in SABM state\n");
+		/* stop Timer T200 */
+		lapd_stop_t200(dl);
+		/* compare UA with SABME if contention resolution is applied */
+		if (dl->tx_hist[0].msg->len) {
+			if (length != (dl->tx_hist[0].msg->len)
+			 || !!memcmp(dl->tx_hist[0].msg->data, msg->l3h,
+			 					length)) {
+				LOGP(DLLAPD, LOGL_INFO, "**** UA response "
+					"mismatches ****\n");
+				rc = send_dl_simple(PRIM_DL_REL,
+					PRIM_OP_INDICATION, lctx);
+				msgb_free(msg);
+				/* go to idle state */
+				lapd_dl_flush_tx(dl);
+				lapd_dl_flush_send(dl);
+				lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+				return 0;
+			}
+		}
+		/* set Vs, Vr and Va to 0 */
+		dl->v_send = dl->v_recv = dl->v_ack = 0;
+		/* clear tx_hist */
+		lapd_dl_flush_hist(dl);
+		/* enter multiple-frame-established state */
+		lapd_dl_newstate(dl, LAPD_STATE_MF_EST);
+		/* send outstanding frames, if any (resume / reconnect) */
+		lapd_send_i(lctx, __LINE__);
+		/* send notification to L3 */
+		rc = send_dl_simple(PRIM_DL_EST, PRIM_OP_CONFIRM, lctx);
+		msgb_free(msg);
+		break;
+	case LAPD_U_FRMR:
+		LOGP(DLLAPD, LOGL_NOTICE, "Frame reject received\n");
+		/* send MDL ERROR INIDCATION to L3 */
+		mdl_error(MDL_CAUSE_FRMR, lctx);
+		msgb_free(msg);
+		/* reestablish */
+		if (!dl->reestablish)
+			break;
+		LOGP(DLLAPD, LOGL_NOTICE, "Performing reestablishment.\n");
+		rc = lapd_reestablish(dl);
+		break;
+	default:
+		/* G.3.1 */
+		LOGP(DLLAPD, LOGL_NOTICE, "Unnumbered frame not allowed.\n");
+		msgb_free(msg);
+		mdl_error(MDL_CAUSE_FRM_UNIMPL, lctx);
+		return -EINVAL;
+	}
+	return rc;
+}
+
+/* Receive a LAPD S (Supervisory) message from L1 */
+static int lapd_rx_s(struct msgb *msg, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	int length = lctx->length;
+
+	if (length > 0 || lctx->more) {
+		/* G.4.3 If a supervisory frame is received with L>0 or
+		 * with the M bit set to "1", an MDL-ERROR-INDICATION
+		 * primitive with cause "S frame with incorrect
+		 * parameters" is sent to the mobile management entity. */
+		LOGP(DLLAPD, LOGL_NOTICE,
+				"S frame with incorrect parameters\n");
+		msgb_free(msg);
+		mdl_error(MDL_CAUSE_SFRM_INC_PARAM, lctx);
+		return -EIO;
+	}
+
+	if (lctx->cr == dl->cr.rem2loc.resp
+	 && lctx->p_f
+	 && dl->state != LAPD_STATE_TIMER_RECOV) {
+		/* 5.4.2.2: Inidcate error on supervisory reponse F=1 */
+		LOGP(DLLAPD, LOGL_NOTICE, "S frame response with F=1 error\n");
+		mdl_error(MDL_CAUSE_UNSOL_SPRV_RESP, lctx);
+	}
+
+	switch (dl->state) {
+	case LAPD_STATE_IDLE:
+		/* if P=1, respond DM with F=1 (5.2.2) */
+		/* 5.4.5 all other frame types shall be discarded */
+		if (lctx->p_f)
+			lapd_send_dm(lctx); /* F=P */
+		/* fall though */
+	case LAPD_STATE_SABM_SENT:
+	case LAPD_STATE_DISC_SENT:
+		LOGP(DLLAPD, LOGL_NOTICE, "S frame ignored in this state\n");
+		msgb_free(msg);
+		return 0;
+	}
+	switch (lctx->s_u) {
+	case LAPD_S_RR:
+		LOGP(DLLAPD, LOGL_INFO, "RR received in state %s\n",
+			lapd_state_names[dl->state]);
+		/* 5.5.3.1: Acknowlege all tx frames up the the N(R)-1 */
+		lapd_acknowledge(lctx);
+
+		/* 5.5.3.2 */
+		if (lctx->cr == dl->cr.rem2loc.cmd
+		 && lctx->p_f) {
+		 	if (!dl->own_busy && !dl->seq_err_cond) {
+				LOGP(DLLAPD, LOGL_INFO, "RR frame command "
+					"with polling bit set and we are not "
+					"busy, so we reply with RR frame "
+					"response\n");
+				lapd_send_rr(lctx, 1, 0);
+				/* NOTE: In case of sequence error condition,
+				 * the REJ frame has been transmitted when
+				 * entering the condition, so it has not be
+				 * done here
+				 */
+			} else if (dl->own_busy) {
+				LOGP(DLLAPD, LOGL_INFO, "RR frame command "
+					"with polling bit set and we are busy, "
+					"so we reply with RR frame response\n");
+				lapd_send_rnr(lctx, 1, 0);
+			}
+		} else if (lctx->cr == dl->cr.rem2loc.resp
+			&& lctx->p_f
+			&& dl->state == LAPD_STATE_TIMER_RECOV) {
+			LOGP(DLLAPD, LOGL_INFO, "RR response with F==1, "
+				"and we are in timer recovery state, so "
+				"we leave that state\n");
+			/* V(S) to the N(R) in the RR frame */
+			dl->v_send = lctx->n_recv;
+			/* stop Timer T200 */
+			lapd_stop_t200(dl);
+			/* 5.5.7 Clear timer recovery condition */
+			lapd_dl_newstate(dl, LAPD_STATE_MF_EST);
+		}
+		/* Send message, if possible due to acknowledged data */
+		lapd_send_i(lctx, __LINE__);
+
+		break;
+	case LAPD_S_RNR:
+		LOGP(DLLAPD, LOGL_INFO, "RNR received in state %s\n",
+			lapd_state_names[dl->state]);
+		/* 5.5.3.1: Acknowlege all tx frames up the the N(R)-1 */
+		lapd_acknowledge(lctx);
+
+		/* 5.5.5 */
+		/* Set peer receiver busy condition */
+		dl->peer_busy = 1;
+
+		if (lctx->p_f) {
+			if (lctx->cr == dl->cr.rem2loc.cmd) {
+				if (!dl->own_busy) {
+					LOGP(DLLAPD, LOGL_INFO, "RNR poll "
+						"command and we are not busy, "
+						"so we reply with RR final "
+						"response\n");
+					/* Send RR with F=1 */
+					lapd_send_rr(lctx, 1, 0);
+				} else {
+					LOGP(DLLAPD, LOGL_INFO, "RNR poll "
+						"command and we are busy, so "
+						"we reply with RNR final "
+						"response\n");
+					/* Send RNR with F=1 */
+					lapd_send_rnr(lctx, 1, 0);
+				}
+			} else if (dl->state == LAPD_STATE_TIMER_RECOV) {
+				LOGP(DLLAPD, LOGL_INFO, "RNR poll response "
+					"and we in timer recovery state, so "
+					"we leave that state\n");
+				/* 5.5.7 Clear timer recovery condition */
+				lapd_dl_newstate(dl, LAPD_STATE_MF_EST);
+				/* V(S) to the N(R) in the RNR frame */
+				dl->v_send = lctx->n_recv;
+			}
+		} else
+			LOGP(DLLAPD, LOGL_INFO, "RNR not polling/final state "
+				"received\n");
+
+		/* Send message, if possible due to acknowledged data */
+		lapd_send_i(lctx, __LINE__);
+
+		break;
+	case LAPD_S_REJ:
+		LOGP(DLLAPD, LOGL_INFO, "REJ received in state %s\n",
+			lapd_state_names[dl->state]);
+		/* 5.5.3.1: Acknowlege all tx frames up the the N(R)-1 */
+		lapd_acknowledge(lctx);
+
+		/* 5.5.4.1 */
+		if (dl->state != LAPD_STATE_TIMER_RECOV) {
+			/* Clear an existing peer receiver busy condition */
+			dl->peer_busy = 0;
+			/* V(S) and V(A) to the N(R) in the REJ frame */
+			dl->v_send = dl->v_ack = lctx->n_recv;
+			/* stop Timer T200 */
+			lapd_stop_t200(dl);
+			/* 5.5.3.2 */
+			if (lctx->cr == dl->cr.rem2loc.cmd && lctx->p_f) {
+				if (!dl->own_busy && !dl->seq_err_cond) {
+					LOGP(DLLAPD, LOGL_INFO, "REJ poll "
+						"command not in timer recovery "
+						"state and not in own busy "
+						"condition received, so we "
+						"respond with RR final "
+						"response\n");
+					lapd_send_rr(lctx, 1, 0);
+					/* NOTE: In case of sequence error
+					 * condition, the REJ frame has been
+					 * transmitted when entering the
+					 * condition, so it has not be done
+					 * here
+				 	 */
+				} else if (dl->own_busy) {
+					LOGP(DLLAPD, LOGL_INFO, "REJ poll "
+						"command not in timer recovery "
+						"state and in own busy "
+						"condition received, so we "
+						"respond with RNR final "
+						"response\n");
+					lapd_send_rnr(lctx, 1, 0);
+				}
+			} else
+				LOGP(DLLAPD, LOGL_INFO, "REJ response or not "
+					"polling command not in timer recovery "
+					"state received\n");
+			/* send MDL ERROR INIDCATION to L3 */
+			if (lctx->cr == dl->cr.rem2loc.resp && lctx->p_f) {
+				mdl_error(MDL_CAUSE_UNSOL_SPRV_RESP, lctx);
+			}
+
+		} else if (lctx->cr == dl->cr.rem2loc.resp && lctx->p_f) {
+			LOGP(DLLAPD, LOGL_INFO, "REJ poll response in timer "
+				"recovery state received\n");
+			/* Clear an existing peer receiver busy condition */
+			dl->peer_busy = 0;
+			/* V(S) and V(A) to the N(R) in the REJ frame */
+			dl->v_send = dl->v_ack = lctx->n_recv;
+			/* stop Timer T200 */
+			lapd_stop_t200(dl);
+			/* 5.5.7 Clear timer recovery condition */
+			lapd_dl_newstate(dl, LAPD_STATE_MF_EST);
+		} else {
+			/* Clear an existing peer receiver busy condition */
+			dl->peer_busy = 0;
+			/* V(S) and V(A) to the N(R) in the REJ frame */
+			dl->v_send = dl->v_ack = lctx->n_recv;
+			/* 5.5.3.2 */
+			if (lctx->cr == dl->cr.rem2loc.cmd && lctx->p_f) {
+				if (!dl->own_busy && !dl->seq_err_cond) {
+					LOGP(DLLAPD, LOGL_INFO, "REJ poll "
+						"command in timer recovery "
+						"state and not in own busy "
+						"condition received, so we "
+						"respond with RR final "
+						"response\n");
+					lapd_send_rr(lctx, 1, 0);
+					/* NOTE: In case of sequence error
+					 * condition, the REJ frame has been
+					 * transmitted when entering the
+					 * condition, so it has not be done
+					 * here
+				 	 */
+				} else if (dl->own_busy) {
+					LOGP(DLLAPD, LOGL_INFO, "REJ poll "
+						"command in timer recovery "
+						"state and in own busy "
+						"condition received, so we "
+						"respond with RNR final "
+						"response\n");
+					lapd_send_rnr(lctx, 1, 0);
+				}
+			} else
+				LOGP(DLLAPD, LOGL_INFO, "REJ response or not "
+					"polling command in timer recovery "
+					"state received\n");
+		}
+
+		/* FIXME: 5.5.4.2 2) */
+
+		/* Send message, if possible due to acknowledged data */
+		lapd_send_i(lctx, __LINE__);
+
+		break;
+	default:
+		/* G.3.1 */
+		LOGP(DLLAPD, LOGL_NOTICE, "Supervisory frame not allowed.\n");
+		msgb_free(msg);
+		mdl_error(MDL_CAUSE_FRM_UNIMPL, lctx);
+		return -EINVAL;
+	}
+	msgb_free(msg);
+	return 0;
+}
+
+/* Receive a LAPD I (Information) message from L1 */
+static int lapd_rx_i(struct msgb *msg, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	//uint8_t nr = lctx->n_recv;
+	uint8_t ns = lctx->n_send;
+	int length = lctx->length;
+	int rc;
+
+	LOGP(DLLAPD, LOGL_INFO, "I received in state %s\n",
+		lapd_state_names[dl->state]);
+		
+	/* G.2.2 Wrong value of the C/R bit */
+	if (lctx->cr == dl->cr.rem2loc.resp) {
+		LOGP(DLLAPD, LOGL_NOTICE, "I frame response not allowed\n");
+		msgb_free(msg);
+		mdl_error(MDL_CAUSE_FRM_UNIMPL, lctx);
+		return -EINVAL;
+	}
+
+	if (length == 0 || length > lctx->n201) {
+		/* G.4.2 If the length indicator of an I frame is set
+		 * to a numerical value L>N201 or L=0, an MDL-ERROR-INDICATION
+		 * primitive with cause "I frame with incorrect length"
+		 * is sent to the mobile management entity. */
+		LOGP(DLLAPD, LOGL_NOTICE, "I frame length not allowed\n");
+		msgb_free(msg);
+		mdl_error(MDL_CAUSE_IFRM_INC_LEN, lctx);
+		return -EIO;
+	}
+
+	/* G.4.2 If the numerical value of L is L<N201 and the M
+	 * bit is set to "1", then an MDL-ERROR-INDICATION primitive with
+	 * cause "I frame with incorrect use of M bit" is sent to the
+	 * mobile management entity. */
+	if (lctx->more && length < lctx->n201) {
+		LOGP(DLLAPD, LOGL_NOTICE, "I frame with M bit too short\n");
+		msgb_free(msg);
+		mdl_error(MDL_CAUSE_IFRM_INC_MBITS, lctx);
+		return -EIO;
+	}
+
+	switch (dl->state) {
+	case LAPD_STATE_IDLE:
+		/* if P=1, respond DM with F=1 (5.2.2) */
+		/* 5.4.5 all other frame types shall be discarded */
+		if (lctx->p_f)
+			lapd_send_dm(lctx); /* F=P */
+		/* fall though */
+	case LAPD_STATE_SABM_SENT:
+	case LAPD_STATE_DISC_SENT:
+		LOGP(DLLAPD, LOGL_NOTICE, "I frame ignored in this state\n");
+		msgb_free(msg);
+		return 0;
+	}
+
+	/* 5.7.1: N(s) sequence error */
+	if (ns != dl->v_recv) {
+		LOGP(DLLAPD, LOGL_NOTICE, "N(S) sequence error: N(S)=%u, "
+		     "V(R)=%u\n", ns, dl->v_recv);
+		/* discard data */
+		msgb_free(msg);
+		if (dl->seq_err_cond != 1) {
+			/* FIXME: help me understand what exactly todo here
+			*/
+			dl->seq_err_cond = 1;
+			lapd_send_rej(lctx, lctx->p_f);
+		} else {
+			/* If there are two subsequent sequence errors received,
+			 * ignore it. (Ignore every second subsequent error.)
+			 * This happens if our reply with the REJ is too slow,
+			 * so the remote gets a T200 timeout and sends another
+			 * frame with a sequence error.
+			 * Test showed that replying with two subsequent REJ
+			 * messages could the remote L2 process to abort.
+			 * Replying too slow shouldn't happen, but may happen
+			 * over serial link between BB and LAPD.
+			 */
+			dl->seq_err_cond = 2;
+		}
+		/* Even if N(s) sequence error, acknowledge to N(R)-1 */
+		/* 5.5.3.1: Acknowlege all transmitted frames up the N(R)-1 */
+		lapd_acknowledge(lctx); /* V(A) is also set here */
+
+		/* Send message, if possible due to acknowledged data */
+		lapd_send_i(lctx, __LINE__);
+
+		return 0;
+	}
+	dl->seq_err_cond = 0;
+
+	/* Increment receiver state */
+	dl->v_recv = inc_mod(dl->v_recv, dl->v_range);
+	LOGP(DLLAPD, LOGL_INFO, "incrementing V(R) to %u\n", dl->v_recv);
+
+	/* 5.5.3.1: Acknowlege all transmitted frames up the the N(R)-1 */
+	lapd_acknowledge(lctx); /* V(A) is also set here */
+
+	/* Only if we are not in own receiver busy condition */
+	if (!dl->own_busy) {
+		/* if the frame carries a complete segment */
+		if (!lctx->more && !dl->rcv_buffer) {
+			LOGP(DLLAPD, LOGL_INFO, "message in single I frame\n");
+			/* send a DATA INDICATION to L3 */
+			msg->len = length;
+			msg->tail = msg->data + length;
+			rc = send_dl_l3(PRIM_DL_DATA, PRIM_OP_INDICATION, lctx,
+				msg);
+		} else {
+			/* create rcv_buffer */
+			if (!dl->rcv_buffer) {
+				LOGP(DLLAPD, LOGL_INFO, "message in multiple "
+					"I frames (first message)\n");
+				dl->rcv_buffer = lapd_msgb_alloc(dl->maxf,
+					"LAPD RX");
+				dl->rcv_buffer->l3h = dl->rcv_buffer->data;
+			}
+			/* concat. rcv_buffer */
+			if (msgb_l3len(dl->rcv_buffer) + length > dl->maxf) {
+				LOGP(DLLAPD, LOGL_NOTICE, "Received frame "
+					"overflow!\n");
+			} else {
+				memcpy(msgb_put(dl->rcv_buffer, length),
+					msg->l3h, length);
+			}
+			/* if the last segment was received */
+			if (!lctx->more) {
+				LOGP(DLLAPD, LOGL_INFO, "message in multiple "
+					"I frames (last message)\n");
+				rc = send_dl_l3(PRIM_DL_DATA,
+					PRIM_OP_INDICATION, lctx,
+					dl->rcv_buffer);
+				dl->rcv_buffer = NULL;
+			} else
+				LOGP(DLLAPD, LOGL_INFO, "message in multiple "
+					"I frames (next message)\n");
+			msgb_free(msg);
+
+		}
+	} else
+		LOGP(DLLAPD, LOGL_INFO, "I frame ignored during own receiver "
+			"busy condition\n");
+
+	/* Check for P bit */
+	if (lctx->p_f) {
+		/* 5.5.2.1 */
+		/* check if we are not in own receiver busy */
+		if (!dl->own_busy) {
+			LOGP(DLLAPD, LOGL_INFO, "we are not busy, send RR\n");
+			/* Send RR with F=1 */
+			rc = lapd_send_rr(lctx, 1, 0);
+		} else {
+			LOGP(DLLAPD, LOGL_INFO, "we are busy, send RNR\n");
+			/* Send RNR with F=1 */
+			rc = lapd_send_rnr(lctx, 1, 0);
+		}
+	} else {
+		/* 5.5.2.2 */
+		/* check if we are not in own receiver busy */
+		if (!dl->own_busy) {
+			/* NOTE: V(R) is already set above */
+			rc = lapd_send_i(lctx, __LINE__);
+			if (rc) {
+				LOGP(DLLAPD, LOGL_INFO, "we are not busy and "
+					"have no pending data, send RR\n");
+				/* Send RR with F=0 */
+				return lapd_send_rr(lctx, 0, 0);
+			}
+			/* all I or one RR is sent, we are done */
+			return 0;
+		} else {
+			LOGP(DLLAPD, LOGL_INFO, "we are busy, send RNR\n");
+			/* Send RNR with F=0 */
+			rc = lapd_send_rnr(lctx, 0, 0);
+		}
+	}
+
+	/* Send message, if possible due to acknowledged data */
+	lapd_send_i(lctx, __LINE__);
+
+	return rc;
+}
+
+/* Receive a LAPD message from L1 */
+int lapd_ph_data_ind(struct msgb *msg, struct lapd_msg_ctx *lctx)
+{
+	int rc;
+
+	switch (lctx->format) {
+	case LAPD_FORM_U:
+		rc = lapd_rx_u(msg, lctx);
+		break;
+	case LAPD_FORM_S:
+		rc = lapd_rx_s(msg, lctx);
+		break;
+	case LAPD_FORM_I:
+		rc = lapd_rx_i(msg, lctx);
+		break;
+	default:
+		LOGP(DLLAPD, LOGL_NOTICE, "unknown LAPD format\n");
+		msgb_free(msg);
+		rc = -EINVAL;
+	}
+	return rc;
+}
+
+/* L3 -> L2 */
+
+/* send unit data */
+static int lapd_udata_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	struct msgb *msg = dp->oph.msg;
+	struct lapd_msg_ctx nctx;
+
+	memcpy(&nctx, lctx, sizeof(nctx));
+	/* keep nctx.ldp */
+	/* keep nctx.sapi */
+	/* keep nctx.tei */
+	nctx.cr = dl->cr.loc2rem.cmd;
+	nctx.format = LAPD_FORM_U;
+	nctx.s_u = LAPD_U_UI;
+	/* keep nctx.p_f */
+	nctx.length = msg->len;
+	nctx.more = 0;
+
+	return dl->send_ph_data_req(&nctx, msg);
+}
+
+/* request link establishment */
+static int lapd_est_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	struct msgb *msg = dp->oph.msg;
+	struct lapd_msg_ctx nctx;
+
+	if (msg->len)
+		LOGP(DLLAPD, LOGL_INFO, "perform establishment with content "
+			"(SABM)\n");
+	else
+		LOGP(DLLAPD, LOGL_INFO, "perform normal establishm. (SABM)\n");
+
+	/* Flush send-queue */
+	/* Clear send-buffer */
+	lapd_dl_flush_send(dl);
+	/* be sure that history is empty */
+	lapd_dl_flush_hist(dl);
+
+	/* save message context for further use */
+	memcpy(&dl->lctx, lctx, sizeof(dl->lctx));
+
+	/* Discard partly received L3 message */
+	if (dl->rcv_buffer) {
+		msgb_free(dl->rcv_buffer);
+		dl->rcv_buffer = NULL;
+	}
+
+	/* assemble message */
+	memcpy(&nctx, &dl->lctx, sizeof(nctx));
+	/* keep nctx.ldp */
+	/* keep nctx.sapi */
+	/* keep nctx.tei */
+	nctx.cr = dl->cr.loc2rem.cmd;
+	nctx.format = LAPD_FORM_U;
+	nctx.s_u = (dl->use_sabme) ? LAPD_U_SABME : LAPD_U_SABM;
+	nctx.p_f = 1;
+	nctx.length = msg->len;
+	nctx.more = 0;
+
+	/* Transmit-buffer carries exactly one segment */
+	dl->tx_hist[0].msg = lapd_msgb_alloc(msg->len, "HIST");
+	msgb_put(dl->tx_hist[0].msg, msg->len);
+	if (msg->len)
+		memcpy(dl->tx_hist[0].msg->data, msg->l3h, msg->len);
+	dl->tx_hist[0].more = 0;
+	/* set Vs to 0, because it is used as index when resending SABM */
+	dl->v_send = 0;
+	
+	/* Set states */
+	dl->own_busy = dl->peer_busy = 0;
+	dl->retrans_ctr = 0;
+	lapd_dl_newstate(dl, LAPD_STATE_SABM_SENT);
+
+	/* Tramsmit and start T200 */
+	dl->send_ph_data_req(&nctx, msg);
+	lapd_start_t200(dl);
+
+	return 0;
+}
+
+/* send data */
+static int lapd_data_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	struct msgb *msg = dp->oph.msg;
+
+	if (msgb_l3len(msg) == 0) {
+		LOGP(DLLAPD, LOGL_ERROR,
+			"writing an empty message is not possible.\n");
+		msgb_free(msg);
+		return -1;
+	}
+
+	LOGP(DLLAPD, LOGL_INFO,
+	     "writing message to send-queue: l3len: %d\n", msgb_l3len(msg));
+
+	/* Write data into the send queue */
+	msgb_enqueue(&dl->send_queue, msg);
+
+	/* Send message, if possible */
+	lapd_send_i(&dl->lctx, __LINE__);
+
+	return 0;
+}
+
+/* Send next I frame from queued/buffered data */
+static int lapd_send_i(struct lapd_msg_ctx *lctx, int line)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	uint8_t k = dl->k;
+	uint8_t h;
+	struct msgb *msg;
+	int length, left;
+	int rc = - 1; /* we sent nothing */
+	struct lapd_msg_ctx nctx;
+
+
+	LOGP(DLLAPD, LOGL_INFO, "%s() called from line %d\n", __func__, line);
+
+	next_frame:
+
+	if (dl->peer_busy) {
+		LOGP(DLLAPD, LOGL_INFO, "peer busy, not sending\n");
+		return rc;
+	}
+
+	if (dl->state == LAPD_STATE_TIMER_RECOV) {
+		LOGP(DLLAPD, LOGL_INFO, "timer recovery, not sending\n");
+		return rc;
+	}
+
+	/* If the send state variable V(S) is equal to V(A) plus k
+	 * (where k is the maximum number of outstanding I frames - see
+	 * subclause 5.8.4), the data link layer entity shall not transmit any
+	 * new I frames, but shall retransmit an I frame as a result
+	 * of the error recovery procedures as described in subclauses 5.5.4 and
+	 * 5.5.7. */
+	if (dl->v_send == add_mod(dl->v_ack, k, dl->v_range)) {
+		LOGP(DLLAPD, LOGL_INFO, "k frames outstanding, not sending "
+			"more (k=%u V(S)=%u V(A)=%u)\n", k, dl->v_send,
+			dl->v_ack);
+		return rc;
+	}
+
+	h = do_mod(dl->v_send, dl->range_hist);
+
+	/* if we have no tx_hist yet, we create it */
+	if (!dl->tx_hist[h].msg) {
+		/* Get next message into send-buffer, if any */
+		if (!dl->send_buffer) {
+			next_message:
+			dl->send_out = 0;
+			dl->send_buffer = msgb_dequeue(&dl->send_queue);
+			/* No more data to be sent */
+			if (!dl->send_buffer)
+				return rc;
+			LOGP(DLLAPD, LOGL_INFO, "get message from "
+				"send-queue\n");
+		}
+
+		/* How much is left in the send-buffer? */
+		left = msgb_l3len(dl->send_buffer) - dl->send_out;
+		/* Segment, if data exceeds N201 */
+		length = left;
+		if (length > lctx->n201)
+			length = lctx->n201;
+		LOGP(DLLAPD, LOGL_INFO, "msg-len %d sent %d left %d N201 %d "
+			"length %d first byte %02x\n",
+			msgb_l3len(dl->send_buffer), dl->send_out, left,
+			lctx->n201, length, dl->send_buffer->l3h[0]);
+		/* If message in send-buffer is completely sent */
+		if (left == 0) {
+			msgb_free(dl->send_buffer);
+			dl->send_buffer = NULL;
+			goto next_message;
+		}
+
+		LOGP(DLLAPD, LOGL_INFO, "send I frame %sV(S)=%d\n",
+			(left > length) ? "segment " : "", dl->v_send);
+
+		/* Create I frame (segment) and transmit-buffer content */
+		msg = lapd_msgb_alloc(length, "LAPD I");
+		msg->l3h = msgb_put(msg, length);
+		/* assemble message */
+		memcpy(&nctx, &dl->lctx, sizeof(nctx));
+		/* keep nctx.ldp */
+		/* keep nctx.sapi */
+		/* keep nctx.tei */
+		nctx.cr = dl->cr.loc2rem.cmd;
+		nctx.format = LAPD_FORM_I;
+		nctx.p_f = 0;
+		nctx.n_send = dl->v_send;
+		nctx.n_recv = dl->v_recv;
+		nctx.length = length;
+		if (left > length)
+			nctx.more = 1;
+		else
+			nctx.more = 0;
+		if (length)
+			memcpy(msg->l3h, dl->send_buffer->l3h + dl->send_out,
+				length);
+		/* store in tx_hist */
+		dl->tx_hist[h].msg = lapd_msgb_alloc(msg->len, "HIST");
+		msgb_put(dl->tx_hist[h].msg, msg->len);
+		if (length)
+			memcpy(dl->tx_hist[h].msg->data, msg->l3h, msg->len);
+		dl->tx_hist[h].more = nctx.more;
+		/* Add length to track how much is already in the tx buffer */
+		dl->send_out += length;
+	} else {
+		LOGP(DLLAPD, LOGL_INFO, "resend I frame from tx buffer "
+			"V(S)=%d\n", dl->v_send);
+
+		/* Create I frame (segment) from tx_hist */
+		length = dl->tx_hist[h].msg->len;
+		msg = lapd_msgb_alloc(length, "LAPD I resend");
+		msg->l3h = msgb_put(msg, length);
+		/* assemble message */
+		memcpy(&nctx, &dl->lctx, sizeof(nctx));
+		/* keep nctx.ldp */
+		/* keep nctx.sapi */
+		/* keep nctx.tei */
+		nctx.cr = dl->cr.loc2rem.cmd;
+		nctx.format = LAPD_FORM_I;
+		nctx.p_f = 0;
+		nctx.n_send = dl->v_send;
+		nctx.n_recv = dl->v_recv;
+		nctx.length = length;
+		nctx.more = dl->tx_hist[h].more;
+		if (length)
+			memcpy(msg->l3h, dl->tx_hist[h].msg->data, length);
+	}
+
+	/* The value of the send state variable V(S) shall be incremented by 1
+	 * at the end of the transmission of the I frame */
+	dl->v_send = inc_mod(dl->v_send, dl->v_range);
+
+	/* If timer T200 is not running at the time right before transmitting a
+	 * frame, when the PH-READY-TO-SEND primitive is received from the
+	 * physical layer., it shall be set. */
+	if (!osmo_timer_pending(&dl->t200)) {
+		/* stop Timer T203, if running */
+		lapd_stop_t203(dl);
+		/* start Timer T200 */
+		lapd_start_t200(dl);
+	}
+
+	dl->send_ph_data_req(&nctx, msg);
+
+	rc = 0; /* we sent something */
+	goto next_frame;
+}
+
+/* request link suspension */
+static int lapd_susp_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	struct msgb *msg = dp->oph.msg;
+
+	LOGP(DLLAPD, LOGL_INFO, "perform suspension\n");
+
+	/* put back the send-buffer to the send-queue (first position) */
+	if (dl->send_buffer) {
+		LOGP(DLLAPD, LOGL_INFO, "put frame in sendbuffer back to "
+			"queue\n");
+		llist_add(&dl->send_buffer->list, &dl->send_queue);
+		dl->send_buffer = NULL;
+	} else
+		LOGP(DLLAPD, LOGL_INFO, "no frame in sendbuffer\n");
+
+	/* Clear transmit buffer, but keep send buffer */
+	lapd_dl_flush_tx(dl);
+	/* Stop timers (there is no state change, so we must stop all timers */
+	lapd_stop_t200(dl);
+	lapd_stop_t203(dl);
+
+	msgb_free(msg);
+
+	return send_dl_simple(PRIM_DL_SUSP, PRIM_OP_CONFIRM, &dl->lctx);
+}
+
+/* requesst resume or reconnect of link */
+static int lapd_res_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	struct msgb *msg = dp->oph.msg;
+	struct lapd_msg_ctx nctx;
+
+	LOGP(DLLAPD, LOGL_INFO, "perform re-establishment (SABM) length=%d\n",
+		msg->len);
+	
+	/* be sure that history is empty */
+	lapd_dl_flush_hist(dl);
+
+	/* save message context for further use */
+	memcpy(&dl->lctx, lctx, sizeof(dl->lctx));
+
+	/* Replace message in the send-buffer (reconnect) */
+	if (dl->send_buffer)
+		msgb_free(dl->send_buffer);
+	dl->send_out = 0;
+	if (msg && msg->len)
+		/* Write data into the send buffer, to be sent first */
+		dl->send_buffer = msg;
+	else
+		dl->send_buffer = NULL;
+
+	/* Discard partly received L3 message */
+	if (dl->rcv_buffer) {
+		msgb_free(dl->rcv_buffer);
+		dl->rcv_buffer = NULL;
+	}
+
+	/* Create new msgb (old one is now free) */
+	msg = lapd_msgb_alloc(0, "LAPD SABM");
+	msg->l3h = msg->data;
+	/* assemble message */
+	memcpy(&nctx, &dl->lctx, sizeof(nctx));
+	/* keep nctx.ldp */
+	/* keep nctx.sapi */
+	/* keep nctx.tei */
+	nctx.cr = dl->cr.loc2rem.cmd;
+	nctx.format = LAPD_FORM_U;
+	nctx.s_u = (dl->use_sabme) ? LAPD_U_SABME : LAPD_U_SABM;
+	nctx.p_f = 1;
+	nctx.length = 0;
+	nctx.more = 0;
+
+	dl->tx_hist[0].msg = lapd_msgb_alloc(msg->len, "HIST");
+	msgb_put(dl->tx_hist[0].msg, msg->len);
+	if (msg->len)
+		memcpy(dl->tx_hist[0].msg->data, msg->l3h, msg->len);
+	dl->tx_hist[0].more = 0;
+	/* set Vs to 0, because it is used as index when resending SABM */
+	dl->v_send = 0;
+
+	/* Set states */
+	dl->own_busy = dl->peer_busy = 0;
+	dl->retrans_ctr = 0;
+	lapd_dl_newstate(dl, LAPD_STATE_SABM_SENT);
+
+	/* Tramsmit and start T200 */
+	dl->send_ph_data_req(&nctx, msg);
+	lapd_start_t200(dl);
+
+	return 0;
+}
+
+/* requesst release of link */
+static int lapd_rel_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	struct msgb *msg = dp->oph.msg;
+	struct lapd_msg_ctx nctx;
+
+	/* local release */
+	if (dp->u.rel_req.mode) {
+		LOGP(DLLAPD, LOGL_INFO, "perform local release\n");
+		msgb_free(msg);
+		/* stop Timer T200 */
+		lapd_stop_t200(dl);
+		/* enter idle state, T203 is stopped here, if running */
+		lapd_dl_newstate(dl, LAPD_STATE_IDLE);
+		/* flush buffers */
+		lapd_dl_flush_tx(dl);
+		lapd_dl_flush_send(dl);
+		/* send notification to L3 */
+		return send_dl_simple(PRIM_DL_REL, PRIM_OP_CONFIRM, &dl->lctx);
+	}
+
+	/* in case we are already disconnecting */
+	if (dl->state == LAPD_STATE_DISC_SENT)
+		return -EBUSY;
+
+	/* flush tx_hist */
+	lapd_dl_flush_hist(dl);
+
+	LOGP(DLLAPD, LOGL_INFO, "perform normal release (DISC)\n");
+
+	/* Push LAPD header on msgb */
+	/* assemble message */
+	memcpy(&nctx, &dl->lctx, sizeof(nctx));
+	/* keep nctx.ldp */
+	/* keep nctx.sapi */
+	/* keep nctx.tei */
+	nctx.cr = dl->cr.loc2rem.cmd;
+	nctx.format = LAPD_FORM_U;
+	nctx.s_u = LAPD_U_DISC;
+	nctx.p_f = 1;
+	nctx.length = 0;
+	nctx.more = 0;
+
+	dl->tx_hist[0].msg = lapd_msgb_alloc(msg->len, "HIST");
+	msgb_put(dl->tx_hist[0].msg, msg->len);
+	if (msg->len)
+		memcpy(dl->tx_hist[0].msg->data, msg->l3h, msg->len);
+	dl->tx_hist[0].more = 0;
+	/* set Vs to 0, because it is used as index when resending DISC */
+	dl->v_send = 0;
+	
+	/* Set states */
+	dl->own_busy = dl->peer_busy = 0;
+	dl->retrans_ctr = 0;
+	lapd_dl_newstate(dl, LAPD_STATE_DISC_SENT);
+
+	/* Tramsmit and start T200 */
+	dl->send_ph_data_req(&nctx, msg);
+	lapd_start_t200(dl);
+
+	return 0;
+}
+
+/* request release of link in idle state */
+static int lapd_rel_req_idle(struct osmo_dlsap_prim *dp,
+	struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	struct msgb *msg = dp->oph.msg;
+
+	msgb_free(msg);
+
+	/* send notification to L3 */
+	return send_dl_simple(PRIM_DL_REL, PRIM_OP_CONFIRM, &dl->lctx);
+}
+
+/* statefull handling for DL SAP messages from L3 */
+static struct l2downstate {
+	uint32_t	states;
+	int		prim, op;
+	const char 	*name;
+	int		(*rout) (struct osmo_dlsap_prim *dp,
+					struct lapd_msg_ctx *lctx);
+} l2downstatelist[] = {
+	/* create and send UI command */
+	{ALL_STATES,
+	 PRIM_DL_UNIT_DATA, PRIM_OP_REQUEST, 
+	 "DL-UNIT-DATA-REQUEST", lapd_udata_req},
+
+	/* create and send SABM command */
+	{SBIT(LAPD_STATE_IDLE),
+	 PRIM_DL_EST, PRIM_OP_REQUEST,
+	 "DL-ESTABLISH-REQUEST", lapd_est_req},
+
+	/* create and send I command */
+	{SBIT(LAPD_STATE_MF_EST) |
+	 SBIT(LAPD_STATE_TIMER_RECOV),
+	 PRIM_DL_DATA, PRIM_OP_REQUEST,
+	 "DL-DATA-REQUEST", lapd_data_req},
+
+	/* suspend datalink */
+	{SBIT(LAPD_STATE_MF_EST) |
+	 SBIT(LAPD_STATE_TIMER_RECOV),
+	 PRIM_DL_SUSP, PRIM_OP_REQUEST,
+	 "DL-SUSPEND-REQUEST", lapd_susp_req},
+
+	/* create and send SABM command (resume) */
+	{SBIT(LAPD_STATE_MF_EST) |
+	 SBIT(LAPD_STATE_TIMER_RECOV),
+	 PRIM_DL_RES, PRIM_OP_REQUEST,
+	 "DL-RESUME-REQUEST", lapd_res_req},
+
+	/* create and send SABM command (reconnect) */
+	{SBIT(LAPD_STATE_IDLE) |
+	 SBIT(LAPD_STATE_MF_EST) |
+	 SBIT(LAPD_STATE_TIMER_RECOV),
+	 PRIM_DL_RECON, PRIM_OP_REQUEST,
+	 "DL-RECONNECT-REQUEST", lapd_res_req},
+
+	/* create and send DISC command */
+	{SBIT(LAPD_STATE_SABM_SENT) |
+	 SBIT(LAPD_STATE_MF_EST) |
+	 SBIT(LAPD_STATE_TIMER_RECOV) |
+	 SBIT(LAPD_STATE_DISC_SENT),
+	 PRIM_DL_REL, PRIM_OP_REQUEST,
+	 "DL-RELEASE-REQUEST", lapd_rel_req},
+
+	/* release in idle state */
+	{SBIT(LAPD_STATE_IDLE),
+	 PRIM_DL_REL, PRIM_OP_REQUEST,
+	 "DL-RELEASE-REQUEST", lapd_rel_req_idle},
+};
+
+#define L2DOWNSLLEN \
+	(sizeof(l2downstatelist) / sizeof(struct l2downstate))
+
+int lapd_recv_dlsap(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	int i, supported = 0;
+	struct msgb *msg = dp->oph.msg;
+	int rc;
+
+	/* find function for current state and message */
+	for (i = 0; i < L2DOWNSLLEN; i++) {
+		if (dp->oph.primitive == l2downstatelist[i].prim
+		 && dp->oph.operation == l2downstatelist[i].op) {
+			supported = 1;
+		 	if ((SBIT(dl->state) & l2downstatelist[i].states))
+				break;
+		}
+	}
+	if (!supported) {
+		LOGP(DLLAPD, LOGL_NOTICE, "Message %u/%u unsupported.\n",
+			dp->oph.primitive, dp->oph.operation);
+		msgb_free(msg);
+		return 0;
+	}
+	if (i == L2DOWNSLLEN) {
+		LOGP(DLLAPD, LOGL_NOTICE, "Message %u/%u unhandled at this "
+			"state %s.\n", dp->oph.primitive, dp->oph.operation,
+			lapd_state_names[dl->state]);
+		msgb_free(msg);
+		return 0;
+	}
+
+	LOGP(DLLAPD, LOGL_INFO, "Message %s received in state %s\n",
+		l2downstatelist[i].name, lapd_state_names[dl->state]);
+
+	rc = l2downstatelist[i].rout(dp, lctx);
+
+	return rc;
+}
+
diff --git a/src/shared/libosmocore/src/gsm/lapdm.c b/src/shared/libosmocore/src/gsm/lapdm.c
new file mode 100644
index 00000000..1c08113e
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/lapdm.c
@@ -0,0 +1,1249 @@
+/* GSM LAPDm (TS 04.06) implementation */
+
+/* (C) 2010-2011 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010-2011 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \addtogroup lapdm
+ *  @{
+ */
+
+/*! \file lapdm.c */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/utils.h>
+
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gsm/prim.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/lapdm.h>
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+
+/* TS 04.06 Figure 4 / Section 3.2 */
+#define LAPDm_LPD_NORMAL  0
+#define LAPDm_LPD_SMSCB	  1
+#define LAPDm_SAPI_NORMAL 0
+#define LAPDm_SAPI_SMS	  3
+#define LAPDm_ADDR(lpd, sapi, cr) ((((lpd) & 0x3) << 5) | (((sapi) & 0x7) << 2) | (((cr) & 0x1) << 1) | 0x1)
+
+#define LAPDm_ADDR_LPD(addr) (((addr) >> 5) & 0x3)
+#define LAPDm_ADDR_SAPI(addr) (((addr) >> 2) & 0x7)
+#define LAPDm_ADDR_CR(addr) (((addr) >> 1) & 0x1)
+#define LAPDm_ADDR_EA(addr) ((addr) & 0x1)
+
+/* TS 04.06 Table 3 / Section 3.4.3 */
+#define LAPDm_CTRL_I(nr, ns, p)	((((nr) & 0x7) << 5) | (((p) & 0x1) << 4) | (((ns) & 0x7) << 1))
+#define LAPDm_CTRL_S(nr, s, p)	((((nr) & 0x7) << 5) | (((p) & 0x1) << 4) | (((s) & 0x3) << 2) | 0x1)
+#define LAPDm_CTRL_U(u, p)	((((u) & 0x1c) << (5-2)) | (((p) & 0x1) << 4) | (((u) & 0x3) << 2) | 0x3)
+
+#define LAPDm_CTRL_is_I(ctrl)	(((ctrl) & 0x1) == 0)
+#define LAPDm_CTRL_is_S(ctrl)	(((ctrl) & 0x3) == 1)
+#define LAPDm_CTRL_is_U(ctrl)	(((ctrl) & 0x3) == 3)
+
+#define LAPDm_CTRL_U_BITS(ctrl)	((((ctrl) & 0xC) >> 2) | ((ctrl) & 0xE0) >> 3)
+#define LAPDm_CTRL_PF_BIT(ctrl)	(((ctrl) >> 4) & 0x1)
+
+#define LAPDm_CTRL_S_BITS(ctrl)	(((ctrl) & 0xC) >> 2)
+
+#define LAPDm_CTRL_I_Ns(ctrl)	(((ctrl) & 0xE) >> 1)
+#define LAPDm_CTRL_Nr(ctrl)	(((ctrl) & 0xE0) >> 5)
+
+#define LAPDm_LEN(len)	((len << 2) | 0x1)
+#define LAPDm_MORE	0x2
+#define LAPDm_EL	0x1
+
+#define LAPDm_U_UI	0x0
+
+/* TS 04.06 Section 5.8.3 */
+#define N201_AB_SACCH		18
+#define N201_AB_SDCCH		20
+#define N201_AB_FACCH		20
+#define N201_Bbis		23
+#define N201_Bter_SACCH		21
+#define N201_Bter_SDCCH		23
+#define N201_Bter_FACCH		23
+#define N201_B4			19
+
+/* 5.8.2.1 N200 during establish and release */
+#define N200_EST_REL		5
+/* 5.8.2.1 N200 during timer recovery state */
+#define N200_TR_SACCH		5
+#define N200_TR_SDCCH		23
+#define N200_TR_FACCH_FR	34
+#define N200_TR_EFACCH_FR	48
+#define N200_TR_FACCH_HR	29
+/* FIXME: set N200 depending on chan_nr */
+#define N200 N200_TR_SDCCH
+
+enum lapdm_format {
+	LAPDm_FMT_A,
+	LAPDm_FMT_B,
+	LAPDm_FMT_Bbis,
+	LAPDm_FMT_Bter,
+	LAPDm_FMT_B4,
+};
+
+static int lapdm_send_ph_data_req(struct lapd_msg_ctx *lctx, struct msgb *msg);
+static int send_rslms_dlsap(struct osmo_dlsap_prim *dp,
+	struct lapd_msg_ctx *lctx);
+
+static void lapdm_dl_init(struct lapdm_datalink *dl,
+			  struct lapdm_entity *entity, int t200)
+{
+	memset(dl, 0, sizeof(*dl));
+	dl->entity = entity;
+	lapd_dl_init(&dl->dl, 1, 8, 200);
+	dl->dl.reestablish = 0; /* GSM uses no reestablish */
+	dl->dl.send_ph_data_req = lapdm_send_ph_data_req;
+	dl->dl.send_dlsap = send_rslms_dlsap;
+	dl->dl.n200_est_rel = N200_EST_REL;
+	dl->dl.n200 = N200;
+	dl->dl.t203_sec = 0; dl->dl.t203_usec = 0;
+	dl->dl.t200_sec = t200; dl->dl.t200_usec = 0;
+}
+
+/*! \brief initialize a LAPDm entity and all datalinks inside
+ *  \param[in] le LAPDm entity
+ *  \param[in] mode \ref lapdm_mode (BTS/MS)
+ */
+void lapdm_entity_init(struct lapdm_entity *le, enum lapdm_mode mode, int t200)
+{
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(le->datalink); i++)
+		lapdm_dl_init(&le->datalink[i], le, t200);
+
+	lapdm_entity_set_mode(le, mode);
+}
+
+/*! \brief initialize a LAPDm channel and all its channels
+ *  \param[in] lc \ref lapdm_channel to be initialized
+ *  \param[in] mode \ref lapdm_mode (BTS/MS)
+ *
+ * This really is a convenience wrapper around calling \ref
+ * lapdm_entity_init twice.
+ */
+void lapdm_channel_init(struct lapdm_channel *lc, enum lapdm_mode mode)
+{
+	lapdm_entity_init(&lc->lapdm_acch, mode, 2);
+	/* FIXME: this depends on chan type */
+	lapdm_entity_init(&lc->lapdm_dcch, mode, 1);
+}
+
+/*! \brief flush and release all resoures in LAPDm entity */
+void lapdm_entity_exit(struct lapdm_entity *le)
+{
+	unsigned int i;
+	struct lapdm_datalink *dl;
+
+	for (i = 0; i < ARRAY_SIZE(le->datalink); i++) {
+		dl = &le->datalink[i];
+		lapd_dl_exit(&dl->dl);
+	}
+}
+
+/* \brief lfush and release all resources in LAPDm channel
+ *
+ * A convenience wrapper calling \ref lapdm_entity_exit on both
+ * entities inside the \ref lapdm_channel
+ */
+void lapdm_channel_exit(struct lapdm_channel *lc)
+{
+	lapdm_entity_exit(&lc->lapdm_acch);
+	lapdm_entity_exit(&lc->lapdm_dcch);
+}
+
+static struct lapdm_datalink *datalink_for_sapi(struct lapdm_entity *le, uint8_t sapi)
+{
+	switch (sapi) {
+	case LAPDm_SAPI_NORMAL:
+		return &le->datalink[0];
+	case LAPDm_SAPI_SMS:
+		return &le->datalink[1];
+	default:
+		return NULL;
+	}
+}
+
+/* remove the L2 header from a MSGB */
+static inline unsigned char *msgb_pull_l2h(struct msgb *msg)
+{
+	unsigned char *ret = msgb_pull(msg, msg->l3h - msg->l2h);
+	msg->l2h = NULL;
+	return ret;
+}
+
+/* Append padding (if required) */
+static void lapdm_pad_msgb(struct msgb *msg, uint8_t n201)
+{
+	int pad_len = n201 - msgb_l2len(msg);
+	uint8_t *data;
+
+	if (pad_len < 0) {
+		LOGP(DLLAPD, LOGL_ERROR,
+		     "cannot pad message that is already too big!\n");
+		return;
+	}
+
+	data = msgb_put(msg, pad_len);
+	memset(data, 0x2B, pad_len);
+}
+
+/* input function that L2 calls when sending messages up to L3 */
+static int rslms_sendmsg(struct msgb *msg, struct lapdm_entity *le)
+{
+	if (!le->l3_cb) {
+		msgb_free(msg);
+		return -EIO;
+	}
+
+	/* call the layer2 message handler that is registered */
+	return le->l3_cb(msg, le, le->l3_ctx);
+}
+
+/* write a frame into the tx queue */
+static int tx_ph_data_enqueue(struct lapdm_datalink *dl, struct msgb *msg,
+				uint8_t chan_nr, uint8_t link_id, uint8_t pad)
+{
+	struct lapdm_entity *le = dl->entity;
+	struct osmo_phsap_prim pp;
+
+	/* if there is a pending message, queue it */
+	if (le->tx_pending || le->flags & LAPDM_ENT_F_POLLING_ONLY) {
+		*msgb_push(msg, 1) = pad;
+		*msgb_push(msg, 1) = link_id;
+		*msgb_push(msg, 1) = chan_nr;
+		msgb_enqueue(&dl->dl.tx_queue, msg);
+		return -EBUSY;
+	}
+
+	osmo_prim_init(&pp.oph, SAP_GSM_PH, PRIM_PH_DATA,
+			PRIM_OP_REQUEST, msg);
+	pp.u.data.chan_nr = chan_nr;
+	pp.u.data.link_id = link_id;
+
+	/* send the frame now */
+	le->tx_pending = 0; /* disabled flow control */
+	lapdm_pad_msgb(msg, pad);
+
+	return le->l1_prim_cb(&pp.oph, le->l1_ctx);
+}
+
+static struct msgb *tx_dequeue_msgb(struct lapdm_entity *le)
+{
+	struct lapdm_datalink *dl;
+	int last = le->last_tx_dequeue;
+	int i = last, n = ARRAY_SIZE(le->datalink);
+	struct msgb *msg = NULL;
+
+	/* round-robin dequeue */
+	do {
+		/* next */
+		i = (i + 1) % n;
+		dl = &le->datalink[i];
+		if ((msg = msgb_dequeue(&dl->dl.tx_queue)))
+			break;
+	} while (i != last);
+
+	if (msg) {
+		/* Set last dequeue position */
+		le->last_tx_dequeue = i;
+	}
+
+	return msg;
+}
+
+/*! \brief dequeue a msg that's pending transmission via L1 and wrap it into
+ * a osmo_phsap_prim */
+int lapdm_phsap_dequeue_prim(struct lapdm_entity *le, struct osmo_phsap_prim *pp)
+{
+	struct msgb *msg;
+	uint8_t pad;
+
+	msg = tx_dequeue_msgb(le);
+	if (!msg)
+		return -ENODEV;
+
+	/* if we have a message, send PH-DATA.req */
+	osmo_prim_init(&pp->oph, SAP_GSM_PH, PRIM_PH_DATA,
+			PRIM_OP_REQUEST, msg);
+
+	/* Pull chan_nr and link_id */
+	pp->u.data.chan_nr = *msg->data;
+	msgb_pull(msg, 1);
+	pp->u.data.link_id = *msg->data;
+	msgb_pull(msg, 1);
+	pad = *msg->data;
+	msgb_pull(msg, 1);
+
+	/* Pad the frame, we can transmit now */
+	lapdm_pad_msgb(msg, pad);
+
+	return 0;
+}
+
+/* get next frame from the tx queue. because the ms has multiple datalinks,
+ * each datalink's queue is read round-robin.
+ */
+static int l2_ph_data_conf(struct msgb *msg, struct lapdm_entity *le)
+{
+	struct osmo_phsap_prim pp;
+
+	/* we may send again */
+	le->tx_pending = 0;
+
+	/* free confirm message */
+	if (msg)
+		msgb_free(msg);
+
+	if (lapdm_phsap_dequeue_prim(le, &pp) < 0) {
+		/* no message in all queues */
+
+		/* If user didn't request PH-EMPTY_FRAME.req, abort */
+		if (!(le->flags & LAPDM_ENT_F_EMPTY_FRAME))
+			return 0;
+
+		/* otherwise, send PH-EMPTY_FRAME.req */
+		osmo_prim_init(&pp.oph, SAP_GSM_PH,
+				PRIM_PH_EMPTY_FRAME,
+				PRIM_OP_REQUEST, NULL);
+	} else {
+		le->tx_pending = 1;
+	}
+
+	return le->l1_prim_cb(&pp.oph, le->l1_ctx);
+}
+
+/* Create RSLms various RSLms messages */
+static int send_rslms_rll_l3(uint8_t msg_type, struct lapdm_msg_ctx *mctx,
+			     struct msgb *msg)
+{
+	/* Add the RSL + RLL header */
+	rsl_rll_push_l3(msg, msg_type, mctx->chan_nr, mctx->link_id, 1);
+
+	/* send off the RSLms message to L3 */
+	return rslms_sendmsg(msg, mctx->dl->entity);
+}
+
+/* Take a B4 format message from L1 and create RSLms UNIT DATA IND */
+static int send_rslms_rll_l3_ui(struct lapdm_msg_ctx *mctx, struct msgb *msg)
+{
+	uint8_t l3_len = msg->tail - (uint8_t *)msgb_l3(msg);
+	struct abis_rsl_rll_hdr *rllh;
+
+	/* Add the RSL + RLL header */
+	msgb_tv16_push(msg, RSL_IE_L3_INFO, l3_len);
+	msgb_push(msg, 2 + 2);
+	rsl_rll_push_hdr(msg, RSL_MT_UNIT_DATA_IND, mctx->chan_nr,
+		mctx->link_id, 1);
+	rllh = (struct abis_rsl_rll_hdr *)msgb_l2(msg);
+
+	rllh->data[0] = RSL_IE_TIMING_ADVANCE;
+	rllh->data[1] = mctx->ta_ind;
+
+	rllh->data[2] = RSL_IE_MS_POWER;
+	rllh->data[3] = mctx->tx_power_ind;
+	
+	return rslms_sendmsg(msg, mctx->dl->entity);
+}
+
+static int send_rll_simple(uint8_t msg_type, struct lapdm_msg_ctx *mctx)
+{
+	struct msgb *msg;
+
+	msg = rsl_rll_simple(msg_type, mctx->chan_nr, mctx->link_id, 1);
+
+	/* send off the RSLms message to L3 */
+	return rslms_sendmsg(msg, mctx->dl->entity);
+}
+
+static int rsl_rll_error(uint8_t cause, struct lapdm_msg_ctx *mctx)
+{
+	struct msgb *msg;
+
+	LOGP(DLLAPD, LOGL_NOTICE, "sending MDL-ERROR-IND %d\n", cause);
+	msg = rsl_rll_simple(RSL_MT_ERROR_IND, mctx->chan_nr, mctx->link_id, 1);
+	msgb_tlv_put(msg, RSL_IE_RLM_CAUSE, 1, &cause);
+	return rslms_sendmsg(msg, mctx->dl->entity);
+}
+
+/* DLSAP L2 -> L3 (RSLms) */
+static int send_rslms_dlsap(struct osmo_dlsap_prim *dp,
+	struct lapd_msg_ctx *lctx)
+{
+	struct lapd_datalink *dl = lctx->dl;
+	struct lapdm_datalink *mdl =
+		container_of(dl, struct lapdm_datalink, dl);
+	struct lapdm_msg_ctx *mctx = &mdl->mctx;
+	uint8_t rll_msg = 0;
+
+	switch (OSMO_PRIM_HDR(&dp->oph)) {
+	case OSMO_PRIM(PRIM_DL_EST, PRIM_OP_INDICATION):
+		rll_msg = RSL_MT_EST_IND;
+		break;
+	case OSMO_PRIM(PRIM_DL_EST, PRIM_OP_CONFIRM):
+		rll_msg = RSL_MT_EST_CONF;
+		break;
+	case OSMO_PRIM(PRIM_DL_DATA, PRIM_OP_INDICATION):
+		rll_msg = RSL_MT_DATA_IND;
+		break;
+	case OSMO_PRIM(PRIM_DL_UNIT_DATA, PRIM_OP_INDICATION):
+		return send_rslms_rll_l3_ui(mctx, dp->oph.msg);
+	case OSMO_PRIM(PRIM_DL_REL, PRIM_OP_INDICATION):
+		rll_msg = RSL_MT_REL_IND;
+		break;
+	case OSMO_PRIM(PRIM_DL_REL, PRIM_OP_CONFIRM):
+		rll_msg = RSL_MT_REL_CONF;
+		break;
+	case OSMO_PRIM(PRIM_DL_SUSP, PRIM_OP_CONFIRM):
+		rll_msg = RSL_MT_SUSP_CONF;
+		break;
+	case OSMO_PRIM(PRIM_MDL_ERROR, PRIM_OP_INDICATION):
+		rsl_rll_error(dp->u.error_ind.cause, mctx);
+		if (dp->oph.msg)
+			msgb_free(dp->oph.msg);
+		return 0;
+	}
+
+	if (!rll_msg) {
+		LOGP(DLLAPD, LOGL_ERROR, "Unsupported op %d, prim %d. Please "
+			"fix!\n", dp->oph.primitive, dp->oph.operation);
+		return -EINVAL;
+	}
+
+	if (!dp->oph.msg)
+		return send_rll_simple(rll_msg, mctx);
+
+	return send_rslms_rll_l3(rll_msg, mctx, dp->oph.msg);
+}
+
+/* send a data frame to layer 1 */
+static int lapdm_send_ph_data_req(struct lapd_msg_ctx *lctx, struct msgb *msg)
+{
+	uint8_t l3_len = msg->tail - msg->data;
+	struct lapd_datalink *dl = lctx->dl;
+	struct lapdm_datalink *mdl =
+		container_of(dl, struct lapdm_datalink, dl);
+	struct lapdm_msg_ctx *mctx = &mdl->mctx;
+	int format = lctx->format;
+
+	/* prepend l2 header */
+	msg->l2h = msgb_push(msg, 3);
+	msg->l2h[0] = LAPDm_ADDR(lctx->lpd, lctx->sapi, lctx->cr);
+					/* EA is set here too */
+	switch (format) {
+	case LAPD_FORM_I:
+		msg->l2h[1] = LAPDm_CTRL_I(lctx->n_recv, lctx->n_send,
+						lctx->p_f);
+		break;
+	case LAPD_FORM_S:
+		msg->l2h[1] = LAPDm_CTRL_S(lctx->n_recv, lctx->s_u, lctx->p_f);
+		break;
+	case LAPD_FORM_U:
+		msg->l2h[1] = LAPDm_CTRL_U(lctx->s_u, lctx->p_f);
+		break;
+	default:
+		msgb_free(msg);
+		return -EINVAL;
+	}
+	msg->l2h[2] = LAPDm_LEN(l3_len); /* EL is set here too */
+	if (lctx->more)
+		msg->l2h[2] |= LAPDm_MORE;
+
+	/* add ACCH header with last indicated tx-power and TA */
+	if ((mctx->link_id & 0x40)) {
+		struct lapdm_entity *le = mdl->entity;
+
+		msg->l2h = msgb_push(msg, 2);
+		msg->l2h[0] = le->tx_power;
+		msg->l2h[1] = le->ta;
+	}
+
+	return tx_ph_data_enqueue(mctx->dl, msg, mctx->chan_nr, mctx->link_id,
+			23);
+}
+
+/* input into layer2 (from layer 1) */
+static int l2_ph_data_ind(struct msgb *msg, struct lapdm_entity *le,
+	uint8_t chan_nr, uint8_t link_id)
+{
+	uint8_t cbits = chan_nr >> 3;
+	uint8_t sapi; /* we cannot take SAPI from link_id, as L1 has no clue */
+	struct lapdm_msg_ctx mctx;
+	struct lapd_msg_ctx lctx;
+	int rc = 0;
+	int n201;
+
+	/* when we reach here, we have a msgb with l2h pointing to the raw
+	 * 23byte mac block. The l1h has already been purged. */
+
+	memset(&mctx, 0, sizeof(mctx));
+	mctx.chan_nr = chan_nr;
+	mctx.link_id = link_id;
+
+	/* check for L1 chan_nr/link_id and determine LAPDm hdr format */
+	if (cbits == 0x10 || cbits == 0x12) {
+		/* Format Bbis is used on BCCH and CCCH(PCH, NCH and AGCH) */
+		mctx.lapdm_fmt = LAPDm_FMT_Bbis;
+		n201 = N201_Bbis;
+		sapi = 0;
+	} else {
+		if (mctx.link_id & 0x40) {
+			/* It was received from network on SACCH */
+
+			/* If UI on SACCH sent by BTS, lapdm_fmt must be B4 */
+			if (le->mode == LAPDM_MODE_MS
+			 && LAPDm_CTRL_is_U(msg->l2h[3])
+			 && LAPDm_CTRL_U_BITS(msg->l2h[3]) == 0) {
+				mctx.lapdm_fmt = LAPDm_FMT_B4;
+				n201 = N201_B4;
+				LOGP(DLLAPD, LOGL_INFO, "fmt=B4\n");
+			} else {
+				mctx.lapdm_fmt = LAPDm_FMT_B;
+				n201 = N201_AB_SACCH;
+				LOGP(DLLAPD, LOGL_INFO, "fmt=B\n");
+			}
+			/* SACCH frames have a two-byte L1 header that
+			 * OsmocomBB L1 doesn't strip */
+			mctx.tx_power_ind = msg->l2h[0] & 0x1f;
+			mctx.ta_ind = msg->l2h[1];
+			msgb_pull(msg, 2);
+			msg->l2h += 2;
+			sapi = (msg->l2h[0] >> 2) & 7;
+		} else {
+			mctx.lapdm_fmt = LAPDm_FMT_B;
+			LOGP(DLLAPD, LOGL_INFO, "fmt=B\n");
+			n201 = N201_AB_SDCCH;
+			sapi = (msg->l2h[0] >> 2) & 7;
+		}
+	}
+
+	mctx.dl = datalink_for_sapi(le, sapi);
+	/* G.2.1 No action on frames containing an unallocated SAPI. */
+	if (!mctx.dl) {
+		LOGP(DLLAPD, LOGL_NOTICE, "Received frame for unsupported "
+			"SAPI %d!\n", sapi);
+		msgb_free(msg);
+		return -EIO;
+	}
+
+	switch (mctx.lapdm_fmt) {
+	case LAPDm_FMT_A:
+	case LAPDm_FMT_B:
+	case LAPDm_FMT_B4:
+		lctx.dl = &mctx.dl->dl;
+		/* obtain SAPI from address field */
+		mctx.link_id |= LAPDm_ADDR_SAPI(msg->l2h[0]);
+		/* G.2.3 EA bit set to "0" is not allowed in GSM */
+		if (!LAPDm_ADDR_EA(msg->l2h[0])) {
+			LOGP(DLLAPD, LOGL_NOTICE, "EA bit 0 is not allowed in "
+				"GSM\n");
+			msgb_free(msg);
+			rsl_rll_error(RLL_CAUSE_FRM_UNIMPL, &mctx);
+			return -EINVAL;
+		}
+		/* adress field */
+		lctx.lpd = LAPDm_ADDR_LPD(msg->l2h[0]);
+		lctx.sapi = LAPDm_ADDR_SAPI(msg->l2h[0]);
+		lctx.cr = LAPDm_ADDR_CR(msg->l2h[0]);
+		/* command field */
+		if (LAPDm_CTRL_is_I(msg->l2h[1])) {
+			lctx.format = LAPD_FORM_I;
+			lctx.n_send = LAPDm_CTRL_I_Ns(msg->l2h[1]);
+			lctx.n_recv = LAPDm_CTRL_Nr(msg->l2h[1]);
+		} else if (LAPDm_CTRL_is_S(msg->l2h[1])) {
+			lctx.format = LAPD_FORM_S;
+			lctx.n_recv = LAPDm_CTRL_Nr(msg->l2h[1]);
+			lctx.s_u = LAPDm_CTRL_S_BITS(msg->l2h[1]);
+		} else if (LAPDm_CTRL_is_U(msg->l2h[1])) {
+			lctx.format = LAPD_FORM_U;
+			lctx.s_u = LAPDm_CTRL_U_BITS(msg->l2h[1]);
+		} else
+			lctx.format = LAPD_FORM_UKN;
+		lctx.p_f = LAPDm_CTRL_PF_BIT(msg->l2h[1]);
+		if (lctx.sapi != LAPDm_SAPI_NORMAL
+		 && lctx.sapi != LAPDm_SAPI_SMS
+		 && lctx.format == LAPD_FORM_U
+		 && lctx.s_u == LAPDm_U_UI) {
+			/* 5.3.3 UI frames with invalid SAPI values shall be
+			 * discarded
+			 */
+			LOGP(DLLAPD, LOGL_INFO, "sapi=%u (discarding)\n",
+				lctx.sapi);
+			msgb_free(msg);
+			return 0;
+		}
+		if (mctx.lapdm_fmt == LAPDm_FMT_B4) {
+			lctx.n201 = n201;
+			lctx.length = n201;
+			lctx.more = 0;
+			msg->l3h = msg->l2h + 2;
+			msgb_pull_l2h(msg);
+		} else {
+			/* length field */
+			if (!(msg->l2h[2] & LAPDm_EL)) {
+				/* G.4.1 If the EL bit is set to "0", an
+				 * MDL-ERROR-INDICATION primitive with cause
+				 * "frame not implemented" is sent to the
+				 * mobile management entity. */
+				LOGP(DLLAPD, LOGL_NOTICE, "we don't support "
+					"multi-octet length\n");
+				msgb_free(msg);
+				rsl_rll_error(RLL_CAUSE_FRM_UNIMPL, &mctx);
+				return -EINVAL;
+			}
+			lctx.n201 = n201;
+			lctx.length = msg->l2h[2] >> 2;
+			lctx.more = !!(msg->l2h[2] & LAPDm_MORE);
+			msg->l3h = msg->l2h + 3;
+			msgb_pull_l2h(msg);
+		}
+		/* store context for messages from lapd */
+		memcpy(&mctx.dl->mctx, &mctx, sizeof(mctx.dl->mctx));
+		/* send to LAPD */
+		rc = lapd_ph_data_ind(msg, &lctx);
+		break;
+	case LAPDm_FMT_Bter:
+		/* FIXME */
+		msgb_free(msg);
+		break;
+	case LAPDm_FMT_Bbis:
+		/* directly pass up to layer3 */
+		LOGP(DLLAPD, LOGL_INFO, "fmt=Bbis UI\n");
+		msg->l3h = msg->l2h;
+		msgb_pull_l2h(msg);
+		rc = send_rslms_rll_l3(RSL_MT_UNIT_DATA_IND, &mctx, msg);
+		break;
+	default:
+		msgb_free(msg);
+	}
+
+	return rc;
+}
+
+/* input into layer2 (from layer 1) */
+static int l2_ph_rach_ind(struct lapdm_entity *le, uint8_t ra, uint32_t fn, uint8_t acc_delay)
+{
+	struct abis_rsl_cchan_hdr *ch;
+	struct gsm48_req_ref req_ref;
+	struct gsm_time gt;
+	struct msgb *msg = msgb_alloc_headroom(512, 64, "RSL CHAN RQD");
+
+	msg->l2h = msgb_push(msg, sizeof(*ch));
+	ch = (struct abis_rsl_cchan_hdr *)msg->l2h;
+	rsl_init_cchan_hdr(ch, RSL_MT_CHAN_RQD);
+	ch->chan_nr = RSL_CHAN_RACH;
+
+	/* generate a RSL CHANNEL REQUIRED message */
+	gsm_fn2gsmtime(&gt, fn);
+	req_ref.ra = ra;
+	req_ref.t1 = gt.t1; /* FIXME: modulo? */
+	req_ref.t2 = gt.t2;
+	req_ref.t3_low = gt.t3 & 7;
+	req_ref.t3_high = gt.t3 >> 3;
+
+	msgb_tv_fixed_put(msg, RSL_IE_REQ_REFERENCE, 3, (uint8_t *) &req_ref);
+	msgb_tv_put(msg, RSL_IE_ACCESS_DELAY, acc_delay);
+
+	return rslms_sendmsg(msg, le);
+}
+
+static int l2_ph_chan_conf(struct msgb *msg, struct lapdm_entity *le, uint32_t frame_nr);
+
+/*! \brief Receive a PH-SAP primitive from L1 */
+int lapdm_phsap_up(struct osmo_prim_hdr *oph, struct lapdm_entity *le)
+{
+	struct osmo_phsap_prim *pp = (struct osmo_phsap_prim *) oph;
+	int rc = 0;
+
+	if (oph->sap != SAP_GSM_PH) {
+		LOGP(DLLAPD, LOGL_ERROR, "primitive for unknown SAP %u\n",
+			oph->sap);
+		return -ENODEV;
+	}
+
+	switch (oph->primitive) {
+	case PRIM_PH_DATA:
+		if (oph->operation != PRIM_OP_INDICATION) {
+			LOGP(DLLAPD, LOGL_ERROR, "PH_DATA is not INDICATION %u\n",
+				oph->operation);
+			return -ENODEV;
+		}
+		rc = l2_ph_data_ind(oph->msg, le, pp->u.data.chan_nr,
+				    pp->u.data.link_id);
+		break;
+	case PRIM_PH_RTS:
+		if (oph->operation != PRIM_OP_INDICATION) {
+			LOGP(DLLAPD, LOGL_ERROR, "PH_RTS is not INDICATION %u\n",
+				oph->operation);
+			return -ENODEV;
+		}
+		rc = l2_ph_data_conf(oph->msg, le);
+		break;
+	case PRIM_PH_RACH:
+		switch (oph->operation) {
+		case PRIM_OP_INDICATION:
+			rc = l2_ph_rach_ind(le, pp->u.rach_ind.ra, pp->u.rach_ind.fn,
+					    pp->u.rach_ind.acc_delay);
+			break;
+		case PRIM_OP_CONFIRM:
+			rc = l2_ph_chan_conf(oph->msg, le, pp->u.rach_ind.fn);
+			break;
+		default:
+			return -EIO;
+		}
+		break;
+	}
+
+	return rc;
+}
+
+
+/* L3 -> L2 / RSLMS -> LAPDm */
+
+/* Set LAPDm context for established connection */
+static int set_lapdm_context(struct lapdm_datalink *dl, uint8_t chan_nr,
+	uint8_t link_id, int n201, uint8_t sapi)
+{
+	memset(&dl->mctx, 0, sizeof(dl->mctx));
+	dl->mctx.dl = dl;
+	dl->mctx.chan_nr = chan_nr;
+	dl->mctx.link_id = link_id;
+	dl->dl.lctx.dl = &dl->dl;
+	dl->dl.lctx.n201 = n201;
+	dl->dl.lctx.sapi = sapi;
+
+	return 0;
+}
+
+/* L3 requests establishment of data link */
+static int rslms_rx_rll_est_req(struct msgb *msg, struct lapdm_datalink *dl)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	uint8_t chan_nr = rllh->chan_nr;
+	uint8_t link_id = rllh->link_id;
+	uint8_t sapi = rllh->link_id & 7;
+	struct tlv_parsed tv;
+	uint8_t length;
+	uint8_t n201 = (rllh->link_id & 0x40) ? N201_AB_SACCH : N201_AB_SDCCH;
+	struct osmo_dlsap_prim dp;
+
+	/* Set LAPDm context for established connection */
+	set_lapdm_context(dl, chan_nr, link_id, n201, sapi);
+
+	rsl_tlv_parse(&tv, rllh->data, msgb_l2len(msg) - sizeof(*rllh));
+	if (TLVP_PRESENT(&tv, RSL_IE_L3_INFO)) {
+		msg->l3h = (uint8_t *) TLVP_VAL(&tv, RSL_IE_L3_INFO);
+		/* contention resolution establishment procedure */
+		if (sapi != 0) {
+			/* According to clause 6, the contention resolution
+			 * procedure is only permitted with SAPI value 0 */
+			LOGP(DLLAPD, LOGL_ERROR, "SAPI != 0 but contention"
+				"resolution (discarding)\n");
+			msgb_free(msg);
+			return send_rll_simple(RSL_MT_REL_IND, &dl->mctx);
+		}
+		/* transmit a SABM command with the P bit set to "1". The SABM
+		 * command shall contain the layer 3 message unit */
+		length = TLVP_LEN(&tv, RSL_IE_L3_INFO);
+	} else {
+		/* normal establishment procedure */
+		msg->l3h = msg->l2h + sizeof(*rllh);
+		length = 0;
+	}
+
+	/* check if the layer3 message length exceeds N201 */
+	if (length > n201) {
+		LOGP(DLLAPD, LOGL_ERROR, "frame too large: %d > N201(%d) "
+			"(discarding)\n", length, n201);
+		msgb_free(msg);
+		return send_rll_simple(RSL_MT_REL_IND, &dl->mctx);
+	}
+
+	/* Remove RLL header from msgb and set length to L3-info */
+	msgb_pull_l2h(msg);
+	msg->len = length;
+	msg->tail = msg->l3h + length;
+
+	/* prepare prim */
+	osmo_prim_init(&dp.oph, 0, PRIM_DL_EST, PRIM_OP_REQUEST, msg);
+
+	/* send to L2 */
+	return lapd_recv_dlsap(&dp, &dl->dl.lctx);
+}
+
+/* L3 requests transfer of unnumbered information */
+static int rslms_rx_rll_udata_req(struct msgb *msg, struct lapdm_datalink *dl)
+{
+	struct lapdm_entity *le = dl->entity;
+	int ui_bts = (le->mode == LAPDM_MODE_BTS);
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	uint8_t chan_nr = rllh->chan_nr;
+	uint8_t link_id = rllh->link_id;
+	uint8_t sapi = link_id & 7;
+	struct tlv_parsed tv;
+	int length;
+
+	/* check if the layer3 message length exceeds N201 */
+
+	rsl_tlv_parse(&tv, rllh->data, msgb_l2len(msg)-sizeof(*rllh));
+
+	if (TLVP_PRESENT(&tv, RSL_IE_TIMING_ADVANCE)) {
+		le->ta = *TLVP_VAL(&tv, RSL_IE_TIMING_ADVANCE);
+	}
+	if (TLVP_PRESENT(&tv, RSL_IE_MS_POWER)) {
+		le->tx_power = *TLVP_VAL(&tv, RSL_IE_MS_POWER);
+	}
+	if (!TLVP_PRESENT(&tv, RSL_IE_L3_INFO)) {
+		LOGP(DLLAPD, LOGL_ERROR, "unit data request without message "
+			"error\n");
+		msgb_free(msg);
+		return -EINVAL;
+	}
+	msg->l3h = (uint8_t *) TLVP_VAL(&tv, RSL_IE_L3_INFO);
+	length = TLVP_LEN(&tv, RSL_IE_L3_INFO);
+	/* check if the layer3 message length exceeds N201 */
+	if (length + 4 + !ui_bts > 23) {
+		LOGP(DLLAPD, LOGL_ERROR, "frame too large: %d > N201(%d) "
+			"(discarding)\n", length, 18 + ui_bts);
+		msgb_free(msg);
+		return -EIO;
+	}
+
+	LOGP(DLLAPD, LOGL_INFO, "sending unit data (tx_power=%d, ta=%d)\n",
+		le->tx_power, le->ta);
+
+	/* Remove RLL header from msgb and set length to L3-info */
+	msgb_pull_l2h(msg);
+	msg->len = length;
+	msg->tail = msg->l3h + length;
+
+	/* Push L1 + LAPDm header on msgb */
+	msg->l2h = msgb_push(msg, 4 + !ui_bts);
+	msg->l2h[0] = le->tx_power;
+	msg->l2h[1] = le->ta;
+	msg->l2h[2] = LAPDm_ADDR(LAPDm_LPD_NORMAL, sapi, dl->dl.cr.loc2rem.cmd);
+	msg->l2h[3] = LAPDm_CTRL_U(LAPDm_U_UI, 0);
+	if (!ui_bts)
+		msg->l2h[4] = LAPDm_LEN(length);
+
+	/* Tramsmit */
+	return tx_ph_data_enqueue(dl, msg, chan_nr, link_id, 23);
+}
+
+/* L3 requests transfer of acknowledged information */
+static int rslms_rx_rll_data_req(struct msgb *msg, struct lapdm_datalink *dl)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	struct tlv_parsed tv;
+	int length;
+	struct osmo_dlsap_prim dp;
+
+	rsl_tlv_parse(&tv, rllh->data, msgb_l2len(msg)-sizeof(*rllh));
+	if (!TLVP_PRESENT(&tv, RSL_IE_L3_INFO)) {
+		LOGP(DLLAPD, LOGL_ERROR, "data request without message "
+			"error\n");
+		msgb_free(msg);
+		return -EINVAL;
+	}
+	msg->l3h = (uint8_t *) TLVP_VAL(&tv, RSL_IE_L3_INFO);
+	length = TLVP_LEN(&tv, RSL_IE_L3_INFO);
+
+	/* Remove RLL header from msgb and set length to L3-info */
+	msgb_pull_l2h(msg);
+	msg->len = length;
+	msg->tail = msg->l3h + length;
+
+	/* prepare prim */
+	osmo_prim_init(&dp.oph, 0, PRIM_DL_DATA, PRIM_OP_REQUEST, msg);
+
+	/* send to L2 */
+	return lapd_recv_dlsap(&dp, &dl->dl.lctx);
+}
+
+/* L3 requests suspension of data link */
+static int rslms_rx_rll_susp_req(struct msgb *msg, struct lapdm_datalink *dl)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	uint8_t sapi = rllh->link_id & 7;
+	struct osmo_dlsap_prim dp;
+
+	if (sapi != 0) {
+		LOGP(DLLAPD, LOGL_ERROR, "SAPI != 0 while suspending\n");
+		msgb_free(msg);
+		return -EINVAL;
+	}
+
+	/* prepare prim */
+	osmo_prim_init(&dp.oph, 0, PRIM_DL_SUSP, PRIM_OP_REQUEST, msg);
+
+	/* send to L2 */
+	return lapd_recv_dlsap(&dp, &dl->dl.lctx);
+}
+
+/* L3 requests resume of data link */
+static int rslms_rx_rll_res_req(struct msgb *msg, struct lapdm_datalink *dl)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	int msg_type = rllh->c.msg_type;
+	uint8_t chan_nr = rllh->chan_nr;
+	uint8_t link_id = rllh->link_id;
+	uint8_t sapi = rllh->link_id & 7;
+	struct tlv_parsed tv;
+	uint8_t length;
+	uint8_t n201 = (rllh->link_id & 0x40) ? N201_AB_SACCH : N201_AB_SDCCH;
+	struct osmo_dlsap_prim dp;
+
+	/* Set LAPDm context for established connection */
+	set_lapdm_context(dl, chan_nr, link_id, n201, sapi);
+
+	rsl_tlv_parse(&tv, rllh->data, msgb_l2len(msg)-sizeof(*rllh));
+	if (!TLVP_PRESENT(&tv, RSL_IE_L3_INFO)) {
+		LOGP(DLLAPD, LOGL_ERROR, "resume without message error\n");
+		msgb_free(msg);
+		return send_rll_simple(RSL_MT_REL_IND, &dl->mctx);
+	}
+	msg->l3h = (uint8_t *) TLVP_VAL(&tv, RSL_IE_L3_INFO);
+	length = TLVP_LEN(&tv, RSL_IE_L3_INFO);
+
+	/* Remove RLL header from msgb and set length to L3-info */
+	msgb_pull_l2h(msg);
+	msg->len = length;
+	msg->tail = msg->l3h + length;
+
+	/* prepare prim */
+	osmo_prim_init(&dp.oph, 0, (msg_type == RSL_MT_RES_REQ) ? PRIM_DL_RES
+		: PRIM_DL_RECON, PRIM_OP_REQUEST, msg);
+
+	/* send to L2 */
+	return lapd_recv_dlsap(&dp, &dl->dl.lctx);
+}
+
+/* L3 requests release of data link */
+static int rslms_rx_rll_rel_req(struct msgb *msg, struct lapdm_datalink *dl)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	uint8_t mode = 0;
+	struct osmo_dlsap_prim dp;
+
+	/* get release mode */
+	if (rllh->data[0] == RSL_IE_RELEASE_MODE)
+		mode = rllh->data[1] & 1;
+
+	/* Pull rllh */
+	msgb_pull_l2h(msg);
+
+	/* 04.06 3.8.3: No information field is permitted with the DISC
+	 * command. */
+	msg->len = 0;
+	msg->tail = msg->l3h = msg->data;
+
+	/* prepare prim */
+	osmo_prim_init(&dp.oph, 0, PRIM_DL_REL, PRIM_OP_REQUEST, msg);
+	dp.u.rel_req.mode = mode;
+
+	/* send to L2 */
+	return lapd_recv_dlsap(&dp, &dl->dl.lctx);
+}
+
+/* L3 requests channel in idle state */
+static int rslms_rx_chan_rqd(struct lapdm_channel *lc, struct msgb *msg)
+{
+	struct abis_rsl_cchan_hdr *cch = msgb_l2(msg);
+	void *l1ctx = lc->lapdm_dcch.l1_ctx;
+	struct osmo_phsap_prim pp;
+
+	osmo_prim_init(&pp.oph, SAP_GSM_PH, PRIM_PH_RACH,
+			PRIM_OP_REQUEST, NULL);
+
+	if (msgb_l2len(msg) < sizeof(*cch) + 4 + 2 + 2) {
+		LOGP(DLLAPD, LOGL_ERROR, "Message too short for CHAN RQD!\n");
+		return -EINVAL;
+	}
+	if (cch->data[0] != RSL_IE_REQ_REFERENCE) {
+		LOGP(DLLAPD, LOGL_ERROR, "Missing REQ REFERENCE IE\n");
+		return -EINVAL;
+	}
+	pp.u.rach_req.ra = cch->data[1];
+	pp.u.rach_req.offset = ((cch->data[2] & 0x7f) << 8) | cch->data[3];
+	pp.u.rach_req.is_combined_ccch = cch->data[2] >> 7;
+
+	if (cch->data[4] != RSL_IE_ACCESS_DELAY) {
+		LOGP(DLLAPD, LOGL_ERROR, "Missing ACCESS_DELAY IE\n");
+		return -EINVAL;
+	}
+	/* TA = 0 - delay */
+	pp.u.rach_req.ta = 0 - cch->data[5];
+
+	if (cch->data[6] != RSL_IE_MS_POWER) {
+		LOGP(DLLAPD, LOGL_ERROR, "Missing MS POWER IE\n");
+		return -EINVAL;
+	}
+	pp.u.rach_req.tx_power = cch->data[7];
+
+	msgb_free(msg);
+
+	return lc->lapdm_dcch.l1_prim_cb(&pp.oph, l1ctx);
+}
+
+/* L1 confirms channel request */
+static int l2_ph_chan_conf(struct msgb *msg, struct lapdm_entity *le, uint32_t frame_nr)
+{
+	struct abis_rsl_cchan_hdr *ch;
+	struct gsm_time tm;
+	struct gsm48_req_ref *ref;
+
+	gsm_fn2gsmtime(&tm, frame_nr);
+
+	msgb_pull_l2h(msg);
+	msg->l2h = msgb_push(msg, sizeof(*ch) + sizeof(*ref));
+	ch = (struct abis_rsl_cchan_hdr *)msg->l2h;
+	rsl_init_cchan_hdr(ch, RSL_MT_CHAN_CONF);
+	ch->chan_nr = RSL_CHAN_RACH;
+	ch->data[0] = RSL_IE_REQ_REFERENCE;
+	ref = (struct gsm48_req_ref *) (ch->data + 1);
+	ref->t1 = tm.t1;
+	ref->t2 = tm.t2;
+	ref->t3_low = tm.t3 & 0x7;
+	ref->t3_high = tm.t3 >> 3;
+	
+	return rslms_sendmsg(msg, le);
+}
+
+/* incoming RSLms RLL message from L3 */
+static int rslms_rx_rll(struct msgb *msg, struct lapdm_channel *lc)
+{
+	struct abis_rsl_rll_hdr *rllh = msgb_l2(msg);
+	int msg_type = rllh->c.msg_type;
+	uint8_t sapi = rllh->link_id & 7;
+	struct lapdm_entity *le;
+	struct lapdm_datalink *dl;
+	int rc = 0;
+
+	if (msgb_l2len(msg) < sizeof(*rllh)) {
+		LOGP(DLLAPD, LOGL_ERROR, "Message too short for RLL hdr!\n");
+		msgb_free(msg);
+		return -EINVAL;
+	}
+
+	if (rllh->link_id & 0x40)
+		le = &lc->lapdm_acch;
+	else
+		le = &lc->lapdm_dcch;
+
+	/* G.2.1 No action schall be taken on frames containing an unallocated
+	 * SAPI.
+	 */
+	dl = datalink_for_sapi(le, sapi);
+	if (!dl) {
+		LOGP(DLLAPD, LOGL_ERROR, "No instance for SAPI %d!\n", sapi);
+		msgb_free(msg);
+		return -EINVAL;
+	}
+
+	LOGP(DLLAPD, LOGL_INFO, "(%p) RLL Message '%s' received. (sapi %d)\n",
+		lc->name, rsl_msg_name(msg_type), sapi);
+
+	switch (msg_type) {
+	case RSL_MT_UNIT_DATA_REQ:
+		rc = rslms_rx_rll_udata_req(msg, dl);
+		break;
+	case RSL_MT_EST_REQ:
+		rc = rslms_rx_rll_est_req(msg, dl);
+		break;
+	case RSL_MT_DATA_REQ:
+		rc = rslms_rx_rll_data_req(msg, dl);
+		break;
+	case RSL_MT_SUSP_REQ:
+		rc = rslms_rx_rll_susp_req(msg, dl);
+		break;
+	case RSL_MT_RES_REQ:
+		rc = rslms_rx_rll_res_req(msg, dl);
+		break;
+	case RSL_MT_RECON_REQ:
+		rc = rslms_rx_rll_res_req(msg, dl);
+		break;
+	case RSL_MT_REL_REQ:
+		rc = rslms_rx_rll_rel_req(msg, dl);
+		break;
+	default:
+		LOGP(DLLAPD, LOGL_NOTICE, "Message unsupported.\n");
+		msgb_free(msg);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+/* incoming RSLms COMMON CHANNEL message from L3 */
+static int rslms_rx_com_chan(struct msgb *msg, struct lapdm_channel *lc)
+{
+	struct abis_rsl_cchan_hdr *cch = msgb_l2(msg);
+	int msg_type = cch->c.msg_type;
+	int rc = 0;
+
+	if (msgb_l2len(msg) < sizeof(*cch)) {
+		LOGP(DLLAPD, LOGL_ERROR, "Message too short for COM CHAN hdr!\n");
+		return -EINVAL;
+	}
+
+	switch (msg_type) {
+	case RSL_MT_CHAN_RQD:
+		/* create and send RACH request */
+		rc = rslms_rx_chan_rqd(lc, msg);
+		break;
+	default:
+		LOGP(DLLAPD, LOGL_NOTICE, "Unknown COMMON CHANNEL msg %d!\n",
+			msg_type);
+		msgb_free(msg);
+		return 0;
+	}
+
+	return rc;
+}
+
+/*! \brief Receive a RSLms \ref msgb from Layer 3 */
+int lapdm_rslms_recvmsg(struct msgb *msg, struct lapdm_channel *lc)
+{
+	struct abis_rsl_common_hdr *rslh = msgb_l2(msg);
+	int rc = 0;
+
+	if (msgb_l2len(msg) < sizeof(*rslh)) {
+		LOGP(DLLAPD, LOGL_ERROR, "Message too short RSL hdr!\n");
+		return -EINVAL;
+	}
+
+	switch (rslh->msg_discr & 0xfe) {
+	case ABIS_RSL_MDISC_RLL:
+		rc = rslms_rx_rll(msg, lc);
+		break;
+	case ABIS_RSL_MDISC_COM_CHAN:
+		rc = rslms_rx_com_chan(msg, lc);
+		break;
+	default:
+		LOGP(DLLAPD, LOGL_ERROR, "unknown RSLms message "
+			"discriminator 0x%02x", rslh->msg_discr);
+		msgb_free(msg);
+		return -EINVAL;
+	}
+
+	return rc;
+}
+
+/*! \brief Set the \ref lapdm_mode of a LAPDm entity */
+int lapdm_entity_set_mode(struct lapdm_entity *le, enum lapdm_mode mode)
+{
+	int i;
+	enum lapd_mode lm;
+
+	switch (mode) {
+	case LAPDM_MODE_MS:
+		lm = LAPD_MODE_USER;
+		break;
+	case LAPDM_MODE_BTS:
+		lm = LAPD_MODE_NETWORK;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(le->datalink); i++) {
+		lapd_set_mode(&le->datalink[i].dl, lm);
+	}
+
+	le->mode = mode;
+
+	return 0;
+}
+
+/*! \brief Set the \ref lapdm_mode of a LAPDm channel*/
+int lapdm_channel_set_mode(struct lapdm_channel *lc, enum lapdm_mode mode)
+{
+	int rc;
+
+	rc = lapdm_entity_set_mode(&lc->lapdm_dcch, mode);
+	if (rc < 0)
+		return rc;
+
+	return lapdm_entity_set_mode(&lc->lapdm_acch, mode);
+}
+
+/*! \brief Set the L1 callback and context of a LAPDm channel */
+void lapdm_channel_set_l1(struct lapdm_channel *lc, osmo_prim_cb cb, void *ctx)
+{
+	lc->lapdm_dcch.l1_prim_cb = cb;
+	lc->lapdm_acch.l1_prim_cb = cb;
+	lc->lapdm_dcch.l1_ctx = ctx;
+	lc->lapdm_acch.l1_ctx = ctx;
+}
+
+/*! \brief Set the L3 callback and context of a LAPDm channel */
+void lapdm_channel_set_l3(struct lapdm_channel *lc, lapdm_cb_t cb, void *ctx)
+{
+	lc->lapdm_dcch.l3_cb = cb;
+	lc->lapdm_acch.l3_cb = cb;
+	lc->lapdm_dcch.l3_ctx = ctx;
+	lc->lapdm_acch.l3_ctx = ctx;
+}
+
+/*! \brief Reset an entire LAPDm entity and all its datalinks */
+void lapdm_entity_reset(struct lapdm_entity *le)
+{
+	struct lapdm_datalink *dl;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(le->datalink); i++) {
+		dl = &le->datalink[i];
+		lapd_dl_reset(&dl->dl);
+	}
+}
+
+/*! \brief Reset a LAPDm channel with all its entities */
+void lapdm_channel_reset(struct lapdm_channel *lc)
+{
+	lapdm_entity_reset(&lc->lapdm_dcch);
+	lapdm_entity_reset(&lc->lapdm_acch);
+}
+
+/*! \brief Set the flags of a LAPDm entity */
+void lapdm_entity_set_flags(struct lapdm_entity *le, unsigned int flags)
+{
+	le->flags = flags;
+}
+
+/*! \brief Set the flags of all LAPDm entities in a LAPDm channel */
+void lapdm_channel_set_flags(struct lapdm_channel *lc, unsigned int flags)
+{
+	lapdm_entity_set_flags(&lc->lapdm_dcch, flags);
+	lapdm_entity_set_flags(&lc->lapdm_acch, flags);
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsm/libosmogsm.map b/src/shared/libosmocore/src/gsm/libosmogsm.map
new file mode 100644
index 00000000..33738881
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/libosmogsm.map
@@ -0,0 +1,236 @@
+LIBOSMOGSM_1.0 {
+global:
+
+abis_nm_adm_state_names;
+abis_nm_att_settable;
+abis_nm_avail_name;
+abis_nm_chcomb4pchan;
+abis_nm_debugp_foh;
+abis_nm_event_type_name;
+abis_nm_nack_cause_name;
+abis_nm_nack_name;
+abis_nm_att_tlvdef;
+abis_nm_obj_class_names;
+abis_nm_opstate_name;
+abis_nm_nacks;
+abis_nm_no_ack_nack;
+abis_nm_pchan4chcomb;
+abis_nm_reports;
+abis_nm_severity_name;
+abis_nm_sw_load_msgs;
+abis_nm_test_name;
+
+osmo_sitype_strs;
+
+comp128;
+dbm2rxlev;
+
+gprs_cipher_gen_input_i;
+gprs_cipher_gen_input_ui;
+gprs_cipher_load;
+gprs_cipher_register;
+gprs_cipher_run;
+gprs_cipher_supported;
+gprs_tlli_type;
+gprs_tmsi2tlli;
+
+gsm0480_create_notifySS;
+gsm0480_create_unstructuredSS_Notify;
+gsm0480_create_ussd_resp;
+gsm0480_decode_ussd_request;
+gsm0480_wrap_facility;
+gsm0480_wrap_invoke;
+
+gsm0502_calc_paging_group;
+
+gsm0808_att_tlvdef;
+gsm0808_bssap_name;
+gsm0808_bssmap_name;
+gsm0808_create_assignment_completed;
+gsm0808_create_assignment_failure;
+gsm0808_create_cipher_complete;
+gsm0808_create_cipher_reject;
+gsm0808_create_classmark_update;
+gsm0808_create_clear_command;
+gsm0808_create_clear_complete;
+gsm0808_create_clear_rqst;
+gsm0808_create_dtap;
+gsm0808_create_layer3;
+gsm0808_create_reset;
+gsm0808_create_sapi_reject;
+gsm0808_prepend_dtap_header;
+
+gsm338_get_sms_alphabet;
+
+gsm340_gen_oa;
+gsm340_gen_scts;
+gsm340_scts;
+gsm340_validity_period;
+
+gsm411_bcdify;
+gsm411_msgb_alloc;
+gsm411_push_cp_header;
+gsm411_push_rp_header;
+gsm411_smc_clear;
+gsm411_smc_init;
+gsm411_smc_recv;
+gsm411_smc_send;
+gsm411_smr_clear;
+gsm411_smr_init;
+gsm411_smr_recv;
+gsm411_smr_send;
+gsm411_unbcdify;
+gsm411_cp_cause_strs;
+gsm411_rp_cause_strs;
+
+gsm48_att_tlvdef;
+gsm48_cc_msg_name;
+gsm48_cc_state_name;
+gsm48_construct_ra;
+gsm48_decode_bcd_number;
+gsm48_decode_bearer_cap;
+gsm48_decode_called;
+gsm48_decode_callerid;
+gsm48_decode_calling;
+gsm48_decode_cause;
+gsm48_decode_cccap;
+gsm48_decode_connected;
+gsm48_decode_facility;
+gsm48_decode_freq_list;
+gsm48_decode_keypad;
+gsm48_decode_lai;
+gsm48_decode_notify;
+gsm48_decode_progress;
+gsm48_decode_redirecting;
+gsm48_decode_signal;
+gsm48_decode_ssversion;
+gsm48_decode_useruser;
+gsm48_encode_bcd_number;
+gsm48_encode_bearer_cap;
+gsm48_encode_called;
+gsm48_encode_callerid;
+gsm48_encode_calling;
+gsm48_encode_cause;
+gsm48_encode_cccap;
+gsm48_encode_connected;
+gsm48_encode_facility;
+gsm48_encode_keypad;
+gsm48_encode_more;
+gsm48_encode_notify;
+gsm48_encode_progress;
+gsm48_encode_redirecting;
+gsm48_encode_signal;
+gsm48_encode_ssversion;
+gsm48_encode_useruser;
+gsm48_generate_lai;
+gsm48_generate_mid_from_imsi;
+gsm48_generate_mid_from_tmsi;
+gsm48_mi_to_string;
+gsm48_mm_att_tlvdef;
+gsm48_number_of_paging_subchannels;
+gsm48_parse_ra;
+gsm48_rr_att_tlvdef;
+
+gsm_7bit_decode;
+gsm_7bit_decode_hdr;
+gsm_7bit_encode;
+
+gsm_arfcn2band;
+gsm_arfcn2freq10;
+gsm_band_name;
+gsm_band_parse;
+gsm_fn2gsmtime;
+gsm_get_octet_len;
+gsm_gsmtime2fn;
+
+gsm_milenage;
+gsm_septet_encode;
+gsm_septets2octets;
+
+lapd_dl_exit;
+lapd_dl_init;
+lapd_dl_reset;
+lapd_msgb_alloc;
+lapd_ph_data_ind;
+lapd_recv_dlsap;
+lapd_set_mode;
+lapd_state_names;
+
+lapdm_channel_exit;
+lapdm_channel_init;
+lapdm_channel_reset;
+lapdm_channel_set_flags;
+lapdm_channel_set_l1;
+lapdm_channel_set_l3;
+lapdm_channel_set_mode;
+lapdm_entity_exit;
+lapdm_entity_init;
+lapdm_entity_reset;
+lapdm_entity_set_flags;
+lapdm_entity_set_mode;
+lapdm_phsap_dequeue_prim;
+lapdm_phsap_up;
+lapdm_rslms_recvmsg;
+
+milenage_auts;
+milenage_check;
+milenage_f1;
+milenage_f2345;
+milenage_generate;
+milenage_opc_gen;
+
+ms_class_gmsk_dbm;
+ms_pwr_ctl_lvl;
+ms_pwr_dbm;
+
+osmo_a5;
+osmo_a5_1;
+osmo_a5_2;
+
+osmo_auth_alg_name;
+osmo_auth_alg_parse;
+osmo_auth_gen_vec;
+osmo_auth_gen_vec_auts;
+osmo_auth_load;
+osmo_auth_register;
+osmo_auth_supported;
+
+osmo_rsl2sitype;
+osmo_sitype2rsl;
+
+rr_cause_name;
+
+rsl_att_tlvdef;
+rsl_ccch_conf_to_bs_cc_chans;
+rsl_ccch_conf_to_bs_ccch_sdcch_comb;
+rsl_chan_nr_str;
+rsl_dec_chan_nr;
+rsl_enc_chan_nr;
+rsl_err_name;
+rsl_init_cchan_hdr;
+rsl_init_rll_hdr;
+rsl_ipac_msg_name;
+rsl_msg_name;
+rsl_rll_push_hdr;
+rsl_rll_push_l3;
+rsl_rll_simple;
+rsl_rlm_cause_name;
+
+rxlev2dbm;
+rxlev_stat_dump;
+rxlev_stat_get_next;
+rxlev_stat_input;
+rxlev_stat_reset;
+
+tlv_def_patch;
+tlv_dump;
+tlv_parse;
+tlv_parse_one;
+tvlv_att_def;
+vtvlv_gan_att_def;
+
+gan_msgt_vals;
+gan_pdisc_vals;
+
+local: *;
+};
diff --git a/src/shared/libosmocore/src/gsm/milenage/aes-encblock.c b/src/shared/libosmocore/src/gsm/milenage/aes-encblock.c
new file mode 100644
index 00000000..8f35caa2
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/aes-encblock.c
@@ -0,0 +1,38 @@
+/*
+ * AES encrypt_block
+ *
+ * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ */
+
+#include "includes.h"
+
+#include "common.h"
+#include "aes.h"
+#include "aes_wrap.h"
+
+/**
+ * aes_128_encrypt_block - Perform one AES 128-bit block operation
+ * @key: Key for AES
+ * @in: Input data (16 bytes)
+ * @out: Output of the AES block operation (16 bytes)
+ * Returns: 0 on success, -1 on failure
+ */
+int aes_128_encrypt_block(const u8 *key, const u8 *in, u8 *out)
+{
+	void *ctx;
+	ctx = aes_encrypt_init(key, 16);
+	if (ctx == NULL)
+		return -1;
+	aes_encrypt(ctx, in, out);
+	aes_encrypt_deinit(ctx);
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/gsm/milenage/aes-internal-enc.c b/src/shared/libosmocore/src/gsm/milenage/aes-internal-enc.c
new file mode 100644
index 00000000..8726aa72
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/aes-internal-enc.c
@@ -0,0 +1,121 @@
+/*
+ * AES (Rijndael) cipher - encrypt
+ *
+ * Modifications to public domain implementation:
+ * - support only 128-bit keys
+ * - cleanup
+ * - use C pre-processor to make it easier to change S table access
+ * - added option (AES_SMALL_TABLES) for reducing code size by about 8 kB at
+ *   cost of reduced throughput (quite small difference on Pentium 4,
+ *   10-25% when using -O1 or -O2 optimization)
+ *
+ * Copyright (c) 2003-2005, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ */
+
+#include "includes.h"
+
+#include "common.h"
+#include "crypto.h"
+#include "aes_i.h"
+
+static void rijndaelEncrypt(const u32 rk[/*44*/], const u8 pt[16], u8 ct[16])
+{
+	u32 s0, s1, s2, s3, t0, t1, t2, t3;
+	const int Nr = 10;
+#ifndef FULL_UNROLL
+	int r;
+#endif /* ?FULL_UNROLL */
+
+	/*
+	 * map byte array block to cipher state
+	 * and add initial round key:
+	 */
+	s0 = GETU32(pt     ) ^ rk[0];
+	s1 = GETU32(pt +  4) ^ rk[1];
+	s2 = GETU32(pt +  8) ^ rk[2];
+	s3 = GETU32(pt + 12) ^ rk[3];
+
+#define ROUND(i,d,s) \
+d##0 = TE0(s##0) ^ TE1(s##1) ^ TE2(s##2) ^ TE3(s##3) ^ rk[4 * i]; \
+d##1 = TE0(s##1) ^ TE1(s##2) ^ TE2(s##3) ^ TE3(s##0) ^ rk[4 * i + 1]; \
+d##2 = TE0(s##2) ^ TE1(s##3) ^ TE2(s##0) ^ TE3(s##1) ^ rk[4 * i + 2]; \
+d##3 = TE0(s##3) ^ TE1(s##0) ^ TE2(s##1) ^ TE3(s##2) ^ rk[4 * i + 3]
+
+#ifdef FULL_UNROLL
+
+	ROUND(1,t,s);
+	ROUND(2,s,t);
+	ROUND(3,t,s);
+	ROUND(4,s,t);
+	ROUND(5,t,s);
+	ROUND(6,s,t);
+	ROUND(7,t,s);
+	ROUND(8,s,t);
+	ROUND(9,t,s);
+
+	rk += Nr << 2;
+
+#else  /* !FULL_UNROLL */
+
+	/* Nr - 1 full rounds: */
+	r = Nr >> 1;
+	for (;;) {
+		ROUND(1,t,s);
+		rk += 8;
+		if (--r == 0)
+			break;
+		ROUND(0,s,t);
+	}
+
+#endif /* ?FULL_UNROLL */
+
+#undef ROUND
+
+	/*
+	 * apply last round and
+	 * map cipher state to byte array block:
+	 */
+	s0 = TE41(t0) ^ TE42(t1) ^ TE43(t2) ^ TE44(t3) ^ rk[0];
+	PUTU32(ct     , s0);
+	s1 = TE41(t1) ^ TE42(t2) ^ TE43(t3) ^ TE44(t0) ^ rk[1];
+	PUTU32(ct +  4, s1);
+	s2 = TE41(t2) ^ TE42(t3) ^ TE43(t0) ^ TE44(t1) ^ rk[2];
+	PUTU32(ct +  8, s2);
+	s3 = TE41(t3) ^ TE42(t0) ^ TE43(t1) ^ TE44(t2) ^ rk[3];
+	PUTU32(ct + 12, s3);
+}
+
+
+void * aes_encrypt_init(const u8 *key, size_t len)
+{
+	u32 *rk;
+	if (len != 16)
+		return NULL;
+	rk = os_malloc(AES_PRIV_SIZE);
+	if (rk == NULL)
+		return NULL;
+	rijndaelKeySetupEnc(rk, key);
+	return rk;
+}
+
+
+void aes_encrypt(void *ctx, const u8 *plain, u8 *crypt)
+{
+	rijndaelEncrypt(ctx, plain, crypt);
+}
+
+
+void aes_encrypt_deinit(void *ctx)
+{
+	os_memset(ctx, 0, AES_PRIV_SIZE);
+	os_free(ctx);
+}
diff --git a/src/shared/libosmocore/src/gsm/milenage/aes-internal.c b/src/shared/libosmocore/src/gsm/milenage/aes-internal.c
new file mode 100644
index 00000000..41612202
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/aes-internal.c
@@ -0,0 +1,805 @@
+/*
+ * AES (Rijndael) cipher
+ *
+ * Modifications to public domain implementation:
+ * - support only 128-bit keys
+ * - cleanup
+ * - use C pre-processor to make it easier to change S table access
+ * - added option (AES_SMALL_TABLES) for reducing code size by about 8 kB at
+ *   cost of reduced throughput (quite small difference on Pentium 4,
+ *   10-25% when using -O1 or -O2 optimization)
+ *
+ * Copyright (c) 2003-2005, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ */
+
+#include "includes.h"
+
+#include "common.h"
+#include "crypto.h"
+#include "aes_i.h"
+
+/*
+ * rijndael-alg-fst.c
+ *
+ * @version 3.0 (December 2000)
+ *
+ * Optimised ANSI C code for the Rijndael cipher (now AES)
+ *
+ * @author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be>
+ * @author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be>
+ * @author Paulo Barreto <paulo.barreto@terra.com.br>
+ *
+ * This code is hereby placed in the public domain.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
+ * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+ * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+/*
+Te0[x] = S [x].[02, 01, 01, 03];
+Te1[x] = S [x].[03, 02, 01, 01];
+Te2[x] = S [x].[01, 03, 02, 01];
+Te3[x] = S [x].[01, 01, 03, 02];
+Te4[x] = S [x].[01, 01, 01, 01];
+
+Td0[x] = Si[x].[0e, 09, 0d, 0b];
+Td1[x] = Si[x].[0b, 0e, 09, 0d];
+Td2[x] = Si[x].[0d, 0b, 0e, 09];
+Td3[x] = Si[x].[09, 0d, 0b, 0e];
+Td4[x] = Si[x].[01, 01, 01, 01];
+*/
+
+const u32 Te0[256] = {
+    0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
+    0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
+    0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
+    0xe7fefe19U, 0xb5d7d762U, 0x4dababe6U, 0xec76769aU,
+    0x8fcaca45U, 0x1f82829dU, 0x89c9c940U, 0xfa7d7d87U,
+    0xeffafa15U, 0xb25959ebU, 0x8e4747c9U, 0xfbf0f00bU,
+    0x41adadecU, 0xb3d4d467U, 0x5fa2a2fdU, 0x45afafeaU,
+    0x239c9cbfU, 0x53a4a4f7U, 0xe4727296U, 0x9bc0c05bU,
+    0x75b7b7c2U, 0xe1fdfd1cU, 0x3d9393aeU, 0x4c26266aU,
+    0x6c36365aU, 0x7e3f3f41U, 0xf5f7f702U, 0x83cccc4fU,
+    0x6834345cU, 0x51a5a5f4U, 0xd1e5e534U, 0xf9f1f108U,
+    0xe2717193U, 0xabd8d873U, 0x62313153U, 0x2a15153fU,
+    0x0804040cU, 0x95c7c752U, 0x46232365U, 0x9dc3c35eU,
+    0x30181828U, 0x379696a1U, 0x0a05050fU, 0x2f9a9ab5U,
+    0x0e070709U, 0x24121236U, 0x1b80809bU, 0xdfe2e23dU,
+    0xcdebeb26U, 0x4e272769U, 0x7fb2b2cdU, 0xea75759fU,
+    0x1209091bU, 0x1d83839eU, 0x582c2c74U, 0x341a1a2eU,
+    0x361b1b2dU, 0xdc6e6eb2U, 0xb45a5aeeU, 0x5ba0a0fbU,
+    0xa45252f6U, 0x763b3b4dU, 0xb7d6d661U, 0x7db3b3ceU,
+    0x5229297bU, 0xdde3e33eU, 0x5e2f2f71U, 0x13848497U,
+    0xa65353f5U, 0xb9d1d168U, 0x00000000U, 0xc1eded2cU,
+    0x40202060U, 0xe3fcfc1fU, 0x79b1b1c8U, 0xb65b5bedU,
+    0xd46a6abeU, 0x8dcbcb46U, 0x67bebed9U, 0x7239394bU,
+    0x944a4adeU, 0x984c4cd4U, 0xb05858e8U, 0x85cfcf4aU,
+    0xbbd0d06bU, 0xc5efef2aU, 0x4faaaae5U, 0xedfbfb16U,
+    0x864343c5U, 0x9a4d4dd7U, 0x66333355U, 0x11858594U,
+    0x8a4545cfU, 0xe9f9f910U, 0x04020206U, 0xfe7f7f81U,
+    0xa05050f0U, 0x783c3c44U, 0x259f9fbaU, 0x4ba8a8e3U,
+    0xa25151f3U, 0x5da3a3feU, 0x804040c0U, 0x058f8f8aU,
+    0x3f9292adU, 0x219d9dbcU, 0x70383848U, 0xf1f5f504U,
+    0x63bcbcdfU, 0x77b6b6c1U, 0xafdada75U, 0x42212163U,
+    0x20101030U, 0xe5ffff1aU, 0xfdf3f30eU, 0xbfd2d26dU,
+    0x81cdcd4cU, 0x180c0c14U, 0x26131335U, 0xc3ecec2fU,
+    0xbe5f5fe1U, 0x359797a2U, 0x884444ccU, 0x2e171739U,
+    0x93c4c457U, 0x55a7a7f2U, 0xfc7e7e82U, 0x7a3d3d47U,
+    0xc86464acU, 0xba5d5de7U, 0x3219192bU, 0xe6737395U,
+    0xc06060a0U, 0x19818198U, 0x9e4f4fd1U, 0xa3dcdc7fU,
+    0x44222266U, 0x542a2a7eU, 0x3b9090abU, 0x0b888883U,
+    0x8c4646caU, 0xc7eeee29U, 0x6bb8b8d3U, 0x2814143cU,
+    0xa7dede79U, 0xbc5e5ee2U, 0x160b0b1dU, 0xaddbdb76U,
+    0xdbe0e03bU, 0x64323256U, 0x743a3a4eU, 0x140a0a1eU,
+    0x924949dbU, 0x0c06060aU, 0x4824246cU, 0xb85c5ce4U,
+    0x9fc2c25dU, 0xbdd3d36eU, 0x43acacefU, 0xc46262a6U,
+    0x399191a8U, 0x319595a4U, 0xd3e4e437U, 0xf279798bU,
+    0xd5e7e732U, 0x8bc8c843U, 0x6e373759U, 0xda6d6db7U,
+    0x018d8d8cU, 0xb1d5d564U, 0x9c4e4ed2U, 0x49a9a9e0U,
+    0xd86c6cb4U, 0xac5656faU, 0xf3f4f407U, 0xcfeaea25U,
+    0xca6565afU, 0xf47a7a8eU, 0x47aeaee9U, 0x10080818U,
+    0x6fbabad5U, 0xf0787888U, 0x4a25256fU, 0x5c2e2e72U,
+    0x381c1c24U, 0x57a6a6f1U, 0x73b4b4c7U, 0x97c6c651U,
+    0xcbe8e823U, 0xa1dddd7cU, 0xe874749cU, 0x3e1f1f21U,
+    0x964b4bddU, 0x61bdbddcU, 0x0d8b8b86U, 0x0f8a8a85U,
+    0xe0707090U, 0x7c3e3e42U, 0x71b5b5c4U, 0xcc6666aaU,
+    0x904848d8U, 0x06030305U, 0xf7f6f601U, 0x1c0e0e12U,
+    0xc26161a3U, 0x6a35355fU, 0xae5757f9U, 0x69b9b9d0U,
+    0x17868691U, 0x99c1c158U, 0x3a1d1d27U, 0x279e9eb9U,
+    0xd9e1e138U, 0xebf8f813U, 0x2b9898b3U, 0x22111133U,
+    0xd26969bbU, 0xa9d9d970U, 0x078e8e89U, 0x339494a7U,
+    0x2d9b9bb6U, 0x3c1e1e22U, 0x15878792U, 0xc9e9e920U,
+    0x87cece49U, 0xaa5555ffU, 0x50282878U, 0xa5dfdf7aU,
+    0x038c8c8fU, 0x59a1a1f8U, 0x09898980U, 0x1a0d0d17U,
+    0x65bfbfdaU, 0xd7e6e631U, 0x844242c6U, 0xd06868b8U,
+    0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U,
+    0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU,
+};
+#ifndef AES_SMALL_TABLES
+const u32 Te1[256] = {
+    0xa5c66363U, 0x84f87c7cU, 0x99ee7777U, 0x8df67b7bU,
+    0x0dfff2f2U, 0xbdd66b6bU, 0xb1de6f6fU, 0x5491c5c5U,
+    0x50603030U, 0x03020101U, 0xa9ce6767U, 0x7d562b2bU,
+    0x19e7fefeU, 0x62b5d7d7U, 0xe64dababU, 0x9aec7676U,
+    0x458fcacaU, 0x9d1f8282U, 0x4089c9c9U, 0x87fa7d7dU,
+    0x15effafaU, 0xebb25959U, 0xc98e4747U, 0x0bfbf0f0U,
+    0xec41adadU, 0x67b3d4d4U, 0xfd5fa2a2U, 0xea45afafU,
+    0xbf239c9cU, 0xf753a4a4U, 0x96e47272U, 0x5b9bc0c0U,
+    0xc275b7b7U, 0x1ce1fdfdU, 0xae3d9393U, 0x6a4c2626U,
+    0x5a6c3636U, 0x417e3f3fU, 0x02f5f7f7U, 0x4f83ccccU,
+    0x5c683434U, 0xf451a5a5U, 0x34d1e5e5U, 0x08f9f1f1U,
+    0x93e27171U, 0x73abd8d8U, 0x53623131U, 0x3f2a1515U,
+    0x0c080404U, 0x5295c7c7U, 0x65462323U, 0x5e9dc3c3U,
+    0x28301818U, 0xa1379696U, 0x0f0a0505U, 0xb52f9a9aU,
+    0x090e0707U, 0x36241212U, 0x9b1b8080U, 0x3ddfe2e2U,
+    0x26cdebebU, 0x694e2727U, 0xcd7fb2b2U, 0x9fea7575U,
+    0x1b120909U, 0x9e1d8383U, 0x74582c2cU, 0x2e341a1aU,
+    0x2d361b1bU, 0xb2dc6e6eU, 0xeeb45a5aU, 0xfb5ba0a0U,
+    0xf6a45252U, 0x4d763b3bU, 0x61b7d6d6U, 0xce7db3b3U,
+    0x7b522929U, 0x3edde3e3U, 0x715e2f2fU, 0x97138484U,
+    0xf5a65353U, 0x68b9d1d1U, 0x00000000U, 0x2cc1ededU,
+    0x60402020U, 0x1fe3fcfcU, 0xc879b1b1U, 0xedb65b5bU,
+    0xbed46a6aU, 0x468dcbcbU, 0xd967bebeU, 0x4b723939U,
+    0xde944a4aU, 0xd4984c4cU, 0xe8b05858U, 0x4a85cfcfU,
+    0x6bbbd0d0U, 0x2ac5efefU, 0xe54faaaaU, 0x16edfbfbU,
+    0xc5864343U, 0xd79a4d4dU, 0x55663333U, 0x94118585U,
+    0xcf8a4545U, 0x10e9f9f9U, 0x06040202U, 0x81fe7f7fU,
+    0xf0a05050U, 0x44783c3cU, 0xba259f9fU, 0xe34ba8a8U,
+    0xf3a25151U, 0xfe5da3a3U, 0xc0804040U, 0x8a058f8fU,
+    0xad3f9292U, 0xbc219d9dU, 0x48703838U, 0x04f1f5f5U,
+    0xdf63bcbcU, 0xc177b6b6U, 0x75afdadaU, 0x63422121U,
+    0x30201010U, 0x1ae5ffffU, 0x0efdf3f3U, 0x6dbfd2d2U,
+    0x4c81cdcdU, 0x14180c0cU, 0x35261313U, 0x2fc3ececU,
+    0xe1be5f5fU, 0xa2359797U, 0xcc884444U, 0x392e1717U,
+    0x5793c4c4U, 0xf255a7a7U, 0x82fc7e7eU, 0x477a3d3dU,
+    0xacc86464U, 0xe7ba5d5dU, 0x2b321919U, 0x95e67373U,
+    0xa0c06060U, 0x98198181U, 0xd19e4f4fU, 0x7fa3dcdcU,
+    0x66442222U, 0x7e542a2aU, 0xab3b9090U, 0x830b8888U,
+    0xca8c4646U, 0x29c7eeeeU, 0xd36bb8b8U, 0x3c281414U,
+    0x79a7dedeU, 0xe2bc5e5eU, 0x1d160b0bU, 0x76addbdbU,
+    0x3bdbe0e0U, 0x56643232U, 0x4e743a3aU, 0x1e140a0aU,
+    0xdb924949U, 0x0a0c0606U, 0x6c482424U, 0xe4b85c5cU,
+    0x5d9fc2c2U, 0x6ebdd3d3U, 0xef43acacU, 0xa6c46262U,
+    0xa8399191U, 0xa4319595U, 0x37d3e4e4U, 0x8bf27979U,
+    0x32d5e7e7U, 0x438bc8c8U, 0x596e3737U, 0xb7da6d6dU,
+    0x8c018d8dU, 0x64b1d5d5U, 0xd29c4e4eU, 0xe049a9a9U,
+    0xb4d86c6cU, 0xfaac5656U, 0x07f3f4f4U, 0x25cfeaeaU,
+    0xafca6565U, 0x8ef47a7aU, 0xe947aeaeU, 0x18100808U,
+    0xd56fbabaU, 0x88f07878U, 0x6f4a2525U, 0x725c2e2eU,
+    0x24381c1cU, 0xf157a6a6U, 0xc773b4b4U, 0x5197c6c6U,
+    0x23cbe8e8U, 0x7ca1ddddU, 0x9ce87474U, 0x213e1f1fU,
+    0xdd964b4bU, 0xdc61bdbdU, 0x860d8b8bU, 0x850f8a8aU,
+    0x90e07070U, 0x427c3e3eU, 0xc471b5b5U, 0xaacc6666U,
+    0xd8904848U, 0x05060303U, 0x01f7f6f6U, 0x121c0e0eU,
+    0xa3c26161U, 0x5f6a3535U, 0xf9ae5757U, 0xd069b9b9U,
+    0x91178686U, 0x5899c1c1U, 0x273a1d1dU, 0xb9279e9eU,
+    0x38d9e1e1U, 0x13ebf8f8U, 0xb32b9898U, 0x33221111U,
+    0xbbd26969U, 0x70a9d9d9U, 0x89078e8eU, 0xa7339494U,
+    0xb62d9b9bU, 0x223c1e1eU, 0x92158787U, 0x20c9e9e9U,
+    0x4987ceceU, 0xffaa5555U, 0x78502828U, 0x7aa5dfdfU,
+    0x8f038c8cU, 0xf859a1a1U, 0x80098989U, 0x171a0d0dU,
+    0xda65bfbfU, 0x31d7e6e6U, 0xc6844242U, 0xb8d06868U,
+    0xc3824141U, 0xb0299999U, 0x775a2d2dU, 0x111e0f0fU,
+    0xcb7bb0b0U, 0xfca85454U, 0xd66dbbbbU, 0x3a2c1616U,
+};
+const u32 Te2[256] = {
+    0x63a5c663U, 0x7c84f87cU, 0x7799ee77U, 0x7b8df67bU,
+    0xf20dfff2U, 0x6bbdd66bU, 0x6fb1de6fU, 0xc55491c5U,
+    0x30506030U, 0x01030201U, 0x67a9ce67U, 0x2b7d562bU,
+    0xfe19e7feU, 0xd762b5d7U, 0xabe64dabU, 0x769aec76U,
+    0xca458fcaU, 0x829d1f82U, 0xc94089c9U, 0x7d87fa7dU,
+    0xfa15effaU, 0x59ebb259U, 0x47c98e47U, 0xf00bfbf0U,
+    0xadec41adU, 0xd467b3d4U, 0xa2fd5fa2U, 0xafea45afU,
+    0x9cbf239cU, 0xa4f753a4U, 0x7296e472U, 0xc05b9bc0U,
+    0xb7c275b7U, 0xfd1ce1fdU, 0x93ae3d93U, 0x266a4c26U,
+    0x365a6c36U, 0x3f417e3fU, 0xf702f5f7U, 0xcc4f83ccU,
+    0x345c6834U, 0xa5f451a5U, 0xe534d1e5U, 0xf108f9f1U,
+    0x7193e271U, 0xd873abd8U, 0x31536231U, 0x153f2a15U,
+    0x040c0804U, 0xc75295c7U, 0x23654623U, 0xc35e9dc3U,
+    0x18283018U, 0x96a13796U, 0x050f0a05U, 0x9ab52f9aU,
+    0x07090e07U, 0x12362412U, 0x809b1b80U, 0xe23ddfe2U,
+    0xeb26cdebU, 0x27694e27U, 0xb2cd7fb2U, 0x759fea75U,
+    0x091b1209U, 0x839e1d83U, 0x2c74582cU, 0x1a2e341aU,
+    0x1b2d361bU, 0x6eb2dc6eU, 0x5aeeb45aU, 0xa0fb5ba0U,
+    0x52f6a452U, 0x3b4d763bU, 0xd661b7d6U, 0xb3ce7db3U,
+    0x297b5229U, 0xe33edde3U, 0x2f715e2fU, 0x84971384U,
+    0x53f5a653U, 0xd168b9d1U, 0x00000000U, 0xed2cc1edU,
+    0x20604020U, 0xfc1fe3fcU, 0xb1c879b1U, 0x5bedb65bU,
+    0x6abed46aU, 0xcb468dcbU, 0xbed967beU, 0x394b7239U,
+    0x4ade944aU, 0x4cd4984cU, 0x58e8b058U, 0xcf4a85cfU,
+    0xd06bbbd0U, 0xef2ac5efU, 0xaae54faaU, 0xfb16edfbU,
+    0x43c58643U, 0x4dd79a4dU, 0x33556633U, 0x85941185U,
+    0x45cf8a45U, 0xf910e9f9U, 0x02060402U, 0x7f81fe7fU,
+    0x50f0a050U, 0x3c44783cU, 0x9fba259fU, 0xa8e34ba8U,
+    0x51f3a251U, 0xa3fe5da3U, 0x40c08040U, 0x8f8a058fU,
+    0x92ad3f92U, 0x9dbc219dU, 0x38487038U, 0xf504f1f5U,
+    0xbcdf63bcU, 0xb6c177b6U, 0xda75afdaU, 0x21634221U,
+    0x10302010U, 0xff1ae5ffU, 0xf30efdf3U, 0xd26dbfd2U,
+    0xcd4c81cdU, 0x0c14180cU, 0x13352613U, 0xec2fc3ecU,
+    0x5fe1be5fU, 0x97a23597U, 0x44cc8844U, 0x17392e17U,
+    0xc45793c4U, 0xa7f255a7U, 0x7e82fc7eU, 0x3d477a3dU,
+    0x64acc864U, 0x5de7ba5dU, 0x192b3219U, 0x7395e673U,
+    0x60a0c060U, 0x81981981U, 0x4fd19e4fU, 0xdc7fa3dcU,
+    0x22664422U, 0x2a7e542aU, 0x90ab3b90U, 0x88830b88U,
+    0x46ca8c46U, 0xee29c7eeU, 0xb8d36bb8U, 0x143c2814U,
+    0xde79a7deU, 0x5ee2bc5eU, 0x0b1d160bU, 0xdb76addbU,
+    0xe03bdbe0U, 0x32566432U, 0x3a4e743aU, 0x0a1e140aU,
+    0x49db9249U, 0x060a0c06U, 0x246c4824U, 0x5ce4b85cU,
+    0xc25d9fc2U, 0xd36ebdd3U, 0xacef43acU, 0x62a6c462U,
+    0x91a83991U, 0x95a43195U, 0xe437d3e4U, 0x798bf279U,
+    0xe732d5e7U, 0xc8438bc8U, 0x37596e37U, 0x6db7da6dU,
+    0x8d8c018dU, 0xd564b1d5U, 0x4ed29c4eU, 0xa9e049a9U,
+    0x6cb4d86cU, 0x56faac56U, 0xf407f3f4U, 0xea25cfeaU,
+    0x65afca65U, 0x7a8ef47aU, 0xaee947aeU, 0x08181008U,
+    0xbad56fbaU, 0x7888f078U, 0x256f4a25U, 0x2e725c2eU,
+    0x1c24381cU, 0xa6f157a6U, 0xb4c773b4U, 0xc65197c6U,
+    0xe823cbe8U, 0xdd7ca1ddU, 0x749ce874U, 0x1f213e1fU,
+    0x4bdd964bU, 0xbddc61bdU, 0x8b860d8bU, 0x8a850f8aU,
+    0x7090e070U, 0x3e427c3eU, 0xb5c471b5U, 0x66aacc66U,
+    0x48d89048U, 0x03050603U, 0xf601f7f6U, 0x0e121c0eU,
+    0x61a3c261U, 0x355f6a35U, 0x57f9ae57U, 0xb9d069b9U,
+    0x86911786U, 0xc15899c1U, 0x1d273a1dU, 0x9eb9279eU,
+    0xe138d9e1U, 0xf813ebf8U, 0x98b32b98U, 0x11332211U,
+    0x69bbd269U, 0xd970a9d9U, 0x8e89078eU, 0x94a73394U,
+    0x9bb62d9bU, 0x1e223c1eU, 0x87921587U, 0xe920c9e9U,
+    0xce4987ceU, 0x55ffaa55U, 0x28785028U, 0xdf7aa5dfU,
+    0x8c8f038cU, 0xa1f859a1U, 0x89800989U, 0x0d171a0dU,
+    0xbfda65bfU, 0xe631d7e6U, 0x42c68442U, 0x68b8d068U,
+    0x41c38241U, 0x99b02999U, 0x2d775a2dU, 0x0f111e0fU,
+    0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U,
+};
+const u32 Te3[256] = {
+
+    0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U,
+    0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U,
+    0x30305060U, 0x01010302U, 0x6767a9ceU, 0x2b2b7d56U,
+    0xfefe19e7U, 0xd7d762b5U, 0xababe64dU, 0x76769aecU,
+    0xcaca458fU, 0x82829d1fU, 0xc9c94089U, 0x7d7d87faU,
+    0xfafa15efU, 0x5959ebb2U, 0x4747c98eU, 0xf0f00bfbU,
+    0xadadec41U, 0xd4d467b3U, 0xa2a2fd5fU, 0xafafea45U,
+    0x9c9cbf23U, 0xa4a4f753U, 0x727296e4U, 0xc0c05b9bU,
+    0xb7b7c275U, 0xfdfd1ce1U, 0x9393ae3dU, 0x26266a4cU,
+    0x36365a6cU, 0x3f3f417eU, 0xf7f702f5U, 0xcccc4f83U,
+    0x34345c68U, 0xa5a5f451U, 0xe5e534d1U, 0xf1f108f9U,
+    0x717193e2U, 0xd8d873abU, 0x31315362U, 0x15153f2aU,
+    0x04040c08U, 0xc7c75295U, 0x23236546U, 0xc3c35e9dU,
+    0x18182830U, 0x9696a137U, 0x05050f0aU, 0x9a9ab52fU,
+    0x0707090eU, 0x12123624U, 0x80809b1bU, 0xe2e23ddfU,
+    0xebeb26cdU, 0x2727694eU, 0xb2b2cd7fU, 0x75759feaU,
+    0x09091b12U, 0x83839e1dU, 0x2c2c7458U, 0x1a1a2e34U,
+    0x1b1b2d36U, 0x6e6eb2dcU, 0x5a5aeeb4U, 0xa0a0fb5bU,
+    0x5252f6a4U, 0x3b3b4d76U, 0xd6d661b7U, 0xb3b3ce7dU,
+    0x29297b52U, 0xe3e33eddU, 0x2f2f715eU, 0x84849713U,
+    0x5353f5a6U, 0xd1d168b9U, 0x00000000U, 0xeded2cc1U,
+    0x20206040U, 0xfcfc1fe3U, 0xb1b1c879U, 0x5b5bedb6U,
+    0x6a6abed4U, 0xcbcb468dU, 0xbebed967U, 0x39394b72U,
+    0x4a4ade94U, 0x4c4cd498U, 0x5858e8b0U, 0xcfcf4a85U,
+    0xd0d06bbbU, 0xefef2ac5U, 0xaaaae54fU, 0xfbfb16edU,
+    0x4343c586U, 0x4d4dd79aU, 0x33335566U, 0x85859411U,
+    0x4545cf8aU, 0xf9f910e9U, 0x02020604U, 0x7f7f81feU,
+    0x5050f0a0U, 0x3c3c4478U, 0x9f9fba25U, 0xa8a8e34bU,
+    0x5151f3a2U, 0xa3a3fe5dU, 0x4040c080U, 0x8f8f8a05U,
+    0x9292ad3fU, 0x9d9dbc21U, 0x38384870U, 0xf5f504f1U,
+    0xbcbcdf63U, 0xb6b6c177U, 0xdada75afU, 0x21216342U,
+    0x10103020U, 0xffff1ae5U, 0xf3f30efdU, 0xd2d26dbfU,
+    0xcdcd4c81U, 0x0c0c1418U, 0x13133526U, 0xecec2fc3U,
+    0x5f5fe1beU, 0x9797a235U, 0x4444cc88U, 0x1717392eU,
+    0xc4c45793U, 0xa7a7f255U, 0x7e7e82fcU, 0x3d3d477aU,
+    0x6464acc8U, 0x5d5de7baU, 0x19192b32U, 0x737395e6U,
+    0x6060a0c0U, 0x81819819U, 0x4f4fd19eU, 0xdcdc7fa3U,
+    0x22226644U, 0x2a2a7e54U, 0x9090ab3bU, 0x8888830bU,
+    0x4646ca8cU, 0xeeee29c7U, 0xb8b8d36bU, 0x14143c28U,
+    0xdede79a7U, 0x5e5ee2bcU, 0x0b0b1d16U, 0xdbdb76adU,
+    0xe0e03bdbU, 0x32325664U, 0x3a3a4e74U, 0x0a0a1e14U,
+    0x4949db92U, 0x06060a0cU, 0x24246c48U, 0x5c5ce4b8U,
+    0xc2c25d9fU, 0xd3d36ebdU, 0xacacef43U, 0x6262a6c4U,
+    0x9191a839U, 0x9595a431U, 0xe4e437d3U, 0x79798bf2U,
+    0xe7e732d5U, 0xc8c8438bU, 0x3737596eU, 0x6d6db7daU,
+    0x8d8d8c01U, 0xd5d564b1U, 0x4e4ed29cU, 0xa9a9e049U,
+    0x6c6cb4d8U, 0x5656faacU, 0xf4f407f3U, 0xeaea25cfU,
+    0x6565afcaU, 0x7a7a8ef4U, 0xaeaee947U, 0x08081810U,
+    0xbabad56fU, 0x787888f0U, 0x25256f4aU, 0x2e2e725cU,
+    0x1c1c2438U, 0xa6a6f157U, 0xb4b4c773U, 0xc6c65197U,
+    0xe8e823cbU, 0xdddd7ca1U, 0x74749ce8U, 0x1f1f213eU,
+    0x4b4bdd96U, 0xbdbddc61U, 0x8b8b860dU, 0x8a8a850fU,
+    0x707090e0U, 0x3e3e427cU, 0xb5b5c471U, 0x6666aaccU,
+    0x4848d890U, 0x03030506U, 0xf6f601f7U, 0x0e0e121cU,
+    0x6161a3c2U, 0x35355f6aU, 0x5757f9aeU, 0xb9b9d069U,
+    0x86869117U, 0xc1c15899U, 0x1d1d273aU, 0x9e9eb927U,
+    0xe1e138d9U, 0xf8f813ebU, 0x9898b32bU, 0x11113322U,
+    0x6969bbd2U, 0xd9d970a9U, 0x8e8e8907U, 0x9494a733U,
+    0x9b9bb62dU, 0x1e1e223cU, 0x87879215U, 0xe9e920c9U,
+    0xcece4987U, 0x5555ffaaU, 0x28287850U, 0xdfdf7aa5U,
+    0x8c8c8f03U, 0xa1a1f859U, 0x89898009U, 0x0d0d171aU,
+    0xbfbfda65U, 0xe6e631d7U, 0x4242c684U, 0x6868b8d0U,
+    0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU,
+    0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU,
+};
+const u32 Te4[256] = {
+    0x63636363U, 0x7c7c7c7cU, 0x77777777U, 0x7b7b7b7bU,
+    0xf2f2f2f2U, 0x6b6b6b6bU, 0x6f6f6f6fU, 0xc5c5c5c5U,
+    0x30303030U, 0x01010101U, 0x67676767U, 0x2b2b2b2bU,
+    0xfefefefeU, 0xd7d7d7d7U, 0xababababU, 0x76767676U,
+    0xcacacacaU, 0x82828282U, 0xc9c9c9c9U, 0x7d7d7d7dU,
+    0xfafafafaU, 0x59595959U, 0x47474747U, 0xf0f0f0f0U,
+    0xadadadadU, 0xd4d4d4d4U, 0xa2a2a2a2U, 0xafafafafU,
+    0x9c9c9c9cU, 0xa4a4a4a4U, 0x72727272U, 0xc0c0c0c0U,
+    0xb7b7b7b7U, 0xfdfdfdfdU, 0x93939393U, 0x26262626U,
+    0x36363636U, 0x3f3f3f3fU, 0xf7f7f7f7U, 0xccccccccU,
+    0x34343434U, 0xa5a5a5a5U, 0xe5e5e5e5U, 0xf1f1f1f1U,
+    0x71717171U, 0xd8d8d8d8U, 0x31313131U, 0x15151515U,
+    0x04040404U, 0xc7c7c7c7U, 0x23232323U, 0xc3c3c3c3U,
+    0x18181818U, 0x96969696U, 0x05050505U, 0x9a9a9a9aU,
+    0x07070707U, 0x12121212U, 0x80808080U, 0xe2e2e2e2U,
+    0xebebebebU, 0x27272727U, 0xb2b2b2b2U, 0x75757575U,
+    0x09090909U, 0x83838383U, 0x2c2c2c2cU, 0x1a1a1a1aU,
+    0x1b1b1b1bU, 0x6e6e6e6eU, 0x5a5a5a5aU, 0xa0a0a0a0U,
+    0x52525252U, 0x3b3b3b3bU, 0xd6d6d6d6U, 0xb3b3b3b3U,
+    0x29292929U, 0xe3e3e3e3U, 0x2f2f2f2fU, 0x84848484U,
+    0x53535353U, 0xd1d1d1d1U, 0x00000000U, 0xededededU,
+    0x20202020U, 0xfcfcfcfcU, 0xb1b1b1b1U, 0x5b5b5b5bU,
+    0x6a6a6a6aU, 0xcbcbcbcbU, 0xbebebebeU, 0x39393939U,
+    0x4a4a4a4aU, 0x4c4c4c4cU, 0x58585858U, 0xcfcfcfcfU,
+    0xd0d0d0d0U, 0xefefefefU, 0xaaaaaaaaU, 0xfbfbfbfbU,
+    0x43434343U, 0x4d4d4d4dU, 0x33333333U, 0x85858585U,
+    0x45454545U, 0xf9f9f9f9U, 0x02020202U, 0x7f7f7f7fU,
+    0x50505050U, 0x3c3c3c3cU, 0x9f9f9f9fU, 0xa8a8a8a8U,
+    0x51515151U, 0xa3a3a3a3U, 0x40404040U, 0x8f8f8f8fU,
+    0x92929292U, 0x9d9d9d9dU, 0x38383838U, 0xf5f5f5f5U,
+    0xbcbcbcbcU, 0xb6b6b6b6U, 0xdadadadaU, 0x21212121U,
+    0x10101010U, 0xffffffffU, 0xf3f3f3f3U, 0xd2d2d2d2U,
+    0xcdcdcdcdU, 0x0c0c0c0cU, 0x13131313U, 0xececececU,
+    0x5f5f5f5fU, 0x97979797U, 0x44444444U, 0x17171717U,
+    0xc4c4c4c4U, 0xa7a7a7a7U, 0x7e7e7e7eU, 0x3d3d3d3dU,
+    0x64646464U, 0x5d5d5d5dU, 0x19191919U, 0x73737373U,
+    0x60606060U, 0x81818181U, 0x4f4f4f4fU, 0xdcdcdcdcU,
+    0x22222222U, 0x2a2a2a2aU, 0x90909090U, 0x88888888U,
+    0x46464646U, 0xeeeeeeeeU, 0xb8b8b8b8U, 0x14141414U,
+    0xdedededeU, 0x5e5e5e5eU, 0x0b0b0b0bU, 0xdbdbdbdbU,
+    0xe0e0e0e0U, 0x32323232U, 0x3a3a3a3aU, 0x0a0a0a0aU,
+    0x49494949U, 0x06060606U, 0x24242424U, 0x5c5c5c5cU,
+    0xc2c2c2c2U, 0xd3d3d3d3U, 0xacacacacU, 0x62626262U,
+    0x91919191U, 0x95959595U, 0xe4e4e4e4U, 0x79797979U,
+    0xe7e7e7e7U, 0xc8c8c8c8U, 0x37373737U, 0x6d6d6d6dU,
+    0x8d8d8d8dU, 0xd5d5d5d5U, 0x4e4e4e4eU, 0xa9a9a9a9U,
+    0x6c6c6c6cU, 0x56565656U, 0xf4f4f4f4U, 0xeaeaeaeaU,
+    0x65656565U, 0x7a7a7a7aU, 0xaeaeaeaeU, 0x08080808U,
+    0xbabababaU, 0x78787878U, 0x25252525U, 0x2e2e2e2eU,
+    0x1c1c1c1cU, 0xa6a6a6a6U, 0xb4b4b4b4U, 0xc6c6c6c6U,
+    0xe8e8e8e8U, 0xddddddddU, 0x74747474U, 0x1f1f1f1fU,
+    0x4b4b4b4bU, 0xbdbdbdbdU, 0x8b8b8b8bU, 0x8a8a8a8aU,
+    0x70707070U, 0x3e3e3e3eU, 0xb5b5b5b5U, 0x66666666U,
+    0x48484848U, 0x03030303U, 0xf6f6f6f6U, 0x0e0e0e0eU,
+    0x61616161U, 0x35353535U, 0x57575757U, 0xb9b9b9b9U,
+    0x86868686U, 0xc1c1c1c1U, 0x1d1d1d1dU, 0x9e9e9e9eU,
+    0xe1e1e1e1U, 0xf8f8f8f8U, 0x98989898U, 0x11111111U,
+    0x69696969U, 0xd9d9d9d9U, 0x8e8e8e8eU, 0x94949494U,
+    0x9b9b9b9bU, 0x1e1e1e1eU, 0x87878787U, 0xe9e9e9e9U,
+    0xcecececeU, 0x55555555U, 0x28282828U, 0xdfdfdfdfU,
+    0x8c8c8c8cU, 0xa1a1a1a1U, 0x89898989U, 0x0d0d0d0dU,
+    0xbfbfbfbfU, 0xe6e6e6e6U, 0x42424242U, 0x68686868U,
+    0x41414141U, 0x99999999U, 0x2d2d2d2dU, 0x0f0f0f0fU,
+    0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
+};
+#endif /* AES_SMALL_TABLES */
+const u32 Td0[256] = {
+    0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
+    0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
+    0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
+    0x4fe5d7fcU, 0xc52acbd7U, 0x26354480U, 0xb562a38fU,
+    0xdeb15a49U, 0x25ba1b67U, 0x45ea0e98U, 0x5dfec0e1U,
+    0xc32f7502U, 0x814cf012U, 0x8d4697a3U, 0x6bd3f9c6U,
+    0x038f5fe7U, 0x15929c95U, 0xbf6d7aebU, 0x955259daU,
+    0xd4be832dU, 0x587421d3U, 0x49e06929U, 0x8ec9c844U,
+    0x75c2896aU, 0xf48e7978U, 0x99583e6bU, 0x27b971ddU,
+    0xbee14fb6U, 0xf088ad17U, 0xc920ac66U, 0x7dce3ab4U,
+    0x63df4a18U, 0xe51a3182U, 0x97513360U, 0x62537f45U,
+    0xb16477e0U, 0xbb6bae84U, 0xfe81a01cU, 0xf9082b94U,
+    0x70486858U, 0x8f45fd19U, 0x94de6c87U, 0x527bf8b7U,
+    0xab73d323U, 0x724b02e2U, 0xe31f8f57U, 0x6655ab2aU,
+    0xb2eb2807U, 0x2fb5c203U, 0x86c57b9aU, 0xd33708a5U,
+    0x302887f2U, 0x23bfa5b2U, 0x02036abaU, 0xed16825cU,
+    0x8acf1c2bU, 0xa779b492U, 0xf307f2f0U, 0x4e69e2a1U,
+    0x65daf4cdU, 0x0605bed5U, 0xd134621fU, 0xc4a6fe8aU,
+    0x342e539dU, 0xa2f355a0U, 0x058ae132U, 0xa4f6eb75U,
+    0x0b83ec39U, 0x4060efaaU, 0x5e719f06U, 0xbd6e1051U,
+    0x3e218af9U, 0x96dd063dU, 0xdd3e05aeU, 0x4de6bd46U,
+    0x91548db5U, 0x71c45d05U, 0x0406d46fU, 0x605015ffU,
+    0x1998fb24U, 0xd6bde997U, 0x894043ccU, 0x67d99e77U,
+    0xb0e842bdU, 0x07898b88U, 0xe7195b38U, 0x79c8eedbU,
+    0xa17c0a47U, 0x7c420fe9U, 0xf8841ec9U, 0x00000000U,
+    0x09808683U, 0x322bed48U, 0x1e1170acU, 0x6c5a724eU,
+    0xfd0efffbU, 0x0f853856U, 0x3daed51eU, 0x362d3927U,
+    0x0a0fd964U, 0x685ca621U, 0x9b5b54d1U, 0x24362e3aU,
+    0x0c0a67b1U, 0x9357e70fU, 0xb4ee96d2U, 0x1b9b919eU,
+    0x80c0c54fU, 0x61dc20a2U, 0x5a774b69U, 0x1c121a16U,
+    0xe293ba0aU, 0xc0a02ae5U, 0x3c22e043U, 0x121b171dU,
+    0x0e090d0bU, 0xf28bc7adU, 0x2db6a8b9U, 0x141ea9c8U,
+    0x57f11985U, 0xaf75074cU, 0xee99ddbbU, 0xa37f60fdU,
+    0xf701269fU, 0x5c72f5bcU, 0x44663bc5U, 0x5bfb7e34U,
+    0x8b432976U, 0xcb23c6dcU, 0xb6edfc68U, 0xb8e4f163U,
+    0xd731dccaU, 0x42638510U, 0x13972240U, 0x84c61120U,
+    0x854a247dU, 0xd2bb3df8U, 0xaef93211U, 0xc729a16dU,
+    0x1d9e2f4bU, 0xdcb230f3U, 0x0d8652ecU, 0x77c1e3d0U,
+    0x2bb3166cU, 0xa970b999U, 0x119448faU, 0x47e96422U,
+    0xa8fc8cc4U, 0xa0f03f1aU, 0x567d2cd8U, 0x223390efU,
+    0x87494ec7U, 0xd938d1c1U, 0x8ccaa2feU, 0x98d40b36U,
+    0xa6f581cfU, 0xa57ade28U, 0xdab78e26U, 0x3fadbfa4U,
+    0x2c3a9de4U, 0x5078920dU, 0x6a5fcc9bU, 0x547e4662U,
+    0xf68d13c2U, 0x90d8b8e8U, 0x2e39f75eU, 0x82c3aff5U,
+    0x9f5d80beU, 0x69d0937cU, 0x6fd52da9U, 0xcf2512b3U,
+    0xc8ac993bU, 0x10187da7U, 0xe89c636eU, 0xdb3bbb7bU,
+    0xcd267809U, 0x6e5918f4U, 0xec9ab701U, 0x834f9aa8U,
+    0xe6956e65U, 0xaaffe67eU, 0x21bccf08U, 0xef15e8e6U,
+    0xbae79bd9U, 0x4a6f36ceU, 0xea9f09d4U, 0x29b07cd6U,
+    0x31a4b2afU, 0x2a3f2331U, 0xc6a59430U, 0x35a266c0U,
+    0x744ebc37U, 0xfc82caa6U, 0xe090d0b0U, 0x33a7d815U,
+    0xf104984aU, 0x41ecdaf7U, 0x7fcd500eU, 0x1791f62fU,
+    0x764dd68dU, 0x43efb04dU, 0xccaa4d54U, 0xe49604dfU,
+    0x9ed1b5e3U, 0x4c6a881bU, 0xc12c1fb8U, 0x4665517fU,
+    0x9d5eea04U, 0x018c355dU, 0xfa877473U, 0xfb0b412eU,
+    0xb3671d5aU, 0x92dbd252U, 0xe9105633U, 0x6dd64713U,
+    0x9ad7618cU, 0x37a10c7aU, 0x59f8148eU, 0xeb133c89U,
+    0xcea927eeU, 0xb761c935U, 0xe11ce5edU, 0x7a47b13cU,
+    0x9cd2df59U, 0x55f2733fU, 0x1814ce79U, 0x73c737bfU,
+    0x53f7cdeaU, 0x5ffdaa5bU, 0xdf3d6f14U, 0x7844db86U,
+    0xcaaff381U, 0xb968c43eU, 0x3824342cU, 0xc2a3405fU,
+    0x161dc372U, 0xbce2250cU, 0x283c498bU, 0xff0d9541U,
+    0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U,
+    0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U,
+};
+#ifndef AES_SMALL_TABLES
+const u32 Td1[256] = {
+    0x5051f4a7U, 0x537e4165U, 0xc31a17a4U, 0x963a275eU,
+    0xcb3bab6bU, 0xf11f9d45U, 0xabacfa58U, 0x934be303U,
+    0x552030faU, 0xf6ad766dU, 0x9188cc76U, 0x25f5024cU,
+    0xfc4fe5d7U, 0xd7c52acbU, 0x80263544U, 0x8fb562a3U,
+    0x49deb15aU, 0x6725ba1bU, 0x9845ea0eU, 0xe15dfec0U,
+    0x02c32f75U, 0x12814cf0U, 0xa38d4697U, 0xc66bd3f9U,
+    0xe7038f5fU, 0x9515929cU, 0xebbf6d7aU, 0xda955259U,
+    0x2dd4be83U, 0xd3587421U, 0x2949e069U, 0x448ec9c8U,
+    0x6a75c289U, 0x78f48e79U, 0x6b99583eU, 0xdd27b971U,
+    0xb6bee14fU, 0x17f088adU, 0x66c920acU, 0xb47dce3aU,
+    0x1863df4aU, 0x82e51a31U, 0x60975133U, 0x4562537fU,
+    0xe0b16477U, 0x84bb6baeU, 0x1cfe81a0U, 0x94f9082bU,
+    0x58704868U, 0x198f45fdU, 0x8794de6cU, 0xb7527bf8U,
+    0x23ab73d3U, 0xe2724b02U, 0x57e31f8fU, 0x2a6655abU,
+    0x07b2eb28U, 0x032fb5c2U, 0x9a86c57bU, 0xa5d33708U,
+    0xf2302887U, 0xb223bfa5U, 0xba02036aU, 0x5ced1682U,
+    0x2b8acf1cU, 0x92a779b4U, 0xf0f307f2U, 0xa14e69e2U,
+    0xcd65daf4U, 0xd50605beU, 0x1fd13462U, 0x8ac4a6feU,
+    0x9d342e53U, 0xa0a2f355U, 0x32058ae1U, 0x75a4f6ebU,
+    0x390b83ecU, 0xaa4060efU, 0x065e719fU, 0x51bd6e10U,
+    0xf93e218aU, 0x3d96dd06U, 0xaedd3e05U, 0x464de6bdU,
+    0xb591548dU, 0x0571c45dU, 0x6f0406d4U, 0xff605015U,
+    0x241998fbU, 0x97d6bde9U, 0xcc894043U, 0x7767d99eU,
+    0xbdb0e842U, 0x8807898bU, 0x38e7195bU, 0xdb79c8eeU,
+    0x47a17c0aU, 0xe97c420fU, 0xc9f8841eU, 0x00000000U,
+    0x83098086U, 0x48322bedU, 0xac1e1170U, 0x4e6c5a72U,
+    0xfbfd0effU, 0x560f8538U, 0x1e3daed5U, 0x27362d39U,
+    0x640a0fd9U, 0x21685ca6U, 0xd19b5b54U, 0x3a24362eU,
+    0xb10c0a67U, 0x0f9357e7U, 0xd2b4ee96U, 0x9e1b9b91U,
+    0x4f80c0c5U, 0xa261dc20U, 0x695a774bU, 0x161c121aU,
+    0x0ae293baU, 0xe5c0a02aU, 0x433c22e0U, 0x1d121b17U,
+    0x0b0e090dU, 0xadf28bc7U, 0xb92db6a8U, 0xc8141ea9U,
+    0x8557f119U, 0x4caf7507U, 0xbbee99ddU, 0xfda37f60U,
+    0x9ff70126U, 0xbc5c72f5U, 0xc544663bU, 0x345bfb7eU,
+    0x768b4329U, 0xdccb23c6U, 0x68b6edfcU, 0x63b8e4f1U,
+    0xcad731dcU, 0x10426385U, 0x40139722U, 0x2084c611U,
+    0x7d854a24U, 0xf8d2bb3dU, 0x11aef932U, 0x6dc729a1U,
+    0x4b1d9e2fU, 0xf3dcb230U, 0xec0d8652U, 0xd077c1e3U,
+    0x6c2bb316U, 0x99a970b9U, 0xfa119448U, 0x2247e964U,
+    0xc4a8fc8cU, 0x1aa0f03fU, 0xd8567d2cU, 0xef223390U,
+    0xc787494eU, 0xc1d938d1U, 0xfe8ccaa2U, 0x3698d40bU,
+    0xcfa6f581U, 0x28a57adeU, 0x26dab78eU, 0xa43fadbfU,
+    0xe42c3a9dU, 0x0d507892U, 0x9b6a5fccU, 0x62547e46U,
+    0xc2f68d13U, 0xe890d8b8U, 0x5e2e39f7U, 0xf582c3afU,
+    0xbe9f5d80U, 0x7c69d093U, 0xa96fd52dU, 0xb3cf2512U,
+    0x3bc8ac99U, 0xa710187dU, 0x6ee89c63U, 0x7bdb3bbbU,
+    0x09cd2678U, 0xf46e5918U, 0x01ec9ab7U, 0xa8834f9aU,
+    0x65e6956eU, 0x7eaaffe6U, 0x0821bccfU, 0xe6ef15e8U,
+    0xd9bae79bU, 0xce4a6f36U, 0xd4ea9f09U, 0xd629b07cU,
+    0xaf31a4b2U, 0x312a3f23U, 0x30c6a594U, 0xc035a266U,
+    0x37744ebcU, 0xa6fc82caU, 0xb0e090d0U, 0x1533a7d8U,
+    0x4af10498U, 0xf741ecdaU, 0x0e7fcd50U, 0x2f1791f6U,
+    0x8d764dd6U, 0x4d43efb0U, 0x54ccaa4dU, 0xdfe49604U,
+    0xe39ed1b5U, 0x1b4c6a88U, 0xb8c12c1fU, 0x7f466551U,
+    0x049d5eeaU, 0x5d018c35U, 0x73fa8774U, 0x2efb0b41U,
+    0x5ab3671dU, 0x5292dbd2U, 0x33e91056U, 0x136dd647U,
+    0x8c9ad761U, 0x7a37a10cU, 0x8e59f814U, 0x89eb133cU,
+    0xeecea927U, 0x35b761c9U, 0xede11ce5U, 0x3c7a47b1U,
+    0x599cd2dfU, 0x3f55f273U, 0x791814ceU, 0xbf73c737U,
+    0xea53f7cdU, 0x5b5ffdaaU, 0x14df3d6fU, 0x867844dbU,
+    0x81caaff3U, 0x3eb968c4U, 0x2c382434U, 0x5fc2a340U,
+    0x72161dc3U, 0x0cbce225U, 0x8b283c49U, 0x41ff0d95U,
+    0x7139a801U, 0xde080cb3U, 0x9cd8b4e4U, 0x906456c1U,
+    0x617bcb84U, 0x70d532b6U, 0x74486c5cU, 0x42d0b857U,
+};
+const u32 Td2[256] = {
+    0xa75051f4U, 0x65537e41U, 0xa4c31a17U, 0x5e963a27U,
+    0x6bcb3babU, 0x45f11f9dU, 0x58abacfaU, 0x03934be3U,
+    0xfa552030U, 0x6df6ad76U, 0x769188ccU, 0x4c25f502U,
+    0xd7fc4fe5U, 0xcbd7c52aU, 0x44802635U, 0xa38fb562U,
+    0x5a49deb1U, 0x1b6725baU, 0x0e9845eaU, 0xc0e15dfeU,
+    0x7502c32fU, 0xf012814cU, 0x97a38d46U, 0xf9c66bd3U,
+    0x5fe7038fU, 0x9c951592U, 0x7aebbf6dU, 0x59da9552U,
+    0x832dd4beU, 0x21d35874U, 0x692949e0U, 0xc8448ec9U,
+    0x896a75c2U, 0x7978f48eU, 0x3e6b9958U, 0x71dd27b9U,
+    0x4fb6bee1U, 0xad17f088U, 0xac66c920U, 0x3ab47dceU,
+    0x4a1863dfU, 0x3182e51aU, 0x33609751U, 0x7f456253U,
+    0x77e0b164U, 0xae84bb6bU, 0xa01cfe81U, 0x2b94f908U,
+    0x68587048U, 0xfd198f45U, 0x6c8794deU, 0xf8b7527bU,
+    0xd323ab73U, 0x02e2724bU, 0x8f57e31fU, 0xab2a6655U,
+    0x2807b2ebU, 0xc2032fb5U, 0x7b9a86c5U, 0x08a5d337U,
+    0x87f23028U, 0xa5b223bfU, 0x6aba0203U, 0x825ced16U,
+    0x1c2b8acfU, 0xb492a779U, 0xf2f0f307U, 0xe2a14e69U,
+    0xf4cd65daU, 0xbed50605U, 0x621fd134U, 0xfe8ac4a6U,
+    0x539d342eU, 0x55a0a2f3U, 0xe132058aU, 0xeb75a4f6U,
+    0xec390b83U, 0xefaa4060U, 0x9f065e71U, 0x1051bd6eU,
+
+    0x8af93e21U, 0x063d96ddU, 0x05aedd3eU, 0xbd464de6U,
+    0x8db59154U, 0x5d0571c4U, 0xd46f0406U, 0x15ff6050U,
+    0xfb241998U, 0xe997d6bdU, 0x43cc8940U, 0x9e7767d9U,
+    0x42bdb0e8U, 0x8b880789U, 0x5b38e719U, 0xeedb79c8U,
+    0x0a47a17cU, 0x0fe97c42U, 0x1ec9f884U, 0x00000000U,
+    0x86830980U, 0xed48322bU, 0x70ac1e11U, 0x724e6c5aU,
+    0xfffbfd0eU, 0x38560f85U, 0xd51e3daeU, 0x3927362dU,
+    0xd9640a0fU, 0xa621685cU, 0x54d19b5bU, 0x2e3a2436U,
+    0x67b10c0aU, 0xe70f9357U, 0x96d2b4eeU, 0x919e1b9bU,
+    0xc54f80c0U, 0x20a261dcU, 0x4b695a77U, 0x1a161c12U,
+    0xba0ae293U, 0x2ae5c0a0U, 0xe0433c22U, 0x171d121bU,
+    0x0d0b0e09U, 0xc7adf28bU, 0xa8b92db6U, 0xa9c8141eU,
+    0x198557f1U, 0x074caf75U, 0xddbbee99U, 0x60fda37fU,
+    0x269ff701U, 0xf5bc5c72U, 0x3bc54466U, 0x7e345bfbU,
+    0x29768b43U, 0xc6dccb23U, 0xfc68b6edU, 0xf163b8e4U,
+    0xdccad731U, 0x85104263U, 0x22401397U, 0x112084c6U,
+    0x247d854aU, 0x3df8d2bbU, 0x3211aef9U, 0xa16dc729U,
+    0x2f4b1d9eU, 0x30f3dcb2U, 0x52ec0d86U, 0xe3d077c1U,
+    0x166c2bb3U, 0xb999a970U, 0x48fa1194U, 0x642247e9U,
+    0x8cc4a8fcU, 0x3f1aa0f0U, 0x2cd8567dU, 0x90ef2233U,
+    0x4ec78749U, 0xd1c1d938U, 0xa2fe8ccaU, 0x0b3698d4U,
+    0x81cfa6f5U, 0xde28a57aU, 0x8e26dab7U, 0xbfa43fadU,
+    0x9de42c3aU, 0x920d5078U, 0xcc9b6a5fU, 0x4662547eU,
+    0x13c2f68dU, 0xb8e890d8U, 0xf75e2e39U, 0xaff582c3U,
+    0x80be9f5dU, 0x937c69d0U, 0x2da96fd5U, 0x12b3cf25U,
+    0x993bc8acU, 0x7da71018U, 0x636ee89cU, 0xbb7bdb3bU,
+    0x7809cd26U, 0x18f46e59U, 0xb701ec9aU, 0x9aa8834fU,
+    0x6e65e695U, 0xe67eaaffU, 0xcf0821bcU, 0xe8e6ef15U,
+    0x9bd9bae7U, 0x36ce4a6fU, 0x09d4ea9fU, 0x7cd629b0U,
+    0xb2af31a4U, 0x23312a3fU, 0x9430c6a5U, 0x66c035a2U,
+    0xbc37744eU, 0xcaa6fc82U, 0xd0b0e090U, 0xd81533a7U,
+    0x984af104U, 0xdaf741ecU, 0x500e7fcdU, 0xf62f1791U,
+    0xd68d764dU, 0xb04d43efU, 0x4d54ccaaU, 0x04dfe496U,
+    0xb5e39ed1U, 0x881b4c6aU, 0x1fb8c12cU, 0x517f4665U,
+    0xea049d5eU, 0x355d018cU, 0x7473fa87U, 0x412efb0bU,
+    0x1d5ab367U, 0xd25292dbU, 0x5633e910U, 0x47136dd6U,
+    0x618c9ad7U, 0x0c7a37a1U, 0x148e59f8U, 0x3c89eb13U,
+    0x27eecea9U, 0xc935b761U, 0xe5ede11cU, 0xb13c7a47U,
+    0xdf599cd2U, 0x733f55f2U, 0xce791814U, 0x37bf73c7U,
+    0xcdea53f7U, 0xaa5b5ffdU, 0x6f14df3dU, 0xdb867844U,
+    0xf381caafU, 0xc43eb968U, 0x342c3824U, 0x405fc2a3U,
+    0xc372161dU, 0x250cbce2U, 0x498b283cU, 0x9541ff0dU,
+    0x017139a8U, 0xb3de080cU, 0xe49cd8b4U, 0xc1906456U,
+    0x84617bcbU, 0xb670d532U, 0x5c74486cU, 0x5742d0b8U,
+};
+const u32 Td3[256] = {
+    0xf4a75051U, 0x4165537eU, 0x17a4c31aU, 0x275e963aU,
+    0xab6bcb3bU, 0x9d45f11fU, 0xfa58abacU, 0xe303934bU,
+    0x30fa5520U, 0x766df6adU, 0xcc769188U, 0x024c25f5U,
+    0xe5d7fc4fU, 0x2acbd7c5U, 0x35448026U, 0x62a38fb5U,
+    0xb15a49deU, 0xba1b6725U, 0xea0e9845U, 0xfec0e15dU,
+    0x2f7502c3U, 0x4cf01281U, 0x4697a38dU, 0xd3f9c66bU,
+    0x8f5fe703U, 0x929c9515U, 0x6d7aebbfU, 0x5259da95U,
+    0xbe832dd4U, 0x7421d358U, 0xe0692949U, 0xc9c8448eU,
+    0xc2896a75U, 0x8e7978f4U, 0x583e6b99U, 0xb971dd27U,
+    0xe14fb6beU, 0x88ad17f0U, 0x20ac66c9U, 0xce3ab47dU,
+    0xdf4a1863U, 0x1a3182e5U, 0x51336097U, 0x537f4562U,
+    0x6477e0b1U, 0x6bae84bbU, 0x81a01cfeU, 0x082b94f9U,
+    0x48685870U, 0x45fd198fU, 0xde6c8794U, 0x7bf8b752U,
+    0x73d323abU, 0x4b02e272U, 0x1f8f57e3U, 0x55ab2a66U,
+    0xeb2807b2U, 0xb5c2032fU, 0xc57b9a86U, 0x3708a5d3U,
+    0x2887f230U, 0xbfa5b223U, 0x036aba02U, 0x16825cedU,
+    0xcf1c2b8aU, 0x79b492a7U, 0x07f2f0f3U, 0x69e2a14eU,
+    0xdaf4cd65U, 0x05bed506U, 0x34621fd1U, 0xa6fe8ac4U,
+    0x2e539d34U, 0xf355a0a2U, 0x8ae13205U, 0xf6eb75a4U,
+    0x83ec390bU, 0x60efaa40U, 0x719f065eU, 0x6e1051bdU,
+    0x218af93eU, 0xdd063d96U, 0x3e05aeddU, 0xe6bd464dU,
+    0x548db591U, 0xc45d0571U, 0x06d46f04U, 0x5015ff60U,
+    0x98fb2419U, 0xbde997d6U, 0x4043cc89U, 0xd99e7767U,
+    0xe842bdb0U, 0x898b8807U, 0x195b38e7U, 0xc8eedb79U,
+    0x7c0a47a1U, 0x420fe97cU, 0x841ec9f8U, 0x00000000U,
+    0x80868309U, 0x2bed4832U, 0x1170ac1eU, 0x5a724e6cU,
+    0x0efffbfdU, 0x8538560fU, 0xaed51e3dU, 0x2d392736U,
+    0x0fd9640aU, 0x5ca62168U, 0x5b54d19bU, 0x362e3a24U,
+    0x0a67b10cU, 0x57e70f93U, 0xee96d2b4U, 0x9b919e1bU,
+    0xc0c54f80U, 0xdc20a261U, 0x774b695aU, 0x121a161cU,
+    0x93ba0ae2U, 0xa02ae5c0U, 0x22e0433cU, 0x1b171d12U,
+    0x090d0b0eU, 0x8bc7adf2U, 0xb6a8b92dU, 0x1ea9c814U,
+    0xf1198557U, 0x75074cafU, 0x99ddbbeeU, 0x7f60fda3U,
+    0x01269ff7U, 0x72f5bc5cU, 0x663bc544U, 0xfb7e345bU,
+    0x4329768bU, 0x23c6dccbU, 0xedfc68b6U, 0xe4f163b8U,
+    0x31dccad7U, 0x63851042U, 0x97224013U, 0xc6112084U,
+    0x4a247d85U, 0xbb3df8d2U, 0xf93211aeU, 0x29a16dc7U,
+    0x9e2f4b1dU, 0xb230f3dcU, 0x8652ec0dU, 0xc1e3d077U,
+    0xb3166c2bU, 0x70b999a9U, 0x9448fa11U, 0xe9642247U,
+    0xfc8cc4a8U, 0xf03f1aa0U, 0x7d2cd856U, 0x3390ef22U,
+    0x494ec787U, 0x38d1c1d9U, 0xcaa2fe8cU, 0xd40b3698U,
+    0xf581cfa6U, 0x7ade28a5U, 0xb78e26daU, 0xadbfa43fU,
+    0x3a9de42cU, 0x78920d50U, 0x5fcc9b6aU, 0x7e466254U,
+    0x8d13c2f6U, 0xd8b8e890U, 0x39f75e2eU, 0xc3aff582U,
+    0x5d80be9fU, 0xd0937c69U, 0xd52da96fU, 0x2512b3cfU,
+    0xac993bc8U, 0x187da710U, 0x9c636ee8U, 0x3bbb7bdbU,
+    0x267809cdU, 0x5918f46eU, 0x9ab701ecU, 0x4f9aa883U,
+    0x956e65e6U, 0xffe67eaaU, 0xbccf0821U, 0x15e8e6efU,
+    0xe79bd9baU, 0x6f36ce4aU, 0x9f09d4eaU, 0xb07cd629U,
+    0xa4b2af31U, 0x3f23312aU, 0xa59430c6U, 0xa266c035U,
+    0x4ebc3774U, 0x82caa6fcU, 0x90d0b0e0U, 0xa7d81533U,
+    0x04984af1U, 0xecdaf741U, 0xcd500e7fU, 0x91f62f17U,
+    0x4dd68d76U, 0xefb04d43U, 0xaa4d54ccU, 0x9604dfe4U,
+    0xd1b5e39eU, 0x6a881b4cU, 0x2c1fb8c1U, 0x65517f46U,
+    0x5eea049dU, 0x8c355d01U, 0x877473faU, 0x0b412efbU,
+    0x671d5ab3U, 0xdbd25292U, 0x105633e9U, 0xd647136dU,
+    0xd7618c9aU, 0xa10c7a37U, 0xf8148e59U, 0x133c89ebU,
+    0xa927eeceU, 0x61c935b7U, 0x1ce5ede1U, 0x47b13c7aU,
+    0xd2df599cU, 0xf2733f55U, 0x14ce7918U, 0xc737bf73U,
+    0xf7cdea53U, 0xfdaa5b5fU, 0x3d6f14dfU, 0x44db8678U,
+    0xaff381caU, 0x68c43eb9U, 0x24342c38U, 0xa3405fc2U,
+    0x1dc37216U, 0xe2250cbcU, 0x3c498b28U, 0x0d9541ffU,
+    0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U,
+    0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U,
+};
+const u32 Td4[256] = {
+    0x52525252U, 0x09090909U, 0x6a6a6a6aU, 0xd5d5d5d5U,
+    0x30303030U, 0x36363636U, 0xa5a5a5a5U, 0x38383838U,
+    0xbfbfbfbfU, 0x40404040U, 0xa3a3a3a3U, 0x9e9e9e9eU,
+    0x81818181U, 0xf3f3f3f3U, 0xd7d7d7d7U, 0xfbfbfbfbU,
+    0x7c7c7c7cU, 0xe3e3e3e3U, 0x39393939U, 0x82828282U,
+    0x9b9b9b9bU, 0x2f2f2f2fU, 0xffffffffU, 0x87878787U,
+    0x34343434U, 0x8e8e8e8eU, 0x43434343U, 0x44444444U,
+    0xc4c4c4c4U, 0xdedededeU, 0xe9e9e9e9U, 0xcbcbcbcbU,
+    0x54545454U, 0x7b7b7b7bU, 0x94949494U, 0x32323232U,
+    0xa6a6a6a6U, 0xc2c2c2c2U, 0x23232323U, 0x3d3d3d3dU,
+    0xeeeeeeeeU, 0x4c4c4c4cU, 0x95959595U, 0x0b0b0b0bU,
+    0x42424242U, 0xfafafafaU, 0xc3c3c3c3U, 0x4e4e4e4eU,
+    0x08080808U, 0x2e2e2e2eU, 0xa1a1a1a1U, 0x66666666U,
+    0x28282828U, 0xd9d9d9d9U, 0x24242424U, 0xb2b2b2b2U,
+    0x76767676U, 0x5b5b5b5bU, 0xa2a2a2a2U, 0x49494949U,
+    0x6d6d6d6dU, 0x8b8b8b8bU, 0xd1d1d1d1U, 0x25252525U,
+    0x72727272U, 0xf8f8f8f8U, 0xf6f6f6f6U, 0x64646464U,
+    0x86868686U, 0x68686868U, 0x98989898U, 0x16161616U,
+    0xd4d4d4d4U, 0xa4a4a4a4U, 0x5c5c5c5cU, 0xccccccccU,
+    0x5d5d5d5dU, 0x65656565U, 0xb6b6b6b6U, 0x92929292U,
+    0x6c6c6c6cU, 0x70707070U, 0x48484848U, 0x50505050U,
+    0xfdfdfdfdU, 0xededededU, 0xb9b9b9b9U, 0xdadadadaU,
+    0x5e5e5e5eU, 0x15151515U, 0x46464646U, 0x57575757U,
+    0xa7a7a7a7U, 0x8d8d8d8dU, 0x9d9d9d9dU, 0x84848484U,
+    0x90909090U, 0xd8d8d8d8U, 0xababababU, 0x00000000U,
+    0x8c8c8c8cU, 0xbcbcbcbcU, 0xd3d3d3d3U, 0x0a0a0a0aU,
+    0xf7f7f7f7U, 0xe4e4e4e4U, 0x58585858U, 0x05050505U,
+    0xb8b8b8b8U, 0xb3b3b3b3U, 0x45454545U, 0x06060606U,
+    0xd0d0d0d0U, 0x2c2c2c2cU, 0x1e1e1e1eU, 0x8f8f8f8fU,
+    0xcacacacaU, 0x3f3f3f3fU, 0x0f0f0f0fU, 0x02020202U,
+    0xc1c1c1c1U, 0xafafafafU, 0xbdbdbdbdU, 0x03030303U,
+    0x01010101U, 0x13131313U, 0x8a8a8a8aU, 0x6b6b6b6bU,
+    0x3a3a3a3aU, 0x91919191U, 0x11111111U, 0x41414141U,
+    0x4f4f4f4fU, 0x67676767U, 0xdcdcdcdcU, 0xeaeaeaeaU,
+    0x97979797U, 0xf2f2f2f2U, 0xcfcfcfcfU, 0xcecececeU,
+    0xf0f0f0f0U, 0xb4b4b4b4U, 0xe6e6e6e6U, 0x73737373U,
+    0x96969696U, 0xacacacacU, 0x74747474U, 0x22222222U,
+    0xe7e7e7e7U, 0xadadadadU, 0x35353535U, 0x85858585U,
+    0xe2e2e2e2U, 0xf9f9f9f9U, 0x37373737U, 0xe8e8e8e8U,
+    0x1c1c1c1cU, 0x75757575U, 0xdfdfdfdfU, 0x6e6e6e6eU,
+    0x47474747U, 0xf1f1f1f1U, 0x1a1a1a1aU, 0x71717171U,
+    0x1d1d1d1dU, 0x29292929U, 0xc5c5c5c5U, 0x89898989U,
+    0x6f6f6f6fU, 0xb7b7b7b7U, 0x62626262U, 0x0e0e0e0eU,
+    0xaaaaaaaaU, 0x18181818U, 0xbebebebeU, 0x1b1b1b1bU,
+    0xfcfcfcfcU, 0x56565656U, 0x3e3e3e3eU, 0x4b4b4b4bU,
+    0xc6c6c6c6U, 0xd2d2d2d2U, 0x79797979U, 0x20202020U,
+    0x9a9a9a9aU, 0xdbdbdbdbU, 0xc0c0c0c0U, 0xfefefefeU,
+    0x78787878U, 0xcdcdcdcdU, 0x5a5a5a5aU, 0xf4f4f4f4U,
+    0x1f1f1f1fU, 0xddddddddU, 0xa8a8a8a8U, 0x33333333U,
+    0x88888888U, 0x07070707U, 0xc7c7c7c7U, 0x31313131U,
+    0xb1b1b1b1U, 0x12121212U, 0x10101010U, 0x59595959U,
+    0x27272727U, 0x80808080U, 0xececececU, 0x5f5f5f5fU,
+    0x60606060U, 0x51515151U, 0x7f7f7f7fU, 0xa9a9a9a9U,
+    0x19191919U, 0xb5b5b5b5U, 0x4a4a4a4aU, 0x0d0d0d0dU,
+    0x2d2d2d2dU, 0xe5e5e5e5U, 0x7a7a7a7aU, 0x9f9f9f9fU,
+    0x93939393U, 0xc9c9c9c9U, 0x9c9c9c9cU, 0xefefefefU,
+    0xa0a0a0a0U, 0xe0e0e0e0U, 0x3b3b3b3bU, 0x4d4d4d4dU,
+    0xaeaeaeaeU, 0x2a2a2a2aU, 0xf5f5f5f5U, 0xb0b0b0b0U,
+    0xc8c8c8c8U, 0xebebebebU, 0xbbbbbbbbU, 0x3c3c3c3cU,
+    0x83838383U, 0x53535353U, 0x99999999U, 0x61616161U,
+    0x17171717U, 0x2b2b2b2bU, 0x04040404U, 0x7e7e7e7eU,
+    0xbabababaU, 0x77777777U, 0xd6d6d6d6U, 0x26262626U,
+    0xe1e1e1e1U, 0x69696969U, 0x14141414U, 0x63636363U,
+    0x55555555U, 0x21212121U, 0x0c0c0c0cU, 0x7d7d7d7dU,
+};
+const u32 rcon[] = {
+	0x01000000, 0x02000000, 0x04000000, 0x08000000,
+	0x10000000, 0x20000000, 0x40000000, 0x80000000,
+	0x1B000000, 0x36000000, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
+};
+#else /* AES_SMALL_TABLES */
+const u8 Td4s[256] = {
+    0x52U, 0x09U, 0x6aU, 0xd5U, 0x30U, 0x36U, 0xa5U, 0x38U,
+    0xbfU, 0x40U, 0xa3U, 0x9eU, 0x81U, 0xf3U, 0xd7U, 0xfbU,
+    0x7cU, 0xe3U, 0x39U, 0x82U, 0x9bU, 0x2fU, 0xffU, 0x87U,
+    0x34U, 0x8eU, 0x43U, 0x44U, 0xc4U, 0xdeU, 0xe9U, 0xcbU,
+    0x54U, 0x7bU, 0x94U, 0x32U, 0xa6U, 0xc2U, 0x23U, 0x3dU,
+    0xeeU, 0x4cU, 0x95U, 0x0bU, 0x42U, 0xfaU, 0xc3U, 0x4eU,
+    0x08U, 0x2eU, 0xa1U, 0x66U, 0x28U, 0xd9U, 0x24U, 0xb2U,
+    0x76U, 0x5bU, 0xa2U, 0x49U, 0x6dU, 0x8bU, 0xd1U, 0x25U,
+    0x72U, 0xf8U, 0xf6U, 0x64U, 0x86U, 0x68U, 0x98U, 0x16U,
+    0xd4U, 0xa4U, 0x5cU, 0xccU, 0x5dU, 0x65U, 0xb6U, 0x92U,
+    0x6cU, 0x70U, 0x48U, 0x50U, 0xfdU, 0xedU, 0xb9U, 0xdaU,
+    0x5eU, 0x15U, 0x46U, 0x57U, 0xa7U, 0x8dU, 0x9dU, 0x84U,
+    0x90U, 0xd8U, 0xabU, 0x00U, 0x8cU, 0xbcU, 0xd3U, 0x0aU,
+    0xf7U, 0xe4U, 0x58U, 0x05U, 0xb8U, 0xb3U, 0x45U, 0x06U,
+    0xd0U, 0x2cU, 0x1eU, 0x8fU, 0xcaU, 0x3fU, 0x0fU, 0x02U,
+    0xc1U, 0xafU, 0xbdU, 0x03U, 0x01U, 0x13U, 0x8aU, 0x6bU,
+    0x3aU, 0x91U, 0x11U, 0x41U, 0x4fU, 0x67U, 0xdcU, 0xeaU,
+    0x97U, 0xf2U, 0xcfU, 0xceU, 0xf0U, 0xb4U, 0xe6U, 0x73U,
+    0x96U, 0xacU, 0x74U, 0x22U, 0xe7U, 0xadU, 0x35U, 0x85U,
+    0xe2U, 0xf9U, 0x37U, 0xe8U, 0x1cU, 0x75U, 0xdfU, 0x6eU,
+    0x47U, 0xf1U, 0x1aU, 0x71U, 0x1dU, 0x29U, 0xc5U, 0x89U,
+    0x6fU, 0xb7U, 0x62U, 0x0eU, 0xaaU, 0x18U, 0xbeU, 0x1bU,
+    0xfcU, 0x56U, 0x3eU, 0x4bU, 0xc6U, 0xd2U, 0x79U, 0x20U,
+    0x9aU, 0xdbU, 0xc0U, 0xfeU, 0x78U, 0xcdU, 0x5aU, 0xf4U,
+    0x1fU, 0xddU, 0xa8U, 0x33U, 0x88U, 0x07U, 0xc7U, 0x31U,
+    0xb1U, 0x12U, 0x10U, 0x59U, 0x27U, 0x80U, 0xecU, 0x5fU,
+    0x60U, 0x51U, 0x7fU, 0xa9U, 0x19U, 0xb5U, 0x4aU, 0x0dU,
+    0x2dU, 0xe5U, 0x7aU, 0x9fU, 0x93U, 0xc9U, 0x9cU, 0xefU,
+    0xa0U, 0xe0U, 0x3bU, 0x4dU, 0xaeU, 0x2aU, 0xf5U, 0xb0U,
+    0xc8U, 0xebU, 0xbbU, 0x3cU, 0x83U, 0x53U, 0x99U, 0x61U,
+    0x17U, 0x2bU, 0x04U, 0x7eU, 0xbaU, 0x77U, 0xd6U, 0x26U,
+    0xe1U, 0x69U, 0x14U, 0x63U, 0x55U, 0x21U, 0x0cU, 0x7dU,
+};
+const u8 rcons[] = {
+	0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36
+	/* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
+};
+#endif /* AES_SMALL_TABLES */
+/**
+ * Expand the cipher key into the encryption key schedule.
+ *
+ * @return	the number of rounds for the given cipher key size.
+ */
+void rijndaelKeySetupEnc(u32 rk[/*44*/], const u8 cipherKey[])
+{
+	int i;
+	u32 temp;
+
+	rk[0] = GETU32(cipherKey     );
+	rk[1] = GETU32(cipherKey +  4);
+	rk[2] = GETU32(cipherKey +  8);
+	rk[3] = GETU32(cipherKey + 12);
+	for (i = 0; i < 10; i++) {
+		temp  = rk[3];
+		rk[4] = rk[0] ^
+			TE421(temp) ^ TE432(temp) ^ TE443(temp) ^ TE414(temp) ^
+			RCON(i);
+		rk[5] = rk[1] ^ rk[4];
+		rk[6] = rk[2] ^ rk[5];
+		rk[7] = rk[3] ^ rk[6];
+		rk += 4;
+	}
+}
diff --git a/src/shared/libosmocore/src/gsm/milenage/aes.h b/src/shared/libosmocore/src/gsm/milenage/aes.h
new file mode 100644
index 00000000..ba384a9d
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/aes.h
@@ -0,0 +1,27 @@
+/*
+ * AES functions
+ * Copyright (c) 2003-2006, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ */
+
+#ifndef AES_H
+#define AES_H
+
+#define AES_BLOCK_SIZE 16
+
+void * aes_encrypt_init(const u8 *key, size_t len);
+void aes_encrypt(void *ctx, const u8 *plain, u8 *crypt);
+void aes_encrypt_deinit(void *ctx);
+void * aes_decrypt_init(const u8 *key, size_t len);
+void aes_decrypt(void *ctx, const u8 *crypt, u8 *plain);
+void aes_decrypt_deinit(void *ctx);
+
+#endif /* AES_H */
diff --git a/src/shared/libosmocore/src/gsm/milenage/aes_i.h b/src/shared/libosmocore/src/gsm/milenage/aes_i.h
new file mode 100644
index 00000000..6b40bc78
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/aes_i.h
@@ -0,0 +1,122 @@
+/*
+ * AES (Rijndael) cipher
+ * Copyright (c) 2003-2005, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ */
+
+#ifndef AES_I_H
+#define AES_I_H
+
+#include "aes.h"
+
+/* #define FULL_UNROLL */
+#define AES_SMALL_TABLES
+
+extern const u32 Te0[256];
+extern const u32 Te1[256];
+extern const u32 Te2[256];
+extern const u32 Te3[256];
+extern const u32 Te4[256];
+extern const u32 Td0[256];
+extern const u32 Td1[256];
+extern const u32 Td2[256];
+extern const u32 Td3[256];
+extern const u32 Td4[256];
+extern const u32 rcon[10];
+extern const u8 Td4s[256];
+extern const u8 rcons[10];
+
+#ifndef AES_SMALL_TABLES
+
+#define RCON(i) rcon[(i)]
+
+#define TE0(i) Te0[((i) >> 24) & 0xff]
+#define TE1(i) Te1[((i) >> 16) & 0xff]
+#define TE2(i) Te2[((i) >> 8) & 0xff]
+#define TE3(i) Te3[(i) & 0xff]
+#define TE41(i) (Te4[((i) >> 24) & 0xff] & 0xff000000)
+#define TE42(i) (Te4[((i) >> 16) & 0xff] & 0x00ff0000)
+#define TE43(i) (Te4[((i) >> 8) & 0xff] & 0x0000ff00)
+#define TE44(i) (Te4[(i) & 0xff] & 0x000000ff)
+#define TE421(i) (Te4[((i) >> 16) & 0xff] & 0xff000000)
+#define TE432(i) (Te4[((i) >> 8) & 0xff] & 0x00ff0000)
+#define TE443(i) (Te4[(i) & 0xff] & 0x0000ff00)
+#define TE414(i) (Te4[((i) >> 24) & 0xff] & 0x000000ff)
+#define TE4(i) (Te4[(i)] & 0x000000ff)
+
+#define TD0(i) Td0[((i) >> 24) & 0xff]
+#define TD1(i) Td1[((i) >> 16) & 0xff]
+#define TD2(i) Td2[((i) >> 8) & 0xff]
+#define TD3(i) Td3[(i) & 0xff]
+#define TD41(i) (Td4[((i) >> 24) & 0xff] & 0xff000000)
+#define TD42(i) (Td4[((i) >> 16) & 0xff] & 0x00ff0000)
+#define TD43(i) (Td4[((i) >> 8) & 0xff] & 0x0000ff00)
+#define TD44(i) (Td4[(i) & 0xff] & 0x000000ff)
+#define TD0_(i) Td0[(i) & 0xff]
+#define TD1_(i) Td1[(i) & 0xff]
+#define TD2_(i) Td2[(i) & 0xff]
+#define TD3_(i) Td3[(i) & 0xff]
+
+#else /* AES_SMALL_TABLES */
+
+#define RCON(i) (rcons[(i)] << 24)
+
+static inline u32 rotr(u32 val, int bits)
+{
+	return (val >> bits) | (val << (32 - bits));
+}
+
+#define TE0(i) Te0[((i) >> 24) & 0xff]
+#define TE1(i) rotr(Te0[((i) >> 16) & 0xff], 8)
+#define TE2(i) rotr(Te0[((i) >> 8) & 0xff], 16)
+#define TE3(i) rotr(Te0[(i) & 0xff], 24)
+#define TE41(i) ((Te0[((i) >> 24) & 0xff] << 8) & 0xff000000)
+#define TE42(i) (Te0[((i) >> 16) & 0xff] & 0x00ff0000)
+#define TE43(i) (Te0[((i) >> 8) & 0xff] & 0x0000ff00)
+#define TE44(i) ((Te0[(i) & 0xff] >> 8) & 0x000000ff)
+#define TE421(i) ((Te0[((i) >> 16) & 0xff] << 8) & 0xff000000)
+#define TE432(i) (Te0[((i) >> 8) & 0xff] & 0x00ff0000)
+#define TE443(i) (Te0[(i) & 0xff] & 0x0000ff00)
+#define TE414(i) ((Te0[((i) >> 24) & 0xff] >> 8) & 0x000000ff)
+#define TE4(i) ((Te0[(i)] >> 8) & 0x000000ff)
+
+#define TD0(i) Td0[((i) >> 24) & 0xff]
+#define TD1(i) rotr(Td0[((i) >> 16) & 0xff], 8)
+#define TD2(i) rotr(Td0[((i) >> 8) & 0xff], 16)
+#define TD3(i) rotr(Td0[(i) & 0xff], 24)
+#define TD41(i) (Td4s[((i) >> 24) & 0xff] << 24)
+#define TD42(i) (Td4s[((i) >> 16) & 0xff] << 16)
+#define TD43(i) (Td4s[((i) >> 8) & 0xff] << 8)
+#define TD44(i) (Td4s[(i) & 0xff])
+#define TD0_(i) Td0[(i) & 0xff]
+#define TD1_(i) rotr(Td0[(i) & 0xff], 8)
+#define TD2_(i) rotr(Td0[(i) & 0xff], 16)
+#define TD3_(i) rotr(Td0[(i) & 0xff], 24)
+
+#endif /* AES_SMALL_TABLES */
+
+#ifdef _MSC_VER
+#define SWAP(x) (_lrotl(x, 8) & 0x00ff00ff | _lrotr(x, 8) & 0xff00ff00)
+#define GETU32(p) SWAP(*((u32 *)(p)))
+#define PUTU32(ct, st) { *((u32 *)(ct)) = SWAP((st)); }
+#else
+#define GETU32(pt) (((u32)(pt)[0] << 24) ^ ((u32)(pt)[1] << 16) ^ \
+((u32)(pt)[2] <<  8) ^ ((u32)(pt)[3]))
+#define PUTU32(ct, st) { \
+(ct)[0] = (u8)((st) >> 24); (ct)[1] = (u8)((st) >> 16); \
+(ct)[2] = (u8)((st) >>  8); (ct)[3] = (u8)(st); }
+#endif
+
+#define AES_PRIV_SIZE (4 * 44)
+
+void rijndaelKeySetupEnc(u32 rk[/*44*/], const u8 cipherKey[]);
+
+#endif /* AES_I_H */
diff --git a/src/shared/libosmocore/src/gsm/milenage/aes_wrap.h b/src/shared/libosmocore/src/gsm/milenage/aes_wrap.h
new file mode 100644
index 00000000..4b1c7b08
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/aes_wrap.h
@@ -0,0 +1,48 @@
+/*
+ * AES-based functions
+ *
+ * - AES Key Wrap Algorithm (128-bit KEK) (RFC3394)
+ * - One-Key CBC MAC (OMAC1) hash with AES-128
+ * - AES-128 CTR mode encryption
+ * - AES-128 EAX mode encryption/decryption
+ * - AES-128 CBC
+ *
+ * Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ */
+
+#ifndef AES_WRAP_H
+#define AES_WRAP_H
+
+int __must_check aes_wrap(const u8 *kek, int n, const u8 *plain, u8 *cipher);
+int __must_check aes_unwrap(const u8 *kek, int n, const u8 *cipher, u8 *plain);
+int __must_check omac1_aes_128_vector(const u8 *key, size_t num_elem,
+				      const u8 *addr[], const size_t *len,
+				      u8 *mac);
+int __must_check omac1_aes_128(const u8 *key, const u8 *data, size_t data_len,
+			       u8 *mac);
+int __must_check aes_128_encrypt_block(const u8 *key, const u8 *in, u8 *out);
+int __must_check aes_128_ctr_encrypt(const u8 *key, const u8 *nonce,
+				     u8 *data, size_t data_len);
+int __must_check aes_128_eax_encrypt(const u8 *key,
+				     const u8 *nonce, size_t nonce_len,
+				     const u8 *hdr, size_t hdr_len,
+				     u8 *data, size_t data_len, u8 *tag);
+int __must_check aes_128_eax_decrypt(const u8 *key,
+				     const u8 *nonce, size_t nonce_len,
+				     const u8 *hdr, size_t hdr_len,
+				     u8 *data, size_t data_len, const u8 *tag);
+int __must_check aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data,
+				     size_t data_len);
+int __must_check aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data,
+				     size_t data_len);
+
+#endif /* AES_WRAP_H */
diff --git a/src/shared/libosmocore/src/gsm/milenage/common.h b/src/shared/libosmocore/src/gsm/milenage/common.h
new file mode 100644
index 00000000..aaf82b97
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/common.h
@@ -0,0 +1,20 @@
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define MSG_DEBUG
+#define wpa_hexdump(x, args...)
+#define wpa_hexdump_key(x, args...)
+#define wpa_printf(x, args...)
+
+#define os_memcpy(x, y, z)  memcpy(x, y, z)
+#define os_memcmp(x, y, z)  memcmp(x, y, z)
+#define os_memset(x, y, z)  memset(x, y, z)
+#define os_malloc(x)  malloc(x)
+#define os_free(x)  free(x)
+
+typedef uint8_t u8;
+typedef uint32_t u32;
+
+#define __must_check
diff --git a/src/shared/libosmocore/src/gsm/milenage/crypto.h b/src/shared/libosmocore/src/gsm/milenage/crypto.h
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/crypto.h
diff --git a/src/shared/libosmocore/src/gsm/milenage/includes.h b/src/shared/libosmocore/src/gsm/milenage/includes.h
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/includes.h
diff --git a/src/shared/libosmocore/src/gsm/milenage/milenage.c b/src/shared/libosmocore/src/gsm/milenage/milenage.c
new file mode 100644
index 00000000..b43f986a
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/milenage.c
@@ -0,0 +1,344 @@
+/*
+ * 3GPP AKA - Milenage algorithm (3GPP TS 35.205, .206, .207, .208)
+ * Copyright (c) 2006-2007 <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ *
+ * This file implements an example authentication algorithm defined for 3GPP
+ * AKA. This can be used to implement a simple HLR/AuC into hlr_auc_gw to allow
+ * EAP-AKA to be tested properly with real USIM cards.
+ *
+ * This implementations assumes that the r1..r5 and c1..c5 constants defined in
+ * TS 35.206 are used, i.e., r1=64, r2=0, r3=32, r4=64, r5=96, c1=00..00,
+ * c2=00..01, c3=00..02, c4=00..04, c5=00..08. The block cipher is assumed to
+ * be AES (Rijndael).
+ */
+
+#include "includes.h"
+
+#include "common.h"
+#include "aes_wrap.h"
+#include "milenage.h"
+
+
+/**
+ * milenage_f1 - Milenage f1 and f1* algorithms
+ * @opc: OPc = 128-bit value derived from OP and K
+ * @k: K = 128-bit subscriber key
+ * @_rand: RAND = 128-bit random challenge
+ * @sqn: SQN = 48-bit sequence number
+ * @amf: AMF = 16-bit authentication management field
+ * @mac_a: Buffer for MAC-A = 64-bit network authentication code, or %NULL
+ * @mac_s: Buffer for MAC-S = 64-bit resync authentication code, or %NULL
+ * Returns: 0 on success, -1 on failure
+ */
+int milenage_f1(const u8 *opc, const u8 *k, const u8 *_rand,
+		const u8 *sqn, const u8 *amf, u8 *mac_a, u8 *mac_s)
+{
+	u8 tmp1[16], tmp2[16], tmp3[16];
+	int i;
+
+	/* tmp1 = TEMP = E_K(RAND XOR OP_C) */
+	for (i = 0; i < 16; i++)
+		tmp1[i] = _rand[i] ^ opc[i];
+	if (aes_128_encrypt_block(k, tmp1, tmp1))
+		return -1;
+
+	/* tmp2 = IN1 = SQN || AMF || SQN || AMF */
+	os_memcpy(tmp2, sqn, 6);
+	os_memcpy(tmp2 + 6, amf, 2);
+	os_memcpy(tmp2 + 8, tmp2, 8);
+
+	/* OUT1 = E_K(TEMP XOR rot(IN1 XOR OP_C, r1) XOR c1) XOR OP_C */
+
+	/* rotate (tmp2 XOR OP_C) by r1 (= 0x40 = 8 bytes) */
+	for (i = 0; i < 16; i++)
+		tmp3[(i + 8) % 16] = tmp2[i] ^ opc[i];
+	/* XOR with TEMP = E_K(RAND XOR OP_C) */
+	for (i = 0; i < 16; i++)
+		tmp3[i] ^= tmp1[i];
+	/* XOR with c1 (= ..00, i.e., NOP) */
+
+	/* f1 || f1* = E_K(tmp3) XOR OP_c */
+	if (aes_128_encrypt_block(k, tmp3, tmp1))
+		return -1;
+	for (i = 0; i < 16; i++)
+		tmp1[i] ^= opc[i];
+	if (mac_a)
+		os_memcpy(mac_a, tmp1, 8); /* f1 */
+	if (mac_s)
+		os_memcpy(mac_s, tmp1 + 8, 8); /* f1* */
+	return 0;
+}
+
+
+/**
+ * milenage_f2345 - Milenage f2, f3, f4, f5, f5* algorithms
+ * @opc: OPc = 128-bit value derived from OP and K
+ * @k: K = 128-bit subscriber key
+ * @_rand: RAND = 128-bit random challenge
+ * @res: Buffer for RES = 64-bit signed response (f2), or %NULL
+ * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL
+ * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL
+ * @ak: Buffer for AK = 48-bit anonymity key (f5), or %NULL
+ * @akstar: Buffer for AK = 48-bit anonymity key (f5*), or %NULL
+ * Returns: 0 on success, -1 on failure
+ */
+int milenage_f2345(const u8 *opc, const u8 *k, const u8 *_rand,
+		   u8 *res, u8 *ck, u8 *ik, u8 *ak, u8 *akstar)
+{
+	u8 tmp1[16], tmp2[16], tmp3[16];
+	int i;
+
+	/* tmp2 = TEMP = E_K(RAND XOR OP_C) */
+	for (i = 0; i < 16; i++)
+		tmp1[i] = _rand[i] ^ opc[i];
+	if (aes_128_encrypt_block(k, tmp1, tmp2))
+		return -1;
+
+	/* OUT2 = E_K(rot(TEMP XOR OP_C, r2) XOR c2) XOR OP_C */
+	/* OUT3 = E_K(rot(TEMP XOR OP_C, r3) XOR c3) XOR OP_C */
+	/* OUT4 = E_K(rot(TEMP XOR OP_C, r4) XOR c4) XOR OP_C */
+	/* OUT5 = E_K(rot(TEMP XOR OP_C, r5) XOR c5) XOR OP_C */
+
+	/* f2 and f5 */
+	/* rotate by r2 (= 0, i.e., NOP) */
+	for (i = 0; i < 16; i++)
+		tmp1[i] = tmp2[i] ^ opc[i];
+	tmp1[15] ^= 1; /* XOR c2 (= ..01) */
+	/* f5 || f2 = E_K(tmp1) XOR OP_c */
+	if (aes_128_encrypt_block(k, tmp1, tmp3))
+		return -1;
+	for (i = 0; i < 16; i++)
+		tmp3[i] ^= opc[i];
+	if (res)
+		os_memcpy(res, tmp3 + 8, 8); /* f2 */
+	if (ak)
+		os_memcpy(ak, tmp3, 6); /* f5 */
+
+	/* f3 */
+	if (ck) {
+		/* rotate by r3 = 0x20 = 4 bytes */
+		for (i = 0; i < 16; i++)
+			tmp1[(i + 12) % 16] = tmp2[i] ^ opc[i];
+		tmp1[15] ^= 2; /* XOR c3 (= ..02) */
+		if (aes_128_encrypt_block(k, tmp1, ck))
+			return -1;
+		for (i = 0; i < 16; i++)
+			ck[i] ^= opc[i];
+	}
+
+	/* f4 */
+	if (ik) {
+		/* rotate by r4 = 0x40 = 8 bytes */
+		for (i = 0; i < 16; i++)
+			tmp1[(i + 8) % 16] = tmp2[i] ^ opc[i];
+		tmp1[15] ^= 4; /* XOR c4 (= ..04) */
+		if (aes_128_encrypt_block(k, tmp1, ik))
+			return -1;
+		for (i = 0; i < 16; i++)
+			ik[i] ^= opc[i];
+	}
+
+	/* f5* */
+	if (akstar) {
+		/* rotate by r5 = 0x60 = 12 bytes */
+		for (i = 0; i < 16; i++)
+			tmp1[(i + 4) % 16] = tmp2[i] ^ opc[i];
+		tmp1[15] ^= 8; /* XOR c5 (= ..08) */
+		if (aes_128_encrypt_block(k, tmp1, tmp1))
+			return -1;
+		for (i = 0; i < 6; i++)
+			akstar[i] = tmp1[i] ^ opc[i];
+	}
+
+	return 0;
+}
+
+
+/**
+ * milenage_generate - Generate AKA AUTN,IK,CK,RES
+ * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.)
+ * @amf: AMF = 16-bit authentication management field
+ * @k: K = 128-bit subscriber key
+ * @sqn: SQN = 48-bit sequence number
+ * @_rand: RAND = 128-bit random challenge
+ * @autn: Buffer for AUTN = 128-bit authentication token
+ * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL
+ * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL
+ * @res: Buffer for RES = 64-bit signed response (f2), or %NULL
+ * @res_len: Max length for res; set to used length or 0 on failure
+ */
+void milenage_generate(const u8 *opc, const u8 *amf, const u8 *k,
+		       const u8 *sqn, const u8 *_rand, u8 *autn, u8 *ik,
+		       u8 *ck, u8 *res, size_t *res_len)
+{
+	int i;
+	u8 mac_a[8], ak[6];
+
+	if (*res_len < 8) {
+		*res_len = 0;
+		return;
+	}
+	if (milenage_f1(opc, k, _rand, sqn, amf, mac_a, NULL) ||
+	    milenage_f2345(opc, k, _rand, res, ck, ik, ak, NULL)) {
+		*res_len = 0;
+		return;
+	}
+	*res_len = 8;
+
+	/* AUTN = (SQN ^ AK) || AMF || MAC */
+	for (i = 0; i < 6; i++)
+		autn[i] = sqn[i] ^ ak[i];
+	os_memcpy(autn + 6, amf, 2);
+	os_memcpy(autn + 8, mac_a, 8);
+}
+
+
+/**
+ * milenage_auts - Milenage AUTS validation
+ * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.)
+ * @k: K = 128-bit subscriber key
+ * @_rand: RAND = 128-bit random challenge
+ * @auts: AUTS = 112-bit authentication token from client
+ * @sqn: Buffer for SQN = 48-bit sequence number
+ * Returns: 0 = success (sqn filled), -1 on failure
+ */
+int milenage_auts(const u8 *opc, const u8 *k, const u8 *_rand, const u8 *auts,
+		  u8 *sqn)
+{
+	u8 amf[2] = { 0x00, 0x00 }; /* TS 33.102 v7.0.0, 6.3.3 */
+	u8 ak[6], mac_s[8];
+	int i;
+
+	if (milenage_f2345(opc, k, _rand, NULL, NULL, NULL, NULL, ak))
+		return -1;
+	for (i = 0; i < 6; i++)
+		sqn[i] = auts[i] ^ ak[i];
+	if (milenage_f1(opc, k, _rand, sqn, amf, NULL, mac_s) ||
+	    memcmp(mac_s, auts + 6, 8) != 0)
+		return -1;
+	return 0;
+}
+
+
+/**
+ * gsm_milenage - Generate GSM-Milenage (3GPP TS 55.205) authentication triplet
+ * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.)
+ * @k: K = 128-bit subscriber key
+ * @_rand: RAND = 128-bit random challenge
+ * @sres: Buffer for SRES = 32-bit SRES
+ * @kc: Buffer for Kc = 64-bit Kc
+ * Returns: 0 on success, -1 on failure
+ */
+int gsm_milenage(const u8 *opc, const u8 *k, const u8 *_rand, u8 *sres, u8 *kc)
+{
+	u8 res[8], ck[16], ik[16];
+	int i;
+
+	if (milenage_f2345(opc, k, _rand, res, ck, ik, NULL, NULL))
+		return -1;
+
+	for (i = 0; i < 8; i++)
+		kc[i] = ck[i] ^ ck[i + 8] ^ ik[i] ^ ik[i + 8];
+
+#ifdef GSM_MILENAGE_ALT_SRES
+	os_memcpy(sres, res, 4);
+#else /* GSM_MILENAGE_ALT_SRES */
+	for (i = 0; i < 4; i++)
+		sres[i] = res[i] ^ res[i + 4];
+#endif /* GSM_MILENAGE_ALT_SRES */
+	return 0;
+}
+
+
+/**
+ * milenage_generate - Generate AKA AUTN,IK,CK,RES
+ * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.)
+ * @k: K = 128-bit subscriber key
+ * @sqn: SQN = 48-bit sequence number
+ * @_rand: RAND = 128-bit random challenge
+ * @autn: AUTN = 128-bit authentication token
+ * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL
+ * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL
+ * @res: Buffer for RES = 64-bit signed response (f2), or %NULL
+ * @res_len: Variable that will be set to RES length
+ * @auts: 112-bit buffer for AUTS
+ * Returns: 0 on success, -1 on failure, or -2 on synchronization failure
+ */
+int milenage_check(const u8 *opc, const u8 *k, const u8 *sqn, const u8 *_rand,
+		   const u8 *autn, u8 *ik, u8 *ck, u8 *res, size_t *res_len,
+		   u8 *auts)
+{
+	int i;
+	u8 mac_a[8], ak[6], rx_sqn[6];
+	const u8 *amf;
+
+	wpa_hexdump(MSG_DEBUG, "Milenage: AUTN", autn, 16);
+	wpa_hexdump(MSG_DEBUG, "Milenage: RAND", _rand, 16);
+
+	if (milenage_f2345(opc, k, _rand, res, ck, ik, ak, NULL))
+		return -1;
+
+	*res_len = 8;
+	wpa_hexdump_key(MSG_DEBUG, "Milenage: RES", res, *res_len);
+	wpa_hexdump_key(MSG_DEBUG, "Milenage: CK", ck, 16);
+	wpa_hexdump_key(MSG_DEBUG, "Milenage: IK", ik, 16);
+	wpa_hexdump_key(MSG_DEBUG, "Milenage: AK", ak, 6);
+
+	/* AUTN = (SQN ^ AK) || AMF || MAC */
+	for (i = 0; i < 6; i++)
+		rx_sqn[i] = autn[i] ^ ak[i];
+	wpa_hexdump(MSG_DEBUG, "Milenage: SQN", rx_sqn, 6);
+
+	if (os_memcmp(rx_sqn, sqn, 6) <= 0) {
+		u8 auts_amf[2] = { 0x00, 0x00 }; /* TS 33.102 v7.0.0, 6.3.3 */
+		if (milenage_f2345(opc, k, _rand, NULL, NULL, NULL, NULL, ak))
+			return -1;
+		wpa_hexdump_key(MSG_DEBUG, "Milenage: AK*", ak, 6);
+		for (i = 0; i < 6; i++)
+			auts[i] = sqn[i] ^ ak[i];
+		if (milenage_f1(opc, k, _rand, sqn, auts_amf, NULL, auts + 6))
+			return -1;
+		wpa_hexdump(MSG_DEBUG, "Milenage: AUTS", auts, 14);
+		return -2;
+	}
+
+	amf = autn + 6;
+	wpa_hexdump(MSG_DEBUG, "Milenage: AMF", amf, 2);
+	if (milenage_f1(opc, k, _rand, rx_sqn, amf, mac_a, NULL))
+		return -1;
+
+	wpa_hexdump(MSG_DEBUG, "Milenage: MAC_A", mac_a, 8);
+
+	if (os_memcmp(mac_a, autn + 8, 8) != 0) {
+		wpa_printf(MSG_DEBUG, "Milenage: MAC mismatch");
+		wpa_hexdump(MSG_DEBUG, "Milenage: Received MAC_A",
+			    autn + 8, 8);
+		return -1;
+	}
+
+	return 0;
+}
+
+int milenage_opc_gen(u8 *opc, const u8 *k, const u8 *op)
+{
+	int i;
+
+	/* Encrypt OP using K */
+	if (aes_128_encrypt_block(k, op, opc))
+		return -1;
+
+	/* XOR the resulting Ek(OP) with OP */
+	for (i = 0; i < 16; i++)
+		opc[i] = opc[i] ^ op[i];
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/gsm/milenage/milenage.h b/src/shared/libosmocore/src/gsm/milenage/milenage.h
new file mode 100644
index 00000000..a91e946a
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/milenage/milenage.h
@@ -0,0 +1,35 @@
+/*
+ * UMTS AKA - Milenage algorithm (3GPP TS 35.205, .206, .207, .208)
+ * Copyright (c) 2006-2007 <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ */
+
+#ifndef MILENAGE_H
+#define MILENAGE_H
+
+void milenage_generate(const u8 *opc, const u8 *amf, const u8 *k,
+		       const u8 *sqn, const u8 *_rand, u8 *autn, u8 *ik,
+		       u8 *ck, u8 *res, size_t *res_len);
+int milenage_auts(const u8 *opc, const u8 *k, const u8 *_rand, const u8 *auts,
+		  u8 *sqn);
+int gsm_milenage(const u8 *opc, const u8 *k, const u8 *_rand, u8 *sres,
+		 u8 *kc);
+int milenage_check(const u8 *opc, const u8 *k, const u8 *sqn, const u8 *_rand,
+		   const u8 *autn, u8 *ik, u8 *ck, u8 *res, size_t *res_len,
+		   u8 *auts);
+int milenage_f1(const u8 *opc, const u8 *k, const u8 *_rand,
+		const u8 *sqn, const u8 *amf, u8 *mac_a, u8 *mac_s);
+int milenage_f2345(const u8 *opc, const u8 *k, const u8 *_rand,
+		   u8 *res, u8 *ck, u8 *ik, u8 *ak, u8 *akstar);
+
+int milenage_opc_gen(u8 *opc, const u8 *k, const u8 *op);
+
+#endif /* MILENAGE_H */
diff --git a/src/shared/libosmocore/src/gsm/rsl.c b/src/shared/libosmocore/src/gsm/rsl.c
new file mode 100644
index 00000000..5693b4f0
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/rsl.c
@@ -0,0 +1,507 @@
+/* GSM Radio Signalling Link messages on the A-bis interface 
+ * 3GPP TS 08.58 version 8.6.0 Release 1999 / ETSI TS 100 596 V8.6.0 */
+
+/* (C) 2008-2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <errno.h>
+
+#include <osmocom/gsm/tlv.h>
+#include <osmocom/gsm/rsl.h>
+
+/*! \addtogroup rsl
+ *  @{
+ */
+
+/*! \file rsl.c */
+
+/*! \brief Size for RSL \ref msgb_alloc */
+#define RSL_ALLOC_SIZE		200
+/*! \brief Headroom size for RSL \ref msgb_alloc */
+#define RSL_ALLOC_HEADROOM	56
+
+/*! \brief Initialize a RSL RLL header */
+void rsl_init_rll_hdr(struct abis_rsl_rll_hdr *dh, uint8_t msg_type)
+{
+	dh->c.msg_discr = ABIS_RSL_MDISC_RLL;
+	dh->c.msg_type = msg_type;
+	dh->ie_chan = RSL_IE_CHAN_NR;
+	dh->ie_link_id = RSL_IE_LINK_IDENT;
+}
+
+/*! \brief Initialize a RSL Common Channel header */
+void rsl_init_cchan_hdr(struct abis_rsl_cchan_hdr *ch, uint8_t msg_type)
+{
+	ch->c.msg_discr = ABIS_RSL_MDISC_COM_CHAN;
+	ch->c.msg_type = msg_type;
+	ch->ie_chan = RSL_IE_CHAN_NR;
+}
+
+/* \brief TLV parser definition for RSL */
+const struct tlv_definition rsl_att_tlvdef = {
+	.def = {
+		[RSL_IE_CHAN_NR]		= { TLV_TYPE_TV },
+		[RSL_IE_LINK_IDENT]		= { TLV_TYPE_TV },
+		[RSL_IE_ACT_TYPE]		= { TLV_TYPE_TV },
+		[RSL_IE_BS_POWER]		= { TLV_TYPE_TV },
+		[RSL_IE_CHAN_IDENT]		= { TLV_TYPE_TLV },
+		[RSL_IE_CHAN_MODE]		= { TLV_TYPE_TLV },
+		[RSL_IE_ENCR_INFO]		= { TLV_TYPE_TLV },
+		[RSL_IE_FRAME_NUMBER]		= { TLV_TYPE_FIXED, 2 },
+		[RSL_IE_HANDO_REF]		= { TLV_TYPE_TV },
+		[RSL_IE_L1_INFO]		= { TLV_TYPE_FIXED, 2 },
+		[RSL_IE_L3_INFO]		= { TLV_TYPE_TL16V },
+		[RSL_IE_MS_IDENTITY]		= { TLV_TYPE_TLV },
+		[RSL_IE_MS_POWER]		= { TLV_TYPE_TV },
+		[RSL_IE_PAGING_GROUP]		= { TLV_TYPE_TV },
+		[RSL_IE_PAGING_LOAD]		= { TLV_TYPE_FIXED, 2 },
+		[RSL_IE_PYHS_CONTEXT]		= { TLV_TYPE_TLV },
+		[RSL_IE_ACCESS_DELAY]		= { TLV_TYPE_TV },
+		[RSL_IE_RACH_LOAD]		= { TLV_TYPE_TLV },
+		[RSL_IE_REQ_REFERENCE]		= { TLV_TYPE_FIXED, 3 },
+		[RSL_IE_RELEASE_MODE]		= { TLV_TYPE_TV },
+		[RSL_IE_RESOURCE_INFO]		= { TLV_TYPE_TLV },
+		[RSL_IE_RLM_CAUSE]		= { TLV_TYPE_TLV },
+		[RSL_IE_STARTNG_TIME]		= { TLV_TYPE_FIXED, 2 },
+		[RSL_IE_TIMING_ADVANCE]		= { TLV_TYPE_TV },
+		[RSL_IE_UPLINK_MEAS]		= { TLV_TYPE_TLV },
+		[RSL_IE_CAUSE]			= { TLV_TYPE_TLV },
+		[RSL_IE_MEAS_RES_NR]		= { TLV_TYPE_TV },
+		[RSL_IE_MSG_ID]			= { TLV_TYPE_TV },
+		[RSL_IE_SYSINFO_TYPE]		= { TLV_TYPE_TV },
+		[RSL_IE_MS_POWER_PARAM]		= { TLV_TYPE_TLV },
+		[RSL_IE_BS_POWER_PARAM]		= { TLV_TYPE_TLV },
+		[RSL_IE_PREPROC_PARAM]		= { TLV_TYPE_TLV },
+		[RSL_IE_PREPROC_MEAS]		= { TLV_TYPE_TLV },
+		[RSL_IE_IMM_ASS_INFO]		= { TLV_TYPE_TLV },
+		[RSL_IE_SMSCB_INFO]		= { TLV_TYPE_FIXED, 23 },
+		[RSL_IE_MS_TIMING_OFFSET]	= { TLV_TYPE_TV },
+		[RSL_IE_ERR_MSG]		= { TLV_TYPE_TLV },
+		[RSL_IE_FULL_BCCH_INFO]		= { TLV_TYPE_TLV },
+		[RSL_IE_CHAN_NEEDED]		= { TLV_TYPE_TV },
+		[RSL_IE_CB_CMD_TYPE]		= { TLV_TYPE_TV },
+		[RSL_IE_SMSCB_MSG]		= { TLV_TYPE_TLV },
+		[RSL_IE_FULL_IMM_ASS_INFO]	= { TLV_TYPE_TLV },
+		[RSL_IE_SACCH_INFO]		= { TLV_TYPE_TLV },
+		[RSL_IE_CBCH_LOAD_INFO]		= { TLV_TYPE_TV },
+		[RSL_IE_SMSCB_CHAN_INDICATOR]	= { TLV_TYPE_TV },
+		[RSL_IE_GROUP_CALL_REF]		= { TLV_TYPE_TLV },
+		[RSL_IE_CHAN_DESC]		= { TLV_TYPE_TLV },
+		[RSL_IE_NCH_DRX_INFO]		= { TLV_TYPE_TLV },
+		[RSL_IE_CMD_INDICATOR]		= { TLV_TYPE_TLV },
+		[RSL_IE_EMLPP_PRIO]		= { TLV_TYPE_TV },
+		[RSL_IE_UIC]			= { TLV_TYPE_TLV },
+		[RSL_IE_MAIN_CHAN_REF]		= { TLV_TYPE_TV },
+		[RSL_IE_MR_CONFIG]		= { TLV_TYPE_TLV },
+		[RSL_IE_MR_CONTROL]		= { TLV_TYPE_TV },
+		[RSL_IE_SUP_CODEC_TYPES]	= { TLV_TYPE_TLV },
+		[RSL_IE_CODEC_CONFIG]		= { TLV_TYPE_TLV },
+		[RSL_IE_RTD]			= { TLV_TYPE_TV },
+		[RSL_IE_TFO_STATUS]		= { TLV_TYPE_TV },
+		[RSL_IE_LLP_APDU]		= { TLV_TYPE_TLV },
+		[RSL_IE_SIEMENS_MRPCI]		= { TLV_TYPE_TV },
+		[RSL_IE_IPAC_PROXY_UDP]		= { TLV_TYPE_FIXED, 2 },
+		[RSL_IE_IPAC_BSCMPL_TOUT]	= { TLV_TYPE_TV },
+		[RSL_IE_IPAC_REMOTE_IP]		= { TLV_TYPE_FIXED, 4 },
+		[RSL_IE_IPAC_REMOTE_PORT]	= { TLV_TYPE_FIXED, 2 },
+		[RSL_IE_IPAC_RTP_PAYLOAD]	= { TLV_TYPE_TV },
+		[RSL_IE_IPAC_LOCAL_PORT]	= { TLV_TYPE_FIXED, 2 },
+		[RSL_IE_IPAC_SPEECH_MODE]	= { TLV_TYPE_TV },
+		[RSL_IE_IPAC_LOCAL_IP]		= { TLV_TYPE_FIXED, 4 },
+		[RSL_IE_IPAC_CONN_ID]		= { TLV_TYPE_FIXED, 2 },
+		[RSL_IE_IPAC_RTP_CSD_FMT]	= { TLV_TYPE_TV },
+		[RSL_IE_IPAC_RTP_JIT_BUF]	= { TLV_TYPE_FIXED, 2 },
+		[RSL_IE_IPAC_RTP_COMPR]		= { TLV_TYPE_TV },
+		[RSL_IE_IPAC_RTP_PAYLOAD2]	= { TLV_TYPE_TV },
+		[RSL_IE_IPAC_RTP_MPLEX]		= { TLV_TYPE_FIXED, 8 },
+		[RSL_IE_IPAC_RTP_MPLEX_ID]	= { TLV_TYPE_TV },
+	},
+};
+
+/*! \brief Encode channel number as per Section 9.3.1 */
+uint8_t rsl_enc_chan_nr(uint8_t type, uint8_t subch, uint8_t timeslot)
+{
+	uint8_t ret;
+
+	ret = (timeslot & 0x07) | type;
+
+	switch (type) {
+	case RSL_CHAN_Lm_ACCHs:
+		subch &= 0x01;
+		break;
+	case RSL_CHAN_SDCCH4_ACCH:
+		subch &= 0x03;
+		break;
+	case RSL_CHAN_SDCCH8_ACCH:
+		subch &= 0x07;
+		break;
+	default:
+		/* no subchannels allowed */
+		subch = 0x00;
+		break;
+	}
+	ret |= (subch << 3);
+
+	return ret;
+}
+
+/*! \brief Decode RSL channel number
+ *  \param[in] chan_nr Channel Number
+ *  \param[out] type Channel Type
+ *  \param[out] subch Sub-channel Number
+ *  \param[out] timeslot Timeslot
+ */
+int rsl_dec_chan_nr(uint8_t chan_nr, uint8_t *type, uint8_t *subch, uint8_t *timeslot)
+{
+	*timeslot = chan_nr & 0x7;
+
+	if ((chan_nr & 0xf8) == RSL_CHAN_Bm_ACCHs) {
+		*type = RSL_CHAN_Bm_ACCHs;
+		*subch = 0;
+	} else if ((chan_nr & 0xf0) == RSL_CHAN_Lm_ACCHs) {
+		*type = RSL_CHAN_Lm_ACCHs;
+		*subch = (chan_nr >> 3) & 0x1;
+	} else if ((chan_nr & 0xe0) == RSL_CHAN_SDCCH4_ACCH) {
+		*type = RSL_CHAN_SDCCH4_ACCH;
+		*subch = (chan_nr >> 3) & 0x3;
+	} else if ((chan_nr & 0xc0) == RSL_CHAN_SDCCH8_ACCH) {
+		*type = RSL_CHAN_SDCCH8_ACCH;
+		*subch = (chan_nr >> 3) & 0x7;
+	} else if ((chan_nr & 0xf8) == RSL_CHAN_BCCH) {
+		*type = RSL_CHAN_BCCH;
+		*subch = 0;
+	} else if ((chan_nr & 0xf8) == RSL_CHAN_RACH) {
+		*type = RSL_CHAN_RACH;
+		*subch = 0;
+	} else if ((chan_nr & 0xf8) == RSL_CHAN_PCH_AGCH) {
+		*type = RSL_CHAN_PCH_AGCH;
+		*subch = 0;
+	} else
+		return -EINVAL;
+
+	return 0;
+}
+
+/*! \brief Get human-readable string for RSL channel number */
+const char *rsl_chan_nr_str(uint8_t chan_nr)
+{
+	static char str[20];
+	int ts = chan_nr & 7;
+	uint8_t cbits = chan_nr >> 3;
+
+	if (cbits == 0x01)
+		sprintf(str, "TCH/F on TS%d", ts);
+	else if ((cbits & 0x1e) == 0x02)
+		sprintf(str, "TCH/H(%u) on TS%d", cbits & 0x01, ts);
+	else if ((cbits & 0x1c) == 0x04)
+		sprintf(str, "SDCCH/4(%u) on TS%d", cbits & 0x03, ts);
+	else if ((cbits & 0x18) == 0x08)
+		sprintf(str, "SDCCH/8(%u) on TS%d", cbits & 0x07, ts);
+	else if (cbits == 0x10)
+		sprintf(str, "BCCH on TS%d", ts);
+	else if (cbits == 0x11)
+		sprintf(str, "RACH on TS%d", ts);
+	else if (cbits == 0x12)
+		sprintf(str, "PCH/AGCH on TS%d", ts);
+	else
+		sprintf(str, "UNKNOWN on TS%d", ts);
+
+        return str;
+}
+
+static const struct value_string rsl_err_vals[] = {
+	{ RSL_ERR_RADIO_IF_FAIL,	"Radio Interface Failure" },
+	{ RSL_ERR_RADIO_LINK_FAIL,	"Radio Link Failure" },
+	{ RSL_ERR_HANDOVER_ACC_FAIL,	"Handover Access Failure" },
+	{ RSL_ERR_TALKER_ACC_FAIL,	"Talker Access Failure" },
+	{ RSL_ERR_OM_INTERVENTION,	"O&M Intervention" },
+	{ RSL_ERR_NORMAL_UNSPEC,	"Normal event, unspecified" },
+	{ RSL_ERR_T_MSRFPCI_EXP,	"Siemens: T_MSRFPCI Expired" },
+	{ RSL_ERR_EQUIPMENT_FAIL,	"Equipment Failure" },
+	{ RSL_ERR_RR_UNAVAIL,		"Radio Resource not available" },
+	{ RSL_ERR_TERR_CH_FAIL,		"Terrestrial Channel Failure" },
+	{ RSL_ERR_CCCH_OVERLOAD,	"CCCH Overload" },
+	{ RSL_ERR_ACCH_OVERLOAD,	"ACCH Overload" },
+	{ RSL_ERR_PROCESSOR_OVERLOAD,	"Processor Overload" },
+	{ RSL_ERR_RES_UNAVAIL,		"Resource not available, unspecified" },
+	{ RSL_ERR_TRANSC_UNAVAIL,	"Transcoding not available" },
+	{ RSL_ERR_SERV_OPT_UNAVAIL,	"Service or Option not available" },
+	{ RSL_ERR_ENCR_UNIMPL,		"Encryption algorithm not implemented" },
+	{ RSL_ERR_SERV_OPT_UNIMPL,	"Service or Option not implemented" },
+	{ RSL_ERR_RCH_ALR_ACTV_ALLOC,	"Radio channel already activated" },
+	{ RSL_ERR_INVALID_MESSAGE,	"Invalid Message, unspecified" },
+	{ RSL_ERR_MSG_DISCR,		"Message Discriminator Error" },
+	{ RSL_ERR_MSG_TYPE,		"Message Type Error" },
+	{ RSL_ERR_MSG_SEQ,		"Message Sequence Error" },
+	{ RSL_ERR_IE_ERROR,		"General IE error" },
+	{ RSL_ERR_MAND_IE_ERROR,	"Mandatory IE error" },
+	{ RSL_ERR_OPT_IE_ERROR,		"Optional IE error" },
+	{ RSL_ERR_IE_NONEXIST,		"IE non-existent" },
+	{ RSL_ERR_IE_LENGTH,		"IE length error" },
+	{ RSL_ERR_IE_CONTENT,		"IE content error" },
+	{ RSL_ERR_PROTO,		"Protocol error, unspecified" },
+	{ RSL_ERR_INTERWORKING,		"Interworking error, unspecified" },
+	{ 0,				NULL }
+};
+
+/*! \brief Get human-readable name for RSL Error */
+const char *rsl_err_name(uint8_t err)
+{
+	return get_value_string(rsl_err_vals, err);
+}
+
+/* Names for Radio Link Layer Management */
+static const struct value_string rsl_msgt_names[] = {
+	{ RSL_MT_DATA_REQ,		"DATA_REQ" },
+	{ RSL_MT_DATA_IND,		"DATA_IND" },
+	{ RSL_MT_ERROR_IND,		"ERROR_IND" },
+	{ RSL_MT_EST_REQ,		"EST_REQ" },
+	{ RSL_MT_EST_CONF,		"EST_CONF" },
+	{ RSL_MT_EST_IND,		"EST_IND" },
+	{ RSL_MT_REL_REQ,		"REL_REQ" },
+	{ RSL_MT_REL_CONF,		"REL_CONF" },
+	{ RSL_MT_REL_IND,		"REL_IND" },
+	{ RSL_MT_UNIT_DATA_REQ,		"UNIT_DATA_REQ" },
+	{ RSL_MT_UNIT_DATA_IND,		"UNIT_DATA_IND" },
+	{ RSL_MT_SUSP_REQ,		"SUSP_REQ" },
+	{ RSL_MT_SUSP_CONF,		"SUSP_CONF" },
+	{ RSL_MT_RES_REQ,		"RES_REQ" },
+	{ RSL_MT_RECON_REQ,		"RECON_REQ" },
+
+	{ RSL_MT_BCCH_INFO,		"BCCH_INFO" },
+	{ RSL_MT_CCCH_LOAD_IND,		"CCCH_LOAD_IND" },
+	{ RSL_MT_CHAN_RQD,		"CHAN_RQD" },
+	{ RSL_MT_DELETE_IND,		"DELETE_IND" },
+	{ RSL_MT_PAGING_CMD,		"PAGING_CMD" },
+	{ RSL_MT_IMMEDIATE_ASSIGN_CMD,	"IMM_ASS_CMD" },
+	{ RSL_MT_SMS_BC_REQ,		"SMS_BC_REQ" },
+	{ RSL_MT_CHAN_CONF,		"CHAN_CONF" },
+
+	{ RSL_MT_RF_RES_IND,		"RF_RES_IND" },
+	{ RSL_MT_SACCH_FILL,		"SACCH_FILL" },
+	{ RSL_MT_OVERLOAD,		"OVERLOAD" },
+	{ RSL_MT_ERROR_REPORT,		"ERROR_REPORT" },
+	{ RSL_MT_SMS_BC_CMD,		"SMS_BC_CMD" },
+	{ RSL_MT_CBCH_LOAD_IND,		"CBCH_LOAD_IND" },
+	{ RSL_MT_NOT_CMD,		"NOTIFY_CMD" },
+
+	{ RSL_MT_CHAN_ACTIV,		"CHAN_ACTIV" },
+	{ RSL_MT_CHAN_ACTIV_ACK,	"CHAN_ACTIV_ACK" },
+	{ RSL_MT_CHAN_ACTIV_NACK,	"CHAN_ACTIV_NACK" },
+	{ RSL_MT_CONN_FAIL,		"CONN_FAIL" },
+	{ RSL_MT_DEACTIVATE_SACCH,	"DEACTIVATE_SACCH" },
+	{ RSL_MT_ENCR_CMD,		"ENCR_CMD" },
+	{ RSL_MT_HANDO_DET,		"HANDOVER_DETECT" },
+	{ RSL_MT_MEAS_RES,		"MEAS_RES" },
+	{ RSL_MT_MODE_MODIFY_REQ,	"MODE_MODIFY_REQ" },
+	{ RSL_MT_MODE_MODIFY_ACK,	"MODE_MODIFY_ACK" },
+	{ RSL_MT_MODE_MODIFY_NACK,	"MODE_MODIFY_NACK" },
+	{ RSL_MT_PHY_CONTEXT_REQ,	"PHY_CONTEXT_REQ" },
+	{ RSL_MT_PHY_CONTEXT_CONF,	"PHY_CONTEXT_CONF" },
+	{ RSL_MT_RF_CHAN_REL,		"RF_CHAN_REL" },
+	{ RSL_MT_MS_POWER_CONTROL,	"MS_POWER_CONTROL" },
+	{ RSL_MT_BS_POWER_CONTROL,	"BS_POWER_CONTROL" },
+	{ RSL_MT_PREPROC_CONFIG,	"PREPROC_CONFIG" },
+	{ RSL_MT_PREPROC_MEAS_RES,	"PREPROC_MEAS_RES" },
+	{ RSL_MT_RF_CHAN_REL_ACK,	"RF_CHAN_REL_ACK" },
+	{ RSL_MT_SACCH_INFO_MODIFY,	"SACCH_INFO_MODIFY" },
+	{ RSL_MT_TALKER_DET,		"TALKER_DETECT" },
+	{ RSL_MT_LISTENER_DET,		"LISTENER_DETECT" },
+	{ RSL_MT_REMOTE_CODEC_CONF_REP,	"REM_CODEC_CONF_REP" },
+	{ RSL_MT_RTD_REP,		"RTD_REQ" },
+	{ RSL_MT_PRE_HANDO_NOTIF,	"HANDO_NOTIF" },
+	{ RSL_MT_MR_CODEC_MOD_REQ,	"CODEC_MOD_REQ" },
+	{ RSL_MT_MR_CODEC_MOD_ACK,	"CODEC_MOD_ACK" },
+	{ RSL_MT_MR_CODEC_MOD_NACK,	"CODEC_MOD_NACK" },
+	{ RSL_MT_MR_CODEC_MOD_PER,	"CODEC_MODE_PER" },
+	{ RSL_MT_TFO_REP,		"TFO_REP" },
+	{ RSL_MT_TFO_MOD_REQ,		"TFO_MOD_REQ" },
+	{ RSL_MT_LOCATION_INFO,		"LOCATION_INFO" },
+	{ 0,				NULL }
+};
+
+
+/*! \brief Get human-readable string for RSL Message Type */
+const char *rsl_msg_name(uint8_t msg_type)
+{
+	return get_value_string(rsl_msgt_names, msg_type);
+}
+
+/*! \brief ip.access specific */
+static const struct value_string rsl_ipac_msgt_names[] = {
+	{ RSL_MT_IPAC_PDCH_ACT,		"IPAC_PDCH_ACT" },
+	{ RSL_MT_IPAC_PDCH_ACT_ACK,	"IPAC_PDCH_ACT_ACK" },
+	{ RSL_MT_IPAC_PDCH_ACT_NACK,	"IPAC_PDCH_ACT_NACK" },
+	{ RSL_MT_IPAC_PDCH_DEACT,	"IPAC_PDCH_DEACT" },
+	{ RSL_MT_IPAC_PDCH_DEACT_ACK,	"IPAC_PDCH_DEACT_ACK" },
+	{ RSL_MT_IPAC_PDCH_DEACT_NACK,	"IPAC_PDCH_DEACT_NACK" },
+	{ RSL_MT_IPAC_CONNECT_MUX,	"IPAC_CONNECT_MUX" },
+	{ RSL_MT_IPAC_CONNECT_MUX_ACK,	"IPAC_CONNECT_MUX_ACK" },
+	{ RSL_MT_IPAC_CONNECT_MUX_NACK,	"IPAC_CONNECT_MUX_NACK" },
+	{ RSL_MT_IPAC_BIND_MUX,		"IPAC_BIND_MUX" },
+	{ RSL_MT_IPAC_BIND_MUX_ACK,	"IPAC_BIND_MUX_ACK" },
+	{ RSL_MT_IPAC_BIND_MUX_NACK,	"IPAC_BIND_MUX_NACK" },
+	{ RSL_MT_IPAC_DISC_MUX,		"IPAC_DISC_MUX" },
+	{ RSL_MT_IPAC_DISC_MUX_ACK,	"IPAC_DISC_MUX_ACK" },
+	{ RSL_MT_IPAC_DISC_MUX_NACK,	"IPAC_DISC_MUX_NACK" },
+	{ RSL_MT_IPAC_CRCX,		"IPAC_CRCX" },
+	{ RSL_MT_IPAC_CRCX_ACK,		"IPAC_CRCX_ACK" },
+	{ RSL_MT_IPAC_CRCX_NACK,	"IPAC_CRCX_NACK" },
+	{ RSL_MT_IPAC_MDCX,		"IPAC_MDCX" },
+	{ RSL_MT_IPAC_MDCX_ACK,		"IPAC_MDCX_ACK" },
+	{ RSL_MT_IPAC_MDCX_NACK,	"IPAC_MDCX_NACK" },
+	{ RSL_MT_IPAC_DLCX_IND,		"IPAC_DLCX_IND" },
+	{ RSL_MT_IPAC_DLCX,		"IPAC_DLCX" },
+	{ RSL_MT_IPAC_DLCX_ACK,		"IPAC_DLCX_ACK" },
+	{ RSL_MT_IPAC_DLCX_NACK,	"IPAC_DLCX_NACK" },
+	{ 0, NULL }
+};
+
+/*! \brief Get human-readable name of ip.access RSL msg type */
+const char *rsl_ipac_msg_name(uint8_t msg_type)
+{
+	return get_value_string(rsl_ipac_msgt_names, msg_type);
+}
+
+static const struct value_string rsl_rlm_cause_strs[] = {
+	{ RLL_CAUSE_T200_EXPIRED,	"Timer T200 expired (N200+1) times" },
+	{ RLL_CAUSE_REEST_REQ,		"Re-establishment request" },
+	{ RLL_CAUSE_UNSOL_UA_RESP,	"Unsolicited UA response" },
+	{ RLL_CAUSE_UNSOL_DM_RESP,	"Unsolicited DM response" },
+	{ RLL_CAUSE_UNSOL_DM_RESP_MF,	"Unsolicited DM response, multiple frame" },
+	{ RLL_CAUSE_UNSOL_SPRV_RESP,	"Unsolicited supervisory response" },
+	{ RLL_CAUSE_SEQ_ERR,		"Sequence Error" },
+	{ RLL_CAUSE_UFRM_INC_PARAM,	"U-Frame with incorrect parameters" },
+	{ RLL_CAUSE_SFRM_INC_PARAM,	"S-Frame with incorrect parameters" },
+	{ RLL_CAUSE_IFRM_INC_MBITS,	"I-Frame with incorrect use of M bit" },
+	{ RLL_CAUSE_IFRM_INC_LEN,	"I-Frame with incorrect length" },
+	{ RLL_CAUSE_FRM_UNIMPL,		"Fraeme not implemented" },
+	{ RLL_CAUSE_SABM_MF,		"SABM command, multiple frame established state" },
+	{ RLL_CAUSE_SABM_INFO_NOTALL,	"SABM frame with information not allowed in this state" },
+	{ 0,				NULL },
+};
+
+/*! \brief Get human-readable string for RLM cause */
+const char *rsl_rlm_cause_name(uint8_t err)
+{
+	return get_value_string(rsl_rlm_cause_strs, err);
+}
+
+/* Section 3.3.2.3 TS 05.02. I think this looks like a table */
+int rsl_ccch_conf_to_bs_cc_chans(int ccch_conf)
+{
+	switch (ccch_conf) {
+	case RSL_BCCH_CCCH_CONF_1_NC:
+		return 1;
+	case RSL_BCCH_CCCH_CONF_1_C:
+		return 1;
+	case RSL_BCCH_CCCH_CONF_2_NC:
+		return 2;
+	case RSL_BCCH_CCCH_CONF_3_NC:
+		return 3;
+	case RSL_BCCH_CCCH_CONF_4_NC:
+		return 4;
+	default:
+		return -1;
+	}
+}
+
+/* Section 3.3.2.3 TS 05.02 */
+int rsl_ccch_conf_to_bs_ccch_sdcch_comb(int ccch_conf)
+{
+	switch (ccch_conf) {
+	case RSL_BCCH_CCCH_CONF_1_NC:
+		return 0;
+	case RSL_BCCH_CCCH_CONF_1_C:
+		return 1;
+	case RSL_BCCH_CCCH_CONF_2_NC:
+		return 0;
+	case RSL_BCCH_CCCH_CONF_3_NC:
+		return 0;
+	case RSL_BCCH_CCCH_CONF_4_NC:
+		return 0;
+	default:
+		return -1;
+	}
+}
+
+/*! \brief Push a RSL RLL header onto an existing msgb */
+void rsl_rll_push_hdr(struct msgb *msg, uint8_t msg_type, uint8_t chan_nr,
+		      uint8_t link_id, int transparent)
+{
+	struct abis_rsl_rll_hdr *rh;
+
+	rh = (struct abis_rsl_rll_hdr *) msgb_push(msg, sizeof(*rh));
+	rsl_init_rll_hdr(rh, msg_type);
+	if (transparent)
+		rh->c.msg_discr |= ABIS_RSL_MDISC_TRANSP;
+	rh->chan_nr = chan_nr;
+	rh->link_id = link_id;
+
+	/* set the l2 header pointer */
+	msg->l2h = (uint8_t *)rh;
+}
+
+/*! \brief Push a RSL RLL header with L3_INFO IE */
+void rsl_rll_push_l3(struct msgb *msg, uint8_t msg_type, uint8_t chan_nr,
+		     uint8_t link_id, int transparent)
+{
+	uint8_t l3_len = msg->tail - (uint8_t *)msgb_l3(msg);
+
+	/* construct a RSLms RLL message (DATA INDICATION, UNIT DATA
+	 * INDICATION) and send it off via RSLms */
+
+	/* Push the L3 IE tag and lengh */
+	msgb_tv16_push(msg, RSL_IE_L3_INFO, l3_len);
+
+	/* Then push the RSL header */
+	rsl_rll_push_hdr(msg, msg_type, chan_nr, link_id, transparent);
+}
+
+/*! \brief Create msgb with RSL RLL header */
+struct msgb *rsl_rll_simple(uint8_t msg_type, uint8_t chan_nr,
+			    uint8_t link_id, int transparent)
+{
+	struct abis_rsl_rll_hdr *rh;
+	struct msgb *msg;
+
+	msg = msgb_alloc_headroom(RSL_ALLOC_SIZE+RSL_ALLOC_HEADROOM,
+				  RSL_ALLOC_HEADROOM, "rsl_rll_simple");
+
+	if (!msg)
+		return NULL;
+
+	/* put the RSL header */
+	rh = (struct abis_rsl_rll_hdr *) msgb_put(msg, sizeof(*rh));
+	rsl_init_rll_hdr(rh, msg_type);
+	if (transparent)
+		rh->c.msg_discr |= ABIS_RSL_MDISC_TRANSP;
+	rh->chan_nr = chan_nr;
+	rh->link_id = link_id;
+
+	/* set the l2 header pointer */
+	msg->l2h = (uint8_t *)rh;
+
+	return msg;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsm/rxlev_stat.c b/src/shared/libosmocore/src/gsm/rxlev_stat.c
new file mode 100644
index 00000000..d226861e
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/rxlev_stat.c
@@ -0,0 +1,82 @@
+/* Rx Level statistics */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <stdint.h>
+
+#include <osmocom/core/bitvec.h>
+#include <osmocom/gsm/rxlev_stat.h>
+
+void rxlev_stat_input(struct rxlev_stats *st, uint16_t arfcn, uint8_t rxlev)
+{
+	struct bitvec bv;
+
+	if (rxlev >= NUM_RXLEVS)
+		rxlev = NUM_RXLEVS-1;
+
+	bv.data_len = NUM_ARFCNS/8;
+	bv.data = st->rxlev_buckets[rxlev];
+
+	bitvec_set_bit_pos(&bv, arfcn, ONE);
+}
+
+/* get the next ARFCN that has the specified Rxlev */
+int16_t rxlev_stat_get_next(const struct rxlev_stats *st, uint8_t rxlev, int16_t arfcn)
+{
+	struct bitvec bv;
+
+	if (rxlev >= NUM_RXLEVS)
+		rxlev = NUM_RXLEVS-1;
+
+	bv.data_len = NUM_ARFCNS/8;
+
+	if (arfcn < 0)
+		arfcn = -1;
+
+	bv.data = (uint8_t *) st->rxlev_buckets[rxlev];
+
+	return bitvec_find_bit_pos(&bv, arfcn+1, ONE);
+}
+
+void rxlev_stat_reset(struct rxlev_stats *st)
+{
+	memset(st, 0, sizeof(*st));
+}
+
+void rxlev_stat_dump(const struct rxlev_stats *st)
+{
+	int i;
+
+	for (i = NUM_RXLEVS-1; i >= 0; i--) {
+		int16_t arfcn = -1;
+
+		printf("ARFCN with RxLev %u: ", i);
+		while ((arfcn = rxlev_stat_get_next(st, i, arfcn)) >= 0) {
+			printf("%u ", arfcn);
+		}
+		printf("\n");
+	}
+}
diff --git a/src/shared/libosmocore/src/gsm/sysinfo.c b/src/shared/libosmocore/src/gsm/sysinfo.c
new file mode 100644
index 00000000..1408f6bf
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/sysinfo.c
@@ -0,0 +1,136 @@
+/* GSM 04.08 System Information (SI) encoding and decoding
+ * 3GPP TS 04.08 version 7.21.0 Release 1998 / ETSI TS 100 940 V7.21.0 */
+
+/* (C) 2008-2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <errno.h>
+#include <string.h>
+#include <stdio.h>
+
+#include <osmocom/core/bitvec.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/sysinfo.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/protocol/gsm_08_58.h>
+
+/* verify the sizes of the system information type structs */
+
+/* rest octets are not part of the struct */
+osmo_static_assert(sizeof(struct gsm48_system_information_type_header) == 3, _si_header_size);
+osmo_static_assert(sizeof(struct gsm48_rach_control) == 3, _si_rach_control);
+osmo_static_assert(sizeof(struct gsm48_system_information_type_1) == 22, _si1_size);
+osmo_static_assert(sizeof(struct gsm48_system_information_type_2) == 23, _si2_size);
+osmo_static_assert(sizeof(struct gsm48_system_information_type_3) == 19, _si3_size);
+osmo_static_assert(sizeof(struct gsm48_system_information_type_4) == 13, _si4_size);
+
+/* bs11 forgot the l2 len, 0-6 rest octets */
+osmo_static_assert(sizeof(struct gsm48_system_information_type_5) == 18, _si5_size);
+osmo_static_assert(sizeof(struct gsm48_system_information_type_6) == 11, _si6_size);
+
+osmo_static_assert(sizeof(struct gsm48_system_information_type_13) == 3, _si13_size);
+
+static const uint8_t sitype2rsl[_MAX_SYSINFO_TYPE] = {
+	[SYSINFO_TYPE_1]	= RSL_SYSTEM_INFO_1,
+	[SYSINFO_TYPE_2]	= RSL_SYSTEM_INFO_2,
+	[SYSINFO_TYPE_3]	= RSL_SYSTEM_INFO_3,
+	[SYSINFO_TYPE_4]	= RSL_SYSTEM_INFO_4,
+	[SYSINFO_TYPE_5]	= RSL_SYSTEM_INFO_5,
+	[SYSINFO_TYPE_6]	= RSL_SYSTEM_INFO_6,
+	[SYSINFO_TYPE_7]	= RSL_SYSTEM_INFO_7,
+	[SYSINFO_TYPE_8]	= RSL_SYSTEM_INFO_8,
+	[SYSINFO_TYPE_9]	= RSL_SYSTEM_INFO_9,
+	[SYSINFO_TYPE_10]	= RSL_SYSTEM_INFO_10,
+	[SYSINFO_TYPE_13]	= RSL_SYSTEM_INFO_13,
+	[SYSINFO_TYPE_16]	= RSL_SYSTEM_INFO_16,
+	[SYSINFO_TYPE_17]	= RSL_SYSTEM_INFO_17,
+	[SYSINFO_TYPE_18]	= RSL_SYSTEM_INFO_18,
+	[SYSINFO_TYPE_19]	= RSL_SYSTEM_INFO_19,
+	[SYSINFO_TYPE_20]	= RSL_SYSTEM_INFO_20,
+	[SYSINFO_TYPE_2bis]	= RSL_SYSTEM_INFO_2bis,
+	[SYSINFO_TYPE_2ter]	= RSL_SYSTEM_INFO_2ter,
+	[SYSINFO_TYPE_2quater]	= RSL_SYSTEM_INFO_2quater,
+	[SYSINFO_TYPE_5bis]	= RSL_SYSTEM_INFO_5bis,
+	[SYSINFO_TYPE_5ter]	= RSL_SYSTEM_INFO_5ter,
+	[SYSINFO_TYPE_EMO]	= RSL_EXT_MEAS_ORDER,
+	[SYSINFO_TYPE_MEAS_INFO]= RSL_MEAS_INFO,
+};
+
+static const uint8_t rsl2sitype[256] = {
+	[RSL_SYSTEM_INFO_1] = SYSINFO_TYPE_1,
+	[RSL_SYSTEM_INFO_2] = SYSINFO_TYPE_2,
+	[RSL_SYSTEM_INFO_3] = SYSINFO_TYPE_3,
+	[RSL_SYSTEM_INFO_4] = SYSINFO_TYPE_4,
+	[RSL_SYSTEM_INFO_5] = SYSINFO_TYPE_5,
+	[RSL_SYSTEM_INFO_6] = SYSINFO_TYPE_6,
+	[RSL_SYSTEM_INFO_7] = SYSINFO_TYPE_7,
+	[RSL_SYSTEM_INFO_8] = SYSINFO_TYPE_8,
+	[RSL_SYSTEM_INFO_9] = SYSINFO_TYPE_9,
+	[RSL_SYSTEM_INFO_10] = SYSINFO_TYPE_10,
+	[RSL_SYSTEM_INFO_13] = SYSINFO_TYPE_13,
+	[RSL_SYSTEM_INFO_16] = SYSINFO_TYPE_16,
+	[RSL_SYSTEM_INFO_17] = SYSINFO_TYPE_17,
+	[RSL_SYSTEM_INFO_18] = SYSINFO_TYPE_18,
+	[RSL_SYSTEM_INFO_19] = SYSINFO_TYPE_19,
+	[RSL_SYSTEM_INFO_20] = SYSINFO_TYPE_20,
+	[RSL_SYSTEM_INFO_2bis] = SYSINFO_TYPE_2bis,
+	[RSL_SYSTEM_INFO_2ter] = SYSINFO_TYPE_2ter,
+	[RSL_SYSTEM_INFO_2quater] = SYSINFO_TYPE_2quater,
+	[RSL_SYSTEM_INFO_5bis] = SYSINFO_TYPE_5bis,
+	[RSL_SYSTEM_INFO_5ter] = SYSINFO_TYPE_5ter,
+	[RSL_EXT_MEAS_ORDER] = SYSINFO_TYPE_EMO,
+	[RSL_MEAS_INFO] = SYSINFO_TYPE_MEAS_INFO,
+};
+
+const struct value_string osmo_sitype_strs[_MAX_SYSINFO_TYPE] = {
+	{ SYSINFO_TYPE_1,	"1" },
+	{ SYSINFO_TYPE_2,	"2" },
+	{ SYSINFO_TYPE_3,	"3" },
+	{ SYSINFO_TYPE_4,	"4" },
+	{ SYSINFO_TYPE_5,	"5" },
+	{ SYSINFO_TYPE_6,	"6" },
+	{ SYSINFO_TYPE_7,	"7" },
+	{ SYSINFO_TYPE_8,	"8" },
+	{ SYSINFO_TYPE_9,	"9" },
+	{ SYSINFO_TYPE_10,	"10" },
+	{ SYSINFO_TYPE_13,	"13" },
+	{ SYSINFO_TYPE_16,	"16" },
+	{ SYSINFO_TYPE_17,	"17" },
+	{ SYSINFO_TYPE_18,	"18" },
+	{ SYSINFO_TYPE_19,	"19" },
+	{ SYSINFO_TYPE_20,	"20" },
+	{ SYSINFO_TYPE_2bis,	"2bis" },
+	{ SYSINFO_TYPE_2ter,	"2ter" },
+	{ SYSINFO_TYPE_2quater,	"2quater" },
+	{ SYSINFO_TYPE_5bis,	"5bis" },
+	{ SYSINFO_TYPE_5ter,	"5ter" },
+	{ SYSINFO_TYPE_EMO,	"EMO" },
+	{ SYSINFO_TYPE_MEAS_INFO, "MI" },
+	{ 0, NULL }
+};
+
+uint8_t osmo_sitype2rsl(enum osmo_sysinfo_type si_type)
+{
+	return sitype2rsl[si_type];
+}
+
+enum osmo_sysinfo_type osmo_rsl2sitype(uint8_t rsl_si)
+{
+	return rsl2sitype[rsl_si];
+}
diff --git a/src/shared/libosmocore/src/gsm/tlv_parser.c b/src/shared/libosmocore/src/gsm/tlv_parser.c
new file mode 100644
index 00000000..d18a6bfd
--- /dev/null
+++ b/src/shared/libosmocore/src/gsm/tlv_parser.c
@@ -0,0 +1,209 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/tlv.h>
+
+/*! \addtogroup tlv
+ *  @{
+ */
+/*! \file tlv.c */
+
+struct tlv_definition tvlv_att_def;
+struct tlv_definition vtvlv_gan_att_def;
+
+/*! \brief Dump pasred TLV structure to stdout */
+int tlv_dump(struct tlv_parsed *dec)
+{
+	int i;
+
+	for (i = 0; i <= 0xff; i++) {
+		if (!dec->lv[i].val)
+			continue;
+		printf("T=%02x L=%d\n", i, dec->lv[i].len);
+	}
+	return 0;
+}
+
+/*! \brief Parse a single TLV encoded IE
+ *  \param[out] o_tag the tag of the IE that was found
+ *  \param[out] o_len length of the IE that was found
+ *  \param[out] o_val pointer to the data of the IE that was found
+ *  \param[in] def structure defining the valid TLV tags / configurations
+ *  \param[in] buf the input data buffer to be parsed
+ *  \param[in] buf_len length of the input data buffer
+ *  \returns number of bytes consumed by the TLV entry / IE parsed
+ */
+int tlv_parse_one(uint8_t *o_tag, uint16_t *o_len, const uint8_t **o_val,
+		  const struct tlv_definition *def,
+		  const uint8_t *buf, int buf_len)
+{
+	uint8_t tag;
+	int len;
+
+	tag = *buf;
+	*o_tag = tag;
+
+	/* single octet TV IE */
+	if (def->def[tag & 0xf0].type == TLV_TYPE_SINGLE_TV) {
+		*o_tag = tag & 0xf0;
+		*o_val = buf;
+		*o_len = 1;
+		return 1;
+	}
+
+	/* FIXME: use tables for knwon IEI */
+	switch (def->def[tag].type) {
+	case TLV_TYPE_T:
+		/* GSM TS 04.07 11.2.4: Type 1 TV or Type 2 T */
+		*o_val = buf;
+		*o_len = 0;
+		len = 1;
+		break;
+	case TLV_TYPE_TV:
+		*o_val = buf+1;
+		*o_len = 1;
+		len = 2;
+		break;
+	case TLV_TYPE_FIXED:
+		*o_val = buf+1;
+		*o_len = def->def[tag].fixed_len;
+		len = def->def[tag].fixed_len + 1;
+		break;
+	case TLV_TYPE_TLV:
+tlv:		/* GSM TS 04.07 11.2.4: Type 4 TLV */
+		if (buf + 1 > buf + buf_len)
+			return -1;
+		*o_val = buf+2;
+		*o_len = *(buf+1);
+		len = *o_len + 2;
+		if (len > buf_len)
+			return -2;
+		break;
+	case TLV_TYPE_vTvLV_GAN:	/* 44.318 / 11.1.4 */
+		/* FIXME: variable-length TAG! */
+		if (*(buf+1) & 0x80) {
+			/* like TL16Vbut without highest bit of len */
+			if (2 > buf_len)
+				return -1;
+			*o_val = buf+3;
+			*o_len = (*(buf+1) & 0x7F) << 8 | *(buf+2);
+			len = *o_len + 3;
+			if (len > buf_len)
+				return -2;
+		} else {
+			/* like TLV */
+			goto tlv;
+		}
+		break;
+	case TLV_TYPE_TvLV:
+		if (*(buf+1) & 0x80) {
+			/* like TLV, but without highest bit of len */
+			if (buf + 1 > buf + buf_len)
+				return -1;
+			*o_val = buf+2;
+			*o_len = *(buf+1) & 0x7f;
+			len = *o_len + 2;
+			if (len > buf_len)
+				return -2;
+			break;
+		}
+		/* like TL16V, fallthrough */
+	case TLV_TYPE_TL16V:
+		if (2 > buf_len)
+			return -1;
+		*o_val = buf+3;
+		*o_len = *(buf+1) << 8 | *(buf+2);
+		len = *o_len + 3;
+		if (len > buf_len)
+			return -2;
+		break;
+	default:
+		return -3;
+	}
+
+	return len;
+}
+
+/*! \brief Parse an entire buffer of TLV encoded Information Eleemnts
+ *  \param[out] dec caller-allocated pointer to \ref tlv_parsed
+ *  \param[in] def structure defining the valid TLV tags / configurations
+ *  \param[in] buf the input data buffer to be parsed
+ *  \param[in] buf_len length of the input data buffer
+ *  \param[in] lv_tag an initial LV tag at the start of the buffer
+ *  \param[in] lv_tag2 a second initial LV tag following the \a lv_tag
+ *  \returns number of bytes consumed by the TLV entry / IE parsed
+ */
+int tlv_parse(struct tlv_parsed *dec, const struct tlv_definition *def,
+	      const uint8_t *buf, int buf_len, uint8_t lv_tag,
+	      uint8_t lv_tag2)
+{
+	int ofs = 0, num_parsed = 0;
+	uint16_t len;
+
+	memset(dec, 0, sizeof(*dec));
+
+	if (lv_tag) {
+		if (ofs > buf_len)
+			return -1;
+		dec->lv[lv_tag].val = &buf[ofs+1];
+		dec->lv[lv_tag].len = buf[ofs];
+		len = dec->lv[lv_tag].len + 1;
+		if (ofs + len > buf_len)
+			return -2;
+		num_parsed++;
+		ofs += len;
+	}
+	if (lv_tag2) {
+		if (ofs > buf_len)
+			return -1;
+		dec->lv[lv_tag2].val = &buf[ofs+1];
+		dec->lv[lv_tag2].len = buf[ofs];
+		len = dec->lv[lv_tag2].len + 1;
+		if (ofs + len > buf_len)
+			return -2;
+		num_parsed++;
+		ofs += len;
+	}
+
+	while (ofs < buf_len) {
+		int rv;
+		uint8_t tag;
+		const uint8_t *val;
+
+		rv = tlv_parse_one(&tag, &len, &val, def,
+		                   &buf[ofs], buf_len-ofs);
+		if (rv < 0)
+			return rv;
+		dec->lv[tag].val = val;
+		dec->lv[tag].len = len;
+		ofs += rv;
+		num_parsed++;
+	}
+	//tlv_dump(dec);
+	return num_parsed;
+}
+
+/*! \brief take a master (src) tlvdev and fill up all empty slots in 'dst' */
+void tlv_def_patch(struct tlv_definition *dst, const struct tlv_definition *src)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(dst->def); i++) {
+		if (src->def[i].type == TLV_TYPE_NONE)
+			continue;
+		if (dst->def[i].type == TLV_TYPE_NONE)
+			dst->def[i] = src->def[i];
+	}
+}
+
+static __attribute__((constructor)) void on_dso_load_tlv(void)
+{
+	int i;
+	for (i = 0; i < ARRAY_SIZE(tvlv_att_def.def); i++)
+		tvlv_att_def.def[i].type = TLV_TYPE_TvLV;
+
+	for (i = 0; i < ARRAY_SIZE(vtvlv_gan_att_def.def); i++)
+		vtvlv_gan_att_def.def[i].type = TLV_TYPE_vTvLV_GAN;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/gsmtap_util.c b/src/shared/libosmocore/src/gsmtap_util.c
new file mode 100644
index 00000000..ce722da9
--- /dev/null
+++ b/src/shared/libosmocore/src/gsmtap_util.c
@@ -0,0 +1,362 @@
+/* GSMTAP support code in libmsomcore */
+/*
+ * (C) 2010-2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include "../config.h"
+
+#include <osmocom/core/gsmtap_util.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/gsmtap.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/rsl.h>
+
+#include <sys/types.h>
+
+#include <arpa/inet.h>
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+
+/*! \addtogroup gsmtap
+ *  @{
+ */
+/*! \file gsmtap_util.c */
+
+
+/*! \brief convert RSL channel number to GSMTAP channel type
+ *  \param[in] rsl_cantype RSL channel type
+ *  \param[in] link_id RSL link identifier
+ *  \returns GSMTAP channel type
+ */
+uint8_t chantype_rsl2gsmtap(uint8_t rsl_chantype, uint8_t link_id)
+{
+	uint8_t ret = GSMTAP_CHANNEL_UNKNOWN;
+
+	switch (rsl_chantype) {
+	case RSL_CHAN_Bm_ACCHs:
+		ret = GSMTAP_CHANNEL_TCH_F;
+		break;
+	case RSL_CHAN_Lm_ACCHs:
+		ret = GSMTAP_CHANNEL_TCH_H;
+		break;
+	case RSL_CHAN_SDCCH4_ACCH:
+		ret = GSMTAP_CHANNEL_SDCCH4;
+		break;
+	case RSL_CHAN_SDCCH8_ACCH:
+		ret = GSMTAP_CHANNEL_SDCCH8;
+		break;
+	case RSL_CHAN_BCCH:
+		ret = GSMTAP_CHANNEL_BCCH;
+		break;
+	case RSL_CHAN_RACH:
+		ret = GSMTAP_CHANNEL_RACH;
+		break;
+	case RSL_CHAN_PCH_AGCH:
+		/* it could also be AGCH... */
+		ret = GSMTAP_CHANNEL_PCH;
+		break;
+	}
+
+	if (link_id & 0x40)
+		ret |= GSMTAP_CHANNEL_ACCH;
+
+	return ret;
+}
+
+/*! \brief create an arbitrary type GSMTAP message
+ *  \param[in] type The GSMTAP_TYPE_xxx constant of the message to create
+ *  \param[in] arfcn GSM ARFCN (Channel Number)
+ *  \param[in] ts GSM time slot
+ *  \param[in] chan_type Channel Type
+ *  \param[in] ss Sub-slot
+ *  \param[in] fn GSM Frame Number
+ *  \param[in] signal_dbm Signal Strength (dBm)
+ *  \param[in] snr Signal/Noise Ratio (SNR)
+ *  \param[in] data Pointer to data buffer
+ *  \param[in] len Length of \ref data
+ *
+ * This function will allocate a new msgb and fill it with a GSMTAP
+ * header containing the information
+ */
+struct msgb *gsmtap_makemsg_ex(uint8_t type, uint16_t arfcn, uint8_t ts, uint8_t chan_type,
+			    uint8_t ss, uint32_t fn, int8_t signal_dbm,
+			    uint8_t snr, const uint8_t *data, unsigned int len)
+{
+	struct msgb *msg;
+	struct gsmtap_hdr *gh;
+	uint8_t *dst;
+
+	msg = msgb_alloc(sizeof(*gh) + len, "gsmtap_tx");
+	if (!msg)
+		return NULL;
+
+	gh = (struct gsmtap_hdr *) msgb_put(msg, sizeof(*gh));
+
+	gh->version = GSMTAP_VERSION;
+	gh->hdr_len = sizeof(*gh)/4;
+	gh->type = type;
+	gh->timeslot = ts;
+	gh->sub_slot = ss;
+	gh->arfcn = htons(arfcn);
+	gh->snr_db = snr;
+	gh->signal_dbm = signal_dbm;
+	gh->frame_number = htonl(fn);
+	gh->sub_type = chan_type;
+	gh->antenna_nr = 0;
+
+	dst = msgb_put(msg, len);
+	memcpy(dst, data, len);
+
+	return msg;
+}
+
+/*! \brief create L1/L2 data and put it into GSMTAP
+ *  \param[in] arfcn GSM ARFCN (Channel Number)
+ *  \param[in] ts GSM time slot
+ *  \param[in] chan_type Channel Type
+ *  \param[in] ss Sub-slot
+ *  \param[in] fn GSM Frame Number
+ *  \param[in] signal_dbm Signal Strength (dBm)
+ *  \param[in] snr Signal/Noise Ratio (SNR)
+ *  \param[in] data Pointer to data buffer
+ *  \param[in] len Length of \ref data
+ *
+ * This function will allocate a new msgb and fill it with a GSMTAP
+ * header containing the information
+ */
+struct msgb *gsmtap_makemsg(uint16_t arfcn, uint8_t ts, uint8_t chan_type,
+			    uint8_t ss, uint32_t fn, int8_t signal_dbm,
+			    uint8_t snr, const uint8_t *data, unsigned int len)
+{
+	return gsmtap_makemsg_ex(GSMTAP_TYPE_UM, arfcn, ts, chan_type,
+		ss, fn, signal_dbm, snr, data, len);
+}
+
+#ifdef HAVE_SYS_SOCKET_H
+
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+/*! \brief Create a new (sending) GSMTAP source socket 
+ *  \param[in] host host name or IP address in string format
+ *  \param[in] port UDP port number in host byte order
+ *
+ * Opens a GSMTAP source (sending) socket, conncet it to host/port and
+ * return resulting fd.  If \a host is NULL, the destination address
+ * will be localhost.  If \a port is 0, the default \ref
+ * GSMTAP_UDP_PORT will be used.
+ * */
+int gsmtap_source_init_fd(const char *host, uint16_t port)
+{
+	if (port == 0)
+		port = GSMTAP_UDP_PORT;
+	if (host == NULL)
+		host = "localhost";
+
+	return osmo_sock_init(AF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP, host, port,
+				OSMO_SOCK_F_CONNECT);
+}
+
+/*! \brief Add a local sink to an existing GSMTAP source and return fd */
+int gsmtap_source_add_sink_fd(int gsmtap_fd)
+{
+	struct sockaddr_storage ss;
+	socklen_t ss_len = sizeof(ss);
+	int rc;
+
+	rc = getpeername(gsmtap_fd, (struct sockaddr *)&ss, &ss_len);
+	if (rc < 0)
+		return rc;
+
+	if (osmo_sockaddr_is_local((struct sockaddr *)&ss, ss_len) == 1) {
+		rc = osmo_sock_init_sa((struct sockaddr *)&ss, SOCK_DGRAM,
+					IPPROTO_UDP, OSMO_SOCK_F_BIND);
+		if (rc >= 0)
+			return rc;
+	}
+
+	return -ENODEV;
+}
+
+/*! \brief Send a \ref msgb through a GSMTAP source
+ *  \param[in] gti GSMTAP instance
+ *  \param[in] msgb message buffer
+ */
+int gsmtap_sendmsg(struct gsmtap_inst *gti, struct msgb *msg)
+{
+	if (!gti)
+		return -ENODEV;
+
+	if (gti->ofd_wq_mode)
+		return osmo_wqueue_enqueue(&gti->wq, msg);
+	else {
+		/* try immediate send and return error if any */
+		int rc;
+
+		rc = write(gsmtap_inst_fd(gti), msg->data, msg->len);
+		if (rc <= 0) {
+			return rc;
+		} else if (rc >= msg->len) {
+			msgb_free(msg);
+			return 0;
+		} else {
+			/* short write */
+			return -EIO;
+		}
+	}
+}
+
+/*! \brief send an arbitrary type through GSMTAP.
+ *  See \ref gsmtap_makemsg_ex for arguments
+ */
+int gsmtap_send_ex(struct gsmtap_inst *gti, uint8_t type, uint16_t arfcn, uint8_t ts,
+		uint8_t chan_type, uint8_t ss, uint32_t fn,
+		int8_t signal_dbm, uint8_t snr, const uint8_t *data,
+		unsigned int len)
+{
+	struct msgb *msg;
+
+	if (!gti)
+		return -ENODEV;
+
+	msg = gsmtap_makemsg_ex(type, arfcn, ts, chan_type, ss, fn, signal_dbm,
+			     snr, data, len);
+	if (!msg)
+		return -ENOMEM;
+
+	return gsmtap_sendmsg(gti, msg);
+}
+
+/*! \brief send a message from L1/L2 through GSMTAP.
+ *  See \ref gsmtap_makemsg for arguments
+ */
+int gsmtap_send(struct gsmtap_inst *gti, uint16_t arfcn, uint8_t ts,
+		uint8_t chan_type, uint8_t ss, uint32_t fn,
+		int8_t signal_dbm, uint8_t snr, const uint8_t *data,
+		unsigned int len)
+{
+	return gsmtap_send_ex(gti, GSMTAP_TYPE_UM, arfcn, ts, chan_type, ss, fn,
+		signal_dbm, snr, data, len);
+}
+
+/* Callback from select layer if we can write to the socket */
+static int gsmtap_wq_w_cb(struct osmo_fd *ofd, struct msgb *msg)
+{
+	int rc;
+
+	rc = write(ofd->fd, msg->data, msg->len);
+	if (rc < 0) {
+		perror("writing msgb to gsmtap fd");
+		return rc;
+	}
+	if (rc != msg->len) {
+		perror("short write to gsmtap fd");
+		return -EIO;
+	}
+
+	return 0;
+}
+
+/* Callback from select layer if we can read from the sink socket */
+static int gsmtap_sink_fd_cb(struct osmo_fd *fd, unsigned int flags)
+{
+	int rc;
+	uint8_t buf[4096];
+
+	if (!(flags & BSC_FD_READ))
+		return 0;
+
+	rc = read(fd->fd, buf, sizeof(buf));
+	if (rc < 0) {
+		perror("reading from gsmtap sink fd");
+		return rc;
+	}
+	/* simply discard any data arriving on the socket */
+
+	return 0;
+}
+
+/*! \brief Add a local sink to an existing GSMTAP source instance */
+int gsmtap_source_add_sink(struct gsmtap_inst *gti)
+{
+	int fd;
+
+	fd = gsmtap_source_add_sink_fd(gsmtap_inst_fd(gti));
+	if (fd < 0)
+		return fd;
+
+	if (gti->ofd_wq_mode) {
+		struct osmo_fd *sink_ofd;
+
+		sink_ofd = &gti->sink_ofd;
+		sink_ofd->fd = fd;
+		sink_ofd->when = BSC_FD_READ;
+		sink_ofd->cb = gsmtap_sink_fd_cb;
+
+		osmo_fd_register(sink_ofd);
+	}
+
+	return fd;
+}
+
+
+/*! \brief Open GSMTAP source socket, connect and register osmo_fd
+ *  \param[in] host host name or IP address in string format
+ *  \param[in] port UDP port number in host byte order
+ *  \param[in] osmo_wq_mode Register \ref osmo_wqueue (1) or not (0)
+ *
+ * Open GSMTAP source (sending) socket, connect it to host/port,
+ * allocate 'struct gsmtap_inst' and optionally osmo_fd/osmo_wqueue
+ * registration.  This means it is like \ref gsmtap_init2 but integrated
+ * with libosmocore \ref select */
+struct gsmtap_inst *gsmtap_source_init(const char *host, uint16_t port,
+					int ofd_wq_mode)
+{
+	struct gsmtap_inst *gti;
+	int fd;
+
+	fd = gsmtap_source_init_fd(host, port);
+	if (fd < 0)
+		return NULL;
+
+	gti = talloc_zero(NULL, struct gsmtap_inst);
+	gti->ofd_wq_mode = ofd_wq_mode;
+	gti->wq.bfd.fd = fd;
+	gti->sink_ofd.fd = -1;
+
+	if (ofd_wq_mode) {
+		osmo_wqueue_init(&gti->wq, 64);
+		gti->wq.write_cb = &gsmtap_wq_w_cb;
+
+		osmo_fd_register(&gti->wq.bfd);
+	}
+
+	return gti;
+}
+
+#endif /* HAVE_SYS_SOCKET_H */
diff --git a/src/shared/libosmocore/src/logging.c b/src/shared/libosmocore/src/logging.c
new file mode 100644
index 00000000..f58265f7
--- /dev/null
+++ b/src/shared/libosmocore/src/logging.c
@@ -0,0 +1,772 @@
+/* Debugging/Logging support code */
+
+/* (C) 2008-2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2008 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/* \addtogroup logging
+ * @{
+ */
+
+/* \file logging.c */
+
+#include "../config.h"
+
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <ctype.h>
+
+#ifdef HAVE_STRINGS_H
+#include <strings.h>
+#endif
+#include <time.h>
+#include <errno.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/logging.h>
+
+#include <osmocom/vty/logging.h>	/* for LOGGING_STR. */
+
+struct log_info *osmo_log_info;
+
+static struct log_context log_context;
+static void *tall_log_ctx = NULL;
+LLIST_HEAD(osmo_log_target_list);
+
+#define LOGLEVEL_DEFS	6	/* Number of loglevels.*/
+
+static const struct value_string loglevel_strs[LOGLEVEL_DEFS+1] = {
+	{ 0,		"EVERYTHING" },
+	{ LOGL_DEBUG,	"DEBUG" },
+	{ LOGL_INFO,	"INFO" },
+	{ LOGL_NOTICE,	"NOTICE" },
+	{ LOGL_ERROR,	"ERROR" },
+	{ LOGL_FATAL,	"FATAL" },
+	{ 0, NULL },
+};
+
+#define INT2IDX(x)	(-1*(x)-1)
+static const struct log_info_cat internal_cat[OSMO_NUM_DLIB] = {
+	[INT2IDX(DLGLOBAL)] = {	/* -1 becomes 0 */
+		.name = "DLGLOBAL",
+		.description = "Library-internal global log family",
+		.loglevel = LOGL_NOTICE,
+		.enabled = 1,
+	},
+	[INT2IDX(DLLAPD)] = {	/* -2 becomes 1 */
+		.name = "DLLAPD",
+		.description = "LAPD in libosmogsm",
+		.loglevel = LOGL_NOTICE,
+		.enabled = 1,
+	},
+	[INT2IDX(DLINP)] = {
+		.name = "DLINP",
+		.description = "A-bis Intput Subsystem",
+		.loglevel = LOGL_NOTICE,
+		.enabled = 1,
+	},
+	[INT2IDX(DLMUX)] = {
+		.name = "DLMUX",
+		.description = "A-bis B-Subchannel TRAU Frame Multiplex",
+		.loglevel = LOGL_NOTICE,
+		.enabled = 1,
+	},
+	[INT2IDX(DLMI)] = {
+		.name = "DLMI",
+		.description = "A-bis Input Driver for Signalling",
+		.enabled = 0, .loglevel = LOGL_NOTICE,
+	},
+	[INT2IDX(DLMIB)] = {
+		.name = "DLMIB",
+		.description = "A-bis Input Driver for B-Channels (voice)",
+		.enabled = 0, .loglevel = LOGL_NOTICE,
+	},
+	[INT2IDX(DLSMS)] = {
+		.name = "DLSMS",
+		.description = "Layer3 Short Message Service (SMS)",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+		.color = "\033[1;38m",
+	},
+};
+
+/* You have to keep this in sync with the structure loglevel_strs. */
+const char *loglevel_descriptions[LOGLEVEL_DEFS+1] = {
+	"Log simply everything",
+	"Log debug messages and higher levels",
+	"Log informational messages and higher levels",
+	"Log noticable messages and higher levels",
+	"Log error messages and higher levels",
+	"Log only fatal messages",
+	NULL,
+};
+
+/* special magic for negative (library-internal) log subsystem numbers */
+static int subsys_lib2index(int subsys)
+{
+	return (subsys * -1) + (osmo_log_info->num_cat_user-1);
+}
+
+/*! \brief Parse a human-readable log level into a numeric value */
+int log_parse_level(const char *lvl)
+{
+	return get_string_value(loglevel_strs, lvl);
+}
+
+/*! \brief convert a numeric log level into human-readable string */
+const char *log_level_str(unsigned int lvl)
+{
+	return get_value_string(loglevel_strs, lvl);
+}
+
+/*! \brief parse a human-readable log category into numeric form
+ *  \param[in] category human-readable log category name
+ *  \returns numeric category value, or -EINVAL otherwise
+ */
+int log_parse_category(const char *category)
+{
+	int i;
+
+	for (i = 0; i < osmo_log_info->num_cat; ++i) {
+		if (osmo_log_info->cat[i].name == NULL)
+			continue;
+		if (!strcasecmp(osmo_log_info->cat[i].name+1, category))
+			return i;
+	}
+
+	return -EINVAL;
+}
+
+/*! \brief parse the log category mask
+ *  \param[in] target log target to be configured
+ *  \param[in] _mask log category mask string
+ *
+ * The format can be this: category1:category2:category3
+ * or category1,2:category2,3:...
+ */
+void log_parse_category_mask(struct log_target* target, const char *_mask)
+{
+	int i = 0;
+	char *mask = strdup(_mask);
+	char *category_token = NULL;
+
+	/* Disable everything to enable it afterwards */
+	for (i = 0; i < osmo_log_info->num_cat; ++i)
+		target->categories[i].enabled = 0;
+
+	category_token = strtok(mask, ":");
+	do {
+		for (i = 0; i < osmo_log_info->num_cat; ++i) {
+			size_t length, cat_length;
+			char* colon = strstr(category_token, ",");
+
+			if (!osmo_log_info->cat[i].name)
+				continue;
+
+			length = strlen(category_token);
+			cat_length = strlen(osmo_log_info->cat[i].name);
+
+			/* Use longest length not to match subocurrences. */
+			if (cat_length > length)
+				length = cat_length;
+
+			if (colon)
+			    length = colon - category_token;
+
+			if (strncasecmp(osmo_log_info->cat[i].name,
+					category_token, length) == 0) {
+				int level = 0;
+
+				if (colon)
+					level = atoi(colon+1);
+
+				target->categories[i].enabled = 1;
+				target->categories[i].loglevel = level;
+			}
+		}
+	} while ((category_token = strtok(NULL, ":")));
+
+	free(mask);
+}
+
+static const char* color(int subsys)
+{
+	if (subsys < osmo_log_info->num_cat)
+		return osmo_log_info->cat[subsys].color;
+
+	return NULL;
+}
+
+static void _output(struct log_target *target, unsigned int subsys,
+		    unsigned int level, const char *file, int line, int cont,
+		    const char *format, va_list ap)
+{
+	char buf[4096];
+	int ret, len = 0, offset = 0, rem = sizeof(buf);
+
+	/* are we using color */
+	if (target->use_color) {
+		const char *c = color(subsys);
+		if (c) {
+			ret = snprintf(buf + offset, rem, "%s", color(subsys));
+			if (ret < 0)
+				goto err;
+			OSMO_SNPRINTF_RET(ret, rem, offset, len);
+		}
+	}
+	if (!cont) {
+		if (target->print_timestamp) {
+			char *timestr;
+			time_t tm;
+			tm = time(NULL);
+			timestr = ctime(&tm);
+			timestr[strlen(timestr)-1] = '\0';
+			ret = snprintf(buf + offset, rem, "%s ", timestr);
+			if (ret < 0)
+				goto err;
+			OSMO_SNPRINTF_RET(ret, rem, offset, len);
+		}
+		if (target->print_filename) {
+			ret = snprintf(buf + offset, rem, "<%4.4x> %s:%d ",
+					subsys, file, line);
+			if (ret < 0)
+				goto err;
+			OSMO_SNPRINTF_RET(ret, rem, offset, len);
+		}
+	}
+	ret = vsnprintf(buf + offset, rem, format, ap);
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+
+	ret = snprintf(buf + offset, rem, "%s",
+			target->use_color ? "\033[0;m" : "");
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+err:
+	buf[sizeof(buf)-1] = '\0';
+	target->output(target, level, buf);
+}
+
+/*! \brief vararg version of logging function */
+void osmo_vlogp(int subsys, int level, const char *file, int line,
+		int cont, const char *format, va_list ap)
+{
+	struct log_target *tar;
+
+	if (subsys < 0)
+		subsys = subsys_lib2index(subsys);
+
+	if (subsys > osmo_log_info->num_cat)
+		subsys = DLGLOBAL;
+
+	llist_for_each_entry(tar, &osmo_log_target_list, entry) {
+		struct log_category *category;
+		int output = 0;
+		va_list bp;
+
+		category = &tar->categories[subsys];
+		/* subsystem is not supposed to be logged */
+		if (!category->enabled)
+			continue;
+
+		/* Check the global log level */
+		if (tar->loglevel != 0 && level < tar->loglevel)
+			continue;
+
+		/* Check the category log level */
+		if (tar->loglevel == 0 && category->loglevel != 0 &&
+		    level < category->loglevel)
+			continue;
+
+		/* Apply filters here... if that becomes messy we will
+		 * need to put filters in a list and each filter will
+		 * say stop, continue, output */
+		if ((tar->filter_map & LOG_FILTER_ALL) != 0)
+			output = 1;
+		else if (osmo_log_info->filter_fn)
+			output = osmo_log_info->filter_fn(&log_context,
+						       tar);
+		if (!output)
+			continue;
+
+		/* According to the manpage, vsnprintf leaves the value of ap
+		 * in undefined state. Since _output uses vsnprintf and it may
+		 * be called several times, we have to pass a copy of ap. */
+		va_copy(bp, ap);
+		_output(tar, subsys, level, file, line, cont, format, bp);
+		va_end(bp);
+	}
+}
+
+void logp(int subsys, const char *file, int line, int cont,
+	  const char *format, ...)
+{
+	va_list ap;
+
+	va_start(ap, format);
+	osmo_vlogp(subsys, LOGL_DEBUG, file, line, cont, format, ap);
+	va_end(ap);
+}
+
+void logp2(int subsys, unsigned int level, const char *file, int line, int cont, const char *format, ...)
+{
+	va_list ap;
+
+	va_start(ap, format);
+	osmo_vlogp(subsys, level, file, line, cont, format, ap);
+	va_end(ap);
+}
+
+/*! \brief Register a new log target with the logging core
+ *  \param[in] target Log target to be registered
+ */
+void log_add_target(struct log_target *target)
+{
+	llist_add_tail(&target->entry, &osmo_log_target_list);
+}
+
+/*! \brief Unregister a log target from the logging core
+ *  \param[in] target Log target to be unregistered
+ */
+void log_del_target(struct log_target *target)
+{
+	llist_del(&target->entry);
+}
+
+/*! \brief Reset (clear) the logging context */
+void log_reset_context(void)
+{
+	memset(&log_context, 0, sizeof(log_context));
+}
+
+/*! \brief Set the logging context
+ *  \param[in] ctx_nr logging context number
+ *  \param[in] value value to which the context is to be set
+ *
+ * A logging context is something like the subscriber identity to which
+ * the currently processed message relates, or the BTS through which it
+ * was received.  As soon as this data is known, it can be set using
+ * this function.  The main use of context information is for logging
+ * filters.
+ */
+int log_set_context(uint8_t ctx_nr, void *value)
+{
+	if (ctx_nr > LOG_MAX_CTX)
+		return -EINVAL;
+
+	log_context.ctx[ctx_nr] = value;
+
+	return 0;
+}
+
+/*! \brief Enable the \ref LOG_FILTER_ALL log filter
+ *  \param[in] target Log target to be affected
+ *  \param[in] all enable (1) or disable (0) the ALL filter
+ *
+ * When the \ref LOG_FILTER_ALL filter is enabled, all log messages will
+ * be printed.  It acts as a wildcard.  Setting it to \a 1 means there
+ * is no filtering.
+ */
+void log_set_all_filter(struct log_target *target, int all)
+{
+	if (all)
+		target->filter_map |= LOG_FILTER_ALL;
+	else
+		target->filter_map &= ~LOG_FILTER_ALL;
+}
+
+/*! \brief Enable or disable the use of colored output
+ *  \param[in] target Log target to be affected
+ *  \param[in] use_color Use color (1) or don't use color (0)
+ */
+void log_set_use_color(struct log_target *target, int use_color)
+{
+	target->use_color = use_color;
+}
+
+/*! \brief Enable or disable printing of timestamps while logging
+ *  \param[in] target Log target to be affected
+ *  \param[in] print_timestamp Enable (1) or disable (0) timestamps
+ */
+void log_set_print_timestamp(struct log_target *target, int print_timestamp)
+{
+	target->print_timestamp = print_timestamp;
+}
+
+/*! \brief Enable or disable printing of the filename while logging
+ *  \param[in] target Log target to be affected
+ *  \param[in] print_filename Enable (1) or disable (0) filenames
+ */
+void log_set_print_filename(struct log_target *target, int print_filename)
+{
+	target->print_filename = print_filename;
+}
+
+/*! \brief Set the global log level for a given log target
+ *  \param[in] target Log target to be affected
+ *  \param[in] log_level New global log level
+ */
+void log_set_log_level(struct log_target *target, int log_level)
+{
+	target->loglevel = log_level;
+}
+
+void log_set_category_filter(struct log_target *target, int category,
+			       int enable, int level)
+{
+	if (category >= osmo_log_info->num_cat)
+		return;
+	target->categories[category].enabled = !!enable;
+	target->categories[category].loglevel = level;
+}
+
+static void _file_output(struct log_target *target, unsigned int level,
+			 const char *log)
+{
+	fprintf(target->tgt_file.out, "%s", log);
+	fflush(target->tgt_file.out);
+}
+
+/*! \brief Create a new log target skeleton */
+struct log_target *log_target_create(void)
+{
+	struct log_target *target;
+	unsigned int i;
+
+	target = talloc_zero(tall_log_ctx, struct log_target);
+	if (!target)
+		return NULL;
+
+	target->categories = talloc_zero_array(target, 
+						struct log_category,
+						osmo_log_info->num_cat);
+	if (!target->categories) {
+		talloc_free(target);
+		return NULL;
+	}
+
+	INIT_LLIST_HEAD(&target->entry);
+
+	/* initialize the per-category enabled/loglevel from defaults */
+	for (i = 0; i < osmo_log_info->num_cat; i++) {
+		struct log_category *cat = &target->categories[i];
+		cat->enabled = osmo_log_info->cat[i].enabled;
+		cat->loglevel = osmo_log_info->cat[i].loglevel;
+	}
+
+	/* global settings */
+	target->use_color = 1;
+	target->print_timestamp = 0;
+	target->print_filename = 1;
+
+	/* global log level */
+	target->loglevel = 0;
+	return target;
+}
+
+/*! \brief Create the STDERR log target */
+struct log_target *log_target_create_stderr(void)
+{
+/* since C89/C99 says stderr is a macro, we can safely do this! */
+#ifdef stderr
+	struct log_target *target;
+
+	target = log_target_create();
+	if (!target)
+		return NULL;
+
+	target->type = LOG_TGT_TYPE_STDERR;
+	target->tgt_file.out = stderr;
+	target->output = _file_output;
+	return target;
+#else
+	return NULL;
+#endif /* stderr */
+}
+
+/*! \brief Create a new file-based log target
+ *  \param[in] fname File name of the new log file
+ *  \returns Log target in case of success, NULL otherwise
+ */
+struct log_target *log_target_create_file(const char *fname)
+{
+	struct log_target *target;
+
+	target = log_target_create();
+	if (!target)
+		return NULL;
+
+	target->type = LOG_TGT_TYPE_FILE;
+	target->tgt_file.out = fopen(fname, "a");
+	if (!target->tgt_file.out)
+		return NULL;
+
+	target->output = _file_output;
+
+	target->tgt_file.fname = talloc_strdup(target, fname);
+
+	return target;
+}
+
+/*! \brief Find a registered log target
+ *  \param[in] type Log target type
+ *  \param[in] fname File name
+ *  \returns Log target (if found), NULL otherwise
+ */
+struct log_target *log_target_find(int type, const char *fname)
+{
+	struct log_target *tgt;
+
+	llist_for_each_entry(tgt, &osmo_log_target_list, entry) {
+		if (tgt->type != type)
+			continue;
+		if (tgt->type == LOG_TGT_TYPE_FILE) {
+			if (!strcmp(fname, tgt->tgt_file.fname))
+				return tgt;
+		} else
+			return tgt;
+	}
+	return NULL;
+}
+
+/*! \brief Unregister, close and delete a log target */
+void log_target_destroy(struct log_target *target)
+{
+
+	/* just in case, to make sure we don't have any references */
+	log_del_target(target);
+
+	if (target->output == &_file_output) {
+/* since C89/C99 says stderr is a macro, we can safely do this! */
+#ifdef stderr
+		/* don't close stderr */
+		if (target->tgt_file.out != stderr)
+#endif
+		{
+			fclose(target->tgt_file.out);
+			target->tgt_file.out = NULL;
+		}
+	}
+
+	talloc_free(target);
+}
+
+/*! \brief close and re-open a log file (for log file rotation) */
+int log_target_file_reopen(struct log_target *target)
+{
+	fclose(target->tgt_file.out);
+
+	target->tgt_file.out = fopen(target->tgt_file.fname, "a");
+	if (!target->tgt_file.out)
+		return -errno;
+
+	/* we assume target->output already to be set */
+
+	return 0;
+}
+
+/*! \brief Generates the logging command string for VTY
+ *  \param[in] unused_info Deprecated parameter, no longer used!
+ */
+const char *log_vty_command_string(const struct log_info *unused_info)
+{
+	struct log_info *info = osmo_log_info;
+	int len = 0, offset = 0, ret, i, rem;
+	int size = strlen("logging level () ()") + 1;
+	char *str;
+
+	for (i = 0; i < info->num_cat; i++) {
+		if (info->cat[i].name == NULL)
+			continue;
+		size += strlen(info->cat[i].name) + 1;
+	}
+
+	for (i = 0; i < LOGLEVEL_DEFS; i++)
+		size += strlen(loglevel_strs[i].str) + 1;
+
+	rem = size;
+	str = talloc_zero_size(tall_log_ctx, size);
+	if (!str)
+		return NULL;
+
+	ret = snprintf(str + offset, rem, "logging level (all|");
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+
+	for (i = 0; i < info->num_cat; i++) {
+		if (info->cat[i].name) {
+			int j, name_len = strlen(info->cat[i].name)+1;
+			char name[name_len];
+
+			for (j = 0; j < name_len; j++)
+				name[j] = tolower(info->cat[i].name[j]);
+
+			name[name_len-1] = '\0';
+			ret = snprintf(str + offset, rem, "%s|", name+1);
+			if (ret < 0)
+				goto err;
+			OSMO_SNPRINTF_RET(ret, rem, offset, len);
+		}
+	}
+	offset--;	/* to remove the trailing | */
+	rem++;
+
+	ret = snprintf(str + offset, rem, ") (");
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+
+	for (i = 0; i < LOGLEVEL_DEFS; i++) {
+		int j, loglevel_str_len = strlen(loglevel_strs[i].str)+1;
+		char loglevel_str[loglevel_str_len];
+
+		for (j = 0; j < loglevel_str_len; j++)
+			loglevel_str[j] = tolower(loglevel_strs[i].str[j]);
+
+		loglevel_str[loglevel_str_len-1] = '\0';
+		ret = snprintf(str + offset, rem, "%s|", loglevel_str);
+		if (ret < 0)
+			goto err;
+		OSMO_SNPRINTF_RET(ret, rem, offset, len);
+	}
+	offset--;	/* to remove the trailing | */
+	rem++;
+
+	ret = snprintf(str + offset, rem, ")");
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+err:
+	str[size-1] = '\0';
+	return str;
+}
+
+/*! \brief Generates the logging command description for VTY
+ *  \param[in] unused_info Deprecated parameter, no longer used!
+ */
+const char *log_vty_command_description(const struct log_info *unused_info)
+{
+	struct log_info *info = osmo_log_info;
+	char *str;
+	int i, ret, len = 0, offset = 0, rem;
+	unsigned int size =
+		strlen(LOGGING_STR
+		       "Set the log level for a specified category\n") + 1;
+
+	for (i = 0; i < info->num_cat; i++) {
+		if (info->cat[i].name == NULL)
+			continue;
+		size += strlen(info->cat[i].description) + 1;
+	}
+
+	for (i = 0; i < LOGLEVEL_DEFS; i++)
+		size += strlen(loglevel_descriptions[i]) + 1;
+
+	size += strlen("Global setting for all subsystems") + 1;
+	rem = size;
+	str = talloc_zero_size(tall_log_ctx, size);
+	if (!str)
+		return NULL;
+
+	ret = snprintf(str + offset, rem, LOGGING_STR
+			"Set the log level for a specified category\n");
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+
+	ret = snprintf(str + offset, rem,
+			"Global setting for all subsystems\n");
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+
+	for (i = 0; i < info->num_cat; i++) {
+		if (info->cat[i].name == NULL)
+			continue;
+		ret = snprintf(str + offset, rem, "%s\n",
+				info->cat[i].description);
+		if (ret < 0)
+			goto err;
+		OSMO_SNPRINTF_RET(ret, rem, offset, len);
+	}
+	for (i = 0; i < LOGLEVEL_DEFS; i++) {
+		ret = snprintf(str + offset, rem, "%s\n",
+				loglevel_descriptions[i]);
+		if (ret < 0)
+			goto err;
+		OSMO_SNPRINTF_RET(ret, rem, offset, len);
+	}
+err:
+	str[size-1] = '\0';
+	return str;
+}
+
+/*! \brief Initialize the Osmocom logging core
+ *  \param[in] inf Information regarding logging categories
+ *  \param[in] ctx \ref talloc context for logging allocations
+ *  \returns 0 in case of success, negative in case of error
+ */
+int log_init(const struct log_info *inf, void *ctx)
+{
+	int i;
+
+	tall_log_ctx = talloc_named_const(ctx, 1, "logging");
+	if (!tall_log_ctx)
+		return -ENOMEM;
+
+	osmo_log_info = talloc_zero(tall_log_ctx, struct log_info);
+	if (!osmo_log_info)
+		return -ENOMEM;
+
+	osmo_log_info->num_cat_user = inf->num_cat;
+	/* total number = number of user cat + library cat */
+	osmo_log_info->num_cat = inf->num_cat + ARRAY_SIZE(internal_cat);
+
+	osmo_log_info->cat = talloc_zero_array(osmo_log_info,
+					struct log_info_cat,
+					osmo_log_info->num_cat);
+	if (!osmo_log_info->cat) {
+		talloc_free(osmo_log_info);
+		osmo_log_info = NULL;
+		return -ENOMEM;
+	}
+
+	/* copy over the user part */
+	for (i = 0; i < inf->num_cat; i++) {
+		memcpy((struct log_info_cat *) &osmo_log_info->cat[i],
+			&inf->cat[i],
+			sizeof(struct log_info_cat));
+	}
+
+	/* copy over the library part */
+	for (i = 0; i < ARRAY_SIZE(internal_cat); i++) {
+		unsigned int cn = osmo_log_info->num_cat_user + i;
+		memcpy((struct log_info_cat *) &osmo_log_info->cat[cn],
+			&internal_cat[i], sizeof(struct log_info_cat));
+	}
+
+	return 0;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/logging_syslog.c b/src/shared/libosmocore/src/logging_syslog.c
new file mode 100644
index 00000000..5b0ae5ff
--- /dev/null
+++ b/src/shared/libosmocore/src/logging_syslog.c
@@ -0,0 +1,92 @@
+/* Syslog logging support code */
+
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \addtogroup logging
+ *  @{
+ */
+
+/*! \file logging_syslog.c */
+
+#include "../config.h"
+
+#ifdef HAVE_SYSLOG_H
+
+#include <stdarg.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <syslog.h>
+
+#ifdef HAVE_STRINGS_H
+#include <strings.h>
+#endif
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/logging.h>
+
+static int logp2syslog_level(unsigned int level)
+{
+	if (level >= LOGL_FATAL)
+		return LOG_CRIT;
+	else if (level >= LOGL_ERROR)
+		return LOG_ERR;
+	else if (level >= LOGL_NOTICE)
+		return LOG_NOTICE;
+	else if (level >= LOGL_INFO)
+		return LOG_INFO;
+	else
+		return LOG_DEBUG;
+}
+
+static void _syslog_output(struct log_target *target,
+			   unsigned int level, const char *log)
+{
+	syslog(logp2syslog_level(level), "%s", log);
+}
+
+/*! \brief Create a new logging target for syslog logging
+ *  \param[in] ident syslog string identifier
+ *  \param[in] option syslog options
+ *  \param[in] facility syslog facility
+ *  \returns Log target in case of success, NULL in case of error
+ */
+struct log_target *log_target_create_syslog(const char *ident, int option,
+					    int facility)
+{
+	struct log_target *target;
+
+	target = log_target_create();
+	if (!target)
+		return NULL;
+
+	target->tgt_syslog.facility = facility;
+	target->type = LOG_TGT_TYPE_SYSLOG;
+	target->output = _syslog_output;
+
+	openlog(ident, option, facility);
+
+	return target;
+}
+
+#endif /* HAVE_SYSLOG_H */
+
+/* @} */
diff --git a/src/shared/libosmocore/src/msgb.c b/src/shared/libosmocore/src/msgb.c
new file mode 100644
index 00000000..c8564dbb
--- /dev/null
+++ b/src/shared/libosmocore/src/msgb.c
@@ -0,0 +1,156 @@
+/* (C) 2008 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \addtogroup msgb
+ *  @{
+ */
+
+/*! \file msgb.c
+ */
+
+#include <unistd.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <osmocom/core/msgb.h>
+//#include <openbsc/gsm_data.h>
+#include <osmocom/core/talloc.h>
+//#include <openbsc/debug.h>
+
+void *tall_msgb_ctx;
+
+/*! \brief Allocate a new message buffer
+ * \param[in] size Length in octets, including headroom
+ * \param[in] name Human-readable name to be associated with msgb
+ *
+ * This function allocates a 'struct msgb' as well as the underlying
+ * memory buffer for the actual message data (size specified by \a size)
+ * using the talloc memory context previously set by \ref msgb_set_talloc_ctx
+ */
+struct msgb *msgb_alloc(uint16_t size, const char *name)
+{
+	struct msgb *msg;
+
+	msg = _talloc_zero(tall_msgb_ctx, sizeof(*msg) + size, name);
+
+	if (!msg) {
+		//LOGP(DRSL, LOGL_FATAL, "unable to allocate msgb\n");
+		return NULL;
+	}
+
+	msg->data_len = size;
+	msg->len = 0;
+	msg->data = msg->_data;
+	msg->head = msg->_data;
+	msg->tail = msg->_data;
+
+	return msg;
+}
+
+/*! \brief Release given message buffer
+ * \param[in] m Message buffer to be free'd
+ */
+void msgb_free(struct msgb *m)
+{
+	talloc_free(m);
+}
+
+/*! \brief Enqueue message buffer to tail of a queue
+ * \param[in] queue linked list header of queue
+ * \param[in] msgb message buffer to be added to the queue
+ *
+ * The function will append the specified message buffer \a msg to the
+ * queue implemented by \ref llist_head \a queue
+ */
+void msgb_enqueue(struct llist_head *queue, struct msgb *msg)
+{
+	llist_add_tail(&msg->list, queue);
+}
+
+/*! \brief Dequeue message buffer from head of queue
+ * \param[in] queue linked list header of queue
+ * \returns message buffer (if any) or NULL if queue empty
+ *
+ * The function will remove the first message buffer from the queue
+ * implemented by 'ref llist_head \a queue.
+ */
+struct msgb *msgb_dequeue(struct llist_head *queue)
+{
+	struct llist_head *lh;
+
+	if (llist_empty(queue))
+		return NULL;
+
+	lh = queue->next;
+	llist_del(lh);
+	
+	return llist_entry(lh, struct msgb, list);
+}
+
+/*! \brief Re-set all message buffer pointers
+ *  \param[in] m message buffer that is to be resetted
+ *
+ * This will re-set the various internal pointers into the underlying
+ * message buffer, i.e. remvoe all headroom and treat the msgb as
+ * completely empty.  It also initializes the control buffer to zero.
+ */
+void msgb_reset(struct msgb *msg)
+{
+	msg->len = 0;
+	msg->data = msg->_data;
+	msg->head = msg->_data;
+	msg->tail = msg->_data;
+
+	msg->trx = NULL;
+	msg->lchan = NULL;
+	msg->l2h = NULL;
+	msg->l3h = NULL;
+	msg->l4h = NULL;
+
+	memset(&msg->cb, 0, sizeof(msg->cb));
+}
+
+/*! \brief get pointer to data section of message buffer
+ *  \param[in] msg message buffer
+ *  \returns pointer to data section of message buffer
+ */
+uint8_t *msgb_data(const struct msgb *msg)
+{
+	return msg->data;
+}
+
+/*! \brief get length of message buffer
+ *  \param[in] msg message buffer
+ *  \returns length of data section in message buffer
+ */
+uint16_t msgb_length(const struct msgb *msg)
+{
+	return msg->len;
+}
+
+/*! \brief Set the talloc context for \ref msgb_alloc
+ *  \param[in] ctx talloc context to be used as root for msgb allocations
+ */
+void msgb_set_talloc_ctx(void *ctx)
+{
+	tall_msgb_ctx = ctx;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/msgfile.c b/src/shared/libosmocore/src/msgfile.c
new file mode 100644
index 00000000..d2b180d7
--- /dev/null
+++ b/src/shared/libosmocore/src/msgfile.c
@@ -0,0 +1,123 @@
+/*
+ * Parse a simple file with messages, e.g used for USSD messages
+ *
+ * (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/core/msgfile.h>
+#include <osmocom/core/talloc.h>
+
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <string.h>
+
+static struct osmo_config_entry *
+alloc_entry(struct osmo_config_list *entries,
+	    const char *mcc, const char *mnc,
+	    const char *option, const char *text)
+{
+	struct osmo_config_entry *entry =
+		talloc_zero(entries, struct osmo_config_entry);
+	if (!entry)
+		return NULL;
+
+	entry->mcc = talloc_strdup(entry, mcc);
+	entry->mnc = talloc_strdup(entry, mnc);
+	entry->option = talloc_strdup(entry, option);
+	entry->text = talloc_strdup(entry, text);
+
+	llist_add_tail(&entry->list, &entries->entry);
+	return entry;
+}
+
+static struct osmo_config_list *alloc_entries(void *ctx)
+{
+	struct osmo_config_list *entries;
+
+	entries = talloc_zero(ctx, struct osmo_config_list);
+	if (!entries)
+		return NULL;
+
+	INIT_LLIST_HEAD(&entries->entry);
+	return entries;
+}
+
+/*
+ * split a line like 'foo:Text'.
+ */
+static void handle_line(struct osmo_config_list *entries, char *line)
+{
+	int i;
+	const int len = strlen(line);
+
+	char *items[3];
+	int last_item = 0;
+
+	/* Skip comments from the file */
+	if (line[0] == '#')
+		return;
+
+	for (i = 0; i < len; ++i) {
+		if (line[i] == '\n' || line[i] == '\r')
+			line[i] = '\0';
+		else if (line[i] == ':' && last_item < 3) {
+			line[i] = '\0';
+
+			items[last_item++] = &line[i + 1];
+		}
+	}
+
+	if (last_item == 3) {
+		alloc_entry(entries, &line[0] , items[0], items[1], items[2]);
+		return;
+	}
+
+	/* nothing found */
+}
+
+struct osmo_config_list *osmo_config_list_parse(void *ctx, const char *filename)
+{
+	struct osmo_config_list *entries;
+	size_t n;
+	char *line;
+	FILE *file;
+
+	file = fopen(filename, "r");
+	if (!file)
+		return NULL;
+
+	entries = alloc_entries(ctx);
+	if (!entries) {
+		fclose(file);
+		return NULL;
+	}
+
+	n = 2342;
+	line = NULL;
+        while (getline(&line, &n, file) != -1) {
+		handle_line(entries, line);
+		free(line);
+		line = NULL;
+	}
+
+	fclose(file);
+	return entries;
+}
diff --git a/src/shared/libosmocore/src/panic.c b/src/shared/libosmocore/src/panic.c
new file mode 100644
index 00000000..be644ff1
--- /dev/null
+++ b/src/shared/libosmocore/src/panic.c
@@ -0,0 +1,82 @@
+/* Panic handling */
+/*
+ * (C) 2010 by Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \addtogroup utils
+ *  @{
+ */
+
+/*! \file panic.c */
+
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/panic.h>
+#include <osmocom/core/backtrace.h>
+
+#include "../config.h"
+
+
+static osmo_panic_handler_t osmo_panic_handler = (void*)0;
+
+
+#ifndef PANIC_INFLOOP
+
+#include <stdio.h>
+#include <stdlib.h>
+
+static void osmo_panic_default(const char *fmt, va_list args)
+{
+	vfprintf(stderr, fmt, args);
+	osmo_generate_backtrace();
+	abort();
+}
+
+#else
+
+static void osmo_panic_default(const char *fmt, va_list args)
+{
+	while (1);
+}
+
+#endif
+
+
+/*! \brief Terminate the current program with a panic */
+void osmo_panic(const char *fmt, ...)
+{
+	va_list args;
+
+	va_start(args, fmt);
+
+	if (osmo_panic_handler)
+		osmo_panic_handler(fmt, args);
+	else
+		osmo_panic_default(fmt, args);
+
+	va_end(args);
+}
+ 
+
+/*! \brief Set the panic handler */
+void osmo_set_panic_handler(osmo_panic_handler_t h)
+{
+	osmo_panic_handler = h;
+}
+
diff --git a/src/shared/libosmocore/src/plugin.c b/src/shared/libosmocore/src/plugin.c
new file mode 100644
index 00000000..998bca35
--- /dev/null
+++ b/src/shared/libosmocore/src/plugin.c
@@ -0,0 +1,62 @@
+/* plugin infrastructure */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include "../config.h"
+
+#if HAVE_DLFCN_H
+
+#include <dirent.h>
+#include <dlfcn.h>
+#include <stdio.h>
+#include <errno.h>
+#include <limits.h>
+
+#include <osmocom/core/plugin.h>
+
+int osmo_plugin_load_all(const char *directory)
+{
+	unsigned int num = 0;
+	char fname[PATH_MAX];
+	DIR *dir;
+	struct dirent *entry;
+
+	dir = opendir(directory);
+	if (!dir)
+		return -errno;
+
+	while ((entry = readdir(dir))) {
+		snprintf(fname, sizeof(fname), "%s/%s", directory,
+			entry->d_name);
+		if (dlopen(fname, RTLD_NOW))
+			num++;
+	}
+
+	closedir(dir);
+
+	return num;
+}
+#else
+int osmo_plugin_load_all(const char *directory)
+{
+	return 0;
+}
+#endif /* HAVE_DLFCN_H */
diff --git a/src/shared/libosmocore/src/rate_ctr.c b/src/shared/libosmocore/src/rate_ctr.c
new file mode 100644
index 00000000..8a232e86
--- /dev/null
+++ b/src/shared/libosmocore/src/rate_ctr.c
@@ -0,0 +1,180 @@
+/* utility routines for keeping conters about events and the event rates */
+
+/* (C) 2009-2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*! \addtogroup rate_ctr
+ *  @{
+ */
+
+/*! \file rate_ctr.c */
+
+
+#include <stdint.h>
+#include <string.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/rate_ctr.h>
+
+static LLIST_HEAD(rate_ctr_groups);
+
+static void *tall_rate_ctr_ctx;
+
+/*! \brief Allocate a new group of counters according to description
+ *  \param[in] ctx \ref talloc context
+ *  \param[in] desc Rate counter group description
+ *  \param[in] idx Index of new counter group
+ */
+struct rate_ctr_group *rate_ctr_group_alloc(void *ctx,
+					    const struct rate_ctr_group_desc *desc,
+					    unsigned int idx)
+{
+	unsigned int size;
+	struct rate_ctr_group *group;
+
+	size = sizeof(struct rate_ctr_group) +
+			desc->num_ctr * sizeof(struct rate_ctr);
+
+	if (!ctx)
+		ctx = tall_rate_ctr_ctx;
+
+	group = talloc_zero_size(ctx, size);
+	if (!group)
+		return NULL;
+
+	group->desc = desc;
+	group->idx = idx;
+
+	llist_add(&group->list, &rate_ctr_groups);
+
+	return group;
+}
+
+/*! \brief Free the memory for the specified group of counters */
+void rate_ctr_group_free(struct rate_ctr_group *grp)
+{
+	llist_del(&grp->list);
+	talloc_free(grp);
+}
+
+/*! \brief Add a number to the counter */
+void rate_ctr_add(struct rate_ctr *ctr, int inc)
+{
+	ctr->current += inc;
+}
+
+static void interval_expired(struct rate_ctr *ctr, enum rate_ctr_intv intv)
+{
+	/* calculate rate over last interval */
+	ctr->intv[intv].rate = ctr->current - ctr->intv[intv].last;
+	/* save current counter for next interval */
+	ctr->intv[intv].last = ctr->current;
+
+	/* update the rate of the next bigger interval.  This will
+	 * be overwritten when that next larger interval expires */
+	if (intv + 1 < ARRAY_SIZE(ctr->intv))
+		ctr->intv[intv+1].rate += ctr->intv[intv].rate;
+}
+
+static struct osmo_timer_list rate_ctr_timer;
+static uint64_t timer_ticks;
+
+/* The one-second interval has expired */
+static void rate_ctr_group_intv(struct rate_ctr_group *grp)
+{
+	unsigned int i;
+
+	for (i = 0; i < grp->desc->num_ctr; i++) {
+		struct rate_ctr *ctr = &grp->ctr[i];
+
+		interval_expired(ctr, RATE_CTR_INTV_SEC);
+		if ((timer_ticks % 60) == 0)
+			interval_expired(ctr, RATE_CTR_INTV_MIN);
+		if ((timer_ticks % (60*60)) == 0)
+			interval_expired(ctr, RATE_CTR_INTV_HOUR);
+		if ((timer_ticks % (24*60*60)) == 0)
+			interval_expired(ctr, RATE_CTR_INTV_DAY);
+	}
+}
+
+static void rate_ctr_timer_cb(void *data)
+{
+	struct rate_ctr_group *ctrg;
+
+	/* Increment number of ticks before we calculate intervals,
+	 * as a counter value of 0 would already wrap all counters */
+	timer_ticks++;
+
+	llist_for_each_entry(ctrg, &rate_ctr_groups, list)
+		rate_ctr_group_intv(ctrg);
+
+	osmo_timer_schedule(&rate_ctr_timer, 1, 0);
+}
+
+/*! \brief Initialize the counter module */
+int rate_ctr_init(void *tall_ctx)
+{
+	tall_rate_ctr_ctx = tall_ctx;
+	rate_ctr_timer.cb = rate_ctr_timer_cb;
+	osmo_timer_schedule(&rate_ctr_timer, 1, 0);
+
+	return 0;
+}
+
+/*! \brief Search for counter group based on group name and index */
+struct rate_ctr_group *rate_ctr_get_group_by_name_idx(const char *name, const unsigned int idx)
+{
+	struct rate_ctr_group *ctrg;
+
+	llist_for_each_entry(ctrg, &rate_ctr_groups, list) {
+		if (!ctrg->desc)
+			continue;
+
+		if (!strcmp(ctrg->desc->group_name_prefix, name) &&
+				ctrg->idx == idx) {
+			return ctrg;
+		}
+	}
+	return NULL;
+}
+
+/*! \brief Search for counter group based on group name */
+const struct rate_ctr *rate_ctr_get_by_name(const struct rate_ctr_group *ctrg, const char *name)
+{
+	int i;
+	const struct rate_ctr_desc *ctr_desc;
+
+	if (!ctrg->desc)
+		return NULL;
+
+	for (i = 0; i < ctrg->desc->num_ctr; i++) {
+		ctr_desc = &ctrg->desc->ctr_desc[i];
+
+		if (!strcmp(ctr_desc->name, name)) {
+			return &ctrg->ctr[i];
+		}
+	}
+	return NULL;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/rbtree.c b/src/shared/libosmocore/src/rbtree.c
new file mode 100644
index 00000000..4e7c0f3a
--- /dev/null
+++ b/src/shared/libosmocore/src/rbtree.c
@@ -0,0 +1,383 @@
+/*
+  Red Black Trees
+  (C) 1999  Andrea Arcangeli <andrea@suse.de>
+  (C) 2002  David Woodhouse <dwmw2@infradead.org>
+  
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+  linux/lib/rbtree.c
+*/
+
+#include <osmocom/core/linuxrbtree.h>
+
+static void __rb_rotate_left(struct rb_node *node, struct rb_root *root)
+{
+	struct rb_node *right = node->rb_right;
+	struct rb_node *parent = rb_parent(node);
+
+	if ((node->rb_right = right->rb_left))
+		rb_set_parent(right->rb_left, node);
+	right->rb_left = node;
+
+	rb_set_parent(right, parent);
+
+	if (parent)
+	{
+		if (node == parent->rb_left)
+			parent->rb_left = right;
+		else
+			parent->rb_right = right;
+	}
+	else
+		root->rb_node = right;
+	rb_set_parent(node, right);
+}
+
+static void __rb_rotate_right(struct rb_node *node, struct rb_root *root)
+{
+	struct rb_node *left = node->rb_left;
+	struct rb_node *parent = rb_parent(node);
+
+	if ((node->rb_left = left->rb_right))
+		rb_set_parent(left->rb_right, node);
+	left->rb_right = node;
+
+	rb_set_parent(left, parent);
+
+	if (parent)
+	{
+		if (node == parent->rb_right)
+			parent->rb_right = left;
+		else
+			parent->rb_left = left;
+	}
+	else
+		root->rb_node = left;
+	rb_set_parent(node, left);
+}
+
+void rb_insert_color(struct rb_node *node, struct rb_root *root)
+{
+	struct rb_node *parent, *gparent;
+
+	while ((parent = rb_parent(node)) && rb_is_red(parent))
+	{
+		gparent = rb_parent(parent);
+
+		if (parent == gparent->rb_left)
+		{
+			{
+				register struct rb_node *uncle = gparent->rb_right;
+				if (uncle && rb_is_red(uncle))
+				{
+					rb_set_black(uncle);
+					rb_set_black(parent);
+					rb_set_red(gparent);
+					node = gparent;
+					continue;
+				}
+			}
+
+			if (parent->rb_right == node)
+			{
+				register struct rb_node *tmp;
+				__rb_rotate_left(parent, root);
+				tmp = parent;
+				parent = node;
+				node = tmp;
+			}
+
+			rb_set_black(parent);
+			rb_set_red(gparent);
+			__rb_rotate_right(gparent, root);
+		} else {
+			{
+				register struct rb_node *uncle = gparent->rb_left;
+				if (uncle && rb_is_red(uncle))
+				{
+					rb_set_black(uncle);
+					rb_set_black(parent);
+					rb_set_red(gparent);
+					node = gparent;
+					continue;
+				}
+			}
+
+			if (parent->rb_left == node)
+			{
+				register struct rb_node *tmp;
+				__rb_rotate_right(parent, root);
+				tmp = parent;
+				parent = node;
+				node = tmp;
+			}
+
+			rb_set_black(parent);
+			rb_set_red(gparent);
+			__rb_rotate_left(gparent, root);
+		}
+	}
+
+	rb_set_black(root->rb_node);
+}
+
+static void __rb_erase_color(struct rb_node *node, struct rb_node *parent,
+			     struct rb_root *root)
+{
+	struct rb_node *other;
+
+	while ((!node || rb_is_black(node)) && node != root->rb_node)
+	{
+		if (parent->rb_left == node)
+		{
+			other = parent->rb_right;
+			if (rb_is_red(other))
+			{
+				rb_set_black(other);
+				rb_set_red(parent);
+				__rb_rotate_left(parent, root);
+				other = parent->rb_right;
+			}
+			if ((!other->rb_left || rb_is_black(other->rb_left)) &&
+			    (!other->rb_right || rb_is_black(other->rb_right)))
+			{
+				rb_set_red(other);
+				node = parent;
+				parent = rb_parent(node);
+			}
+			else
+			{
+				if (!other->rb_right || rb_is_black(other->rb_right))
+				{
+					rb_set_black(other->rb_left);
+					rb_set_red(other);
+					__rb_rotate_right(other, root);
+					other = parent->rb_right;
+				}
+				rb_set_color(other, rb_color(parent));
+				rb_set_black(parent);
+				rb_set_black(other->rb_right);
+				__rb_rotate_left(parent, root);
+				node = root->rb_node;
+				break;
+			}
+		}
+		else
+		{
+			other = parent->rb_left;
+			if (rb_is_red(other))
+			{
+				rb_set_black(other);
+				rb_set_red(parent);
+				__rb_rotate_right(parent, root);
+				other = parent->rb_left;
+			}
+			if ((!other->rb_left || rb_is_black(other->rb_left)) &&
+			    (!other->rb_right || rb_is_black(other->rb_right)))
+			{
+				rb_set_red(other);
+				node = parent;
+				parent = rb_parent(node);
+			}
+			else
+			{
+				if (!other->rb_left || rb_is_black(other->rb_left))
+				{
+					rb_set_black(other->rb_right);
+					rb_set_red(other);
+					__rb_rotate_left(other, root);
+					other = parent->rb_left;
+				}
+				rb_set_color(other, rb_color(parent));
+				rb_set_black(parent);
+				rb_set_black(other->rb_left);
+				__rb_rotate_right(parent, root);
+				node = root->rb_node;
+				break;
+			}
+		}
+	}
+	if (node)
+		rb_set_black(node);
+}
+
+void rb_erase(struct rb_node *node, struct rb_root *root)
+{
+	struct rb_node *child, *parent;
+	int color;
+
+	if (!node->rb_left)
+		child = node->rb_right;
+	else if (!node->rb_right)
+		child = node->rb_left;
+	else
+	{
+		struct rb_node *old = node, *left;
+
+		node = node->rb_right;
+		while ((left = node->rb_left) != NULL)
+			node = left;
+
+		if (rb_parent(old)) {
+			if (rb_parent(old)->rb_left == old)
+				rb_parent(old)->rb_left = node;
+			else
+				rb_parent(old)->rb_right = node;
+		} else
+			root->rb_node = node;
+
+		child = node->rb_right;
+		parent = rb_parent(node);
+		color = rb_color(node);
+
+		if (parent == old) {
+			parent = node;
+		} else {
+			if (child)
+				rb_set_parent(child, parent);
+			parent->rb_left = child;
+
+			node->rb_right = old->rb_right;
+			rb_set_parent(old->rb_right, node);
+		}
+
+		node->rb_parent_color = old->rb_parent_color;
+		node->rb_left = old->rb_left;
+		rb_set_parent(old->rb_left, node);
+
+		goto color;
+	}
+
+	parent = rb_parent(node);
+	color = rb_color(node);
+
+	if (child)
+		rb_set_parent(child, parent);
+	if (parent)
+	{
+		if (parent->rb_left == node)
+			parent->rb_left = child;
+		else
+			parent->rb_right = child;
+	}
+	else
+		root->rb_node = child;
+
+ color:
+	if (color == RB_BLACK)
+		__rb_erase_color(child, parent, root);
+}
+
+/*
+ * This function returns the first node (in sort order) of the tree.
+ */
+struct rb_node *rb_first(const struct rb_root *root)
+{
+	struct rb_node	*n;
+
+	n = root->rb_node;
+	if (!n)
+		return NULL;
+	while (n->rb_left)
+		n = n->rb_left;
+	return n;
+}
+
+struct rb_node *rb_last(const struct rb_root *root)
+{
+	struct rb_node	*n;
+
+	n = root->rb_node;
+	if (!n)
+		return NULL;
+	while (n->rb_right)
+		n = n->rb_right;
+	return n;
+}
+
+struct rb_node *rb_next(const struct rb_node *node)
+{
+	struct rb_node *parent;
+
+	if (rb_parent(node) == node)
+		return NULL;
+
+	/* If we have a right-hand child, go down and then left as far
+	   as we can. */
+	if (node->rb_right) {
+		node = node->rb_right; 
+		while (node->rb_left)
+			node=node->rb_left;
+		return (struct rb_node *)node;
+	}
+
+	/* No right-hand children.  Everything down and left is
+	   smaller than us, so any 'next' node must be in the general
+	   direction of our parent. Go up the tree; any time the
+	   ancestor is a right-hand child of its parent, keep going
+	   up. First time it's a left-hand child of its parent, said
+	   parent is our 'next' node. */
+	while ((parent = rb_parent(node)) && node == parent->rb_right)
+		node = parent;
+
+	return parent;
+}
+
+struct rb_node *rb_prev(const struct rb_node *node)
+{
+	struct rb_node *parent;
+
+	if (rb_parent(node) == node)
+		return NULL;
+
+	/* If we have a left-hand child, go down and then right as far
+	   as we can. */
+	if (node->rb_left) {
+		node = node->rb_left; 
+		while (node->rb_right)
+			node=node->rb_right;
+		return (struct rb_node *)node;
+	}
+
+	/* No left-hand children. Go up till we find an ancestor which
+	   is a right-hand child of its parent */
+	while ((parent = rb_parent(node)) && node == parent->rb_left)
+		node = parent;
+
+	return parent;
+}
+
+void rb_replace_node(struct rb_node *victim, struct rb_node *new,
+		     struct rb_root *root)
+{
+	struct rb_node *parent = rb_parent(victim);
+
+	/* Set the surrounding nodes to point to the replacement */
+	if (parent) {
+		if (victim == parent->rb_left)
+			parent->rb_left = new;
+		else
+			parent->rb_right = new;
+	} else {
+		root->rb_node = new;
+	}
+	if (victim->rb_left)
+		rb_set_parent(victim->rb_left, new);
+	if (victim->rb_right)
+		rb_set_parent(victim->rb_right, new);
+
+	/* Copy the pointers/colour from the victim to the replacement */
+	*new = *victim;
+}
diff --git a/src/shared/libosmocore/src/select.c b/src/shared/libosmocore/src/select.c
new file mode 100644
index 00000000..6b73377a
--- /dev/null
+++ b/src/shared/libosmocore/src/select.c
@@ -0,0 +1,172 @@
+/* select filedescriptor handling, taken from:
+ * userspace logging daemon for the iptables ULOG target
+ * of the linux 2.4 netfilter subsystem.
+ *
+ * (C) 2000-2009 by Harald Welte <laforge@gnumonks.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <fcntl.h>
+#include <stdio.h>
+
+#include <osmocom/core/select.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/timer.h>
+
+#include "../config.h"
+
+#ifdef HAVE_SYS_SELECT_H
+
+/*! \addtogroup select
+ *  @{
+ */
+
+/*! \file select.c
+ *  \brief select loop abstraction
+ */
+
+static int maxfd = 0;
+static LLIST_HEAD(osmo_fds);
+static int unregistered_count;
+
+/*! \brief Register a new file descriptor with select loop abstraction
+ *  \param[in] fd osmocom file descriptor to be registered
+ */
+int osmo_fd_register(struct osmo_fd *fd)
+{
+	int flags;
+
+	/* make FD nonblocking */
+	flags = fcntl(fd->fd, F_GETFL);
+	if (flags < 0)
+		return flags;
+	flags |= O_NONBLOCK;
+	flags = fcntl(fd->fd, F_SETFL, flags);
+	if (flags < 0)
+		return flags;
+
+	/* set close-on-exec flag */
+	flags = fcntl(fd->fd, F_GETFD);
+	if (flags < 0)
+		return flags;
+	flags |= FD_CLOEXEC;
+	flags = fcntl(fd->fd, F_SETFD, flags);
+	if (flags < 0)
+		return flags;
+
+	/* Register FD */
+	if (fd->fd > maxfd)
+		maxfd = fd->fd;
+
+#ifdef BSC_FD_CHECK
+	struct osmo_fd *entry;
+	llist_for_each_entry(entry, &osmo_fds, list) {
+		if (entry == fd) {
+			fprintf(stderr, "Adding a osmo_fd that is already in the list.\n");
+			return 0;
+		}
+	}
+#endif
+
+	llist_add_tail(&fd->list, &osmo_fds);
+
+	return 0;
+}
+
+/*! \brief Unregister a file descriptor from select loop abstraction
+ *  \param[in] fd osmocom file descriptor to be unregistered
+ */
+void osmo_fd_unregister(struct osmo_fd *fd)
+{
+	unregistered_count++;
+	llist_del(&fd->list);
+}
+
+/*! \brief select main loop integration
+ *  \param[in] polling should we pollonly (1) or block on select (0)
+ */
+int osmo_select_main(int polling)
+{
+	struct osmo_fd *ufd, *tmp;
+	fd_set readset, writeset, exceptset;
+	int work = 0, rc;
+	struct timeval no_time = {0, 0};
+
+	FD_ZERO(&readset);
+	FD_ZERO(&writeset);
+	FD_ZERO(&exceptset);
+
+	/* prepare read and write fdsets */
+	llist_for_each_entry(ufd, &osmo_fds, list) {
+		if (ufd->when & BSC_FD_READ)
+			FD_SET(ufd->fd, &readset);
+
+		if (ufd->when & BSC_FD_WRITE)
+			FD_SET(ufd->fd, &writeset);
+
+		if (ufd->when & BSC_FD_EXCEPT)
+			FD_SET(ufd->fd, &exceptset);
+	}
+
+	osmo_timers_check();
+
+	if (!polling)
+		osmo_timers_prepare();
+	rc = select(maxfd+1, &readset, &writeset, &exceptset, polling ? &no_time : osmo_timers_nearest());
+	if (rc < 0)
+		return 0;
+
+	/* fire timers */
+	osmo_timers_update();
+
+	/* call registered callback functions */
+restart:
+	unregistered_count = 0;
+	llist_for_each_entry_safe(ufd, tmp, &osmo_fds, list) {
+		int flags = 0;
+
+		if (FD_ISSET(ufd->fd, &readset)) {
+			flags |= BSC_FD_READ;
+			FD_CLR(ufd->fd, &readset);
+		}
+
+		if (FD_ISSET(ufd->fd, &writeset)) {
+			flags |= BSC_FD_WRITE;
+			FD_CLR(ufd->fd, &writeset);
+		}
+
+		if (FD_ISSET(ufd->fd, &exceptset)) {
+			flags |= BSC_FD_EXCEPT;
+			FD_CLR(ufd->fd, &exceptset);
+		}
+
+		if (flags) {
+			work = 1;
+			ufd->cb(ufd, flags);
+		}
+		/* ugly, ugly hack. If more than one filedescriptors were
+		 * unregistered, they might have been consecutive and
+		 * llist_for_each_entry_safe() is no longer safe */
+		/* this seems to happen with the last element of the list as well */
+		if (unregistered_count >= 1)
+			goto restart;
+	}
+	return work;
+}
+
+/*! @} */
+
+#endif /* _HAVE_SYS_SELECT_H */
diff --git a/src/shared/libosmocore/src/serial.c b/src/shared/libosmocore/src/serial.c
new file mode 100644
index 00000000..a025ae91
--- /dev/null
+++ b/src/shared/libosmocore/src/serial.c
@@ -0,0 +1,229 @@
+/*
+ * serial.c
+ *
+ * Utility functions to deal with serial ports
+ *
+ * Copyright (C) 2011  Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/*! \addtogroup serial
+ *  @{
+ */
+
+/*! \file serial.c
+ *  \file Osmocom serial port helpers
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <termios.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#ifdef __linux__
+#include <linux/serial.h>
+#endif
+
+#include <osmocom/core/serial.h>
+
+
+#if 0
+# define dbg_perror(x) perror(x)
+#else
+# define dbg_perror(x) do { } while (0)
+#endif
+
+/*! \brief Open serial device and does base init
+ *  \param[in] dev Path to the device node to open
+ *  \param[in] baudrate Baudrate constant (speed_t: B9600, B...)
+ *  \returns >=0 file descriptor in case of success or negative errno.
+ */
+int
+osmo_serial_init(const char *dev, speed_t baudrate)
+{
+	int rc, fd=0, v24;
+	struct termios tio;
+
+	/* Open device */
+	fd = open(dev, O_RDWR | O_NOCTTY);
+	if (fd < 0) {
+		dbg_perror("open");
+		return -errno;
+	}
+
+	/* Configure serial interface */
+	rc = tcgetattr(fd, &tio);
+	if (rc < 0) {
+		dbg_perror("tcgetattr()");
+		rc = -errno;
+		goto error;
+	}
+
+	cfsetispeed(&tio, baudrate);
+	cfsetospeed(&tio, baudrate);
+
+	tio.c_cflag &= ~(PARENB | CSTOPB | CSIZE | CRTSCTS);
+	tio.c_cflag |=  (CREAD | CLOCAL | CS8);
+	tio.c_lflag &= ~(ICANON | ECHO | ECHOE | ISIG);
+	tio.c_iflag |=  (INPCK | ISTRIP);
+	tio.c_iflag &= ~(ISTRIP | IXON | IXOFF | IGNBRK | INLCR | ICRNL | IGNCR);
+	tio.c_oflag &= ~(OPOST | ONLCR);
+
+	rc = tcsetattr(fd, TCSANOW, &tio);
+	if (rc < 0) {
+		dbg_perror("tcsetattr()");
+		rc = -errno;
+		goto error;
+	}
+
+	/* Set ready to read/write */
+	v24 = TIOCM_DTR | TIOCM_RTS;
+	rc = ioctl(fd, TIOCMBIS, &v24);
+	if (rc < 0) {
+		dbg_perror("ioctl(TIOCMBIS)");
+		rc = -errno;
+		goto error;
+	}
+
+	return fd;
+
+error:
+	if (fd)
+		close(fd);
+	return rc;
+}
+
+static int
+_osmo_serial_set_baudrate(int fd, speed_t baudrate)
+{
+	int rc;
+	struct termios tio;
+
+	rc = tcgetattr(fd, &tio);
+	if (rc < 0) {
+		dbg_perror("tcgetattr()");
+		return -errno;
+	}
+	cfsetispeed(&tio, baudrate);
+	cfsetospeed(&tio, baudrate);
+
+	rc = tcsetattr(fd, TCSANOW, &tio);
+	if (rc < 0) {
+		dbg_perror("tcgetattr()");
+		return -errno;
+	}
+
+	return 0;
+}
+
+/*! \brief Change current baudrate
+ *  \param[in] fd File descriptor of the open device
+ *  \param[in] baudrate Baudrate constant (speed_t: B9600, B...)
+ *  \returns 0 for success or negative errno.
+ */
+int
+osmo_serial_set_baudrate(int fd, speed_t baudrate)
+{
+	osmo_serial_clear_custom_baudrate(fd);
+	return _osmo_serial_set_baudrate(fd, baudrate);
+}
+
+/*! \brief Change current baudrate to a custom one using OS specific method
+ *  \param[in] fd File descriptor of the open device
+ *  \param[in] baudrate Baudrate as integer
+ *  \returns 0 for success or negative errno.
+ *
+ *  This function might not work on all OS or with all type of serial adapters
+ */
+int
+osmo_serial_set_custom_baudrate(int fd, int baudrate)
+{
+#ifdef __linux__
+	int rc;
+	struct serial_struct ser_info;
+
+	rc = ioctl(fd, TIOCGSERIAL, &ser_info);
+	if (rc < 0) {
+		dbg_perror("ioctl(TIOCGSERIAL)");
+		return -errno;
+	}
+
+	ser_info.flags = ASYNC_SPD_CUST | ASYNC_LOW_LATENCY;
+	ser_info.custom_divisor = ser_info.baud_base / baudrate;
+
+	rc = ioctl(fd, TIOCSSERIAL, &ser_info);
+	if (rc < 0) {
+		dbg_perror("ioctl(TIOCSSERIAL)");
+		return -errno;
+	}
+
+	return _osmo_serial_set_baudrate(fd, B38400); /* 38400 is a kind of magic ... */
+#elif defined(__APPLE__)
+#ifndef IOSSIOSPEED
+#define IOSSIOSPEED    _IOW('T', 2, speed_t)
+#endif
+	int rc;
+
+	unsigned int speed = baudrate;
+	rc = ioctl(fd, IOSSIOSPEED, &speed);
+	if (rc < 0) {
+		dbg_perror("ioctl(IOSSIOSPEED)");
+		return -errno;
+	}
+	return 0;
+#else
+#warning osmo_serial_set_custom_baudrate: unsupported platform
+	return 0;
+#endif
+}
+
+/*! \brief Clear any custom baudrate
+ *  \param[in] fd File descriptor of the open device
+ *  \returns 0 for success or negative errno.
+ *
+ *  This function might not work on all OS or with all type of serial adapters
+ */
+int
+osmo_serial_clear_custom_baudrate(int fd)
+{
+#ifdef __linux__
+	int rc;
+	struct serial_struct ser_info;
+
+	rc = ioctl(fd, TIOCGSERIAL, &ser_info);
+	if (rc < 0) {
+		dbg_perror("ioctl(TIOCGSERIAL)");
+		return -errno;
+	}
+
+	ser_info.flags = ASYNC_LOW_LATENCY;
+	ser_info.custom_divisor = 0;
+
+	rc = ioctl(fd, TIOCSSERIAL, &ser_info);
+	if (rc < 0) {
+		dbg_perror("ioctl(TIOCSSERIAL)");
+		return -errno;
+	}
+#endif
+	return 0;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/signal.c b/src/shared/libosmocore/src/signal.c
new file mode 100644
index 00000000..63843849
--- /dev/null
+++ b/src/shared/libosmocore/src/signal.c
@@ -0,0 +1,109 @@
+/* Generic signalling/notification infrastructure */
+/* (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/core/signal.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/linuxlist.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+
+/*! \addtogroup signal
+ *  @{
+ */
+/*! \file signal.c */
+
+
+void *tall_sigh_ctx;
+static LLIST_HEAD(signal_handler_list);
+
+struct signal_handler {
+	struct llist_head entry;
+	unsigned int subsys;
+	osmo_signal_cbfn *cbfn;
+	void *data;
+};
+
+
+/*! \brief Register a new signal handler
+ *  \param[in] subsys Subsystem number
+ *  \param[in] cbfn Callback function
+ *  \param[in] data Data passed through to callback
+ */
+int osmo_signal_register_handler(unsigned int subsys,
+				 osmo_signal_cbfn *cbfn, void *data)
+{
+	struct signal_handler *sig_data;
+
+	sig_data = talloc(tall_sigh_ctx, struct signal_handler);
+	if (!sig_data)
+		return -ENOMEM;
+
+	memset(sig_data, 0, sizeof(*sig_data));
+
+	sig_data->subsys = subsys;
+	sig_data->data = data;
+	sig_data->cbfn = cbfn;
+
+	/* FIXME: check if we already have a handler for this subsys/cbfn/data */
+
+	llist_add_tail(&sig_data->entry, &signal_handler_list);
+
+	return 0;
+}
+
+/*! \brief Unregister signal handler
+ *  \param[in] subsys Subsystem number
+ *  \param[in] cbfn Callback function
+ *  \param[in] data Data passed through to callback
+ */
+void osmo_signal_unregister_handler(unsigned int subsys,
+				    osmo_signal_cbfn *cbfn, void *data)
+{
+	struct signal_handler *handler;
+
+	llist_for_each_entry(handler, &signal_handler_list, entry) {
+		if (handler->cbfn == cbfn && handler->data == data 
+		    && subsys == handler->subsys) {
+			llist_del(&handler->entry);
+			talloc_free(handler);
+			break;
+		}
+	}
+}
+
+/*! \brief dispatch (deliver) a new signal to all registered handlers
+ *  \param[in] subsys Subsystem number
+ *  \param[in] signal Signal number,
+ *  \param[in] signal_data Data to be passed along to handlers
+ */
+void osmo_signal_dispatch(unsigned int subsys, unsigned int signal,
+			  void *signal_data)
+{
+	struct signal_handler *handler;
+
+	llist_for_each_entry(handler, &signal_handler_list, entry) {
+		if (handler->subsys != subsys)
+			continue;
+		(*handler->cbfn)(subsys, signal, handler->data, signal_data);
+	}
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/socket.c b/src/shared/libosmocore/src/socket.c
new file mode 100644
index 00000000..53205cd2
--- /dev/null
+++ b/src/shared/libosmocore/src/socket.c
@@ -0,0 +1,249 @@
+#include "../config.h"
+
+/*! \addtogroup socket
+ *  @{
+ */
+
+/*! \file socket.c
+ *  \brief Osmocom socket convenience functions
+ */
+
+#ifdef HAVE_SYS_SOCKET_H
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/socket.h>
+
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+
+#include <netinet/in.h>
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+#include <netdb.h>
+#include <ifaddrs.h>
+
+/*! \brief Initialize a socket (including bind/connect)
+ *  \param[in] family Address Family like AF_INET, AF_INET6, AF_UNSPEC
+ *  \param[in] type Socket type like SOCK_DGRAM, SOCK_STREAM
+ *  \param[in] proto Protocol like IPPROTO_TCP, IPPROTO_UDP
+ *  \param[in] host remote host name or IP address in string form
+ *  \param[in] port remote port number in host byte order
+ *  \param[in] flags flags like \ref OSMO_SOCK_F_CONNECT
+ *
+ * This function creates a new socket of the designated \a family, \a
+ * type and \a proto and optionally binds or connects it, depending on
+ * the value of \a flags parameter.
+ */
+int osmo_sock_init(uint16_t family, uint16_t type, uint8_t proto,
+		   const char *host, uint16_t port, unsigned int flags)
+{
+	struct addrinfo hints, *result, *rp;
+	int sfd, rc, on = 1;
+	char portbuf[16];
+
+	if ((flags & (OSMO_SOCK_F_BIND | OSMO_SOCK_F_CONNECT)) ==
+		     (OSMO_SOCK_F_BIND | OSMO_SOCK_F_CONNECT))
+		return -EINVAL;
+
+	sprintf(portbuf, "%u", port);
+	memset(&hints, 0, sizeof(struct addrinfo));
+	hints.ai_family = family;
+	hints.ai_socktype = type;
+	hints.ai_flags = 0;
+	hints.ai_protocol = proto;
+
+	if (flags & OSMO_SOCK_F_BIND)
+		hints.ai_flags |= AI_PASSIVE;
+
+	rc = getaddrinfo(host, portbuf, &hints, &result);
+	if (rc != 0) {
+		perror("getaddrinfo returned NULL");
+		return -EINVAL;
+	}
+
+	for (rp = result; rp != NULL; rp = rp->ai_next) {
+		sfd = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
+		if (sfd == -1)
+			continue;
+		if (flags & OSMO_SOCK_F_NONBLOCK) {
+			if (ioctl(sfd, FIONBIO, (unsigned char *)&on) < 0) {
+				perror("cannot set this socket unblocking");
+				close(sfd);
+				return -EINVAL;
+			}
+		}
+		if (flags & OSMO_SOCK_F_CONNECT) {
+			rc = connect(sfd, rp->ai_addr, rp->ai_addrlen);
+			if (rc != -1 || (rc == -1 && errno == EINPROGRESS))
+				break;
+		} else {
+			rc = setsockopt(sfd, SOL_SOCKET, SO_REUSEADDR,
+							&on, sizeof(on));
+			if (rc < 0) {
+				perror("cannot setsockopt socket");
+				break;
+			}
+			if (bind(sfd, rp->ai_addr, rp->ai_addrlen) != -1)
+				break;
+		}
+		close(sfd);
+	}
+	freeaddrinfo(result);
+
+	if (rp == NULL) {
+		perror("unable to connect/bind socket");
+		return -ENODEV;
+	}
+
+	setsockopt(sfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+
+	/* Make sure to call 'listen' on a bound, connection-oriented sock */
+	if (flags & OSMO_SOCK_F_BIND) {
+		switch (type) {
+		case SOCK_STREAM:
+		case SOCK_SEQPACKET:
+			listen(sfd, 10);
+			break;
+		}
+	}
+	return sfd;
+}
+
+/*! \brief Initialize a socket and fill \ref osmo_fd
+ *  \param[out] osmocom file descriptor (will be filled in)
+ *  \param[in] family Address Family like AF_INET, AF_INET6, AF_UNSPEC
+ *  \param[in] type Socket type like SOCK_DGRAM, SOCK_STREAM
+ *  \param[in] proto Protocol like IPPROTO_TCP, IPPROTO_UDP
+ *  \param[in] host remote host name or IP address in string form
+ *  \param[in] port remote port number in host byte order
+ *  \param[in] flags flags like \ref OSMO_SOCK_F_CONNECT
+ *
+ * This function creates (and optionall binds/connects) a socket using
+ * \ref osmo_sock_init, but also fills the \a ofd structure.
+ */
+int osmo_sock_init_ofd(struct osmo_fd *ofd, int family, int type, int proto,
+			const char *host, uint16_t port, unsigned int flags)
+{
+	int sfd, rc;
+
+	sfd = osmo_sock_init(family, type, proto, host, port, flags);
+	if (sfd < 0)
+		return sfd;
+
+	ofd->fd = sfd;
+	ofd->when = BSC_FD_READ;
+
+	rc = osmo_fd_register(ofd);
+	if (rc < 0) {
+		close(sfd);
+		return rc;
+	}
+
+	return sfd;
+}
+
+/*! \brief Initialize a socket and fill \ref sockaddr
+ *  \param[out] ss socket address (will be filled in)
+ *  \param[in] type Socket type like SOCK_DGRAM, SOCK_STREAM
+ *  \param[in] proto Protocol like IPPROTO_TCP, IPPROTO_UDP
+ *  \param[in] flags flags like \ref OSMO_SOCK_F_CONNECT
+ *
+ * This function creates (and optionall binds/connects) a socket using
+ * \ref osmo_sock_init, but also fills the \a ss structure.
+ */
+int osmo_sock_init_sa(struct sockaddr *ss, uint16_t type,
+		      uint8_t proto, unsigned int flags)
+{
+	char host[NI_MAXHOST];
+	uint16_t port;
+	struct sockaddr_in *sin;
+	struct sockaddr_in6 *sin6;
+	int s, sa_len;
+
+	/* determine port and host from ss */
+	switch (ss->sa_family) {
+	case AF_INET:
+		sin = (struct sockaddr_in *) ss;
+		sa_len = sizeof(struct sockaddr_in);
+		port = ntohs(sin->sin_port);
+		break;
+	case AF_INET6:
+		sin6 = (struct sockaddr_in6 *) ss;
+		sa_len = sizeof(struct sockaddr_in6);
+		port = ntohs(sin6->sin6_port);
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	s = getnameinfo(ss, sa_len, host, NI_MAXHOST,
+			NULL, 0, NI_NUMERICHOST);
+	if (s != 0) {
+		perror("getnameinfo failed");
+		return s;
+	}
+
+	return osmo_sock_init(ss->sa_family, type, proto, host, port, flags);
+}
+
+static int sockaddr_equal(const struct sockaddr *a,
+			  const struct sockaddr *b, unsigned int len)
+{
+	struct sockaddr_in *sin_a, *sin_b;
+	struct sockaddr_in6 *sin6_a, *sin6_b;
+
+	if (a->sa_family != b->sa_family)
+		return 0;
+
+	switch (a->sa_family) {
+	case AF_INET:
+		sin_a = (struct sockaddr_in *)a;
+		sin_b = (struct sockaddr_in *)b;
+		if (!memcmp(&sin_a->sin_addr, &sin_b->sin_addr,
+			    sizeof(struct in_addr)))
+			return 1;
+		break;
+	case AF_INET6:
+		sin6_a = (struct sockaddr_in6 *)a;
+		sin6_b = (struct sockaddr_in6 *)b;
+		if (!memcmp(&sin6_a->sin6_addr, &sin6_b->sin6_addr,
+			    sizeof(struct in6_addr)))
+			return 1;
+		break;
+	}
+	return 0;
+}
+
+/*! \brief Determine if the given address is a local address
+ *  \param[in] addr Socket Address
+ *  \param[in] addrlen Length of socket address in bytes
+ *  \returns 1 if address is local, 0 otherwise.
+ */
+int osmo_sockaddr_is_local(struct sockaddr *addr, unsigned int addrlen)
+{
+	struct ifaddrs *ifaddr, *ifa;
+
+	if (getifaddrs(&ifaddr) == -1) {
+		perror("getifaddrs");
+		return -EIO;
+	}
+
+	for (ifa = ifaddr; ifa != NULL; ifa = ifa->ifa_next) {
+		if (!ifa->ifa_addr)
+			continue;
+		if (sockaddr_equal(ifa->ifa_addr, addr, addrlen))
+			return 1;
+	}
+
+	return 0;
+}
+
+#endif /* HAVE_SYS_SOCKET_H */
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/statistics.c b/src/shared/libosmocore/src/statistics.c
new file mode 100644
index 00000000..e28541ba
--- /dev/null
+++ b/src/shared/libosmocore/src/statistics.c
@@ -0,0 +1,76 @@
+/* utility routines for keeping some statistics */
+
+/* (C) 2009 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <string.h>
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/statistics.h>
+
+static LLIST_HEAD(counters);
+
+void *tall_ctr_ctx;
+
+struct osmo_counter *osmo_counter_alloc(const char *name)
+{
+	struct osmo_counter *ctr = talloc_zero(tall_ctr_ctx, struct osmo_counter);
+
+	if (!ctr)
+		return NULL;
+
+	ctr->name = name;
+	llist_add_tail(&ctr->list, &counters);
+
+	return ctr;
+}
+
+void osmo_counter_free(struct osmo_counter *ctr)
+{
+	llist_del(&ctr->list);
+	talloc_free(ctr);
+}
+
+int osmo_counters_for_each(int (*handle_counter)(struct osmo_counter *, void *),
+			   void *data)
+{
+	struct osmo_counter *ctr;
+	int rc = 0;
+
+	llist_for_each_entry(ctr, &counters, list) {
+		rc = handle_counter(ctr, data);
+		if (rc < 0)
+			return rc;
+	}
+
+	return rc;
+}
+
+struct osmo_counter *osmo_counter_get_by_name(const char *name)
+{
+	struct osmo_counter *ctr;
+
+	llist_for_each_entry(ctr, &counters, list) {
+		if (!strcmp(ctr->name, name))
+			return ctr;
+	}
+	return NULL;
+}
diff --git a/src/shared/libosmocore/src/talloc.c b/src/shared/libosmocore/src/talloc.c
new file mode 100644
index 00000000..d3a0690f
--- /dev/null
+++ b/src/shared/libosmocore/src/talloc.c
@@ -0,0 +1,1804 @@
+/* 
+   Samba Unix SMB/CIFS implementation.
+
+   Samba trivial allocation library - new interface
+
+   NOTE: Please read talloc_guide.txt for full documentation
+
+   Copyright (C) Andrew Tridgell 2004
+   Copyright (C) Stefan Metzmacher 2006
+   
+     ** NOTE! The following LGPL license applies to the talloc
+     ** library. This does NOT imply that all of Samba is released
+     ** under the LGPL
+   
+   This library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 3 of the License, or (at your option) any later version.
+
+   This library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with this library; if not, see <http://www.gnu.org/licenses/>.
+*/
+
+/*
+  inspired by http://swapped.cc/halloc/
+*/
+
+#ifdef _SAMBA_BUILD_
+#include "version.h"
+#if (SAMBA_VERSION_MAJOR<4)
+#include "includes.h"
+/* This is to circumvent SAMBA3's paranoid malloc checker. Here in this file
+ * we trust ourselves... */
+#ifdef malloc
+#undef malloc
+#endif
+#ifdef realloc
+#undef realloc
+#endif
+#define _TALLOC_SAMBA3
+#endif /* (SAMBA_VERSION_MAJOR<4) */
+#endif /* _SAMBA_BUILD_ */
+
+#ifndef _TALLOC_SAMBA3
+//#include "replace.h"
+#include <unistd.h>
+#include <stdio.h>
+#include <stdbool.h>
+#define __USE_GNU
+#include <string.h>
+#undef __USE_GNU
+#include <osmocom/core/talloc.h>
+#define MIN(x,y) ((x) < (y) ? (x) : (y))
+#endif /* not _TALLOC_SAMBA3 */
+
+/* use this to force every realloc to change the pointer, to stress test
+   code that might not cope */
+#define ALWAYS_REALLOC 0
+
+
+#define MAX_TALLOC_SIZE 0x10000000
+#define TALLOC_MAGIC 0xe814ec70
+#define TALLOC_FLAG_FREE 0x01
+#define TALLOC_FLAG_LOOP 0x02
+#define TALLOC_FLAG_POOL 0x04		/* This is a talloc pool */
+#define TALLOC_FLAG_POOLMEM 0x08	/* This is allocated in a pool */
+#define TALLOC_MAGIC_REFERENCE ((const char *)1)
+
+/* by default we abort when given a bad pointer (such as when talloc_free() is called 
+   on a pointer that came from malloc() */
+#ifndef TALLOC_ABORT
+#define TALLOC_ABORT(reason) abort()
+#endif
+
+#ifndef discard_const_p
+#if defined(__intptr_t_defined) || defined(HAVE_INTPTR_T)
+# define discard_const_p(type, ptr) ((type *)((intptr_t)(ptr)))
+#else
+# define discard_const_p(type, ptr) ((type *)(ptr))
+#endif
+#endif
+
+/* these macros gain us a few percent of speed on gcc */
+#if (__GNUC__ >= 3)
+/* the strange !! is to ensure that __builtin_expect() takes either 0 or 1
+   as its first argument */
+#ifndef likely
+#define likely(x)   __builtin_expect(!!(x), 1)
+#endif
+#ifndef unlikely
+#define unlikely(x) __builtin_expect(!!(x), 0)
+#endif
+#else
+#ifndef likely
+#define likely(x) (x)
+#endif
+#ifndef unlikely
+#define unlikely(x) (x)
+#endif
+#endif
+
+#ifdef __APPLE__
+/* taken from http://insanecoding.blogspot.com/2007/03/methods-for-safe-string-handling.html */
+size_t strnlen(const char *s, size_t n)
+{
+  const char *p = (const char *)memchr(s, 0, n);
+  return(p ? p-s : n);
+}
+#endif
+
+/* this null_context is only used if talloc_enable_leak_report() or
+   talloc_enable_leak_report_full() is called, otherwise it remains
+   NULL
+*/
+static void *null_context;
+static void *autofree_context;
+
+struct talloc_reference_handle {
+	struct talloc_reference_handle *next, *prev;
+	void *ptr;
+};
+
+typedef int (*talloc_destructor_t)(void *);
+
+struct talloc_chunk {
+	struct talloc_chunk *next, *prev;
+	struct talloc_chunk *parent, *child;
+	struct talloc_reference_handle *refs;
+	talloc_destructor_t destructor;
+	const char *name;
+	size_t size;
+	unsigned flags;
+
+	/*
+	 * "pool" has dual use:
+	 *
+	 * For the talloc pool itself (i.e. TALLOC_FLAG_POOL is set), "pool"
+	 * marks the end of the currently allocated area.
+	 *
+	 * For members of the pool (i.e. TALLOC_FLAG_POOLMEM is set), "pool"
+	 * is a pointer to the struct talloc_chunk of the pool that it was
+	 * allocated from. This way children can quickly find the pool to chew
+	 * from.
+	 */
+	void *pool;
+};
+
+/* 16 byte alignment seems to keep everyone happy */
+#define TC_HDR_SIZE ((sizeof(struct talloc_chunk)+15)&~15)
+#define TC_PTR_FROM_CHUNK(tc) ((void *)(TC_HDR_SIZE + (char*)tc))
+
+static void (*talloc_abort_fn)(const char *reason);
+
+void talloc_set_abort_fn(void (*abort_fn)(const char *reason))
+{
+	talloc_abort_fn = abort_fn;
+}
+
+static void talloc_abort(const char *reason)
+{
+	if (!talloc_abort_fn) {
+		TALLOC_ABORT(reason);
+	}
+
+	talloc_abort_fn(reason);
+}
+
+static void talloc_abort_double_free(void)
+{
+	talloc_abort("Bad talloc magic value - double free");
+}
+
+static void talloc_abort_unknown_value(void)
+{
+	talloc_abort("Bad talloc magic value - unknown value");
+}
+
+/* panic if we get a bad magic value */
+static inline struct talloc_chunk *talloc_chunk_from_ptr(const void *ptr)
+{
+	const char *pp = (const char *)ptr;
+	struct talloc_chunk *tc = discard_const_p(struct talloc_chunk, pp - TC_HDR_SIZE);
+	if (unlikely((tc->flags & (TALLOC_FLAG_FREE | ~0xF)) != TALLOC_MAGIC)) { 
+		if (tc->flags & TALLOC_FLAG_FREE) {
+			talloc_abort_double_free();
+		} else {
+			talloc_abort_unknown_value();
+		}
+	}
+	return tc;
+}
+
+/* hook into the front of the list */
+#define _TLIST_ADD(list, p) \
+do { \
+        if (!(list)) { \
+		(list) = (p); \
+		(p)->next = (p)->prev = NULL; \
+	} else { \
+		(list)->prev = (p); \
+		(p)->next = (list); \
+		(p)->prev = NULL; \
+		(list) = (p); \
+	}\
+} while (0)
+
+/* remove an element from a list - element doesn't have to be in list. */
+#define _TLIST_REMOVE(list, p) \
+do { \
+	if ((p) == (list)) { \
+		(list) = (p)->next; \
+		if (list) (list)->prev = NULL; \
+	} else { \
+		if ((p)->prev) (p)->prev->next = (p)->next; \
+		if ((p)->next) (p)->next->prev = (p)->prev; \
+	} \
+	if ((p) && ((p) != (list))) (p)->next = (p)->prev = NULL; \
+} while (0)
+
+
+/*
+  return the parent chunk of a pointer
+*/
+static inline struct talloc_chunk *talloc_parent_chunk(const void *ptr)
+{
+	struct talloc_chunk *tc;
+
+	if (unlikely(ptr == NULL)) {
+		return NULL;
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+	while (tc->prev) tc=tc->prev;
+
+	return tc->parent;
+}
+
+void *talloc_parent(const void *ptr)
+{
+	struct talloc_chunk *tc = talloc_parent_chunk(ptr);
+	return tc? TC_PTR_FROM_CHUNK(tc) : NULL;
+}
+
+/*
+  find parents name
+*/
+const char *talloc_parent_name(const void *ptr)
+{
+	struct talloc_chunk *tc = talloc_parent_chunk(ptr);
+	return tc? tc->name : NULL;
+}
+
+/*
+  A pool carries an in-pool object count count in the first 16 bytes.
+  bytes. This is done to support talloc_steal() to a parent outside of the
+  pool. The count includes the pool itself, so a talloc_free() on a pool will
+  only destroy the pool if the count has dropped to zero. A talloc_free() of a
+  pool member will reduce the count, and eventually also call free(3) on the
+  pool memory.
+
+  The object count is not put into "struct talloc_chunk" because it is only
+  relevant for talloc pools and the alignment to 16 bytes would increase the
+  memory footprint of each talloc chunk by those 16 bytes.
+*/
+
+#define TALLOC_POOL_HDR_SIZE 16
+
+static unsigned int *talloc_pool_objectcount(struct talloc_chunk *tc)
+{
+	return (unsigned int *)((char *)tc + sizeof(struct talloc_chunk));
+}
+
+/*
+  Allocate from a pool
+*/
+
+static struct talloc_chunk *talloc_alloc_pool(struct talloc_chunk *parent,
+					      size_t size)
+{
+	struct talloc_chunk *pool_ctx = NULL;
+	size_t space_left;
+	struct talloc_chunk *result;
+	size_t chunk_size;
+
+	if (parent == NULL) {
+		return NULL;
+	}
+
+	if (parent->flags & TALLOC_FLAG_POOL) {
+		pool_ctx = parent;
+	}
+	else if (parent->flags & TALLOC_FLAG_POOLMEM) {
+		pool_ctx = (struct talloc_chunk *)parent->pool;
+	}
+
+	if (pool_ctx == NULL) {
+		return NULL;
+	}
+
+	space_left = ((char *)pool_ctx + TC_HDR_SIZE + pool_ctx->size)
+		- ((char *)pool_ctx->pool);
+
+	/*
+	 * Align size to 16 bytes
+	 */
+	chunk_size = ((size + 15) & ~15);
+
+	if (space_left < chunk_size) {
+		return NULL;
+	}
+
+	result = (struct talloc_chunk *)pool_ctx->pool;
+
+#if defined(DEVELOPER) && defined(VALGRIND_MAKE_MEM_UNDEFINED)
+	VALGRIND_MAKE_MEM_UNDEFINED(result, size);
+#endif
+
+	pool_ctx->pool = (void *)((char *)result + chunk_size);
+
+	result->flags = TALLOC_MAGIC | TALLOC_FLAG_POOLMEM;
+	result->pool = pool_ctx;
+
+	*talloc_pool_objectcount(pool_ctx) += 1;
+
+	return result;
+}
+
+/* 
+   Allocate a bit of memory as a child of an existing pointer
+*/
+static inline void *__talloc(const void *context, size_t size)
+{
+	struct talloc_chunk *tc = NULL;
+
+	if (unlikely(context == NULL)) {
+		context = null_context;
+	}
+
+	if (unlikely(size >= MAX_TALLOC_SIZE)) {
+		return NULL;
+	}
+
+	if (context != NULL) {
+		tc = talloc_alloc_pool(talloc_chunk_from_ptr(context),
+				       TC_HDR_SIZE+size);
+	}
+
+	if (tc == NULL) {
+		tc = (struct talloc_chunk *)malloc(TC_HDR_SIZE+size);
+		if (unlikely(tc == NULL)) return NULL;
+		tc->flags = TALLOC_MAGIC;
+		tc->pool  = NULL;
+	}
+
+	tc->size = size;
+	tc->destructor = NULL;
+	tc->child = NULL;
+	tc->name = NULL;
+	tc->refs = NULL;
+
+	if (likely(context)) {
+		struct talloc_chunk *parent = talloc_chunk_from_ptr(context);
+
+		if (parent->child) {
+			parent->child->parent = NULL;
+			tc->next = parent->child;
+			tc->next->prev = tc;
+		} else {
+			tc->next = NULL;
+		}
+		tc->parent = parent;
+		tc->prev = NULL;
+		parent->child = tc;
+	} else {
+		tc->next = tc->prev = tc->parent = NULL;
+	}
+
+	return TC_PTR_FROM_CHUNK(tc);
+}
+
+/*
+ * Create a talloc pool
+ */
+
+void *talloc_pool(const void *context, size_t size)
+{
+	void *result = __talloc(context, size + TALLOC_POOL_HDR_SIZE);
+	struct talloc_chunk *tc;
+
+	if (unlikely(result == NULL)) {
+		return NULL;
+	}
+
+	tc = talloc_chunk_from_ptr(result);
+
+	tc->flags |= TALLOC_FLAG_POOL;
+	tc->pool = (char *)result + TALLOC_POOL_HDR_SIZE;
+
+	*talloc_pool_objectcount(tc) = 1;
+
+#if defined(DEVELOPER) && defined(VALGRIND_MAKE_MEM_NOACCESS)
+	VALGRIND_MAKE_MEM_NOACCESS(tc->pool, size);
+#endif
+
+	return result;
+}
+
+/*
+  setup a destructor to be called on free of a pointer
+  the destructor should return 0 on success, or -1 on failure.
+  if the destructor fails then the free is failed, and the memory can
+  be continued to be used
+*/
+void _talloc_set_destructor(const void *ptr, int (*destructor)(void *))
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	tc->destructor = destructor;
+}
+
+/*
+  increase the reference count on a piece of memory. 
+*/
+int talloc_increase_ref_count(const void *ptr)
+{
+	if (unlikely(!talloc_reference(null_context, ptr))) {
+		return -1;
+	}
+	return 0;
+}
+
+/*
+  helper for talloc_reference()
+
+  this is referenced by a function pointer and should not be inline
+*/
+static int talloc_reference_destructor(struct talloc_reference_handle *handle)
+{
+	struct talloc_chunk *ptr_tc = talloc_chunk_from_ptr(handle->ptr);
+	_TLIST_REMOVE(ptr_tc->refs, handle);
+	return 0;
+}
+
+/*
+   more efficient way to add a name to a pointer - the name must point to a 
+   true string constant
+*/
+static inline void _talloc_set_name_const(const void *ptr, const char *name)
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	tc->name = name;
+}
+
+/*
+  internal talloc_named_const()
+*/
+static inline void *_talloc_named_const(const void *context, size_t size, const char *name)
+{
+	void *ptr;
+
+	ptr = __talloc(context, size);
+	if (unlikely(ptr == NULL)) {
+		return NULL;
+	}
+
+	_talloc_set_name_const(ptr, name);
+
+	return ptr;
+}
+
+/*
+  make a secondary reference to a pointer, hanging off the given context.
+  the pointer remains valid until both the original caller and this given
+  context are freed.
+  
+  the major use for this is when two different structures need to reference the 
+  same underlying data, and you want to be able to free the two instances separately,
+  and in either order
+*/
+void *_talloc_reference(const void *context, const void *ptr)
+{
+	struct talloc_chunk *tc;
+	struct talloc_reference_handle *handle;
+	if (unlikely(ptr == NULL)) return NULL;
+
+	tc = talloc_chunk_from_ptr(ptr);
+	handle = (struct talloc_reference_handle *)_talloc_named_const(context,
+						   sizeof(struct talloc_reference_handle),
+						   TALLOC_MAGIC_REFERENCE);
+	if (unlikely(handle == NULL)) return NULL;
+
+	/* note that we hang the destructor off the handle, not the
+	   main context as that allows the caller to still setup their
+	   own destructor on the context if they want to */
+	talloc_set_destructor(handle, talloc_reference_destructor);
+	handle->ptr = discard_const_p(void, ptr);
+	_TLIST_ADD(tc->refs, handle);
+	return handle->ptr;
+}
+
+
+/* 
+   internal talloc_free call
+*/
+static inline int _talloc_free(void *ptr)
+{
+	struct talloc_chunk *tc;
+
+	if (unlikely(ptr == NULL)) {
+		return -1;
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	if (unlikely(tc->refs)) {
+		int is_child;
+		/* check this is a reference from a child or grantchild
+		 * back to it's parent or grantparent
+		 *
+		 * in that case we need to remove the reference and
+		 * call another instance of talloc_free() on the current
+		 * pointer.
+		 */
+		is_child = talloc_is_parent(tc->refs, ptr);
+		_talloc_free(tc->refs);
+		if (is_child) {
+			return _talloc_free(ptr);
+		}
+		return -1;
+	}
+
+	if (unlikely(tc->flags & TALLOC_FLAG_LOOP)) {
+		/* we have a free loop - stop looping */
+		return 0;
+	}
+
+	if (unlikely(tc->destructor)) {
+		talloc_destructor_t d = tc->destructor;
+		if (d == (talloc_destructor_t)-1) {
+			return -1;
+		}
+		tc->destructor = (talloc_destructor_t)-1;
+		if (d(ptr) == -1) {
+			tc->destructor = d;
+			return -1;
+		}
+		tc->destructor = NULL;
+	}
+
+	if (tc->parent) {
+		_TLIST_REMOVE(tc->parent->child, tc);
+		if (tc->parent->child) {
+			tc->parent->child->parent = tc->parent;
+		}
+	} else {
+		if (tc->prev) tc->prev->next = tc->next;
+		if (tc->next) tc->next->prev = tc->prev;
+	}
+
+	tc->flags |= TALLOC_FLAG_LOOP;
+
+	while (tc->child) {
+		/* we need to work out who will own an abandoned child
+		   if it cannot be freed. In priority order, the first
+		   choice is owner of any remaining reference to this
+		   pointer, the second choice is our parent, and the
+		   final choice is the null context. */
+		void *child = TC_PTR_FROM_CHUNK(tc->child);
+		const void *new_parent = null_context;
+		if (unlikely(tc->child->refs)) {
+			struct talloc_chunk *p = talloc_parent_chunk(tc->child->refs);
+			if (p) new_parent = TC_PTR_FROM_CHUNK(p);
+		}
+		if (unlikely(_talloc_free(child) == -1)) {
+			if (new_parent == null_context) {
+				struct talloc_chunk *p = talloc_parent_chunk(ptr);
+				if (p) new_parent = TC_PTR_FROM_CHUNK(p);
+			}
+			talloc_steal(new_parent, child);
+		}
+	}
+
+	tc->flags |= TALLOC_FLAG_FREE;
+
+	if (tc->flags & (TALLOC_FLAG_POOL|TALLOC_FLAG_POOLMEM)) {
+		struct talloc_chunk *pool;
+		unsigned int *pool_object_count;
+
+		pool = (tc->flags & TALLOC_FLAG_POOL)
+			? tc : (struct talloc_chunk *)tc->pool;
+
+		pool_object_count = talloc_pool_objectcount(pool);
+
+		if (*pool_object_count == 0) {
+			talloc_abort("Pool object count zero!");
+		}
+
+		*pool_object_count -= 1;
+
+		if (*pool_object_count == 0) {
+			free(pool);
+		}
+	}
+	else {
+		free(tc);
+	}
+	return 0;
+}
+
+/* 
+   move a lump of memory from one talloc context to another return the
+   ptr on success, or NULL if it could not be transferred.
+   passing NULL as ptr will always return NULL with no side effects.
+*/
+void *_talloc_steal(const void *new_ctx, const void *ptr)
+{
+	struct talloc_chunk *tc, *new_tc;
+
+	if (unlikely(!ptr)) {
+		return NULL;
+	}
+
+	if (unlikely(new_ctx == NULL)) {
+		new_ctx = null_context;
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	if (unlikely(new_ctx == NULL)) {
+		if (tc->parent) {
+			_TLIST_REMOVE(tc->parent->child, tc);
+			if (tc->parent->child) {
+				tc->parent->child->parent = tc->parent;
+			}
+		} else {
+			if (tc->prev) tc->prev->next = tc->next;
+			if (tc->next) tc->next->prev = tc->prev;
+		}
+		
+		tc->parent = tc->next = tc->prev = NULL;
+		return discard_const_p(void, ptr);
+	}
+
+	new_tc = talloc_chunk_from_ptr(new_ctx);
+
+	if (unlikely(tc == new_tc || tc->parent == new_tc)) {
+		return discard_const_p(void, ptr);
+	}
+
+	if (tc->parent) {
+		_TLIST_REMOVE(tc->parent->child, tc);
+		if (tc->parent->child) {
+			tc->parent->child->parent = tc->parent;
+		}
+	} else {
+		if (tc->prev) tc->prev->next = tc->next;
+		if (tc->next) tc->next->prev = tc->prev;
+	}
+
+	tc->parent = new_tc;
+	if (new_tc->child) new_tc->child->parent = NULL;
+	_TLIST_ADD(new_tc->child, tc);
+
+	return discard_const_p(void, ptr);
+}
+
+
+
+/*
+  remove a secondary reference to a pointer. This undo's what
+  talloc_reference() has done. The context and pointer arguments
+  must match those given to a talloc_reference()
+*/
+static inline int talloc_unreference(const void *context, const void *ptr)
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	struct talloc_reference_handle *h;
+
+	if (unlikely(context == NULL)) {
+		context = null_context;
+	}
+
+	for (h=tc->refs;h;h=h->next) {
+		struct talloc_chunk *p = talloc_parent_chunk(h);
+		if (p == NULL) {
+			if (context == NULL) break;
+		} else if (TC_PTR_FROM_CHUNK(p) == context) {
+			break;
+		}
+	}
+	if (h == NULL) {
+		return -1;
+	}
+
+	return _talloc_free(h);
+}
+
+/*
+  remove a specific parent context from a pointer. This is a more
+  controlled varient of talloc_free()
+*/
+int talloc_unlink(const void *context, void *ptr)
+{
+	struct talloc_chunk *tc_p, *new_p;
+	void *new_parent;
+
+	if (ptr == NULL) {
+		return -1;
+	}
+
+	if (context == NULL) {
+		context = null_context;
+	}
+
+	if (talloc_unreference(context, ptr) == 0) {
+		return 0;
+	}
+
+	if (context == NULL) {
+		if (talloc_parent_chunk(ptr) != NULL) {
+			return -1;
+		}
+	} else {
+		if (talloc_chunk_from_ptr(context) != talloc_parent_chunk(ptr)) {
+			return -1;
+		}
+	}
+	
+	tc_p = talloc_chunk_from_ptr(ptr);
+
+	if (tc_p->refs == NULL) {
+		return _talloc_free(ptr);
+	}
+
+	new_p = talloc_parent_chunk(tc_p->refs);
+	if (new_p) {
+		new_parent = TC_PTR_FROM_CHUNK(new_p);
+	} else {
+		new_parent = NULL;
+	}
+
+	if (talloc_unreference(new_parent, ptr) != 0) {
+		return -1;
+	}
+
+	talloc_steal(new_parent, ptr);
+
+	return 0;
+}
+
+/*
+  add a name to an existing pointer - va_list version
+*/
+static inline const char *talloc_set_name_v(const void *ptr, const char *fmt, va_list ap) PRINTF_ATTRIBUTE(2,0);
+
+static inline const char *talloc_set_name_v(const void *ptr, const char *fmt, va_list ap)
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	tc->name = talloc_vasprintf(ptr, fmt, ap);
+	if (likely(tc->name)) {
+		_talloc_set_name_const(tc->name, ".name");
+	}
+	return tc->name;
+}
+
+/*
+  add a name to an existing pointer
+*/
+const char *talloc_set_name(const void *ptr, const char *fmt, ...)
+{
+	const char *name;
+	va_list ap;
+	va_start(ap, fmt);
+	name = talloc_set_name_v(ptr, fmt, ap);
+	va_end(ap);
+	return name;
+}
+
+
+/*
+  create a named talloc pointer. Any talloc pointer can be named, and
+  talloc_named() operates just like talloc() except that it allows you
+  to name the pointer.
+*/
+void *talloc_named(const void *context, size_t size, const char *fmt, ...)
+{
+	va_list ap;
+	void *ptr;
+	const char *name;
+
+	ptr = __talloc(context, size);
+	if (unlikely(ptr == NULL)) return NULL;
+
+	va_start(ap, fmt);
+	name = talloc_set_name_v(ptr, fmt, ap);
+	va_end(ap);
+
+	if (unlikely(name == NULL)) {
+		_talloc_free(ptr);
+		return NULL;
+	}
+
+	return ptr;
+}
+
+/*
+  return the name of a talloc ptr, or "UNNAMED"
+*/
+const char *talloc_get_name(const void *ptr)
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	if (unlikely(tc->name == TALLOC_MAGIC_REFERENCE)) {
+		return ".reference";
+	}
+	if (likely(tc->name)) {
+		return tc->name;
+	}
+	return "UNNAMED";
+}
+
+
+/*
+  check if a pointer has the given name. If it does, return the pointer,
+  otherwise return NULL
+*/
+void *talloc_check_name(const void *ptr, const char *name)
+{
+	const char *pname;
+	if (unlikely(ptr == NULL)) return NULL;
+	pname = talloc_get_name(ptr);
+	if (likely(pname == name || strcmp(pname, name) == 0)) {
+		return discard_const_p(void, ptr);
+	}
+	return NULL;
+}
+
+static void talloc_abort_type_missmatch(const char *location,
+					const char *name,
+					const char *expected)
+{
+	const char *reason;
+
+	reason = talloc_asprintf(NULL,
+				 "%s: Type mismatch: name[%s] expected[%s]",
+				 location,
+				 name?name:"NULL",
+				 expected);
+	if (!reason) {
+		reason = "Type mismatch";
+	}
+
+	talloc_abort(reason);
+}
+
+void *_talloc_get_type_abort(const void *ptr, const char *name, const char *location)
+{
+	const char *pname;
+
+	if (unlikely(ptr == NULL)) {
+		talloc_abort_type_missmatch(location, NULL, name);
+		return NULL;
+	}
+
+	pname = talloc_get_name(ptr);
+	if (likely(pname == name || strcmp(pname, name) == 0)) {
+		return discard_const_p(void, ptr);
+	}
+
+	talloc_abort_type_missmatch(location, pname, name);
+	return NULL;
+}
+
+/*
+  this is for compatibility with older versions of talloc
+*/
+void *talloc_init(const char *fmt, ...)
+{
+	va_list ap;
+	void *ptr;
+	const char *name;
+
+	/*
+	 * samba3 expects talloc_report_depth_cb(NULL, ...)
+	 * reports all talloc'ed memory, so we need to enable
+	 * null_tracking
+	 */
+	talloc_enable_null_tracking();
+
+	ptr = __talloc(NULL, 0);
+	if (unlikely(ptr == NULL)) return NULL;
+
+	va_start(ap, fmt);
+	name = talloc_set_name_v(ptr, fmt, ap);
+	va_end(ap);
+
+	if (unlikely(name == NULL)) {
+		_talloc_free(ptr);
+		return NULL;
+	}
+
+	return ptr;
+}
+
+/*
+  this is a replacement for the Samba3 talloc_destroy_pool functionality. It
+  should probably not be used in new code. It's in here to keep the talloc
+  code consistent across Samba 3 and 4.
+*/
+void talloc_free_children(void *ptr)
+{
+	struct talloc_chunk *tc;
+
+	if (unlikely(ptr == NULL)) {
+		return;
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	while (tc->child) {
+		/* we need to work out who will own an abandoned child
+		   if it cannot be freed. In priority order, the first
+		   choice is owner of any remaining reference to this
+		   pointer, the second choice is our parent, and the
+		   final choice is the null context. */
+		void *child = TC_PTR_FROM_CHUNK(tc->child);
+		const void *new_parent = null_context;
+		if (unlikely(tc->child->refs)) {
+			struct talloc_chunk *p = talloc_parent_chunk(tc->child->refs);
+			if (p) new_parent = TC_PTR_FROM_CHUNK(p);
+		}
+		if (unlikely(_talloc_free(child) == -1)) {
+			if (new_parent == null_context) {
+				struct talloc_chunk *p = talloc_parent_chunk(ptr);
+				if (p) new_parent = TC_PTR_FROM_CHUNK(p);
+			}
+			talloc_steal(new_parent, child);
+		}
+	}
+
+	if ((tc->flags & TALLOC_FLAG_POOL)
+	    && (*talloc_pool_objectcount(tc) == 1)) {
+		tc->pool = ((char *)tc + TC_HDR_SIZE + TALLOC_POOL_HDR_SIZE);
+#if defined(DEVELOPER) && defined(VALGRIND_MAKE_MEM_NOACCESS)
+		VALGRIND_MAKE_MEM_NOACCESS(
+			tc->pool, tc->size - TALLOC_POOL_HDR_SIZE);
+#endif
+	}
+}
+
+/* 
+   Allocate a bit of memory as a child of an existing pointer
+*/
+void *_talloc(const void *context, size_t size)
+{
+	return __talloc(context, size);
+}
+
+/*
+  externally callable talloc_set_name_const()
+*/
+void talloc_set_name_const(const void *ptr, const char *name)
+{
+	_talloc_set_name_const(ptr, name);
+}
+
+/*
+  create a named talloc pointer. Any talloc pointer can be named, and
+  talloc_named() operates just like talloc() except that it allows you
+  to name the pointer.
+*/
+void *talloc_named_const(const void *context, size_t size, const char *name)
+{
+	return _talloc_named_const(context, size, name);
+}
+
+/* 
+   free a talloc pointer. This also frees all child pointers of this 
+   pointer recursively
+
+   return 0 if the memory is actually freed, otherwise -1. The memory
+   will not be freed if the ref_count is > 1 or the destructor (if
+   any) returns non-zero
+*/
+int talloc_free(void *ptr)
+{
+	return _talloc_free(ptr);
+}
+
+
+
+/*
+  A talloc version of realloc. The context argument is only used if
+  ptr is NULL
+*/
+void *_talloc_realloc(const void *context, void *ptr, size_t size, const char *name)
+{
+	struct talloc_chunk *tc;
+	void *new_ptr;
+	bool malloced = false;
+
+	/* size zero is equivalent to free() */
+	if (unlikely(size == 0)) {
+		_talloc_free(ptr);
+		return NULL;
+	}
+
+	if (unlikely(size >= MAX_TALLOC_SIZE)) {
+		return NULL;
+	}
+
+	/* realloc(NULL) is equivalent to malloc() */
+	if (ptr == NULL) {
+		return _talloc_named_const(context, size, name);
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	/* don't allow realloc on referenced pointers */
+	if (unlikely(tc->refs)) {
+		return NULL;
+	}
+
+	/* don't let anybody try to realloc a talloc_pool */
+	if (unlikely(tc->flags & TALLOC_FLAG_POOL)) {
+		return NULL;
+	}
+
+	/* don't shrink if we have less than 1k to gain */
+	if ((size < tc->size) && ((tc->size - size) < 1024)) {
+		tc->size = size;
+		return ptr;
+	}
+
+	/* by resetting magic we catch users of the old memory */
+	tc->flags |= TALLOC_FLAG_FREE;
+
+#if ALWAYS_REALLOC
+	new_ptr = malloc(size + TC_HDR_SIZE);
+	if (new_ptr) {
+		memcpy(new_ptr, tc, tc->size + TC_HDR_SIZE);
+		free(tc);
+	}
+#else
+	if (tc->flags & TALLOC_FLAG_POOLMEM) {
+
+		new_ptr = talloc_alloc_pool(tc, size + TC_HDR_SIZE);
+		*talloc_pool_objectcount((struct talloc_chunk *)
+					 (tc->pool)) -= 1;
+
+		if (new_ptr == NULL) {
+			new_ptr = malloc(TC_HDR_SIZE+size);
+			malloced = true;
+		}
+
+		if (new_ptr) {
+			memcpy(new_ptr, tc, MIN(tc->size,size) + TC_HDR_SIZE);
+		}
+	}
+	else {
+		new_ptr = realloc(tc, size + TC_HDR_SIZE);
+	}
+#endif
+	if (unlikely(!new_ptr)) {	
+		tc->flags &= ~TALLOC_FLAG_FREE; 
+		return NULL; 
+	}
+
+	tc = (struct talloc_chunk *)new_ptr;
+	tc->flags &= ~TALLOC_FLAG_FREE;
+	if (malloced) {
+		tc->flags &= ~TALLOC_FLAG_POOLMEM;
+	}
+	if (tc->parent) {
+		tc->parent->child = tc;
+	}
+	if (tc->child) {
+		tc->child->parent = tc;
+	}
+
+	if (tc->prev) {
+		tc->prev->next = tc;
+	}
+	if (tc->next) {
+		tc->next->prev = tc;
+	}
+
+	tc->size = size;
+	_talloc_set_name_const(TC_PTR_FROM_CHUNK(tc), name);
+
+	return TC_PTR_FROM_CHUNK(tc);
+}
+
+/*
+  a wrapper around talloc_steal() for situations where you are moving a pointer
+  between two structures, and want the old pointer to be set to NULL
+*/
+void *_talloc_move(const void *new_ctx, const void *_pptr)
+{
+	const void **pptr = discard_const_p(const void *,_pptr);
+	void *ret = _talloc_steal(new_ctx, *pptr);
+	(*pptr) = NULL;
+	return ret;
+}
+
+/*
+  return the total size of a talloc pool (subtree)
+*/
+size_t talloc_total_size(const void *ptr)
+{
+	size_t total = 0;
+	struct talloc_chunk *c, *tc;
+
+	if (ptr == NULL) {
+		ptr = null_context;
+	}
+	if (ptr == NULL) {
+		return 0;
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	if (tc->flags & TALLOC_FLAG_LOOP) {
+		return 0;
+	}
+
+	tc->flags |= TALLOC_FLAG_LOOP;
+
+	total = tc->size;
+	for (c=tc->child;c;c=c->next) {
+		total += talloc_total_size(TC_PTR_FROM_CHUNK(c));
+	}
+
+	tc->flags &= ~TALLOC_FLAG_LOOP;
+
+	return total;
+}
+
+/*
+  return the total number of blocks in a talloc pool (subtree)
+*/
+size_t talloc_total_blocks(const void *ptr)
+{
+	size_t total = 0;
+	struct talloc_chunk *c, *tc = talloc_chunk_from_ptr(ptr);
+
+	if (tc->flags & TALLOC_FLAG_LOOP) {
+		return 0;
+	}
+
+	tc->flags |= TALLOC_FLAG_LOOP;
+
+	total++;
+	for (c=tc->child;c;c=c->next) {
+		total += talloc_total_blocks(TC_PTR_FROM_CHUNK(c));
+	}
+
+	tc->flags &= ~TALLOC_FLAG_LOOP;
+
+	return total;
+}
+
+/*
+  return the number of external references to a pointer
+*/
+size_t talloc_reference_count(const void *ptr)
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	struct talloc_reference_handle *h;
+	size_t ret = 0;
+
+	for (h=tc->refs;h;h=h->next) {
+		ret++;
+	}
+	return ret;
+}
+
+/*
+  report on memory usage by all children of a pointer, giving a full tree view
+*/
+void talloc_report_depth_cb(const void *ptr, int depth, int max_depth,
+			    void (*callback)(const void *ptr,
+			  		     int depth, int max_depth,
+					     int is_ref,
+					     void *private_data),
+			    void *private_data)
+{
+	struct talloc_chunk *c, *tc;
+
+	if (ptr == NULL) {
+		ptr = null_context;
+	}
+	if (ptr == NULL) return;
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	if (tc->flags & TALLOC_FLAG_LOOP) {
+		return;
+	}
+
+	callback(ptr, depth, max_depth, 0, private_data);
+
+	if (max_depth >= 0 && depth >= max_depth) {
+		return;
+	}
+
+	tc->flags |= TALLOC_FLAG_LOOP;
+	for (c=tc->child;c;c=c->next) {
+		if (c->name == TALLOC_MAGIC_REFERENCE) {
+			struct talloc_reference_handle *h = (struct talloc_reference_handle *)TC_PTR_FROM_CHUNK(c);
+			callback(h->ptr, depth + 1, max_depth, 1, private_data);
+		} else {
+			talloc_report_depth_cb(TC_PTR_FROM_CHUNK(c), depth + 1, max_depth, callback, private_data);
+		}
+	}
+	tc->flags &= ~TALLOC_FLAG_LOOP;
+}
+
+static void talloc_report_depth_FILE_helper(const void *ptr, int depth, int max_depth, int is_ref, void *_f)
+{
+	const char *name = talloc_get_name(ptr);
+	FILE *f = (FILE *)_f;
+
+	if (is_ref) {
+		fprintf(f, "%*sreference to: %s\n", depth*4, "", name);
+		return;
+	}
+
+	if (depth == 0) {
+		fprintf(f,"%stalloc report on '%s' (total %6lu bytes in %3lu blocks)\n", 
+			(max_depth < 0 ? "full " :""), name,
+			(unsigned long)talloc_total_size(ptr),
+			(unsigned long)talloc_total_blocks(ptr));
+		return;
+	}
+
+	fprintf(f, "%*s%-30s contains %6lu bytes in %3lu blocks (ref %d) %p\n", 
+		depth*4, "",
+		name,
+		(unsigned long)talloc_total_size(ptr),
+		(unsigned long)talloc_total_blocks(ptr),
+		(int)talloc_reference_count(ptr), ptr);
+
+#if 0
+	fprintf(f, "content: ");
+	if (talloc_total_size(ptr)) {
+		int tot = talloc_total_size(ptr);
+		int i;
+
+		for (i = 0; i < tot; i++) {
+			if ((((char *)ptr)[i] > 31) && (((char *)ptr)[i] < 126)) {
+				fprintf(f, "%c", ((char *)ptr)[i]);
+			} else {
+				fprintf(f, "~%02x", ((char *)ptr)[i]);
+			}
+		}
+	}
+	fprintf(f, "\n");
+#endif
+}
+
+/*
+  report on memory usage by all children of a pointer, giving a full tree view
+*/
+void talloc_report_depth_file(const void *ptr, int depth, int max_depth, FILE *f)
+{
+	talloc_report_depth_cb(ptr, depth, max_depth, talloc_report_depth_FILE_helper, f);
+	fflush(f);
+}
+
+/*
+  report on memory usage by all children of a pointer, giving a full tree view
+*/
+void talloc_report_full(const void *ptr, FILE *f)
+{
+	talloc_report_depth_file(ptr, 0, -1, f);
+}
+
+/*
+  report on memory usage by all children of a pointer
+*/
+void talloc_report(const void *ptr, FILE *f)
+{
+	talloc_report_depth_file(ptr, 0, 1, f);
+}
+
+/*
+  report on any memory hanging off the null context
+*/
+static void talloc_report_null(void)
+{
+	if (talloc_total_size(null_context) != 0) {
+		talloc_report(null_context, stderr);
+	}
+}
+
+/*
+  report on any memory hanging off the null context
+*/
+static void talloc_report_null_full(void)
+{
+	if (talloc_total_size(null_context) != 0) {
+		talloc_report_full(null_context, stderr);
+	}
+}
+
+/*
+  enable tracking of the NULL context
+*/
+void talloc_enable_null_tracking(void)
+{
+	if (null_context == NULL) {
+		null_context = _talloc_named_const(NULL, 0, "null_context");
+	}
+}
+
+/*
+  disable tracking of the NULL context
+*/
+void talloc_disable_null_tracking(void)
+{
+	_talloc_free(null_context);
+	null_context = NULL;
+}
+
+/*
+  enable leak reporting on exit
+*/
+void talloc_enable_leak_report(void)
+{
+	talloc_enable_null_tracking();
+	atexit(talloc_report_null);
+}
+
+/*
+  enable full leak reporting on exit
+*/
+void talloc_enable_leak_report_full(void)
+{
+	talloc_enable_null_tracking();
+	atexit(talloc_report_null_full);
+}
+
+/* 
+   talloc and zero memory. 
+*/
+void *_talloc_zero(const void *ctx, size_t size, const char *name)
+{
+	void *p = _talloc_named_const(ctx, size, name);
+
+	if (p) {
+		memset(p, '\0', size);
+	}
+
+	return p;
+}
+
+/*
+  memdup with a talloc. 
+*/
+void *_talloc_memdup(const void *t, const void *p, size_t size, const char *name)
+{
+	void *newp = _talloc_named_const(t, size, name);
+
+	if (likely(newp)) {
+		memcpy(newp, p, size);
+	}
+
+	return newp;
+}
+
+static inline char *__talloc_strlendup(const void *t, const char *p, size_t len)
+{
+	char *ret;
+
+	ret = (char *)__talloc(t, len + 1);
+	if (unlikely(!ret)) return NULL;
+
+	memcpy(ret, p, len);
+	ret[len] = 0;
+
+	_talloc_set_name_const(ret, ret);
+	return ret;
+}
+
+/*
+  strdup with a talloc
+*/
+char *talloc_strdup(const void *t, const char *p)
+{
+	if (unlikely(!p)) return NULL;
+	return __talloc_strlendup(t, p, strlen(p));
+}
+
+/*
+  strndup with a talloc
+*/
+char *talloc_strndup(const void *t, const char *p, size_t n)
+{
+	if (unlikely(!p)) return NULL;
+	return __talloc_strlendup(t, p, strnlen(p, n));
+}
+
+static inline char *__talloc_strlendup_append(char *s, size_t slen,
+					      const char *a, size_t alen)
+{
+	char *ret;
+
+	ret = talloc_realloc(NULL, s, char, slen + alen + 1);
+	if (unlikely(!ret)) return NULL;
+
+	/* append the string and the trailing \0 */
+	memcpy(&ret[slen], a, alen);
+	ret[slen+alen] = 0;
+
+	_talloc_set_name_const(ret, ret);
+	return ret;
+}
+
+/*
+ * Appends at the end of the string.
+ */
+char *talloc_strdup_append(char *s, const char *a)
+{
+	if (unlikely(!s)) {
+		return talloc_strdup(NULL, a);
+	}
+
+	if (unlikely(!a)) {
+		return s;
+	}
+
+	return __talloc_strlendup_append(s, strlen(s), a, strlen(a));
+}
+
+/*
+ * Appends at the end of the talloc'ed buffer,
+ * not the end of the string.
+ */
+char *talloc_strdup_append_buffer(char *s, const char *a)
+{
+	size_t slen;
+
+	if (unlikely(!s)) {
+		return talloc_strdup(NULL, a);
+	}
+
+	if (unlikely(!a)) {
+		return s;
+	}
+
+	slen = talloc_get_size(s);
+	if (likely(slen > 0)) {
+		slen--;
+	}
+
+	return __talloc_strlendup_append(s, slen, a, strlen(a));
+}
+
+/*
+ * Appends at the end of the string.
+ */
+char *talloc_strndup_append(char *s, const char *a, size_t n)
+{
+	if (unlikely(!s)) {
+		return talloc_strdup(NULL, a);
+	}
+
+	if (unlikely(!a)) {
+		return s;
+	}
+
+	return __talloc_strlendup_append(s, strlen(s), a, strnlen(a, n));
+}
+
+/*
+ * Appends at the end of the talloc'ed buffer,
+ * not the end of the string.
+ */
+char *talloc_strndup_append_buffer(char *s, const char *a, size_t n)
+{
+	size_t slen;
+
+	if (unlikely(!s)) {
+		return talloc_strdup(NULL, a);
+	}
+
+	if (unlikely(!a)) {
+		return s;
+	}
+
+	slen = talloc_get_size(s);
+	if (likely(slen > 0)) {
+		slen--;
+	}
+
+	return __talloc_strlendup_append(s, slen, a, strnlen(a, n));
+}
+
+#ifndef HAVE_VA_COPY
+#ifdef HAVE___VA_COPY
+#define va_copy(dest, src) __va_copy(dest, src)
+#else
+#define va_copy(dest, src) (dest) = (src)
+#endif
+#endif
+
+char *talloc_vasprintf(const void *t, const char *fmt, va_list ap)
+{
+	int len;
+	char *ret;
+	va_list ap2;
+	char c;
+
+	/* this call looks strange, but it makes it work on older solaris boxes */
+	va_copy(ap2, ap);
+	len = vsnprintf(&c, 1, fmt, ap2);
+	va_end(ap2);
+	if (unlikely(len < 0)) {
+		return NULL;
+	}
+
+	ret = (char *)__talloc(t, len+1);
+	if (unlikely(!ret)) return NULL;
+
+	va_copy(ap2, ap);
+	vsnprintf(ret, len+1, fmt, ap2);
+	va_end(ap2);
+
+	_talloc_set_name_const(ret, ret);
+	return ret;
+}
+
+
+/*
+  Perform string formatting, and return a pointer to newly allocated
+  memory holding the result, inside a memory pool.
+ */
+char *talloc_asprintf(const void *t, const char *fmt, ...)
+{
+	va_list ap;
+	char *ret;
+
+	va_start(ap, fmt);
+	ret = talloc_vasprintf(t, fmt, ap);
+	va_end(ap);
+	return ret;
+}
+
+static inline char *__talloc_vaslenprintf_append(char *s, size_t slen,
+						 const char *fmt, va_list ap)
+						 PRINTF_ATTRIBUTE(3,0);
+
+static inline char *__talloc_vaslenprintf_append(char *s, size_t slen,
+						 const char *fmt, va_list ap)
+{
+	ssize_t alen;
+	va_list ap2;
+	char c;
+
+	va_copy(ap2, ap);
+	alen = vsnprintf(&c, 1, fmt, ap2);
+	va_end(ap2);
+
+	if (alen <= 0) {
+		/* Either the vsnprintf failed or the format resulted in
+		 * no characters being formatted. In the former case, we
+		 * ought to return NULL, in the latter we ought to return
+		 * the original string. Most current callers of this
+		 * function expect it to never return NULL.
+		 */
+		return s;
+	}
+
+	s = talloc_realloc(NULL, s, char, slen + alen + 1);
+	if (!s) return NULL;
+
+	va_copy(ap2, ap);
+	vsnprintf(s + slen, alen + 1, fmt, ap2);
+	va_end(ap2);
+
+	_talloc_set_name_const(s, s);
+	return s;
+}
+
+/**
+ * Realloc @p s to append the formatted result of @p fmt and @p ap,
+ * and return @p s, which may have moved.  Good for gradually
+ * accumulating output into a string buffer. Appends at the end
+ * of the string.
+ **/
+char *talloc_vasprintf_append(char *s, const char *fmt, va_list ap)
+{
+	if (unlikely(!s)) {
+		return talloc_vasprintf(NULL, fmt, ap);
+	}
+
+	return __talloc_vaslenprintf_append(s, strlen(s), fmt, ap);
+}
+
+/**
+ * Realloc @p s to append the formatted result of @p fmt and @p ap,
+ * and return @p s, which may have moved. Always appends at the
+ * end of the talloc'ed buffer, not the end of the string.
+ **/
+char *talloc_vasprintf_append_buffer(char *s, const char *fmt, va_list ap)
+{
+	size_t slen;
+
+	if (unlikely(!s)) {
+		return talloc_vasprintf(NULL, fmt, ap);
+	}
+
+	slen = talloc_get_size(s);
+	if (likely(slen > 0)) {
+		slen--;
+	}
+
+	return __talloc_vaslenprintf_append(s, slen, fmt, ap);
+}
+
+/*
+  Realloc @p s to append the formatted result of @p fmt and return @p
+  s, which may have moved.  Good for gradually accumulating output
+  into a string buffer.
+ */
+char *talloc_asprintf_append(char *s, const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	s = talloc_vasprintf_append(s, fmt, ap);
+	va_end(ap);
+	return s;
+}
+
+/*
+  Realloc @p s to append the formatted result of @p fmt and return @p
+  s, which may have moved.  Good for gradually accumulating output
+  into a buffer.
+ */
+char *talloc_asprintf_append_buffer(char *s, const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	s = talloc_vasprintf_append_buffer(s, fmt, ap);
+	va_end(ap);
+	return s;
+}
+
+/*
+  alloc an array, checking for integer overflow in the array size
+*/
+void *_talloc_array(const void *ctx, size_t el_size, unsigned count, const char *name)
+{
+	if (count >= MAX_TALLOC_SIZE/el_size) {
+		return NULL;
+	}
+	return _talloc_named_const(ctx, el_size * count, name);
+}
+
+/*
+  alloc an zero array, checking for integer overflow in the array size
+*/
+void *_talloc_zero_array(const void *ctx, size_t el_size, unsigned count, const char *name)
+{
+	if (count >= MAX_TALLOC_SIZE/el_size) {
+		return NULL;
+	}
+	return _talloc_zero(ctx, el_size * count, name);
+}
+
+/*
+  realloc an array, checking for integer overflow in the array size
+*/
+void *_talloc_realloc_array(const void *ctx, void *ptr, size_t el_size, unsigned count, const char *name)
+{
+	if (count >= MAX_TALLOC_SIZE/el_size) {
+		return NULL;
+	}
+	return _talloc_realloc(ctx, ptr, el_size * count, name);
+}
+
+/*
+  a function version of talloc_realloc(), so it can be passed as a function pointer
+  to libraries that want a realloc function (a realloc function encapsulates
+  all the basic capabilities of an allocation library, which is why this is useful)
+*/
+void *talloc_realloc_fn(const void *context, void *ptr, size_t size)
+{
+	return _talloc_realloc(context, ptr, size, NULL);
+}
+
+
+static int talloc_autofree_destructor(void *ptr)
+{
+	autofree_context = NULL;
+	return 0;
+}
+
+static void talloc_autofree(void)
+{
+	_talloc_free(autofree_context);
+}
+
+/*
+  return a context which will be auto-freed on exit
+  this is useful for reducing the noise in leak reports
+*/
+void *talloc_autofree_context(void)
+{
+	if (autofree_context == NULL) {
+		autofree_context = _talloc_named_const(NULL, 0, "autofree_context");
+		talloc_set_destructor(autofree_context, talloc_autofree_destructor);
+		atexit(talloc_autofree);
+	}
+	return autofree_context;
+}
+
+size_t talloc_get_size(const void *context)
+{
+	struct talloc_chunk *tc;
+
+	if (context == NULL)
+		return 0;
+
+	tc = talloc_chunk_from_ptr(context);
+
+	return tc->size;
+}
+
+/*
+  find a parent of this context that has the given name, if any
+*/
+void *talloc_find_parent_byname(const void *context, const char *name)
+{
+	struct talloc_chunk *tc;
+
+	if (context == NULL) {
+		return NULL;
+	}
+
+	tc = talloc_chunk_from_ptr(context);
+	while (tc) {
+		if (tc->name && strcmp(tc->name, name) == 0) {
+			return TC_PTR_FROM_CHUNK(tc);
+		}
+		while (tc && tc->prev) tc = tc->prev;
+		if (tc) {
+			tc = tc->parent;
+		}
+	}
+	return NULL;
+}
+
+/*
+  show the parentage of a context
+*/
+void talloc_show_parents(const void *context, FILE *file)
+{
+	struct talloc_chunk *tc;
+
+	if (context == NULL) {
+		fprintf(file, "talloc no parents for NULL\n");
+		return;
+	}
+
+	tc = talloc_chunk_from_ptr(context);
+	fprintf(file, "talloc parents of '%s'\n", talloc_get_name(context));
+	while (tc) {
+		fprintf(file, "\t'%s'\n", talloc_get_name(TC_PTR_FROM_CHUNK(tc)));
+		while (tc && tc->prev) tc = tc->prev;
+		if (tc) {
+			tc = tc->parent;
+		}
+	}
+	fflush(file);
+}
+
+/*
+  return 1 if ptr is a parent of context
+*/
+int talloc_is_parent(const void *context, const void *ptr)
+{
+	struct talloc_chunk *tc;
+
+	if (context == NULL) {
+		return 0;
+	}
+
+	tc = talloc_chunk_from_ptr(context);
+	while (tc) {
+		if (TC_PTR_FROM_CHUNK(tc) == ptr) return 1;
+		while (tc && tc->prev) tc = tc->prev;
+		if (tc) {
+			tc = tc->parent;
+		}
+	}
+	return 0;
+}
diff --git a/src/shared/libosmocore/src/timer.c b/src/shared/libosmocore/src/timer.c
new file mode 100644
index 00000000..6d4abc26
--- /dev/null
+++ b/src/shared/libosmocore/src/timer.c
@@ -0,0 +1,264 @@
+/*
+ * (C) 2008,2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * Authors: Holger Hans Peter Freyther <zecke@selfish.org>
+ *	    Harald Welte <laforge@gnumonks.org>
+ *	    Pablo Neira Ayuso <pablo@gnumonks.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/* These store the amount of time that we wait until next timer expires. */
+static struct timeval nearest;
+static struct timeval *nearest_p;
+
+/*! \addtogroup timer
+ *  @{
+ */
+
+/*! \file timer.c
+ */
+
+#include <assert.h>
+#include <string.h>
+#include <limits.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/timer_compat.h>
+#include <osmocom/core/linuxlist.h>
+
+static struct rb_root timer_root = RB_ROOT;
+
+static void __add_timer(struct osmo_timer_list *timer)
+{
+	struct rb_node **new = &(timer_root.rb_node);
+	struct rb_node *parent = NULL;
+
+	while (*new) {
+		struct osmo_timer_list *this;
+
+		this = container_of(*new, struct osmo_timer_list, node);
+
+		parent = *new;
+		if (timercmp(&timer->timeout, &this->timeout, <))
+			new = &((*new)->rb_left);
+		else
+			new = &((*new)->rb_right);
+        }
+
+        rb_link_node(&timer->node, parent, new);
+        rb_insert_color(&timer->node, &timer_root);
+}
+
+/*! \brief add a new timer to the timer management
+ *  \param[in] timer the timer that should be added
+ */
+void osmo_timer_add(struct osmo_timer_list *timer)
+{
+	osmo_timer_del(timer);
+	timer->active = 1;
+	INIT_LLIST_HEAD(&timer->list);
+	__add_timer(timer);
+}
+
+/*! \brief schedule a timer at a given future relative time
+ *  \param[in] timer the to-be-added timer
+ *  \param[in] seconds number of seconds from now
+ *  \param[in] microseconds number of microseconds from now
+ *
+ * This function can be used to (re-)schedule a given timer at a
+ * specified number of seconds+microseconds in the future.  It will
+ * internally add it to the timer management data structures, thus
+ * osmo_timer_add() is automatically called.
+ */
+void
+osmo_timer_schedule(struct osmo_timer_list *timer, int seconds, int microseconds)
+{
+	struct timeval current_time;
+
+	gettimeofday(&current_time, NULL);
+	timer->timeout.tv_sec = seconds;
+	timer->timeout.tv_usec = microseconds;
+	timeradd(&timer->timeout, &current_time, &timer->timeout);
+	osmo_timer_add(timer);
+}
+
+/*! \brief delete a timer from timer management
+ *  \param[in] timer the to-be-deleted timer
+ *
+ * This function can be used to delete a previously added/scheduled
+ * timer from the timer management code.
+ */
+void osmo_timer_del(struct osmo_timer_list *timer)
+{
+	if (timer->active) {
+		timer->active = 0;
+		rb_erase(&timer->node, &timer_root);
+		/* make sure this is not already scheduled for removal. */
+		if (!llist_empty(&timer->list))
+			llist_del_init(&timer->list);
+	}
+}
+
+/*! \brief check if given timer is still pending
+ *  \param[in] timer the to-be-checked timer
+ *  \return 1 if pending, 0 otherwise
+ *
+ * This function can be used to determine whether a given timer
+ * has alredy expired (returns 0) or is still pending (returns 1)
+ */
+int osmo_timer_pending(struct osmo_timer_list *timer)
+{
+	return timer->active;
+}
+
+/*! \brief compute the remaining time of a timer
+ *  \param[in] timer the to-be-checked timer
+ *  \param[in] the current time (NULL if not known)
+ *  \param[out] remaining remaining time until timer fires
+ *  \return 0 if timer has not expired yet, -1 if it has
+ *
+ *  This function can be used to determine the amount of time
+ *  remaining until the expiration of the timer.
+ */
+int osmo_timer_remaining(const struct osmo_timer_list *timer,
+			 const struct timeval *now,
+			 struct timeval *remaining)
+{
+	struct timeval current_time;
+
+	if (!now) {
+		gettimeofday(&current_time, NULL);
+		now = &current_time;
+	}
+
+	timersub(&timer->timeout, &current_time, remaining);
+
+	if (remaining->tv_sec < 0)
+		return -1;
+
+	return 0;
+}
+
+/*
+ * if we have a nearest time return the delta between the current
+ * time and the time of the nearest timer.
+ * If the nearest timer timed out return NULL and then we will
+ * dispatch everything after the select
+ */
+struct timeval *osmo_timers_nearest(void)
+{
+	/* nearest_p is exactly what we need already: NULL if nothing is
+	 * waiting, {0,0} if we must dispatch immediately, and the correct
+	 * delay if we need to wait */
+	return nearest_p;
+}
+
+static void update_nearest(struct timeval *cand, struct timeval *current)
+{
+	if (cand->tv_sec != LONG_MAX) {
+		if (timercmp(cand, current, >))
+			timersub(cand, current, &nearest);
+		else {
+			/* loop again inmediately */
+			nearest.tv_sec = 0;
+			nearest.tv_usec = 0;
+		}
+		nearest_p = &nearest;
+	} else {
+		nearest_p = NULL;
+	}
+}
+
+/*
+ * Find the nearest time and update s_nearest_time
+ */
+void osmo_timers_prepare(void)
+{
+	struct rb_node *node;
+	struct timeval current;
+
+	gettimeofday(&current, NULL);
+
+	node = rb_first(&timer_root);
+	if (node) {
+		struct osmo_timer_list *this;
+		this = container_of(node, struct osmo_timer_list, node);
+		update_nearest(&this->timeout, &current);
+	} else {
+		nearest_p = NULL;
+	}
+}
+
+/*
+ * fire all timers... and remove them
+ */
+int osmo_timers_update(void)
+{
+	struct timeval current_time;
+	struct rb_node *node;
+	struct llist_head timer_eviction_list;
+	struct osmo_timer_list *this;
+	int work = 0;
+
+	gettimeofday(&current_time, NULL);
+
+	INIT_LLIST_HEAD(&timer_eviction_list);
+	for (node = rb_first(&timer_root); node; node = rb_next(node)) {
+		this = container_of(node, struct osmo_timer_list, node);
+
+		if (timercmp(&this->timeout, &current_time, >))
+			break;
+
+		llist_add(&this->list, &timer_eviction_list);
+	}
+
+	/*
+	 * The callbacks might mess with our list and in this case
+	 * even llist_for_each_entry_safe is not safe to use. To allow
+	 * osmo_timer_del to be called from within the callback we need
+	 * to restart the iteration for each element scheduled for removal.
+	 *
+	 * The problematic scenario is the following: Given two timers A
+	 * and B that have expired at the same time. Thus, they are both
+	 * in the eviction list in this order: A, then B. If we remove
+	 * timer B from the A's callback, we continue with B in the next
+	 * iteration step, leading to an access-after-release.
+	 */
+restart:
+	llist_for_each_entry(this, &timer_eviction_list, list) {
+		osmo_timer_del(this);
+		this->cb(this->data);
+		work = 1;
+		goto restart;
+	}
+
+	return work;
+}
+
+int osmo_timers_check(void)
+{
+	struct rb_node *node;
+	int i = 0;
+
+	for (node = rb_first(&timer_root); node; node = rb_next(node)) {
+		i++;
+	}
+	return i;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/utils.c b/src/shared/libosmocore/src/utils.c
new file mode 100644
index 00000000..cf0c9344
--- /dev/null
+++ b/src/shared/libosmocore/src/utils.c
@@ -0,0 +1,215 @@
+
+#include <string.h>
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+
+#include <osmocom/core/utils.h>
+
+/*! \addtogroup utils
+ * @{
+ */
+
+/*! \file utils.c */
+
+static char namebuf[255];
+
+/*! \brief get human-readable string for given value
+ *  \param[in] vs Array of value_string tuples
+ *  \param[in] val Value to be converted
+ *  \returns pointer to human-readable string
+ */
+const char *get_value_string(const struct value_string *vs, uint32_t val)
+{
+	int i;
+
+	for (i = 0;; i++) {
+		if (vs[i].value == 0 && vs[i].str == NULL)
+			break;
+		if (vs[i].value == val)
+			return vs[i].str;
+	}
+
+	snprintf(namebuf, sizeof(namebuf), "unknown 0x%x", val);
+	return namebuf;
+}
+
+/*! \brief get numeric value for given human-readable string
+ *  \param[in] vs Array of value_string tuples
+ *  \param[in] str human-readable string
+ *  \returns numeric value (>0) or negative numer in case of error
+ */
+int get_string_value(const struct value_string *vs, const char *str)
+{
+	int i;
+
+	for (i = 0;; i++) {
+		if (vs[i].value == 0 && vs[i].str == NULL)
+			break;
+		if (!strcasecmp(vs[i].str, str))
+			return vs[i].value;
+	}
+	return -EINVAL;
+}
+
+/*! \brief Convert BCD-encoded digit into printable character
+ *  \param[in] bcd A single BCD-encoded digit
+ *  \returns single printable character
+ */
+char osmo_bcd2char(uint8_t bcd)
+{
+	if (bcd < 0xa)
+		return '0' + bcd;
+	else
+		return 'A' + (bcd - 0xa);
+}
+
+/* only works for numbers in ascii */
+uint8_t osmo_char2bcd(char c)
+{
+	return c - 0x30;
+}
+
+int osmo_hexparse(const char *str, uint8_t *b, int max_len)
+
+{
+	int i, l, v;
+
+	l = strlen(str);
+	if ((l&1) || ((l>>1) > max_len))
+		return -1;
+
+	memset(b, 0x00, max_len);
+
+	for (i=0; i<l; i++) {
+		char c = str[i];
+		if (c >= '0' && c <= '9')
+			v = c - '0';
+		else if (c >= 'a' && c <= 'f')
+			v = 10 + (c - 'a');
+		else if (c >= 'A' && c <= 'F')
+			v = 10 + (c - 'A');
+		else
+			return -1;
+		b[i>>1] |= v << (i&1 ? 0 : 4);
+	}
+
+	return i>>1;
+}
+
+static char hexd_buff[4096];
+
+static char *_osmo_hexdump(const unsigned char *buf, int len, char *delim)
+{
+	int i;
+	char *cur = hexd_buff;
+
+	hexd_buff[0] = 0;
+	for (i = 0; i < len; i++) {
+		int len_remain = sizeof(hexd_buff) - (cur - hexd_buff);
+		if (len_remain <= 0)
+			break;
+		int rc = snprintf(cur, len_remain, "%02x%s", buf[i], delim);
+		if (rc <= 0)
+			break;
+		cur += rc;
+	}
+	hexd_buff[sizeof(hexd_buff)-1] = 0;
+	return hexd_buff;
+}
+
+/*! \brief Convert a sequence of unpacked bits to ASCII string
+ * \param[in] bits A sequence of unpacked bits
+ * \param[in] len Length of bits
+ */
+char *osmo_ubit_dump(const uint8_t *bits, unsigned int len)
+{
+	int i;
+
+	if (len > sizeof(hexd_buff)-1)
+		len = sizeof(hexd_buff)-1;
+	memset(hexd_buff, 0, sizeof(hexd_buff));
+
+	for (i = 0; i < len; i++) {
+		char outch;
+		switch (bits[i]) {
+		case 0:
+			outch = '0';
+			break;
+		case 0xff:
+			outch = '?';
+			break;
+		case 1:
+			outch = '1';
+			break;
+		default:
+			outch = 'E';
+			break;
+		}
+		hexd_buff[i] = outch;
+	}
+	hexd_buff[sizeof(hexd_buff)-1] = 0;
+	return hexd_buff;
+}
+
+/*! \brief Convert binary sequence to hexadecimal ASCII string
+ *  \param[in] buf pointer to sequence of bytes
+ *  \param[in] len length of buf in number of bytes
+ *  \returns pointer to zero-terminated string
+ *
+ * This function will print a sequence of bytes as hexadecimal numbers,
+ * adding one space character between each byte (e.g. "1a ef d9")
+ */
+char *osmo_hexdump(const unsigned char *buf, int len)
+{
+	return _osmo_hexdump(buf, len, " ");
+}
+
+/*! \brief Convert binary sequence to hexadecimal ASCII string
+ *  \param[in] buf pointer to sequence of bytes
+ *  \param[in] len length of buf in number of bytes
+ *  \returns pointer to zero-terminated string
+ *
+ * This function will print a sequence of bytes as hexadecimal numbers,
+ * without any space character between each byte (e.g. "1aefd9")
+ */
+char *osmo_hexdump_nospc(const unsigned char *buf, int len)
+{
+	return _osmo_hexdump(buf, len, "");
+}
+
+	/* Compat with previous typo to preserve abi */
+char *osmo_osmo_hexdump_nospc(const unsigned char *buf, int len)
+	__attribute__((weak, alias("osmo_hexdump_nospc")));
+
+#include "../config.h"
+#ifdef HAVE_CTYPE_H
+#include <ctype.h>
+/*! \brief Convert an entire string to lower case
+ *  \param[out] out output string, caller-allocated
+ *  \param[in] in input string
+ */
+void osmo_str2lower(char *out, const char *in)
+{
+	unsigned int i;
+
+	for (i = 0; i < strlen(in); i++)
+		out[i] = tolower(in[i]);
+	out[strlen(in)] = '\0';
+}
+
+/*! \brief Convert an entire string to upper case
+ *  \param[out] out output string, caller-allocated
+ *  \param[in] in input string
+ */
+void osmo_str2upper(char *out, const char *in)
+{
+	unsigned int i;
+
+	for (i = 0; i < strlen(in); i++)
+		out[i] = toupper(in[i]);
+	out[strlen(in)] = '\0';
+}
+#endif /* HAVE_CTYPE_H */
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/vty/Makefile.am b/src/shared/libosmocore/src/vty/Makefile.am
new file mode 100644
index 00000000..61111235
--- /dev/null
+++ b/src/shared/libosmocore/src/vty/Makefile.am
@@ -0,0 +1,15 @@
+# This is _NOT_ the library release version, it's an API version.
+# Please read Chapter 6 "Library interface versions" of the libtool documentation before making any modification
+LIBVERSION=0:0:0
+
+INCLUDES = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS = -Wall
+
+if ENABLE_VTY
+lib_LTLIBRARIES = libosmovty.la
+
+libosmovty_la_SOURCES = buffer.c command.c vty.c vector.c utils.c \
+			telnet_interface.c logging_vty.c
+libosmovty_la_LDFLAGS = -version-info $(LIBVERSION)
+libosmovty_la_LIBADD = $(top_builddir)/src/libosmocore.la
+endif
diff --git a/src/shared/libosmocore/src/vty/buffer.c b/src/shared/libosmocore/src/vty/buffer.c
new file mode 100644
index 00000000..e385f9fd
--- /dev/null
+++ b/src/shared/libosmocore/src/vty/buffer.c
@@ -0,0 +1,463 @@
+/*
+ * Buffering of output and input.
+ * Copyright (C) 1998 Kunihiro Ishiguro
+ *
+ * This file is part of GNU Zebra.
+ *
+ * GNU Zebra is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2, or (at your
+ * option) any later version.
+ *
+ * GNU Zebra is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GNU Zebra; see the file COPYING.  If not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <stddef.h>
+#include <sys/uio.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/vty/buffer.h>
+#include <osmocom/vty/vty.h>
+
+/* Buffer master. */
+struct buffer {
+	/* Data list. */
+	struct buffer_data *head;
+	struct buffer_data *tail;
+
+	/* Size of each buffer_data chunk. */
+	size_t size;
+};
+
+/* Data container. */
+struct buffer_data {
+	struct buffer_data *next;
+
+	/* Location to add new data. */
+	size_t cp;
+
+	/* Pointer to data not yet flushed. */
+	size_t sp;
+
+	/* Actual data stream (variable length). */
+	unsigned char data[0];	/* real dimension is buffer->size */
+};
+
+/* It should always be true that: 0 <= sp <= cp <= size */
+
+/* Default buffer size (used if none specified).  It is rounded up to the
+   next page boundery. */
+#define BUFFER_SIZE_DEFAULT		4096
+
+#define BUFFER_DATA_FREE(D) talloc_free((D))
+
+/* Make new buffer. */
+struct buffer *buffer_new(void *ctx, size_t size)
+{
+	struct buffer *b;
+
+	b = talloc_zero(ctx, struct buffer);
+
+	if (size)
+		b->size = size;
+	else {
+		static size_t default_size;
+		if (!default_size) {
+			long pgsz = sysconf(_SC_PAGESIZE);
+			default_size =
+			    ((((BUFFER_SIZE_DEFAULT - 1) / pgsz) + 1) * pgsz);
+		}
+		b->size = default_size;
+	}
+
+	return b;
+}
+
+/* Free buffer. */
+void buffer_free(struct buffer *b)
+{
+	buffer_reset(b);
+	talloc_free(b);
+}
+
+/* Make string clone. */
+char *buffer_getstr(struct buffer *b)
+{
+	size_t totlen = 0;
+	struct buffer_data *data;
+	char *s;
+	char *p;
+
+	for (data = b->head; data; data = data->next)
+		totlen += data->cp - data->sp;
+	if (!(s = _talloc_zero(tall_vty_ctx, (totlen + 1), "buffer_getstr")))
+		return NULL;
+	p = s;
+	for (data = b->head; data; data = data->next) {
+		memcpy(p, data->data + data->sp, data->cp - data->sp);
+		p += data->cp - data->sp;
+	}
+	*p = '\0';
+	return s;
+}
+
+/* Return 1 if buffer is empty. */
+int buffer_empty(struct buffer *b)
+{
+	return (b->head == NULL);
+}
+
+/* Clear and free all allocated data. */
+void buffer_reset(struct buffer *b)
+{
+	struct buffer_data *data;
+	struct buffer_data *next;
+
+	for (data = b->head; data; data = next) {
+		next = data->next;
+		BUFFER_DATA_FREE(data);
+	}
+	b->head = b->tail = NULL;
+}
+
+/* Add buffer_data to the end of buffer. */
+static struct buffer_data *buffer_add(struct buffer *b)
+{
+	struct buffer_data *d;
+
+	d = _talloc_zero(b,
+			 offsetof(struct buffer_data, data[b->size]),
+			 "buffer_add");
+	if (!d)
+		return NULL;
+	d->cp = d->sp = 0;
+	d->next = NULL;
+
+	if (b->tail)
+		b->tail->next = d;
+	else
+		b->head = d;
+	b->tail = d;
+
+	return d;
+}
+
+/* Write data to buffer. */
+void buffer_put(struct buffer *b, const void *p, size_t size)
+{
+	struct buffer_data *data = b->tail;
+	const char *ptr = p;
+
+	/* We use even last one byte of data buffer. */
+	while (size) {
+		size_t chunk;
+
+		/* If there is no data buffer add it. */
+		if (data == NULL || data->cp == b->size)
+			data = buffer_add(b);
+
+		chunk =
+		    ((size <=
+		      (b->size - data->cp)) ? size : (b->size - data->cp));
+		memcpy((data->data + data->cp), ptr, chunk);
+		size -= chunk;
+		ptr += chunk;
+		data->cp += chunk;
+	}
+}
+
+/* Insert character into the buffer. */
+void buffer_putc(struct buffer *b, u_char c)
+{
+	buffer_put(b, &c, 1);
+}
+
+/* Put string to the buffer. */
+void buffer_putstr(struct buffer *b, const char *c)
+{
+	buffer_put(b, c, strlen(c));
+}
+
+/* Keep flushing data to the fd until the buffer is empty or an error is
+   encountered or the operation would block. */
+buffer_status_t buffer_flush_all(struct buffer *b, int fd)
+{
+	buffer_status_t ret;
+	struct buffer_data *head;
+	size_t head_sp;
+
+	if (!b->head)
+		return BUFFER_EMPTY;
+	head_sp = (head = b->head)->sp;
+	/* Flush all data. */
+	while ((ret = buffer_flush_available(b, fd)) == BUFFER_PENDING) {
+		if ((b->head == head) && (head_sp == head->sp)
+		    && (errno != EINTR))
+			/* No data was flushed, so kernel buffer must be full. */
+			return ret;
+		head_sp = (head = b->head)->sp;
+	}
+
+	return ret;
+}
+
+#if 0
+/* Flush enough data to fill a terminal window of the given scene (used only
+   by vty telnet interface). */
+buffer_status_t
+buffer_flush_window(struct buffer * b, int fd, int width, int height,
+		    int erase_flag, int no_more_flag)
+{
+	int nbytes;
+	int iov_alloc;
+	int iov_index;
+	struct iovec *iov;
+	struct iovec small_iov[3];
+	char more[] = " --More-- ";
+	char erase[] =
+	    { 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08,
+		' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ',
+		0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08
+	};
+	struct buffer_data *data;
+	int column;
+
+	if (!b->head)
+		return BUFFER_EMPTY;
+
+	if (height < 1) {
+		zlog_warn
+		    ("%s called with non-positive window height %d, forcing to 1",
+		     __func__, height);
+		height = 1;
+	} else if (height >= 2)
+		height--;
+	if (width < 1) {
+		zlog_warn
+		    ("%s called with non-positive window width %d, forcing to 1",
+		     __func__, width);
+		width = 1;
+	}
+
+	/* For erase and more data add two to b's buffer_data count. */
+	if (b->head->next == NULL) {
+		iov_alloc = sizeof(small_iov) / sizeof(small_iov[0]);
+		iov = small_iov;
+	} else {
+		iov_alloc = ((height * (width + 2)) / b->size) + 10;
+		iov = XMALLOC(MTYPE_TMP, iov_alloc * sizeof(*iov));
+	}
+	iov_index = 0;
+
+	/* Previously print out is performed. */
+	if (erase_flag) {
+		iov[iov_index].iov_base = erase;
+		iov[iov_index].iov_len = sizeof erase;
+		iov_index++;
+	}
+
+	/* Output data. */
+	column = 1;		/* Column position of next character displayed. */
+	for (data = b->head; data && (height > 0); data = data->next) {
+		size_t cp;
+
+		cp = data->sp;
+		while ((cp < data->cp) && (height > 0)) {
+			/* Calculate lines remaining and column position after displaying
+			   this character. */
+			if (data->data[cp] == '\r')
+				column = 1;
+			else if ((data->data[cp] == '\n') || (column == width)) {
+				column = 1;
+				height--;
+			} else
+				column++;
+			cp++;
+		}
+		iov[iov_index].iov_base = (char *)(data->data + data->sp);
+		iov[iov_index++].iov_len = cp - data->sp;
+		data->sp = cp;
+
+		if (iov_index == iov_alloc)
+			/* This should not ordinarily happen. */
+		{
+			iov_alloc *= 2;
+			if (iov != small_iov) {
+				zlog_warn("%s: growing iov array to %d; "
+					  "width %d, height %d, size %lu",
+					  __func__, iov_alloc, width, height,
+					  (u_long) b->size);
+				iov =
+				    XREALLOC(MTYPE_TMP, iov,
+					     iov_alloc * sizeof(*iov));
+			} else {
+				/* This should absolutely never occur. */
+				zlog_err
+				    ("%s: corruption detected: iov_small overflowed; "
+				     "head %p, tail %p, head->next %p",
+				     __func__, b->head, b->tail, b->head->next);
+				iov =
+				    XMALLOC(MTYPE_TMP,
+					    iov_alloc * sizeof(*iov));
+				memcpy(iov, small_iov, sizeof(small_iov));
+			}
+		}
+	}
+
+	/* In case of `more' display need. */
+	if (b->tail && (b->tail->sp < b->tail->cp) && !no_more_flag) {
+		iov[iov_index].iov_base = more;
+		iov[iov_index].iov_len = sizeof more;
+		iov_index++;
+	}
+#ifdef IOV_MAX
+	/* IOV_MAX are normally defined in <sys/uio.h> , Posix.1g.
+	   example: Solaris2.6 are defined IOV_MAX size at 16.     */
+	{
+		struct iovec *c_iov = iov;
+		nbytes = 0;	/* Make sure it's initialized. */
+
+		while (iov_index > 0) {
+			int iov_size;
+
+			iov_size =
+			    ((iov_index > IOV_MAX) ? IOV_MAX : iov_index);
+			if ((nbytes = writev(fd, c_iov, iov_size)) < 0) {
+				zlog_warn("%s: writev to fd %d failed: %s",
+					  __func__, fd, safe_strerror(errno));
+				break;
+			}
+
+			/* move pointer io-vector */
+			c_iov += iov_size;
+			iov_index -= iov_size;
+		}
+	}
+#else				/* IOV_MAX */
+	if ((nbytes = writev(fd, iov, iov_index)) < 0)
+		zlog_warn("%s: writev to fd %d failed: %s",
+			  __func__, fd, safe_strerror(errno));
+#endif				/* IOV_MAX */
+
+	/* Free printed buffer data. */
+	while (b->head && (b->head->sp == b->head->cp)) {
+		struct buffer_data *del;
+		if (!(b->head = (del = b->head)->next))
+			b->tail = NULL;
+		BUFFER_DATA_FREE(del);
+	}
+
+	if (iov != small_iov)
+		XFREE(MTYPE_TMP, iov);
+
+	return (nbytes < 0) ? BUFFER_ERROR :
+	    (b->head ? BUFFER_PENDING : BUFFER_EMPTY);
+}
+#endif
+
+/* This function (unlike other buffer_flush* functions above) is designed
+to work with non-blocking sockets.  It does not attempt to write out
+all of the queued data, just a "big" chunk.  It returns 0 if it was
+able to empty out the buffers completely, 1 if more flushing is
+required later, or -1 on a fatal write error. */
+buffer_status_t buffer_flush_available(struct buffer * b, int fd)
+{
+
+/* These are just reasonable values to make sure a significant amount of
+data is written.  There's no need to go crazy and try to write it all
+in one shot. */
+#ifdef IOV_MAX
+#define MAX_CHUNKS ((IOV_MAX >= 16) ? 16 : IOV_MAX)
+#else
+#define MAX_CHUNKS 16
+#endif
+#define MAX_FLUSH 131072
+
+	struct buffer_data *d;
+	size_t written;
+	struct iovec iov[MAX_CHUNKS];
+	size_t iovcnt = 0;
+	size_t nbyte = 0;
+
+	for (d = b->head; d && (iovcnt < MAX_CHUNKS) && (nbyte < MAX_FLUSH);
+	     d = d->next, iovcnt++) {
+		iov[iovcnt].iov_base = d->data + d->sp;
+		nbyte += (iov[iovcnt].iov_len = d->cp - d->sp);
+	}
+
+	if (!nbyte)
+		/* No data to flush: should we issue a warning message? */
+		return BUFFER_EMPTY;
+
+	/* only place where written should be sign compared */
+	if ((ssize_t) (written = writev(fd, iov, iovcnt)) < 0) {
+		if (ERRNO_IO_RETRY(errno))
+			/* Calling code should try again later. */
+			return BUFFER_PENDING;
+		return BUFFER_ERROR;
+	}
+
+	/* Free printed buffer data. */
+	while (written > 0) {
+		struct buffer_data *d;
+		if (!(d = b->head))
+			break;
+		if (written < d->cp - d->sp) {
+			d->sp += written;
+			return BUFFER_PENDING;
+		}
+
+		written -= (d->cp - d->sp);
+		if (!(b->head = d->next))
+			b->tail = NULL;
+		BUFFER_DATA_FREE(d);
+	}
+
+	return b->head ? BUFFER_PENDING : BUFFER_EMPTY;
+
+#undef MAX_CHUNKS
+#undef MAX_FLUSH
+}
+
+buffer_status_t
+buffer_write(struct buffer * b, int fd, const void *p, size_t size)
+{
+	ssize_t nbytes;
+
+#if 0
+	/* Should we attempt to drain any previously buffered data?  This could help reduce latency in pushing out the data if we are stuck in a long-running thread that is preventing the main select loop from calling the flush thread... */
+
+	if (b->head && (buffer_flush_available(b, fd) == BUFFER_ERROR))
+		return BUFFER_ERROR;
+#endif
+	if (b->head)
+		/* Buffer is not empty, so do not attempt to write the new data. */
+		nbytes = 0;
+	else if ((nbytes = write(fd, p, size)) < 0) {
+		if (ERRNO_IO_RETRY(errno))
+			nbytes = 0;
+		else
+			return BUFFER_ERROR;
+	}
+	/* Add any remaining data to the buffer. */
+	{
+		size_t written = nbytes;
+		if (written < size)
+			buffer_put(b, ((const char *)p) + written,
+				   size - written);
+	}
+	return b->head ? BUFFER_PENDING : BUFFER_EMPTY;
+}
diff --git a/src/shared/libosmocore/src/vty/command.c b/src/shared/libosmocore/src/vty/command.c
new file mode 100644
index 00000000..7f83a5e4
--- /dev/null
+++ b/src/shared/libosmocore/src/vty/command.c
@@ -0,0 +1,3473 @@
+/*
+   $Id: command.c,v 1.47 2005/04/25 16:26:42 paul Exp $
+
+   Command interpreter routine for virtual terminal [aka TeletYpe]
+   Copyright (C) 1997, 98, 99 Kunihiro Ishiguro
+
+This file is part of GNU Zebra.
+
+GNU Zebra is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published
+by the Free Software Foundation; either version 2, or (at your
+option) any later version.
+
+GNU Zebra is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Zebra; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+Boston, MA 02111-1307, USA.  */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <syslog.h>
+#include <errno.h>
+#define _XOPEN_SOURCE
+#include <unistd.h>
+#include <assert.h>
+#include <ctype.h>
+#include <time.h>
+#include <sys/time.h>
+#include <sys/stat.h>
+
+#include <osmocom/vty/vector.h>
+#include <osmocom/vty/vty.h>
+#include <osmocom/vty/command.h>
+
+#include <osmocom/core/talloc.h>
+
+/*! \addtogroup command
+ * @{
+ */
+/*! \file command.c */
+
+#define CONFIGFILE_MASK 022
+
+void *tall_vty_cmd_ctx;
+
+/* Command vector which includes some level of command lists. Normally
+   each daemon maintains each own cmdvec. */
+vector cmdvec;
+
+/* Host information structure. */
+struct host host;
+
+/* Standard command node structures. */
+struct cmd_node auth_node = {
+	AUTH_NODE,
+	"Password: ",
+};
+
+struct cmd_node view_node = {
+	VIEW_NODE,
+	"%s> ",
+};
+
+struct cmd_node auth_enable_node = {
+	AUTH_ENABLE_NODE,
+	"Password: ",
+};
+
+struct cmd_node enable_node = {
+	ENABLE_NODE,
+	"%s# ",
+};
+
+struct cmd_node config_node = {
+	CONFIG_NODE,
+	"%s(config)# ",
+	1
+};
+
+/* Default motd string. */
+const char *default_motd = "";
+
+/*! \brief print the version (and optionally copyright) information
+ *
+ * This is called from main when a daemon is invoked with -v or --version. */
+void print_version(int print_copyright)
+{
+	printf("%s version %s\n", host.app_info->name, host.app_info->version);
+	if (print_copyright)
+		printf("\n%s\n", host.app_info->copyright);
+}
+
+/* Utility function to concatenate argv argument into a single string
+   with inserting ' ' character between each argument.  */
+char *argv_concat(const char **argv, int argc, int shift)
+{
+	int i;
+	size_t len;
+	char *str;
+	char *p;
+
+	len = 0;
+	for (i = shift; i < argc; i++)
+		len += strlen(argv[i]) + 1;
+	if (!len)
+		return NULL;
+	p = str = _talloc_zero(tall_vty_cmd_ctx, len, "arvg_concat");
+	for (i = shift; i < argc; i++) {
+		size_t arglen;
+		memcpy(p, argv[i], (arglen = strlen(argv[i])));
+		p += arglen;
+		*p++ = ' ';
+	}
+	*(p - 1) = '\0';
+	return str;
+}
+
+/*! \brief Install top node of command vector. */
+void install_node(struct cmd_node *node, int (*func) (struct vty *))
+{
+	vector_set_index(cmdvec, node->node, node);
+	node->func = func;
+	node->cmd_vector = vector_init(VECTOR_MIN_SIZE);
+}
+
+/* Compare two command's string.  Used in sort_node (). */
+static int cmp_node(const void *p, const void *q)
+{
+	struct cmd_element *a = *(struct cmd_element **)p;
+	struct cmd_element *b = *(struct cmd_element **)q;
+
+	return strcmp(a->string, b->string);
+}
+
+static int cmp_desc(const void *p, const void *q)
+{
+	struct desc *a = *(struct desc **)p;
+	struct desc *b = *(struct desc **)q;
+
+	return strcmp(a->cmd, b->cmd);
+}
+
+static int is_config(struct vty *vty)
+{
+	if (vty->node <= CONFIG_NODE)
+		return 0;
+	else if (vty->node > CONFIG_NODE && vty->node < _LAST_OSMOVTY_NODE)
+		return 1;
+	else if (host.app_info->is_config_node)
+		return host.app_info->is_config_node(vty, vty->node);
+	else
+		return vty->node > CONFIG_NODE;
+}
+
+/*! \brief Sort each node's command element according to command string. */
+void sort_node(void)
+{
+	unsigned int i, j;
+	struct cmd_node *cnode;
+	vector descvec;
+	struct cmd_element *cmd_element;
+
+	for (i = 0; i < vector_active(cmdvec); i++)
+		if ((cnode = vector_slot(cmdvec, i)) != NULL) {
+			vector cmd_vector = cnode->cmd_vector;
+			qsort(cmd_vector->index, vector_active(cmd_vector),
+			      sizeof(void *), cmp_node);
+
+			for (j = 0; j < vector_active(cmd_vector); j++)
+				if ((cmd_element =
+				     vector_slot(cmd_vector, j)) != NULL
+				    && vector_active(cmd_element->strvec)) {
+					descvec =
+					    vector_slot(cmd_element->strvec,
+							vector_active
+							(cmd_element->strvec) -
+							1);
+					qsort(descvec->index,
+					      vector_active(descvec),
+					      sizeof(void *), cmp_desc);
+				}
+		}
+}
+
+/*! Breaking up string into each command piece. I assume given
+   character is separated by a space character. Return value is a
+   vector which includes char ** data element. */
+vector cmd_make_strvec(const char *string)
+{
+	const char *cp, *start;
+	char *token;
+	int strlen;
+	vector strvec;
+
+	if (string == NULL)
+		return NULL;
+
+	cp = string;
+
+	/* Skip white spaces. */
+	while (isspace((int)*cp) && *cp != '\0')
+		cp++;
+
+	/* Return if there is only white spaces */
+	if (*cp == '\0')
+		return NULL;
+
+	if (*cp == '!' || *cp == '#')
+		return NULL;
+
+	/* Prepare return vector. */
+	strvec = vector_init(VECTOR_MIN_SIZE);
+
+	/* Copy each command piece and set into vector. */
+	while (1) {
+		start = cp;
+		while (!(isspace((int)*cp) || *cp == '\r' || *cp == '\n') &&
+		       *cp != '\0')
+			cp++;
+		strlen = cp - start;
+		token = _talloc_zero(tall_vty_cmd_ctx, strlen + 1, "make_strvec");
+		memcpy(token, start, strlen);
+		*(token + strlen) = '\0';
+		vector_set(strvec, token);
+
+		while ((isspace((int)*cp) || *cp == '\n' || *cp == '\r') &&
+		       *cp != '\0')
+			cp++;
+
+		if (*cp == '\0')
+			return strvec;
+	}
+}
+
+/*! \brief Free allocated string vector. */
+void cmd_free_strvec(vector v)
+{
+	unsigned int i;
+	char *cp;
+
+	if (!v)
+		return;
+
+	for (i = 0; i < vector_active(v); i++)
+		if ((cp = vector_slot(v, i)) != NULL)
+			talloc_free(cp);
+
+	vector_free(v);
+}
+
+/*! \brief Fetch next description.  Used in \ref cmd_make_descvec(). */
+static char *cmd_desc_str(const char **string)
+{
+	const char *cp, *start;
+	char *token;
+	int strlen;
+
+	cp = *string;
+
+	if (cp == NULL)
+		return NULL;
+
+	/* Skip white spaces. */
+	while (isspace((int)*cp) && *cp != '\0')
+		cp++;
+
+	/* Return if there is only white spaces */
+	if (*cp == '\0')
+		return NULL;
+
+	start = cp;
+
+	while (!(*cp == '\r' || *cp == '\n') && *cp != '\0')
+		cp++;
+
+	strlen = cp - start;
+	token = _talloc_zero(tall_vty_cmd_ctx, strlen + 1, "cmd_desc_str");
+	memcpy(token, start, strlen);
+	*(token + strlen) = '\0';
+
+	*string = cp;
+
+	return token;
+}
+
+/*! \brief New string vector. */
+static vector cmd_make_descvec(const char *string, const char *descstr)
+{
+	int multiple = 0;
+	const char *sp;
+	char *token;
+	int len;
+	const char *cp;
+	const char *dp;
+	vector allvec;
+	vector strvec = NULL;
+	struct desc *desc;
+
+	cp = string;
+	dp = descstr;
+
+	if (cp == NULL)
+		return NULL;
+
+	allvec = vector_init(VECTOR_MIN_SIZE);
+
+	while (1) {
+		while (isspace((int)*cp) && *cp != '\0')
+			cp++;
+
+		if (*cp == '(') {
+			multiple = 1;
+			cp++;
+		}
+		if (*cp == ')') {
+			multiple = 0;
+			cp++;
+		}
+		if (*cp == '|') {
+			if (!multiple) {
+				fprintf(stderr, "Command parse error!: %s\n",
+					string);
+				exit(1);
+			}
+			cp++;
+		}
+
+		while (isspace((int)*cp) && *cp != '\0')
+			cp++;
+
+		if (*cp == '(') {
+			multiple = 1;
+			cp++;
+		}
+
+		if (*cp == '\0')
+			return allvec;
+
+		sp = cp;
+
+		while (!
+		       (isspace((int)*cp) || *cp == '\r' || *cp == '\n'
+			|| *cp == ')' || *cp == '|') && *cp != '\0')
+			cp++;
+
+		len = cp - sp;
+
+		token = _talloc_zero(tall_vty_cmd_ctx, len + 1, "cmd_make_descvec");
+		memcpy(token, sp, len);
+		*(token + len) = '\0';
+
+		desc = talloc_zero(tall_vty_cmd_ctx, struct desc);
+		desc->cmd = token;
+		desc->str = cmd_desc_str(&dp);
+
+		if (multiple) {
+			if (multiple == 1) {
+				strvec = vector_init(VECTOR_MIN_SIZE);
+				vector_set(allvec, strvec);
+			}
+			multiple++;
+		} else {
+			strvec = vector_init(VECTOR_MIN_SIZE);
+			vector_set(allvec, strvec);
+		}
+		vector_set(strvec, desc);
+	}
+}
+
+/* Count mandantory string vector size.  This is to determine inputed
+   command has enough command length. */
+static int cmd_cmdsize(vector strvec)
+{
+	unsigned int i;
+	int size = 0;
+	vector descvec;
+	struct desc *desc;
+
+	for (i = 0; i < vector_active(strvec); i++)
+		if ((descvec = vector_slot(strvec, i)) != NULL) {
+			if ((vector_active(descvec)) == 1
+			    && (desc = vector_slot(descvec, 0)) != NULL) {
+				if (desc->cmd == NULL || CMD_OPTION(desc->cmd))
+					return size;
+				else
+					size++;
+			} else
+				size++;
+		}
+	return size;
+}
+
+/*! \brief Return prompt character of specified node. */
+const char *cmd_prompt(enum node_type node)
+{
+	struct cmd_node *cnode;
+
+	cnode = vector_slot(cmdvec, node);
+	return cnode->prompt;
+}
+
+static char *xml_escape(const char *inp)
+{
+	int _strlen;
+	char *out, *out_ptr;
+	int len = 0, i, j;
+
+	if (!inp)
+		return NULL;
+	_strlen = strlen(inp);
+
+	for (i = 0; i < _strlen; ++i) {
+		switch (inp[i]) {
+		case '"':
+			len += 6;
+			break;
+		case '\'':
+			len += 6;
+			break;
+		case '<':
+			len += 4;
+			break;
+		case '>':
+			len += 4;
+			break;
+		case '&':
+			len += 5;
+			break;
+		default:
+			len += 1;
+			break;
+		}
+	}
+
+	out = talloc_size(NULL, len + 1);
+	if (!out)
+		return NULL;
+
+	out_ptr = out;
+
+#define ADD(out, str) \
+	for (j = 0; j < strlen(str); ++j) \
+		*(out++) = str[j];
+
+	for (i = 0; i < _strlen; ++i) {
+		switch (inp[i]) {
+		case '"':
+			ADD(out_ptr, "&quot;");
+			break;
+		case '\'':
+			ADD(out_ptr, "&apos;");
+			break;
+		case '<':
+			ADD(out_ptr, "&lt;");
+			break;
+		case '>':
+			ADD(out_ptr, "&gt;");
+			break;
+		case '&':
+			ADD(out_ptr, "&amp;");
+			break;
+		default:
+			*(out_ptr++) = inp[i];
+			break;
+		}
+	}
+
+#undef ADD
+
+	out_ptr[0] = '\0';
+	return out;
+}
+
+/*
+ * Write one cmd_element as XML to the given VTY.
+ */
+static int vty_dump_element(struct cmd_element *cmd, struct vty *vty)
+{
+	char *xml_string = xml_escape(cmd->string);
+
+	vty_out(vty, "    <command id='%s'>%s", xml_string, VTY_NEWLINE);
+	vty_out(vty, "      <params>%s", VTY_NEWLINE);
+
+	int j;
+	for (j = 0; j < vector_count(cmd->strvec); ++j) {
+		vector descvec = vector_slot(cmd->strvec, j);
+		int i;
+		for (i = 0; i < vector_active(descvec); ++i) {
+			char *xml_param, *xml_doc;
+			struct desc *desc = vector_slot(descvec, i);
+			if (desc == NULL)
+				continue;
+
+			xml_param = xml_escape(desc->cmd);
+			xml_doc = xml_escape(desc->str);
+			vty_out(vty, "        <param name='%s' doc='%s' />%s",
+				xml_param, xml_doc, VTY_NEWLINE);
+			talloc_free(xml_param);
+			talloc_free(xml_doc);
+		}
+	}
+
+	vty_out(vty, "      </params>%s", VTY_NEWLINE);
+	vty_out(vty, "    </command>%s", VTY_NEWLINE);
+
+	talloc_free(xml_string);
+	return 0;
+}
+
+/*
+ * Dump all nodes and commands associated with a given node as XML to the VTY.
+ */
+static int vty_dump_nodes(struct vty *vty)
+{
+	int i, j;
+
+	vty_out(vty, "<vtydoc xmlns='urn:osmocom:xml:libosmocore:vty:doc:1.0'>%s", VTY_NEWLINE);
+
+	for (i = 0; i < vector_active(cmdvec); ++i) {
+		struct cmd_node *cnode;
+		cnode = vector_slot(cmdvec, i);
+		if (!cnode)
+			continue;
+
+		vty_out(vty, "  <node id='%d'>%s", i, VTY_NEWLINE);
+
+		for (j = 0; j < vector_active(cnode->cmd_vector); ++j) {
+			struct cmd_element *elem;
+			elem = vector_slot(cnode->cmd_vector, j);
+			vty_dump_element(elem, vty);
+		}
+
+		vty_out(vty, "  </node>%s", VTY_NEWLINE);
+	}
+
+	vty_out(vty, "</vtydoc>%s", VTY_NEWLINE);
+
+	return 0;
+}
+
+/*! \brief Install a command into a node
+ *  \param[in] ntype Node Type
+ *  \param[cmd] element to be installed
+ */
+void install_element(enum node_type ntype, struct cmd_element *cmd)
+{
+	struct cmd_node *cnode;
+
+	cnode = vector_slot(cmdvec, ntype);
+
+	if (cnode == NULL) {
+		fprintf(stderr,
+			"Command node %d doesn't exist, please check it\n",
+			ntype);
+		exit(1);
+	}
+
+	vector_set(cnode->cmd_vector, cmd);
+
+	cmd->strvec = cmd_make_descvec(cmd->string, cmd->doc);
+	cmd->cmdsize = cmd_cmdsize(cmd->strvec);
+}
+
+/* Install a command into VIEW and ENABLE node */
+void install_element_ve(struct cmd_element *cmd)
+{
+	install_element(VIEW_NODE, cmd);
+	install_element(ENABLE_NODE, cmd);
+}
+
+#ifdef VTY_CRYPT_PW
+static unsigned char itoa64[] =
+    "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+
+static void to64(char *s, long v, int n)
+{
+	while (--n >= 0) {
+		*s++ = itoa64[v & 0x3f];
+		v >>= 6;
+	}
+}
+
+static char *zencrypt(const char *passwd)
+{
+	char salt[6];
+	struct timeval tv;
+	char *crypt(const char *, const char *);
+
+	gettimeofday(&tv, 0);
+
+	to64(&salt[0], random(), 3);
+	to64(&salt[3], tv.tv_usec, 3);
+	salt[5] = '\0';
+
+	return crypt(passwd, salt);
+}
+#endif
+
+/* This function write configuration of this host. */
+static int config_write_host(struct vty *vty)
+{
+	if (host.name)
+		vty_out(vty, "hostname %s%s", host.name, VTY_NEWLINE);
+
+	if (host.encrypt) {
+		if (host.password_encrypt)
+			vty_out(vty, "password 8 %s%s", host.password_encrypt,
+				VTY_NEWLINE);
+		if (host.enable_encrypt)
+			vty_out(vty, "enable password 8 %s%s",
+				host.enable_encrypt, VTY_NEWLINE);
+	} else {
+		if (host.password)
+			vty_out(vty, "password %s%s", host.password,
+				VTY_NEWLINE);
+		if (host.enable)
+			vty_out(vty, "enable password %s%s", host.enable,
+				VTY_NEWLINE);
+	}
+
+	if (host.advanced)
+		vty_out(vty, "service advanced-vty%s", VTY_NEWLINE);
+
+	if (host.encrypt)
+		vty_out(vty, "service password-encryption%s", VTY_NEWLINE);
+
+	if (host.lines >= 0)
+		vty_out(vty, "service terminal-length %d%s", host.lines,
+			VTY_NEWLINE);
+
+	if (host.motdfile)
+		vty_out(vty, "banner motd file %s%s", host.motdfile,
+			VTY_NEWLINE);
+	else if (!host.motd)
+		vty_out(vty, "no banner motd%s", VTY_NEWLINE);
+
+	return 1;
+}
+
+/* Utility function for getting command vector. */
+static vector cmd_node_vector(vector v, enum node_type ntype)
+{
+	struct cmd_node *cnode = vector_slot(v, ntype);
+	return cnode->cmd_vector;
+}
+
+/* Completion match types. */
+enum match_type {
+	no_match,
+	extend_match,
+	ipv4_prefix_match,
+	ipv4_match,
+	ipv6_prefix_match,
+	ipv6_match,
+	range_match,
+	vararg_match,
+	partly_match,
+	exact_match
+};
+
+static enum match_type cmd_ipv4_match(const char *str)
+{
+	const char *sp;
+	int dots = 0, nums = 0;
+	char buf[4];
+
+	if (str == NULL)
+		return partly_match;
+
+	for (;;) {
+		memset(buf, 0, sizeof(buf));
+		sp = str;
+		while (*str != '\0') {
+			if (*str == '.') {
+				if (dots >= 3)
+					return no_match;
+
+				if (*(str + 1) == '.')
+					return no_match;
+
+				if (*(str + 1) == '\0')
+					return partly_match;
+
+				dots++;
+				break;
+			}
+			if (!isdigit((int)*str))
+				return no_match;
+
+			str++;
+		}
+
+		if (str - sp > 3)
+			return no_match;
+
+		strncpy(buf, sp, str - sp);
+		if (atoi(buf) > 255)
+			return no_match;
+
+		nums++;
+
+		if (*str == '\0')
+			break;
+
+		str++;
+	}
+
+	if (nums < 4)
+		return partly_match;
+
+	return exact_match;
+}
+
+static enum match_type cmd_ipv4_prefix_match(const char *str)
+{
+	const char *sp;
+	int dots = 0;
+	char buf[4];
+
+	if (str == NULL)
+		return partly_match;
+
+	for (;;) {
+		memset(buf, 0, sizeof(buf));
+		sp = str;
+		while (*str != '\0' && *str != '/') {
+			if (*str == '.') {
+				if (dots == 3)
+					return no_match;
+
+				if (*(str + 1) == '.' || *(str + 1) == '/')
+					return no_match;
+
+				if (*(str + 1) == '\0')
+					return partly_match;
+
+				dots++;
+				break;
+			}
+
+			if (!isdigit((int)*str))
+				return no_match;
+
+			str++;
+		}
+
+		if (str - sp > 3)
+			return no_match;
+
+		strncpy(buf, sp, str - sp);
+		if (atoi(buf) > 255)
+			return no_match;
+
+		if (dots == 3) {
+			if (*str == '/') {
+				if (*(str + 1) == '\0')
+					return partly_match;
+
+				str++;
+				break;
+			} else if (*str == '\0')
+				return partly_match;
+		}
+
+		if (*str == '\0')
+			return partly_match;
+
+		str++;
+	}
+
+	sp = str;
+	while (*str != '\0') {
+		if (!isdigit((int)*str))
+			return no_match;
+
+		str++;
+	}
+
+	if (atoi(sp) > 32)
+		return no_match;
+
+	return exact_match;
+}
+
+#define IPV6_ADDR_STR		"0123456789abcdefABCDEF:.%"
+#define IPV6_PREFIX_STR		"0123456789abcdefABCDEF:.%/"
+#define STATE_START		1
+#define STATE_COLON		2
+#define STATE_DOUBLE		3
+#define STATE_ADDR		4
+#define STATE_DOT               5
+#define STATE_SLASH		6
+#define STATE_MASK		7
+
+#ifdef HAVE_IPV6
+
+static enum match_type cmd_ipv6_match(const char *str)
+{
+	int state = STATE_START;
+	int colons = 0, nums = 0, double_colon = 0;
+	const char *sp = NULL;
+	struct sockaddr_in6 sin6_dummy;
+	int ret;
+
+	if (str == NULL)
+		return partly_match;
+
+	if (strspn(str, IPV6_ADDR_STR) != strlen(str))
+		return no_match;
+
+	/* use inet_pton that has a better support,
+	 * for example inet_pton can support the automatic addresses:
+	 *  ::1.2.3.4
+	 */
+	ret = inet_pton(AF_INET6, str, &sin6_dummy.sin6_addr);
+
+	if (ret == 1)
+		return exact_match;
+
+	while (*str != '\0') {
+		switch (state) {
+		case STATE_START:
+			if (*str == ':') {
+				if (*(str + 1) != ':' && *(str + 1) != '\0')
+					return no_match;
+				colons--;
+				state = STATE_COLON;
+			} else {
+				sp = str;
+				state = STATE_ADDR;
+			}
+
+			continue;
+		case STATE_COLON:
+			colons++;
+			if (*(str + 1) == ':')
+				state = STATE_DOUBLE;
+			else {
+				sp = str + 1;
+				state = STATE_ADDR;
+			}
+			break;
+		case STATE_DOUBLE:
+			if (double_colon)
+				return no_match;
+
+			if (*(str + 1) == ':')
+				return no_match;
+			else {
+				if (*(str + 1) != '\0')
+					colons++;
+				sp = str + 1;
+				state = STATE_ADDR;
+			}
+
+			double_colon++;
+			nums++;
+			break;
+		case STATE_ADDR:
+			if (*(str + 1) == ':' || *(str + 1) == '\0') {
+				if (str - sp > 3)
+					return no_match;
+
+				nums++;
+				state = STATE_COLON;
+			}
+			if (*(str + 1) == '.')
+				state = STATE_DOT;
+			break;
+		case STATE_DOT:
+			state = STATE_ADDR;
+			break;
+		default:
+			break;
+		}
+
+		if (nums > 8)
+			return no_match;
+
+		if (colons > 7)
+			return no_match;
+
+		str++;
+	}
+
+#if 0
+	if (nums < 11)
+		return partly_match;
+#endif				/* 0 */
+
+	return exact_match;
+}
+
+static enum match_type cmd_ipv6_prefix_match(const char *str)
+{
+	int state = STATE_START;
+	int colons = 0, nums = 0, double_colon = 0;
+	int mask;
+	const char *sp = NULL;
+	char *endptr = NULL;
+
+	if (str == NULL)
+		return partly_match;
+
+	if (strspn(str, IPV6_PREFIX_STR) != strlen(str))
+		return no_match;
+
+	while (*str != '\0' && state != STATE_MASK) {
+		switch (state) {
+		case STATE_START:
+			if (*str == ':') {
+				if (*(str + 1) != ':' && *(str + 1) != '\0')
+					return no_match;
+				colons--;
+				state = STATE_COLON;
+			} else {
+				sp = str;
+				state = STATE_ADDR;
+			}
+
+			continue;
+		case STATE_COLON:
+			colons++;
+			if (*(str + 1) == '/')
+				return no_match;
+			else if (*(str + 1) == ':')
+				state = STATE_DOUBLE;
+			else {
+				sp = str + 1;
+				state = STATE_ADDR;
+			}
+			break;
+		case STATE_DOUBLE:
+			if (double_colon)
+				return no_match;
+
+			if (*(str + 1) == ':')
+				return no_match;
+			else {
+				if (*(str + 1) != '\0' && *(str + 1) != '/')
+					colons++;
+				sp = str + 1;
+
+				if (*(str + 1) == '/')
+					state = STATE_SLASH;
+				else
+					state = STATE_ADDR;
+			}
+
+			double_colon++;
+			nums += 1;
+			break;
+		case STATE_ADDR:
+			if (*(str + 1) == ':' || *(str + 1) == '.'
+			    || *(str + 1) == '\0' || *(str + 1) == '/') {
+				if (str - sp > 3)
+					return no_match;
+
+				for (; sp <= str; sp++)
+					if (*sp == '/')
+						return no_match;
+
+				nums++;
+
+				if (*(str + 1) == ':')
+					state = STATE_COLON;
+				else if (*(str + 1) == '.')
+					state = STATE_DOT;
+				else if (*(str + 1) == '/')
+					state = STATE_SLASH;
+			}
+			break;
+		case STATE_DOT:
+			state = STATE_ADDR;
+			break;
+		case STATE_SLASH:
+			if (*(str + 1) == '\0')
+				return partly_match;
+
+			state = STATE_MASK;
+			break;
+		default:
+			break;
+		}
+
+		if (nums > 11)
+			return no_match;
+
+		if (colons > 7)
+			return no_match;
+
+		str++;
+	}
+
+	if (state < STATE_MASK)
+		return partly_match;
+
+	mask = strtol(str, &endptr, 10);
+	if (*endptr != '\0')
+		return no_match;
+
+	if (mask < 0 || mask > 128)
+		return no_match;
+
+/* I don't know why mask < 13 makes command match partly.
+   Forgive me to make this comments. I Want to set static default route
+   because of lack of function to originate default in ospf6d; sorry
+       yasu
+  if (mask < 13)
+    return partly_match;
+*/
+
+	return exact_match;
+}
+
+#endif				/* HAVE_IPV6  */
+
+#define DECIMAL_STRLEN_MAX 10
+
+static int cmd_range_match(const char *range, const char *str)
+{
+	char *p;
+	char buf[DECIMAL_STRLEN_MAX + 1];
+	char *endptr = NULL;
+
+	if (str == NULL)
+		return 1;
+
+	if (range[1] == '-') {
+		signed long min = 0, max = 0, val;
+
+		val = strtol(str, &endptr, 10);
+		if (*endptr != '\0')
+			return 0;
+
+		range += 2;
+		p = strchr(range, '-');
+		if (p == NULL)
+			return 0;
+		if (p - range > DECIMAL_STRLEN_MAX)
+			return 0;
+		strncpy(buf, range, p - range);
+		buf[p - range] = '\0';
+		min = -strtol(buf, &endptr, 10);
+		if (*endptr != '\0')
+			return 0;
+
+		range = p + 1;
+		p = strchr(range, '>');
+		if (p == NULL)
+			return 0;
+		if (p - range > DECIMAL_STRLEN_MAX)
+			return 0;
+		strncpy(buf, range, p - range);
+		buf[p - range] = '\0';
+		max = strtol(buf, &endptr, 10);
+		if (*endptr != '\0')
+			return 0;
+
+		if (val < min || val > max)
+			return 0;
+	} else {
+		unsigned long min, max, val;
+
+		val = strtoul(str, &endptr, 10);
+		if (*endptr != '\0')
+			return 0;
+
+		range++;
+		p = strchr(range, '-');
+		if (p == NULL)
+			return 0;
+		if (p - range > DECIMAL_STRLEN_MAX)
+			return 0;
+		strncpy(buf, range, p - range);
+		buf[p - range] = '\0';
+		min = strtoul(buf, &endptr, 10);
+		if (*endptr != '\0')
+			return 0;
+
+		range = p + 1;
+		p = strchr(range, '>');
+		if (p == NULL)
+			return 0;
+		if (p - range > DECIMAL_STRLEN_MAX)
+			return 0;
+		strncpy(buf, range, p - range);
+		buf[p - range] = '\0';
+		max = strtoul(buf, &endptr, 10);
+		if (*endptr != '\0')
+			return 0;
+
+		if (val < min || val > max)
+			return 0;
+	}
+
+	return 1;
+}
+
+/* Make completion match and return match type flag. */
+static enum match_type
+cmd_filter_by_completion(char *command, vector v, unsigned int index)
+{
+	unsigned int i;
+	const char *str;
+	struct cmd_element *cmd_element;
+	enum match_type match_type;
+	vector descvec;
+	struct desc *desc;
+
+	match_type = no_match;
+
+	/* If command and cmd_element string does not match set NULL to vector */
+	for (i = 0; i < vector_active(v); i++)
+		if ((cmd_element = vector_slot(v, i)) != NULL) {
+			if (index >= vector_active(cmd_element->strvec))
+				vector_slot(v, i) = NULL;
+			else {
+				unsigned int j;
+				int matched = 0;
+
+				descvec =
+				    vector_slot(cmd_element->strvec, index);
+
+				for (j = 0; j < vector_active(descvec); j++)
+					if ((desc = vector_slot(descvec, j))) {
+						str = desc->cmd;
+
+						if (CMD_VARARG(str)) {
+							if (match_type <
+							    vararg_match)
+								match_type =
+								    vararg_match;
+							matched++;
+						} else if (CMD_RANGE(str)) {
+							if (cmd_range_match
+							    (str, command)) {
+								if (match_type <
+								    range_match)
+									match_type
+									    =
+									    range_match;
+
+								matched++;
+							}
+						}
+#ifdef HAVE_IPV6
+						else if (CMD_IPV6(str)) {
+							if (cmd_ipv6_match
+							    (command)) {
+								if (match_type <
+								    ipv6_match)
+									match_type
+									    =
+									    ipv6_match;
+
+								matched++;
+							}
+						} else if (CMD_IPV6_PREFIX(str)) {
+							if (cmd_ipv6_prefix_match(command)) {
+								if (match_type <
+								    ipv6_prefix_match)
+									match_type
+									    =
+									    ipv6_prefix_match;
+
+								matched++;
+							}
+						}
+#endif				/* HAVE_IPV6  */
+						else if (CMD_IPV4(str)) {
+							if (cmd_ipv4_match
+							    (command)) {
+								if (match_type <
+								    ipv4_match)
+									match_type
+									    =
+									    ipv4_match;
+
+								matched++;
+							}
+						} else if (CMD_IPV4_PREFIX(str)) {
+							if (cmd_ipv4_prefix_match(command)) {
+								if (match_type <
+								    ipv4_prefix_match)
+									match_type
+									    =
+									    ipv4_prefix_match;
+								matched++;
+							}
+						} else
+							/* Check is this point's argument optional ? */
+						if (CMD_OPTION(str)
+							    ||
+							    CMD_VARIABLE(str)) {
+							if (match_type <
+							    extend_match)
+								match_type =
+								    extend_match;
+							matched++;
+						} else
+						    if (strncmp
+							(command, str,
+							 strlen(command)) ==
+							0) {
+							if (strcmp(command, str)
+							    == 0)
+								match_type =
+								    exact_match;
+							else {
+								if (match_type <
+								    partly_match)
+									match_type
+									    =
+									    partly_match;
+							}
+							matched++;
+						}
+					}
+				if (!matched)
+					vector_slot(v, i) = NULL;
+			}
+		}
+	return match_type;
+}
+
+/* Filter vector by command character with index. */
+static enum match_type
+cmd_filter_by_string(char *command, vector v, unsigned int index)
+{
+	unsigned int i;
+	const char *str;
+	struct cmd_element *cmd_element;
+	enum match_type match_type;
+	vector descvec;
+	struct desc *desc;
+
+	match_type = no_match;
+
+	/* If command and cmd_element string does not match set NULL to vector */
+	for (i = 0; i < vector_active(v); i++)
+		if ((cmd_element = vector_slot(v, i)) != NULL) {
+			/* If given index is bigger than max string vector of command,
+			   set NULL */
+			if (index >= vector_active(cmd_element->strvec))
+				vector_slot(v, i) = NULL;
+			else {
+				unsigned int j;
+				int matched = 0;
+
+				descvec =
+				    vector_slot(cmd_element->strvec, index);
+
+				for (j = 0; j < vector_active(descvec); j++)
+					if ((desc = vector_slot(descvec, j))) {
+						str = desc->cmd;
+
+						if (CMD_VARARG(str)) {
+							if (match_type <
+							    vararg_match)
+								match_type =
+								    vararg_match;
+							matched++;
+						} else if (CMD_RANGE(str)) {
+							if (cmd_range_match
+							    (str, command)) {
+								if (match_type <
+								    range_match)
+									match_type
+									    =
+									    range_match;
+								matched++;
+							}
+						}
+#ifdef HAVE_IPV6
+						else if (CMD_IPV6(str)) {
+							if (cmd_ipv6_match
+							    (command) ==
+							    exact_match) {
+								if (match_type <
+								    ipv6_match)
+									match_type
+									    =
+									    ipv6_match;
+								matched++;
+							}
+						} else if (CMD_IPV6_PREFIX(str)) {
+							if (cmd_ipv6_prefix_match(command) == exact_match) {
+								if (match_type <
+								    ipv6_prefix_match)
+									match_type
+									    =
+									    ipv6_prefix_match;
+								matched++;
+							}
+						}
+#endif				/* HAVE_IPV6  */
+						else if (CMD_IPV4(str)) {
+							if (cmd_ipv4_match
+							    (command) ==
+							    exact_match) {
+								if (match_type <
+								    ipv4_match)
+									match_type
+									    =
+									    ipv4_match;
+								matched++;
+							}
+						} else if (CMD_IPV4_PREFIX(str)) {
+							if (cmd_ipv4_prefix_match(command) == exact_match) {
+								if (match_type <
+								    ipv4_prefix_match)
+									match_type
+									    =
+									    ipv4_prefix_match;
+								matched++;
+							}
+						} else if (CMD_OPTION(str)
+							   || CMD_VARIABLE(str))
+						{
+							if (match_type <
+							    extend_match)
+								match_type =
+								    extend_match;
+							matched++;
+						} else {
+							if (strcmp(command, str)
+							    == 0) {
+								match_type =
+								    exact_match;
+								matched++;
+							}
+						}
+					}
+				if (!matched)
+					vector_slot(v, i) = NULL;
+			}
+		}
+	return match_type;
+}
+
+/* Check ambiguous match */
+static int
+is_cmd_ambiguous(char *command, vector v, int index, enum match_type type)
+{
+	unsigned int i;
+	unsigned int j;
+	const char *str = NULL;
+	struct cmd_element *cmd_element;
+	const char *matched = NULL;
+	vector descvec;
+	struct desc *desc;
+
+	for (i = 0; i < vector_active(v); i++)
+		if ((cmd_element = vector_slot(v, i)) != NULL) {
+			int match = 0;
+
+			descvec = vector_slot(cmd_element->strvec, index);
+
+			for (j = 0; j < vector_active(descvec); j++)
+				if ((desc = vector_slot(descvec, j))) {
+					enum match_type ret;
+
+					str = desc->cmd;
+
+					switch (type) {
+					case exact_match:
+						if (!
+						    (CMD_OPTION(str)
+						     || CMD_VARIABLE(str))
+&& strcmp(command, str) == 0)
+							match++;
+						break;
+					case partly_match:
+						if (!
+						    (CMD_OPTION(str)
+						     || CMD_VARIABLE(str))
+&& strncmp(command, str, strlen(command)) == 0) {
+							if (matched
+							    && strcmp(matched,
+								      str) != 0)
+								return 1;	/* There is ambiguous match. */
+							else
+								matched = str;
+							match++;
+						}
+						break;
+					case range_match:
+						if (cmd_range_match
+						    (str, command)) {
+							if (matched
+							    && strcmp(matched,
+								      str) != 0)
+								return 1;
+							else
+								matched = str;
+							match++;
+						}
+						break;
+#ifdef HAVE_IPV6
+					case ipv6_match:
+						if (CMD_IPV6(str))
+							match++;
+						break;
+					case ipv6_prefix_match:
+						if ((ret =
+						     cmd_ipv6_prefix_match
+						     (command)) != no_match) {
+							if (ret == partly_match)
+								return 2;	/* There is incomplete match. */
+
+							match++;
+						}
+						break;
+#endif				/* HAVE_IPV6 */
+					case ipv4_match:
+						if (CMD_IPV4(str))
+							match++;
+						break;
+					case ipv4_prefix_match:
+						if ((ret =
+						     cmd_ipv4_prefix_match
+						     (command)) != no_match) {
+							if (ret == partly_match)
+								return 2;	/* There is incomplete match. */
+
+							match++;
+						}
+						break;
+					case extend_match:
+						if (CMD_OPTION(str)
+						    || CMD_VARIABLE(str))
+							match++;
+						break;
+					case no_match:
+					default:
+						break;
+					}
+				}
+			if (!match)
+				vector_slot(v, i) = NULL;
+		}
+	return 0;
+}
+
+/* If src matches dst return dst string, otherwise return NULL */
+static const char *cmd_entry_function(const char *src, const char *dst)
+{
+	/* Skip variable arguments. */
+	if (CMD_OPTION(dst) || CMD_VARIABLE(dst) || CMD_VARARG(dst) ||
+	    CMD_IPV4(dst) || CMD_IPV4_PREFIX(dst) || CMD_RANGE(dst))
+		return NULL;
+
+	/* In case of 'command \t', given src is NULL string. */
+	if (src == NULL)
+		return dst;
+
+	/* Matched with input string. */
+	if (strncmp(src, dst, strlen(src)) == 0)
+		return dst;
+
+	return NULL;
+}
+
+/* If src matches dst return dst string, otherwise return NULL */
+/* This version will return the dst string always if it is
+   CMD_VARIABLE for '?' key processing */
+static const char *cmd_entry_function_desc(const char *src, const char *dst)
+{
+	if (CMD_VARARG(dst))
+		return dst;
+
+	if (CMD_RANGE(dst)) {
+		if (cmd_range_match(dst, src))
+			return dst;
+		else
+			return NULL;
+	}
+#ifdef HAVE_IPV6
+	if (CMD_IPV6(dst)) {
+		if (cmd_ipv6_match(src))
+			return dst;
+		else
+			return NULL;
+	}
+
+	if (CMD_IPV6_PREFIX(dst)) {
+		if (cmd_ipv6_prefix_match(src))
+			return dst;
+		else
+			return NULL;
+	}
+#endif				/* HAVE_IPV6 */
+
+	if (CMD_IPV4(dst)) {
+		if (cmd_ipv4_match(src))
+			return dst;
+		else
+			return NULL;
+	}
+
+	if (CMD_IPV4_PREFIX(dst)) {
+		if (cmd_ipv4_prefix_match(src))
+			return dst;
+		else
+			return NULL;
+	}
+
+	/* Optional or variable commands always match on '?' */
+	if (CMD_OPTION(dst) || CMD_VARIABLE(dst))
+		return dst;
+
+	/* In case of 'command \t', given src is NULL string. */
+	if (src == NULL)
+		return dst;
+
+	if (strncmp(src, dst, strlen(src)) == 0)
+		return dst;
+	else
+		return NULL;
+}
+
+/* Check same string element existence.  If it isn't there return
+    1. */
+static int cmd_unique_string(vector v, const char *str)
+{
+	unsigned int i;
+	char *match;
+
+	for (i = 0; i < vector_active(v); i++)
+		if ((match = vector_slot(v, i)) != NULL)
+			if (strcmp(match, str) == 0)
+				return 0;
+	return 1;
+}
+
+/* Compare string to description vector.  If there is same string
+   return 1 else return 0. */
+static int desc_unique_string(vector v, const char *str)
+{
+	unsigned int i;
+	struct desc *desc;
+
+	for (i = 0; i < vector_active(v); i++)
+		if ((desc = vector_slot(v, i)) != NULL)
+			if (strcmp(desc->cmd, str) == 0)
+				return 1;
+	return 0;
+}
+
+static int cmd_try_do_shortcut(enum node_type node, char *first_word)
+{
+	if (first_word != NULL &&
+	    node != AUTH_NODE &&
+	    node != VIEW_NODE &&
+	    node != AUTH_ENABLE_NODE &&
+	    node != ENABLE_NODE && 0 == strcmp("do", first_word))
+		return 1;
+	return 0;
+}
+
+/* '?' describe command support. */
+static vector
+cmd_describe_command_real(vector vline, struct vty *vty, int *status)
+{
+	unsigned int i;
+	vector cmd_vector;
+#define INIT_MATCHVEC_SIZE 10
+	vector matchvec;
+	struct cmd_element *cmd_element;
+	unsigned int index;
+	int ret;
+	enum match_type match;
+	char *command;
+	static struct desc desc_cr = { "<cr>", "" };
+
+	/* Set index. */
+	if (vector_active(vline) == 0) {
+		*status = CMD_ERR_NO_MATCH;
+		return NULL;
+	} else
+		index = vector_active(vline) - 1;
+
+	/* Make copy vector of current node's command vector. */
+	cmd_vector = vector_copy(cmd_node_vector(cmdvec, vty->node));
+
+	/* Prepare match vector */
+	matchvec = vector_init(INIT_MATCHVEC_SIZE);
+
+	/* Filter commands. */
+	/* Only words precedes current word will be checked in this loop. */
+	for (i = 0; i < index; i++)
+		if ((command = vector_slot(vline, i))) {
+			match =
+			    cmd_filter_by_completion(command, cmd_vector, i);
+
+			if (match == vararg_match) {
+				struct cmd_element *cmd_element;
+				vector descvec;
+				unsigned int j, k;
+
+				for (j = 0; j < vector_active(cmd_vector); j++)
+					if ((cmd_element =
+					     vector_slot(cmd_vector, j)) != NULL
+					    &&
+					    (vector_active
+					     (cmd_element->strvec))) {
+						descvec =
+						    vector_slot(cmd_element->
+								strvec,
+								vector_active
+								(cmd_element->
+								 strvec) - 1);
+						for (k = 0;
+						     k < vector_active(descvec);
+						     k++) {
+							struct desc *desc =
+							    vector_slot(descvec,
+									k);
+							vector_set(matchvec,
+								   desc);
+						}
+					}
+
+				vector_set(matchvec, &desc_cr);
+				vector_free(cmd_vector);
+
+				return matchvec;
+			}
+
+			if ((ret =
+			     is_cmd_ambiguous(command, cmd_vector, i,
+					      match)) == 1) {
+				vector_free(cmd_vector);
+				*status = CMD_ERR_AMBIGUOUS;
+				return NULL;
+			} else if (ret == 2) {
+				vector_free(cmd_vector);
+				*status = CMD_ERR_NO_MATCH;
+				return NULL;
+			}
+		}
+
+	/* Prepare match vector */
+	/*  matchvec = vector_init (INIT_MATCHVEC_SIZE); */
+
+	/* Make sure that cmd_vector is filtered based on current word */
+	command = vector_slot(vline, index);
+	if (command)
+		match = cmd_filter_by_completion(command, cmd_vector, index);
+
+	/* Make description vector. */
+	for (i = 0; i < vector_active(cmd_vector); i++)
+		if ((cmd_element = vector_slot(cmd_vector, i)) != NULL) {
+			const char *string = NULL;
+			vector strvec = cmd_element->strvec;
+
+			/* if command is NULL, index may be equal to vector_active */
+			if (command && index >= vector_active(strvec))
+				vector_slot(cmd_vector, i) = NULL;
+			else {
+				/* Check if command is completed. */
+				if (command == NULL
+				    && index == vector_active(strvec)) {
+					string = "<cr>";
+					if (!desc_unique_string
+					    (matchvec, string))
+						vector_set(matchvec, &desc_cr);
+				} else {
+					unsigned int j;
+					vector descvec =
+					    vector_slot(strvec, index);
+					struct desc *desc;
+
+					for (j = 0; j < vector_active(descvec);
+					     j++)
+						if ((desc =
+						     vector_slot(descvec, j))) {
+							string =
+							    cmd_entry_function_desc
+							    (command,
+							     desc->cmd);
+							if (string) {
+								/* Uniqueness check */
+								if (!desc_unique_string(matchvec, string))
+									vector_set
+									    (matchvec,
+									     desc);
+							}
+						}
+				}
+			}
+		}
+	vector_free(cmd_vector);
+
+	if (vector_slot(matchvec, 0) == NULL) {
+		vector_free(matchvec);
+		*status = CMD_ERR_NO_MATCH;
+	} else
+		*status = CMD_SUCCESS;
+
+	return matchvec;
+}
+
+vector cmd_describe_command(vector vline, struct vty * vty, int *status)
+{
+	vector ret;
+
+	if (cmd_try_do_shortcut(vty->node, vector_slot(vline, 0))) {
+		enum node_type onode;
+		vector shifted_vline;
+		unsigned int index;
+
+		onode = vty->node;
+		vty->node = ENABLE_NODE;
+		/* We can try it on enable node, cos' the vty is authenticated */
+
+		shifted_vline = vector_init(vector_count(vline));
+		/* use memcpy? */
+		for (index = 1; index < vector_active(vline); index++) {
+			vector_set_index(shifted_vline, index - 1,
+					 vector_lookup(vline, index));
+		}
+
+		ret = cmd_describe_command_real(shifted_vline, vty, status);
+
+		vector_free(shifted_vline);
+		vty->node = onode;
+		return ret;
+	}
+
+	return cmd_describe_command_real(vline, vty, status);
+}
+
+/* Check LCD of matched command. */
+static int cmd_lcd(char **matched)
+{
+	int i;
+	int j;
+	int lcd = -1;
+	char *s1, *s2;
+	char c1, c2;
+
+	if (matched[0] == NULL || matched[1] == NULL)
+		return 0;
+
+	for (i = 1; matched[i] != NULL; i++) {
+		s1 = matched[i - 1];
+		s2 = matched[i];
+
+		for (j = 0; (c1 = s1[j]) && (c2 = s2[j]); j++)
+			if (c1 != c2)
+				break;
+
+		if (lcd < 0)
+			lcd = j;
+		else {
+			if (lcd > j)
+				lcd = j;
+		}
+	}
+	return lcd;
+}
+
+/* Command line completion support. */
+static char **cmd_complete_command_real(vector vline, struct vty *vty,
+					int *status)
+{
+	unsigned int i;
+	vector cmd_vector = vector_copy(cmd_node_vector(cmdvec, vty->node));
+#define INIT_MATCHVEC_SIZE 10
+	vector matchvec;
+	struct cmd_element *cmd_element;
+	unsigned int index;
+	char **match_str;
+	struct desc *desc;
+	vector descvec;
+	char *command;
+	int lcd;
+
+	if (vector_active(vline) == 0) {
+		*status = CMD_ERR_NO_MATCH;
+		return NULL;
+	} else
+		index = vector_active(vline) - 1;
+
+	/* First, filter by preceeding command string */
+	for (i = 0; i < index; i++)
+		if ((command = vector_slot(vline, i))) {
+			enum match_type match;
+			int ret;
+
+			/* First try completion match, if there is exactly match return 1 */
+			match =
+			    cmd_filter_by_completion(command, cmd_vector, i);
+
+			/* If there is exact match then filter ambiguous match else check
+			   ambiguousness. */
+			if ((ret =
+			     is_cmd_ambiguous(command, cmd_vector, i,
+					      match)) == 1) {
+				vector_free(cmd_vector);
+				*status = CMD_ERR_AMBIGUOUS;
+				return NULL;
+			}
+			/*
+			   else if (ret == 2)
+			   {
+			   vector_free (cmd_vector);
+			   *status = CMD_ERR_NO_MATCH;
+			   return NULL;
+			   }
+			 */
+		}
+
+	/* Prepare match vector. */
+	matchvec = vector_init(INIT_MATCHVEC_SIZE);
+
+	/* Now we got into completion */
+	for (i = 0; i < vector_active(cmd_vector); i++)
+		if ((cmd_element = vector_slot(cmd_vector, i))) {
+			const char *string;
+			vector strvec = cmd_element->strvec;
+
+			/* Check field length */
+			if (index >= vector_active(strvec))
+				vector_slot(cmd_vector, i) = NULL;
+			else {
+				unsigned int j;
+
+				descvec = vector_slot(strvec, index);
+				for (j = 0; j < vector_active(descvec); j++)
+					if ((desc = vector_slot(descvec, j))) {
+						if ((string = cmd_entry_function(vector_slot(vline, index), desc->cmd)))
+							if (cmd_unique_string (matchvec, string))
+								vector_set (matchvec, talloc_strdup(tall_vty_cmd_ctx, string));
+					}
+			}
+		}
+
+	/* We don't need cmd_vector any more. */
+	vector_free(cmd_vector);
+
+	/* No matched command */
+	if (vector_slot(matchvec, 0) == NULL) {
+		vector_free(matchvec);
+
+		/* In case of 'command \t' pattern.  Do you need '?' command at
+		   the end of the line. */
+		if (vector_slot(vline, index) == '\0')
+			*status = CMD_ERR_NOTHING_TODO;
+		else
+			*status = CMD_ERR_NO_MATCH;
+		return NULL;
+	}
+
+	/* Only one matched */
+	if (vector_slot(matchvec, 1) == NULL) {
+		match_str = (char **)matchvec->index;
+		vector_only_wrapper_free(matchvec);
+		*status = CMD_COMPLETE_FULL_MATCH;
+		return match_str;
+	}
+	/* Make it sure last element is NULL. */
+	vector_set(matchvec, NULL);
+
+	/* Check LCD of matched strings. */
+	if (vector_slot(vline, index) != NULL) {
+		lcd = cmd_lcd((char **)matchvec->index);
+
+		if (lcd) {
+			int len = strlen(vector_slot(vline, index));
+
+			if (len < lcd) {
+				char *lcdstr;
+
+				lcdstr = _talloc_zero(tall_vty_cmd_ctx, lcd + 1,
+						      "complete-lcdstr");
+				memcpy(lcdstr, matchvec->index[0], lcd);
+				lcdstr[lcd] = '\0';
+
+				/* match_str = (char **) &lcdstr; */
+
+				/* Free matchvec. */
+				for (i = 0; i < vector_active(matchvec); i++) {
+					if (vector_slot(matchvec, i))
+						talloc_free(vector_slot(matchvec, i));
+				}
+				vector_free(matchvec);
+
+				/* Make new matchvec. */
+				matchvec = vector_init(INIT_MATCHVEC_SIZE);
+				vector_set(matchvec, lcdstr);
+				match_str = (char **)matchvec->index;
+				vector_only_wrapper_free(matchvec);
+
+				*status = CMD_COMPLETE_MATCH;
+				return match_str;
+			}
+		}
+	}
+
+	match_str = (char **)matchvec->index;
+	vector_only_wrapper_free(matchvec);
+	*status = CMD_COMPLETE_LIST_MATCH;
+	return match_str;
+}
+
+char **cmd_complete_command(vector vline, struct vty *vty, int *status)
+{
+	char **ret;
+
+	if (cmd_try_do_shortcut(vty->node, vector_slot(vline, 0))) {
+		enum node_type onode;
+		vector shifted_vline;
+		unsigned int index;
+
+		onode = vty->node;
+		vty->node = ENABLE_NODE;
+		/* We can try it on enable node, cos' the vty is authenticated */
+
+		shifted_vline = vector_init(vector_count(vline));
+		/* use memcpy? */
+		for (index = 1; index < vector_active(vline); index++) {
+			vector_set_index(shifted_vline, index - 1,
+					 vector_lookup(vline, index));
+		}
+
+		ret = cmd_complete_command_real(shifted_vline, vty, status);
+
+		vector_free(shifted_vline);
+		vty->node = onode;
+		return ret;
+	}
+
+	return cmd_complete_command_real(vline, vty, status);
+}
+
+/* return parent node */
+/* MUST eventually converge on CONFIG_NODE */
+enum node_type vty_go_parent(struct vty *vty)
+{
+	assert(vty->node > CONFIG_NODE);
+
+	if (host.app_info->go_parent_cb)
+		host.app_info->go_parent_cb(vty);
+	else
+		vty->node = CONFIG_NODE;
+
+	return vty->node;
+}
+
+/* Execute command by argument vline vector. */
+static int
+cmd_execute_command_real(vector vline, struct vty *vty,
+			 struct cmd_element **cmd)
+{
+	unsigned int i;
+	unsigned int index;
+	vector cmd_vector;
+	struct cmd_element *cmd_element;
+	struct cmd_element *matched_element;
+	unsigned int matched_count, incomplete_count;
+	int argc;
+	const char *argv[CMD_ARGC_MAX];
+	enum match_type match = 0;
+	int varflag;
+	char *command;
+
+	/* Make copy of command elements. */
+	cmd_vector = vector_copy(cmd_node_vector(cmdvec, vty->node));
+
+	for (index = 0; index < vector_active(vline); index++)
+		if ((command = vector_slot(vline, index))) {
+			int ret;
+
+			match =
+			    cmd_filter_by_completion(command, cmd_vector,
+						     index);
+
+			if (match == vararg_match)
+				break;
+
+			ret =
+			    is_cmd_ambiguous(command, cmd_vector, index, match);
+
+			if (ret == 1) {
+				vector_free(cmd_vector);
+				return CMD_ERR_AMBIGUOUS;
+			} else if (ret == 2) {
+				vector_free(cmd_vector);
+				return CMD_ERR_NO_MATCH;
+			}
+		}
+
+	/* Check matched count. */
+	matched_element = NULL;
+	matched_count = 0;
+	incomplete_count = 0;
+
+	for (i = 0; i < vector_active(cmd_vector); i++)
+		if ((cmd_element = vector_slot(cmd_vector, i))) {
+			if (match == vararg_match
+			    || index >= cmd_element->cmdsize) {
+				matched_element = cmd_element;
+#if 0
+				printf("DEBUG: %s\n", cmd_element->string);
+#endif
+				matched_count++;
+			} else {
+				incomplete_count++;
+			}
+		}
+
+	/* Finish of using cmd_vector. */
+	vector_free(cmd_vector);
+
+	/* To execute command, matched_count must be 1. */
+	if (matched_count == 0) {
+		if (incomplete_count)
+			return CMD_ERR_INCOMPLETE;
+		else
+			return CMD_ERR_NO_MATCH;
+	}
+
+	if (matched_count > 1)
+		return CMD_ERR_AMBIGUOUS;
+
+	/* Argument treatment */
+	varflag = 0;
+	argc = 0;
+
+	for (i = 0; i < vector_active(vline); i++) {
+		if (varflag)
+			argv[argc++] = vector_slot(vline, i);
+		else {
+			vector descvec =
+			    vector_slot(matched_element->strvec, i);
+
+			if (vector_active(descvec) == 1) {
+				struct desc *desc = vector_slot(descvec, 0);
+
+				if (CMD_VARARG(desc->cmd))
+					varflag = 1;
+
+				if (varflag || CMD_VARIABLE(desc->cmd)
+				    || CMD_OPTION(desc->cmd))
+					argv[argc++] = vector_slot(vline, i);
+			} else
+				argv[argc++] = vector_slot(vline, i);
+		}
+
+		if (argc >= CMD_ARGC_MAX)
+			return CMD_ERR_EXEED_ARGC_MAX;
+	}
+
+	/* For vtysh execution. */
+	if (cmd)
+		*cmd = matched_element;
+
+	if (matched_element->daemon)
+		return CMD_SUCCESS_DAEMON;
+
+	/* Execute matched command. */
+	return (*matched_element->func) (matched_element, vty, argc, argv);
+}
+
+int
+cmd_execute_command(vector vline, struct vty *vty, struct cmd_element **cmd,
+		    int vtysh)
+{
+	int ret, saved_ret, tried = 0;
+	enum node_type onode;
+	void *oindex;
+
+	onode = vty->node;
+	oindex = vty->index;
+
+	if (cmd_try_do_shortcut(vty->node, vector_slot(vline, 0))) {
+		vector shifted_vline;
+		unsigned int index;
+
+		vty->node = ENABLE_NODE;
+		/* We can try it on enable node, cos' the vty is authenticated */
+
+		shifted_vline = vector_init(vector_count(vline));
+		/* use memcpy? */
+		for (index = 1; index < vector_active(vline); index++) {
+			vector_set_index(shifted_vline, index - 1,
+					 vector_lookup(vline, index));
+		}
+
+		ret = cmd_execute_command_real(shifted_vline, vty, cmd);
+
+		vector_free(shifted_vline);
+		vty->node = onode;
+		return ret;
+	}
+
+	saved_ret = ret = cmd_execute_command_real(vline, vty, cmd);
+
+	if (vtysh)
+		return saved_ret;
+
+	/* Go to parent for config nodes to attempt to find the right command */
+	while (ret != CMD_SUCCESS && ret != CMD_WARNING
+	       && is_config(vty)) {
+		vty_go_parent(vty);
+		ret = cmd_execute_command_real(vline, vty, cmd);
+		tried = 1;
+		if (ret == CMD_SUCCESS || ret == CMD_WARNING) {
+			/* succesfull command, leave the node as is */
+			return ret;
+		}
+	}
+	/* no command succeeded, reset the vty to the original node and
+	   return the error for this node */
+	if (tried) {
+		vty->node = onode;
+		vty->index = oindex;
+	}
+	return saved_ret;
+}
+
+/* Execute command by argument readline. */
+int
+cmd_execute_command_strict(vector vline, struct vty *vty,
+			   struct cmd_element **cmd)
+{
+	unsigned int i;
+	unsigned int index;
+	vector cmd_vector;
+	struct cmd_element *cmd_element;
+	struct cmd_element *matched_element;
+	unsigned int matched_count, incomplete_count;
+	int argc;
+	const char *argv[CMD_ARGC_MAX];
+	int varflag;
+	enum match_type match = 0;
+	char *command;
+
+	/* Make copy of command element */
+	cmd_vector = vector_copy(cmd_node_vector(cmdvec, vty->node));
+
+	for (index = 0; index < vector_active(vline); index++)
+		if ((command = vector_slot(vline, index))) {
+			int ret;
+
+			match = cmd_filter_by_string(vector_slot(vline, index),
+						     cmd_vector, index);
+
+			/* If command meets '.VARARG' then finish matching. */
+			if (match == vararg_match)
+				break;
+
+			ret =
+			    is_cmd_ambiguous(command, cmd_vector, index, match);
+			if (ret == 1) {
+				vector_free(cmd_vector);
+				return CMD_ERR_AMBIGUOUS;
+			}
+			if (ret == 2) {
+				vector_free(cmd_vector);
+				return CMD_ERR_NO_MATCH;
+			}
+		}
+
+	/* Check matched count. */
+	matched_element = NULL;
+	matched_count = 0;
+	incomplete_count = 0;
+	for (i = 0; i < vector_active(cmd_vector); i++)
+		if (vector_slot(cmd_vector, i) != NULL) {
+			cmd_element = vector_slot(cmd_vector, i);
+
+			if (match == vararg_match
+			    || index >= cmd_element->cmdsize) {
+				matched_element = cmd_element;
+				matched_count++;
+			} else
+				incomplete_count++;
+		}
+
+	/* Finish of using cmd_vector. */
+	vector_free(cmd_vector);
+
+	/* To execute command, matched_count must be 1. */
+	if (matched_count == 0) {
+		if (incomplete_count)
+			return CMD_ERR_INCOMPLETE;
+		else
+			return CMD_ERR_NO_MATCH;
+	}
+
+	if (matched_count > 1)
+		return CMD_ERR_AMBIGUOUS;
+
+	/* Argument treatment */
+	varflag = 0;
+	argc = 0;
+
+	for (i = 0; i < vector_active(vline); i++) {
+		if (varflag)
+			argv[argc++] = vector_slot(vline, i);
+		else {
+			vector descvec =
+			    vector_slot(matched_element->strvec, i);
+
+			if (vector_active(descvec) == 1) {
+				struct desc *desc = vector_slot(descvec, 0);
+
+				if (CMD_VARARG(desc->cmd))
+					varflag = 1;
+
+				if (varflag || CMD_VARIABLE(desc->cmd)
+				    || CMD_OPTION(desc->cmd))
+					argv[argc++] = vector_slot(vline, i);
+			} else
+				argv[argc++] = vector_slot(vline, i);
+		}
+
+		if (argc >= CMD_ARGC_MAX)
+			return CMD_ERR_EXEED_ARGC_MAX;
+	}
+
+	/* For vtysh execution. */
+	if (cmd)
+		*cmd = matched_element;
+
+	if (matched_element->daemon)
+		return CMD_SUCCESS_DAEMON;
+
+	/* Now execute matched command */
+	return (*matched_element->func) (matched_element, vty, argc, argv);
+}
+
+/* Configration make from file. */
+int config_from_file(struct vty *vty, FILE * fp)
+{
+	int ret;
+	vector vline;
+
+	while (fgets(vty->buf, VTY_BUFSIZ, fp)) {
+		vline = cmd_make_strvec(vty->buf);
+
+		/* In case of comment line */
+		if (vline == NULL)
+			continue;
+		/* Execute configuration command : this is strict match */
+		ret = cmd_execute_command_strict(vline, vty, NULL);
+
+		/* Try again with setting node to CONFIG_NODE */
+		while (ret != CMD_SUCCESS && ret != CMD_WARNING
+		       && ret != CMD_ERR_NOTHING_TODO
+		       && vty->node != CONFIG_NODE && is_config(vty)) {
+			vty_go_parent(vty);
+			ret = cmd_execute_command_strict(vline, vty, NULL);
+		}
+
+		cmd_free_strvec(vline);
+
+		if (ret != CMD_SUCCESS && ret != CMD_WARNING
+		    && ret != CMD_ERR_NOTHING_TODO)
+			return ret;
+	}
+	return CMD_SUCCESS;
+}
+
+/* Configration from terminal */
+DEFUN(config_terminal,
+      config_terminal_cmd,
+      "configure terminal",
+      "Configuration from vty interface\n" "Configuration terminal\n")
+{
+	if (vty_config_lock(vty))
+		vty->node = CONFIG_NODE;
+	else {
+		vty_out(vty, "VTY configuration is locked by other VTY%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	return CMD_SUCCESS;
+}
+
+/* Enable command */
+DEFUN(enable, config_enable_cmd, "enable", "Turn on privileged mode command\n")
+{
+	/* If enable password is NULL, change to ENABLE_NODE */
+	if ((host.enable == NULL && host.enable_encrypt == NULL) ||
+	    vty->type == VTY_SHELL_SERV)
+		vty->node = ENABLE_NODE;
+	else
+		vty->node = AUTH_ENABLE_NODE;
+
+	return CMD_SUCCESS;
+}
+
+/* Disable command */
+DEFUN(disable,
+      config_disable_cmd, "disable", "Turn off privileged mode command\n")
+{
+	if (vty->node == ENABLE_NODE)
+		vty->node = VIEW_NODE;
+	return CMD_SUCCESS;
+}
+
+/* Down vty node level. */
+gDEFUN(config_exit,
+      config_exit_cmd, "exit", "Exit current mode and down to previous mode\n")
+{
+	switch (vty->node) {
+	case VIEW_NODE:
+	case ENABLE_NODE:
+		if (0)		//vty_shell (vty))
+			exit(0);
+		else
+			vty->status = VTY_CLOSE;
+		break;
+	case CONFIG_NODE:
+		vty->node = ENABLE_NODE;
+		vty_config_unlock(vty);
+		break;
+	case VTY_NODE:
+		vty->node = CONFIG_NODE;
+		break;
+	case CFG_LOG_NODE:
+		vty->node = CONFIG_NODE;
+		break;
+	default:
+		break;
+	}
+	return CMD_SUCCESS;
+}
+
+/* End of configuration. */
+    gDEFUN(config_end,
+      config_end_cmd, "end", "End current mode and change to enable mode.")
+{
+	switch (vty->node) {
+	case VIEW_NODE:
+	case ENABLE_NODE:
+		/* Nothing to do. */
+		break;
+	case CFG_LOG_NODE:
+	case CONFIG_NODE:
+	case VTY_NODE:
+		vty_config_unlock(vty);
+		vty->node = ENABLE_NODE;
+		break;
+	default:
+		break;
+	}
+	return CMD_SUCCESS;
+}
+
+/* Show version. */
+DEFUN(show_version,
+      show_version_cmd, "show version", SHOW_STR "Displays program version\n")
+{
+	vty_out(vty, "%s %s (%s).%s", host.app_info->name,
+		host.app_info->version,
+		host.app_info->name ? host.app_info->name : "", VTY_NEWLINE);
+	vty_out(vty, "%s%s", host.app_info->copyright, VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_online_help,
+      show_online_help_cmd, "show online-help", SHOW_STR "Online help\n")
+{
+	vty_dump_nodes(vty);
+	return CMD_SUCCESS;
+}
+
+/* Help display function for all node. */
+gDEFUN(config_help,
+      config_help_cmd, "help", "Description of the interactive help system\n")
+{
+	vty_out(vty,
+		"This VTY provides advanced help features.  When you need help,%s\
+anytime at the command line please press '?'.%s\
+%s\
+If nothing matches, the help list will be empty and you must backup%s\
+ until entering a '?' shows the available options.%s\
+Two styles of help are provided:%s\
+1. Full help is available when you are ready to enter a%s\
+command argument (e.g. 'show ?') and describes each possible%s\
+argument.%s\
+2. Partial help is provided when an abbreviated argument is entered%s\
+   and you want to know what arguments match the input%s\
+   (e.g. 'show me?'.)%s%s", VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE,
+		VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+/* Help display function for all node. */
+gDEFUN(config_list, config_list_cmd, "list", "Print command list\n")
+{
+	unsigned int i;
+	struct cmd_node *cnode = vector_slot(cmdvec, vty->node);
+	struct cmd_element *cmd;
+
+	for (i = 0; i < vector_active(cnode->cmd_vector); i++)
+		if ((cmd = vector_slot(cnode->cmd_vector, i)) != NULL
+		    && !(cmd->attr == CMD_ATTR_DEPRECATED
+			 || cmd->attr == CMD_ATTR_HIDDEN))
+			vty_out(vty, "  %s%s", cmd->string, VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+static int write_config_file(const char *config_file, char **outpath)
+{
+	unsigned int i;
+	int fd;
+	struct cmd_node *node;
+	char *config_file_tmp = NULL;
+	char *config_file_sav = NULL;
+	struct vty *file_vty;
+	struct stat st;
+
+	*outpath = NULL;
+
+	/* Check and see if we are operating under vtysh configuration */
+	config_file_sav =
+	    _talloc_zero(tall_vty_cmd_ctx,
+			 strlen(config_file) + strlen(CONF_BACKUP_EXT) + 1,
+			 "config_file_sav");
+	strcpy(config_file_sav, config_file);
+	strcat(config_file_sav, CONF_BACKUP_EXT);
+
+	config_file_tmp = _talloc_zero(tall_vty_cmd_ctx, strlen(config_file) + 8,
+					"config_file_tmp");
+	sprintf(config_file_tmp, "%s.XXXXXX", config_file);
+
+	/* Open file to configuration write. */
+	fd = mkstemp(config_file_tmp);
+	if (fd < 0) {
+		*outpath = talloc_strdup(tall_vty_cmd_ctx, config_file_tmp);
+		talloc_free(config_file_tmp);
+		talloc_free(config_file_sav);
+		return -1;
+	}
+
+	/* Make vty for configuration file. */
+	file_vty = vty_new();
+	file_vty->fd = fd;
+	file_vty->type = VTY_FILE;
+
+	/* Config file header print. */
+	vty_out(file_vty, "!\n! %s (%s) configuration saved from vty\n!",
+		host.app_info->name, host.app_info->version);
+	//vty_time_print (file_vty, 1);
+	vty_out(file_vty, "!\n");
+
+	for (i = 0; i < vector_active(cmdvec); i++)
+		if ((node = vector_slot(cmdvec, i)) && node->func) {
+			if ((*node->func) (file_vty))
+				vty_out(file_vty, "!\n");
+		}
+	vty_close(file_vty);
+
+	if (unlink(config_file_sav) != 0)
+		if (errno != ENOENT) {
+			*outpath = talloc_strdup(tall_vty_cmd_ctx, config_file_sav);
+			talloc_free(config_file_sav);
+			talloc_free(config_file_tmp);
+			unlink(config_file_tmp);
+			return -2;
+		}
+
+	/* Only link the .sav file if the original file exists */
+	if (stat(config_file, &st) == 0) {
+		if (link(config_file, config_file_sav) != 0) {
+			*outpath = talloc_strdup(tall_vty_cmd_ctx, config_file_sav);
+			talloc_free(config_file_sav);
+			talloc_free(config_file_tmp);
+			unlink(config_file_tmp);
+			return -3;
+		}
+		sync();
+		if (unlink(config_file) != 0) {
+			*outpath = talloc_strdup(tall_vty_cmd_ctx, config_file);
+			talloc_free(config_file_sav);
+			talloc_free(config_file_tmp);
+			unlink(config_file_tmp);
+			return -4;
+		}
+	}
+	if (link(config_file_tmp, config_file) != 0) {
+		*outpath = talloc_strdup(tall_vty_cmd_ctx, config_file);
+		talloc_free(config_file_sav);
+		talloc_free(config_file_tmp);
+		unlink(config_file_tmp);
+		return -5;
+	}
+	unlink(config_file_tmp);
+	sync();
+
+	talloc_free(config_file_sav);
+	talloc_free(config_file_tmp);
+
+	if (chmod(config_file, 0666 & ~CONFIGFILE_MASK) != 0) {
+		*outpath = talloc_strdup(tall_vty_cmd_ctx, config_file);
+		return -6;
+	}
+
+	return 0;
+}
+
+
+/* Write current configuration into file. */
+DEFUN(config_write_file,
+      config_write_file_cmd,
+      "write file",
+      "Write running configuration to memory, network, or terminal\n"
+      "Write to configuration file\n")
+{
+	char *failed_file;
+	int rc;
+
+	if (host.config == NULL) {
+		vty_out(vty, "Can't save to configuration file, using vtysh.%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	rc = write_config_file(host.config, &failed_file);
+	switch (rc) {
+	case -1:
+		vty_out(vty, "Can't open configuration file %s.%s",
+			failed_file, VTY_NEWLINE);
+		rc = CMD_WARNING;
+		break;
+	case -2:
+		vty_out(vty, "Can't unlink backup configuration file %s.%s",
+			failed_file, VTY_NEWLINE);
+		rc = CMD_WARNING;
+		break;
+	case -3:
+		vty_out(vty, "Can't backup old configuration file %s.%s",
+			failed_file, VTY_NEWLINE);
+		rc = CMD_WARNING;
+		break;
+	case -4:
+		vty_out(vty, "Can't unlink configuration file %s.%s",
+			failed_file, VTY_NEWLINE);
+		rc = CMD_WARNING;
+		break;
+	case -5:
+		vty_out(vty, "Can't save configuration file %s.%s", failed_file,
+			VTY_NEWLINE);
+		rc = CMD_WARNING;
+		break;
+	case -6:
+		vty_out(vty, "Can't chmod configuration file %s: %s (%d).%s",
+			failed_file, strerror(errno), errno, VTY_NEWLINE);
+		rc = CMD_WARNING;
+		break;
+	default:
+		vty_out(vty, "Configuration saved to %s%s", host.config, VTY_NEWLINE);
+		rc = CMD_SUCCESS;
+		break;
+	}
+
+	talloc_free(failed_file);
+	return rc;
+}
+
+ALIAS(config_write_file,
+      config_write_cmd,
+      "write", "Write running configuration to memory, network, or terminal\n")
+
+    ALIAS(config_write_file,
+      config_write_memory_cmd,
+      "write memory",
+      "Write running configuration to memory, network, or terminal\n"
+      "Write configuration to the file (same as write file)\n")
+
+    ALIAS(config_write_file,
+      copy_runningconfig_startupconfig_cmd,
+      "copy running-config startup-config",
+      "Copy configuration\n"
+      "Copy running config to... \n"
+      "Copy running config to startup config (same as write file)\n")
+
+/* Write current configuration into the terminal. */
+    DEFUN(config_write_terminal,
+      config_write_terminal_cmd,
+      "write terminal",
+      "Write running configuration to memory, network, or terminal\n"
+      "Write to terminal\n")
+{
+	unsigned int i;
+	struct cmd_node *node;
+
+	if (vty->type == VTY_SHELL_SERV) {
+		for (i = 0; i < vector_active(cmdvec); i++)
+			if ((node = vector_slot(cmdvec, i)) && node->func
+			    && node->vtysh) {
+				if ((*node->func) (vty))
+					vty_out(vty, "!%s", VTY_NEWLINE);
+			}
+	} else {
+		vty_out(vty, "%sCurrent configuration:%s", VTY_NEWLINE,
+			VTY_NEWLINE);
+		vty_out(vty, "!%s", VTY_NEWLINE);
+
+		for (i = 0; i < vector_active(cmdvec); i++)
+			if ((node = vector_slot(cmdvec, i)) && node->func) {
+				if ((*node->func) (vty))
+					vty_out(vty, "!%s", VTY_NEWLINE);
+			}
+		vty_out(vty, "end%s", VTY_NEWLINE);
+	}
+	return CMD_SUCCESS;
+}
+
+/* Write current configuration into the terminal. */
+ALIAS(config_write_terminal,
+      show_running_config_cmd,
+      "show running-config", SHOW_STR "running configuration\n")
+
+/* Write startup configuration into the terminal. */
+    DEFUN(show_startup_config,
+      show_startup_config_cmd,
+      "show startup-config", SHOW_STR "Contentes of startup configuration\n")
+{
+	char buf[BUFSIZ];
+	FILE *confp;
+
+	confp = fopen(host.config, "r");
+	if (confp == NULL) {
+		vty_out(vty, "Can't open configuration file [%s]%s",
+			host.config, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	while (fgets(buf, BUFSIZ, confp)) {
+		char *cp = buf;
+
+		while (*cp != '\r' && *cp != '\n' && *cp != '\0')
+			cp++;
+		*cp = '\0';
+
+		vty_out(vty, "%s%s", buf, VTY_NEWLINE);
+	}
+
+	fclose(confp);
+
+	return CMD_SUCCESS;
+}
+
+/* Hostname configuration */
+DEFUN(config_hostname,
+      hostname_cmd,
+      "hostname WORD",
+      "Set system's network name\n" "This system's network name\n")
+{
+	if (!isalpha((int)*argv[0])) {
+		vty_out(vty, "Please specify string starting with alphabet%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (host.name)
+		talloc_free(host.name);
+
+	host.name = talloc_strdup(tall_vty_cmd_ctx, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(config_no_hostname,
+      no_hostname_cmd,
+      "no hostname [HOSTNAME]",
+      NO_STR "Reset system's network name\n" "Host name of this router\n")
+{
+	if (host.name)
+		talloc_free(host.name);
+	host.name = NULL;
+	return CMD_SUCCESS;
+}
+
+/* VTY interface password set. */
+DEFUN(config_password, password_cmd,
+      "password (8|) WORD",
+      "Assign the terminal connection password\n"
+      "Specifies a HIDDEN password will follow\n"
+      "dummy string \n" "The HIDDEN line password string\n")
+{
+	/* Argument check. */
+	if (argc == 0) {
+		vty_out(vty, "Please specify password.%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (argc == 2) {
+		if (*argv[0] == '8') {
+			if (host.password)
+				talloc_free(host.password);
+			host.password = NULL;
+			if (host.password_encrypt)
+				talloc_free(host.password_encrypt);
+			host.password_encrypt = talloc_strdup(tall_vty_cmd_ctx, argv[1]);
+			return CMD_SUCCESS;
+		} else {
+			vty_out(vty, "Unknown encryption type.%s", VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	if (!isalnum((int)*argv[0])) {
+		vty_out(vty,
+			"Please specify string starting with alphanumeric%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (host.password)
+		talloc_free(host.password);
+	host.password = NULL;
+
+#ifdef VTY_CRYPT_PW
+	if (host.encrypt) {
+		if (host.password_encrypt)
+			talloc_free(host.password_encrypt);
+		host.password_encrypt = talloc_strdup(tall_vty_cmd_ctx, zencrypt(argv[0]));
+	} else
+#endif
+		host.password = talloc_strdup(tall_vty_cmd_ctx, argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+ALIAS(config_password, password_text_cmd,
+      "password LINE",
+      "Assign the terminal connection password\n"
+      "The UNENCRYPTED (cleartext) line password\n")
+
+/* VTY enable password set. */
+    DEFUN(config_enable_password, enable_password_cmd,
+      "enable password (8|) WORD",
+      "Modify enable password parameters\n"
+      "Assign the privileged level password\n"
+      "Specifies a HIDDEN password will follow\n"
+      "dummy string \n" "The HIDDEN 'enable' password string\n")
+{
+	/* Argument check. */
+	if (argc == 0) {
+		vty_out(vty, "Please specify password.%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	/* Crypt type is specified. */
+	if (argc == 2) {
+		if (*argv[0] == '8') {
+			if (host.enable)
+				talloc_free(host.enable);
+			host.enable = NULL;
+
+			if (host.enable_encrypt)
+				talloc_free(host.enable_encrypt);
+			host.enable_encrypt = talloc_strdup(tall_vty_cmd_ctx, argv[1]);
+
+			return CMD_SUCCESS;
+		} else {
+			vty_out(vty, "Unknown encryption type.%s", VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+	}
+
+	if (!isalnum((int)*argv[0])) {
+		vty_out(vty,
+			"Please specify string starting with alphanumeric%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (host.enable)
+		talloc_free(host.enable);
+	host.enable = NULL;
+
+	/* Plain password input. */
+#ifdef VTY_CRYPT_PW
+	if (host.encrypt) {
+		if (host.enable_encrypt)
+			talloc_free(host.enable_encrypt);
+		host.enable_encrypt = talloc_strdup(tall_vty_cmd_ctx, zencrypt(argv[0]));
+	} else
+#endif
+		host.enable = talloc_strdup(tall_vty_cmd_ctx, argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+ALIAS(config_enable_password,
+      enable_password_text_cmd,
+      "enable password LINE",
+      "Modify enable password parameters\n"
+      "Assign the privileged level password\n"
+      "The UNENCRYPTED (cleartext) 'enable' password\n")
+
+/* VTY enable password delete. */
+    DEFUN(no_config_enable_password, no_enable_password_cmd,
+      "no enable password",
+      NO_STR
+      "Modify enable password parameters\n"
+      "Assign the privileged level password\n")
+{
+	if (host.enable)
+		talloc_free(host.enable);
+	host.enable = NULL;
+
+	if (host.enable_encrypt)
+		talloc_free(host.enable_encrypt);
+	host.enable_encrypt = NULL;
+
+	return CMD_SUCCESS;
+}
+
+#ifdef VTY_CRYPT_PW
+DEFUN(service_password_encrypt,
+      service_password_encrypt_cmd,
+      "service password-encryption",
+      "Set up miscellaneous service\n" "Enable encrypted passwords\n")
+{
+	if (host.encrypt)
+		return CMD_SUCCESS;
+
+	host.encrypt = 1;
+
+	if (host.password) {
+		if (host.password_encrypt)
+			talloc_free(host.password_encrypt);
+		host.password_encrypt = talloc_strdup(tall_vty_cmd_ctx, zencrypt(host.password));
+	}
+	if (host.enable) {
+		if (host.enable_encrypt)
+			talloc_free(host.enable_encrypt);
+		host.enable_encrypt = talloc_strdup(tall_vty_cmd_ctx, zencrypt(host.enable));
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_service_password_encrypt,
+      no_service_password_encrypt_cmd,
+      "no service password-encryption",
+      NO_STR "Set up miscellaneous service\n" "Enable encrypted passwords\n")
+{
+	if (!host.encrypt)
+		return CMD_SUCCESS;
+
+	host.encrypt = 0;
+
+	if (host.password_encrypt)
+		talloc_free(host.password_encrypt);
+	host.password_encrypt = NULL;
+
+	if (host.enable_encrypt)
+		talloc_free(host.enable_encrypt);
+	host.enable_encrypt = NULL;
+
+	return CMD_SUCCESS;
+}
+#endif
+
+DEFUN(config_terminal_length, config_terminal_length_cmd,
+      "terminal length <0-512>",
+      "Set terminal line parameters\n"
+      "Set number of lines on a screen\n"
+      "Number of lines on screen (0 for no pausing)\n")
+{
+	int lines;
+	char *endptr = NULL;
+
+	lines = strtol(argv[0], &endptr, 10);
+	if (lines < 0 || lines > 512 || *endptr != '\0') {
+		vty_out(vty, "length is malformed%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	vty->lines = lines;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(config_terminal_no_length, config_terminal_no_length_cmd,
+      "terminal no length",
+      "Set terminal line parameters\n"
+      NO_STR "Set number of lines on a screen\n")
+{
+	vty->lines = -1;
+	return CMD_SUCCESS;
+}
+
+DEFUN(service_terminal_length, service_terminal_length_cmd,
+      "service terminal-length <0-512>",
+      "Set up miscellaneous service\n"
+      "System wide terminal length configuration\n"
+      "Number of lines of VTY (0 means no line control)\n")
+{
+	int lines;
+	char *endptr = NULL;
+
+	lines = strtol(argv[0], &endptr, 10);
+	if (lines < 0 || lines > 512 || *endptr != '\0') {
+		vty_out(vty, "length is malformed%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	host.lines = lines;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_service_terminal_length, no_service_terminal_length_cmd,
+      "no service terminal-length [<0-512>]",
+      NO_STR
+      "Set up miscellaneous service\n"
+      "System wide terminal length configuration\n"
+      "Number of lines of VTY (0 means no line control)\n")
+{
+	host.lines = -1;
+	return CMD_SUCCESS;
+}
+
+DEFUN_HIDDEN(do_echo,
+	     echo_cmd,
+	     "echo .MESSAGE",
+	     "Echo a message back to the vty\n" "The message to echo\n")
+{
+	char *message;
+
+	vty_out(vty, "%s%s",
+		((message =
+		  argv_concat(argv, argc, 0)) ? message : ""), VTY_NEWLINE);
+	if (message)
+		talloc_free(message);
+	return CMD_SUCCESS;
+}
+
+#if 0
+DEFUN(config_logmsg,
+      config_logmsg_cmd,
+      "logmsg " LOG_LEVELS " .MESSAGE",
+      "Send a message to enabled logging destinations\n"
+      LOG_LEVEL_DESC "The message to send\n")
+{
+	int level;
+	char *message;
+
+	if ((level = level_match(argv[0])) == ZLOG_DISABLED)
+		return CMD_ERR_NO_MATCH;
+
+	zlog(NULL, level,
+	     ((message = argv_concat(argv, argc, 1)) ? message : ""));
+	if (message)
+		talloc_free(message);
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_logging,
+      show_logging_cmd,
+      "show logging", SHOW_STR "Show current logging configuration\n")
+{
+	struct zlog *zl = zlog_default;
+
+	vty_out(vty, "Syslog logging: ");
+	if (zl->maxlvl[ZLOG_DEST_SYSLOG] == ZLOG_DISABLED)
+		vty_out(vty, "disabled");
+	else
+		vty_out(vty, "level %s, facility %s, ident %s",
+			zlog_priority[zl->maxlvl[ZLOG_DEST_SYSLOG]],
+			facility_name(zl->facility), zl->ident);
+	vty_out(vty, "%s", VTY_NEWLINE);
+
+	vty_out(vty, "Stdout logging: ");
+	if (zl->maxlvl[ZLOG_DEST_STDOUT] == ZLOG_DISABLED)
+		vty_out(vty, "disabled");
+	else
+		vty_out(vty, "level %s",
+			zlog_priority[zl->maxlvl[ZLOG_DEST_STDOUT]]);
+	vty_out(vty, "%s", VTY_NEWLINE);
+
+	vty_out(vty, "Monitor logging: ");
+	if (zl->maxlvl[ZLOG_DEST_MONITOR] == ZLOG_DISABLED)
+		vty_out(vty, "disabled");
+	else
+		vty_out(vty, "level %s",
+			zlog_priority[zl->maxlvl[ZLOG_DEST_MONITOR]]);
+	vty_out(vty, "%s", VTY_NEWLINE);
+
+	vty_out(vty, "File logging: ");
+	if ((zl->maxlvl[ZLOG_DEST_FILE] == ZLOG_DISABLED) || !zl->fp)
+		vty_out(vty, "disabled");
+	else
+		vty_out(vty, "level %s, filename %s",
+			zlog_priority[zl->maxlvl[ZLOG_DEST_FILE]],
+			zl->filename);
+	vty_out(vty, "%s", VTY_NEWLINE);
+
+	vty_out(vty, "Protocol name: %s%s",
+		zlog_proto_names[zl->protocol], VTY_NEWLINE);
+	vty_out(vty, "Record priority: %s%s",
+		(zl->record_priority ? "enabled" : "disabled"), VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(config_log_stdout,
+      config_log_stdout_cmd,
+      "log stdout", "Logging control\n" "Set stdout logging level\n")
+{
+	zlog_set_level(NULL, ZLOG_DEST_STDOUT, zlog_default->default_lvl);
+	return CMD_SUCCESS;
+}
+
+DEFUN(config_log_stdout_level,
+      config_log_stdout_level_cmd,
+      "log stdout " LOG_LEVELS,
+      "Logging control\n" "Set stdout logging level\n" LOG_LEVEL_DESC)
+{
+	int level;
+
+	if ((level = level_match(argv[0])) == ZLOG_DISABLED)
+		return CMD_ERR_NO_MATCH;
+	zlog_set_level(NULL, ZLOG_DEST_STDOUT, level);
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_config_log_stdout,
+      no_config_log_stdout_cmd,
+      "no log stdout [LEVEL]",
+      NO_STR "Logging control\n" "Cancel logging to stdout\n" "Logging level\n")
+{
+	zlog_set_level(NULL, ZLOG_DEST_STDOUT, ZLOG_DISABLED);
+	return CMD_SUCCESS;
+}
+
+DEFUN(config_log_monitor,
+      config_log_monitor_cmd,
+      "log monitor",
+      "Logging control\n" "Set terminal line (monitor) logging level\n")
+{
+	zlog_set_level(NULL, ZLOG_DEST_MONITOR, zlog_default->default_lvl);
+	return CMD_SUCCESS;
+}
+
+DEFUN(config_log_monitor_level,
+      config_log_monitor_level_cmd,
+      "log monitor " LOG_LEVELS,
+      "Logging control\n"
+      "Set terminal line (monitor) logging level\n" LOG_LEVEL_DESC)
+{
+	int level;
+
+	if ((level = level_match(argv[0])) == ZLOG_DISABLED)
+		return CMD_ERR_NO_MATCH;
+	zlog_set_level(NULL, ZLOG_DEST_MONITOR, level);
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_config_log_monitor,
+      no_config_log_monitor_cmd,
+      "no log monitor [LEVEL]",
+      NO_STR
+      "Logging control\n"
+      "Disable terminal line (monitor) logging\n" "Logging level\n")
+{
+	zlog_set_level(NULL, ZLOG_DEST_MONITOR, ZLOG_DISABLED);
+	return CMD_SUCCESS;
+}
+
+static int set_log_file(struct vty *vty, const char *fname, int loglevel)
+{
+	int ret;
+	char *p = NULL;
+	const char *fullpath;
+
+	/* Path detection. */
+	if (!IS_DIRECTORY_SEP(*fname)) {
+		char cwd[MAXPATHLEN + 1];
+		cwd[MAXPATHLEN] = '\0';
+
+		if (getcwd(cwd, MAXPATHLEN) == NULL) {
+			zlog_err("config_log_file: Unable to alloc mem!");
+			return CMD_WARNING;
+		}
+
+		if ((p = _talloc_zero(tall_vcmd_ctx,
+				      strlen(cwd) + strlen(fname) + 2),
+				      "set_log_file")
+		    == NULL) {
+			zlog_err("config_log_file: Unable to alloc mem!");
+			return CMD_WARNING;
+		}
+		sprintf(p, "%s/%s", cwd, fname);
+		fullpath = p;
+	} else
+		fullpath = fname;
+
+	ret = zlog_set_file(NULL, fullpath, loglevel);
+
+	if (p)
+		talloc_free(p);
+
+	if (!ret) {
+		vty_out(vty, "can't open logfile %s\n", fname);
+		return CMD_WARNING;
+	}
+
+	if (host.logfile)
+		talloc_free(host.logfile);
+
+	host.logfile = talloc_strdup(tall_vty_cmd_ctx, fname);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(config_log_file,
+      config_log_file_cmd,
+      "log file FILENAME",
+      "Logging control\n" "Logging to file\n" "Logging filename\n")
+{
+	return set_log_file(vty, argv[0], zlog_default->default_lvl);
+}
+
+DEFUN(config_log_file_level,
+      config_log_file_level_cmd,
+      "log file FILENAME " LOG_LEVELS,
+      "Logging control\n"
+      "Logging to file\n" "Logging filename\n" LOG_LEVEL_DESC)
+{
+	int level;
+
+	if ((level = level_match(argv[1])) == ZLOG_DISABLED)
+		return CMD_ERR_NO_MATCH;
+	return set_log_file(vty, argv[0], level);
+}
+
+DEFUN(no_config_log_file,
+      no_config_log_file_cmd,
+      "no log file [FILENAME]",
+      NO_STR
+      "Logging control\n" "Cancel logging to file\n" "Logging file name\n")
+{
+	zlog_reset_file(NULL);
+
+	if (host.logfile)
+		talloc_free(host.logfile);
+
+	host.logfile = NULL;
+
+	return CMD_SUCCESS;
+}
+
+ALIAS(no_config_log_file,
+      no_config_log_file_level_cmd,
+      "no log file FILENAME LEVEL",
+      NO_STR
+      "Logging control\n"
+      "Cancel logging to file\n" "Logging file name\n" "Logging level\n")
+
+    DEFUN(config_log_syslog,
+      config_log_syslog_cmd,
+      "log syslog", "Logging control\n" "Set syslog logging level\n")
+{
+	zlog_set_level(NULL, ZLOG_DEST_SYSLOG, zlog_default->default_lvl);
+	return CMD_SUCCESS;
+}
+
+DEFUN(config_log_syslog_level,
+      config_log_syslog_level_cmd,
+      "log syslog " LOG_LEVELS,
+      "Logging control\n" "Set syslog logging level\n" LOG_LEVEL_DESC)
+{
+	int level;
+
+	if ((level = level_match(argv[0])) == ZLOG_DISABLED)
+		return CMD_ERR_NO_MATCH;
+	zlog_set_level(NULL, ZLOG_DEST_SYSLOG, level);
+	return CMD_SUCCESS;
+}
+
+DEFUN_DEPRECATED(config_log_syslog_facility,
+		 config_log_syslog_facility_cmd,
+		 "log syslog facility " LOG_FACILITIES,
+		 "Logging control\n"
+		 "Logging goes to syslog\n"
+		 "(Deprecated) Facility parameter for syslog messages\n"
+		 LOG_FACILITY_DESC)
+{
+	int facility;
+
+	if ((facility = facility_match(argv[0])) < 0)
+		return CMD_ERR_NO_MATCH;
+
+	zlog_set_level(NULL, ZLOG_DEST_SYSLOG, zlog_default->default_lvl);
+	zlog_default->facility = facility;
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_config_log_syslog,
+      no_config_log_syslog_cmd,
+      "no log syslog [LEVEL]",
+      NO_STR "Logging control\n" "Cancel logging to syslog\n" "Logging level\n")
+{
+	zlog_set_level(NULL, ZLOG_DEST_SYSLOG, ZLOG_DISABLED);
+	return CMD_SUCCESS;
+}
+
+ALIAS(no_config_log_syslog,
+      no_config_log_syslog_facility_cmd,
+      "no log syslog facility " LOG_FACILITIES,
+      NO_STR
+      "Logging control\n"
+      "Logging goes to syslog\n"
+      "Facility parameter for syslog messages\n" LOG_FACILITY_DESC)
+
+    DEFUN(config_log_facility,
+      config_log_facility_cmd,
+      "log facility " LOG_FACILITIES,
+      "Logging control\n"
+      "Facility parameter for syslog messages\n" LOG_FACILITY_DESC)
+{
+	int facility;
+
+	if ((facility = facility_match(argv[0])) < 0)
+		return CMD_ERR_NO_MATCH;
+	zlog_default->facility = facility;
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_config_log_facility,
+      no_config_log_facility_cmd,
+      "no log facility [FACILITY]",
+      NO_STR
+      "Logging control\n"
+      "Reset syslog facility to default (daemon)\n" "Syslog facility\n")
+{
+	zlog_default->facility = LOG_DAEMON;
+	return CMD_SUCCESS;
+}
+
+DEFUN_DEPRECATED(config_log_trap,
+		 config_log_trap_cmd,
+		 "log trap " LOG_LEVELS,
+		 "Logging control\n"
+		 "(Deprecated) Set logging level and default for all destinations\n"
+		 LOG_LEVEL_DESC)
+{
+	int new_level;
+	int i;
+
+	if ((new_level = level_match(argv[0])) == ZLOG_DISABLED)
+		return CMD_ERR_NO_MATCH;
+
+	zlog_default->default_lvl = new_level;
+	for (i = 0; i < ZLOG_NUM_DESTS; i++)
+		if (zlog_default->maxlvl[i] != ZLOG_DISABLED)
+			zlog_default->maxlvl[i] = new_level;
+	return CMD_SUCCESS;
+}
+
+DEFUN_DEPRECATED(no_config_log_trap,
+		 no_config_log_trap_cmd,
+		 "no log trap [LEVEL]",
+		 NO_STR
+		 "Logging control\n"
+		 "Permit all logging information\n" "Logging level\n")
+{
+	zlog_default->default_lvl = LOG_DEBUG;
+	return CMD_SUCCESS;
+}
+
+DEFUN(config_log_record_priority,
+      config_log_record_priority_cmd,
+      "log record-priority",
+      "Logging control\n"
+      "Log the priority of the message within the message\n")
+{
+	zlog_default->record_priority = 1;
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_config_log_record_priority,
+      no_config_log_record_priority_cmd,
+      "no log record-priority",
+      NO_STR
+      "Logging control\n"
+      "Do not log the priority of the message within the message\n")
+{
+	zlog_default->record_priority = 0;
+	return CMD_SUCCESS;
+}
+#endif
+
+DEFUN(banner_motd_file,
+      banner_motd_file_cmd,
+      "banner motd file [FILE]",
+      "Set banner\n" "Banner for motd\n" "Banner from a file\n" "Filename\n")
+{
+	if (host.motdfile)
+		talloc_free(host.motdfile);
+	host.motdfile = talloc_strdup(tall_vty_cmd_ctx, argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(banner_motd_default,
+      banner_motd_default_cmd,
+      "banner motd default",
+      "Set banner string\n" "Strings for motd\n" "Default string\n")
+{
+	host.motd = default_motd;
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_banner_motd,
+      no_banner_motd_cmd,
+      "no banner motd", NO_STR "Set banner string\n" "Strings for motd\n")
+{
+	host.motd = NULL;
+	if (host.motdfile)
+		talloc_free(host.motdfile);
+	host.motdfile = NULL;
+	return CMD_SUCCESS;
+}
+
+/* Set config filename.  Called from vty.c */
+void host_config_set(const char *filename)
+{
+	host.config = talloc_strdup(tall_vty_cmd_ctx, filename);
+}
+
+void install_default(enum node_type node)
+{
+	install_element(node, &config_help_cmd);
+	install_element(node, &config_list_cmd);
+
+	install_element(node, &config_write_terminal_cmd);
+	install_element(node, &config_write_file_cmd);
+	install_element(node, &config_write_memory_cmd);
+	install_element(node, &config_write_cmd);
+	install_element(node, &show_running_config_cmd);
+}
+
+/**
+ * \brief Write the current running config to a given file
+ * \param[in] vty the vty of the code
+ * \param[in] filename where to store the file
+ * \return 0 in case of success.
+ *
+ * If the filename already exists create a filename.sav
+ * version with the current code.
+ *
+ */
+int osmo_vty_write_config_file(const char *filename)
+{
+	char *failed_file;
+	int rc;
+
+	rc = write_config_file(filename, &failed_file);
+	talloc_free(failed_file);
+	return rc;
+}
+
+/**
+ * \brief Save the current state to the config file
+ * \return 0 in case of success.
+ *
+ * If the filename already exists create a filename.sav
+ * version with the current code.
+ *
+ */
+int osmo_vty_save_config_file(void)
+{
+	char *failed_file;
+	int rc;
+
+	if (host.config == NULL)
+		return -7;
+
+	rc = write_config_file(host.config, &failed_file);
+	talloc_free(failed_file);
+	return rc;
+}
+
+/* Initialize command interface. Install basic nodes and commands. */
+void cmd_init(int terminal)
+{
+	/* Allocate initial top vector of commands. */
+	cmdvec = vector_init(VECTOR_MIN_SIZE);
+
+	/* Default host value settings. */
+	host.name = NULL;
+	host.password = NULL;
+	host.enable = NULL;
+	host.logfile = NULL;
+	host.config = NULL;
+	host.lines = -1;
+	host.motd = default_motd;
+	host.motdfile = NULL;
+
+	/* Install top nodes. */
+	install_node(&view_node, NULL);
+	install_node(&enable_node, NULL);
+	install_node(&auth_node, NULL);
+	install_node(&auth_enable_node, NULL);
+	install_node(&config_node, config_write_host);
+
+	/* Each node's basic commands. */
+	install_element(VIEW_NODE, &show_version_cmd);
+	install_element(VIEW_NODE, &show_online_help_cmd);
+	if (terminal) {
+		install_element(VIEW_NODE, &config_list_cmd);
+		install_element(VIEW_NODE, &config_exit_cmd);
+		install_element(VIEW_NODE, &config_help_cmd);
+		install_element(VIEW_NODE, &config_enable_cmd);
+		install_element(VIEW_NODE, &config_terminal_length_cmd);
+		install_element(VIEW_NODE, &config_terminal_no_length_cmd);
+		install_element(VIEW_NODE, &echo_cmd);
+	}
+
+	if (terminal) {
+		install_element(ENABLE_NODE, &config_exit_cmd);
+		install_default(ENABLE_NODE);
+		install_element(ENABLE_NODE, &config_disable_cmd);
+		install_element(ENABLE_NODE, &config_terminal_cmd);
+		install_element (ENABLE_NODE, &copy_runningconfig_startupconfig_cmd);
+	}
+	install_element (ENABLE_NODE, &show_startup_config_cmd);
+	install_element(ENABLE_NODE, &show_version_cmd);
+	install_element(ENABLE_NODE, &show_online_help_cmd);
+
+	if (terminal) {
+		install_element(ENABLE_NODE, &config_terminal_length_cmd);
+		install_element(ENABLE_NODE, &config_terminal_no_length_cmd);
+		install_element(ENABLE_NODE, &echo_cmd);
+
+		install_default(CONFIG_NODE);
+		install_element(CONFIG_NODE, &config_exit_cmd);
+	}
+
+	install_element(CONFIG_NODE, &hostname_cmd);
+	install_element(CONFIG_NODE, &no_hostname_cmd);
+
+	if (terminal) {
+		install_element(CONFIG_NODE, &password_cmd);
+		install_element(CONFIG_NODE, &password_text_cmd);
+		install_element(CONFIG_NODE, &enable_password_cmd);
+		install_element(CONFIG_NODE, &enable_password_text_cmd);
+		install_element(CONFIG_NODE, &no_enable_password_cmd);
+
+#ifdef VTY_CRYPT_PW
+		install_element(CONFIG_NODE, &service_password_encrypt_cmd);
+		install_element(CONFIG_NODE, &no_service_password_encrypt_cmd);
+#endif
+		install_element(CONFIG_NODE, &banner_motd_default_cmd);
+		install_element(CONFIG_NODE, &banner_motd_file_cmd);
+		install_element(CONFIG_NODE, &no_banner_motd_cmd);
+		install_element(CONFIG_NODE, &service_terminal_length_cmd);
+		install_element(CONFIG_NODE, &no_service_terminal_length_cmd);
+
+	}
+	srand(time(NULL));
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/vty/logging_vty.c b/src/shared/libosmocore/src/vty/logging_vty.c
new file mode 100644
index 00000000..6029d58b
--- /dev/null
+++ b/src/shared/libosmocore/src/vty/logging_vty.c
@@ -0,0 +1,610 @@
+/* OpenBSC logging helper for the VTY */
+/* (C) 2009-2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2009-2010 by Holger Hans Peter Freyther
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "../../config.h"
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+
+//#include <openbsc/vty.h>
+
+#include <osmocom/vty/command.h>
+#include <osmocom/vty/buffer.h>
+#include <osmocom/vty/vty.h>
+#include <osmocom/vty/telnet_interface.h>
+#include <osmocom/vty/logging.h>
+
+#define LOG_STR "Configure logging sub-system\n"
+
+extern const struct log_info *osmo_log_info;
+
+static void _vty_output(struct log_target *tgt,
+			unsigned int level, const char *line)
+{
+	struct vty *vty = tgt->tgt_vty.vty;
+	vty_out(vty, "%s", line);
+	/* This is an ugly hack, but there is no easy way... */
+	if (strchr(line, '\n'))
+		vty_out(vty, "\r");
+}
+
+struct log_target *log_target_create_vty(struct vty *vty)
+{
+	struct log_target *target;
+
+	target = log_target_create();
+	if (!target)
+		return NULL;
+
+	target->tgt_vty.vty = vty;
+	target->output = _vty_output;
+	return target;
+}
+
+DEFUN(enable_logging,
+      enable_logging_cmd,
+      "logging enable",
+	LOGGING_STR
+      "Enables logging to this vty\n")
+{
+	struct telnet_connection *conn;
+
+	conn = (struct telnet_connection *) vty->priv;
+	if (conn->dbg) {
+		vty_out(vty, "Logging already enabled.%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	conn->dbg = log_target_create_vty(vty);
+	if (!conn->dbg)
+		return CMD_WARNING;
+
+	log_add_target(conn->dbg);
+	return CMD_SUCCESS;
+}
+
+struct log_target *osmo_log_vty2tgt(struct vty *vty)
+{
+	struct telnet_connection *conn;
+
+	if (vty->node == CFG_LOG_NODE)
+		return vty->index;
+
+
+	conn = (struct telnet_connection *) vty->priv;
+	if (!conn->dbg)
+		vty_out(vty, "Logging was not enabled.%s", VTY_NEWLINE);
+
+	return conn->dbg;
+}
+
+DEFUN(logging_fltr_all,
+      logging_fltr_all_cmd,
+      "logging filter all (0|1)",
+	LOGGING_STR FILTER_STR
+	"Do you want to log all messages?\n"
+	"Only print messages matched by other filters\n"
+	"Bypass filter and print all messages\n")
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	log_set_all_filter(tgt, atoi(argv[0]));
+	return CMD_SUCCESS;
+}
+
+DEFUN(logging_use_clr,
+      logging_use_clr_cmd,
+      "logging color (0|1)",
+	LOGGING_STR "Configure color-printing for log messages\n"
+      "Don't use color for printing messages\n"
+      "Use color for printing messages\n")
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	log_set_use_color(tgt, atoi(argv[0]));
+	return CMD_SUCCESS;
+}
+
+DEFUN(logging_prnt_timestamp,
+      logging_prnt_timestamp_cmd,
+      "logging timestamp (0|1)",
+	LOGGING_STR "Configure log message timestamping\n"
+	"Don't prefix each log message\n"
+	"Prefix each log message with current timestamp\n")
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	log_set_print_timestamp(tgt, atoi(argv[0]));
+	return CMD_SUCCESS;
+}
+
+DEFUN(logging_level,
+      logging_level_cmd,
+      NULL, /* cmdstr is dynamically set in logging_vty_add_cmds(). */
+      NULL) /* same thing for helpstr. */
+{
+	int category = log_parse_category(argv[0]);
+	int level = log_parse_level(argv[1]);
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	if (level < 0) {
+		vty_out(vty, "Invalid level `%s'%s", argv[1], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	/* Check for special case where we want to set global log level */
+	if (!strcmp(argv[0], "all")) {
+		log_set_log_level(tgt, level);
+		return CMD_SUCCESS;
+	}
+
+	if (category < 0) {
+		vty_out(vty, "Invalid category `%s'%s", argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	tgt->categories[category].enabled = 1;
+	tgt->categories[category].loglevel = level;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(logging_set_category_mask,
+      logging_set_category_mask_cmd,
+      "logging set-log-mask MASK",
+	LOGGING_STR
+      "Set the logmask of this logging target\n"
+      "The logmask to use\n")
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	log_parse_category_mask(tgt, argv[0]);
+	return CMD_SUCCESS;
+}
+
+ALIAS_DEPRECATED(logging_set_category_mask,
+		 logging_set_category_mask_old_cmd,
+		 "logging set log mask MASK",
+		 LOGGING_STR
+		 "Decide which categories to output.\n"
+		 "Log commands\n" "Mask commands\n" "The logmask to use\n");
+
+
+DEFUN(diable_logging,
+      disable_logging_cmd,
+      "logging disable",
+	LOGGING_STR
+      "Disables logging to this vty\n")
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+	struct telnet_connection *conn = (struct telnet_connection *) vty->priv;
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	log_del_target(tgt);
+	talloc_free(tgt);
+	conn->dbg = NULL;
+
+	return CMD_SUCCESS;
+}
+
+static void vty_print_logtarget(struct vty *vty, const struct log_info *info,
+				const struct log_target *tgt)
+{
+	unsigned int i;
+
+	vty_out(vty, " Global Loglevel: %s%s",
+		log_level_str(tgt->loglevel), VTY_NEWLINE);
+	vty_out(vty, " Use color: %s, Print Timestamp: %s%s",
+		tgt->use_color ? "On" : "Off",
+		tgt->print_timestamp ? "On" : "Off", VTY_NEWLINE);
+
+	vty_out(vty, " Log Level specific information:%s", VTY_NEWLINE);
+
+	for (i = 0; i < info->num_cat; i++) {
+		const struct log_category *cat = &tgt->categories[i];
+		vty_out(vty, "  %-10s %-10s %-8s %s%s",
+			info->cat[i].name+1, log_level_str(cat->loglevel),
+			cat->enabled ? "Enabled" : "Disabled",
+ 			info->cat[i].description,
+			VTY_NEWLINE);
+	}
+}
+
+#define SHOW_LOG_STR "Show current logging configuration\n"
+
+DEFUN(show_logging_vty,
+      show_logging_vty_cmd,
+      "show logging vty",
+	SHOW_STR SHOW_LOG_STR
+	"Show current logging configuration for this vty\n")
+{
+	struct log_target *tgt = osmo_log_vty2tgt(vty);
+
+	if (!tgt)
+		return CMD_WARNING;
+
+	vty_print_logtarget(vty, osmo_log_info, tgt);
+
+	return CMD_SUCCESS;
+}
+
+gDEFUN(cfg_description, cfg_description_cmd,
+	"description .TEXT",
+	"Save human-readable decription of the object\n"
+	"Text until the end of the line\n")
+{
+	char **dptr = vty->index_sub;
+
+	if (!dptr) {
+		vty_out(vty, "vty->index_sub == NULL%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (*dptr)
+		talloc_free(*dptr);
+	*dptr = argv_concat(argv, argc, 0);
+	if (!dptr)
+		return CMD_WARNING;
+
+	return CMD_SUCCESS;
+}
+
+gDEFUN(cfg_no_description, cfg_no_description_cmd,
+	"no description",
+	NO_STR
+	"Remove description of the object\n")
+{
+	char **dptr = vty->index_sub;
+
+	if (!dptr) {
+		vty_out(vty, "vty->index_sub == NULL%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (*dptr) {
+		talloc_free(*dptr);
+		*dptr = NULL;
+	}
+
+	return CMD_SUCCESS;
+}
+
+/* Support for configuration of log targets != the current vty */
+
+struct cmd_node cfg_log_node = {
+	CFG_LOG_NODE,
+	"%s(config-log)# ",
+	1
+};
+
+#ifdef HAVE_SYSLOG_H
+
+#include <syslog.h>
+
+static const int local_sysl_map[] = {
+	[0] = LOG_LOCAL0,
+	[1] = LOG_LOCAL1,
+	[2] = LOG_LOCAL2,
+	[3] = LOG_LOCAL3,
+	[4] = LOG_LOCAL4,
+	[5] = LOG_LOCAL5,
+	[6] = LOG_LOCAL6,
+	[7] = LOG_LOCAL7
+};
+
+/* From VTY core code */
+extern struct host host;
+
+static int _cfg_log_syslog(struct vty *vty, int facility)
+{
+	struct log_target *tgt;
+
+	/* First delete the old syslog target, if any */
+	tgt = log_target_find(LOG_TGT_TYPE_SYSLOG, NULL);
+	if (tgt)
+		log_target_destroy(tgt);
+
+	tgt = log_target_create_syslog(host.app_info->name, 0, facility);
+	if (!tgt) {
+		vty_out(vty, "%% Unable to open syslog%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	log_add_target(tgt);
+
+	vty->index = tgt;
+	vty->node = CFG_LOG_NODE;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_log_syslog_local, cfg_log_syslog_local_cmd,
+      "log syslog local <0-7>",
+	LOG_STR "Logging via syslog\n" "Syslog LOCAL facility\n"
+	"Local facility number\n")
+{
+	int local = atoi(argv[0]);
+	int facility = local_sysl_map[local];
+
+	return _cfg_log_syslog(vty, facility);
+}
+
+static struct value_string sysl_level_names[] = {
+	{ LOG_AUTHPRIV, "authpriv" },
+	{ LOG_CRON, 	"cron" },
+	{ LOG_DAEMON,	"daemon" },
+	{ LOG_FTP,	"ftp" },
+	{ LOG_LPR,	"lpr" },
+	{ LOG_MAIL,	"mail" },
+	{ LOG_NEWS,	"news" },
+	{ LOG_USER,	"user" },
+	{ LOG_UUCP,	"uucp" },
+	/* only for value -> string conversion */
+	{ LOG_LOCAL0,	"local 0" },
+	{ LOG_LOCAL1,	"local 1" },
+	{ LOG_LOCAL2,	"local 2" },
+	{ LOG_LOCAL3,	"local 3" },
+	{ LOG_LOCAL4,	"local 4" },
+	{ LOG_LOCAL5,	"local 5" },
+	{ LOG_LOCAL6,	"local 6" },
+	{ LOG_LOCAL7,	"local 7" },
+	{ 0, NULL }
+};
+
+DEFUN(cfg_log_syslog, cfg_log_syslog_cmd,
+      "log syslog (authpriv|cron|daemon|ftp|lpr|mail|news|user|uucp)",
+	LOG_STR "Logging via syslog\n"
+	"Security/authorization messages facility\n"
+	"Clock daemon (cron/at) facility\n"
+	"General system daemon facility\n"
+	"Ftp daemon facility\n"
+	"Line printer facility\n"
+	"Mail facility\n"
+	"News facility\n"
+	"Generic facility\n"
+	"UUCP facility\n")
+{
+	int facility = get_string_value(sysl_level_names, argv[0]);
+
+	return _cfg_log_syslog(vty, facility);
+}
+
+DEFUN(cfg_no_log_syslog, cfg_no_log_syslog_cmd,
+	"no log syslog",
+	NO_STR LOG_STR "Logging via syslog\n")
+{
+	struct log_target *tgt;
+
+	tgt = log_target_find(LOG_TGT_TYPE_SYSLOG, NULL);
+	if (!tgt) {
+		vty_out(vty, "%% No syslog target found%s",
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	log_target_destroy(tgt);
+
+	return CMD_SUCCESS;
+}
+#endif /* HAVE_SYSLOG_H */
+
+DEFUN(cfg_log_stderr, cfg_log_stderr_cmd,
+	"log stderr",
+	LOG_STR "Logging via STDERR of the process\n")
+{
+	struct log_target *tgt;
+
+	tgt = log_target_find(LOG_TGT_TYPE_STDERR, NULL);
+	if (!tgt) {
+		tgt = log_target_create_stderr();
+		if (!tgt) {
+			vty_out(vty, "%% Unable to create stderr log%s",
+				VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		log_add_target(tgt);
+	}
+
+	vty->index = tgt;
+	vty->node = CFG_LOG_NODE;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_log_stderr, cfg_no_log_stderr_cmd,
+	"no log stderr",
+	NO_STR LOG_STR "Logging via STDERR of the process\n")
+{
+	struct log_target *tgt;
+
+	tgt = log_target_find(LOG_TGT_TYPE_STDERR, NULL);
+	if (!tgt) {
+		vty_out(vty, "%% No stderr logging active%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	log_target_destroy(tgt);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_log_file, cfg_log_file_cmd,
+	"log file .FILENAME",
+	LOG_STR "Logging to text file\n" "Filename\n")
+{
+	const char *fname = argv[0];
+	struct log_target *tgt;
+
+	tgt = log_target_find(LOG_TGT_TYPE_FILE, fname);
+	if (!tgt) {
+		tgt = log_target_create_file(fname);
+		if (!tgt) {
+			vty_out(vty, "%% Unable to create file `%s'%s",
+				fname, VTY_NEWLINE);
+			return CMD_WARNING;
+		}
+		log_add_target(tgt);
+	}
+
+	vty->index = tgt;
+	vty->node = CFG_LOG_NODE;
+
+	return CMD_SUCCESS;
+}
+
+
+DEFUN(cfg_no_log_file, cfg_no_log_file_cmd,
+	"no log file .FILENAME",
+	NO_STR LOG_STR "Logging to text file\n" "Filename\n")
+{
+	const char *fname = argv[0];
+	struct log_target *tgt;
+
+	tgt = log_target_find(LOG_TGT_TYPE_FILE, fname);
+	if (!tgt) {
+		vty_out(vty, "%% No such log file `%s'%s",
+			fname, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	log_target_destroy(tgt);
+
+	return CMD_SUCCESS;
+}
+
+static int config_write_log_single(struct vty *vty, struct log_target *tgt)
+{
+	int i;
+	char level_lower[32];
+
+	switch (tgt->type) {
+	case LOG_TGT_TYPE_VTY:
+		return 1;
+		break;
+	case LOG_TGT_TYPE_STDERR:
+		vty_out(vty, "log stderr%s", VTY_NEWLINE);
+		break;
+	case LOG_TGT_TYPE_SYSLOG:
+#ifdef HAVE_SYSLOG_H
+		vty_out(vty, "log syslog %s%s",
+			get_value_string(sysl_level_names,
+					 tgt->tgt_syslog.facility),
+			VTY_NEWLINE);
+#endif
+		break;
+	case LOG_TGT_TYPE_FILE:
+		vty_out(vty, "log file %s%s", tgt->tgt_file.fname, VTY_NEWLINE);
+		break;
+	}
+
+	vty_out(vty, "  logging filter all %u%s",
+		tgt->filter_map & LOG_FILTER_ALL ? 1 : 0, VTY_NEWLINE);
+	/* FIXME: how to do this for filters outside of libosmocore? */
+
+	vty_out(vty, "  logging color %u%s", tgt->use_color ? 1 : 0,
+		VTY_NEWLINE);
+	vty_out(vty, "  logging timestamp %u%s", tgt->print_timestamp ? 1 : 0,
+		VTY_NEWLINE);
+
+	/* stupid old osmo logging API uses uppercase strings... */
+	osmo_str2lower(level_lower, log_level_str(tgt->loglevel));
+	vty_out(vty, "  logging level all %s%s", level_lower, VTY_NEWLINE);
+
+	for (i = 0; i < osmo_log_info->num_cat; i++) {
+		const struct log_category *cat = &tgt->categories[i];
+		char cat_lower[32];
+
+		/* stupid old osmo logging API uses uppercase strings... */
+		osmo_str2lower(cat_lower, osmo_log_info->cat[i].name+1);
+		osmo_str2lower(level_lower, log_level_str(cat->loglevel));
+
+		vty_out(vty, "  logging level %s %s%s", cat_lower, level_lower,
+			VTY_NEWLINE);
+	}
+
+	/* FIXME: levels */
+
+	return 1;
+}
+
+static int config_write_log(struct vty *vty)
+{
+	struct log_target *dbg = vty->index;
+
+	llist_for_each_entry(dbg, &osmo_log_target_list, entry)
+		config_write_log_single(vty, dbg);
+
+	return 1;
+}
+
+void logging_vty_add_cmds(const struct log_info *cat)
+{
+	install_element_ve(&enable_logging_cmd);
+	install_element_ve(&disable_logging_cmd);
+	install_element_ve(&logging_fltr_all_cmd);
+	install_element_ve(&logging_use_clr_cmd);
+	install_element_ve(&logging_prnt_timestamp_cmd);
+	install_element_ve(&logging_set_category_mask_cmd);
+	install_element_ve(&logging_set_category_mask_old_cmd);
+
+	/* Logging level strings are generated dynamically. */
+	logging_level_cmd.string = log_vty_command_string(cat);
+	logging_level_cmd.doc = log_vty_command_description(cat);
+	install_element_ve(&logging_level_cmd);
+	install_element_ve(&show_logging_vty_cmd);
+
+	install_node(&cfg_log_node, config_write_log);
+	install_element(CFG_LOG_NODE, &config_end_cmd);
+	install_element(CFG_LOG_NODE, &logging_fltr_all_cmd);
+	install_element(CFG_LOG_NODE, &logging_use_clr_cmd);
+	install_element(CFG_LOG_NODE, &logging_prnt_timestamp_cmd);
+	install_element(CFG_LOG_NODE, &logging_level_cmd);
+
+	install_element(CONFIG_NODE, &cfg_log_stderr_cmd);
+	install_element(CONFIG_NODE, &cfg_no_log_stderr_cmd);
+	install_element(CONFIG_NODE, &cfg_log_file_cmd);
+	install_element(CONFIG_NODE, &cfg_no_log_file_cmd);
+#ifdef HAVE_SYSLOG_H
+	install_element(CONFIG_NODE, &cfg_log_syslog_cmd);
+	install_element(CONFIG_NODE, &cfg_log_syslog_local_cmd);
+	install_element(CONFIG_NODE, &cfg_no_log_syslog_cmd);
+#endif
+}
diff --git a/src/shared/libosmocore/src/vty/telnet_interface.c b/src/shared/libosmocore/src/vty/telnet_interface.c
new file mode 100644
index 00000000..1abf141d
--- /dev/null
+++ b/src/shared/libosmocore/src/vty/telnet_interface.c
@@ -0,0 +1,204 @@
+/* minimalistic telnet/network interface it might turn into a wire interface */
+/* (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/logging.h>
+
+#include <osmocom/vty/telnet_interface.h>
+#include <osmocom/vty/buffer.h>
+#include <osmocom/vty/command.h>
+
+/*! \addtogroup telnet_interface
+ *  @{
+ */
+/*! \file telnet_interface.c */
+
+/* per connection data */
+LLIST_HEAD(active_connections);
+
+static void *tall_telnet_ctx;
+
+/* per network data */
+static int telnet_new_connection(struct osmo_fd *fd, unsigned int what);
+
+static struct osmo_fd server_socket = {
+	.when	    = BSC_FD_READ,
+	.cb	    = telnet_new_connection,
+	.priv_nr    = 0,
+};
+
+/*! \brief Initialize telnet based VTY interface listening to 127.0.0.1
+ *  \param[in] tall_ctx \ref talloc context
+ *  \param[in] priv private data to be passed to callback
+ *  \param[in] port UDP port number
+ */
+int telnet_init(void *tall_ctx, void *priv, int port)
+{
+	return telnet_init_dynif(tall_ctx, priv, "127.0.0.1", port);
+}
+
+/*! \brief Initialize telnet based VTY interface
+ *  \param[in] tall_ctx \ref talloc context
+ *  \param[in] priv private data to be passed to callback
+ *  \param[in] ip IP to listen to ('::1' for localhost, '::0' for all, ...)
+ *  \param[in] port UDP port number
+ */
+int telnet_init_dynif(void *tall_ctx, void *priv, const char *ip, int port)
+{
+	int rc;
+
+	tall_telnet_ctx = talloc_named_const(tall_ctx, 1,
+			"telnet_connection");
+
+	rc = osmo_sock_init_ofd(
+			&server_socket,
+			AF_UNSPEC, SOCK_STREAM, IPPROTO_TCP,
+			ip, port, OSMO_SOCK_F_BIND
+			);
+
+	server_socket.data = priv;
+
+	return (rc < 0) ? -1 : 0;
+}
+
+extern struct host host;
+
+/*! \brief close a telnet connection */
+int telnet_close_client(struct osmo_fd *fd)
+{
+	struct telnet_connection *conn = (struct telnet_connection*)fd->data;
+
+	close(fd->fd);
+	osmo_fd_unregister(fd);
+
+	if (conn->dbg) {
+		log_del_target(conn->dbg);
+		talloc_free(conn->dbg);
+	}
+
+	llist_del(&conn->entry);
+	talloc_free(conn);
+	return 0;
+}
+
+static int client_data(struct osmo_fd *fd, unsigned int what)
+{
+	struct telnet_connection *conn = fd->data;
+	int rc = 0;
+
+	if (what & BSC_FD_READ) {
+		conn->fd.when &= ~BSC_FD_READ;
+		rc = vty_read(conn->vty);
+	}
+
+	/* vty might have been closed from vithin vty_read() */
+	if (!conn->vty)
+		return rc;
+
+	if (what & BSC_FD_WRITE) {
+		rc = buffer_flush_all(conn->vty->obuf, fd->fd);
+		if (rc == BUFFER_EMPTY)
+			conn->fd.when &= ~BSC_FD_WRITE;
+	}
+
+	return rc;
+}
+
+static int telnet_new_connection(struct osmo_fd *fd, unsigned int what)
+{
+	struct telnet_connection *connection;
+	struct sockaddr_in sockaddr;
+	socklen_t len = sizeof(sockaddr);
+	int new_connection = accept(fd->fd, (struct sockaddr*)&sockaddr, &len);
+
+	if (new_connection < 0) {
+		LOGP(0, LOGL_ERROR, "telnet accept failed\n");
+		return new_connection;
+	}
+
+	connection = talloc_zero(tall_telnet_ctx, struct telnet_connection);
+	connection->priv = fd->data;
+	connection->fd.data = connection;
+	connection->fd.fd = new_connection;
+	connection->fd.when = BSC_FD_READ;
+	connection->fd.cb = client_data;
+	osmo_fd_register(&connection->fd);
+	llist_add_tail(&connection->entry, &active_connections);
+
+	connection->vty = vty_create(new_connection, connection);
+	if (!connection->vty) {
+		LOGP(0, LOGL_ERROR, "couldn't create VTY\n");
+		close(new_connection);
+		talloc_free(connection);
+		return -1;
+	}
+
+	return 0;
+}
+
+/*! \brief callback from core VTY code about VTY related events */
+void vty_event(enum event event, int sock, struct vty *vty)
+{
+	struct telnet_connection *connection = vty->priv;
+	struct osmo_fd *bfd = &connection->fd;
+
+	if (vty->type != VTY_TERM)
+		return;
+
+	switch (event) {
+	case VTY_READ:
+		bfd->when |= BSC_FD_READ;
+		break;
+	case VTY_WRITE:
+		bfd->when |= BSC_FD_WRITE;
+		break;
+	case VTY_CLOSED:
+		/* vty layer is about to free() vty */
+		connection->vty = NULL;
+		telnet_close_client(bfd);
+		break;
+	default:
+		break;
+	}
+}
+
+void telnet_exit(void) 
+{
+	struct telnet_connection *tc, *tc2;
+
+	llist_for_each_entry_safe(tc, tc2, &active_connections, entry)
+		telnet_close_client(&tc->fd);
+
+	osmo_fd_unregister(&server_socket);
+	close(server_socket.fd);
+	talloc_free(tall_telnet_ctx);
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/vty/utils.c b/src/shared/libosmocore/src/vty/utils.c
new file mode 100644
index 00000000..e9c0d2d7
--- /dev/null
+++ b/src/shared/libosmocore/src/vty/utils.c
@@ -0,0 +1,118 @@
+/* utility routines for printing common objects in the Osmocom world */
+
+/* (C) 2009-2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <inttypes.h>
+#include <string.h>
+#include <ctype.h>
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/core/utils.h>
+
+#include <osmocom/vty/vty.h>
+
+/* \file utils.c */
+
+/*! \addtogroup rate_ctr
+ *  @{
+ */
+
+/*! \brief print a rate counter group to given VTY
+ *  \param[in] vty The VTY to which it should be printed
+ *  \param[in] prefix Any additional log prefix ahead of each line
+ *  \param[in] ctrg Rate counter group to be printed
+ */
+void vty_out_rate_ctr_group(struct vty *vty, const char *prefix,
+			    struct rate_ctr_group *ctrg)
+{
+	unsigned int i;
+
+	vty_out(vty, "%s%s:%s", prefix, ctrg->desc->group_description, VTY_NEWLINE);
+	for (i = 0; i < ctrg->desc->num_ctr; i++) {
+		struct rate_ctr *ctr = &ctrg->ctr[i];
+		vty_out(vty, " %s%s: %8" PRIu64 " "
+			"(%" PRIu64 "/s %" PRIu64 "/m %" PRIu64 "/h %" PRIu64 "/d)%s",
+			prefix, ctrg->desc->ctr_desc[i].description, ctr->current,
+			ctr->intv[RATE_CTR_INTV_SEC].rate,
+			ctr->intv[RATE_CTR_INTV_MIN].rate,
+			ctr->intv[RATE_CTR_INTV_HOUR].rate,
+			ctr->intv[RATE_CTR_INTV_DAY].rate,
+			VTY_NEWLINE);
+	};
+}
+
+/*! \brief Generate a VTY command string from value_string */
+char *vty_cmd_string_from_valstr(void *ctx, const struct value_string *vals,
+				 const char *prefix, const char *sep,
+				 const char *end, int do_lower)
+{
+	int len = 0, offset = 0, ret, rem;
+	int size = strlen(prefix);
+	const struct value_string *vs;
+	char *str;
+
+	for (vs = vals; vs->value || vs->str; vs++)
+		size += strlen(vs->str) + 1;
+
+	rem = size;
+	str = talloc_zero_size(ctx, size);
+	if (!str)
+		return NULL;
+
+	ret = snprintf(str + offset, rem, prefix);
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+
+	for (vs = vals; vs->value || vs->str; vs++) {
+		if (vs->str) {
+			int j, name_len = strlen(vs->str)+1;
+			char name[name_len];
+
+			for (j = 0; j < name_len; j++)
+				name[j] = do_lower ?
+					tolower(vs->str[j]) : vs->str[j];
+
+			name[name_len-1] = '\0';
+			ret = snprintf(str + offset, rem, "%s%s", name, sep);
+			if (ret < 0)
+				goto err;
+			OSMO_SNPRINTF_RET(ret, rem, offset, len);
+		}
+	}
+	offset--;	/* to remove the trailing | */
+	rem++;
+
+	ret = snprintf(str + offset, rem, end);
+	if (ret < 0)
+		goto err;
+	OSMO_SNPRINTF_RET(ret, rem, offset, len);
+err:
+	str[size-1] = '\0';
+	return str;
+}
+
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/vty/vector.c b/src/shared/libosmocore/src/vty/vector.c
new file mode 100644
index 00000000..4012f24b
--- /dev/null
+++ b/src/shared/libosmocore/src/vty/vector.c
@@ -0,0 +1,192 @@
+/* Generic vector interface routine
+ * Copyright (C) 1997 Kunihiro Ishiguro
+ *
+ * This file is part of GNU Zebra.
+ *
+ * GNU Zebra is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2, or (at your option) any
+ * later version.
+ *
+ * GNU Zebra is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GNU Zebra; see the file COPYING.  If not, write to the Free
+ * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+ * 02111-1307, USA.
+ */
+
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <osmocom/vty/vector.h>
+#include <osmocom/vty/vty.h>
+#include <osmocom/core/talloc.h>
+#include <memory.h>
+
+void *tall_vty_vec_ctx;
+
+/* Initialize vector : allocate memory and return vector. */
+vector vector_init(unsigned int size)
+{
+	vector v = talloc_zero(tall_vty_vec_ctx, struct _vector);
+	if (!v)
+		return NULL;
+
+	/* allocate at least one slot */
+	if (size == 0)
+		size = 1;
+
+	v->alloced = size;
+	v->active = 0;
+	v->index = _talloc_zero(tall_vty_vec_ctx, sizeof(void *) * size,
+				"vector_init:index");
+	if (!v->index) {
+		talloc_free(v);
+		return NULL;
+	}
+	return v;
+}
+
+void vector_only_wrapper_free(vector v)
+{
+	talloc_free(v);
+}
+
+void vector_only_index_free(void *index)
+{
+	talloc_free(index);
+}
+
+void vector_free(vector v)
+{
+	talloc_free(v->index);
+	talloc_free(v);
+}
+
+vector vector_copy(vector v)
+{
+	unsigned int size;
+	vector new = talloc_zero(tall_vty_vec_ctx, struct _vector);
+	if (!new)
+		return NULL;
+
+	new->active = v->active;
+	new->alloced = v->alloced;
+
+	size = sizeof(void *) * (v->alloced);
+	new->index = _talloc_zero(tall_vty_vec_ctx, size, "vector_copy:index");
+	if (!new->index) {
+		talloc_free(new);
+		return NULL;
+	}
+	memcpy(new->index, v->index, size);
+
+	return new;
+}
+
+/* Check assigned index, and if it runs short double index pointer */
+void vector_ensure(vector v, unsigned int num)
+{
+	if (v->alloced > num)
+		return;
+
+	v->index = talloc_realloc_size(tall_vty_vec_ctx, v->index,
+				       sizeof(void *) * (v->alloced * 2));
+	memset(&v->index[v->alloced], 0, sizeof(void *) * v->alloced);
+	v->alloced *= 2;
+
+	if (v->alloced <= num)
+		vector_ensure(v, num);
+}
+
+/* This function only returns next empty slot index.  It dose not mean
+   the slot's index memory is assigned, please call vector_ensure()
+   after calling this function. */
+int vector_empty_slot(vector v)
+{
+	unsigned int i;
+
+	if (v->active == 0)
+		return 0;
+
+	for (i = 0; i < v->active; i++)
+		if (v->index[i] == 0)
+			return i;
+
+	return i;
+}
+
+/* Set value to the smallest empty slot. */
+int vector_set(vector v, void *val)
+{
+	unsigned int i;
+
+	i = vector_empty_slot(v);
+	vector_ensure(v, i);
+
+	v->index[i] = val;
+
+	if (v->active <= i)
+		v->active = i + 1;
+
+	return i;
+}
+
+/* Set value to specified index slot. */
+int vector_set_index(vector v, unsigned int i, void *val)
+{
+	vector_ensure(v, i);
+
+	v->index[i] = val;
+
+	if (v->active <= i)
+		v->active = i + 1;
+
+	return i;
+}
+
+/* Look up vector.  */
+void *vector_lookup(vector v, unsigned int i)
+{
+	if (i >= v->active)
+		return NULL;
+	return v->index[i];
+}
+
+/* Lookup vector, ensure it. */
+void *vector_lookup_ensure(vector v, unsigned int i)
+{
+	vector_ensure(v, i);
+	return v->index[i];
+}
+
+/* Unset value at specified index slot. */
+void vector_unset(vector v, unsigned int i)
+{
+	if (i >= v->alloced)
+		return;
+
+	v->index[i] = NULL;
+
+	if (i + 1 == v->active) {
+		v->active--;
+		while (i && v->index[--i] == NULL && v->active--) ;	/* Is this ugly ? */
+	}
+}
+
+/* Count the number of not emplty slot. */
+unsigned int vector_count(vector v)
+{
+	unsigned int i;
+	unsigned count = 0;
+
+	for (i = 0; i < v->active; i++)
+		if (v->index[i] != NULL)
+			count++;
+
+	return count;
+}
diff --git a/src/shared/libosmocore/src/vty/vty.c b/src/shared/libosmocore/src/vty/vty.c
new file mode 100644
index 00000000..cafe2028
--- /dev/null
+++ b/src/shared/libosmocore/src/vty/vty.c
@@ -0,0 +1,1781 @@
+
+/*! \mainpage libosmovty Documentation
+ *
+ * \section sec_intro Introduction
+ * This library is a collection of common code used in various
+ * GSM related sub-projects inside the Osmocom family of projects.  It
+ * has been imported/derived from the GNU Zebra project.
+ * \n\n
+ * libosmovty implements the interactive command-line on the VTY
+ * (Virtual TTY) as well as configuration file parsing.
+ * \n\n
+ * Please note that C language projects inside Osmocom are typically
+ * single-threaded event-loop state machine designs.  As such,
+ * routines in libosmovty are not thread-safe.  If you must use them in
+ * a multi-threaded context, you have to add your own locking.
+ *
+ * \section sec_copyright Copyright and License
+ * Copyright © 1997-2007 - Kuninhiro Ishiguro\n
+ * Copyright © 2008-2011 - Harald Welte, Holger Freyther and contributors\n
+ * All rights reserved. \n\n
+ * The source code of libosmovty is licensed under the terms of the GNU
+ * General Public License as published by the Free Software Foundation;
+ * either version 2 of the License, or (at your option) any later
+ * version.\n
+ * See <http://www.gnu.org/licenses/> or COPYING included in the source
+ * code package istelf.\n
+ * The information detailed here is provided AS IS with NO WARRANTY OF
+ * ANY KIND, INCLUDING THE WARRANTY OF DESIGN, MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE.
+ * \n\n
+ *
+ * \section sec_contact Contact and Support
+ * Community-based support is available at the OpenBSC mailing list
+ * <http://lists.osmocom.org/mailman/listinfo/openbsc>\n
+ * Commercial support options available upon request from
+ * <http://sysmocom.de/>
+ */
+
+
+#include <stdio.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <ctype.h>
+#include <termios.h>
+
+#include <sys/utsname.h>
+#include <sys/param.h>
+
+#include <arpa/telnet.h>
+
+#include <osmocom/vty/vty.h>
+#include <osmocom/vty/command.h>
+#include <osmocom/vty/buffer.h>
+#include <osmocom/core/talloc.h>
+
+/* \addtogroup vty
+ * @{
+ */
+/*! \file vty.c */
+
+#define SYSCONFDIR "/usr/local/etc"
+
+/* our callback, located in telnet_interface.c */
+void vty_event(enum event event, int sock, struct vty *vty);
+
+extern struct host host;
+
+/* Vector which store each vty structure. */
+static vector vtyvec;
+
+vector Vvty_serv_thread;
+
+char *vty_cwd = NULL;
+
+/* Configure lock. */
+static int vty_config;
+
+static int password_check;
+
+void *tall_vty_ctx;
+
+static void vty_clear_buf(struct vty *vty)
+{
+	memset(vty->buf, 0, vty->max);
+}
+
+/*! \brief Allocate a new vty interface structure */
+struct vty *vty_new(void)
+{
+	struct vty *new = talloc_zero(tall_vty_ctx, struct vty);
+
+	if (!new)
+		goto out;
+
+	new->obuf = buffer_new(new, 0);	/* Use default buffer size. */
+	if (!new->obuf)
+		goto out_new;
+	new->buf = _talloc_zero(new, VTY_BUFSIZ, "vty_new->buf");
+	if (!new->buf)
+		goto out_obuf;
+
+	new->max = VTY_BUFSIZ;
+
+	return new;
+
+out_obuf:
+	buffer_free(new->obuf);
+out_new:
+	talloc_free(new);
+	new = NULL;
+out:
+	return new;
+}
+
+/* Authentication of vty */
+static void vty_auth(struct vty *vty, char *buf)
+{
+	char *passwd = NULL;
+	enum node_type next_node = 0;
+	int fail;
+	char *crypt(const char *, const char *);
+
+	switch (vty->node) {
+	case AUTH_NODE:
+#ifdef VTY_CRYPT_PW
+		if (host.encrypt)
+			passwd = host.password_encrypt;
+		else
+#endif
+			passwd = host.password;
+		if (host.advanced)
+			next_node = host.enable ? VIEW_NODE : ENABLE_NODE;
+		else
+			next_node = VIEW_NODE;
+		break;
+	case AUTH_ENABLE_NODE:
+#ifdef VTY_CRYPT_PW
+		if (host.encrypt)
+			passwd = host.enable_encrypt;
+		else
+#endif
+			passwd = host.enable;
+		next_node = ENABLE_NODE;
+		break;
+	}
+
+	if (passwd) {
+#ifdef VTY_CRYPT_PW
+		if (host.encrypt)
+			fail = strcmp(crypt(buf, passwd), passwd);
+		else
+#endif
+			fail = strcmp(buf, passwd);
+	} else
+		fail = 1;
+
+	if (!fail) {
+		vty->fail = 0;
+		vty->node = next_node;	/* Success ! */
+	} else {
+		vty->fail++;
+		if (vty->fail >= 3) {
+			if (vty->node == AUTH_NODE) {
+				vty_out(vty,
+					"%% Bad passwords, too many failures!%s",
+					VTY_NEWLINE);
+				vty->status = VTY_CLOSE;
+			} else {
+				/* AUTH_ENABLE_NODE */
+				vty->fail = 0;
+				vty_out(vty,
+					"%% Bad enable passwords, too many failures!%s",
+					VTY_NEWLINE);
+				vty->node = VIEW_NODE;
+			}
+		}
+	}
+}
+
+/*! \brief Close a given vty interface. */
+void vty_close(struct vty *vty)
+{
+	int i;
+
+	if (vty->obuf)  {
+		/* Flush buffer. */
+		buffer_flush_all(vty->obuf, vty->fd);
+
+		/* Free input buffer. */
+		buffer_free(vty->obuf);
+		vty->obuf = NULL;
+	}
+
+	/* Free command history. */
+	for (i = 0; i < VTY_MAXHIST; i++)
+		if (vty->hist[i])
+			talloc_free(vty->hist[i]);
+
+	/* Unset vector. */
+	vector_unset(vtyvec, vty->fd);
+
+	/* Close socket. */
+	if (vty->fd > 0)
+		close(vty->fd);
+
+	if (vty->buf) {
+		talloc_free(vty->buf);
+		vty->buf = NULL;
+	}
+
+	/* Check configure. */
+	vty_config_unlock(vty);
+
+	/* VTY_CLOSED is handled by the telnet_interface */
+	vty_event(VTY_CLOSED, vty->fd, vty);
+
+	/* OK free vty. */
+	talloc_free(vty);
+}
+
+/*! \brief Return if this VTY is a shell or not */
+int vty_shell(struct vty *vty)
+{
+	return vty->type == VTY_SHELL ? 1 : 0;
+}
+
+
+/*! \brief VTY standard output function
+ *  \param[in] vty VTY to which we should print
+ *  \param[in] format variable-length format string
+ */
+int vty_out(struct vty *vty, const char *format, ...)
+{
+	va_list args;
+	int len = 0;
+	int size = 1024;
+	char buf[1024];
+	char *p = NULL;
+
+	if (vty_shell(vty)) {
+		va_start(args, format);
+		vprintf(format, args);
+		va_end(args);
+	} else {
+		/* Try to write to initial buffer.  */
+		va_start(args, format);
+		len = vsnprintf(buf, sizeof buf, format, args);
+		va_end(args);
+
+		/* Initial buffer is not enough.  */
+		if (len < 0 || len >= size) {
+			while (1) {
+				if (len > -1)
+					size = len + 1;
+				else
+					size = size * 2;
+
+				p = talloc_realloc_size(vty, p, size);
+				if (!p)
+					return -1;
+
+				va_start(args, format);
+				len = vsnprintf(p, size, format, args);
+				va_end(args);
+
+				if (len > -1 && len < size)
+					break;
+			}
+		}
+
+		/* When initial buffer is enough to store all output.  */
+		if (!p)
+			p = buf;
+
+		/* Pointer p must point out buffer. */
+		buffer_put(vty->obuf, (u_char *) p, len);
+
+		/* If p is not different with buf, it is allocated buffer.  */
+		if (p != buf)
+			talloc_free(p);
+	}
+
+	vty_event(VTY_WRITE, vty->fd, vty);
+
+	return len;
+}
+
+/*! \brief print a newline on the given VTY */
+int vty_out_newline(struct vty *vty)
+{
+	const char *p = vty_newline(vty);
+	buffer_put(vty->obuf, p, strlen(p));
+	return 0;
+}
+
+/*! \brief return the current index of a given VTY */
+void *vty_current_index(struct vty *vty)
+{
+	return vty->index;
+}
+
+/*! \brief return the current node of a given VTY */
+int vty_current_node(struct vty *vty)
+{
+	return vty->node;
+}
+
+/*! \brief Lock the configuration to a given VTY
+ *  \param[in] vty VTY to which the config shall be locked
+ *  \returns 1 on success, 0 on error
+ *
+ * This shall be used to make sure only one VTY at a given time has
+ * access to modify the configuration */
+int vty_config_lock(struct vty *vty)
+{
+	if (vty_config == 0) {
+		vty->config = 1;
+		vty_config = 1;
+	}
+	return vty->config;
+}
+
+/*! \brief Unlock the configuration from a given VTY
+ *  \param[in] vty VTY from which the configuration shall be unlocked
+ *  \returns 0 in case of success
+ */
+int vty_config_unlock(struct vty *vty)
+{
+	if (vty_config == 1 && vty->config == 1) {
+		vty->config = 0;
+		vty_config = 0;
+	}
+	return vty->config;
+}
+
+/* Say hello to vty interface. */
+void vty_hello(struct vty *vty)
+{
+	const char *app_name = "<unnamed>";
+
+	if (host.app_info->name)
+		app_name = host.app_info->name;
+
+	vty_out(vty, "Welcome to the %s control interface%s%s",
+		app_name, VTY_NEWLINE, VTY_NEWLINE);
+
+	if (host.app_info->copyright)
+		vty_out(vty, "%s", host.app_info->copyright);
+
+	if (host.motdfile) {
+		FILE *f;
+		char buf[4096];
+
+		f = fopen(host.motdfile, "r");
+		if (f) {
+			while (fgets(buf, sizeof(buf), f)) {
+				char *s;
+				/* work backwards to ignore trailling isspace() */
+				for (s = buf + strlen(buf);
+				     (s > buf) && isspace(*(s - 1)); s--) ;
+				*s = '\0';
+				vty_out(vty, "%s%s", buf, VTY_NEWLINE);
+			}
+			fclose(f);
+		} else
+			vty_out(vty, "MOTD file not found%s", VTY_NEWLINE);
+	} else if (host.motd)
+		vty_out(vty, "%s", host.motd);
+}
+
+/* Put out prompt and wait input from user. */
+static void vty_prompt(struct vty *vty)
+{
+	struct utsname names;
+	const char *hostname;
+
+	if (vty->type == VTY_TERM) {
+		hostname = host.app_info->name;
+		if (!hostname) {
+			uname(&names);
+			hostname = names.nodename;
+		}
+		vty_out(vty, cmd_prompt(vty->node), hostname);
+	}
+}
+
+/* Command execution over the vty interface. */
+static int vty_command(struct vty *vty, char *buf)
+{
+	int ret;
+	vector vline;
+
+	/* Split readline string up into the vector */
+	vline = cmd_make_strvec(buf);
+
+	if (vline == NULL)
+		return CMD_SUCCESS;
+
+	ret = cmd_execute_command(vline, vty, NULL, 0);
+	if (ret != CMD_SUCCESS)
+		switch (ret) {
+		case CMD_WARNING:
+			if (vty->type == VTY_FILE)
+				vty_out(vty, "Warning...%s", VTY_NEWLINE);
+			break;
+		case CMD_ERR_AMBIGUOUS:
+			vty_out(vty, "%% Ambiguous command.%s", VTY_NEWLINE);
+			break;
+		case CMD_ERR_NO_MATCH:
+			vty_out(vty, "%% Unknown command.%s", VTY_NEWLINE);
+			break;
+		case CMD_ERR_INCOMPLETE:
+			vty_out(vty, "%% Command incomplete.%s", VTY_NEWLINE);
+			break;
+		}
+	cmd_free_strvec(vline);
+
+	return ret;
+}
+
+static const char telnet_backward_char = 0x08;
+static const char telnet_space_char = ' ';
+
+/* Basic function to write buffer to vty. */
+static void vty_write(struct vty *vty, const char *buf, size_t nbytes)
+{
+	if ((vty->node == AUTH_NODE) || (vty->node == AUTH_ENABLE_NODE))
+		return;
+
+	/* Should we do buffering here ?  And make vty_flush (vty) ? */
+	buffer_put(vty->obuf, buf, nbytes);
+}
+
+/* Ensure length of input buffer.  Is buffer is short, double it. */
+static void vty_ensure(struct vty *vty, int length)
+{
+	if (vty->max <= length) {
+		vty->max *= 2;
+		vty->buf = talloc_realloc_size(vty, vty->buf, vty->max);
+		// FIXME: check return
+	}
+}
+
+/* Basic function to insert character into vty. */
+static void vty_self_insert(struct vty *vty, char c)
+{
+	int i;
+	int length;
+
+	vty_ensure(vty, vty->length + 1);
+	length = vty->length - vty->cp;
+	memmove(&vty->buf[vty->cp + 1], &vty->buf[vty->cp], length);
+	vty->buf[vty->cp] = c;
+
+	vty_write(vty, &vty->buf[vty->cp], length + 1);
+	for (i = 0; i < length; i++)
+		vty_write(vty, &telnet_backward_char, 1);
+
+	vty->cp++;
+	vty->length++;
+}
+
+/* Self insert character 'c' in overwrite mode. */
+static void vty_self_insert_overwrite(struct vty *vty, char c)
+{
+	vty_ensure(vty, vty->length + 1);
+	vty->buf[vty->cp++] = c;
+
+	if (vty->cp > vty->length)
+		vty->length++;
+
+	if ((vty->node == AUTH_NODE) || (vty->node == AUTH_ENABLE_NODE))
+		return;
+
+	vty_write(vty, &c, 1);
+}
+
+/* Insert a word into vty interface with overwrite mode. */
+static void vty_insert_word_overwrite(struct vty *vty, char *str)
+{
+	int len = strlen(str);
+	vty_write(vty, str, len);
+	strcpy(&vty->buf[vty->cp], str);
+	vty->cp += len;
+	vty->length = vty->cp;
+}
+
+/* Forward character. */
+static void vty_forward_char(struct vty *vty)
+{
+	if (vty->cp < vty->length) {
+		vty_write(vty, &vty->buf[vty->cp], 1);
+		vty->cp++;
+	}
+}
+
+/* Backward character. */
+static void vty_backward_char(struct vty *vty)
+{
+	if (vty->cp > 0) {
+		vty->cp--;
+		vty_write(vty, &telnet_backward_char, 1);
+	}
+}
+
+/* Move to the beginning of the line. */
+static void vty_beginning_of_line(struct vty *vty)
+{
+	while (vty->cp)
+		vty_backward_char(vty);
+}
+
+/* Move to the end of the line. */
+static void vty_end_of_line(struct vty *vty)
+{
+	while (vty->cp < vty->length)
+		vty_forward_char(vty);
+}
+
+/* Add current command line to the history buffer. */
+static void vty_hist_add(struct vty *vty)
+{
+	int index;
+
+	if (vty->length == 0)
+		return;
+
+	index = vty->hindex ? vty->hindex - 1 : VTY_MAXHIST - 1;
+
+	/* Ignore the same string as previous one. */
+	if (vty->hist[index])
+		if (strcmp(vty->buf, vty->hist[index]) == 0) {
+			vty->hp = vty->hindex;
+			return;
+		}
+
+	/* Insert history entry. */
+	if (vty->hist[vty->hindex])
+		talloc_free(vty->hist[vty->hindex]);
+	vty->hist[vty->hindex] = talloc_strdup(vty, vty->buf);
+
+	/* History index rotation. */
+	vty->hindex++;
+	if (vty->hindex == VTY_MAXHIST)
+		vty->hindex = 0;
+
+	vty->hp = vty->hindex;
+}
+
+/* Get telnet window size. */
+static int
+vty_telnet_option (struct vty *vty, unsigned char *buf, int nbytes)
+{
+#ifdef TELNET_OPTION_DEBUG
+  int i;
+
+  for (i = 0; i < nbytes; i++)
+    {
+      switch (buf[i])
+	{
+	case IAC:
+	  vty_out (vty, "IAC ");
+	  break;
+	case WILL:
+	  vty_out (vty, "WILL ");
+	  break;
+	case WONT:
+	  vty_out (vty, "WONT ");
+	  break;
+	case DO:
+	  vty_out (vty, "DO ");
+	  break;
+	case DONT:
+	  vty_out (vty, "DONT ");
+	  break;
+	case SB:
+	  vty_out (vty, "SB ");
+	  break;
+	case SE:
+	  vty_out (vty, "SE ");
+	  break;
+	case TELOPT_ECHO:
+	  vty_out (vty, "TELOPT_ECHO %s", VTY_NEWLINE);
+	  break;
+	case TELOPT_SGA:
+	  vty_out (vty, "TELOPT_SGA %s", VTY_NEWLINE);
+	  break;
+	case TELOPT_NAWS:
+	  vty_out (vty, "TELOPT_NAWS %s", VTY_NEWLINE);
+	  break;
+	default:
+	  vty_out (vty, "%x ", buf[i]);
+	  break;
+	}
+    }
+  vty_out (vty, "%s", VTY_NEWLINE);
+
+#endif /* TELNET_OPTION_DEBUG */
+
+  switch (buf[0])
+    {
+    case SB:
+      vty->sb_len = 0;
+      vty->iac_sb_in_progress = 1;
+      return 0;
+      break;
+    case SE:
+      {
+	if (!vty->iac_sb_in_progress)
+	  return 0;
+
+	if ((vty->sb_len == 0) || (vty->sb_buf[0] == '\0'))
+	  {
+	    vty->iac_sb_in_progress = 0;
+	    return 0;
+	  }
+	switch (vty->sb_buf[0])
+	  {
+	  case TELOPT_NAWS:
+	    if (vty->sb_len != TELNET_NAWS_SB_LEN)
+	      vty_out(vty,"RFC 1073 violation detected: telnet NAWS option "
+			"should send %d characters, but we received %lu",
+			TELNET_NAWS_SB_LEN, (u_long)vty->sb_len);
+	    else if (sizeof(vty->sb_buf) < TELNET_NAWS_SB_LEN)
+	      vty_out(vty, "Bug detected: sizeof(vty->sb_buf) %lu < %d, "
+		       "too small to handle the telnet NAWS option",
+		       (u_long)sizeof(vty->sb_buf), TELNET_NAWS_SB_LEN);
+	    else
+	      {
+		vty->width = ((vty->sb_buf[1] << 8)|vty->sb_buf[2]);
+		vty->height = ((vty->sb_buf[3] << 8)|vty->sb_buf[4]);
+#ifdef TELNET_OPTION_DEBUG
+		vty_out(vty, "TELNET NAWS window size negotiation completed: "
+			      "width %d, height %d%s",
+			vty->width, vty->height, VTY_NEWLINE);
+#endif
+	      }
+	    break;
+	  }
+	vty->iac_sb_in_progress = 0;
+	return 0;
+	break;
+      }
+    default:
+      break;
+    }
+  return 1;
+}
+
+/* Execute current command line. */
+static int vty_execute(struct vty *vty)
+{
+	int ret;
+
+	ret = CMD_SUCCESS;
+
+	switch (vty->node) {
+	case AUTH_NODE:
+	case AUTH_ENABLE_NODE:
+		vty_auth(vty, vty->buf);
+		break;
+	default:
+		ret = vty_command(vty, vty->buf);
+		if (vty->type == VTY_TERM)
+			vty_hist_add(vty);
+		break;
+	}
+
+	/* Clear command line buffer. */
+	vty->cp = vty->length = 0;
+	vty_clear_buf(vty);
+
+	if (vty->status != VTY_CLOSE)
+		vty_prompt(vty);
+
+	return ret;
+}
+
+/* Send WILL TELOPT_ECHO to remote server. */
+static void
+vty_will_echo (struct vty *vty)
+{
+	unsigned char cmd[] = { IAC, WILL, TELOPT_ECHO, '\0' };
+	vty_out (vty, "%s", cmd);
+}
+
+/* Make suppress Go-Ahead telnet option. */
+static void
+vty_will_suppress_go_ahead (struct vty *vty)
+{
+	unsigned char cmd[] = { IAC, WILL, TELOPT_SGA, '\0' };
+	vty_out (vty, "%s", cmd);
+}
+
+/* Make don't use linemode over telnet. */
+static void
+vty_dont_linemode (struct vty *vty)
+{
+	unsigned char cmd[] = { IAC, DONT, TELOPT_LINEMODE, '\0' };
+	vty_out (vty, "%s", cmd);
+}
+
+/* Use window size. */
+static void
+vty_do_window_size (struct vty *vty)
+{
+	unsigned char cmd[] = { IAC, DO, TELOPT_NAWS, '\0' };
+	vty_out (vty, "%s", cmd);
+}
+
+static void vty_kill_line_from_beginning(struct vty *);
+static void vty_redraw_line(struct vty *);
+
+/* Print command line history.  This function is called from
+   vty_next_line and vty_previous_line. */
+static void vty_history_print(struct vty *vty)
+{
+	int length;
+
+	vty_kill_line_from_beginning(vty);
+
+	/* Get previous line from history buffer */
+	length = strlen(vty->hist[vty->hp]);
+	memcpy(vty->buf, vty->hist[vty->hp], length);
+	vty->cp = vty->length = length;
+
+	/* Redraw current line */
+	vty_redraw_line(vty);
+}
+
+/* Show next command line history. */
+static void vty_next_line(struct vty *vty)
+{
+	int try_index;
+
+	if (vty->hp == vty->hindex)
+		return;
+
+	/* Try is there history exist or not. */
+	try_index = vty->hp;
+	if (try_index == (VTY_MAXHIST - 1))
+		try_index = 0;
+	else
+		try_index++;
+
+	/* If there is not history return. */
+	if (vty->hist[try_index] == NULL)
+		return;
+	else
+		vty->hp = try_index;
+
+	vty_history_print(vty);
+}
+
+/* Show previous command line history. */
+static void vty_previous_line(struct vty *vty)
+{
+	int try_index;
+
+	try_index = vty->hp;
+	if (try_index == 0)
+		try_index = VTY_MAXHIST - 1;
+	else
+		try_index--;
+
+	if (vty->hist[try_index] == NULL)
+		return;
+	else
+		vty->hp = try_index;
+
+	vty_history_print(vty);
+}
+
+/* This function redraw all of the command line character. */
+static void vty_redraw_line(struct vty *vty)
+{
+	vty_write(vty, vty->buf, vty->length);
+	vty->cp = vty->length;
+}
+
+/* Forward word. */
+static void vty_forward_word(struct vty *vty)
+{
+	while (vty->cp != vty->length && vty->buf[vty->cp] != ' ')
+		vty_forward_char(vty);
+
+	while (vty->cp != vty->length && vty->buf[vty->cp] == ' ')
+		vty_forward_char(vty);
+}
+
+/* Backward word without skipping training space. */
+static void vty_backward_pure_word(struct vty *vty)
+{
+	while (vty->cp > 0 && vty->buf[vty->cp - 1] != ' ')
+		vty_backward_char(vty);
+}
+
+/* Backward word. */
+static void vty_backward_word(struct vty *vty)
+{
+	while (vty->cp > 0 && vty->buf[vty->cp - 1] == ' ')
+		vty_backward_char(vty);
+
+	while (vty->cp > 0 && vty->buf[vty->cp - 1] != ' ')
+		vty_backward_char(vty);
+}
+
+/* When '^D' is typed at the beginning of the line we move to the down
+   level. */
+static void vty_down_level(struct vty *vty)
+{
+	vty_out(vty, "%s", VTY_NEWLINE);
+	/* call the exit function of the specific node */
+	if (vty->node > CONFIG_NODE)
+		vty_go_parent(vty);
+	else
+		(*config_exit_cmd.func) (NULL, vty, 0, NULL);
+	vty_prompt(vty);
+	vty->cp = 0;
+}
+
+/* When '^Z' is received from vty, move down to the enable mode. */
+static void vty_end_config(struct vty *vty)
+{
+	vty_out(vty, "%s", VTY_NEWLINE);
+
+	/* FIXME: we need to call the exit function of the specific node
+	 * in question, not this generic one that doesn't know all nodes */
+	switch (vty->node) {
+	case VIEW_NODE:
+	case ENABLE_NODE:
+		/* Nothing to do. */
+		break;
+	case CONFIG_NODE:
+	case VTY_NODE:
+		vty_config_unlock(vty);
+		vty->node = ENABLE_NODE;
+		break;
+	case CFG_LOG_NODE:
+		vty->node = CONFIG_NODE;
+		break;
+	default:
+		/* Unknown node, we have to ignore it. */
+		break;
+	}
+
+	vty_prompt(vty);
+	vty->cp = 0;
+}
+
+/* Delete a charcter at the current point. */
+static void vty_delete_char(struct vty *vty)
+{
+	int i;
+	int size;
+
+	if (vty->node == AUTH_NODE || vty->node == AUTH_ENABLE_NODE)
+		return;
+
+	if (vty->length == 0) {
+		vty_down_level(vty);
+		return;
+	}
+
+	if (vty->cp == vty->length)
+		return;		/* completion need here? */
+
+	size = vty->length - vty->cp;
+
+	vty->length--;
+	memmove(&vty->buf[vty->cp], &vty->buf[vty->cp + 1], size - 1);
+	vty->buf[vty->length] = '\0';
+
+	vty_write(vty, &vty->buf[vty->cp], size - 1);
+	vty_write(vty, &telnet_space_char, 1);
+
+	for (i = 0; i < size; i++)
+		vty_write(vty, &telnet_backward_char, 1);
+}
+
+/* Delete a character before the point. */
+static void vty_delete_backward_char(struct vty *vty)
+{
+	if (vty->cp == 0)
+		return;
+
+	vty_backward_char(vty);
+	vty_delete_char(vty);
+}
+
+/* Kill rest of line from current point. */
+static void vty_kill_line(struct vty *vty)
+{
+	int i;
+	int size;
+
+	size = vty->length - vty->cp;
+
+	if (size == 0)
+		return;
+
+	for (i = 0; i < size; i++)
+		vty_write(vty, &telnet_space_char, 1);
+	for (i = 0; i < size; i++)
+		vty_write(vty, &telnet_backward_char, 1);
+
+	memset(&vty->buf[vty->cp], 0, size);
+	vty->length = vty->cp;
+}
+
+/* Kill line from the beginning. */
+static void vty_kill_line_from_beginning(struct vty *vty)
+{
+	vty_beginning_of_line(vty);
+	vty_kill_line(vty);
+}
+
+/* Delete a word before the point. */
+static void vty_forward_kill_word(struct vty *vty)
+{
+	while (vty->cp != vty->length && vty->buf[vty->cp] == ' ')
+		vty_delete_char(vty);
+	while (vty->cp != vty->length && vty->buf[vty->cp] != ' ')
+		vty_delete_char(vty);
+}
+
+/* Delete a word before the point. */
+static void vty_backward_kill_word(struct vty *vty)
+{
+	while (vty->cp > 0 && vty->buf[vty->cp - 1] == ' ')
+		vty_delete_backward_char(vty);
+	while (vty->cp > 0 && vty->buf[vty->cp - 1] != ' ')
+		vty_delete_backward_char(vty);
+}
+
+/* Transpose chars before or at the point. */
+static void vty_transpose_chars(struct vty *vty)
+{
+	char c1, c2;
+
+	/* If length is short or point is near by the beginning of line then
+	   return. */
+	if (vty->length < 2 || vty->cp < 1)
+		return;
+
+	/* In case of point is located at the end of the line. */
+	if (vty->cp == vty->length) {
+		c1 = vty->buf[vty->cp - 1];
+		c2 = vty->buf[vty->cp - 2];
+
+		vty_backward_char(vty);
+		vty_backward_char(vty);
+		vty_self_insert_overwrite(vty, c1);
+		vty_self_insert_overwrite(vty, c2);
+	} else {
+		c1 = vty->buf[vty->cp];
+		c2 = vty->buf[vty->cp - 1];
+
+		vty_backward_char(vty);
+		vty_self_insert_overwrite(vty, c1);
+		vty_self_insert_overwrite(vty, c2);
+	}
+}
+
+/* Do completion at vty interface. */
+static void vty_complete_command(struct vty *vty)
+{
+	int i;
+	int ret;
+	char **matched = NULL;
+	vector vline;
+
+	if (vty->node == AUTH_NODE || vty->node == AUTH_ENABLE_NODE)
+		return;
+
+	vline = cmd_make_strvec(vty->buf);
+	if (vline == NULL)
+		return;
+
+	/* In case of 'help \t'. */
+	if (isspace((int)vty->buf[vty->length - 1]))
+		vector_set(vline, '\0');
+
+	matched = cmd_complete_command(vline, vty, &ret);
+
+	cmd_free_strvec(vline);
+
+	vty_out(vty, "%s", VTY_NEWLINE);
+	switch (ret) {
+	case CMD_ERR_AMBIGUOUS:
+		vty_out(vty, "%% Ambiguous command.%s", VTY_NEWLINE);
+		vty_prompt(vty);
+		vty_redraw_line(vty);
+		break;
+	case CMD_ERR_NO_MATCH:
+		/* vty_out (vty, "%% There is no matched command.%s", VTY_NEWLINE); */
+		vty_prompt(vty);
+		vty_redraw_line(vty);
+		break;
+	case CMD_COMPLETE_FULL_MATCH:
+		vty_prompt(vty);
+		vty_redraw_line(vty);
+		vty_backward_pure_word(vty);
+		vty_insert_word_overwrite(vty, matched[0]);
+		vty_self_insert(vty, ' ');
+		talloc_free(matched[0]);
+		break;
+	case CMD_COMPLETE_MATCH:
+		vty_prompt(vty);
+		vty_redraw_line(vty);
+		vty_backward_pure_word(vty);
+		vty_insert_word_overwrite(vty, matched[0]);
+		talloc_free(matched[0]);
+		break;
+	case CMD_COMPLETE_LIST_MATCH:
+		for (i = 0; matched[i] != NULL; i++) {
+			if (i != 0 && ((i % 6) == 0))
+				vty_out(vty, "%s", VTY_NEWLINE);
+			vty_out(vty, "%-10s ", matched[i]);
+			talloc_free(matched[i]);
+		}
+		vty_out(vty, "%s", VTY_NEWLINE);
+
+		vty_prompt(vty);
+		vty_redraw_line(vty);
+		break;
+	case CMD_ERR_NOTHING_TODO:
+		vty_prompt(vty);
+		vty_redraw_line(vty);
+		break;
+	default:
+		break;
+	}
+	if (matched)
+		vector_only_index_free(matched);
+}
+
+static void
+vty_describe_fold(struct vty *vty, int cmd_width,
+		  unsigned int desc_width, struct desc *desc)
+{
+	char *buf;
+	const char *cmd, *p;
+	int pos;
+
+	cmd = desc->cmd[0] == '.' ? desc->cmd + 1 : desc->cmd;
+
+	if (desc_width <= 0) {
+		vty_out(vty, "  %-*s  %s%s", cmd_width, cmd, desc->str,
+			VTY_NEWLINE);
+		return;
+	}
+
+	buf = _talloc_zero(vty, strlen(desc->str) + 1, "describe_fold");
+	if (!buf)
+		return;
+
+	for (p = desc->str; strlen(p) > desc_width; p += pos + 1) {
+		for (pos = desc_width; pos > 0; pos--)
+			if (*(p + pos) == ' ')
+				break;
+
+		if (pos == 0)
+			break;
+
+		strncpy(buf, p, pos);
+		buf[pos] = '\0';
+		vty_out(vty, "  %-*s  %s%s", cmd_width, cmd, buf, VTY_NEWLINE);
+
+		cmd = "";
+	}
+
+	vty_out(vty, "  %-*s  %s%s", cmd_width, cmd, p, VTY_NEWLINE);
+
+	talloc_free(buf);
+}
+
+/* Describe matched command function. */
+static void vty_describe_command(struct vty *vty)
+{
+	int ret;
+	vector vline;
+	vector describe;
+	unsigned int i, width, desc_width;
+	struct desc *desc, *desc_cr = NULL;
+
+	vline = cmd_make_strvec(vty->buf);
+
+	/* In case of '> ?'. */
+	if (vline == NULL) {
+		vline = vector_init(1);
+		vector_set(vline, '\0');
+	} else if (isspace((int)vty->buf[vty->length - 1]))
+		vector_set(vline, '\0');
+
+	describe = cmd_describe_command(vline, vty, &ret);
+
+	vty_out(vty, "%s", VTY_NEWLINE);
+
+	/* Ambiguous error. */
+	switch (ret) {
+	case CMD_ERR_AMBIGUOUS:
+		cmd_free_strvec(vline);
+		vty_out(vty, "%% Ambiguous command.%s", VTY_NEWLINE);
+		vty_prompt(vty);
+		vty_redraw_line(vty);
+		return;
+		break;
+	case CMD_ERR_NO_MATCH:
+		cmd_free_strvec(vline);
+		vty_out(vty, "%% There is no matched command.%s", VTY_NEWLINE);
+		vty_prompt(vty);
+		vty_redraw_line(vty);
+		return;
+		break;
+	}
+
+	/* Get width of command string. */
+	width = 0;
+	for (i = 0; i < vector_active(describe); i++)
+		if ((desc = vector_slot(describe, i)) != NULL) {
+			unsigned int len;
+
+			if (desc->cmd[0] == '\0')
+				continue;
+
+			len = strlen(desc->cmd);
+			if (desc->cmd[0] == '.')
+				len--;
+
+			if (width < len)
+				width = len;
+		}
+
+	/* Get width of description string. */
+	desc_width = vty->width - (width + 6);
+
+	/* Print out description. */
+	for (i = 0; i < vector_active(describe); i++)
+		if ((desc = vector_slot(describe, i)) != NULL) {
+			if (desc->cmd[0] == '\0')
+				continue;
+
+			if (strcmp(desc->cmd, "<cr>") == 0) {
+				desc_cr = desc;
+				continue;
+			}
+
+			if (!desc->str)
+				vty_out(vty, "  %-s%s",
+					desc->cmd[0] ==
+					'.' ? desc->cmd + 1 : desc->cmd,
+					VTY_NEWLINE);
+			else if (desc_width >= strlen(desc->str))
+				vty_out(vty, "  %-*s  %s%s", width,
+					desc->cmd[0] ==
+					'.' ? desc->cmd + 1 : desc->cmd,
+					desc->str, VTY_NEWLINE);
+			else
+				vty_describe_fold(vty, width, desc_width, desc);
+
+#if 0
+			vty_out(vty, "  %-*s %s%s", width
+				desc->cmd[0] == '.' ? desc->cmd + 1 : desc->cmd,
+				desc->str ? desc->str : "", VTY_NEWLINE);
+#endif				/* 0 */
+		}
+
+	if ((desc = desc_cr)) {
+		if (!desc->str)
+			vty_out(vty, "  %-s%s",
+				desc->cmd[0] == '.' ? desc->cmd + 1 : desc->cmd,
+				VTY_NEWLINE);
+		else if (desc_width >= strlen(desc->str))
+			vty_out(vty, "  %-*s  %s%s", width,
+				desc->cmd[0] == '.' ? desc->cmd + 1 : desc->cmd,
+				desc->str, VTY_NEWLINE);
+		else
+			vty_describe_fold(vty, width, desc_width, desc);
+	}
+
+	cmd_free_strvec(vline);
+	vector_free(describe);
+
+	vty_prompt(vty);
+	vty_redraw_line(vty);
+}
+
+/* ^C stop current input and do not add command line to the history. */
+static void vty_stop_input(struct vty *vty)
+{
+	vty->cp = vty->length = 0;
+	vty_clear_buf(vty);
+	vty_out(vty, "%s", VTY_NEWLINE);
+
+	switch (vty->node) {
+	case VIEW_NODE:
+	case ENABLE_NODE:
+		/* Nothing to do. */
+		break;
+	case CONFIG_NODE:
+	case VTY_NODE:
+		vty_config_unlock(vty);
+		vty->node = ENABLE_NODE;
+		break;
+	case CFG_LOG_NODE:
+		vty->node = CONFIG_NODE;
+		break;
+	default:
+		/* Unknown node, we have to ignore it. */
+		break;
+	}
+	vty_prompt(vty);
+
+	/* Set history pointer to the latest one. */
+	vty->hp = vty->hindex;
+}
+
+#define CONTROL(X)  ((X) - '@')
+#define VTY_NORMAL     0
+#define VTY_PRE_ESCAPE 1
+#define VTY_ESCAPE     2
+
+/* Escape character command map. */
+static void vty_escape_map(unsigned char c, struct vty *vty)
+{
+	switch (c) {
+	case ('A'):
+		vty_previous_line(vty);
+		break;
+	case ('B'):
+		vty_next_line(vty);
+		break;
+	case ('C'):
+		vty_forward_char(vty);
+		break;
+	case ('D'):
+		vty_backward_char(vty);
+		break;
+	default:
+		break;
+	}
+
+	/* Go back to normal mode. */
+	vty->escape = VTY_NORMAL;
+}
+
+/* Quit print out to the buffer. */
+static void vty_buffer_reset(struct vty *vty)
+{
+	buffer_reset(vty->obuf);
+	vty_prompt(vty);
+	vty_redraw_line(vty);
+}
+
+/*! \brief Read data via vty socket. */
+int vty_read(struct vty *vty)
+{
+	int i;
+	int nbytes;
+	unsigned char buf[VTY_READ_BUFSIZ];
+
+	int vty_sock = vty->fd;
+
+	/* Read raw data from socket */
+	if ((nbytes = read(vty->fd, buf, VTY_READ_BUFSIZ)) <= 0) {
+		if (nbytes < 0) {
+			if (ERRNO_IO_RETRY(errno)) {
+				vty_event(VTY_READ, vty_sock, vty);
+				return 0;
+			}
+		}
+		buffer_reset(vty->obuf);
+		vty->status = VTY_CLOSE;
+	}
+
+	for (i = 0; i < nbytes; i++) {
+		if (buf[i] == IAC) {
+			if (!vty->iac) {
+				vty->iac = 1;
+				continue;
+			} else {
+				vty->iac = 0;
+			}
+		}
+
+		if (vty->iac_sb_in_progress && !vty->iac) {
+			if (vty->sb_len < sizeof(vty->sb_buf))
+				vty->sb_buf[vty->sb_len] = buf[i];
+			vty->sb_len++;
+			continue;
+		}
+
+		if (vty->iac) {
+			/* In case of telnet command */
+			int ret = 0;
+			ret = vty_telnet_option(vty, buf + i, nbytes - i);
+			vty->iac = 0;
+			i += ret;
+			continue;
+		}
+
+		if (vty->status == VTY_MORE) {
+			switch (buf[i]) {
+			case CONTROL('C'):
+			case 'q':
+			case 'Q':
+				vty_buffer_reset(vty);
+				break;
+#if 0				/* More line does not work for "show ip bgp".  */
+			case '\n':
+			case '\r':
+				vty->status = VTY_MORELINE;
+				break;
+#endif
+			default:
+				break;
+			}
+			continue;
+		}
+
+		/* Escape character. */
+		if (vty->escape == VTY_ESCAPE) {
+			vty_escape_map(buf[i], vty);
+			continue;
+		}
+
+		/* Pre-escape status. */
+		if (vty->escape == VTY_PRE_ESCAPE) {
+			switch (buf[i]) {
+			case '[':
+				vty->escape = VTY_ESCAPE;
+				break;
+			case 'b':
+				vty_backward_word(vty);
+				vty->escape = VTY_NORMAL;
+				break;
+			case 'f':
+				vty_forward_word(vty);
+				vty->escape = VTY_NORMAL;
+				break;
+			case 'd':
+				vty_forward_kill_word(vty);
+				vty->escape = VTY_NORMAL;
+				break;
+			case CONTROL('H'):
+			case 0x7f:
+				vty_backward_kill_word(vty);
+				vty->escape = VTY_NORMAL;
+				break;
+			default:
+				vty->escape = VTY_NORMAL;
+				break;
+			}
+			continue;
+		}
+
+		switch (buf[i]) {
+		case CONTROL('A'):
+			vty_beginning_of_line(vty);
+			break;
+		case CONTROL('B'):
+			vty_backward_char(vty);
+			break;
+		case CONTROL('C'):
+			vty_stop_input(vty);
+			break;
+		case CONTROL('D'):
+			vty_delete_char(vty);
+			break;
+		case CONTROL('E'):
+			vty_end_of_line(vty);
+			break;
+		case CONTROL('F'):
+			vty_forward_char(vty);
+			break;
+		case CONTROL('H'):
+		case 0x7f:
+			vty_delete_backward_char(vty);
+			break;
+		case CONTROL('K'):
+			vty_kill_line(vty);
+			break;
+		case CONTROL('N'):
+			vty_next_line(vty);
+			break;
+		case CONTROL('P'):
+			vty_previous_line(vty);
+			break;
+		case CONTROL('T'):
+			vty_transpose_chars(vty);
+			break;
+		case CONTROL('U'):
+			vty_kill_line_from_beginning(vty);
+			break;
+		case CONTROL('W'):
+			vty_backward_kill_word(vty);
+			break;
+		case CONTROL('Z'):
+			vty_end_config(vty);
+			break;
+		case '\n':
+		case '\r':
+			vty_out(vty, "%s", VTY_NEWLINE);
+			vty_execute(vty);
+			break;
+		case '\t':
+			vty_complete_command(vty);
+			break;
+		case '?':
+			if (vty->node == AUTH_NODE
+			    || vty->node == AUTH_ENABLE_NODE)
+				vty_self_insert(vty, buf[i]);
+			else
+				vty_describe_command(vty);
+			break;
+		case '\033':
+			if (i + 1 < nbytes && buf[i + 1] == '[') {
+				vty->escape = VTY_ESCAPE;
+				i++;
+			} else
+				vty->escape = VTY_PRE_ESCAPE;
+			break;
+		default:
+			if (buf[i] > 31 && buf[i] < 127)
+				vty_self_insert(vty, buf[i]);
+			break;
+		}
+	}
+
+	/* Check status. */
+	if (vty->status == VTY_CLOSE)
+		vty_close(vty);
+	else {
+		vty_event(VTY_WRITE, vty_sock, vty);
+		vty_event(VTY_READ, vty_sock, vty);
+	}
+	return 0;
+}
+
+/* Read up configuration file */
+static int
+vty_read_file(FILE *confp, void *priv)
+{
+	int ret;
+	struct vty *vty;
+
+	vty = vty_new();
+	vty->fd = 0;
+	vty->type = VTY_FILE;
+	vty->node = CONFIG_NODE;
+	vty->priv = priv;
+
+	ret = config_from_file(vty, confp);
+
+	if (ret != CMD_SUCCESS) {
+		switch (ret) {
+		case CMD_ERR_AMBIGUOUS:
+			fprintf(stderr, "Ambiguous command.\n");
+			break;
+		case CMD_ERR_NO_MATCH:
+			fprintf(stderr, "There is no such command.\n");
+			break;
+		}
+		fprintf(stderr, "Error occurred during reading below "
+			"line:\n%s\n", vty->buf);
+		vty_close(vty);
+		return -EINVAL;
+	}
+
+	vty_close(vty);
+	return 0;
+}
+
+/*! \brief Create new vty structure. */
+struct vty *
+vty_create (int vty_sock, void *priv)
+{
+  struct vty *vty;
+
+	struct termios t;
+
+	tcgetattr(vty_sock, &t);
+	cfmakeraw(&t);
+	tcsetattr(vty_sock, TCSANOW, &t);
+
+  /* Allocate new vty structure and set up default values. */
+  vty = vty_new ();
+  vty->fd = vty_sock;
+  vty->priv = priv;
+  vty->type = VTY_TERM;
+  if (!password_check)
+    {
+      if (host.advanced)
+	vty->node = ENABLE_NODE;
+      else
+	vty->node = VIEW_NODE;
+    }
+  else
+    vty->node = AUTH_NODE;
+  vty->fail = 0;
+  vty->cp = 0;
+  vty_clear_buf (vty);
+  vty->length = 0;
+  memset (vty->hist, 0, sizeof (vty->hist));
+  vty->hp = 0;
+  vty->hindex = 0;
+  vector_set_index (vtyvec, vty_sock, vty);
+  vty->status = VTY_NORMAL;
+  if (host.lines >= 0)
+    vty->lines = host.lines;
+  else
+    vty->lines = -1;
+
+  if (password_check)
+    {
+      /* Vty is not available if password isn't set. */
+      if (host.password == NULL && host.password_encrypt == NULL)
+	{
+	  vty_out (vty, "Vty password is not set.%s", VTY_NEWLINE);
+	  vty->status = VTY_CLOSE;
+	  vty_close (vty);
+	  return NULL;
+	}
+    }
+
+  /* Say hello to the world. */
+  vty_hello (vty);
+  if (password_check)
+    vty_out (vty, "%sUser Access Verification%s%s", VTY_NEWLINE, VTY_NEWLINE, VTY_NEWLINE);
+
+  /* Setting up terminal. */
+  vty_will_echo (vty);
+  vty_will_suppress_go_ahead (vty);
+
+  vty_dont_linemode (vty);
+  vty_do_window_size (vty);
+  /* vty_dont_lflow_ahead (vty); */
+
+  vty_prompt (vty);
+
+  /* Add read/write thread. */
+  vty_event (VTY_WRITE, vty_sock, vty);
+  vty_event (VTY_READ, vty_sock, vty);
+
+  return vty;
+}
+
+DEFUN(config_who, config_who_cmd, "who", "Display who is on vty\n")
+{
+	unsigned int i;
+	struct vty *v;
+
+	for (i = 0; i < vector_active(vtyvec); i++)
+		if ((v = vector_slot(vtyvec, i)) != NULL)
+			vty_out(vty, "%svty[%d] %s",
+				v->config ? "*" : " ", i, VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+/* Move to vty configuration mode. */
+DEFUN(line_vty,
+      line_vty_cmd,
+      "line vty", "Configure a terminal line\n" "Virtual terminal\n")
+{
+	vty->node = VTY_NODE;
+	return CMD_SUCCESS;
+}
+
+/* vty login. */
+DEFUN(vty_login, vty_login_cmd, "login", "Enable password checking\n")
+{
+	password_check = 1;
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_vty_login,
+      no_vty_login_cmd, "no login", NO_STR "Enable password checking\n")
+{
+	password_check = 0;
+	return CMD_SUCCESS;
+}
+
+DEFUN(service_advanced_vty,
+      service_advanced_vty_cmd,
+      "service advanced-vty",
+      "Set up miscellaneous service\n" "Enable advanced mode vty interface\n")
+{
+	host.advanced = 1;
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_service_advanced_vty,
+      no_service_advanced_vty_cmd,
+      "no service advanced-vty",
+      NO_STR
+      "Set up miscellaneous service\n" "Enable advanced mode vty interface\n")
+{
+	host.advanced = 0;
+	return CMD_SUCCESS;
+}
+
+DEFUN(terminal_monitor,
+      terminal_monitor_cmd,
+      "terminal monitor",
+      "Set terminal line parameters\n"
+      "Copy debug output to the current terminal line\n")
+{
+	vty->monitor = 1;
+	return CMD_SUCCESS;
+}
+
+DEFUN(terminal_no_monitor,
+      terminal_no_monitor_cmd,
+      "terminal no monitor",
+      "Set terminal line parameters\n"
+      NO_STR "Copy debug output to the current terminal line\n")
+{
+	vty->monitor = 0;
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_history,
+      show_history_cmd,
+      "show history", SHOW_STR "Display the session command history\n")
+{
+	int index;
+
+	for (index = vty->hindex + 1; index != vty->hindex;) {
+		if (index == VTY_MAXHIST) {
+			index = 0;
+			continue;
+		}
+
+		if (vty->hist[index] != NULL)
+			vty_out(vty, "  %s%s", vty->hist[index], VTY_NEWLINE);
+
+		index++;
+	}
+
+	return CMD_SUCCESS;
+}
+
+/* Display current configuration. */
+static int vty_config_write(struct vty *vty)
+{
+	vty_out(vty, "line vty%s", VTY_NEWLINE);
+
+	/* login */
+	if (!password_check)
+		vty_out(vty, " no login%s", VTY_NEWLINE);
+
+	vty_out(vty, "!%s", VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+struct cmd_node vty_node = {
+	VTY_NODE,
+	"%s(config-line)# ",
+	1,
+};
+
+/*! \brief Reset all VTY status. */
+void vty_reset(void)
+{
+	unsigned int i;
+	struct vty *vty;
+	struct thread *vty_serv_thread;
+
+	for (i = 0; i < vector_active(vtyvec); i++)
+		if ((vty = vector_slot(vtyvec, i)) != NULL) {
+			buffer_reset(vty->obuf);
+			vty->status = VTY_CLOSE;
+			vty_close(vty);
+		}
+
+	for (i = 0; i < vector_active(Vvty_serv_thread); i++)
+		if ((vty_serv_thread =
+		     vector_slot(Vvty_serv_thread, i)) != NULL) {
+			//thread_cancel (vty_serv_thread);
+			vector_slot(Vvty_serv_thread, i) = NULL;
+			close(i);
+		}
+}
+
+static void vty_save_cwd(void)
+{
+	char cwd[MAXPATHLEN];
+	char *c ;
+
+	c = getcwd(cwd, MAXPATHLEN);
+
+	if (!c) {
+		if (chdir(SYSCONFDIR) != 0)
+		    perror("chdir failed");
+		if (getcwd(cwd, MAXPATHLEN) == NULL)
+		    perror("getcwd failed");
+	}
+
+	vty_cwd = _talloc_zero(tall_vty_ctx, strlen(cwd) + 1, "save_cwd");
+	strcpy(vty_cwd, cwd);
+}
+
+char *vty_get_cwd(void)
+{
+	return vty_cwd;
+}
+
+int vty_shell_serv(struct vty *vty)
+{
+	return vty->type == VTY_SHELL_SERV ? 1 : 0;
+}
+
+void vty_init_vtysh(void)
+{
+	vtyvec = vector_init(VECTOR_MIN_SIZE);
+}
+
+extern void *tall_bsc_ctx;
+
+/*! \brief Initialize VTY layer
+ *  \param[in] app_info application information
+ */
+/* Install vty's own commands like `who' command. */
+void vty_init(struct vty_app_info *app_info)
+{
+	tall_vty_ctx = talloc_named_const(app_info->tall_ctx, 0, "vty");
+	tall_vty_vec_ctx = talloc_named_const(tall_vty_ctx, 0, "vty_vector");
+	tall_vty_cmd_ctx = talloc_named_const(tall_vty_ctx, 0, "vty_command");
+
+	cmd_init(1);
+
+	host.app_info = app_info;
+
+	/* For further configuration read, preserve current directory. */
+	vty_save_cwd();
+
+	vtyvec = vector_init(VECTOR_MIN_SIZE);
+
+	/* Install bgp top node. */
+	install_node(&vty_node, vty_config_write);
+
+	install_element_ve(&config_who_cmd);
+	install_element_ve(&show_history_cmd);
+	install_element(CONFIG_NODE, &line_vty_cmd);
+	install_element(CONFIG_NODE, &service_advanced_vty_cmd);
+	install_element(CONFIG_NODE, &no_service_advanced_vty_cmd);
+	install_element(CONFIG_NODE, &show_history_cmd);
+	install_element(ENABLE_NODE, &terminal_monitor_cmd);
+	install_element(ENABLE_NODE, &terminal_no_monitor_cmd);
+
+	install_element(VTY_NODE, &vty_login_cmd);
+	install_element(VTY_NODE, &no_vty_login_cmd);
+}
+
+/*! \brief Read the configuration file using the VTY code
+ *  \param[in] file_name file name of the configuration file
+ *  \param[in] priv private data to be passed to \ref vty_read_file
+ */
+int vty_read_config_file(const char *file_name, void *priv)
+{
+	FILE *cfile;
+	int rc;
+
+	cfile = fopen(file_name, "r");
+	if (!cfile)
+		return -ENOENT;
+
+	rc = vty_read_file(cfile, priv);
+	fclose(cfile);
+
+	host_config_set(file_name);
+
+	return rc;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/src/write_queue.c b/src/shared/libosmocore/src/write_queue.c
new file mode 100644
index 00000000..cef40f83
--- /dev/null
+++ b/src/shared/libosmocore/src/write_queue.c
@@ -0,0 +1,118 @@
+/* Generic write queue implementation */
+/*
+ * (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by On-Waves
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/core/write_queue.h>
+
+/*! \addtogroup write_queue
+ *  @{
+ */
+
+/*! \file write_queue.c */
+
+/*! \brief Select loop function for write queue handling
+ *  \param[in] fd osmocom file descriptor
+ *  \param[in] what bit-mask of events that have happened
+ *
+ * This function is provided so that it can be registered with the
+ * select loop abstraction code (\ref osmo_fd::cb).
+ */
+int osmo_wqueue_bfd_cb(struct osmo_fd *fd, unsigned int what)
+{
+	struct osmo_wqueue *queue;
+
+	queue = container_of(fd, struct osmo_wqueue, bfd);
+
+	if (what & BSC_FD_READ)
+		queue->read_cb(fd);
+
+	if (what & BSC_FD_EXCEPT)
+		queue->except_cb(fd);
+
+	if (what & BSC_FD_WRITE) {
+		struct msgb *msg;
+
+		fd->when &= ~BSC_FD_WRITE;
+
+		/* the queue might have been emptied */
+		if (!llist_empty(&queue->msg_queue)) {
+			--queue->current_length;
+
+			msg = msgb_dequeue(&queue->msg_queue);
+			queue->write_cb(fd, msg);
+			msgb_free(msg);
+
+			if (!llist_empty(&queue->msg_queue))
+				fd->when |= BSC_FD_WRITE;
+		}
+	}
+
+	return 0;
+}
+
+/*! \brief Initialize a \ref osmo_wqueue structure
+ *  \param[in] queue Write queue to operate on
+ *  \param[in] max_length Maximum length of write queue
+ */
+void osmo_wqueue_init(struct osmo_wqueue *queue, int max_length)
+{
+	queue->max_length = max_length;
+	queue->current_length = 0;
+	queue->read_cb = NULL;
+	queue->write_cb = NULL;
+	queue->bfd.cb = osmo_wqueue_bfd_cb;
+	INIT_LLIST_HEAD(&queue->msg_queue);
+}
+
+/*! \brief Enqueue a new \ref msgb into a write queue
+ *  \param[in] queue Write queue to be used
+ *  \param[in] data to-be-enqueued message buffer
+ */
+int osmo_wqueue_enqueue(struct osmo_wqueue *queue, struct msgb *data)
+{
+//	if (queue->current_length + 1 >= queue->max_length)
+//		LOGP(DMSC, LOGL_ERROR, "The queue is full. Dropping not yet implemented.\n");
+
+	++queue->current_length;
+	msgb_enqueue(&queue->msg_queue, data);
+	queue->bfd.when |= BSC_FD_WRITE;
+
+	return 0;
+}
+
+/*! \brief Clear a \ref osmo_wqueue
+ *  \param[in] queue Write queue to be cleared
+ *
+ * This function will clear (remove/release) all messages in it.
+ */
+void osmo_wqueue_clear(struct osmo_wqueue *queue)
+{
+	while (!llist_empty(&queue->msg_queue)) {
+		struct msgb *msg = msgb_dequeue(&queue->msg_queue);
+		msgb_free(msg);
+	}
+
+	queue->current_length = 0;
+	queue->bfd.when &= ~BSC_FD_WRITE;
+}
+
+/*! @} */
diff --git a/src/shared/libosmocore/tests/Makefile.am b/src/shared/libosmocore/tests/Makefile.am
new file mode 100644
index 00000000..aaad0c84
--- /dev/null
+++ b/src/shared/libosmocore/tests/Makefile.am
@@ -0,0 +1,100 @@
+INCLUDES = $(all_includes) -I$(top_srcdir)/include
+
+check_PROGRAMS = timer/timer_test sms/sms_test ussd/ussd_test		\
+                 smscb/smscb_test bits/bitrev_test a5/a5_test		\
+                 conv/conv_test auth/milenage_test lapd/lapd_test	\
+                 gsm0808/gsm0808_test gsm0408/gsm0408_test		\
+		 gb/bssgp_fc_test logging/logging_test
+if ENABLE_MSGFILE
+check_PROGRAMS += msgfile/msgfile_test
+endif
+
+a5_a5_test_SOURCES = a5/a5_test.c
+a5_a5_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la
+
+auth_milenage_test_SOURCES = auth/milenage_test.c
+auth_milenage_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la
+
+bits_bitrev_test_SOURCES = bits/bitrev_test.c
+bits_bitrev_test_LDADD = $(top_builddir)/src/libosmocore.la
+
+conv_conv_test_SOURCES = conv/conv_test.c
+conv_conv_test_LDADD = $(top_builddir)/src/libosmocore.la
+
+gsm0808_gsm0808_test_SOURCES = gsm0808/gsm0808_test.c
+gsm0808_gsm0808_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la
+
+gsm0408_gsm0408_test_SOURCES = gsm0408/gsm0408_test.c
+gsm0408_gsm0408_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la
+
+lapd_lapd_test_SOURCES = lapd/lapd_test.c
+lapd_lapd_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la
+
+msgfile_msgfile_test_SOURCES = msgfile/msgfile_test.c
+msgfile_msgfile_test_LDADD = $(top_builddir)/src/libosmocore.la
+
+smscb_smscb_test_SOURCES = smscb/smscb_test.c
+smscb_smscb_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la
+
+sms_sms_test_SOURCES = sms/sms_test.c
+sms_sms_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la
+
+timer_timer_test_SOURCES = timer/timer_test.c
+timer_timer_test_LDADD = $(top_builddir)/src/libosmocore.la
+
+ussd_ussd_test_SOURCES = ussd/ussd_test.c
+ussd_ussd_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la
+
+gb_bssgp_fc_test_SOURCES = gb/bssgp_fc_test.c
+gb_bssgp_fc_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gb/libosmogb.la
+
+logging_logging_test_SOURCES = logging/logging_test.c
+logging_logging_test_LDADD = $(top_builddir)/src/libosmocore.la
+
+# The `:;' works around a Bash 3.2 bug when the output is not writeable.
+$(srcdir)/package.m4: $(top_srcdir)/configure.ac
+	:;{ \
+               echo '# Signature of the current package.' && \
+               echo 'm4_define([AT_PACKAGE_NAME],' && \
+               echo '  [$(PACKAGE_NAME)])' && \
+               echo 'm4_define([AT_PACKAGE_TARNAME],' && \
+               echo '  [$(PACKAGE_TARNAME)])' && \
+               echo 'm4_define([AT_PACKAGE_VERSION],' && \
+               echo '  [$(PACKAGE_VERSION)])' && \
+               echo 'm4_define([AT_PACKAGE_STRING],' && \
+               echo '  [$(PACKAGE_STRING)])' && \
+               echo 'm4_define([AT_PACKAGE_BUGREPORT],' && \
+               echo '  [$(PACKAGE_BUGREPORT)])'; \
+               echo 'm4_define([AT_PACKAGE_URL],' && \
+               echo '  [$(PACKAGE_URL)])'; \
+             } >'$(srcdir)/package.m4'
+
+EXTRA_DIST = testsuite.at $(srcdir)/package.m4 $(TESTSUITE)		\
+             timer/timer_test.ok sms/sms_test.ok ussd/ussd_test.ok	\
+             smscb/smscb_test.ok bits/bitrev_test.ok a5/a5_test.ok	\
+             conv/conv_test.ok auth/milenage_test.ok			\
+             lapd/lapd_test.ok gsm0408/gsm0408_test.ok			\
+             gsm0808/gsm0808_test.ok gb/bssgp_fc_tests.err		\
+             gb/bssgp_fc_tests.ok gb/bssgp_fc_tests.sh			\
+             msgfile/msgfile_test.ok msgfile/msgconfig.cfg		\
+             logging/logging_test.ok logging/logging_test.err
+
+TESTSUITE = $(srcdir)/testsuite
+
+check-local: atconfig $(TESTSUITE)
+	$(SHELL) '$(TESTSUITE)' $(TESTSUITEFLAGS)
+
+installcheck-local: atconfig $(TESTSUITE)
+	$(SHELL) '$(TESTSUITE)' AUTOTEST_PATH='$(bindir)' \
+		$(TESTSUITEFLAGS)
+
+clean-local:
+	test ! -f '$(TESTSUITE)' || \
+		$(SHELL) '$(TESTSUITE)' --clean
+	$(RM) -f atconfig
+
+AUTOM4TE = $(SHELL) $(top_srcdir)/missing --run autom4te
+AUTOTEST = $(AUTOM4TE) --language=autotest
+$(TESTSUITE): $(srcdir)/testsuite.at $(srcdir)/package.m4
+	$(AUTOTEST) -I '$(srcdir)' -o $@.tmp $@.at
+	mv $@.tmp $@
diff --git a/src/shared/libosmocore/tests/a5/a5_test.c b/src/shared/libosmocore/tests/a5/a5_test.c
new file mode 100644
index 00000000..14436f19
--- /dev/null
+++ b/src/shared/libosmocore/tests/a5/a5_test.c
@@ -0,0 +1,98 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <osmocom/core/bits.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/a5.h>
+
+static const uint8_t key[] = { 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef };
+static const uint32_t fn = 123456;
+static const uint8_t dl[] = {
+	/* A5/0 */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+	/* A5/1 */
+	0xcb, 0xa2, 0x55, 0x76, 0x17, 0x5d, 0x3b, 0x1c,
+	0x7b, 0x2f, 0x29, 0xa8, 0xc1, 0xb6, 0x00,
+
+	/* A5/2 */
+	0x45, 0x9c, 0x88, 0xc3, 0x82, 0xb7, 0xff, 0xb3,
+	0x98, 0xd2, 0xf9, 0x6e, 0x0f, 0x14, 0x80,
+};
+static const uint8_t ul[] = {
+	/* A5/0 */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+	/* A5/1 */
+	0xd9, 0x03, 0x5e, 0x0f, 0x2a, 0xec, 0x13, 0x9a,
+	0x05, 0xd4, 0xa8, 0x7b, 0xb1, 0x64, 0x80,
+
+	/* A5/2 */
+	0xf0, 0x3a, 0xac, 0xde, 0xe3, 0x5b, 0x5e, 0x65,
+	0x80, 0xba, 0xab, 0xc0, 0x59, 0x26, 0x40,
+};
+
+static const char *
+binstr(ubit_t *d, int n)
+{
+	static char str[256];
+	int i;
+
+	for (i=0; i<n; i++)
+		str[i] = d[i] ? '1' : '0';
+
+	str[i] = '\0';
+
+	return str;
+}
+
+int main(int argc, char **argv)
+{
+	ubit_t exp[114];
+	ubit_t out[114];
+	int n, i;
+
+	for (n=0; n<3; n++) {
+		/* "Randomize" */
+		for (i=0; i<114; i++)
+			out[i] = i & 1;
+
+		/* DL */
+		osmo_pbit2ubit(exp, &dl[15*n], 114);
+
+		osmo_a5(n, key, fn, out, NULL);
+
+		printf("A5/%d - DL: %s", n, binstr(out, 114));
+
+		if (!memcmp(exp, out, 114))
+			printf(" => OK\n");
+		else {
+			printf(" => BAD\n");
+			printf(" Expected: %s", binstr(out, 114));
+			fprintf(stderr, "[!] A5/%d DL failed", n);
+			exit(1);
+		}
+
+		/* UL */
+		osmo_pbit2ubit(exp, &ul[15*n], 114);
+
+		osmo_a5(n, key, fn, NULL, out);
+
+		printf("A5/%d - UL: %s", n, binstr(out, 114));
+
+		if (!memcmp(exp, out, 114))
+			printf(" => OK\n");
+		else {
+			printf(" => BAD\n");
+			printf(" Expected: %s", binstr(out, 114));
+			fprintf(stderr, "[!] A5/%d UL failed", n);
+			exit(1);
+		}
+	}
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/tests/a5/a5_test.ok b/src/shared/libosmocore/tests/a5/a5_test.ok
new file mode 100644
index 00000000..4497e14a
--- /dev/null
+++ b/src/shared/libosmocore/tests/a5/a5_test.ok
@@ -0,0 +1,6 @@
+A5/0 - DL: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 => OK
+A5/0 - UL: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 => OK
+A5/1 - DL: 110010111010001001010101011101100001011101011101001110110001110001111011001011110010100110101000110000011011011000 => OK
+A5/1 - UL: 110110010000001101011110000011110010101011101100000100111001101000000101110101001010100001111011101100010110010010 => OK
+A5/2 - DL: 010001011001110010001000110000111000001010110111111111111011001110011000110100101111100101101110000011110001010010 => OK
+A5/2 - UL: 111100000011101010101100110111101110001101011011010111100110010110000000101110101010101111000000010110010010011001 => OK
diff --git a/src/shared/libosmocore/tests/auth/milenage_test.c b/src/shared/libosmocore/tests/auth/milenage_test.c
new file mode 100644
index 00000000..7c996f02
--- /dev/null
+++ b/src/shared/libosmocore/tests/auth/milenage_test.c
@@ -0,0 +1,98 @@
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+
+#include <osmocom/crypt/auth.h>
+#include <osmocom/core/utils.h>
+
+static void dump_auth_vec(struct osmo_auth_vector *vec)
+{
+	printf("RAND:\t%s\n", osmo_hexdump(vec->rand, sizeof(vec->rand)));
+
+	if (vec->auth_types & OSMO_AUTH_TYPE_UMTS) {
+		printf("AUTN:\t%s\n", osmo_hexdump(vec->autn, sizeof(vec->autn)));
+		printf("IK:\t%s\n", osmo_hexdump(vec->ik, sizeof(vec->ik)));
+		printf("CK:\t%s\n", osmo_hexdump(vec->ck, sizeof(vec->ck)));
+		printf("RES:\t%s\n", osmo_hexdump(vec->res, vec->res_len));
+	}
+
+	if (vec->auth_types & OSMO_AUTH_TYPE_GSM) {
+		printf("SRES:\t%s\n", osmo_hexdump(vec->sres, sizeof(vec->sres)));
+		printf("Kc:\t%s\n", osmo_hexdump(vec->kc, sizeof(vec->kc)));
+	}
+}
+
+static struct osmo_sub_auth_data test_aud = {
+	.type = OSMO_AUTH_TYPE_UMTS,
+	.algo = OSMO_AUTH_ALG_MILENAGE,
+	.u.umts = {
+		.opc = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
+		.k =   { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+			 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
+		.amf = { 0x00, 0x00 },
+		.sqn = 0x22,
+	},
+};
+
+static int opc_test(const struct osmo_sub_auth_data *aud)
+{
+	int rc;
+	uint8_t opc[16];
+#if 0
+	const uint8_t op[16] = { 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+				 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f };
+#else
+	const uint8_t op[16] = { 0,0,0,0,0,0,0,0, 0,0,0,0,0,0,0,0 };
+#endif
+
+	rc = milenage_opc_gen(opc, aud->u.umts.k, op);
+
+	printf("OP:\t%s\n", osmo_hexdump(op, sizeof(op)));
+	printf("OPC:\t%s\n", osmo_hexdump(opc, sizeof(opc)));
+	return rc;
+}
+
+int main(int argc, char **argv)
+{
+	struct osmo_auth_vector _vec;
+	struct osmo_auth_vector *vec = &_vec;
+	uint8_t _rand[16];
+	int rc;
+
+#if 0
+	srand(time(NULL));
+	*(uint32_t *)&_rand[0] = rand();
+	*(uint32_t *)(&_rand[4]) = rand();
+	*(uint32_t *)(&_rand[8]) = rand();
+	*(uint32_t *)(&_rand[12]) = rand();
+#else
+	memset(_rand, 0, sizeof(_rand));
+#endif
+	memset(vec, 0, sizeof(*vec));
+
+	rc = osmo_auth_gen_vec(vec, &test_aud, _rand);
+	if (rc < 0) {
+		fprintf(stderr, "error generating auth vector\n");
+		exit(1);
+	}
+
+	dump_auth_vec(vec);
+
+	const uint8_t auts[14] = { 0x87, 0x11, 0xa0, 0xec, 0x9e, 0x16, 0x37, 0xdf,
+			     0x17, 0xf8, 0x0b, 0x38, 0x4e, 0xe4 };
+
+	rc = osmo_auth_gen_vec_auts(vec, &test_aud, auts, _rand, _rand);
+	if (rc < 0) {
+		printf("AUTS failed\n");
+	} else {
+		printf("AUTS success: SEQ.MS = %lu\n", test_aud.u.umts.sqn);
+	}
+
+	opc_test(&test_aud);
+
+	exit(0);
+
+}
diff --git a/src/shared/libosmocore/tests/auth/milenage_test.ok b/src/shared/libosmocore/tests/auth/milenage_test.ok
new file mode 100644
index 00000000..00ffc222
--- /dev/null
+++ b/src/shared/libosmocore/tests/auth/milenage_test.ok
@@ -0,0 +1,10 @@
+RAND:	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
+AUTN:	ec 93 20 c2 c2 12 00 00 c8 b7 de 2a 34 49 f1 bd 
+IK:	12 cb 2d d3 e0 ec 83 78 f6 fc 1d 60 6c 61 9f 47 
+CK:	72 00 a1 84 d8 f2 c7 58 fb df 87 90 0d db f2 75 
+RES:	e9 fc 88 cc c8 a3 53 81 
+SRES:	21 5f db 4d 
+Kc:	6d e8 16 a7 59 a4 29 12 
+AUTS success: SEQ.MS = 33
+OP:	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
+OPC:	c6 a1 3b 37 87 8f 5b 82 6f 4f 81 62 a1 c8 d8 79 
diff --git a/src/shared/libosmocore/tests/bits/bitrev_test.c b/src/shared/libosmocore/tests/bits/bitrev_test.c
new file mode 100644
index 00000000..5eca990a
--- /dev/null
+++ b/src/shared/libosmocore/tests/bits/bitrev_test.c
@@ -0,0 +1,36 @@
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/bits.h>
+
+static const uint8_t input[] = { 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80 };
+static const uint8_t exp_out[] = { 0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01 };
+
+int main(int argc, char **argv)
+{
+	uint8_t out[ARRAY_SIZE(input)];
+	unsigned int offs;
+
+	for (offs = 0; offs < sizeof(out); offs++) {
+		uint8_t *start = out + offs;
+		uint8_t len = sizeof(out) - offs;
+
+		memcpy(out, input, sizeof(out));
+
+		printf("INORDER:  %s\n", osmo_hexdump(start, len));
+		osmo_revbytebits_buf(start, len);
+		printf("REVERSED: %s\n", osmo_hexdump(start, len));
+		if (memcmp(start, exp_out + offs, len)) {
+			printf("EXPECTED: %s\n", osmo_hexdump(exp_out+offs, len));
+			fprintf(stderr, "REVERSED != EXPECTED!\n");
+			exit(1);
+		}
+		printf("\n");
+	}
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/tests/bits/bitrev_test.ok b/src/shared/libosmocore/tests/bits/bitrev_test.ok
new file mode 100644
index 00000000..47f402f4
--- /dev/null
+++ b/src/shared/libosmocore/tests/bits/bitrev_test.ok
@@ -0,0 +1,24 @@
+INORDER:  01 02 04 08 10 20 40 80 
+REVERSED: 80 40 20 10 08 04 02 01 
+
+INORDER:  02 04 08 10 20 40 80 
+REVERSED: 40 20 10 08 04 02 01 
+
+INORDER:  04 08 10 20 40 80 
+REVERSED: 20 10 08 04 02 01 
+
+INORDER:  08 10 20 40 80 
+REVERSED: 10 08 04 02 01 
+
+INORDER:  10 20 40 80 
+REVERSED: 08 04 02 01 
+
+INORDER:  20 40 80 
+REVERSED: 04 02 01 
+
+INORDER:  40 80 
+REVERSED: 02 01 
+
+INORDER:  80 
+REVERSED: 01 
+
diff --git a/src/shared/libosmocore/tests/conv/conv_test.c b/src/shared/libosmocore/tests/conv/conv_test.c
new file mode 100644
index 00000000..54e043e9
--- /dev/null
+++ b/src/shared/libosmocore/tests/conv/conv_test.c
@@ -0,0 +1,486 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+
+#include <osmocom/core/bits.h>
+#include <osmocom/core/conv.h>
+#include <osmocom/core/utils.h>
+
+#define MAX_LEN_BITS	512
+#define MAX_LEN_BYTES	(512/8)
+
+
+/* ------------------------------------------------------------------------ */
+/* Test codes                                                               */
+/* ------------------------------------------------------------------------ */
+
+/* GSM xCCH -> Non-recursive code, flushed, not punctured */
+static const uint8_t conv_gsm_xcch_next_output[][2] = {
+	{ 0, 3 }, { 1, 2 }, { 0, 3 }, { 1, 2 },
+	{ 3, 0 }, { 2, 1 }, { 3, 0 }, { 2, 1 },
+	{ 3, 0 }, { 2, 1 }, { 3, 0 }, { 2, 1 },
+	{ 0, 3 }, { 1, 2 }, { 0, 3 }, { 1, 2 },
+};
+
+static const uint8_t conv_gsm_xcch_next_state[][2] = {
+	{  0,  1 }, {  2,  3 }, {  4,  5 }, {  6,  7 },
+	{  8,  9 }, { 10, 11 }, { 12, 13 }, { 14, 15 },
+	{  0,  1 }, {  2,  3 }, {  4,  5 }, {  6,  7 },
+	{  8,  9 }, { 10, 11 }, { 12, 13 }, { 14, 15 },
+};
+
+static const struct osmo_conv_code conv_gsm_xcch = {
+	.N = 2,
+	.K = 5,
+	.len = 224,
+	.term = CONV_TERM_FLUSH,
+	.next_output = conv_gsm_xcch_next_output,
+	.next_state  = conv_gsm_xcch_next_state,
+};
+
+
+/* GSM TCH/AFS 7.95 -> Recursive code, flushed, with puncturing */
+static const uint8_t conv_gsm_tch_afs_7_95_next_output[][2] = {
+	{ 0, 7 }, { 3, 4 }, { 2, 5 }, { 1, 6 },
+	{ 2, 5 }, { 1, 6 }, { 0, 7 }, { 3, 4 },
+	{ 3, 4 }, { 0, 7 }, { 1, 6 }, { 2, 5 },
+	{ 1, 6 }, { 2, 5 }, { 3, 4 }, { 0, 7 },
+	{ 3, 4 }, { 0, 7 }, { 1, 6 }, { 2, 5 },
+	{ 1, 6 }, { 2, 5 }, { 3, 4 }, { 0, 7 },
+	{ 0, 7 }, { 3, 4 }, { 2, 5 }, { 1, 6 },
+	{ 2, 5 }, { 1, 6 }, { 0, 7 }, { 3, 4 },
+	{ 0, 7 }, { 3, 4 }, { 2, 5 }, { 1, 6 },
+	{ 2, 5 }, { 1, 6 }, { 0, 7 }, { 3, 4 },
+	{ 3, 4 }, { 0, 7 }, { 1, 6 }, { 2, 5 },
+	{ 1, 6 }, { 2, 5 }, { 3, 4 }, { 0, 7 },
+	{ 3, 4 }, { 0, 7 }, { 1, 6 }, { 2, 5 },
+	{ 1, 6 }, { 2, 5 }, { 3, 4 }, { 0, 7 },
+	{ 0, 7 }, { 3, 4 }, { 2, 5 }, { 1, 6 },
+	{ 2, 5 }, { 1, 6 }, { 0, 7 }, { 3, 4 },
+};
+
+static const uint8_t conv_gsm_tch_afs_7_95_next_state[][2] = {
+	{  0,  1 }, {  2,  3 }, {  5,  4 }, {  7,  6 },
+	{  9,  8 }, { 11, 10 }, { 12, 13 }, { 14, 15 },
+	{ 16, 17 }, { 18, 19 }, { 21, 20 }, { 23, 22 },
+	{ 25, 24 }, { 27, 26 }, { 28, 29 }, { 30, 31 },
+	{ 33, 32 }, { 35, 34 }, { 36, 37 }, { 38, 39 },
+	{ 40, 41 }, { 42, 43 }, { 45, 44 }, { 47, 46 },
+	{ 49, 48 }, { 51, 50 }, { 52, 53 }, { 54, 55 },
+	{ 56, 57 }, { 58, 59 }, { 61, 60 }, { 63, 62 },
+	{  1,  0 }, {  3,  2 }, {  4,  5 }, {  6,  7 },
+	{  8,  9 }, { 10, 11 }, { 13, 12 }, { 15, 14 },
+	{ 17, 16 }, { 19, 18 }, { 20, 21 }, { 22, 23 },
+	{ 24, 25 }, { 26, 27 }, { 29, 28 }, { 31, 30 },
+	{ 32, 33 }, { 34, 35 }, { 37, 36 }, { 39, 38 },
+	{ 41, 40 }, { 43, 42 }, { 44, 45 }, { 46, 47 },
+	{ 48, 49 }, { 50, 51 }, { 53, 52 }, { 55, 54 },
+	{ 57, 56 }, { 59, 58 }, { 60, 61 }, { 62, 63 },
+};
+
+static const uint8_t conv_gsm_tch_afs_7_95_next_term_output[] = {
+	 0,  3,  5,  6,  5,  6,  0,  3,  3,  0,  6,  5,  6,  5,  3,  0,
+	 4,  7,  1,  2,  1,  2,  4,  7,  7,  4,  2,  1,  2,  1,  7,  4,
+	 7,  4,  2,  1,  2,  1,  7,  4,  4,  7,  1,  2,  1,  2,  4,  7,
+	 3,  0,  6,  5,  6,  5,  3,  0,  0,  3,  5,  6,  5,  6,  0,  3,
+};
+
+static const uint8_t conv_gsm_tch_afs_7_95_next_term_state[] = {
+	 0,  2,  4,  6,  8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30,
+	32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62,
+	 0,  2,  4,  6,  8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30,
+	32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62,
+};
+
+static int conv_gsm_tch_afs_7_95_puncture[] = {
+	  1,   2,   4,   5,   8,  22,  70, 118, 166, 214, 262, 310,
+	317, 319, 325, 332, 334, 341, 343, 349, 356, 358, 365, 367,
+	373, 380, 382, 385, 389, 391, 397, 404, 406, 409, 413, 415,
+	421, 428, 430, 433, 437, 439, 445, 452, 454, 457, 461, 463,
+	469, 476, 478, 481, 485, 487, 490, 493, 500, 502, 503, 505,
+	506, 508, 509, 511, 512,
+	-1, /* end */
+};
+
+static const struct osmo_conv_code conv_gsm_tch_afs_7_95 = {
+	.N = 3,
+	.K = 7,
+	.len = 165,
+	.term = CONV_TERM_FLUSH,
+	.next_output      = conv_gsm_tch_afs_7_95_next_output,
+	.next_state       = conv_gsm_tch_afs_7_95_next_state,
+	.next_term_output = conv_gsm_tch_afs_7_95_next_term_output,
+	.next_term_state  = conv_gsm_tch_afs_7_95_next_term_state,
+	.puncture         = conv_gsm_tch_afs_7_95_puncture,
+};
+
+
+/* GMR-1 TCH3 Speech -> Non recursive code, tail-biting, punctured */
+static const uint8_t conv_gmr1_tch3_speech_next_output[][2] = {
+	{  0,  3 }, {  1,  2 }, {  3,  0 }, {  2,  1 },
+	{  3,  0 }, {  2,  1 }, {  0,  3 }, {  1,  2 },
+	{  0,  3 }, {  1,  2 }, {  3,  0 }, {  2,  1 },
+	{  3,  0 }, {  2,  1 }, {  0,  3 }, {  1,  2 },
+	{  2,  1 }, {  3,  0 }, {  1,  2 }, {  0,  3 },
+	{  1,  2 }, {  0,  3 }, {  2,  1 }, {  3,  0 },
+	{  2,  1 }, {  3,  0 }, {  1,  2 }, {  0,  3 },
+	{  1,  2 }, {  0,  3 }, {  2,  1 }, {  3,  0 },
+	{  3,  0 }, {  2,  1 }, {  0,  3 }, {  1,  2 },
+	{  0,  3 }, {  1,  2 }, {  3,  0 }, {  2,  1 },
+	{  3,  0 }, {  2,  1 }, {  0,  3 }, {  1,  2 },
+	{  0,  3 }, {  1,  2 }, {  3,  0 }, {  2,  1 },
+	{  1,  2 }, {  0,  3 }, {  2,  1 }, {  3,  0 },
+	{  2,  1 }, {  3,  0 }, {  1,  2 }, {  0,  3 },
+	{  1,  2 }, {  0,  3 }, {  2,  1 }, {  3,  0 },
+	{  2,  1 }, {  3,  0 }, {  1,  2 }, {  0,  3 },
+};
+
+static const uint8_t conv_gmr1_tch3_speech_next_state[][2] = {
+	{  0,  1 }, {  2,  3 }, {  4,  5 }, {  6,  7 },
+	{  8,  9 }, { 10, 11 }, { 12, 13 }, { 14, 15 },
+	{ 16, 17 }, { 18, 19 }, { 20, 21 }, { 22, 23 },
+	{ 24, 25 }, { 26, 27 }, { 28, 29 }, { 30, 31 },
+	{ 32, 33 }, { 34, 35 }, { 36, 37 }, { 38, 39 },
+	{ 40, 41 }, { 42, 43 }, { 44, 45 }, { 46, 47 },
+	{ 48, 49 }, { 50, 51 }, { 52, 53 }, { 54, 55 },
+	{ 56, 57 }, { 58, 59 }, { 60, 61 }, { 62, 63 },
+	{  0,  1 }, {  2,  3 }, {  4,  5 }, {  6,  7 },
+	{  8,  9 }, { 10, 11 }, { 12, 13 }, { 14, 15 },
+	{ 16, 17 }, { 18, 19 }, { 20, 21 }, { 22, 23 },
+	{ 24, 25 }, { 26, 27 }, { 28, 29 }, { 30, 31 },
+	{ 32, 33 }, { 34, 35 }, { 36, 37 }, { 38, 39 },
+	{ 40, 41 }, { 42, 43 }, { 44, 45 }, { 46, 47 },
+	{ 48, 49 }, { 50, 51 }, { 52, 53 }, { 54, 55 },
+	{ 56, 57 }, { 58, 59 }, { 60, 61 }, { 62, 63 },
+};
+
+static const int conv_gmr1_tch3_speech_puncture[] = {
+	 3,  7, 11, 15, 19, 23, 27, 31, 35, 39, 43, 47,
+	51, 55, 59, 63, 67, 71, 75, 79, 83, 87, 91, 95,
+	-1, /* end */
+};
+
+static const struct osmo_conv_code conv_gmr1_tch3_speech = {
+	.N = 2,
+	.K = 7,
+	.len = 48,
+	.term = CONV_TERM_TAIL_BITING,
+	.next_output = conv_gmr1_tch3_speech_next_output,
+	.next_state  = conv_gmr1_tch3_speech_next_state,
+	.puncture = conv_gmr1_tch3_speech_puncture,
+};
+
+
+/* WiMax FCH -> Non recursive code, tail-biting, non-punctured */
+static const uint8_t conv_wimax_fch_next_output[][2] = {
+	{  0,  3 }, {  2,  1 }, {  3,  0 }, {  1,  2 },
+	{  3,  0 }, {  1,  2 }, {  0,  3 }, {  2,  1 },
+	{  0,  3 }, {  2,  1 }, {  3,  0 }, {  1,  2 },
+	{  3,  0 }, {  1,  2 }, {  0,  3 }, {  2,  1 },
+	{  1,  2 }, {  3,  0 }, {  2,  1 }, {  0,  3 },
+	{  2,  1 }, {  0,  3 }, {  1,  2 }, {  3,  0 },
+	{  1,  2 }, {  3,  0 }, {  2,  1 }, {  0,  3 },
+	{  2,  1 }, {  0,  3 }, {  1,  2 }, {  3,  0 },
+	{  3,  0 }, {  1,  2 }, {  0,  3 }, {  2,  1 },
+	{  0,  3 }, {  2,  1 }, {  3,  0 }, {  1,  2 },
+	{  3,  0 }, {  1,  2 }, {  0,  3 }, {  2,  1 },
+	{  0,  3 }, {  2,  1 }, {  3,  0 }, {  1,  2 },
+	{  2,  1 }, {  0,  3 }, {  1,  2 }, {  3,  0 },
+	{  1,  2 }, {  3,  0 }, {  2,  1 }, {  0,  3 },
+	{  2,  1 }, {  0,  3 }, {  1,  2 }, {  3,  0 },
+	{  1,  2 }, {  3,  0 }, {  2,  1 }, {  0,  3 },
+};
+
+static const uint8_t conv_wimax_fch_next_state[][2] = {
+	{  0,  1 }, {  2,  3 }, {  4,  5 }, {  6,  7 },
+	{  8,  9 }, { 10, 11 }, { 12, 13 }, { 14, 15 },
+	{ 16, 17 }, { 18, 19 }, { 20, 21 }, { 22, 23 },
+	{ 24, 25 }, { 26, 27 }, { 28, 29 }, { 30, 31 },
+	{ 32, 33 }, { 34, 35 }, { 36, 37 }, { 38, 39 },
+	{ 40, 41 }, { 42, 43 }, { 44, 45 }, { 46, 47 },
+	{ 48, 49 }, { 50, 51 }, { 52, 53 }, { 54, 55 },
+	{ 56, 57 }, { 58, 59 }, { 60, 61 }, { 62, 63 },
+	{  0,  1 }, {  2,  3 }, {  4,  5 }, {  6,  7 },
+	{  8,  9 }, { 10, 11 }, { 12, 13 }, { 14, 15 },
+	{ 16, 17 }, { 18, 19 }, { 20, 21 }, { 22, 23 },
+	{ 24, 25 }, { 26, 27 }, { 28, 29 }, { 30, 31 },
+	{ 32, 33 }, { 34, 35 }, { 36, 37 }, { 38, 39 },
+	{ 40, 41 }, { 42, 43 }, { 44, 45 }, { 46, 47 },
+	{ 48, 49 }, { 50, 51 }, { 52, 53 }, { 54, 55 },
+	{ 56, 57 }, { 58, 59 }, { 60, 61 }, { 62, 63 },
+};
+
+static const struct osmo_conv_code conv_wimax_fch = {
+	.N = 2,
+	.K = 7,
+	.len = 48,
+	.term = CONV_TERM_TAIL_BITING,
+	.next_output = conv_wimax_fch_next_output,
+	.next_state  = conv_wimax_fch_next_state,
+};
+
+
+/* Random code -> Non recursive code, direct truncation, non-punctured */
+static const struct osmo_conv_code conv_trunc = {
+	.N = 2,
+	.K = 5,
+	.len = 224,
+	.term = CONV_TERM_TRUNCATION,
+	.next_output = conv_gsm_xcch_next_output,
+	.next_state  = conv_gsm_xcch_next_state,
+};
+
+
+/* ------------------------------------------------------------------------ */
+/* Test vectors                                                             */
+/* ------------------------------------------------------------------------ */
+
+struct conv_test_vector {
+	const char *name;
+	const struct osmo_conv_code *code;
+	int in_len;
+	int out_len;
+	int has_vec;
+	pbit_t vec_in[MAX_LEN_BYTES];
+	pbit_t vec_out[MAX_LEN_BYTES];
+};
+
+static const struct conv_test_vector tests[] = {
+	{
+		.name = "GSM xCCH (non-recursive, flushed, not punctured)",
+		.code = &conv_gsm_xcch,
+		.in_len  = 224,
+		.out_len = 456,
+		.has_vec = 1,
+		.vec_in  = { 0xf3, 0x1d, 0xb4, 0x0c, 0x4d, 0x1d, 0x9d, 0xae,
+		             0xc0, 0x0a, 0x42, 0x57, 0x13, 0x60, 0x80, 0x96,
+		             0xef, 0x23, 0x7e, 0x4c, 0x1d, 0x96, 0x24, 0x19,
+		             0x17, 0xf2, 0x44, 0x99 },
+		.vec_out = { 0xe9, 0x4d, 0x70, 0xab, 0xa2, 0x87, 0xf0, 0xe7,
+		             0x04, 0x14, 0x7c, 0xab, 0xaf, 0x6b, 0xa1, 0x16,
+		             0xeb, 0x30, 0x00, 0xde, 0xc8, 0xfd, 0x0b, 0x85,
+		             0x80, 0x41, 0x4a, 0xcc, 0xd3, 0xc0, 0xd0, 0xb6,
+		             0x26, 0xe5, 0x4e, 0x32, 0x49, 0x69, 0x38, 0x17,
+		             0x33, 0xab, 0xaf, 0xb6, 0xc1, 0x08, 0xf3, 0x9f,
+		             0x8c, 0x75, 0x6a, 0x4e, 0x08, 0xc4, 0x20, 0x5f,
+		             0x8f },
+	},
+	{
+		.name = "GSM TCH/AFS 7.95 (recursive, flushed, punctured)",
+		.code = &conv_gsm_tch_afs_7_95,
+		.in_len  = 165,
+		.out_len = 448,
+		.has_vec = 1,
+		.vec_in  = { 0x87, 0x66, 0xc3, 0x58, 0x09, 0xd4, 0x06, 0x59,
+		             0x10, 0xbf, 0x6b, 0x7f, 0xc8, 0xed, 0x72, 0xaa,
+		             0xc1, 0x3d, 0xf3, 0x1e, 0xb0 },
+		.vec_out = { 0x92, 0xbc, 0xde, 0xa0, 0xde, 0xbe, 0x01, 0x2f,
+		             0xbe, 0xe4, 0x61, 0x32, 0x4d, 0x4f, 0xdc, 0x41,
+		             0x43, 0x0d, 0x15, 0xe0, 0x23, 0xdd, 0x18, 0x91,
+		             0xe5, 0x36, 0x2d, 0xb7, 0xd9, 0x78, 0xb8, 0xb1,
+		             0xb7, 0xcb, 0x2f, 0xc0, 0x52, 0x8f, 0xe2, 0x8c,
+		             0x6f, 0xa6, 0x79, 0x88, 0xed, 0x0c, 0x2e, 0x9e,
+		             0xa1, 0x5f, 0x45, 0x4a, 0xfb, 0xe6, 0x5a, 0x9c },
+	},
+	{
+		.name = "GMR-1 TCH3 Speech (non-recursive, tail-biting, punctured)",
+		.code = &conv_gmr1_tch3_speech,
+		.in_len  = 48,
+		.out_len = 72,
+		.has_vec = 1,
+		.vec_in  = { 0x4d, 0xcb, 0xfc, 0x72, 0xf4, 0x8c },
+		.vec_out = { 0xc0, 0x86, 0x63, 0x4b, 0x8b, 0xd4, 0x6a, 0x76, 0xb2 },
+	},
+	{
+		.name = "WiMax FCH (non-recursive, tail-biting, not punctured)",
+		.code = &conv_wimax_fch,
+		.in_len  = 48,
+		.out_len = 96,
+		.has_vec = 1,
+		.vec_in  = { 0xfc, 0xa0, 0xa0, 0xfc, 0xa0, 0xa0 },
+		.vec_out = { 0x19, 0x42, 0x8a, 0xed, 0x21, 0xed, 0x19, 0x42,
+		             0x8a, 0xed, 0x21, 0xed },
+	},
+	{
+		.name = "??? (non-recursive, direct truncation, not punctured)",
+		.code = &conv_trunc,
+		.in_len  = 224,
+		.out_len = 448,
+		.has_vec = 1,
+		.vec_in  = { 0xe5, 0xe0, 0x85, 0x7e, 0xf7, 0x08, 0x19, 0x5a,
+		             0xb9, 0xad, 0x82, 0x37, 0x98, 0x8b, 0x26, 0xb9,
+		             0x81, 0x26, 0x9c, 0x75, 0xaf, 0xf3, 0xcb, 0x07,
+		             0xac, 0x63, 0xe2, 0x9c,
+		},
+		.vec_out = { 0xea, 0x3b, 0x55, 0x0c, 0xd3, 0xf7, 0x85, 0x69,
+		             0xe5, 0x79, 0x83, 0xd3, 0xc3, 0x9f, 0xb8, 0x61,
+		             0x21, 0x63, 0x51, 0x18, 0xac, 0xcd, 0x32, 0x49,
+		             0x53, 0x5c, 0x13, 0x1d, 0xbe, 0x05, 0x11, 0x63,
+		             0x5c, 0xc3, 0x42, 0x05, 0x1c, 0x68, 0x0a, 0xb4,
+		             0x61, 0x15, 0xaa, 0x4d, 0x94, 0xed, 0xb3, 0x3a,
+		             0x5d, 0x1b, 0x09, 0xc2, 0x99, 0x01, 0xec, 0x68 },
+	},
+	{ /* end */ },
+};
+
+
+
+
+/* ------------------------------------------------------------------------ */
+/* Main                                                                     */
+/* ------------------------------------------------------------------------ */
+
+static void
+fill_random(ubit_t *b, int n)
+{
+	int i;
+	for (i=0; i<n; i++)
+		b[i] = random() & 1;
+}
+
+static void
+ubit_to_sbit(sbit_t *dst, ubit_t *src, int n)
+{
+	int i;
+	for (i=0; i<n; i++)
+		dst[i] = src[i] ? -127 : 127;
+}
+
+static void
+sbit_to_ubit(ubit_t *dst, sbit_t *src, int n)
+{
+	int i;
+	for (i=0; i<n; i++)
+		dst[i] = src[i] < 0;
+}
+
+
+int main(int argc, char argv[])
+{
+	const struct conv_test_vector *tst;
+	ubit_t *bu0, *bu1;
+	sbit_t *bs;
+
+	srandom(time(NULL));
+
+	bu0 = malloc(sizeof(ubit_t) * MAX_LEN_BITS);
+	bu1 = malloc(sizeof(ubit_t) * MAX_LEN_BITS);
+	bs  = malloc(sizeof(sbit_t) * MAX_LEN_BITS);
+
+	for (tst=tests; tst->name; tst++)
+	{
+		int i,l;
+
+		/* Test name */
+		printf("[+] Testing: %s\n", tst->name);
+
+		/* Check length */
+		l = osmo_conv_get_input_length(tst->code, 0);
+		printf("[.] Input length  : ret = %3d  exp = %3d -> %s\n",
+			l, tst->in_len, l == tst->in_len ? "OK" : "Bad !");
+
+		if (l != tst->in_len) {
+			fprintf(stderr, "[!] Failure for input length computation\n");
+			return -1;
+		}
+
+		l = osmo_conv_get_output_length(tst->code, 0);
+		printf("[.] Output length : ret = %3d  exp = %3d -> %s\n",
+			l, tst->out_len, l == tst->out_len ? "OK" : "Bad !");
+
+		if (l != tst->out_len) {
+			fprintf(stderr, "[!] Failure for output length computation\n");
+			return -1;
+		}
+
+		/* Check pre-computed vector */
+		if (tst->has_vec) {
+			printf("[.] Pre computed vector checks:\n");
+
+			printf("[..] Encoding: ");
+
+			osmo_pbit2ubit(bu0, tst->vec_in, tst->in_len);
+
+			l = osmo_conv_encode(tst->code, bu0, bu1);
+			if (l != tst->out_len) {
+				printf("ERROR !\n");
+				fprintf(stderr, "[!] Failed encoding length check\n");
+				return -1;
+			}
+
+			osmo_pbit2ubit(bu0, tst->vec_out, tst->out_len);
+
+			if (memcmp(bu0, bu1, tst->out_len)) {
+				printf("ERROR !\n");
+				fprintf(stderr, "[!] Failed encoding: Results don't match\n");
+				return -1;
+			};
+
+			printf("OK\n");
+
+
+			printf("[..] Decoding: ");
+
+			ubit_to_sbit(bs, bu0, l);
+
+			l = osmo_conv_decode(tst->code, bs, bu1);
+			if (l != 0) {
+				printf("ERROR !\n");
+				fprintf(stderr, "[!] Failed decoding: non-zero path (%d)\n", l);
+				return -1;
+			}
+
+			osmo_pbit2ubit(bu0, tst->vec_in, tst->in_len);
+
+			if (memcmp(bu0, bu1, tst->in_len)) {
+				printf("ERROR !\n");
+				fprintf(stderr, "[!] Failed decoding: Results don't match\n");
+				return -1;
+			}
+
+			printf("OK\n");
+		}
+
+		/* Check random vector */
+		printf("[.] Random vector checks:\n");
+
+		for (i=0; i<3; i++) {
+			printf("[..] Encoding / Decoding cycle : ");
+
+			fill_random(bu0, tst->in_len);
+
+			l = osmo_conv_encode(tst->code, bu0, bu1);
+			if (l != tst->out_len) {
+				printf("ERROR !\n");
+				fprintf(stderr, "[!] Failed encoding length check\n");
+				return -1;
+			}
+
+			ubit_to_sbit(bs, bu1, l);
+
+			l = osmo_conv_decode(tst->code, bs, bu1);
+			if (l != 0) {
+				printf("ERROR !\n");
+				fprintf(stderr, "[!] Failed decoding: non-zero path (%d)\n", l);
+				return -1;
+			}
+
+			if (memcmp(bu0, bu1, tst->in_len)) {
+				printf("ERROR !\n");
+				fprintf(stderr, "[!] Failed decoding: Results don't match\n");
+				return -1;
+			}
+
+			printf("OK\n");
+		}
+
+		/* Spacing */
+		printf("\n");
+	}
+
+	free(bs);
+	free(bu1);
+	free(bu0);
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/tests/conv/conv_test.ok b/src/shared/libosmocore/tests/conv/conv_test.ok
new file mode 100644
index 00000000..21229619
--- /dev/null
+++ b/src/shared/libosmocore/tests/conv/conv_test.ok
@@ -0,0 +1,55 @@
+[+] Testing: GSM xCCH (non-recursive, flushed, not punctured)
+[.] Input length  : ret = 224  exp = 224 -> OK
+[.] Output length : ret = 456  exp = 456 -> OK
+[.] Pre computed vector checks:
+[..] Encoding: OK
+[..] Decoding: OK
+[.] Random vector checks:
+[..] Encoding / Decoding cycle : OK
+[..] Encoding / Decoding cycle : OK
+[..] Encoding / Decoding cycle : OK
+
+[+] Testing: GSM TCH/AFS 7.95 (recursive, flushed, punctured)
+[.] Input length  : ret = 165  exp = 165 -> OK
+[.] Output length : ret = 448  exp = 448 -> OK
+[.] Pre computed vector checks:
+[..] Encoding: OK
+[..] Decoding: OK
+[.] Random vector checks:
+[..] Encoding / Decoding cycle : OK
+[..] Encoding / Decoding cycle : OK
+[..] Encoding / Decoding cycle : OK
+
+[+] Testing: GMR-1 TCH3 Speech (non-recursive, tail-biting, punctured)
+[.] Input length  : ret =  48  exp =  48 -> OK
+[.] Output length : ret =  72  exp =  72 -> OK
+[.] Pre computed vector checks:
+[..] Encoding: OK
+[..] Decoding: OK
+[.] Random vector checks:
+[..] Encoding / Decoding cycle : OK
+[..] Encoding / Decoding cycle : OK
+[..] Encoding / Decoding cycle : OK
+
+[+] Testing: WiMax FCH (non-recursive, tail-biting, not punctured)
+[.] Input length  : ret =  48  exp =  48 -> OK
+[.] Output length : ret =  96  exp =  96 -> OK
+[.] Pre computed vector checks:
+[..] Encoding: OK
+[..] Decoding: OK
+[.] Random vector checks:
+[..] Encoding / Decoding cycle : OK
+[..] Encoding / Decoding cycle : OK
+[..] Encoding / Decoding cycle : OK
+
+[+] Testing: ??? (non-recursive, direct truncation, not punctured)
+[.] Input length  : ret = 224  exp = 224 -> OK
+[.] Output length : ret = 448  exp = 448 -> OK
+[.] Pre computed vector checks:
+[..] Encoding: OK
+[..] Decoding: OK
+[.] Random vector checks:
+[..] Encoding / Decoding cycle : OK
+[..] Encoding / Decoding cycle : OK
+[..] Encoding / Decoding cycle : OK
+
diff --git a/src/shared/libosmocore/tests/gb/bssgp_fc_test.c b/src/shared/libosmocore/tests/gb/bssgp_fc_test.c
new file mode 100644
index 00000000..f74be300
--- /dev/null
+++ b/src/shared/libosmocore/tests/gb/bssgp_fc_test.c
@@ -0,0 +1,170 @@
+/* test routines for BSSGP flow control implementation in libosmogb
+ * (C) 2012 by Harald Welte <laforge@gnumonks.org>
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <getopt.h>
+
+#include <osmocom/core/application.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/gprs/gprs_bssgp.h>
+
+static unsigned long in_ctr = 1;
+static struct timeval tv_start;
+
+int get_centisec_diff(void)
+{
+	struct timeval tv;
+	struct timeval now;
+	gettimeofday(&now, NULL);
+
+	timersub(&now, &tv_start, &tv);
+
+	return tv.tv_sec * 100 + tv.tv_usec/10000;
+}
+
+/* round to deciseconds to make sure test output is always consistent */
+int round_decisec(int csec_in)
+{
+	int tmp = csec_in / 10;
+
+	return tmp * 10;
+}
+
+static int fc_out_cb(struct bssgp_flow_control *fc, struct msgb *msg,
+		     uint32_t llc_pdu_len, void *priv)
+{
+	unsigned int csecs = get_centisec_diff();
+	csecs = round_decisec(csecs);
+
+	printf("%u: FC OUT Nr %lu\n", csecs, (unsigned long) msg);
+}
+
+static int fc_in(struct bssgp_flow_control *fc, unsigned int pdu_len)
+{
+	unsigned int csecs = get_centisec_diff();
+	csecs = round_decisec(csecs);
+
+	printf("%u: FC IN Nr %lu\n", csecs, in_ctr);
+	bssgp_fc_in(fc, (struct msgb *) in_ctr, pdu_len, NULL);
+	in_ctr++;
+}
+
+
+static void test_fc(uint32_t bucket_size_max, uint32_t bucket_leak_rate,
+		    uint32_t max_queue_depth, uint32_t pdu_len,
+		    uint32_t pdu_count)
+{
+	struct bssgp_flow_control *fc = talloc_zero(NULL, struct bssgp_flow_control);
+	int i;
+
+	bssgp_fc_init(fc, bucket_size_max, bucket_leak_rate, max_queue_depth,
+		      fc_out_cb);
+
+	gettimeofday(&tv_start, NULL);
+
+	for (i = 0; i < pdu_count; i++) {
+		fc_in(fc, pdu_len);
+		osmo_timers_check();
+		osmo_timers_prepare();
+		osmo_timers_update();
+	}
+
+	while (1) {
+		usleep(100000);
+		osmo_timers_check();
+		osmo_timers_prepare();
+		osmo_timers_update();
+
+		if (llist_empty(&fc->queue))
+			break;
+	}
+}
+
+static void help(void)
+{
+	printf(" -h --help                This help message\n");
+	printf(" -s --bucket-size-max N   Maximum size of bucket in octets\n");
+	printf(" -r --bucket-leak-rate N  Bucket leak rate in octets/sec\n");
+	printf(" -d --max-queue-depth N   Maximum length of pending PDU queue (msgs)\n");
+	printf(" -l --pdu-length N        Length of each PDU in octets\n");
+}
+
+int bssgp_prim_cb(struct osmo_prim_hdr *oph, void *ctx)
+{
+	return -1;
+}
+
+static struct log_info info = {};
+
+int main(int argc, char **argv)
+{
+	uint32_t bucket_size_max = 100;	/* octets */
+	uint32_t bucket_leak_rate = 100; /* octets / second */
+	uint32_t max_queue_depth = 5; /* messages */
+	uint32_t pdu_length = 10; /* octets */
+	uint32_t pdu_count = 20; /* messages */
+	int c;
+
+	static const struct option long_options[] = {
+		{ "bucket-size-max", 1, 0, 's' },
+		{ "bucket-leak-rate", 1, 0, 'r' },
+		{ "max-queue-depth", 1, 0, 'd' },
+		{ "pdu-length", 1, 0, 'l' },
+		{ "pdu-count", 1, 0, 'c' },
+		{ "help", 0, 0, 'h' },
+		{ 0, 0, 0, 0 }
+	};
+
+	osmo_init_logging(&info);
+	log_set_use_color(osmo_stderr_target, 0);
+	log_set_print_filename(osmo_stderr_target, 0);
+
+	while ((c = getopt_long(argc, argv, "s:r:d:l:c:",
+				long_options, NULL)) != -1) {
+		switch (c) {
+		case 's':
+			bucket_size_max = atoi(optarg);
+			break;
+		case 'r':
+			bucket_leak_rate = atoi(optarg);
+			break;
+		case 'd':
+			max_queue_depth = atoi(optarg);
+			break;
+		case 'l':
+			pdu_length = atoi(optarg);
+			break;
+		case 'c':
+			pdu_count = atoi(optarg);
+			break;
+		case 'h':
+			help();
+			exit(EXIT_SUCCESS);
+			break;
+		default:
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	/* bucket leak rate less than 100 not supported! */
+	if (bucket_leak_rate < 100) {
+		fprintf(stderr, "Bucket leak rate < 100 not supported!\n");
+		exit(EXIT_FAILURE);
+	}
+
+	printf("===== BSSGP flow-control test START\n");
+	printf("size-max=%u oct, leak-rate=%u oct/s, "
+		"queue-len=%u msgs, pdu_len=%u oct, pdu_cnt=%u\n\n", bucket_size_max,
+		bucket_leak_rate, max_queue_depth, pdu_length, pdu_count);
+	test_fc(bucket_size_max, bucket_leak_rate, max_queue_depth,
+		pdu_length, pdu_count);
+	printf("===== BSSGP flow-control test END\n\n");
+
+	exit(EXIT_SUCCESS);
+}
diff --git a/src/shared/libosmocore/tests/gb/bssgp_fc_tests.err b/src/shared/libosmocore/tests/gb/bssgp_fc_tests.err
new file mode 100644
index 00000000..2f285af8
--- /dev/null
+++ b/src/shared/libosmocore/tests/gb/bssgp_fc_tests.err
@@ -0,0 +1,50 @@
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+Single PDU (size=1000) is larger than maximum bucket size (100)!
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
+BSSGP-FC: fc_timer_cb() but still not able to send PDU of 10 bytes
diff --git a/src/shared/libosmocore/tests/gb/bssgp_fc_tests.ok b/src/shared/libosmocore/tests/gb/bssgp_fc_tests.ok
new file mode 100644
index 00000000..fda96f30
--- /dev/null
+++ b/src/shared/libosmocore/tests/gb/bssgp_fc_tests.ok
@@ -0,0 +1,150 @@
+===== BSSGP flow-control test START
+size-max=100 oct, leak-rate=100 oct/s, queue-len=5 msgs, pdu_len=10 oct, pdu_cnt=20
+
+0: FC IN Nr 1
+0: FC OUT Nr 1
+0: FC IN Nr 2
+0: FC OUT Nr 2
+0: FC IN Nr 3
+0: FC OUT Nr 3
+0: FC IN Nr 4
+0: FC OUT Nr 4
+0: FC IN Nr 5
+0: FC OUT Nr 5
+0: FC IN Nr 6
+0: FC OUT Nr 6
+0: FC IN Nr 7
+0: FC OUT Nr 7
+0: FC IN Nr 8
+0: FC OUT Nr 8
+0: FC IN Nr 9
+0: FC OUT Nr 9
+0: FC IN Nr 10
+0: FC OUT Nr 10
+0: FC IN Nr 11
+0: FC IN Nr 12
+0: FC IN Nr 13
+0: FC IN Nr 14
+0: FC IN Nr 15
+0: FC IN Nr 16
+0: FC IN Nr 17
+0: FC IN Nr 18
+0: FC IN Nr 19
+0: FC IN Nr 20
+10: FC OUT Nr 11
+20: FC OUT Nr 12
+30: FC OUT Nr 13
+40: FC OUT Nr 14
+50: FC OUT Nr 15
+===== BSSGP flow-control test END
+
+===== BSSGP flow-control test START
+size-max=100 oct, leak-rate=100 oct/s, queue-len=100 msgs, pdu_len=10 oct, pdu_cnt=20
+
+0: FC IN Nr 1
+0: FC OUT Nr 1
+0: FC IN Nr 2
+0: FC OUT Nr 2
+0: FC IN Nr 3
+0: FC OUT Nr 3
+0: FC IN Nr 4
+0: FC OUT Nr 4
+0: FC IN Nr 5
+0: FC OUT Nr 5
+0: FC IN Nr 6
+0: FC OUT Nr 6
+0: FC IN Nr 7
+0: FC OUT Nr 7
+0: FC IN Nr 8
+0: FC OUT Nr 8
+0: FC IN Nr 9
+0: FC OUT Nr 9
+0: FC IN Nr 10
+0: FC OUT Nr 10
+0: FC IN Nr 11
+0: FC IN Nr 12
+0: FC IN Nr 13
+0: FC IN Nr 14
+0: FC IN Nr 15
+0: FC IN Nr 16
+0: FC IN Nr 17
+0: FC IN Nr 18
+0: FC IN Nr 19
+0: FC IN Nr 20
+10: FC OUT Nr 11
+20: FC OUT Nr 12
+30: FC OUT Nr 13
+40: FC OUT Nr 14
+50: FC OUT Nr 15
+60: FC OUT Nr 16
+70: FC OUT Nr 17
+80: FC OUT Nr 18
+90: FC OUT Nr 19
+100: FC OUT Nr 20
+===== BSSGP flow-control test END
+
+===== BSSGP flow-control test START
+size-max=100 oct, leak-rate=100 oct/s, queue-len=5 msgs, pdu_len=1000 oct, pdu_cnt=20
+
+0: FC IN Nr 1
+0: FC IN Nr 2
+0: FC IN Nr 3
+0: FC IN Nr 4
+0: FC IN Nr 5
+0: FC IN Nr 6
+0: FC IN Nr 7
+0: FC IN Nr 8
+0: FC IN Nr 9
+0: FC IN Nr 10
+0: FC IN Nr 11
+0: FC IN Nr 12
+0: FC IN Nr 13
+0: FC IN Nr 14
+0: FC IN Nr 15
+0: FC IN Nr 16
+0: FC IN Nr 17
+0: FC IN Nr 18
+0: FC IN Nr 19
+0: FC IN Nr 20
+===== BSSGP flow-control test END
+
+===== BSSGP flow-control test START
+size-max=100 oct, leak-rate=100 oct/s, queue-len=5 msgs, pdu_len=10 oct, pdu_cnt=20
+
+0: FC IN Nr 1
+0: FC OUT Nr 1
+0: FC IN Nr 2
+0: FC OUT Nr 2
+0: FC IN Nr 3
+0: FC OUT Nr 3
+0: FC IN Nr 4
+0: FC OUT Nr 4
+0: FC IN Nr 5
+0: FC OUT Nr 5
+0: FC IN Nr 6
+0: FC OUT Nr 6
+0: FC IN Nr 7
+0: FC OUT Nr 7
+0: FC IN Nr 8
+0: FC OUT Nr 8
+0: FC IN Nr 9
+0: FC OUT Nr 9
+0: FC IN Nr 10
+0: FC OUT Nr 10
+0: FC IN Nr 11
+0: FC IN Nr 12
+0: FC IN Nr 13
+0: FC IN Nr 14
+0: FC IN Nr 15
+0: FC IN Nr 16
+0: FC IN Nr 17
+0: FC IN Nr 18
+0: FC IN Nr 19
+0: FC IN Nr 20
+10: FC OUT Nr 11
+20: FC OUT Nr 12
+30: FC OUT Nr 13
+40: FC OUT Nr 14
+50: FC OUT Nr 15
+===== BSSGP flow-control test END
+
diff --git a/src/shared/libosmocore/tests/gb/bssgp_fc_tests.sh b/src/shared/libosmocore/tests/gb/bssgp_fc_tests.sh
new file mode 100755
index 00000000..38659bb9
--- /dev/null
+++ b/src/shared/libosmocore/tests/gb/bssgp_fc_tests.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+T=$1/bssgp_fc_test
+
+# default test (1 second, insufficient queue depth)
+$T
+
+# default test (1 second, sufficient queue depth)
+$T -d 100
+
+# test with PDU too large for bucket max
+$T -l 1000
+
+# test with 100 byte PDUs (10 second)
+$T -s 100
+
diff --git a/src/shared/libosmocore/tests/gsm0408/gsm0408_test.c b/src/shared/libosmocore/tests/gsm0408/gsm0408_test.c
new file mode 100644
index 00000000..077063be
--- /dev/null
+++ b/src/shared/libosmocore/tests/gsm0408/gsm0408_test.c
@@ -0,0 +1,133 @@
+/*
+ * (C) 2012 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <string.h>
+#include <stdio.h>
+
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/gsm48_ie.h>
+#include <osmocom/gsm/mncc.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/msgb.h>
+
+
+static const uint8_t csd_9600_v110_lv[] = { 0x07, 0xa1, 0xb8, 0x89, 0x21, 0x15, 0x63, 0x80 };
+
+static const struct gsm_mncc_bearer_cap bcap_csd_9600_v110 = {
+	.transfer =	GSM48_BCAP_ITCAP_UNR_DIG_INF,
+	.mode =		GSM48_BCAP_TMOD_CIRCUIT,
+	.coding =	GSM48_BCAP_CODING_GSM_STD,
+	.radio =	GSM48_BCAP_RRQ_FR_ONLY,
+	.speech_ver[0]=	-1,
+	.data = {
+		.rate_adaption =	GSM48_BCAP_RA_V110_X30,
+		.sig_access =		GSM48_BCAP_SA_I440_I450,
+		.async =		1,
+		.nr_stop_bits =		1,
+		.nr_data_bits =		8,
+		.user_rate =		GSM48_BCAP_UR_9600,
+		.parity =		GSM48_BCAP_PAR_NONE,
+		.interm_rate =		GSM48_BCAP_IR_16k,
+		.transp =		GSM48_BCAP_TR_TRANSP,
+		.modem_type =		GSM48_BCAP_MT_NONE,
+	},
+};
+
+static const uint8_t speech_all_lv[] = { 0x06, 0x60, 0x04, 0x02, 0x00, 0x05, 0x81 };
+
+static const struct gsm_mncc_bearer_cap bcap_speech_all = {
+	.transfer =	GSM48_BCAP_ITCAP_SPEECH,
+	.mode =		GSM48_BCAP_TMOD_CIRCUIT,
+	.coding =	GSM48_BCAP_CODING_GSM_STD,
+	.radio =	GSM48_BCAP_RRQ_DUAL_FR,
+	.speech_ver = {
+		4, 2, 0, 5, 1, -1,
+	},
+};
+
+
+struct bcap_test {
+	const uint8_t *lv;
+	const struct gsm_mncc_bearer_cap *bc;
+	const char *name;
+};
+
+static const struct bcap_test bcap_tests[] = {
+	{ csd_9600_v110_lv, &bcap_csd_9600_v110, "CSD 9600/V.110/transparent" },
+	{ speech_all_lv, &bcap_speech_all, "Speech, all codecs" },
+};
+
+static int test_bearer_cap()
+{
+	struct gsm_mncc_bearer_cap bc;
+	int i, rc;
+
+	for (i = 0; i < ARRAY_SIZE(bcap_tests); i++) {
+		struct msgb *msg = msgb_alloc(100, "test");
+		int lv_len;
+
+		memset(&bc, 0, sizeof(bc));
+
+		/* test decoding */
+		rc = gsm48_decode_bearer_cap(&bc, bcap_tests[i].lv);
+		if (rc < 0) {
+			fprintf(stderr, "Error decoding %s\n",
+				bcap_tests[i].name);
+			return rc;
+		}
+		if (memcmp(&bc, bcap_tests[i].bc, sizeof(bc))) {
+			fprintf(stderr, "Incorrect decoded result of %s:\n",
+				bcap_tests[i].name);
+			fprintf(stderr, " should: %s\n",
+				osmo_hexdump((uint8_t *) bcap_tests[i].bc, sizeof(bc)));
+			fprintf(stderr, " is:     %s\n",
+				osmo_hexdump((uint8_t *) &bc, sizeof(bc)));
+			return -1;
+		}
+
+		/* also test re-encode? */
+		rc = gsm48_encode_bearer_cap(msg, 1, &bc);
+		if (rc < 0) {
+			fprintf(stderr, "Error encoding %s\n",
+				bcap_tests[i].name);
+			return rc;
+		}
+		lv_len = bcap_tests[i].lv[0]+1;
+		if (memcmp(msg->data, bcap_tests[i].lv, lv_len)) {
+			fprintf(stderr, "Incorrect encoded result of %s:\n",
+				bcap_tests[i].name);
+			fprintf(stderr, " should: %s\n",
+				osmo_hexdump(bcap_tests[i].lv, lv_len));
+			fprintf(stderr, " is:     %s\n",
+				osmo_hexdump(msg->data, msg->len));
+			return -1;
+		}
+
+		printf("Test `%s' passed\n", bcap_tests[i].name);
+		msgb_free(msg);
+	}
+
+	return 0;
+}
+
+int main(int argc, char **argv)
+{
+	test_bearer_cap();
+}
diff --git a/src/shared/libosmocore/tests/gsm0408/gsm0408_test.ok b/src/shared/libosmocore/tests/gsm0408/gsm0408_test.ok
new file mode 100644
index 00000000..5ce19e63
--- /dev/null
+++ b/src/shared/libosmocore/tests/gsm0408/gsm0408_test.ok
@@ -0,0 +1,2 @@
+Test `CSD 9600/V.110/transparent' passed
+Test `Speech, all codecs' passed
diff --git a/src/shared/libosmocore/tests/gsm0808/gsm0808_test.c b/src/shared/libosmocore/tests/gsm0808/gsm0808_test.c
new file mode 100644
index 00000000..7e5e97b5
--- /dev/null
+++ b/src/shared/libosmocore/tests/gsm0808/gsm0808_test.c
@@ -0,0 +1,269 @@
+/*
+ * (C) 2012 by Holger Hans Peter Freyther
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/gsm/gsm0808.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#define VERIFY(msg, data, len) 						\
+	if (msgb_l3len(msg) != len) {					\
+		printf("%s:%d Length don't match: %d vs. %d. %s\n", 	\
+			__func__, __LINE__, msgb_l3len(msg), len,	\
+			osmo_hexdump(msg->l3h, msgb_l3len(msg))); 	\
+		abort();						\
+	} else if (memcmp(msg->l3h, data, len) != 0) {			\
+		printf("%s:%d didn't match: got: %s\n",			\
+			__func__, __LINE__,				\
+			osmo_hexdump(msg->l3h, msgb_l3len(msg)));	\
+		abort();						\
+	}
+
+
+static void test_create_layer3(void)
+{
+	static const uint8_t res[] = {
+		0x00, 0x0e, 0x57, 0x05, 0x08, 0x00, 0x77, 0x62,
+		0x83, 0x33, 0x66, 0x44, 0x88, 0x17, 0x01, 0x23 };
+	struct msgb *msg, *in_msg;
+	printf("Testing creating Layer3\n");
+
+	in_msg = msgb_alloc_headroom(512, 128, "foo");
+	in_msg->l3h = in_msg->data;
+	msgb_v_put(in_msg, 0x23);
+
+	msg = gsm0808_create_layer3(in_msg, 0x1122, 0x2244, 0x3366, 0x4488);
+	VERIFY(msg, res, ARRAY_SIZE(res));
+	msgb_free(msg);
+	msgb_free(in_msg);
+}
+
+static void test_create_reset()
+{
+	static const uint8_t res[] = { 0x00, 0x04, 0x30, 0x04, 0x01, 0x20 };
+	struct msgb *msg;
+
+	printf("Testing creating Reset\n");
+	msg = gsm0808_create_reset();
+	VERIFY(msg, res, ARRAY_SIZE(res));
+	msgb_free(msg);
+}
+
+static void test_create_clear_command()
+{
+	static const uint8_t res[] = { 0x20, 0x04, 0x01, 0x23 };
+	struct msgb *msg;
+
+	printf("Testing creating Clear Command\n");
+	msg = gsm0808_create_clear_command(0x23);
+	VERIFY(msg, res, ARRAY_SIZE(res));
+	msgb_free(msg);
+}
+
+static void test_create_clear_complete()
+{
+	static const uint8_t res[] = { 0x00, 0x01, 0x21 };
+	struct msgb *msg;
+
+	printf("Testing creating Clear Complete\n");
+	msg = gsm0808_create_clear_complete();
+	VERIFY(msg, res, ARRAY_SIZE(res));
+	msgb_free(msg);
+}
+
+static void test_create_cipher_complete()
+{
+	static const uint8_t res1[] = {
+		0x00, 0x08, 0x55, 0x20, 0x03, 0x23, 0x42, 0x21, 0x2c, 0x04 };
+	static const uint8_t res2[] = { 0x00, 0x03, 0x55, 0x2c, 0x04};
+	struct msgb *l3, *msg;
+
+	printf("Testing creating Cipher Complete\n");
+	l3 = msgb_alloc_headroom(512, 128, "l3h");
+	l3->l3h = l3->data;
+	msgb_v_put(l3, 0x23);
+	msgb_v_put(l3, 0x42);
+	msgb_v_put(l3, 0x21);
+
+	/* with l3 data */
+	msg = gsm0808_create_cipher_complete(l3, 4);
+	VERIFY(msg, res1, ARRAY_SIZE(res1));
+	msgb_free(msg);
+
+	/* with l3 data but short */
+	l3->len -= 1;
+	l3->tail -= 1;
+	msg = gsm0808_create_cipher_complete(l3, 4);
+	VERIFY(msg, res2, ARRAY_SIZE(res2));
+	msgb_free(msg);
+
+	/* without l3 data */
+	msg = gsm0808_create_cipher_complete(NULL, 4);
+	VERIFY(msg, res2, ARRAY_SIZE(res2));
+	msgb_free(msg);
+
+
+	msgb_free(l3);
+}
+
+static void test_create_cipher_reject()
+{
+	static const uint8_t res[] = { 0x00, 0x02, 0x59, 0x23 };
+	struct msgb *msg;
+
+	printf("Testing creating Cipher Reject\n");
+	msg = gsm0808_create_cipher_reject(0x23);
+	VERIFY(msg, res, ARRAY_SIZE(res));
+	msgb_free(msg);
+}
+
+static void test_create_cm_u()
+{
+	static const uint8_t res[] = {
+		0x00, 0x07, 0x54, 0x12, 0x01, 0x23, 0x13, 0x01, 0x42 };
+	static const uint8_t res2o[] = {
+		0x00, 0x04, 0x54, 0x12, 0x01, 0x23 };
+	struct msgb *msg;
+	const uint8_t cm2 = 0x23;
+	const uint8_t cm3 = 0x42;
+
+	printf("Testing creating CM U\n");
+	msg = gsm0808_create_classmark_update(&cm2, 1, &cm3, 1);
+	VERIFY(msg, res, ARRAY_SIZE(res));
+
+	msg = gsm0808_create_classmark_update(&cm2, 1, NULL, 0);
+	VERIFY(msg, res2o, ARRAY_SIZE(res2o));
+
+	msgb_free(msg);
+}
+
+static void test_create_sapi_reject()
+{
+	static const uint8_t res[] = { 0x00, 0x03, 0x25, 0x03, 0x25 };
+	struct msgb *msg;
+
+	printf("Testing creating SAPI Reject\n");
+	msg = gsm0808_create_sapi_reject(3);
+	VERIFY(msg, res, ARRAY_SIZE(res));
+	msgb_free(msg);
+}
+
+static void test_create_ass_compl()
+{
+	static const uint8_t res1[] = {
+		0x00, 0x09, 0x02, 0x15, 0x23, 0x21, 0x42, 0x2c,
+		0x11, 0x40, 0x22 };
+	static const uint8_t res2[] = {
+		0x00, 0x07, 0x02, 0x15, 0x23, 0x21, 0x42, 0x2c, 0x11};
+	struct msgb *msg;
+
+	printf("Testing creating Assignment Complete\n");
+	msg = gsm0808_create_assignment_completed(0x23, 0x42, 0x11, 0x22);
+	VERIFY(msg, res1, ARRAY_SIZE(res1));
+	msgb_free(msg);
+
+	msg = gsm0808_create_assignment_completed(0x23, 0x42, 0x11, 0);
+	VERIFY(msg, res2, ARRAY_SIZE(res2));
+	msgb_free(msg);
+}
+
+static void test_create_ass_fail()
+{
+	static const uint8_t res1[] = { 0x00, 0x04, 0x03, 0x04, 0x01, 0x23 };
+	static const uint8_t res2[] = {
+		0x00, 0x06, 0x03, 0x04, 0x01, 0x23, 0x15, 0x02};
+	uint8_t rr_res = 2;
+	struct msgb *msg;
+
+	printf("Testing creating Assignment Failure\n");
+	msg = gsm0808_create_assignment_failure(0x23, NULL);
+	VERIFY(msg, res1, ARRAY_SIZE(res1));
+	msgb_free(msg);
+
+	msg = gsm0808_create_assignment_failure(0x23, &rr_res);
+	VERIFY(msg, res2, ARRAY_SIZE(res2));
+	msgb_free(msg);
+}
+
+static void test_create_clear_rqst()
+{
+	static const uint8_t res[] = { 0x00, 0x04, 0x22, 0x04, 0x01, 0x23 };
+	struct msgb *msg;
+
+	printf("Testing creating Clear Request\n");
+	msg = gsm0808_create_clear_rqst(0x23);
+	VERIFY(msg, res, ARRAY_SIZE(res));
+	msgb_free(msg);
+}
+
+static void test_create_dtap()
+{
+	static const uint8_t res[] = { 0x01, 0x03, 0x02, 0x23, 0x42 };
+	struct msgb *msg, *l3;
+
+	printf("Testing creating DTAP\n");
+	l3 = msgb_alloc_headroom(512, 128, "test");
+	l3->l3h = l3->data;
+	msgb_v_put(l3, 0x23);
+	msgb_v_put(l3, 0x42);
+
+	msg = gsm0808_create_dtap(l3, 0x3);
+	VERIFY(msg, res, ARRAY_SIZE(res));
+	msgb_free(msg);
+	msgb_free(l3);
+}
+
+static void test_prepend_dtap()
+{
+	static const uint8_t res[] = { 0x01, 0x03, 0x02, 0x23, 0x42 };
+	struct msgb *in_msg;
+
+	printf("Testing prepend DTAP\n");
+
+	in_msg = msgb_alloc_headroom(512, 128, "test");
+	msgb_v_put(in_msg, 0x23);
+	msgb_v_put(in_msg, 0x42);
+
+	gsm0808_prepend_dtap_header(in_msg, 0x3);
+	in_msg->l3h = in_msg->data;
+	VERIFY(in_msg, res, ARRAY_SIZE(res));
+	msgb_free(in_msg);
+}
+
+int main(int argc, char **argv)
+{
+	printf("Testing generation of GSM0808 messages\n");
+	test_create_layer3();
+	test_create_reset();
+	test_create_clear_command();
+	test_create_clear_complete();
+	test_create_cipher_complete();
+	test_create_cipher_reject();
+	test_create_cm_u();
+	test_create_sapi_reject();
+	test_create_ass_compl();
+	test_create_ass_fail();
+	test_create_clear_rqst();
+	test_create_dtap();
+	test_prepend_dtap();
+
+	printf("Done\n");
+	return EXIT_SUCCESS;
+}
diff --git a/src/shared/libosmocore/tests/gsm0808/gsm0808_test.ok b/src/shared/libosmocore/tests/gsm0808/gsm0808_test.ok
new file mode 100644
index 00000000..eb431267
--- /dev/null
+++ b/src/shared/libosmocore/tests/gsm0808/gsm0808_test.ok
@@ -0,0 +1,15 @@
+Testing generation of GSM0808 messages
+Testing creating Layer3
+Testing creating Reset
+Testing creating Clear Command
+Testing creating Clear Complete
+Testing creating Cipher Complete
+Testing creating Cipher Reject
+Testing creating CM U
+Testing creating SAPI Reject
+Testing creating Assignment Complete
+Testing creating Assignment Failure
+Testing creating Clear Request
+Testing creating DTAP
+Testing prepend DTAP
+Done
diff --git a/src/shared/libosmocore/tests/lapd/lapd_test.c b/src/shared/libosmocore/tests/lapd/lapd_test.c
new file mode 100644
index 00000000..d58bec65
--- /dev/null
+++ b/src/shared/libosmocore/tests/lapd/lapd_test.c
@@ -0,0 +1,319 @@
+/*
+ * (C) 2011 by Holger Hans Peter Freyther
+ * (C) 2011 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/core/logging.h>
+#include <osmocom/gsm/lapdm.h>
+#include <osmocom/gsm/rsl.h>
+
+#include <errno.h>
+
+#include <string.h>
+
+#define CHECK_RC(rc)	\
+	if (rc != 0) {	\
+		printf("Operation failed rc=%d on %s:%d\n", rc, __FILE__, __LINE__); \
+		abort(); \
+	}
+
+#define ASSERT(exp)    \
+	if (!(exp)) { \
+		printf("Assert failed %s %s:%d\n", #exp, __FILE__, __LINE__); \
+		abort(); \
+	}
+
+
+static struct log_info info = {};
+
+struct lapdm_polling_state {
+	struct lapdm_channel *bts;
+	int bts_read;
+
+	struct lapdm_channel *ms;
+	int ms_read;
+};
+
+static struct msgb *msgb_from_array(const uint8_t *data, int len)
+{
+	struct msgb *msg = msgb_alloc_headroom(4096, 128, "data");
+	msg->l3h = msgb_put(msg, len);
+	memcpy(msg->l3h, data, len);
+	return msg;
+}
+
+/*
+ * Test data is below...
+ */
+static const uint8_t cm[] = {
+	0x05, 0x24, 0x31, 0x03, 0x50, 0x18, 0x93, 0x08,
+	0x29, 0x47, 0x80, 0x00, 0x00, 0x00, 0x00, 0x80,
+};
+
+static const uint8_t cm_padded[] = {
+	0x05, 0x24, 0x31, 0x03, 0x50, 0x18, 0x93, 0x08,
+	0x29, 0x47, 0x80, 0x00, 0x00, 0x00, 0x00, 0x80,
+	0x2b, 0x2b, 0x2b, 0x2b
+};
+
+static const uint8_t mm[] = {
+	0x00, 0x0c, 0x00, 0x03, 0x01, 0x01, 0x20, 0x02,
+	0x00, 0x0b, 0x00, 0x03, 0x05, 0x04, 0x0d
+};
+
+static const uint8_t dummy1[] = {
+	0xab, 0x03, 0x30, 0x60, 0x06,
+};
+
+static struct msgb *create_cm_serv_req(void)
+{
+	struct msgb *msg;
+
+	msg = msgb_from_array(cm, sizeof(cm));
+	rsl_rll_push_l3(msg, RSL_MT_EST_REQ, 0, 0, 1);
+	return msg;
+}
+
+static struct msgb *create_mm_id_req(void)
+{
+	struct msgb *msg;
+
+	msg = msgb_from_array(mm, sizeof(mm));
+	msg->l2h = msg->data + 3;
+	ASSERT(msgb_l2len(msg) == 12);
+	msg->l3h = msg->l2h + 6;
+	ASSERT(msgb_l3len(msg) == 6);
+
+	return msg;
+}
+
+static struct msgb *create_empty_msg(void)
+{
+	struct msgb *msg;
+
+	msg = msgb_from_array(NULL, 0);
+	ASSERT(msgb_l3len(msg) == 0);
+	rsl_rll_push_l3(msg, RSL_MT_DATA_REQ, 0, 0, 1);
+	return msg;
+}
+
+static struct msgb *create_dummy_data_req(void)
+{
+	struct msgb *msg;
+
+	msg = msgb_from_array(dummy1, sizeof(dummy1));
+	rsl_rll_push_l3(msg, RSL_MT_DATA_REQ, 0, 0, 1);
+	return msg;
+}
+
+static int send(struct msgb *in_msg, struct lapdm_channel *chan)
+{
+	struct osmo_phsap_prim pp;
+	struct msgb *msg;
+	int rc;
+
+	msg = msgb_alloc_headroom(128, 64, "PH-DATA.ind");
+	osmo_prim_init(&pp.oph, SAP_GSM_PH, PRIM_PH_DATA,
+			PRIM_OP_INDICATION, msg);
+	/* copy over actual MAC block */
+	msg->l2h = msgb_put(msg, msgb_l2len(in_msg));
+	memcpy(msg->l2h, in_msg->l2h, msgb_l2len(in_msg));
+
+	/* LAPDm requires those... */
+	pp.u.data.chan_nr = 0;
+	pp.u.data.link_id = 0;
+        /* feed into the LAPDm code of libosmogsm */
+        rc = lapdm_phsap_up(&pp.oph, &chan->lapdm_dcch);
+	ASSERT(rc == 0 || rc == -EBUSY);
+	return 0;
+}
+
+/*
+ * I get called from the LAPDm code when something was sent my way...
+ */
+static int bts_to_ms_tx_cb(struct msgb *in_msg, struct lapdm_entity *le, void *_ctx)
+{
+	struct lapdm_polling_state *state = _ctx;
+
+
+	printf("%s: MS->BTS(us) message %d\n", __func__, msgb_length(in_msg));
+
+
+	if (state->bts_read == 0) {
+		printf("BTS: Verifying CM request.\n");
+		ASSERT(msgb_l3len(in_msg) == ARRAY_SIZE(cm_padded));
+		ASSERT(memcmp(in_msg->l3h, cm_padded, ARRAY_SIZE(cm_padded)) == 0);
+	} else if (state->bts_read == 1) {
+		printf("BTS: Verifying dummy message.\n");
+		ASSERT(msgb_l3len(in_msg) == ARRAY_SIZE(dummy1));
+		ASSERT(memcmp(in_msg->l3h, dummy1, ARRAY_SIZE(dummy1)) == 0);
+	} else {
+		printf("BTS: Do not know to verify: %d\n", state->bts_read);
+	}
+
+	state->bts_read += 1;
+	msgb_free(in_msg);
+
+	return 0;
+}
+
+static int ms_to_bts_l1_cb(struct osmo_prim_hdr *oph, void *_ctx)
+{
+	int rc;
+	struct lapdm_polling_state *state = _ctx;
+	printf("%s: MS(us) -> BTS prim message\n", __func__);
+
+	/* i stuff it into the LAPDm channel of the BTS */
+	rc = send(oph->msg, state->bts);
+	msgb_free(oph->msg);
+}
+
+static int ms_to_bts_tx_cb(struct msgb *msg, struct lapdm_entity *le, void *_ctx)
+{
+	struct lapdm_polling_state *state = _ctx;
+
+	printf("%s: BTS->MS(us) message %d\n", __func__, msgb_length(msg));
+
+	if (state->ms_read == 0) {
+		struct abis_rsl_rll_hdr hdr;
+
+		printf("MS: Verifying incoming primitive.\n");
+		ASSERT(msg->len == sizeof(struct abis_rsl_rll_hdr) + 3);
+
+		/* verify the header */
+		memset(&hdr, 0, sizeof(hdr));
+		rsl_init_rll_hdr(&hdr, RSL_MT_EST_CONF);
+		hdr.c.msg_discr |= ABIS_RSL_MDISC_TRANSP;
+		ASSERT(memcmp(msg->data, &hdr, sizeof(hdr)) == 0);
+
+		/* Verify the added RSL_IE_L3_INFO but we have a bug here */
+		ASSERT(msg->data[6] == RSL_IE_L3_INFO);
+		#warning "RSL_IE_L3_INFO 16 bit length is wrong"
+		/* ASSERT(msg->data[7] == 0x0 && msg->data[8] == 0x9c); */
+		/* this should be 0x0 and 0x0... but we have a bug */
+	} else if (state->ms_read == 1) {
+		printf("MS: Verifying incoming MM message: %d\n", msgb_l3len(msg));
+		ASSERT(msgb_l3len(msg) == 3);
+		ASSERT(memcmp(msg->l3h, &mm[12], msgb_l3len(msg)) == 0);
+	} else {
+		printf("MS: Do not know to verify: %d\n", state->ms_read);
+	}
+
+	state->ms_read += 1;
+	msgb_free(msg);
+	return 0;
+}
+
+static void test_lapdm_polling()
+{
+	printf("I do some very simple LAPDm test.\n");
+
+	int rc;
+	struct lapdm_polling_state test_state;
+	struct osmo_phsap_prim pp;
+
+	/* Configure LAPDm on both sides */
+	struct lapdm_channel bts_to_ms_channel;
+	struct lapdm_channel ms_to_bts_channel;
+	memset(&bts_to_ms_channel, 0, sizeof(bts_to_ms_channel));
+	memset(&ms_to_bts_channel, 0, sizeof(ms_to_bts_channel));
+
+	memset(&test_state, 0, sizeof(test_state));
+	test_state.bts = &bts_to_ms_channel;
+	test_state.ms = &ms_to_bts_channel;
+
+	/* BTS to MS in polling mode */
+	lapdm_channel_init(&bts_to_ms_channel, LAPDM_MODE_BTS);
+        lapdm_channel_set_flags(&bts_to_ms_channel, LAPDM_ENT_F_POLLING_ONLY);
+        lapdm_channel_set_l1(&bts_to_ms_channel, NULL, &test_state);
+        lapdm_channel_set_l3(&bts_to_ms_channel, bts_to_ms_tx_cb, &test_state);
+
+	/* MS to BTS in direct mode */
+	lapdm_channel_init(&ms_to_bts_channel, LAPDM_MODE_MS);
+	lapdm_channel_set_l1(&ms_to_bts_channel, ms_to_bts_l1_cb, &test_state);
+	lapdm_channel_set_l3(&ms_to_bts_channel, ms_to_bts_tx_cb, &test_state);
+
+	/*
+	 * We try to send messages from the MS to the BTS to the MS..
+	 */
+	/* 1. Start with MS -> BTS, BTS should have a pending message */
+	printf("Establishing link.\n");
+	lapdm_rslms_recvmsg(create_cm_serv_req(), &ms_to_bts_channel);
+
+	/* 2. Poll on the BTS for sending out a confirmation */
+	printf("\nConfirming\n");
+	ASSERT(test_state.bts_read == 1)
+	rc = lapdm_phsap_dequeue_prim(&bts_to_ms_channel.lapdm_dcch, &pp);
+	CHECK_RC(rc);
+	ASSERT(pp.oph.msg->data == pp.oph.msg->l2h);
+	send(pp.oph.msg, &ms_to_bts_channel);
+	msgb_free(pp.oph.msg);
+	ASSERT(test_state.ms_read == 1);
+
+	/* 3. Send some data to the MS */
+	printf("\nSending back to MS\n");
+	lapdm_rslms_recvmsg(create_mm_id_req(), &bts_to_ms_channel);
+	rc = lapdm_phsap_dequeue_prim(&bts_to_ms_channel.lapdm_dcch, &pp);
+	CHECK_RC(rc);
+	send(pp.oph.msg, &ms_to_bts_channel);
+	msgb_free(pp.oph.msg);
+	ASSERT(test_state.ms_read == 2);
+
+	/* verify that there is nothing more to poll */
+	rc = lapdm_phsap_dequeue_prim(&bts_to_ms_channel.lapdm_dcch, &pp);
+	ASSERT(rc < 0);
+
+	/* 3. And back to the BTS */
+	printf("\nSending back to BTS\n");
+	ASSERT(test_state.ms_read == 2);
+	lapdm_rslms_recvmsg(create_dummy_data_req(), &ms_to_bts_channel);
+
+
+	/* 4. And back to the MS, but let's move data/l2h apart */
+	ASSERT(test_state.bts_read == 2)
+	ASSERT(test_state.ms_read == 2);
+	rc = lapdm_phsap_dequeue_prim(&bts_to_ms_channel.lapdm_dcch, &pp);
+	CHECK_RC(rc);
+	send(pp.oph.msg, &ms_to_bts_channel);
+	ASSERT(test_state.ms_read == 2);
+	msgb_free(pp.oph.msg);
+
+	/* verify that there is nothing more to poll */
+	rc = lapdm_phsap_dequeue_prim(&bts_to_ms_channel.lapdm_dcch, &pp);
+	ASSERT(rc < 0);
+
+	/* check sending an empty L3 message fails */
+	rc = lapdm_rslms_recvmsg(create_empty_msg(), &bts_to_ms_channel);
+	ASSERT(rc == -1);
+	ASSERT(test_state.ms_read == 2);
+
+	/* clean up */
+	lapdm_channel_exit(&bts_to_ms_channel);
+	lapdm_channel_exit(&ms_to_bts_channel);
+}
+
+int main(int argc, char **argv)
+{
+	osmo_init_logging(&info);
+
+	test_lapdm_polling();
+	printf("Success.\n");
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/tests/lapd/lapd_test.ok b/src/shared/libosmocore/tests/lapd/lapd_test.ok
new file mode 100644
index 00000000..d67a0a80
--- /dev/null
+++ b/src/shared/libosmocore/tests/lapd/lapd_test.ok
@@ -0,0 +1,20 @@
+I do some very simple LAPDm test.
+Establishing link.
+ms_to_bts_l1_cb: MS(us) -> BTS prim message
+bts_to_ms_tx_cb: MS->BTS(us) message 29
+BTS: Verifying CM request.
+
+Confirming
+ms_to_bts_tx_cb: BTS->MS(us) message 9
+MS: Verifying incoming primitive.
+
+Sending back to MS
+ms_to_bts_tx_cb: BTS->MS(us) message 12
+MS: Verifying incoming MM message: 3
+ms_to_bts_l1_cb: MS(us) -> BTS prim message
+
+Sending back to BTS
+ms_to_bts_l1_cb: MS(us) -> BTS prim message
+bts_to_ms_tx_cb: MS->BTS(us) message 14
+BTS: Verifying dummy message.
+Success.
diff --git a/src/shared/libosmocore/tests/logging/logging_test.c b/src/shared/libosmocore/tests/logging/logging_test.c
new file mode 100644
index 00000000..fd62db5a
--- /dev/null
+++ b/src/shared/libosmocore/tests/logging/logging_test.c
@@ -0,0 +1,76 @@
+/* simple test for the debug interface */
+/*
+ * (C) 2008, 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+
+enum {
+	DRLL,
+	DCC,
+	DMM,
+};
+
+static const struct log_info_cat default_categories[] = {
+	[DRLL] = {
+		.name = "DRLL",
+		.description = "A-bis Radio Link Layer (RLL)",
+		.color = "\033[1;31m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DCC] = {
+		.name = "DCC",
+		.description = "Layer3 Call Control (CC)",
+		.color = "\033[1;32m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DMM] = {
+		.name = NULL,
+		.description = "Layer3 Mobility Management (MM)",
+		.color = "\033[1;33m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+};
+
+const struct log_info log_info = {
+	.cat = default_categories,
+	.num_cat = ARRAY_SIZE(default_categories),
+};
+
+int main(int argc, char **argv)
+{
+	struct log_target *stderr_target;
+
+	log_init(&log_info, NULL);
+	stderr_target = log_target_create_stderr();
+	log_add_target(stderr_target);
+	log_set_all_filter(stderr_target, 1);
+	log_set_print_filename(stderr_target, 0);
+
+	log_parse_category_mask(stderr_target, "DRLL:DCC");
+	log_parse_category_mask(stderr_target, "DRLL");
+	DEBUGP(DCC, "You should not see this\n");
+
+	log_parse_category_mask(stderr_target, "DRLL:DCC");
+	DEBUGP(DRLL, "You should see this\n");
+	DEBUGP(DCC, "You should see this\n");
+	DEBUGP(DMM, "You should not see this\n");
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/tests/logging/logging_test.err b/src/shared/libosmocore/tests/logging/logging_test.err
new file mode 100644
index 00000000..b59d2e83
--- /dev/null
+++ b/src/shared/libosmocore/tests/logging/logging_test.err
@@ -0,0 +1,3 @@
+You should see this
+You should see this
+
\ No newline at end of file
diff --git a/src/shared/libosmocore/tests/logging/logging_test.ok b/src/shared/libosmocore/tests/logging/logging_test.ok
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/src/shared/libosmocore/tests/logging/logging_test.ok
diff --git a/src/shared/libosmocore/tests/msgfile/msgconfig.cfg b/src/shared/libosmocore/tests/msgfile/msgconfig.cfg
new file mode 100644
index 00000000..28d74326
--- /dev/null
+++ b/src/shared/libosmocore/tests/msgfile/msgconfig.cfg
@@ -0,0 +1,2 @@
+# This is a comment
+*:*::Hello Welt
diff --git a/src/shared/libosmocore/tests/msgfile/msgfile_test.c b/src/shared/libosmocore/tests/msgfile/msgfile_test.c
new file mode 100644
index 00000000..ed7aa978
--- /dev/null
+++ b/src/shared/libosmocore/tests/msgfile/msgfile_test.c
@@ -0,0 +1,50 @@
+/*
+ * (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/core/msgfile.h>
+
+#include <stdio.h>
+
+static void dump_entries(struct osmo_config_list *entries)
+{
+	struct osmo_config_entry *entry;
+
+	if (!entries) {
+		fprintf(stderr, "Failed to parse the file\n");
+		return;
+	}
+
+	llist_for_each_entry(entry, &entries->entry, list) {
+		printf("Entry '%s:%s:%s:%s'\n",
+			entry->mcc, entry->mnc, entry->option, entry->text);
+	}
+}
+
+int main(int argc, char **argv)
+{
+	struct osmo_config_list *entries;
+
+	/* todo use msgfile_test.c.in and replace the path */
+	entries = osmo_config_list_parse(NULL, "msgconfig.cfg");
+	dump_entries(entries);
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/tests/msgfile/msgfile_test.ok b/src/shared/libosmocore/tests/msgfile/msgfile_test.ok
new file mode 100644
index 00000000..c47cd747
--- /dev/null
+++ b/src/shared/libosmocore/tests/msgfile/msgfile_test.ok
@@ -0,0 +1 @@
+Entry '*:*::Hello Welt'
diff --git a/src/shared/libosmocore/tests/sms/sms_test.c b/src/shared/libosmocore/tests/sms/sms_test.c
new file mode 100644
index 00000000..6df4b623
--- /dev/null
+++ b/src/shared/libosmocore/tests/sms/sms_test.c
@@ -0,0 +1,319 @@
+/*
+ * (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
+ * (C) 2010 by Nico Golde <nico@ngolde.de>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/utils.h>
+
+struct test_case {
+	const uint8_t *input;
+	const uint16_t input_length;
+
+	const uint8_t *expected;
+	const uint16_t expected_octet_length;
+	const uint16_t expected_septet_length;
+	const uint8_t ud_hdr_ind;
+};
+
+static const char simple_text[] = "test text";
+#define simple_septet_length 9
+static const uint8_t simple_enc[] = {
+	0xf4, 0xf2, 0x9c, 0x0e, 0xa2, 0x97, 0xf1, 0x74
+};
+
+static const char escape_text[] = "!$ a more#^- complicated test@@?_%! case";
+#define escape_septet_length 41 /* note: the ^ counts as two, because it is a extension character */
+static const uint8_t escape_enc[] = {
+	0x21, 0x01, 0x28, 0x0c, 0x6a, 0xbf, 0xe5, 0xe5, 0xd1,
+	0x86, 0xd2, 0x02, 0x8d, 0xdf, 0x6d, 0x38, 0x3b, 0x3d,
+	0x0e, 0xd3, 0xcb, 0x64, 0x10, 0xbd, 0x3c, 0xa7, 0x03,
+	0x00, 0xbf, 0x48, 0x29, 0x04, 0x1a, 0x87, 0xe7, 0x65,
+};
+
+static const char enhanced_text[] = "enhanced ^ {][} test |+~ ^ test";
+#define enhanced_septet_length 39 /* note: the characters { } [ ] ^ | ~ count as two (each of them), because they are extension characters */
+static const uint8_t enhanced_enc[] = {
+	0x65, 0x37, 0x3A, 0xEC, 0x1E, 0x97, 0xC9, 0xA0, 0x0D,
+	0x05, 0xB4, 0x41, 0x6D, 0x7C, 0x1B, 0xDE, 0x26, 0x05,
+	0xA2, 0x97, 0xE7, 0x74, 0xD0, 0x06, 0xB8, 0xDA, 0xF4,
+	0x40, 0x1B, 0x0A, 0x88, 0x5E, 0x9E, 0xD3, 0x01,
+};
+
+static const char enhancedV2_text[] = "enhanced ^ {][} test |+~ ^ tests";
+#define enhancedV2_septet_length 40 /* note: number of octets are equal to the enhanced_text! */
+static const uint8_t enhancedV2_enc[] = {
+	0x65, 0x37, 0x3A, 0xEC, 0x1E, 0x97, 0xC9, 0xA0, 0x0D,
+	0x05, 0xB4, 0x41, 0x6D, 0x7C, 0x1B, 0xDE, 0x26, 0x05,
+	0xA2, 0x97, 0xE7, 0x74, 0xD0, 0x06, 0xB8, 0xDA, 0xF4,
+	0x40, 0x1B, 0x0A, 0x88, 0x5E, 0x9E, 0xD3, 0xE7,
+};
+
+
+
+static const char concatenated_text[] =
+		"this is a testmessage. this is a testmessage. this is a testmessage. this is a testmessage. "
+		"this is a testmessage. this is a testmessage. cut here .....: this is a second testmessage. end here.";
+
+static const char splitted_text_part1[] =
+		"this is a testmessage. this is a testmessage. this is a testmessage. this is a testmessage. "
+		"this is a testmessage. this is a testmessage. cut here .....:";
+#define concatenated_part1_septet_length_with_header 160
+#define concatenated_part1_septet_length 153
+static const uint8_t concatenated_part1_enc[] = {
+		0x05, 0x00, 0x03, 0x6f, 0x02, 0x01,
+		0xe8, 0xe8, 0xf4, 0x1c, 0x94, 0x9e, 0x83, 0xc2,
+		0x20, 0x7a, 0x79, 0x4e, 0x6f, 0x97, 0xe7, 0xf3,
+		0xf0, 0xb9, 0xec, 0x02, 0xd1, 0xd1, 0xe9, 0x39,
+		0x28, 0x3d, 0x07, 0x85, 0x41, 0xf4, 0xf2, 0x9c,
+		0xde, 0x2e, 0xcf, 0xe7, 0xe1, 0x73, 0xd9, 0x05,
+		0xa2, 0xa3, 0xd3, 0x73, 0x50, 0x7a, 0x0e, 0x0a,
+		0x83, 0xe8, 0xe5, 0x39, 0xbd, 0x5d, 0x9e, 0xcf,
+		0xc3, 0xe7, 0xb2, 0x0b, 0x44, 0x47, 0xa7, 0xe7,
+		0xa0, 0xf4, 0x1c, 0x14, 0x06, 0xd1, 0xcb, 0x73,
+		0x7a, 0xbb, 0x3c, 0x9f, 0x87, 0xcf, 0x65, 0x17,
+		0x88, 0x8e, 0x4e, 0xcf, 0x41, 0xe9, 0x39, 0x28,
+		0x0c, 0xa2, 0x97, 0xe7, 0xf4, 0x76, 0x79, 0x3e,
+		0x0f, 0x9f, 0xcb, 0x2e, 0x10, 0x1d, 0x9d, 0x9e,
+		0x83, 0xd2, 0x73, 0x50, 0x18, 0x44, 0x2f, 0xcf,
+		0xe9, 0xed, 0xf2, 0x7c, 0x1e, 0x3e, 0x97, 0x5d,
+		0xa0, 0x71, 0x9d, 0x0e, 0x42, 0x97, 0xe5, 0x65,
+		0x90, 0xcb, 0xe5, 0x72, 0xb9, 0x74,
+};
+
+static const char splitted_text_part2[] = " this is a second testmessage. end here.";
+#define concatenated_part2_septet_length_with_header 47
+#define concatenated_part2_septet_length 40
+static const uint8_t concatenated_part2_enc[] = {
+		0x05, 0x00, 0x03, 0x6f, 0x02, 0x02,
+		0x40, 0x74, 0x74, 0x7a, 0x0e, 0x4a, 0xcf, 0x41,
+		0x61, 0xd0, 0xbc, 0x3c, 0x7e, 0xbb, 0xc9, 0x20,
+		0x7a, 0x79, 0x4e, 0x6f, 0x97, 0xe7, 0xf3, 0xf0,
+		0xb9, 0xec, 0x02, 0x95, 0xdd, 0x64, 0x10, 0xba,
+		0x2c, 0x2f, 0xbb, 0x00,
+};
+
+static const struct test_case test_multiple_encode[] =
+{
+	{
+		.input = concatenated_text,
+		.expected = concatenated_part1_enc,
+		.expected_octet_length = sizeof(concatenated_part1_enc),
+		.expected_septet_length = concatenated_part1_septet_length,
+		.ud_hdr_ind = 1,
+	},
+	{
+		.input = concatenated_text,
+		.expected = concatenated_part2_enc,
+		.expected_octet_length = sizeof(concatenated_part2_enc),
+		.expected_septet_length = concatenated_part2_septet_length,
+		.ud_hdr_ind = 1,
+	},
+};
+
+static const struct test_case test_encode[] =
+{
+	{
+		.input = simple_text,
+		.expected = simple_enc,
+		.expected_octet_length = sizeof(simple_enc),
+		.expected_septet_length = simple_septet_length,
+		.ud_hdr_ind = 0,
+	},
+	{
+		.input = escape_text,
+		.expected = escape_enc,
+		.expected_octet_length = sizeof(escape_enc),
+		.expected_septet_length = escape_septet_length,
+		.ud_hdr_ind = 0,
+	},
+	{
+		.input = enhanced_text,
+		.expected = enhanced_enc,
+		.expected_octet_length = sizeof(enhanced_enc),
+		.expected_septet_length = enhanced_septet_length,
+		.ud_hdr_ind = 0,
+	},
+	{
+		.input = enhancedV2_text,
+		.expected = enhancedV2_enc,
+		.expected_octet_length = sizeof(enhancedV2_enc),
+		.expected_septet_length = enhancedV2_septet_length,
+		.ud_hdr_ind = 0,
+	},
+};
+
+static const struct test_case test_decode[] =
+{
+	{
+		.input = simple_enc,
+		.input_length = sizeof(simple_enc),
+		.expected = simple_text,
+		.expected_septet_length = simple_septet_length,
+		.ud_hdr_ind = 0,
+	},
+	{
+		.input = escape_enc,
+		.input_length = sizeof(escape_enc),
+		.expected = escape_text,
+		.expected_septet_length = escape_septet_length,
+		.ud_hdr_ind = 0,
+	},
+	{
+		.input = enhanced_enc,
+		.input_length = sizeof(enhanced_enc),
+		.expected = enhanced_text,
+		.expected_septet_length = enhanced_septet_length,
+		.ud_hdr_ind = 0,
+	},
+	{
+		.input = enhancedV2_enc,
+		.input_length = sizeof(enhancedV2_enc),
+		.expected = enhancedV2_text,
+		.expected_septet_length = enhancedV2_septet_length,
+		.ud_hdr_ind = 0,
+	},
+	{
+		.input = concatenated_part1_enc,
+		.input_length = sizeof(concatenated_part1_enc),
+		.expected = splitted_text_part1,
+		.expected_septet_length = concatenated_part1_septet_length_with_header,
+		.ud_hdr_ind = 1,
+	},
+	{
+		.input = concatenated_part2_enc,
+		.input_length = sizeof(concatenated_part2_enc),
+		.expected = splitted_text_part2,
+		.expected_septet_length = concatenated_part2_septet_length_with_header,
+		.ud_hdr_ind = 1,
+	},
+};
+
+int main(int argc, char** argv)
+{
+	printf("SMS testing\n");
+	struct msgb *msg;
+	uint8_t i;
+
+	uint8_t octet_length;
+	uint8_t septet_length;
+	uint8_t gsm_septet_length;
+	uint8_t coded[256];
+	uint8_t tmp[160];
+	uint8_t septet_data[256];
+	uint8_t ud_header[6];
+	char result[256];
+
+	/* test 7-bit encoding */
+	for (i = 0; i < ARRAY_SIZE(test_encode); ++i) {
+		memset(coded, 0x42, sizeof(coded));
+		septet_length = gsm_7bit_encode(coded, test_encode[i].input);
+		octet_length = gsm_get_octet_len(septet_length);
+		if (octet_length != test_encode[i].expected_octet_length) {
+			fprintf(stderr, "Encode case %d: Octet length failure. Got %d, expected %d\n",
+				i, octet_length, test_encode[i].expected_octet_length);
+			return -1;
+		}
+
+		if (septet_length != test_encode[i].expected_septet_length){
+			fprintf(stderr, "Encode case %d: Septet length failure. Got %d, expected %d\n",
+				i, septet_length, test_encode[i].expected_septet_length);
+			return -1;
+		}
+
+		if (memcmp(coded, test_encode[i].expected, octet_length) != 0) {
+			fprintf(stderr, "Encoded content does not match for case %d\n",
+				i);
+			return -1;
+		}
+	}
+
+
+	/* Test: encode multiple SMS */
+	int number_of_septets = gsm_septet_encode(septet_data, test_multiple_encode[0].input);
+
+	/* SMS part 1 */
+	memset(tmp, 0x42, sizeof(tmp));
+	memset(coded, 0x42, sizeof(coded));
+	memcpy(tmp, septet_data, concatenated_part1_septet_length);
+
+	/* In our case: test_multiple_decode[0].ud_hdr_ind equals number of padding bits*/
+	octet_length = gsm_septets2octets(coded, tmp, concatenated_part1_septet_length, test_multiple_encode[0].ud_hdr_ind);
+
+	/* copy header */
+	memset(tmp, 0x42, sizeof(tmp));
+	int udh_length = test_multiple_encode[0].expected[0] + 1;
+	memcpy(tmp, test_multiple_encode[0].expected, udh_length);
+	memcpy(tmp + udh_length, coded, octet_length);
+	memset(coded, 0x42, sizeof(coded));
+	memcpy(coded, tmp, octet_length + 6);
+
+	if (memcmp(coded, test_multiple_encode[0].expected, octet_length) != 0) {
+		fprintf(stderr, "Multiple-SMS encoded content does not match for part 1\n");
+		return -1;
+	}
+
+
+	/* SMS part 2 */
+	memset(tmp, 0x42, sizeof(tmp));
+	memset(coded, 0x42, sizeof(coded));
+	memcpy(tmp, septet_data + concatenated_part1_septet_length, concatenated_part2_septet_length);
+
+	/* In our case: test_multiple_decode[1].ud_hdr_ind equals number of padding bits*/
+	octet_length = gsm_septets2octets(coded, tmp, concatenated_part2_septet_length, test_multiple_encode[1].ud_hdr_ind);
+
+	/* copy header */
+	memset(tmp, 0x42, sizeof(tmp));
+	udh_length = test_multiple_encode[1].expected[0] + 1;
+	memcpy(tmp, test_multiple_encode[1].expected, udh_length);
+	memcpy(tmp + udh_length, coded, octet_length);
+	memset(coded, 0x42, sizeof(coded));
+	memcpy(coded, tmp, octet_length + 6);
+
+	if (memcmp(coded, test_multiple_encode[1].expected, octet_length) != 0) {
+		fprintf(stderr, "Multiple-SMS encoded content does not match for part 2\n");
+		return -1;
+	}
+
+
+
+	/* test 7-bit decoding */
+	for (i = 0; i < ARRAY_SIZE(test_decode); ++i) {
+		memset(result, 0x42, sizeof(coded));
+		septet_length = gsm_7bit_decode_hdr(result, test_decode[i].input,
+				test_decode[i].expected_septet_length, test_decode[i].ud_hdr_ind);
+
+		if (strcmp(result, test_decode[i].expected) != 0) {
+			fprintf(stderr, "Test case %d failed to decode.\n", i);
+			return -1;
+		}
+		if (septet_length != test_decode[i].expected_septet_length) {
+			fprintf(stderr, "Decode case %d: Septet length failure. Got %d, expected %d\n",
+				i, septet_length, test_decode[i].expected_septet_length);
+			return -1;
+		}
+	}
+
+	printf("OK\n");
+	return 0;
+}
diff --git a/src/shared/libosmocore/tests/sms/sms_test.ok b/src/shared/libosmocore/tests/sms/sms_test.ok
new file mode 100644
index 00000000..d0e09838
--- /dev/null
+++ b/src/shared/libosmocore/tests/sms/sms_test.ok
@@ -0,0 +1,2 @@
+SMS testing
+OK
diff --git a/src/shared/libosmocore/tests/smscb/smscb_test.c b/src/shared/libosmocore/tests/smscb/smscb_test.c
new file mode 100644
index 00000000..e10e12d8
--- /dev/null
+++ b/src/shared/libosmocore/tests/smscb/smscb_test.c
@@ -0,0 +1,41 @@
+/*
+ * (C) 2010 Holger Hans Peter Freyther
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/gsm/protocol/gsm_03_41.h>
+
+#include <stdio.h>
+
+static uint8_t smscb_msg[] = { 0x40, 0x10, 0x05, 0x0d, 0x01, 0x11 };
+
+int main(int argc, char **argv)
+{
+	struct gsm341_ms_message *msg;
+
+	msg = (struct gsm341_ms_message *) smscb_msg;
+	printf("(srl) GS: %d MSG_CODE: %d UPDATE: %d\n",
+		msg->serial.gs, GSM341_MSG_CODE(msg), msg->serial.update);
+	printf("(msg) msg_id: %d\n", htons(msg->msg_id));
+	printf("(dcs) group: %d language: %d\n",
+		msg->dcs.language, msg->dcs.group);
+	printf("(pge) page total: %d current: %d\n",
+		msg->page.total, msg->page.current);
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/tests/smscb/smscb_test.ok b/src/shared/libosmocore/tests/smscb/smscb_test.ok
new file mode 100644
index 00000000..347037f8
--- /dev/null
+++ b/src/shared/libosmocore/tests/smscb/smscb_test.ok
@@ -0,0 +1,4 @@
+(srl) GS: 1 MSG_CODE: 1 UPDATE: 0
+(msg) msg_id: 1293
+(dcs) group: 1 language: 0
+(pge) page total: 1 current: 1
diff --git a/src/shared/libosmocore/tests/testsuite.at b/src/shared/libosmocore/tests/testsuite.at
new file mode 100644
index 00000000..1cfae03c
--- /dev/null
+++ b/src/shared/libosmocore/tests/testsuite.at
@@ -0,0 +1,93 @@
+AT_INIT
+AT_BANNER([Regression tests.])
+
+
+# todo.. create one macro for it
+AT_SETUP([a5])
+AT_KEYWORDS([a5])
+cat $abs_srcdir/a5/a5_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/a5/a5_test], [], [expout])
+AT_CLEANUP
+
+AT_SETUP([bssgp-fc])
+AT_KEYWORDS([bssgp-fc])
+cat $abs_srcdir/gb/bssgp_fc_tests.ok > expout
+cat $abs_srcdir/gb/bssgp_fc_tests.err > experr
+AT_CHECK([$abs_top_srcdir/tests/gb/bssgp_fc_tests.sh $abs_top_builddir/tests/gb], [], [expout], [experr])
+AT_CLEANUP
+
+AT_SETUP([bits])
+AT_KEYWORDS([bits])
+cat $abs_srcdir/bits/bitrev_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/bits/bitrev_test], [], [expout])
+AT_CLEANUP
+
+AT_SETUP([conv])
+AT_KEYWORDS([conv])
+cat $abs_srcdir/conv/conv_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/conv/conv_test], [], [expout])
+AT_CLEANUP
+
+if ENABLE_MSGFILE
+AT_SETUP([msgfile])
+AT_KEYWORDS([msgfile])
+cp $abs_srcdir/msgfile/msgconfig.cfg .
+cat $abs_srcdir/msgfile/msgfile_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/msgfile/msgfile_test], [], [expout])
+AT_CLEANUP
+endif
+
+AT_SETUP([sms])
+AT_KEYWORDS([sms])
+cat $abs_srcdir/sms/sms_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/sms/sms_test], [], [expout])
+AT_CLEANUP
+
+AT_SETUP([smscb])
+AT_KEYWORDS([smscb])
+cat $abs_srcdir/smscb/smscb_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/smscb/smscb_test], [], [expout])
+AT_CLEANUP
+
+AT_SETUP([timer])
+AT_KEYWORDS([timer])
+cat $abs_srcdir/timer/timer_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/timer/timer_test -s 5], [], [expout], [ignore])
+AT_CLEANUP
+
+AT_SETUP([ussd])
+AT_KEYWORDS([ussd])
+cat $abs_srcdir/ussd/ussd_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/ussd/ussd_test], [], [expout], [ignore])
+AT_CLEANUP
+
+AT_SETUP([auth])
+AT_KEYWORDS([auth])
+cat $abs_srcdir/auth/milenage_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/auth/milenage_test], [], [expout], [ignore])
+AT_CLEANUP
+
+AT_SETUP([lapd])
+AT_KEYWORDS([lapd])
+cat $abs_srcdir/lapd/lapd_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/lapd/lapd_test], [], [expout], [ignore])
+AT_CLEANUP
+
+AT_SETUP([gsm0808])
+AT_KEYWORDS([gsm0808])
+cat $abs_srcdir/gsm0808/gsm0808_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/gsm0808/gsm0808_test], [], [expout], [ignore])
+AT_CLEANUP
+
+AT_SETUP([gsm0408])
+AT_KEYWORDS([gsm0408])
+cat $abs_srcdir/gsm0408/gsm0408_test.ok > expout
+AT_CHECK([$abs_top_builddir/tests/gsm0408/gsm0408_test], [], [expout], [ignore])
+AT_CLEANUP
+
+AT_SETUP([logging])
+AT_KEYWORDS([logging])
+cat $abs_srcdir/logging/logging_test.ok > expout
+cat $abs_srcdir/logging/logging_test.err > experr
+AT_CHECK([$abs_top_builddir/tests/logging/logging_test], [], [expout], [experr])
+AT_CLEANUP
diff --git a/src/shared/libosmocore/tests/timer/timer_test.c b/src/shared/libosmocore/tests/timer/timer_test.c
new file mode 100644
index 00000000..ba3127d4
--- /dev/null
+++ b/src/shared/libosmocore/tests/timer/timer_test.c
@@ -0,0 +1,192 @@
+/*
+ * (C) 2008 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * Authors: Holger Hans Peter Freyther <zecke@selfish.org>
+ *	    Pablo Neira Ayuso <pablo@gnumonks.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <getopt.h>
+#include <unistd.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/linuxlist.h>
+
+#include "../../config.h"
+
+static void main_timer_fired(void *data);
+static void secondary_timer_fired(void *data);
+
+static unsigned int main_timer_step = 0;
+static struct osmo_timer_list main_timer = {
+	.cb = main_timer_fired,
+	.data = &main_timer_step,
+};
+
+static LLIST_HEAD(timer_test_list);
+
+struct test_timer {
+	struct llist_head head;
+	struct osmo_timer_list timer;
+	struct timeval start;
+	struct timeval stop;
+};
+
+/* number of test steps. We add fact(steps) timers in the whole test. */
+#define MAIN_TIMER_NSTEPS	16
+
+/* time between two steps, in secs. */
+#define TIME_BETWEEN_STEPS	1
+
+/* timer imprecision that we accept for this test: 10 milliseconds. */
+#define TIMER_PRES_SECS		0
+#define TIMER_PRES_USECS	20000
+
+static int timer_nsteps = MAIN_TIMER_NSTEPS;
+static unsigned int expired_timers = 0;
+static unsigned int total_timers = 0;
+static unsigned int too_late = 0;
+
+static void main_timer_fired(void *data)
+{
+	unsigned int *step = data;
+	unsigned int add_in_this_step;
+	int i;
+
+	if (*step == timer_nsteps) {
+		fprintf(stderr, "Main timer has finished, please, "
+				"wait a bit for the final report.\n");
+		return;
+	}
+	/* add 2^step pair of timers per step. */
+	add_in_this_step = (1 << *step);
+
+	for (i=0; i<add_in_this_step; i++) {
+		struct test_timer *v;
+
+		v = talloc_zero(NULL, struct test_timer);
+		if (v == NULL) {
+			fprintf(stderr, "timer_test: OOM!\n");
+			return;
+		}
+		gettimeofday(&v->start, NULL);
+		v->timer.cb = secondary_timer_fired;
+		v->timer.data = v;
+		unsigned int seconds = (random() % 10) + 1;
+		v->stop.tv_sec = v->start.tv_sec + seconds;
+		osmo_timer_schedule(&v->timer, seconds, 0);
+		llist_add(&v->head, &timer_test_list);
+	}
+	fprintf(stderr, "added %d timers in step %u (expired=%u)\n",
+		add_in_this_step, *step, expired_timers);
+	total_timers += add_in_this_step;
+	osmo_timer_schedule(&main_timer, TIME_BETWEEN_STEPS, 0);
+	(*step)++;
+}
+
+static void secondary_timer_fired(void *data)
+{
+	struct test_timer *v = data, *this, *tmp;
+	struct timeval current, res, precision = { 1, 0 };
+
+	gettimeofday(&current, NULL);
+
+	timersub(&current, &v->stop, &res);
+	if (timercmp(&res, &precision, >)) {
+		fprintf(stderr, "ERROR: timer %p has expired too late!\n",
+			v->timer);
+		too_late++;
+	}
+
+	llist_del(&v->head);
+	talloc_free(data);
+	expired_timers++;
+	if (expired_timers == total_timers) {
+		fprintf(stdout, "test over: added=%u expired=%u too_late=%u \n",
+			total_timers, expired_timers, too_late);
+		exit(EXIT_SUCCESS);
+	}
+
+	/* randomly (10%) deletion of timers. */
+	llist_for_each_entry_safe(this, tmp, &timer_test_list, head) {
+		if ((random() % 100) < 10) {
+			osmo_timer_del(&this->timer);
+			llist_del(&this->head);
+			talloc_free(this);
+			expired_timers++;
+		}
+	}
+}
+
+static void alarm_handler(int signum)
+{
+	fprintf(stderr, "ERROR: We took too long to run the timer test, "
+			"something seems broken, aborting.\n");
+	exit(EXIT_FAILURE);
+}
+
+int main(int argc, char *argv[])
+{
+	int c;
+
+	if (signal(SIGALRM, alarm_handler) == SIG_ERR) {
+		perror("cannot register signal handler");
+		exit(EXIT_FAILURE);
+	}
+
+	while ((c = getopt_long(argc, argv, "s:", NULL, NULL)) != -1) {
+	switch(c) {
+		case 's':
+			timer_nsteps = atoi(optarg);
+			if (timer_nsteps <= 0) {
+				fprintf(stderr, "%s: steps must be > 0\n",
+					argv[0]);
+				exit(EXIT_FAILURE);
+			}
+			break;
+		default:
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	fprintf(stdout, "Running timer test for %u steps, accepting "
+		"imprecision of %u.%.6u seconds\n",
+		timer_nsteps, TIMER_PRES_SECS, TIMER_PRES_USECS);
+
+	osmo_timer_schedule(&main_timer, 1, 0);
+
+	/* if the test takes too long, we may consider that the timer scheduler
+	 * has hung. We set some maximum wait time which is the double of the
+	 * maximum timeout randomly set (10 seconds, worst case) plus the
+	 * number of steps (since some of them are reset each step). */
+	alarm(2 * (10 + timer_nsteps));
+
+#ifdef HAVE_SYS_SELECT_H
+	while (1) {
+		osmo_select_main(0);
+	}
+#else
+	fprintf(stdout, "Select not supported on this platform!\n");
+#endif
+}
diff --git a/src/shared/libosmocore/tests/timer/timer_test.ok b/src/shared/libosmocore/tests/timer/timer_test.ok
new file mode 100644
index 00000000..1bb382ee
--- /dev/null
+++ b/src/shared/libosmocore/tests/timer/timer_test.ok
@@ -0,0 +1,2 @@
+Running timer test for 5 steps, accepting imprecision of 0.020000 seconds
+test over: added=31 expired=31 too_late=0 
diff --git a/src/shared/libosmocore/tests/ussd/ussd_test.c b/src/shared/libosmocore/tests/ussd/ussd_test.c
new file mode 100644
index 00000000..55384f10
--- /dev/null
+++ b/src/shared/libosmocore/tests/ussd/ussd_test.c
@@ -0,0 +1,97 @@
+/*
+ * (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/core/application.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/gsm/gsm0480.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static const uint8_t ussd_request[] = {
+	0x0b, 0x7b, 0x1c, 0x15, 0xa1, 0x13, 0x02, 0x01,
+	0x03, 0x02, 0x01, 0x3b, 0x30, 0x0b, 0x04, 0x01,
+	0x0f, 0x04, 0x06, 0x2a, 0xd5, 0x4c, 0x16, 0x1b,
+	0x01, 0x7f, 0x01, 0x00
+};
+
+static int parse_ussd(const uint8_t *_data, int len)
+{
+	uint8_t *data;
+	int rc;
+	struct ussd_request req;
+	struct gsm48_hdr *hdr;
+
+	data = malloc(len);
+	memcpy(data, _data, len);
+	hdr = (struct gsm48_hdr *) &data[0];
+	rc = gsm0480_decode_ussd_request(hdr, len, &req);
+	free(data);
+
+	return rc;
+}
+
+static int parse_mangle_ussd(const uint8_t *_data, int len)
+{
+	uint8_t *data;
+	int rc;
+	struct ussd_request req;
+	struct gsm48_hdr *hdr;
+
+	data = malloc(len);
+	memcpy(data, _data, len);
+	hdr = (struct gsm48_hdr *) &data[0];
+	hdr->data[1] = len - sizeof(*hdr) - 2;
+	rc = gsm0480_decode_ussd_request(hdr, len, &req);
+	free(data);
+
+	return rc;
+}
+
+struct log_info info = {};
+
+int main(int argc, char **argv)
+{
+	struct ussd_request req;
+	const int size = sizeof(ussd_request);
+	int i;
+
+	osmo_init_logging(&info);
+
+	gsm0480_decode_ussd_request((struct gsm48_hdr *) ussd_request, size, &req);
+	printf("Tested if it still works. Text was: %s\n", req.text);
+
+
+	printf("Testing parsing a USSD request and truncated versions\n");
+
+	for (i = size; i > sizeof(struct gsm48_hdr); --i) {
+		int rc = parse_ussd(&ussd_request[0], i);
+		printf("Result for %d is %d\n", rc, i);
+	}
+
+	printf("Mangling the container now\n");
+	for (i = size; i > sizeof(struct gsm48_hdr) + 2; --i) {
+		int rc = parse_mangle_ussd(&ussd_request[0], i);
+		printf("Result for %d is %d\n", rc, i);
+	}
+
+	return 0;
+}
diff --git a/src/shared/libosmocore/tests/ussd/ussd_test.ok b/src/shared/libosmocore/tests/ussd/ussd_test.ok
new file mode 100644
index 00000000..1b6316e8
--- /dev/null
+++ b/src/shared/libosmocore/tests/ussd/ussd_test.ok
@@ -0,0 +1,53 @@
+Tested if it still works. Text was: **321#
+Testing parsing a USSD request and truncated versions
+Result for 1 is 28
+Result for 1 is 27
+Result for 1 is 26
+Result for 1 is 25
+Result for 0 is 24
+Result for 0 is 23
+Result for 0 is 22
+Result for 0 is 21
+Result for 0 is 20
+Result for 0 is 19
+Result for 0 is 18
+Result for 0 is 17
+Result for 0 is 16
+Result for 0 is 15
+Result for 0 is 14
+Result for 0 is 13
+Result for 0 is 12
+Result for 0 is 11
+Result for 0 is 10
+Result for 0 is 9
+Result for 0 is 8
+Result for 0 is 7
+Result for 0 is 6
+Result for 0 is 5
+Result for 0 is 4
+Result for 0 is 3
+Mangling the container now
+Result for 0 is 28
+Result for 0 is 27
+Result for 1 is 26
+Result for 1 is 25
+Result for 0 is 24
+Result for 0 is 23
+Result for 0 is 22
+Result for 0 is 21
+Result for 0 is 20
+Result for 0 is 19
+Result for 0 is 18
+Result for 0 is 17
+Result for 0 is 16
+Result for 0 is 15
+Result for 0 is 14
+Result for 0 is 13
+Result for 0 is 12
+Result for 0 is 11
+Result for 0 is 10
+Result for 0 is 9
+Result for 0 is 8
+Result for 0 is 7
+Result for 0 is 6
+Result for 1 is 5
diff --git a/src/shared/libosmocore/utils/Makefile.am b/src/shared/libosmocore/utils/Makefile.am
new file mode 100644
index 00000000..4e7869e4
--- /dev/null
+++ b/src/shared/libosmocore/utils/Makefile.am
@@ -0,0 +1,10 @@
+if ENABLE_UTILITIES
+INCLUDES = $(all_includes) -I$(top_srcdir)/include
+noinst_PROGRAMS = osmo-arfcn osmo-auc-gen
+
+osmo_arfcn_SOURCES = osmo-arfcn.c
+osmo_arfcn_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la
+
+osmo_auc_gen_SOURCES = osmo-auc-gen.c
+osmo_auc_gen_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la
+endif
diff --git a/src/shared/libosmocore/utils/gen_website_doc_tree.sh b/src/shared/libosmocore/utils/gen_website_doc_tree.sh
new file mode 100755
index 00000000..622db56d
--- /dev/null
+++ b/src/shared/libosmocore/utils/gen_website_doc_tree.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+TOPDIR=`pwd`
+INDIR="$TOPDIR/doc"
+OUTDIR=/tmp/doxywww
+GITREV=`./git-version-gen .tarball-version`
+
+[ -f "$OUTDIR" ] || mkdir "$OUTDIR"
+
+for MOD in core gsm vty codec; do
+	TGTDIR="$OUTDIR/libosmo$MOD/$GITREV"
+	mkdir -p "$TGTDIR"
+	cp -R "$INDIR/$MOD/"* "$TGTDIR/"
+done
diff --git a/src/shared/libosmocore/utils/osmo-arfcn.c b/src/shared/libosmocore/utils/osmo-arfcn.c
new file mode 100644
index 00000000..15adbca2
--- /dev/null
+++ b/src/shared/libosmocore/utils/osmo-arfcn.c
@@ -0,0 +1,103 @@
+/* Utility program for ARFCN / frequency calculations */
+/*
+ * (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <getopt.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+
+enum program_mode {
+	MODE_NONE,
+	MODE_A2F,
+	MODE_F2A,
+};
+
+static int arfcn2freq(char *arfcn_str)
+{
+	int arfcn = atoi(arfcn_str);
+	uint16_t freq10u, freq10d;
+
+	if (arfcn < 0 || arfcn > 0xffff) {
+		fprintf(stderr, "Invalid ARFCN %d\n", arfcn);
+		return -EINVAL;
+	}
+
+	freq10u = gsm_arfcn2freq10(arfcn, 1);
+	freq10d = gsm_arfcn2freq10(arfcn, 0);
+	if (freq10u == 0xffff || freq10d == 0xffff) {
+		fprintf(stderr, "Error during conversion of ARFCN %d\n",
+			arfcn);
+		return -EINVAL;
+	}
+
+	printf("ARFCN %4d: Uplink %4u.%1u MHz / Downlink %4u.%1u MHz\n",
+		arfcn, freq10u/10, freq10u%10, freq10d/10, freq10d%10);
+
+	return 0;
+}
+
+static void help(const char *progname)
+{
+	printf("Usage: %s [-h] [-a arfcn] [-f freq] [-u|-d]\n",
+		progname);
+}
+
+int main(int argc, char **argv)
+{
+	int opt;
+	char *param;
+	enum program_mode mode = MODE_NONE;
+
+	while ((opt = getopt(argc, argv, "a:f:ud")) != -1) {
+		switch (opt) {
+		case 'a':
+			mode = MODE_A2F;
+			param = optarg;
+			break;
+		case 'f':
+			mode = MODE_F2A;
+			param = optarg;
+			break;
+		case 'h':
+			help(argv[0]);
+			exit(0);
+			break;
+		default:
+			break;
+		}
+	}
+
+	switch (mode) {
+	case MODE_NONE:
+		help(argv[0]);
+		exit(2);
+		break;
+	case MODE_A2F:
+		arfcn2freq(param);
+		break;
+	}
+
+	exit(0);
+}
diff --git a/src/shared/libosmocore/utils/osmo-auc-gen.c b/src/shared/libosmocore/utils/osmo-auc-gen.c
new file mode 100644
index 00000000..7a3c124c
--- /dev/null
+++ b/src/shared/libosmocore/utils/osmo-auc-gen.c
@@ -0,0 +1,252 @@
+/* GSM/GPRS/3G authentication testing tool */
+
+/* (C) 2010-2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <getopt.h>
+#include <unistd.h>
+
+#include <osmocom/crypt/auth.h>
+#include <osmocom/core/utils.h>
+
+static void dump_triplets_dat(struct osmo_auth_vector *vec)
+{
+	if (vec->auth_types & OSMO_AUTH_TYPE_UMTS) {
+		fprintf(stderr, "triplets.dat doesn't support UMTS!\n");
+		return;
+	}
+	printf("imsi,");
+	printf("%s,", osmo_hexdump_nospc(vec->rand, sizeof(vec->rand)));
+	printf("%s,", osmo_hexdump_nospc(vec->sres, sizeof(vec->sres)));
+	printf("%s\n", osmo_hexdump_nospc(vec->kc, sizeof(vec->kc)));
+}
+
+static void dump_auth_vec(struct osmo_auth_vector *vec)
+{
+	printf("RAND:\t%s\n", osmo_hexdump(vec->rand, sizeof(vec->rand)));
+
+	if (vec->auth_types & OSMO_AUTH_TYPE_UMTS) {
+		printf("AUTN:\t%s\n", osmo_hexdump(vec->autn, sizeof(vec->autn)));
+		printf("IK:\t%s\n", osmo_hexdump(vec->ik, sizeof(vec->ik)));
+		printf("CK:\t%s\n", osmo_hexdump(vec->ck, sizeof(vec->ck)));
+		printf("RES:\t%s\n", osmo_hexdump(vec->res, vec->res_len));
+	}
+
+	if (vec->auth_types & OSMO_AUTH_TYPE_GSM) {
+		printf("SRES:\t%s\n", osmo_hexdump(vec->sres, sizeof(vec->sres)));
+		printf("Kc:\t%s\n", osmo_hexdump(vec->kc, sizeof(vec->kc)));
+	}
+}
+
+static struct osmo_sub_auth_data test_aud = {
+	.type = OSMO_AUTH_TYPE_NONE,
+	.algo = OSMO_AUTH_ALG_NONE,
+};
+
+static void help()
+{
+	printf( "-2  --2g\tUse 2G (GSM) authentication\n"
+		"-3  --3g\tUse 3G (UMTS) authentication\n"
+		"-a  --algorithm\tSpecify name of the algorithm\n"
+		"-k  --key\tSpecify Ki / K\n"
+		"-o  --opc\tSpecify OPC (only for 3G)\n"
+		"-O  --op\tSpecify OP (only for 3G)\n"
+		"-a  --amf\tSpecify AMF (only for 3G)\n"
+		"-s  --sqn\tSpecify SQN (only for 3G)\n"
+		"-A  --auts\tSpecify AUTS (only for 3G)\n"
+		"-r  --rand\tSpecify random value\n"
+		"-I  --ipsec\tOutput in triplets.dat format for strongswan\n");
+}
+
+int main(int argc, char **argv)
+{
+	struct osmo_auth_vector _vec;
+	struct osmo_auth_vector *vec = &_vec;
+	uint8_t _rand[16], _auts[16];
+	int rc, option_index;
+	int rand_is_set = 0;
+	int auts_is_set = 0;
+	int fmt_triplets_dat = 0;
+
+	printf("osmo-auc-gen (C) 2011-2012 by Harald Welte\n");
+	printf("This is FREE SOFTWARE with ABSOLUTELY NO WARRANTY\n\n");
+
+	memset(_auts, 0, sizeof(_auts));
+
+	while (1) {
+		int c;
+		unsigned long ul;
+		static struct option long_options[] = {
+			{ "2g", 0, 0, '2' },
+			{ "3g", 0, 0, '3' },
+			{ "algorithm", 1, 0, 'a' },
+			{ "key", 1, 0, 'k' },
+			{ "opc", 1, 0, 'o' },
+			{ "op", 1, 0, 'O' },
+			{ "amf", 1, 0, 'f' },
+			{ "sqn", 1, 0, 's' },
+			{ "rand", 1, 0, 'r' },
+			{ "auts", 1, 0, 'A' },
+			{ "help", 0, 0, 'h' },
+			{ 0, 0, 0, 0 }
+		};
+
+		rc = 0;
+
+		c = getopt_long(argc, argv, "23a:k:o:f:s:r:hO:A:I", long_options,
+				&option_index);
+
+		if (c == -1)
+			break;
+
+		switch (c) {
+		case '2':
+			test_aud.type = OSMO_AUTH_TYPE_GSM;
+			break;
+		case '3':
+			test_aud.type = OSMO_AUTH_TYPE_UMTS;
+			break;
+		case 'a':
+			rc = osmo_auth_alg_parse(optarg);
+			if (rc < 0)
+				break;
+			test_aud.algo = rc;
+			break;
+		case 'k':
+			switch (test_aud.type) {
+			case OSMO_AUTH_TYPE_GSM:
+				rc = osmo_hexparse(optarg, test_aud.u.gsm.ki,
+						   sizeof(test_aud.u.gsm.ki));
+				break;
+			case OSMO_AUTH_TYPE_UMTS:
+				rc = osmo_hexparse(optarg, test_aud.u.umts.k,
+						   sizeof(test_aud.u.umts.k));
+				break;
+			default:
+				fprintf(stderr, "please specify 2g/3g first!\n");
+			}
+			break;
+		case 'o':
+			if (test_aud.type != OSMO_AUTH_TYPE_UMTS) {
+				fprintf(stderr, "Only UMTS has OPC\n");
+				exit(2);
+			}
+			rc = osmo_hexparse(optarg, test_aud.u.umts.opc,
+					   sizeof(test_aud.u.umts.opc));
+			test_aud.u.umts.opc_is_op = 0;
+			break;
+		case 'O':
+			if (test_aud.type != OSMO_AUTH_TYPE_UMTS) {
+				fprintf(stderr, "Only UMTS has OP\n");
+				exit(2);
+			}
+			rc = osmo_hexparse(optarg, test_aud.u.umts.opc,
+					   sizeof(test_aud.u.umts.opc));
+			test_aud.u.umts.opc_is_op = 1;
+			break;
+		case 'A':
+			if (test_aud.type != OSMO_AUTH_TYPE_UMTS) {
+				fprintf(stderr, "Only UMTS has AUTS\n");
+				exit(2);
+			}
+			rc = osmo_hexparse(optarg, _auts, sizeof(_auts));
+			auts_is_set = 1;
+			break;
+		case 'f':
+			if (test_aud.type != OSMO_AUTH_TYPE_UMTS) {
+				fprintf(stderr, "Only UMTS has AMF\n");
+				exit(2);
+			}
+			rc = osmo_hexparse(optarg, test_aud.u.umts.amf,
+					   sizeof(test_aud.u.umts.amf));
+			break;
+		case 's':
+			if (test_aud.type != OSMO_AUTH_TYPE_UMTS) {
+				fprintf(stderr, "Only UMTS has SQN\n");
+				exit(2);
+			}
+			ul = strtoul(optarg, 0, 10);
+			test_aud.u.umts.sqn = ul;
+			break;
+		case 'r':
+			rc = osmo_hexparse(optarg, _rand, sizeof(_rand));
+			rand_is_set = 1;
+			break;
+		case 'I':
+			fmt_triplets_dat = 1;
+			break;
+		case 'h':
+			help();
+			exit(0);
+		default:
+			help();
+			exit(1);
+		}
+
+		if (rc < 0) {
+			fprintf(stderr, "Error parsing argument of option `%c'\n", c);
+			exit(2);
+		}
+	}
+
+	if (!rand_is_set) {
+		printf("WARNING: We're using really weak random numbers!\n\n");
+		srand(time(NULL));
+		*(uint32_t *)&_rand[0] = rand();
+		*(uint32_t *)(&_rand[4]) = rand();
+		*(uint32_t *)(&_rand[8]) = rand();
+		*(uint32_t *)(&_rand[12]) = rand();
+	}
+
+	if (test_aud.type == OSMO_AUTH_TYPE_NONE ||
+	    test_aud.algo == OSMO_AUTH_ALG_NONE) {
+		help();
+		exit(2);
+	}
+
+	memset(vec, 0, sizeof(*vec));
+
+	if (!auts_is_set)
+		rc = osmo_auth_gen_vec(vec, &test_aud, _rand);
+	else
+		rc = osmo_auth_gen_vec_auts(vec, &test_aud, _auts, _rand, _rand);
+	if (rc < 0) {
+		if (!auts_is_set)
+			fprintf(stderr, "error generating auth vector\n");
+		else
+			fprintf(stderr, "AUTS from MS seems incorrect\n");
+		exit(1);
+	}
+
+	if (fmt_triplets_dat)
+		dump_triplets_dat(vec);
+	else
+		dump_auth_vec(vec);
+
+	if (auts_is_set)
+		printf("AUTS success: SEQ.MS = %lu\n", test_aud.u.umts.sqn);
+
+	exit(0);
+}
diff --git a/src/shared/update-libosmocore.sh b/src/shared/update-libosmocore.sh
new file mode 100755
index 00000000..69dfbe11
--- /dev/null
+++ b/src/shared/update-libosmocore.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+(cd ../.. && git subtree pull --prefix=src/shared/libosmocore git://git.osmocom.org/libosmocore.git master)
diff --git a/src/target/firmware/.gitignore b/src/target/firmware/.gitignore
new file mode 100644
index 00000000..79e98dfc
--- /dev/null
+++ b/src/target/firmware/.gitignore
@@ -0,0 +1,9 @@
+*.o
+*.p
+*.a
+*.lst
+*.bin
+*.elf
+*.map
+*.size
+*~
diff --git a/src/target/firmware/COPYING b/src/target/firmware/COPYING
new file mode 100644
index 00000000..d511905c
--- /dev/null
+++ b/src/target/firmware/COPYING
@@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
diff --git a/src/target/firmware/Makefile b/src/target/firmware/Makefile
new file mode 100644
index 00000000..22fa7461
--- /dev/null
+++ b/src/target/firmware/Makefile
@@ -0,0 +1,137 @@
+##
+## Osmocom-BB: Target firmware Makefile
+##
+
+#
+# Environments
+#
+
+ENV_compalram_LDS=board/compal/ram.lds
+ENV_compalram_OBJS=board/compal/start.ram.o board/compal/exceptions_redirected.o board/compal/handlers.o
+
+ENV_highram_LDS=board/compal/highram.lds
+ENV_highram_OBJS=board/compal/start.ram.o board/compal/exceptions_redirected.o board/compal/handlers.o
+
+ENV_e88loader_LDS=board/compal_e88/loader.lds
+ENV_e88loader_OBJS=board/compal/start.rom.o board/compal/header.o board/compal/exceptions_redirect.o
+
+ENV_e88flash_LDS=board/compal_e88/flash.lds
+ENV_e88flash_OBJS=board/compal/start.rom.o board/compal/header.o board/compal/exceptions_redirected.o board/compal/handlers.o
+
+
+#
+# Boards
+#
+
+# List of all supported boards (meant to be overridden on command line)
+BOARDS?=compal_e88 compal_e86 compal_e99 se_j100 gta0x pirelli_dpl10
+
+# Framebuffer support, board specific drivers
+FB_OBJS=fb/framebuffer.o fb/font.o fb/helvR08.o fb/helvB14.o fb/c64.o \
+	fb/symbols.o
+
+FB_e88_OBJS=$(FB_OBJS) fb/fb_bw8.o fb/fb_st7558.o
+FB_e99_OBJS=$(FB_OBJS) fb/fb_rgb332.o fb/fb_ssd1783.o
+FB_e86_OBJS=$(FB_OBJS) fb/fb_rgb332.o fb/fb_td014.o
+FB_j100_OBJS=$(FB_OBJS) fb/fb_rgb332.o fb/fb_ssd1963.o
+FB_dpl10_OBJS=$(FB_OBJS) fb/fb_rgb332.o fb/fb_s6b33b1x.o
+FB_dummy_OBJS=$(FB_OBJS) fb/fb_dummy.o
+
+# TI Calypso
+calypso_COMMON_OBJS=board/common/calypso_uart.o board/common/calypso_pwl.o
+
+# OpenMoko GTA0x
+BOARD_gta0x_OBJS=$(calypso_COMMON_OBJS) board/gta0x/init.o \
+	board/gta0x/rffe_gta0x_triband.o board/gta0x/rf_power.o \
+	battery/dummy.o $(FB_dummy_OBJS)
+BOARD_gta0x_ENVIRONMENTS=highram
+
+# Pirelli DP-L10
+BOARD_pirelli_dpl10_OBJS=$(calypso_COMMON_OBJS) board/pirelli_dpl10/init.o \
+	board/pirelli_dpl10/rffe_dpl10_triband.o board/pirelli_dpl10/rf_power.o \
+	battery/dummy.o $(FB_dpl10_OBJS)
+BOARD_pirelli_dpl10_ENVIRONMENTS=highram
+
+# Compal Generic
+compal_COMMON_OBJS=$(calypso_COMMON_OBJS) \
+	board/compal/rffe_dualband.o board/compal/rf_power.o
+compal_COMMON_ENVIRONMENTS=compalram highram
+
+# Compal E88
+BOARD_compal_e88_OBJS=$(compal_COMMON_OBJS) board/compal_e88/init.o \
+	battery/compal_e88.o $(FB_e88_OBJS)
+BOARD_compal_e88_ENVIRONMENTS=$(compal_COMMON_ENVIRONMENTS) e88loader e88flash
+
+# Compal E86 (has a different RFFE configuration)
+BOARD_compal_e86_OBJS=$(calypso_COMMON_OBJS) board/compal_e86/init.o \
+	board/compal_e86/rffe_dualband_e86.o board/compal/rf_power.o \
+	battery/dummy.o $(FB_e86_OBJS)
+BOARD_compal_e86_ENVIRONMENTS=$(compal_COMMON_ENVIRONMENTS)
+
+# Compal E99
+BOARD_compal_e99_OBJS=$(compal_COMMON_OBJS) board/compal_e99/init.o \
+	battery/dummy.o $(FB_e99_OBJS)
+BOARD_compal_e99_ENVIRONMENTS=$(compal_COMMON_ENVIRONMENTS)
+
+# Sony Ericsson J100 (made by Compal)
+BOARD_se_j100_OBJS=$(compal_COMMON_OBJS) board/se_j100/init.o \
+	battery/dummy.o $(FB_j100_OBJS)
+BOARD_se_j100_ENVIRONMENTS=$(compal_COMMON_ENVIRONMENTS)
+
+
+#
+# Applications
+#
+
+# List of all applications (meant to be overridden on command line)
+APPLICATIONS?=hello_world compal_dsp_dump layer1 loader rssi
+
+# Applications specific env requirements
+APP_loader_ENVIRONMENTS=compalram highram
+APP_rssi_ENVIRONMENTS=* -compalram
+
+# Various objects that are currently linked into all applications
+FLASH_OBJS=flash/cfi_flash.o
+ABB_OBJS=abb/twl3025.o
+RF_OBJS=rf/trf6151.o
+
+# Objects that go in all applications
+ANY_APP_OBJS+=$(ABB_OBJS) $(RF_OBJS) $(FLASH_OBJS)
+ANY_APP_LIBS+=	calypso/libcalypso.a \
+		layer1/liblayer1.a \
+		lib/libmini.a \
+		comm/libcomm.a \
+		../../shared/libosmocore/build-target/src/.libs/libosmocore.a \
+		../../shared/libosmocore/build-target/src/gsm/.libs/libosmogsm.a \
+		../../shared/libosmocore/build-target/src/codec/.libs/libosmocodec.a
+
+
+#
+# Build rules
+#
+
+# Global include path
+INCLUDES=-Iinclude/ -I../../../include -I../../shared/libosmocore/include -I../../shared/libosmocore/build-target/include
+
+# Libraries are defined in subdirectories
+-include calypso/Makefile
+-include layer1/Makefile
+-include comm/Makefile
+-include lib/Makefile
+
+# Include rules
+-include Makefile.inc
+
+
+#
+# Build options
+#
+
+# Uncomment this line if you want to enable Tx (Transmit) Support.
+#CFLAGS += -DCONFIG_TX_ENABLE
+
+# Uncomment this line if you want to write to flash.
+#CFLAGS += -DCONFIG_FLASH_WRITE
+
+# Uncomment this line if you want to write to flash, including the bootloader.
+#CFLAGS += -DCONFIG_FLASH_WRITE_LOADER
diff --git a/src/target/firmware/Makefile.inc b/src/target/firmware/Makefile.inc
new file mode 100644
index 00000000..90498989
--- /dev/null
+++ b/src/target/firmware/Makefile.inc
@@ -0,0 +1,209 @@
+
+#### TOOLCHAIN CONFIGURATION ####
+
+CROSS_COMPILE?=arm-elf-
+
+CC=gcc
+LD=ld
+AR=ar
+SIZE=size
+OBJCOPY=objcopy
+
+DEBUGF=dwarf-2
+
+CFLAGS=-mcpu=arm7tdmi $(INCLUDES)
+CFLAGS += -Wall -Wextra -Wcast-align -Wimplicit -Wunused
+CFLAGS += -Wswitch -Wredundant-decls -Wreturn-type -Wshadow -Wnested-externs
+CFLAGS += -Wbad-function-cast -Wsign-compare -Waggregate-return
+CFLAGS += -Os -ffunction-sections
+CFLAGS += -g$(DEBUGF)
+
+# some older toolchains don't support this, ignore it for now
+#ASFLAGS=--g$(DEBUGF) $(INCLUDES) -D__ASSEMBLY__
+ASFLAGS=$(INCLUDES) -D__ASSEMBLY__
+
+LDFLAGS = -nostartfiles -nostdlib -nodefaultlibs --gc-sections --cref
+
+#### QUIET OUTPUT ####
+
+ifndef V
+  V = 0
+endif
+
+Q_CC = $(if $(V:1=),@echo "  CC     $@";)
+Q_LD = $(if $(V:1=),@echo "  LD     $@";)
+Q_AR = $(if $(V:1=),@echo "  AR     $@";)
+Q_OBJ = $(if $(V:1=),@echo "  OBJ    $@";)
+Q_SIZE = $(if $(V:1=),@echo "  SIZE   $@";)
+
+#### GIT VERSION ####
+
+GIT_COMMIT:=$(shell git describe --always)
+GIT_MODIFIED:=$(shell (git status | grep "modified:\|added:\|deleted:" -q) && echo "-modified")
+
+GIT_REVISION:=$(GIT_COMMIT)$(GIT_MODIFIED)
+
+ASFLAGS += -DGIT_REVISION=\"$(GIT_REVISION)\"
+CFLAGS += -DGIT_REVISION=\"$(GIT_REVISION)\"
+
+#### GLOBAL DATA ####
+
+ALL_OBJS=
+
+ALL_LSTS=$(ALL_OBJS:.o=.lst)
+ALL_DEPS=$(ALL_OBJS:.o=.p)
+
+#### APPLICATION DATA ####
+
+ALL_APPS=
+
+ALL_APP_TARGETS=$(ALL_APPS:.elf=.bin) $(ALL_APPS:.elf=.size) $(ALL_APPS) $(ALL_APPS:.elf=.map)
+
+#### LIBRARY DATA ####
+
+ALL_LIBS=
+
+ALL_LIB_TARGETS=$(ALL_LIBS)
+
+
+#### DEFAULT RULE ####
+
+.PHONY: default
+default: all
+
+
+#### APPLICATION RULES ####
+
+# template for application rules
+define APPLICATION_BOARD_ENVIRONMENT_template
+
+# define set of objects for this binary
+$(1)_$(2)_$(3)_OBJS := apps/$(1)/main.o $(ANY_APP_OBJS) $$(APP_$(1)_OBJS) $$(BOARD_$(2)_OBJS) $$(ENV_$(3)_OBJS)
+$(1)_$(2)_$(3)_LIBS := $(ANY_APP_LIBS)
+
+# define manifest compilation
+board/$(2)/$(1).$(3).manifest.o: board/manifest.c
+	$$(Q_CC)$(CROSS_COMPILE)$(CC) $(CFLAGS) -DAPPLICATION=\"$(1)\" -DBOARD=\"$(2)\" -DENVIRONMENT=\"$(3)\" -c -o $$@ $$<
+
+# generate dummy dependencies for manifest
+board/$(2)/$(1).$(3).manifest.p: board/manifest.c
+	@touch board/$(2)/$(1).$(3).manifest.p
+
+# add manifest object to object list
+$(1)_$(2)_$(3)_OBJS+=board/$(2)/$(1).$(3).manifest.o
+
+# define compilation rule, also generates map file
+board/$(2)/$(1).$(3).elf board/$(2)/$(1).$(3).map: $$($(1)_$(2)_$(3)_OBJS) $$($(1)_$(2)_$(3)_LIBS) $$(ENV_$(3)_LDS)
+	$$(Q_LD)$(CROSS_COMPILE)$(LD) $(LDFLAGS) -T $$(ENV_$(3)_LDS) -Bstatic \
+		-Map board/$(2)/$(1).$(3).map -o board/$(2)/$(1).$(3).elf \
+		--start-group $$($(1)_$(2)_$(3)_OBJS) $$($(1)_$(2)_$(3)_LIBS) --end-group
+
+# define size rule
+board/$(2)/$(1).$(3).size: board/$(2)/$(1).$(3).elf
+	$$(Q_SIZE)$(CROSS_COMPILE)$(SIZE) board/$(2)/$(1).$(3).elf | tee board/$(2)/$(1).$(3).size
+
+ALL_APPS+=board/$(2)/$(1).$(3).elf
+ALL_OBJS+=board/$(2)/$(1).$(3).manifest.o
+
+endef
+
+define BOARD_template
+ALL_OBJS+=$$(BOARD_$(1)_OBJS)
+endef
+
+define BOARD_ENVIRONMENT_template
+ALL_OBJS+=$$(ENV_$(1)_OBJS)
+endef
+
+define APPLICATION_template
+APP_$(1)_SRCS_REL=$$(patsubst %,$$(APP_$(1)_DIR)/%,$$(APP_$(1)_SRCS))
+APP_$(1)_OBJS:=$$(APP_$(1)_SRCS_REL:.c=.o)
+APP_$(1)_OBJS:=$$(APP_$(1)_OBJS:.S=.o)
+
+ALL_OBJS+=$$(APP_$(1)_OBJS) apps/$(1)/main.o
+endef
+
+# define rules for all defined applications
+$(foreach brd,$(BOARDS), \
+	$(eval $(call BOARD_template,$(brd)) \
+	$(foreach env,$(BOARD_$(brd)_ENVIRONMENTS), \
+		$(eval $(call BOARD_ENVIRONMENT_template,$(env))))))
+
+$(foreach app,$(APPLICATIONS), \
+	$(eval $(call APPLICATION_template,$(app))))
+
+$(foreach app,$(APPLICATIONS),                \
+	$(foreach brd,$(BOARDS),                  \
+		$(foreach env,$(shell ./solve_envs.py "$(BOARD_$(brd)_ENVIRONMENTS)" "$(APP_$(app)_ENVIRONMENTS)"), \
+			$(eval $(call APPLICATION_BOARD_ENVIRONMENT_template,$(app),$(brd),$(env))))))
+
+
+# add common things to global lists
+ALL_OBJS+=$(ANY_APP_OBJS)
+
+#### LIBRARY RULES ####
+
+# template for library rules
+define LIBRARY_template
+
+LIB_$(1)_SRCS_REL=$$(patsubst %,$$(LIB_$(1)_DIR)/%,$$(LIB_$(1)_SRCS))
+LIB_$(1)_OBJS:=$$(LIB_$(1)_SRCS_REL:.c=.o)
+LIB_$(1)_OBJS:=$$(LIB_$(1)_OBJS:.S=.o)
+
+$$(LIB_$(1)_DIR)/lib$(1).a: $$(LIB_$(1)_OBJS)
+	$$(Q_AR)$(CROSS_COMPILE)$(AR) cru $$(LIB_$(1)_DIR)/lib$(1).a $$(LIB_$(1)_OBJS)
+
+ALL_LIBS+=$$(LIB_$(1)_DIR)/lib$(1).a
+
+ALL_OBJS+=$$(LIB_$(1)_OBJS)
+
+endef
+
+# define rules for all defined libraries
+$(foreach lbr,$(LIBRARIES),$(eval $(call LIBRARY_template,$(lbr))))
+
+
+#### TOPLEVEL RULES ####
+
+.PHONY: all
+all: $(ALL_DEPS) $(ALL_APPS:.elf=.bin) $(ALL_APPS:.elf=.size)
+
+.PHONY: depend
+depend: $(ALL_DEPS)
+
+
+#### COMPILATION RULES ####
+
+%.p: %.c
+	@$(CROSS_COMPILE)$(CC) $(CFLAGS) -M -o $(*).d $(<)
+	@sed 's|.*\.o:|$(@:.p=.o): |g' < $*.d > $@; rm -f $*.d; [ -s $@ ] || rm -f $@
+
+%.p: %.S
+	@$(CROSS_COMPILE)$(CC) $(ASFLAGS) -M -o $(*).d $(<)
+	@sed 's|.*\.o:|$(@:.p=.o): |g' < $*.d > $@; rm -f $*.d; [ -s $@ ] || rm -f $@
+
+%.o: %.c
+	$(Q_CC)$(CROSS_COMPILE)$(CC) $(CFLAGS) -Wa,-adhlns=$(@:.o=.lst) -c -o $@ $<
+
+%.o: %.S
+	$(Q_CC)$(CROSS_COMPILE)$(CC) $(ASFLAGS) -Wa,-adhlns=$(@:.o=.lst) -c -o $@ $<
+
+
+%.bin: %.elf
+	$(Q_OBJ)$(CROSS_COMPILE)objcopy --gap-fill=0xff -O binary $^ $@
+
+
+#### CLEANUP RULES ####
+
+.PHONY: clean
+clean:
+	rm -f $(ALL_APP_TARGETS) $(ALL_LIB_TARGETS) $(ALL_OBJS) $(ALL_DEPS) $(ALL_LSTS)
+
+.PHONY: distclean
+distclean: clean
+	find . -name '*.o' -or -name '*.bin' -or -name '*.map' -or -name '*.lst' -or -name '*.p' -exec rm '{}' ';'
+
+
+#### DEPENDENCY LOAD ####
+
+-include $(ALL_DEPS)
diff --git a/src/target/firmware/Makefile.mtk b/src/target/firmware/Makefile.mtk
new file mode 100644
index 00000000..927e31a0
--- /dev/null
+++ b/src/target/firmware/Makefile.mtk
@@ -0,0 +1,34 @@
+# List of all supported boards (meant to be overridden on command line)
+BOARDS?=mt62xx
+
+# List of all applications (meant to be overridden on command line)
+APPLICATIONS?=loader_mtk
+
+APP_loader_mtk_ENVIRONMENTS=mtkram
+
+ENV_mtkram_LDS=board/mediatek/ram.lds
+ENV_mtkram_OBJS=board/mediatek/start.ram.o
+
+mtk_COMMON_OBJS=board/mediatek/uart.o
+
+# Mediatek MT62xx
+BOARD_mt62xx_OBJS=$(mtk_COMMON_OBJS) board/mt62xx/init.o
+BOARD_mt62xx_ENVIRONMENTS=mtkram
+
+# Global include path
+INCLUDES=-Iinclude/ -I../../../include -I../../shared/libosmocore/include
+
+FLASH_OBJS=flash/cfi_flash.o
+
+# Objects that go in all applications
+ANY_APP_OBJS+=$(FLASH_OBJS)
+
+# Various objects that are currently linked into all applications
+ANY_APP_LIBS+=lib/libmini.a comm/libcomm.a ../../shared/libosmocore/build-target/src/.libs/libosmocore.a
+
+# Libraries are defined in subdirectories
+-include comm/Makefile
+-include lib/Makefile
+
+# Include rules
+-include Makefile.inc
diff --git a/src/target/firmware/abb/twl3025.c b/src/target/firmware/abb/twl3025.c
new file mode 100644
index 00000000..e4fcf4f0
--- /dev/null
+++ b/src/target/firmware/abb/twl3025.c
@@ -0,0 +1,368 @@
+/* Driver for Analog Baseband Circuit (TWL3025) */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <delay.h>
+#include <memory.h>
+#include <spi.h>
+#include <calypso/irq.h>
+#include <calypso/tsp.h>
+#include <calypso/tpu.h>
+#include <abb/twl3025.h>
+#include <asm/system.h>
+
+/* TWL3025 */
+#define REG_PAGE(n)	(n >> 7)
+#define REG_ADDR(n)	(n & 0x3f)
+
+#define TWL3025_DEV_IDX		0	/* On the SPI bus */
+#define TWL3025_TSP_DEV_IDX	0	/* On the TSP bus */
+
+/* values encountered on a GTA-02 for GSM900 (the same for GSM1800!?) */
+const uint16_t twl3025_default_ramp[16] = {
+	ABB_RAMP_VAL( 0,  0),
+	ABB_RAMP_VAL( 0, 11),
+	ABB_RAMP_VAL( 0, 31),
+	ABB_RAMP_VAL( 0, 31),
+	ABB_RAMP_VAL( 0, 31),
+	ABB_RAMP_VAL( 0, 24),
+	ABB_RAMP_VAL( 0,  0),
+	ABB_RAMP_VAL( 0,  0),
+	ABB_RAMP_VAL( 9,  0),
+	ABB_RAMP_VAL(18,  0),
+	ABB_RAMP_VAL(25,  0),
+	ABB_RAMP_VAL(31,  0),
+	ABB_RAMP_VAL(30,  0),
+	ABB_RAMP_VAL(15,  0),
+	ABB_RAMP_VAL( 0,  0),
+	ABB_RAMP_VAL( 0,  0),
+};
+
+struct twl3025 {
+	uint8_t page;
+};
+static struct twl3025 twl3025_state;
+
+/* Switch the register page of the TWL3025 */
+static void twl3025_switch_page(uint8_t page)
+{
+	if (page == 0)
+		twl3025_reg_write(PAGEREG, 1 << 0);
+	else
+		twl3025_reg_write(PAGEREG, 1 << 1);
+
+	twl3025_state.page = page;
+}
+
+static void handle_charger(void)
+{
+	uint16_t status;
+	printd("handle_charger();");
+
+	status = twl3025_reg_read(VRPCSTS);
+//	printd("\nvrpcsts: 0x%02x", status);
+
+	if (status & 0x40) {
+		printd(" inserted\n");
+	} else {
+		printd(" removed\n");
+	}
+
+//	twl3025_dump_madc();
+}
+
+static void handle_adc_done(void)
+{
+	printd("handle_adc_done();");
+}
+
+static void twl3025_irq(enum irq_nr nr)
+{
+	uint16_t src;
+	printd("twl3025_irq: 0x%02x\n",nr);
+	switch (nr){
+	case IRQ_EXTERNAL: // charger in/out, pwrbtn, adc done
+		src = twl3025_reg_read(ITSTATREG);
+//		printd("itstatreg 0x%02x\n", src);
+		if (src & 0x08)
+			handle_charger();
+		if (src & 0x20)
+			handle_adc_done();
+		break;
+	case IRQ_EXTERNAL_FIQ: // vcc <2.8V emergency power off
+		puts("\nBROWNOUT!1!");
+		twl3025_power_off();
+		break;
+	default:
+		return;
+	}
+}
+
+void twl3025_init(void)
+{
+	spi_init();
+	twl3025_switch_page(0);
+	twl3025_clk13m(1);
+	twl3025_reg_write(AFCCTLADD, 0x01);	/* AFCCK(1:0) must not be zero! */
+	twl3025_unit_enable(TWL3025_UNIT_AFC, 1);
+
+	irq_register_handler(IRQ_EXTERNAL, &twl3025_irq);
+	irq_config(IRQ_EXTERNAL, 0, 0, 0);
+	irq_enable(IRQ_EXTERNAL);
+
+	irq_register_handler(IRQ_EXTERNAL_FIQ, &twl3025_irq);
+	irq_config(IRQ_EXTERNAL_FIQ, 1, 0, 0);
+	irq_enable(IRQ_EXTERNAL_FIQ);
+}
+
+void twl3025_reg_write(uint8_t reg, uint16_t data)
+{
+	uint16_t tx;
+
+	printd("tw3025_reg_write(%u,%u)=0x%04x\n", REG_PAGE(reg),
+		REG_ADDR(reg), data);
+
+	if (reg != PAGEREG && REG_PAGE(reg) != twl3025_state.page)
+		twl3025_switch_page(REG_PAGE(reg));
+
+	tx = ((data & 0x3ff) << 6) | (REG_ADDR(reg) << 1);
+
+	spi_xfer(TWL3025_DEV_IDX, 16, &tx, NULL);
+}
+
+void twl3025_tsp_write(uint8_t data)
+{
+	tsp_write(TWL3025_TSP_DEV_IDX, 7, data);
+}
+
+uint16_t twl3025_reg_read(uint8_t reg)
+{
+	uint16_t tx, rx;
+
+	if (REG_PAGE(reg) != twl3025_state.page)
+		twl3025_switch_page(REG_PAGE(reg));
+
+	tx = (REG_ADDR(reg) << 1) | 1;
+
+	/* A read cycle contains two SPI transfers */
+	spi_xfer(TWL3025_DEV_IDX, 16, &tx, &rx);
+	delay_ms(1);
+	spi_xfer(TWL3025_DEV_IDX, 16, &tx, &rx);
+
+	rx >>= 6;
+
+	printd("tw3025_reg_read(%u,%u)=0x%04x\n", REG_PAGE(reg),
+		REG_ADDR(reg), rx);
+
+	return rx;
+}
+
+static void twl3025_wait_ibic_access(void)
+{
+	/* Wait 6 * 32kHz clock cycles for first IBIC access (187us + 10% = 210us) */
+	delay_ms(1);
+}
+
+void twl3025_power_off(void)
+{
+	unsigned long flags;
+
+	/* turn off all IRQs, since received frames cannot be
+	 * handled form here. (otherwise the message allocation
+	 * runs out of memory) */
+	local_firq_save(flags);
+
+	/* poll PWON status and power off the phone when the
+	 * powerbutton has been released (otherwise it will
+	 * poweron immediately again) */
+	while (!(twl3025_reg_read(VRPCSTS) & 0x10)) { };
+	twl3025_reg_write(VRPCDEV, 0x01);
+}
+
+void twl3025_clk13m(int enable)
+{
+	if (enable) {
+		twl3025_reg_write(TOGBR2, TOGBR2_ACTS);
+		twl3025_wait_ibic_access();
+		/* for whatever reason we need to do this twice */
+		twl3025_reg_write(TOGBR2, TOGBR2_ACTS);
+		twl3025_wait_ibic_access();
+	} else {
+		twl3025_reg_write(TOGBR2, TOGBR2_ACTR);
+		twl3025_wait_ibic_access();
+	}
+}
+
+#define	TSP_DELAY	6	/* 13* Tclk6M5 = ~ 3 GSM Qbits + 3 TPU instructions */
+#define BDLON_TO_BDLCAL	6
+#define BDLCAL_DURATION	66
+#define BDLON_TO_BDLENA	7
+#define BULON_TO_BULENA	16
+#define BULON_TO_BULCAL	17
+#define BULCAL_DURATION	143	/* really that long? */
+
+/* bdl_ena - TSP_DELAY - BDLCAL_DURATION - TSP_DELAY - BDLON_TO_BDLCAL - TSP_DELAY */
+#define DOWNLINK_DELAY	(3 * TSP_DELAY + BDLCAL_DURATION + BDLON_TO_BDLCAL)
+
+/* Enqueue a series of TSP commands in the TPU to (de)activate the downlink path */
+void twl3025_downlink(int on, int16_t at)
+{
+	int16_t bdl_ena = at - TSP_DELAY - 6;
+
+	if (on) {
+		if (bdl_ena < 0)
+			printf("BDLENA time negative (%d)\n", bdl_ena);
+		/* calibration should be done just before BDLENA */
+		tpu_enq_at(bdl_ena - DOWNLINK_DELAY);
+		/* bdl_ena - TSP_DELAY - BDLCAL_DURATION - TSP_DELAY - BDLON_TO_BDLCAL - TSP_DELAY */
+		twl3025_tsp_write(BDLON);
+		/* bdl_ena - TSP_DELAY - BDLCAL_DURATION - TSP_DELAY - BDLON_TO_BDLCAL */
+		tpu_enq_wait(BDLON_TO_BDLCAL - TSP_DELAY);
+		/* bdl_ena - TSP_DELAY - BDLCAL_DURATION - TSP_DELAY */
+		twl3025_tsp_write(BDLON | BDLCAL);
+		/* bdl_ena - TSP_DELAY - BDLCAL_DURATION */
+		tpu_enq_wait(BDLCAL_DURATION - TSP_DELAY);
+		/* bdl_ena - TSP_DELAY */
+		twl3025_tsp_write(BDLON);
+		//tpu_enq_wait(BDLCAL_TO_BDLENA)	this is only 3.7us == 4 qbits, i.e. less than the TSP_DELAY
+		tpu_enq_at(bdl_ena);
+		twl3025_tsp_write(BDLON | BDLENA);
+	} else {
+		tpu_enq_at(bdl_ena);
+		twl3025_tsp_write(BDLON);
+		//tpu_enq_wait(nBDLENA_TO_nBDLON)	this is only 3.7us == 4 qbits, i.e. less than the TSP_DELAY
+		twl3025_tsp_write(0);
+	}
+}
+
+/* bdl_ena - 35 - TSP_DELAY - BULCAL_DURATION - TSP_DELAY - BULON_TO_BULCAL - TSP_DELAY */
+#define UPLINK_DELAY (3 * TSP_DELAY + BULCAL_DURATION + BULON_TO_BULCAL + 35)
+
+void twl3025_uplink(int on, int16_t at)
+{
+	int16_t bul_ena = at - TSP_DELAY - 6;
+
+	if (bul_ena < 0)
+		printf("BULENA time negative (%d)\n", bul_ena);
+	if (on) {
+		/* calibration should  be done just before BULENA */
+		tpu_enq_at(bul_ena - UPLINK_DELAY);
+		/* bdl_ena - 35 - TSP_DELAY - BULCAL_DURATION - TSP_DELAY - BULON_TO_BULCAL - TSP_DELAY */
+		twl3025_tsp_write(BULON);
+		/* bdl_ena - 35 - TSP_DELAY - BULCAL_DURATION - TSP_DELAY - BULON_TO_BULCAL */
+		tpu_enq_wait(BULON_TO_BULCAL - TSP_DELAY);
+		/* bdl_ena - 35 - TSP_DELAY - BULCAL_DURATION - TSP_DELAY */
+		twl3025_tsp_write(BULON | BULCAL);
+		/* bdl_ena - 35 - TSP_DELAY - BULCAL_DURATION */
+		tpu_enq_wait(BULCAL_DURATION - TSP_DELAY);
+		/* bdl_ena - 35 - TSP_DELAY */
+		twl3025_tsp_write(BULON);
+		/* bdl_ena - 35 */
+		tpu_enq_wait(35);	/* minimum time required to bring the ramp up (really needed?) */
+		tpu_enq_at(bul_ena);
+		twl3025_tsp_write(BULON | BULENA);
+	} else {
+		tpu_enq_at(bul_ena);
+		twl3025_tsp_write(BULON);
+		tpu_enq_wait(35);	/* minimum time required to bring the ramp down (needed!) */
+		twl3025_tsp_write(0);
+	}
+}
+
+void twl3025_afc_set(int16_t val)
+{
+	printf("twl3025_afc_set(%d)\n", val);
+
+	if (val > 4095)
+		val = 4095;
+	else if (val <= -4096)
+		val = -4096;
+
+	/* FIXME: we currently write from the USP rather than BSP */
+	twl3025_reg_write(AUXAFC2, val >> 10);
+	twl3025_reg_write(AUXAFC1, val & 0x3ff);
+}
+
+int16_t twl3025_afc_get(void)
+{
+	int16_t val;
+
+	val = (twl3025_reg_read(AUXAFC2) & 0x7);
+	val = val << 10;
+	val = val | (twl3025_reg_read(AUXAFC1) & 0x3ff);
+
+	if (val > 4095)
+		val = -(8192 - val);
+	return val;
+}
+
+void twl3025_unit_enable(enum twl3025_unit unit, int on)
+{
+	uint16_t togbr1 = 0;
+
+	switch (unit) {
+	case TWL3025_UNIT_AFC:
+		if (on)
+			togbr1 = (1 << 7);
+		else
+			togbr1 = (1 << 6);
+		break;
+	case TWL3025_UNIT_MAD:
+		if (on)
+			togbr1 = (1 << 9);
+		else
+			togbr1 = (1 << 8);
+		break;
+	case TWL3025_UNIT_ADA:
+		if (on)
+			togbr1 = (1 << 5);
+		else
+			togbr1 = (1 << 4);
+	case TWL3025_UNIT_VDL:
+		if (on)
+			togbr1 = (1 << 3);
+		else
+			togbr1 = (1 << 2);
+		break;
+	case TWL3025_UNIT_VUL:
+		if (on)
+			togbr1 = (1 << 1);
+		else
+			togbr1 = (1 << 0);
+		break;
+	}
+	twl3025_reg_write(TOGBR1, togbr1);
+}
+
+uint8_t twl3025_afcout_get(void)
+{
+	return twl3025_reg_read(AFCOUT) & 0xff;
+}
+
+void twl3025_afcout_set(uint8_t val)
+{
+	twl3025_reg_write(AFCCTLADD, 0x05);
+	twl3025_reg_write(AFCOUT, val);
+}
diff --git a/src/target/firmware/apps/compal_dsp_dump/main.c b/src/target/firmware/apps/compal_dsp_dump/main.c
new file mode 100644
index 00000000..5e1ab68d
--- /dev/null
+++ b/src/target/firmware/apps/compal_dsp_dump/main.c
@@ -0,0 +1,85 @@
+/* main program of Free Software for Calypso Phone */
+
+/* (C) 2010 Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <memory.h>
+#include <delay.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <rffe.h>
+#include <keypad.h>
+#include <board.h>
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+#include <calypso/clock.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/irq.h>
+#include <calypso/misc.h>
+#include <comm/timer.h>
+#include <fb/framebuffer.h>
+
+/* Main Program */
+const char *hr = "======================================================================\n";
+
+int main(void)
+{
+	board_init(1);
+
+	puts("\n\nOsmocomBB Compal DSP Dumper (revision " GIT_REVISION ")\n");
+	puts(hr);
+
+	/* Dump device identification */
+	dump_dev_id();
+	puts(hr);
+
+	fb_clear();
+
+	fb_setfg(FB_COLOR_BLACK);
+	fb_setbg(FB_COLOR_WHITE);
+	fb_setfont(FB_FONT_HELVB14);
+
+	fb_gotoxy(2,20);
+	fb_putstr("DSP Dump",framebuffer->width-4);
+
+	fb_setfg(FB_COLOR_RED);
+	fb_setbg(FB_COLOR_BLUE);
+
+	fb_gotoxy(2,25);
+	fb_boxto(framebuffer->width-3,38);
+
+	fb_setfg(FB_COLOR_WHITE);
+	fb_setfont(FB_FONT_HELVR08);
+	fb_gotoxy(8,33);
+	fb_putstr("osmocom-bb",framebuffer->width-4);
+
+	fb_flush();
+
+	/* Dump DSP content */
+	dsp_dump();
+
+	while (1) {
+		osmo_timers_update();
+	}
+}
+
diff --git a/src/target/firmware/apps/hello_world/main.c b/src/target/firmware/apps/hello_world/main.c
new file mode 100644
index 00000000..481cf170
--- /dev/null
+++ b/src/target/firmware/apps/hello_world/main.c
@@ -0,0 +1,199 @@
+/* main program of Free Software for Calypso Phone */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <delay.h>
+#include <rffe.h>
+#include <keypad.h>
+#include <board.h>
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+#include <calypso/clock.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/irq.h>
+#include <calypso/misc.h>
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+#include <fb/framebuffer.h>
+#include <battery/battery.h>
+
+/* Main Program */
+const char *hr = "======================================================================\n";
+
+void key_handler(enum key_codes code, enum key_states state);
+
+static void console_rx_cb(uint8_t dlci, struct msgb *msg)
+{
+	if (dlci != SC_DLCI_CONSOLE) {
+		printf("Message for unknown DLCI %u\n", dlci);
+		return;
+	}
+
+	printf("Message on console DLCI: '%s'\n", msg->data);
+	msgb_free(msg);
+}
+
+static void l1a_l23_rx_cb(uint8_t dlci, struct msgb *msg)
+{
+	int i;
+	puts("l1a_l23_rx_cb: ");
+	for (i = 0; i < msg->len; i++)
+		printf("%02x ", msg->data[i]);
+	puts("\n");
+}
+
+void
+write_battery_info(void *p){
+	char buf[128];
+
+	fb_setfg(FB_COLOR_WHITE);
+	fb_setfont(FB_FONT_C64);
+
+	snprintf(buf,sizeof(buf),"B: %04d mV",battery_info.bat_volt_mV);
+	fb_gotoxy(8,41);
+	fb_putstr(buf,framebuffer->width-8);
+
+	snprintf(buf,sizeof(buf),"C: %04d mV",battery_info.charger_volt_mV);
+	fb_gotoxy(8,49);
+	fb_putstr(buf,framebuffer->width-8);
+
+	snprintf(buf,sizeof(buf),"F: %08x",battery_info.flags);
+	fb_gotoxy(8,57);
+	fb_putstr(buf,framebuffer->width-8);
+
+	fb_flush();
+	osmo_timer_schedule((struct osmo_timer_list*)p,100);
+
+}
+
+/* timer that fires the charging loop regularly */
+static struct osmo_timer_list write_battery_info_timer = {
+	.cb = &write_battery_info,
+	.data = &write_battery_info_timer
+};
+
+int main(void)
+{
+	board_init(1);
+
+	puts("\n\nOsmocomBB Hello World (revision " GIT_REVISION ")\n");
+	puts(hr);
+
+	/* Dump device identification */
+	dump_dev_id();
+	puts(hr);
+
+	/* Dump clock config before PLL set */
+	calypso_clk_dump();
+	puts(hr);
+
+	keypad_set_handler(&key_handler);
+
+	/* Dump clock config after PLL set */
+	calypso_clk_dump();
+	puts(hr);
+
+	fb_clear();
+
+	fb_setfg(FB_COLOR_BLACK);
+	fb_setbg(FB_COLOR_WHITE);
+	fb_setfont(FB_FONT_HELVB14);
+
+	fb_gotoxy(2,20);
+	fb_putstr("Hello World!",framebuffer->width-4);
+
+	fb_setfg(FB_COLOR_RED);
+	fb_setbg(FB_COLOR_BLUE);
+
+	fb_gotoxy(2,25);
+	fb_boxto(framebuffer->width-3,38);
+
+	fb_setfg(FB_COLOR_WHITE);
+	fb_setfont(FB_FONT_HELVR08);
+	fb_gotoxy(8,33);
+	fb_putstr("osmocom-bb",framebuffer->width-4);
+
+	fb_flush();
+
+
+
+	/* Dump all memory */
+	//dump_mem();
+#if 0
+	/* Dump Bootloader */
+	memdump_range((void *)0x00000000, 0x2000);
+	puts(hr);
+#endif
+
+	sercomm_register_rx_cb(SC_DLCI_CONSOLE, console_rx_cb);
+	sercomm_register_rx_cb(SC_DLCI_L1A_L23, l1a_l23_rx_cb);
+
+	osmo_timer_schedule(&write_battery_info_timer,100);
+
+	/* beyond this point we only react to interrupts */
+	puts("entering interrupt loop\n");
+	while (1) {
+		osmo_timers_update();
+	}
+
+	twl3025_power_off();
+
+	while (1) {}
+}
+
+void key_handler(enum key_codes code, enum key_states state)
+{
+	char test[16];
+
+	if (state != PRESSED)
+		return;
+
+	switch (code) {
+	case KEY_0:
+	case KEY_1:
+	case KEY_2:
+	case KEY_3:
+	case KEY_4:
+	case KEY_5:
+	case KEY_6:
+	case KEY_7:
+	case KEY_8:
+	case KEY_9:
+		// used to be display_puts...
+		break;
+	case KEY_STAR:
+		// used to be display puts...
+		break;
+	case KEY_HASH:
+		// used to be display puts...
+		break;
+	default:
+		break;
+	}
+}
diff --git a/src/target/firmware/apps/layer1/main.c b/src/target/firmware/apps/layer1/main.c
new file mode 100644
index 00000000..59ffe972
--- /dev/null
+++ b/src/target/firmware/apps/layer1/main.c
@@ -0,0 +1,173 @@
+/* main program of Free Software for Calypso Phone */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <string.h>
+#include <delay.h>
+#include <rffe.h>
+#include <keypad.h>
+#include <board.h>
+
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+
+#include <calypso/clock.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/irq.h>
+#include <calypso/misc.h>
+#include <calypso/sim.h>
+
+#include <layer1/sync.h>
+#include <layer1/async.h>
+#include <layer1/tpu_window.h>
+#include <layer1/l23_api.h>
+
+#include <fb/framebuffer.h>
+
+const char *hr = "======================================================================\n";
+
+/* MAIN program **************************************************************/
+
+static void key_handler(enum key_codes code, enum key_states state);
+
+int main(void)
+{
+	uint8_t atr[20];
+	uint8_t atrLength = 0;
+
+	board_init(1);
+
+	puts("\n\nOsmocomBB Layer 1 (revision " GIT_REVISION ")\n");
+	puts(hr);
+
+	/* Dump device identification */
+	dump_dev_id();
+	puts(hr);
+
+	keypad_set_handler(&key_handler);
+
+	/* Dump clock config after PLL set */
+	calypso_clk_dump();
+	puts(hr);
+
+	fb_clear();
+
+	fb_setfg(FB_COLOR_BLACK);
+	fb_setbg(FB_COLOR_WHITE);
+	fb_setfont(FB_FONT_HELVB14);
+
+	fb_gotoxy(2,20);
+	fb_putstr("Layer 1",framebuffer->width-4);
+
+	fb_setfg(FB_COLOR_RED);
+	fb_setbg(FB_COLOR_BLUE);
+
+	fb_gotoxy(2,25);
+	fb_boxto(framebuffer->width-3,38);
+
+	fb_setfg(FB_COLOR_WHITE);
+	fb_setfont(FB_FONT_HELVR08);
+	fb_gotoxy(8,33);
+	fb_putstr("osmocom-bb",framebuffer->width-4);
+
+	fb_flush();
+
+	/* initialize SIM */
+	calypso_sim_init();
+
+	puts("Power up simcard:\n");
+	memset(atr,0,sizeof(atr));
+	atrLength = calypso_sim_powerup(atr);
+
+	layer1_init();
+
+	tpu_frame_irq_en(1, 1);
+
+	while (1) {
+		l1a_compl_execute();
+		osmo_timers_update();
+		sim_handler();
+		l1a_l23_handler();
+	}
+
+	/* NOT REACHED */
+
+	twl3025_power_off();
+}
+
+static int afcout = 0;
+
+static void tspact_toggle(uint8_t num)
+{
+	printf("TSPACT%u toggle\n", num);
+	tsp_act_toggle((1 << num));
+	tpu_enq_sleep();
+	tpu_enable(1);
+	tpu_wait_idle();
+}
+
+static void key_handler(enum key_codes code, enum key_states state)
+{
+	if (state != PRESSED)
+		return;
+
+	switch (code) {
+	case KEY_4:
+		tspact_toggle(6);	/* TRENA (RFFE) */
+		break;
+	case KEY_5:
+		tspact_toggle(8);	/* GSM_TXEN (RFFE) */
+		break;
+	case KEY_6:
+		tspact_toggle(1);	/* PAENA (RFFE) */
+		break;
+	case KEY_7:			/* decrement AFC OUT */
+		afcout -= 100;
+		if (afcout < -4096)
+			afcout = -4096;
+		twl3025_afc_set(afcout);
+		printf("AFC OUT: %u\n", twl3025_afcout_get());
+		break;
+	case KEY_9:			/* increase AFC OUT */
+		afcout += 100;
+		if (afcout > 4095)
+			afcout = 4095;
+		twl3025_afc_set(afcout);
+		printf("AFC OUT: %u\n", twl3025_afcout_get());
+		break;
+	default:
+		break;
+	}
+	/* power down SIM, TODO:  this will happen with every key pressed,
+       put it somewhere else ! */
+	calypso_sim_powerdown();
+}
+
+
diff --git a/src/target/firmware/apps/loader/main.c b/src/target/firmware/apps/loader/main.c
new file mode 100644
index 00000000..9b7a1b59
--- /dev/null
+++ b/src/target/firmware/apps/loader/main.c
@@ -0,0 +1,452 @@
+/* boot loader for Calypso phones */
+
+/* (C) 2010 by Ingo Albrecht <prom@berlin.ccc.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <delay.h>
+#include <rffe.h>
+#include <keypad.h>
+#include <board.h>
+#include <console.h>
+#include <manifest.h>
+
+#include <osmocom/core/crc16.h>
+
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+
+#include <comm/sercomm.h>
+
+#include <calypso/clock.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/irq.h>
+#include <calypso/misc.h>
+#include <calypso/backlight.h>
+#include <uart.h>
+#include <calypso/timer.h>
+#include <fb/framebuffer.h>
+
+#include <flash/cfi_flash.h>
+
+#include "protocol.h"
+
+/* Main Program */
+const char *hr =
+    "======================================================================\n";
+
+static void key_handler(enum key_codes code, enum key_states state);
+static void cmd_handler(uint8_t dlci, struct msgb *msg);
+
+int flag = 0;
+static int sercomm_uart;
+
+static void flush_uart(void)
+{
+	unsigned i;
+	for (i = 0; i < 500; i++) {
+		uart_poll(sercomm_uart);
+		delay_ms(1);
+	}
+}
+
+static void device_poweroff(void)
+{
+	flush_uart();
+	twl3025_power_off();
+}
+
+static void device_reset(void)
+{
+	flush_uart();
+	wdog_reset();
+}
+
+static void device_enter_loader(unsigned char bootrom)
+{
+	flush_uart();
+
+	calypso_bootrom(bootrom);
+	void (*entry) (void) = (void (*)(void))0;
+	entry();
+}
+
+static void device_jump(void *entry)
+{
+	flush_uart();
+
+	void (*f) (void) = (void (*)(void))entry;
+	f();
+}
+
+static void loader_send_simple(struct msgb *msg, uint8_t dlci, uint8_t command)
+{
+	msgb_put_u8(msg, command);
+	sercomm_sendmsg(dlci, msg);
+}
+
+extern unsigned char _start;
+
+static void loader_send_init(uint8_t dlci)
+{
+	struct msgb *msg = sercomm_alloc_msgb(9);
+	msgb_put_u8(msg, LOADER_INIT);
+	msgb_put_u32(msg, 0);
+	msgb_put_u32(msg, (uint32_t)&_start);
+	sercomm_sendmsg(dlci, msg);
+}
+
+flash_t the_flash;
+
+extern void putchar_asm(uint32_t c);
+
+static const uint8_t phone_ack[] = { 0x1b, 0xf6, 0x02, 0x00, 0x41, 0x03, 0x42 };
+
+int main(void)
+{
+	/* Simulate a compal loader saying "ACK" */
+	unsigned i = 0;
+	for (i = 0; i < sizeof(phone_ack); i++) {
+		putchar_asm(phone_ack[i]);
+	}
+
+	/* initialize board without interrupts */
+	board_init(0);
+	sercomm_uart = sercomm_get_uart();
+
+	/* Say hi */
+	puts("\n\nOsmocomBB Loader (revision " GIT_REVISION ")\n");
+	puts(hr);
+
+	fb_clear();
+
+	fb_setfg(FB_COLOR_BLACK);
+	fb_setbg(FB_COLOR_WHITE);
+	fb_setfont(FB_FONT_HELVB14);
+
+	fb_gotoxy(2,20);
+	fb_putstr("loader",framebuffer->width-4);
+
+	fb_setfg(FB_COLOR_RED);
+	fb_setbg(FB_COLOR_BLUE);
+
+	fb_gotoxy(2,25);
+	fb_boxto(framebuffer->width-3,38);
+
+	fb_setfg(FB_COLOR_WHITE);
+	fb_setfont(FB_FONT_HELVR08);
+	fb_gotoxy(8,33);
+	fb_putstr("osmocom-bb",framebuffer->width-4);
+
+	fb_flush();
+
+	/* Identify environment */
+	printf("Running on %s in environment %s\n", manifest_board,
+	       manifest_environment);
+
+	/* Initialize flash driver */
+	if (flash_init(&the_flash, 0)) {
+		puts("Failed to initialize flash!\n");
+	} else {
+		printf("Found flash of %zu bytes at 0x%p with %zu regions\n",
+		       the_flash.f_size, the_flash.f_base,
+		       the_flash.f_nregions);
+
+		for (i = 0; i < the_flash.f_nregions; i++) {
+			printf("  Region %d of %zu pages with %zu bytes each.\n",
+			       i,
+			       the_flash.f_regions[i].fr_bnum,
+			       the_flash.f_regions[i].fr_bsize);
+		}
+
+	}
+
+	/* Set up a key handler for powering off */
+	keypad_set_handler(&key_handler);
+
+	/* Set up loader communications */
+	sercomm_register_rx_cb(SC_DLCI_LOADER, &cmd_handler);
+
+	/* Notify any running osmoload about our startup */
+	loader_send_init(SC_DLCI_LOADER);
+
+	/* Wait for events */
+	while (1) {
+		keypad_poll();
+		uart_poll(sercomm_uart);
+	}
+
+	/* NOT REACHED */
+
+	twl3025_power_off();
+}
+
+static void cmd_handler(uint8_t dlci, struct msgb *msg)
+{
+	if (msg->data_len < 1) {
+		return;
+	}
+
+	uint8_t command = msgb_pull_u8(msg);
+
+	int res = 0;
+
+	flash_lock_t lock;
+
+	void *data;
+
+	uint8_t chip;
+	uint8_t nbytes;
+	uint16_t crc, mycrc;
+	uint32_t address;
+
+	struct msgb *reply = sercomm_alloc_msgb(256);	// XXX
+
+	if (!reply) {
+		printf("Failed to allocate reply buffer!\n");
+		goto out;
+	}
+
+	switch (command) {
+
+	case LOADER_PING:
+		loader_send_simple(reply, dlci, LOADER_PING);
+		break;
+
+	case LOADER_RESET:
+		loader_send_simple(reply, dlci, LOADER_RESET);
+		device_reset();
+		break;
+
+	case LOADER_POWEROFF:
+		loader_send_simple(reply, dlci, LOADER_POWEROFF);
+		device_poweroff();
+		break;
+
+	case LOADER_ENTER_ROM_LOADER:
+		loader_send_simple(reply, dlci, LOADER_ENTER_ROM_LOADER);
+		device_enter_loader(1);
+		break;
+
+	case LOADER_ENTER_FLASH_LOADER:
+		loader_send_simple(reply, dlci, LOADER_ENTER_FLASH_LOADER);
+		device_enter_loader(0);
+		break;
+
+	case LOADER_MEM_READ:
+
+		nbytes = msgb_pull_u8(msg);
+		address = msgb_pull_u32(msg);
+
+		crc = osmo_crc16(0, (void *)address, nbytes);
+
+		msgb_put_u8(reply, LOADER_MEM_READ);
+		msgb_put_u8(reply, nbytes);
+		msgb_put_u16(reply, crc);
+		msgb_put_u32(reply, address);
+
+		memcpy(msgb_put(reply, nbytes), (void *)address, nbytes);
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	case LOADER_MEM_WRITE:
+
+		nbytes = msgb_pull_u8(msg);
+		crc = msgb_pull_u16(msg);
+		address = msgb_pull_u32(msg);
+
+		data = msgb_pull(msg, nbytes) - nbytes;
+
+		mycrc = osmo_crc16(0, data, nbytes);
+
+		if (mycrc == crc) {
+			memcpy((void *)address, data, nbytes);
+		}
+
+		msgb_put_u8(reply, LOADER_MEM_WRITE);
+		msgb_put_u8(reply, nbytes);
+		msgb_put_u16(reply, mycrc);
+		msgb_put_u32(reply, address);
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	case LOADER_JUMP:
+
+		address = msgb_pull_u32(msg);
+
+		msgb_put_u8(reply, LOADER_JUMP);
+		msgb_put_u32(reply, address);
+
+		sercomm_sendmsg(dlci, reply);
+
+		device_jump((void *)address);
+
+		break;
+
+	case LOADER_FLASH_INFO:
+
+		msgb_put_u8(reply, LOADER_FLASH_INFO);
+		msgb_put_u8(reply, 1);	// nchips
+
+		// chip 1
+		msgb_put_u32(reply, (uint32_t)the_flash.f_base);
+		msgb_put_u32(reply, the_flash.f_size);
+		msgb_put_u8(reply, the_flash.f_nregions);
+
+		unsigned i;
+		for (i = 0; i < the_flash.f_nregions; i++) {
+			msgb_put_u32(reply, the_flash.f_regions[i].fr_bnum);
+			msgb_put_u32(reply, the_flash.f_regions[i].fr_bsize);
+		}
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	case LOADER_FLASH_ERASE:
+	case LOADER_FLASH_UNLOCK:
+	case LOADER_FLASH_LOCK:
+	case LOADER_FLASH_LOCKDOWN:
+
+		chip = msgb_pull_u8(msg);
+		address = msgb_pull_u32(msg);
+
+		if (command == LOADER_FLASH_ERASE) {
+			res = flash_block_erase(&the_flash, address);
+		}
+		if (command == LOADER_FLASH_UNLOCK) {
+			res = flash_block_unlock(&the_flash, address);
+		}
+		if (command == LOADER_FLASH_LOCK) {
+			res = flash_block_lock(&the_flash, address);
+		}
+		if (command == LOADER_FLASH_LOCKDOWN) {
+			res = flash_block_lockdown(&the_flash, address);
+		}
+
+		msgb_put_u8(reply, command);
+		msgb_put_u8(reply, chip);
+		msgb_put_u32(reply, address);
+		msgb_put_u32(reply, (res != 0));
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	case LOADER_FLASH_GETLOCK:
+
+		chip = msgb_pull_u8(msg);
+		address = msgb_pull_u32(msg);
+
+		lock = flash_block_getlock(&the_flash, address);
+
+		msgb_put_u8(reply, command);
+		msgb_put_u8(reply, chip);
+		msgb_put_u32(reply, address);
+
+		switch (lock) {
+		case FLASH_UNLOCKED:
+			msgb_put_u32(reply, LOADER_FLASH_UNLOCKED);
+			break;
+		case FLASH_LOCKED:
+			msgb_put_u32(reply, LOADER_FLASH_LOCKED);
+			break;
+		case FLASH_LOCKED_DOWN:
+			msgb_put_u32(reply, LOADER_FLASH_LOCKED_DOWN);
+			break;
+		default:
+			msgb_put_u32(reply, 0xFFFFFFFF);
+			break;
+		}
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	case LOADER_FLASH_PROGRAM:
+
+		nbytes = msgb_pull_u8(msg);
+		crc = msgb_pull_u16(msg);
+		msgb_pull_u8(msg);	// XXX align
+		chip = msgb_pull_u8(msg);
+		address = msgb_pull_u32(msg);
+
+		data = msgb_pull(msg, nbytes) - nbytes;
+
+		mycrc = osmo_crc16(0, data, nbytes);
+
+		if (mycrc == crc) {
+			res = flash_program(&the_flash, address, data, nbytes);
+		}
+
+		msgb_put_u8(reply, LOADER_FLASH_PROGRAM);
+		msgb_put_u8(reply, nbytes);
+		msgb_put_u16(reply, mycrc);
+		msgb_put_u8(reply, 0);	// XXX align
+		msgb_put_u8(reply, chip);
+		msgb_put_u32(reply, address);
+
+		msgb_put_u32(reply, (uint32_t) res);	// XXX
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	default:
+		printf("unknown command %d\n", command);
+
+		msgb_free(reply);
+
+		break;
+	}
+
+ out:
+
+	msgb_free(msg);
+}
+
+static void key_handler(enum key_codes code, enum key_states state)
+{
+	if (state != PRESSED)
+		return;
+
+	switch (code) {
+	case KEY_POWER:
+		puts("Powering off due to keypress.\n");
+		device_poweroff();
+		break;
+	case KEY_OK:
+		puts("Resetting due to keypress.\n");
+		device_reset();
+		break;
+	default:
+		break;
+	}
+}
diff --git a/src/target/firmware/apps/loader/protocol.h b/src/target/firmware/apps/loader/protocol.h
new file mode 100644
index 00000000..0a61c89e
--- /dev/null
+++ b/src/target/firmware/apps/loader/protocol.h
@@ -0,0 +1,37 @@
+
+enum loader_command {
+	/* init message from loader */
+	LOADER_INIT,
+
+	/* ping / pong */
+	LOADER_PING,
+
+	/* lifecycle requests */
+	LOADER_RESET,
+	LOADER_POWEROFF,
+
+	/* jumps */
+	LOADER_JUMP,
+	LOADER_ENTER_ROM_LOADER,
+	LOADER_ENTER_FLASH_LOADER,
+
+	/* generic memory ops */
+	LOADER_MEM_READ,
+	LOADER_MEM_WRITE,
+
+	/* flash operations */
+	LOADER_FLASH_INFO,
+	LOADER_FLASH_ERASE,
+	LOADER_FLASH_UNLOCK,
+	LOADER_FLASH_LOCK,
+	LOADER_FLASH_LOCKDOWN,
+	LOADER_FLASH_GETLOCK,
+	LOADER_FLASH_PROGRAM,
+
+};
+
+enum loader_flash_lock {
+	LOADER_FLASH_UNLOCKED = 0,
+	LOADER_FLASH_LOCKED,
+	LOADER_FLASH_LOCKED_DOWN,
+};
diff --git a/src/target/firmware/apps/loader_mtk/main.c b/src/target/firmware/apps/loader_mtk/main.c
new file mode 100644
index 00000000..f2ebbea1
--- /dev/null
+++ b/src/target/firmware/apps/loader_mtk/main.c
@@ -0,0 +1,368 @@
+/*
+ * boot loader for MTK phones (based on the calypso-version)
+ *
+ * (C) 2010 by Ingo Albrecht <prom@berlin.ccc.de>
+ * (C) 2011 by Wolfram Sang <wolfram@the-dreams.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <delay.h>
+#include <keypad.h>
+#include <board.h>
+#include <console.h>
+#include <defines.h>
+#include <manifest.h>
+
+#include <osmocom/core/crc16.h>
+
+#include <comm/sercomm.h>
+
+#include <uart.h>
+
+#include <flash/cfi_flash.h>
+
+#include <mtk/emi.h>
+#include <mtk/mt6235.h>
+#include <mtk/system.h>
+
+#include "../loader/protocol.h"
+
+/* Main Program */
+const char *hr =
+    "======================================================================\n";
+
+static void cmd_handler(uint8_t dlci, struct msgb *msg);
+
+int flag = 0;
+static int sercomm_uart;
+
+static void flush_uart(void)
+{
+	unsigned i;
+	for (i = 0; i < 500; i++) {
+		uart_poll(sercomm_uart);
+		delay_ms(1);
+	}
+}
+
+static void device_poweroff(void)
+{
+	flush_uart();
+	writew(BBPU_MAGIC | RTC_BBPU_WRITE_EN,
+	       MTK_RTC_BBPU);
+	writew(1, MTK_RTC_WRTGR);
+}
+
+static void device_reset(void)
+{
+	flush_uart();
+}
+
+static void device_enter_loader(__unused unsigned char bootrom)
+{
+	flush_uart();
+	delay_ms(2000);
+	void (*entry)( void ) = (void (*)(void))0;
+	entry();
+}
+
+static void device_jump(void *entry)
+{
+	flush_uart();
+
+	void (*f) (void) = (void (*)(void))entry;
+	f();
+}
+
+static void loader_send_simple(struct msgb *msg, uint8_t dlci, uint8_t command)
+{
+	msgb_put_u8(msg, command);
+	sercomm_sendmsg(dlci, msg);
+}
+
+extern unsigned char _start;
+
+flash_t the_flash;
+
+extern void putchar_asm(uint32_t c);
+
+static const uint8_t phone_ack[] = { 0x1b, 0xf6, 0x02, 0x00, 0x41, 0x03, 0x42 };
+
+int main(void)
+{
+	board_init(0);
+	sercomm_uart = sercomm_get_uart();
+
+	/* Initialize HDLC subsystem */
+	sercomm_init();
+
+	/* Say hi */
+	puts("\n\nOsmocomBB Loader (revision " GIT_REVISION ")\n");
+	puts(hr);
+
+	/* Identify environment */
+	printf("\nRunning on %s in environment %s\n", manifest_board,
+	       manifest_environment);
+
+	printf("\nHW_CODE = 0x%04x", readw(MTK_CONFG_HW_CODE));
+
+	/* Set up loader communications */
+	sercomm_register_rx_cb(SC_DLCI_LOADER, &cmd_handler);
+
+	/* Wait for events */
+
+	while (1) {
+		uart_poll(sercomm_uart);
+	}
+
+}
+
+static void cmd_handler(uint8_t dlci, struct msgb *msg)
+{
+	if (msg->data_len < 1) {
+		return;
+	}
+
+	uint8_t command = msgb_pull_u8(msg);
+
+	int res;
+
+	flash_lock_t lock;
+
+	void *data;
+
+	uint8_t chip;
+	uint8_t nbytes;
+	uint16_t crc, mycrc;
+	uint32_t address;
+
+	struct msgb *reply = sercomm_alloc_msgb(256);	// XXX
+
+	if (!reply) {
+		printf("Failed to allocate reply buffer!\n");
+		goto out;
+	}
+
+	switch (command) {
+
+	case LOADER_PING:
+		loader_send_simple(reply, dlci, LOADER_PING);
+		break;
+
+	case LOADER_RESET:
+		loader_send_simple(reply, dlci, LOADER_RESET);
+		device_reset();
+		break;
+
+	case LOADER_POWEROFF:
+		loader_send_simple(reply, dlci, LOADER_POWEROFF);
+		device_poweroff();
+		break;
+
+	case LOADER_ENTER_ROM_LOADER:
+		loader_send_simple(reply, dlci, LOADER_ENTER_ROM_LOADER);
+		device_enter_loader(1);
+		break;
+
+	case LOADER_ENTER_FLASH_LOADER:
+		loader_send_simple(reply, dlci, LOADER_ENTER_FLASH_LOADER);
+		device_enter_loader(0);
+		break;
+
+	case LOADER_MEM_READ:
+
+		nbytes = msgb_pull_u8(msg);
+		address = msgb_pull_u32(msg);
+
+		crc = osmo_crc16(0, (void *)address, nbytes);
+
+		msgb_put_u8(reply, LOADER_MEM_READ);
+		msgb_put_u8(reply, nbytes);
+		msgb_put_u16(reply, crc);
+		msgb_put_u32(reply, address);
+
+		memcpy(msgb_put(reply, nbytes), (void *)address, nbytes);
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	case LOADER_MEM_WRITE:
+
+		nbytes = msgb_pull_u8(msg);
+		crc = msgb_pull_u16(msg);
+		address = msgb_pull_u32(msg);
+
+		data = msgb_pull(msg, nbytes) - nbytes;
+
+		mycrc = osmo_crc16(0, data, nbytes);
+
+		if (mycrc == crc) {
+			memcpy((void *)address, data, nbytes);
+		}
+
+		msgb_put_u8(reply, LOADER_MEM_WRITE);
+		msgb_put_u8(reply, nbytes);
+		msgb_put_u16(reply, mycrc);
+		msgb_put_u32(reply, address);
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	case LOADER_JUMP:
+
+		address = msgb_pull_u32(msg);
+
+		msgb_put_u8(reply, LOADER_JUMP);
+		msgb_put_u32(reply, address);
+
+		sercomm_sendmsg(dlci, reply);
+
+		device_jump((void *)address);
+
+		break;
+
+	case LOADER_FLASH_INFO:
+
+		msgb_put_u8(reply, LOADER_FLASH_INFO);
+		msgb_put_u8(reply, 1);	// nchips
+
+		// chip 1
+		msgb_put_u32(reply, the_flash.f_base);
+		msgb_put_u32(reply, the_flash.f_size);
+		msgb_put_u8(reply, the_flash.f_nregions);
+
+		unsigned i;
+		for (i = 0; i < the_flash.f_nregions; i++) {
+			msgb_put_u32(reply, the_flash.f_regions[i].fr_bnum);
+			msgb_put_u32(reply, the_flash.f_regions[i].fr_bsize);
+		}
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	case LOADER_FLASH_ERASE:
+	case LOADER_FLASH_UNLOCK:
+	case LOADER_FLASH_LOCK:
+	case LOADER_FLASH_LOCKDOWN:
+
+		chip = msgb_pull_u8(msg);
+		address = msgb_pull_u32(msg);
+
+		if (command == LOADER_FLASH_ERASE) {
+			res = flash_block_erase(&the_flash, address);
+		}
+		if (command == LOADER_FLASH_UNLOCK) {
+			res = flash_block_unlock(&the_flash, address);
+		}
+		if (command == LOADER_FLASH_LOCK) {
+			res = flash_block_lock(&the_flash, address);
+		}
+		if (command == LOADER_FLASH_LOCKDOWN) {
+			res = flash_block_lockdown(&the_flash, address);
+		}
+
+		msgb_put_u8(reply, command);
+		msgb_put_u8(reply, chip);
+		msgb_put_u32(reply, address);
+		msgb_put_u32(reply, (res != 0));
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	case LOADER_FLASH_GETLOCK:
+
+		chip = msgb_pull_u8(msg);
+		address = msgb_pull_u32(msg);
+
+		lock = flash_block_getlock(&the_flash, address);
+
+		msgb_put_u8(reply, command);
+		msgb_put_u8(reply, chip);
+		msgb_put_u32(reply, address);
+
+		switch (lock) {
+		case FLASH_UNLOCKED:
+			msgb_put_u32(reply, LOADER_FLASH_UNLOCKED);
+			break;
+		case FLASH_LOCKED:
+			msgb_put_u32(reply, LOADER_FLASH_LOCKED);
+			break;
+		case FLASH_LOCKED_DOWN:
+			msgb_put_u32(reply, LOADER_FLASH_LOCKED_DOWN);
+			break;
+		default:
+			msgb_put_u32(reply, 0xFFFFFFFF);
+			break;
+		}
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	case LOADER_FLASH_PROGRAM:
+
+		nbytes = msgb_pull_u8(msg);
+		crc = msgb_pull_u16(msg);
+		msgb_pull_u8(msg);	// XXX align
+		chip = msgb_pull_u8(msg);
+		address = msgb_pull_u32(msg);
+
+		data = msgb_pull(msg, nbytes) - nbytes;
+
+		mycrc = osmo_crc16(0, data, nbytes);
+
+		if (mycrc == crc) {
+			res = flash_program(&the_flash, address, data, nbytes);
+		}
+
+		msgb_put_u8(reply, LOADER_FLASH_PROGRAM);
+		msgb_put_u8(reply, nbytes);
+		msgb_put_u16(reply, mycrc);
+		msgb_put_u8(reply, 0);	// XXX align
+		msgb_put_u8(reply, chip);
+		msgb_put_u32(reply, address);
+
+		msgb_put_u32(reply, (uint32_t) res);	// XXX
+
+		sercomm_sendmsg(dlci, reply);
+
+		break;
+
+	default:
+		printf("unknown command %d\n", command);
+
+		msgb_free(reply);
+
+		break;
+	}
+
+ out:
+
+	msgb_free(msg);
+}
diff --git a/src/target/firmware/apps/rssi/main.c b/src/target/firmware/apps/rssi/main.c
new file mode 100644
index 00000000..50204869
--- /dev/null
+++ b/src/target/firmware/apps/rssi/main.c
@@ -0,0 +1,1562 @@
+/* Cell Monitor of Free Software for Calypso Phone */
+
+/* (C) 2012 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <delay.h>
+#include <byteorder.h>
+#include <rffe.h>
+#include <keypad.h>
+#include <board.h>
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+#include <calypso/clock.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/irq.h>
+#include <calypso/misc.h>
+#include <calypso/buzzer.h>
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+#include <fb/framebuffer.h>
+#include <layer1/sync.h>
+#include <layer1/async.h>
+#include <layer1/l23_api.h>
+#include <osmocom/gsm/rsl.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/gsm/gsm48_ie.h>
+#include <battery/battery.h>
+
+enum key_codes key_code = KEY_INV;
+int key_pressed = 0;
+enum key_codes key_pressed_code;
+unsigned long key_pressed_when;
+unsigned int key_pressed_delay;
+
+enum mode {
+	MODE_MAIN,
+	MODE_SPECTRUM,
+	MODE_ARFCN,
+	MODE_SYNC,
+	MODE_RACH,
+} mode = MODE_MAIN;
+enum mode last_mode; /* where to return after entering ARFCN */
+
+static uint16_t arfcn = 0, ul_arfcn;
+int pcs = 0;
+int uplink = 0;
+int max = 0;
+uint8_t power, max_power;
+char input[5];
+int cursor;
+
+char *sync_result = NULL;
+char *sync_msg = "";
+
+static struct band {
+	int min, max, prev, next, freq_ul, freq_dl;
+} bands[] = {
+        { 128, 251, 124, 512, 8242, 8692 }, /* GSM 850 */
+        { 955, 124, 885, 128, 8762, 9212 }, /* P,E,R GSM */
+        { 512, 885, 251, 955, 17102, 18052 }, /* DCS 1800 */
+	{ 0, 0, 0, 0, 0, 0},
+};
+
+struct band *band;
+
+#define PCS_MIN 512
+#define PCS_MAX 810
+#define DCS_MIN 512
+#define DCS_MAX 885
+#define PCS_UL 18502
+#define PCS_DL 19302
+
+enum pm_mode {
+	PM_IDLE,
+	PM_SENT,
+	PM_RANGE_SENT,
+	PM_RANGE_RESULT,
+	PM_RESULT,
+} pm_mode = PM_IDLE;
+
+#define NUM_PM_DL 2
+#define NUM_PM_UL 10
+int pm_meas[NUM_PM_UL];
+int pm_count = 0;
+int pm_max = 2;
+uint8_t pm_spectrum[1024];
+int pm_scale = 1; /* scale measured power level */
+
+#define TONE_JIFFIES ((HZ < 25) ? 1 : HZ / 25)
+int tone = 0;
+unsigned long tone_time;
+int tone_on = 0;
+
+uint8_t bsic;
+uint8_t ul_levels[8], ul_max[8]; /* 8 uplink levels */
+uint8_t si_1[23];
+uint8_t si_2[23];
+uint8_t si_2bis[23];
+uint8_t si_2ter[23];
+uint8_t si_3[23];
+uint8_t si_4[23];
+uint16_t si_new = 0, ul_new;
+uint16_t mcc, mnc, lac, cell_id;
+int ccch_conf;
+int nb_num;
+struct gsm_sysinfo_freq freq[1024];
+#define NEIGH_LINES	((framebuffer->height - 25) / 8)
+
+#define FREQ_TYPE_SERV		0x01 /* frequency of the serving cell */
+#define FREQ_TYPE_NCELL		0x1c /* frequency of the neighbor cell */
+#define FREQ_TYPE_NCELL_2	0x04 /* sub channel of SI 2 */
+#define FREQ_TYPE_NCELL_2bis	0x08 /* sub channel of SI 2bis */
+#define FREQ_TYPE_NCELL_2ter	0x10 /* sub channel of SI 2ter */
+
+int rach = 0;
+struct gsm48_req_ref rach_ref;
+uint8_t rach_ra;
+unsigned long rach_when;
+uint8_t ta;
+
+enum assign {
+	ASSIGN_NONE,
+	ASSIGN_NO_TX,
+	ASSIGN_RESULT,
+	ASSIGN_REJECT,
+	ASSIGN_TIMEOUT,
+} assign;
+
+/* UI */
+
+static void print_display(char *text, int *y, int c)
+{
+	/* skip lines, given by cursor */
+	(*y)++;
+	if (c >= (*y))
+		return;
+	/* skip, if end of display area is reached */
+	if ((*y) - c > NEIGH_LINES)
+		return;
+
+	fb_gotoxy(0, 20 + (((*y) - c - 1) << 3));
+	fb_putstr(text, framebuffer->width);
+}
+
+static void refresh_display(void)
+{
+	char text[16];
+	int bat = battery_info.battery_percent;
+
+	fb_clear();
+
+	/* header */
+	fb_setbg(FB_COLOR_WHITE);
+	if (mode != MODE_SPECTRUM && !(mode == MODE_SYNC && cursor < 0)) {
+		fb_setfg(FB_COLOR_BLUE);
+		fb_setfont(FB_FONT_HELVR08);
+		fb_gotoxy(0, 7);
+		fb_putstr("Osmocom RSSI", -1);
+		fb_setfg(FB_COLOR_RGB(0xc0, 0xc0, 0x00));
+		fb_setfont(FB_FONT_SYMBOLS);
+		fb_gotoxy(framebuffer->width - 15, 8);
+		if (bat >= 100 && (battery_info.flags & BATTERY_CHG_ENABLED)
+		 && !(battery_info.flags & BATTERY_CHARGING))
+			fb_putstr("@HHBC", framebuffer->width);
+		else {
+			sprintf(text, "@%c%c%cC", (bat >= 30) ? 'B':'A',
+				(bat >= 60) ? 'B':'A', (bat >= 90) ? 'B':'A');
+			fb_putstr(text, framebuffer->width);
+		}
+		fb_gotoxy(0, 8);
+		sprintf(text, "%c%cE%c%c", (power >= 40) ? 'D':'G',
+			(power >= 10) ? 'D':'G', (power >= 10) ? 'F':'G',
+			(power >= 40) ? 'F':'G');
+		fb_putstr(text, framebuffer->width);
+		fb_setfg(FB_COLOR_GREEN);
+		fb_gotoxy(0, 10);
+		fb_boxto(framebuffer->width - 1, 10);
+	}
+	fb_setfg(FB_COLOR_BLACK);
+	fb_setfont(FB_FONT_C64);
+
+	/* RACH */
+	if (mode == MODE_RACH) {
+		unsigned long elapsed = jiffies - rach_when;
+
+		fb_gotoxy(0,28);
+		switch (assign) {
+		case ASSIGN_NONE:
+			fb_putstr("Rach sent...", -1);
+			break;
+		case ASSIGN_RESULT:
+			sprintf(text, "TA = %d", ta);
+			fb_putstr(text, -1);
+			fb_gotoxy(0,36);
+			sprintf(text, "(%dm)", ta * 554);
+			fb_putstr(text, -1);
+			break;
+		case ASSIGN_REJECT:
+			fb_putstr("Rejected!", -1);
+			break;
+		case ASSIGN_NO_TX:
+			fb_putstr("TX disabled", -1);
+			break;
+		case ASSIGN_TIMEOUT:
+			fb_putstr("Timeout", -1);
+			break;
+		}
+		switch (assign) {
+		case ASSIGN_RESULT:
+		case ASSIGN_REJECT:
+			fb_gotoxy(0,44);
+			sprintf(text, "Delay:%ldms", elapsed * 1000 / HZ);
+			fb_putstr(text, -1);
+			break;
+		default:
+			break;
+		}
+	}
+
+	/* SYNC / UL levels */
+	if (mode == MODE_SYNC && cursor < 0) {
+		int i, tn, l;
+		int offset = (framebuffer->width - 96) >> 1;
+		int height = framebuffer->height - 25;
+
+		fb_setfont(FB_FONT_HELVR08);
+		for (i = 0; i < 8; i++) {
+			if (uplink)
+				tn = (i + 3) & 7; /* UL is shifted by 3 */
+			else
+				tn = i;
+			fb_setbg(FB_COLOR_WHITE);
+			fb_gotoxy(offset + 12 * i, 7);
+			l = (max) ? ul_max[tn] : ul_levels[tn];
+			l = 110 - l;
+			if (l >= 100)
+				l -= 100;
+			sprintf(text, "%02d", l);
+			fb_putstr(text, framebuffer->width);
+			fb_setbg(FB_COLOR_BLACK);
+			fb_gotoxy(offset + 3 + 12 * i, height + 10);
+			fb_boxto(offset + 3 + 12 * i + 5, height + 10 - ul_levels[tn] * height / 64);
+			if (max) {
+				fb_gotoxy(offset + 3 + 12 * i, height + 10 - ul_max[tn] * height / 64);
+				fb_boxto(offset + 3 + 12 * i + 5, height + 10 - ul_max[tn] * height / 64);
+			}
+		}
+		fb_setbg(FB_COLOR_TRANSP);
+		if (max) {
+			fb_setfg(FB_COLOR_RED);
+			fb_gotoxy(framebuffer->width - 16, 15);
+			fb_putstr("max", framebuffer->width);
+		}
+		fb_setfont(FB_FONT_C64);
+		fb_setfg(FB_COLOR_BLUE);
+		fb_gotoxy(0, 16);
+		if (pcs && ul_arfcn >= PCS_MIN && ul_arfcn <= PCS_MAX)
+			sprintf(text, "%4dP", ul_arfcn);
+		else if (ul_arfcn >= DCS_MIN && ul_arfcn <= DCS_MAX)
+			sprintf(text, "%4dD", ul_arfcn);
+		else
+			sprintf(text, "%4d ", ul_arfcn);
+		fb_putstr(text, framebuffer->width);
+		fb_setbg(FB_COLOR_WHITE);
+		fb_setfg(FB_COLOR_BLACK);
+	}
+
+	/* SYNC / SI */
+	if (mode == MODE_SYNC && cursor == 0) {
+		fb_gotoxy(0, 20);
+		if (sync_msg[0] == 'o')
+			sprintf(text, "BSIC%d/%d %4d", bsic >> 3, bsic & 7,
+				power - 110);
+		else
+			sprintf(text, "Sync %s", sync_msg);
+		fb_putstr(text, -1);
+
+		fb_gotoxy(0,28);
+		text[0] = si_1[2] ? '1' : '-';
+		text[1] = ' ';
+		text[2] = si_2[2] ? '2' : '-';
+		text[3] = ' ';
+		text[4] = si_2bis[2] ? '2' : '-';
+		text[5] = si_2bis[2] ? 'b' : ' ';
+		text[6] = si_2ter[2] ? '2' : '-';
+		text[7] = si_2ter[2] ? 't' : ' ';
+		text[8] = ' ';
+		text[9] = si_3[2] ? '3' : '-';
+		text[10] = ' ';
+		text[11] = si_4[2] ? '4' : '-';
+		text[12] = '\0';
+		fb_putstr(text, -1);
+
+		fb_gotoxy(0, 36);
+		fb_putstr("MCC MNC LAC ", -1);
+		fb_gotoxy(0, 44);
+		if (mcc) {
+			if ((mnc & 0x00f) == 0x00f)
+				sprintf(text, "%3x %02x  %04x", mcc, mnc >> 4, lac);
+			else
+				sprintf(text, "%3x %03x %04x", mcc, mnc, lac);
+			fb_putstr(text, -1);
+		} else
+			fb_putstr("--- --- ----", -1);
+		fb_gotoxy(0, 52);
+		if (si_3[2]) {
+			sprintf(text, "cell id:%04x", cell_id);
+			fb_putstr(text, -1);
+		} else
+			fb_putstr("cell id:----", -1);
+	}
+
+	/* SYNC / neighbour cells */
+	if (mode == MODE_SYNC && cursor > 0) {
+		int i, y = 0;
+
+		text[0] = '\0';
+		for (i = 0; i < 1024; i++) {
+			if (freq[i].mask & FREQ_TYPE_SERV) {
+				if (!text[0])
+					sprintf(text, "S: %4d", i);
+				else {
+					sprintf(text + 7, " %4d", i);
+					print_display(text, &y, cursor - 1);
+					text[0] = '\0';
+				}
+			}
+		}
+		if (text[0])
+			print_display(text, &y, cursor - 1);
+		text[0] = '\0';
+		for (i = 0; i < 1024; i++) {
+			if (freq[i].mask & FREQ_TYPE_NCELL) {
+				if (!text[0])
+					sprintf(text, "N: %4d", i);
+				else {
+					sprintf(text + 7, " %4d", i);
+					print_display(text, &y, cursor - 1);
+					text[0] = '\0';
+				}
+			}
+		}
+		if (text[0])
+			print_display(text, &y, cursor - 1);
+		nb_num = y;
+	}
+
+	/* ARFCN */
+	if (mode == MODE_MAIN || mode == MODE_ARFCN) {
+		fb_gotoxy(0, 20);
+		if (mode == MODE_ARFCN)
+			sprintf(text, "ARFCN %s", input);
+		else if (pcs && arfcn >= PCS_MIN && arfcn <= PCS_MAX)
+			sprintf(text, "ARFCN %dPCS", arfcn);
+		else if (arfcn >= DCS_MIN && arfcn <= DCS_MAX)
+			sprintf(text, "ARFCN %dDCS", arfcn);
+		else
+			sprintf(text, "ARFCN %d", arfcn);
+		fb_putstr(text,framebuffer->width);
+	}
+
+	/* cursor */
+	if (mode == MODE_ARFCN) {
+		fb_setfg(FB_COLOR_WHITE);
+		fb_setbg(FB_COLOR_BLUE);
+		fb_putstr(" ", framebuffer->width);
+		fb_setfg(FB_COLOR_BLACK);
+		fb_setbg(FB_COLOR_WHITE);
+	}
+
+	/* Frequency / power */
+	if (mode == MODE_MAIN) {
+		int f;
+
+		if (pcs && arfcn >= PCS_MIN && arfcn <= PCS_MAX) {
+			if (uplink)
+				f = PCS_UL;
+			else
+				f = PCS_DL;
+		} else if (uplink)
+			f = band->freq_ul;
+		else
+			f = band->freq_dl;
+		f += ((arfcn - band->min) & 1023) << 1;
+
+		fb_gotoxy(0, 30);
+		sprintf(text, "Freq. %d.%d", f / 10, f % 10);
+		fb_putstr(text,framebuffer->width);
+
+		fb_gotoxy(0, 40);
+		sprintf(text, "Power %d", ((max) ? max_power : power) - 110);
+		fb_putstr(text, framebuffer->width);
+		if (max) {
+			fb_setfont(FB_FONT_HELVR08);
+			fb_setfg(FB_COLOR_RED);
+			fb_gotoxy(framebuffer->width - 16, 39);
+			fb_putstr("max", framebuffer->width);
+			fb_setfont(FB_FONT_C64);
+			fb_setfg(FB_COLOR_BLACK);
+		}
+		fb_setbg(FB_COLOR_BLACK);
+		fb_gotoxy(0, 45);
+		fb_boxto(framebuffer->width * power / 64, 50);
+		if (max) {
+			fb_gotoxy(framebuffer->width * max_power / 64 ,45);
+			fb_boxto(framebuffer->width * max_power / 64, 50);
+		}
+		fb_setbg(FB_COLOR_WHITE);
+	}
+
+	/* spectrum */
+	if (mode == MODE_SPECTRUM) {
+		int i;
+		uint16_t a, e, p;
+		int height = framebuffer->height - 25;
+
+		fb_gotoxy(0, 8);
+		if (pcs && arfcn >= PCS_MIN && arfcn <= PCS_MAX)
+			sprintf(text, "%4dP", arfcn);
+		else if (arfcn >= DCS_MIN && arfcn <= DCS_MAX)
+			sprintf(text, "%4dD", arfcn);
+		else
+			sprintf(text, "%4d ", arfcn);
+		sprintf(text + 5, "   %4d", pm_spectrum[arfcn & 1023] - 110);
+		fb_putstr(text, -1);
+		fb_setfg(FB_COLOR_RED);
+		if (max) {
+			fb_setfont(FB_FONT_HELVR08);
+			fb_gotoxy(framebuffer->width - 16,15);
+			fb_putstr("max", framebuffer->width);
+			fb_setfont(FB_FONT_C64);
+		}
+		if (pm_scale != 1) {
+			fb_setfont(FB_FONT_HELVR08);
+			fb_gotoxy(1, 15);
+			sprintf(text, "x%d", pm_scale);
+			fb_putstr(text, framebuffer->width);
+			fb_setfont(FB_FONT_C64);
+		}
+		fb_setfg(FB_COLOR_BLACK);
+		if (pcs && arfcn >= PCS_MIN && arfcn <= PCS_MAX) {
+			a = PCS_MIN;
+			e = PCS_MAX;
+		} else {
+			a = band->min;
+			e = band->max;
+		}
+		for (i = 0; i < framebuffer->width; i++) {
+			p = (arfcn + i - (framebuffer->width >> 1)) & 1023;
+			if ((((p - a) & 1023) & 512))
+				continue;
+			if ((((e - p) & 1023) & 512))
+				continue;
+			p = (pm_spectrum[p] * pm_scale * height / 64);
+			if (p > height)
+				p = height;
+			if (i == (framebuffer->width >> 1))
+				fb_setfg(FB_COLOR_RED);
+			fb_gotoxy(i, height + 10 - p);
+			fb_boxto(i, height + 10);
+			if (i == (framebuffer->width >> 1))
+				fb_setfg(FB_COLOR_BLACK);
+		}
+		i = framebuffer->width >> 1;
+		fb_gotoxy(i, 0);
+		fb_boxto(i, 4);
+		fb_gotoxy(i, height + 10);
+		fb_boxto(i, height + 14);
+	}
+
+	/* footer */
+	fb_setfg(FB_COLOR_GREEN);
+	fb_gotoxy(0, framebuffer->height - 10);
+	fb_boxto(framebuffer->width-1, framebuffer->height - 10);
+	fb_gotoxy(0, framebuffer->height - 1);
+	fb_setfg(FB_COLOR_RED);
+	if (mode == MODE_ARFCN)
+		sprintf(text, "%s   %s", (cursor) ? "del " : "back",
+			(cursor) ? "enter" : "     ");
+	else if (mode == MODE_SYNC && cursor < 0)
+		sprintf(text, "%s      %s", "back",
+			(uplink) ? "UL" : "DL");
+	else if (mode == MODE_SYNC || mode == MODE_RACH)
+		sprintf(text, "%s        ", "back");
+	else
+		sprintf(text, "%s       %s", (pcs) ? "PCS" : "DCS",
+			(uplink) ? "UL" : "DL");
+	fb_putstr(text, -1);
+	fb_setfg(FB_COLOR_BLACK);
+	fb_setfont(FB_FONT_HELVR08);
+	fb_gotoxy(0, framebuffer->height - 2);
+	sprintf(text, "%d", tone / 25);
+	fb_putstr(text, -1);
+
+	fb_flush();
+}
+
+static void exit_arfcn(void)
+{
+	mode = last_mode;
+	refresh_display();
+}
+
+static void enter_arfcn(enum key_codes code)
+{
+	/* enter mode */
+	if (mode != MODE_ARFCN) {
+		last_mode = mode;
+		mode = MODE_ARFCN;
+		input[0] = code - KEY_0 + '0';
+		input[1] = '\0';
+		cursor = 1;
+		refresh_display();
+		return;
+	}
+
+	if (code == KEY_LEFT_SB) {
+		/* back */
+		if (cursor == 0) {
+			exit_arfcn();
+			return;
+		}
+		/* delete */
+		cursor--;
+		input[cursor] = '\0';
+		refresh_display();
+		return;
+	}
+
+	if (code == KEY_RIGHT_SB) {
+		int check = 0;
+		int i;
+		struct band *temp = NULL;
+
+		/* nothing entered */
+		if (cursor == 0) {
+			return;
+		}
+		for (i = 0; i < cursor; i++)
+			check = (check << 3) + (check << 1) + input[i] - '0';
+
+		/* check */
+		for (i = 0; bands[i].max; i++) {
+			temp = &bands[i];
+			if (temp->min < temp->max) {
+				if (check >= temp->min && check <= temp->max)
+					break;
+			} else {
+				if (check >= temp->min || check <= temp->max)
+					break;
+			}
+		}
+		if (!bands[i].max)
+			return;
+		if (check > 1023)
+			return;
+		arfcn = check;
+		band = temp;
+		mode = last_mode;
+		refresh_display();
+		return;
+	}
+
+	if (cursor == 4)
+		return;
+
+	input[cursor] = code - KEY_0 + '0';
+	cursor++;
+	input[cursor] = '\0';
+	refresh_display();
+}
+
+static int inc_dec_arfcn(int inc)
+{
+	int i;
+
+	/* select current band */
+	for (i = 0; bands[i].max; i++) {
+		band = &bands[i];
+		if (band->min < band->max) {
+			if (arfcn >= band->min && arfcn <= band->max)
+				break;
+		} else {
+			if (arfcn >= band->min || arfcn <= band->max)
+				break;
+		}
+	}
+	if (!bands[i].max)
+		return -EINVAL;
+
+	if (inc) {
+		if (arfcn == band->max)
+			arfcn = band->next;
+		else if (arfcn == 1023)
+			arfcn = 0;
+		else
+			arfcn++;
+	} else {
+		if (arfcn == band->min)
+			arfcn = band->prev;
+		else if (arfcn == 0)
+			arfcn = 1023;
+		else
+			arfcn--;
+	}
+	/* select next band */
+	for (i = 0; bands[i].max; i++) {
+		band = &bands[i];
+		if (band->min < band->max) {
+			if (arfcn >= band->min && arfcn <= band->max)
+				break;
+		} else {
+			if (arfcn >= band->min || arfcn <= band->max)
+				break;
+		}
+	}
+	if (!bands[i].max)
+		return -EINVAL;
+
+	refresh_display();
+
+	return 0;
+}
+
+static void request_ul_levels(uint16_t a);
+
+static int inc_dec_ul_arfcn(int inc)
+{
+	uint16_t a;
+
+	/* loop until we hit a serving cell or our current bcch arfcn */
+	if (inc) {
+		for (a = (ul_arfcn + 1) & 1023; a != (arfcn & 1023);
+					a = (a + 1) & 1023) {
+			if ((freq[a].mask & FREQ_TYPE_SERV))
+				break;
+		}
+	} else {
+		for (a = (ul_arfcn - 1) & 1023; a != (arfcn & 1023);
+					a = (a - 1) & 1023) {
+			if ((freq[a].mask & FREQ_TYPE_SERV))
+				break;
+		}
+	}
+	ul_arfcn = a;
+
+	refresh_display();
+
+	request_ul_levels(a);
+
+	return 0;
+}
+
+static void toggle_dcs_pcs(void)
+{
+	pcs = !pcs;
+	refresh_display();
+}
+
+static void toggle_up_down(void)
+{
+	uplink = !uplink;
+	refresh_display();
+
+	if (mode == MODE_SYNC && cursor < 0)
+		request_ul_levels(ul_arfcn);
+}
+
+static void toggle_spectrum(void)
+{
+	if (mode == MODE_MAIN) {
+		mode = MODE_SPECTRUM;
+		pm_mode = PM_IDLE;
+	} else if (mode == MODE_SPECTRUM) {
+		mode = MODE_MAIN;
+		pm_mode = PM_IDLE;
+	}
+	l1s_reset();
+	l1s_reset_hw();
+	pm_count = 0;
+	refresh_display();
+}
+
+static void tone_inc_dec(int inc)
+{
+	if (inc) {
+		if (tone + 25 <= 255)
+			tone += 25;
+	} else {
+		if (tone - 25 >= 0)
+			tone -= 25;
+	}
+
+	refresh_display();
+}
+
+static void hold_max(void)
+{
+	max = !max;
+	max_power = power;
+	refresh_display();
+}
+
+static int inc_dec_neighbour(int inc)
+{
+	if (inc) {
+		if (cursor > 0 && cursor - 1 >= (nb_num - NEIGH_LINES))
+			return -EINVAL;
+		cursor++;
+	} else {
+		if (cursor < 0)
+			return -EINVAL;
+		cursor--;
+	}
+
+	refresh_display();
+
+	return 0;
+}
+
+static int inc_dec_spectrum(int inc)
+{
+	if (inc) {
+		pm_scale <<= 1;
+		if (pm_scale > 8)
+			pm_scale = 8;
+	} else {
+		pm_scale >>= 1;
+		if (pm_scale < 1)
+			pm_scale = 1;
+	}
+
+	refresh_display();
+
+	return 0;
+}
+
+static void enter_sync(void);
+static void exit_sync(void);
+
+static void enter_rach(void);
+static void exit_rach(void);
+
+static void handle_key_code()
+{
+	/* key repeat */
+	if (key_pressed) {
+		unsigned long elapsed = jiffies - key_pressed_when;
+		if (elapsed > key_pressed_delay) {
+			key_pressed_when = jiffies;
+			key_pressed_delay = HZ / 10;
+			/* only repeat these keys */
+			if (key_pressed_code == KEY_LEFT
+			 || key_pressed_code == KEY_RIGHT)
+				key_code = key_pressed_code;
+		}
+	}
+
+	if (key_code == KEY_INV)
+		return;
+
+	/* do later, do not disturb tone */
+	if (tone_on)
+		return;
+
+	switch (key_code) {
+	case KEY_0:
+	case KEY_1:
+	case KEY_2:
+	case KEY_3:
+	case KEY_4:
+	case KEY_5:
+	case KEY_6:
+	case KEY_7:
+	case KEY_8:
+	case KEY_9:
+		if (mode == MODE_MAIN || mode == MODE_SPECTRUM || mode == MODE_ARFCN)
+			enter_arfcn(key_code);
+		break;
+	case KEY_UP:
+		if (mode == MODE_MAIN)
+			tone_inc_dec(1);
+		else if (mode == MODE_SYNC)
+			inc_dec_neighbour(0);
+		else if (mode == MODE_SPECTRUM)
+			inc_dec_spectrum(1);
+		break;
+	case KEY_DOWN:
+		if (mode == MODE_MAIN)
+			tone_inc_dec(0);
+		else if (mode == MODE_SYNC)
+			inc_dec_neighbour(1);
+		else if (mode == MODE_SPECTRUM)
+			inc_dec_spectrum(0);
+		break;
+	case KEY_RIGHT:
+		if (mode == MODE_MAIN || mode == MODE_SPECTRUM)
+			inc_dec_arfcn(1);
+		else if (mode == MODE_SYNC && cursor < 0)
+			inc_dec_ul_arfcn(1);
+		break;
+	case KEY_LEFT:
+		if (mode == MODE_MAIN || mode == MODE_SPECTRUM)
+			inc_dec_arfcn(0);
+		else if (mode == MODE_SYNC && cursor < 0)
+			inc_dec_ul_arfcn(0);
+		break;
+	case KEY_LEFT_SB:
+		if (mode == MODE_MAIN || mode == MODE_SPECTRUM)
+			toggle_dcs_pcs();
+		else if (mode == MODE_ARFCN)
+			enter_arfcn(key_code);
+		else if (mode == MODE_SYNC)
+			exit_sync();
+		else if (mode == MODE_RACH)
+			exit_rach();
+		break;
+	case KEY_RIGHT_SB:
+		if (mode == MODE_MAIN || mode == MODE_SPECTRUM)
+			toggle_up_down();
+		else if (mode == MODE_ARFCN)
+			enter_arfcn(key_code);
+		else if (mode == MODE_SYNC && cursor < 0)
+			toggle_up_down();
+		break;
+	case KEY_OK:
+		if (mode == MODE_MAIN || mode == MODE_SPECTRUM)
+			enter_sync();
+		else if (mode == MODE_SYNC || mode == MODE_RACH)
+			enter_rach();
+		break;
+	case KEY_MENU:
+		hold_max();
+		break;
+	case KEY_POWER:
+		if (mode == MODE_ARFCN)
+			exit_arfcn();
+		else if (mode == MODE_SYNC)
+			exit_sync();
+		else if (mode == MODE_RACH)
+			exit_rach();
+		else if (mode == MODE_SPECTRUM)
+			toggle_spectrum();
+		break;
+	case KEY_STAR:
+		if (mode == MODE_MAIN || mode == MODE_SPECTRUM)
+			toggle_spectrum();
+		break;
+	default:
+		break;
+	}
+
+	key_code = KEY_INV;
+}
+
+static void handle_tone(void)
+{
+	unsigned long elapsed = jiffies - tone_time;
+
+	if (!tone_on) {
+		if (!tone || mode != MODE_MAIN)
+			return;
+		/* wait depending on power level */
+		if (elapsed < (uint8_t)(63-power))
+			return;
+		buzzer_volume(tone);
+		buzzer_note(NOTE(NOTE_C, OCTAVE_5));
+		tone_time = jiffies;
+		tone_on = 1;
+		return;
+	}
+
+	if (elapsed >= TONE_JIFFIES) {
+		tone_on = 0;
+		tone_time = jiffies;
+		buzzer_volume(0);
+	}
+}
+
+/* PM handling */
+
+static void handle_pm(void)
+{
+	/* start power measurement */
+	if (pm_mode == PM_IDLE && (mode == MODE_MAIN || mode == MODE_SPECTRUM)) {
+		struct msgb *msg = l1ctl_msgb_alloc(L1CTL_PM_REQ);
+		struct l1ctl_pm_req *pm;
+		uint16_t a, e;
+
+		pm = (struct l1ctl_pm_req *) msgb_put(msg, sizeof(*pm));
+		pm->type = 1;
+		if (mode == MODE_MAIN) {
+			a = arfcn;
+			if (pcs && arfcn >= PCS_MIN && arfcn <= PCS_MAX)
+				a |= ARFCN_PCS;
+			if (uplink)
+				a |= ARFCN_UPLINK;
+			e = a;
+			pm_mode = PM_SENT;
+		}
+		if (mode == MODE_SPECTRUM) {
+			if (pcs && arfcn >= PCS_MIN && arfcn <= PCS_MAX) {
+				a = PCS_MIN | ARFCN_PCS;
+				e = PCS_MAX | ARFCN_PCS;
+			} else {
+				a = band->min;
+				e = band->max;
+			}
+			pm_mode = PM_RANGE_SENT;
+		}
+		if (uplink) {
+			a |= ARFCN_UPLINK;
+			e |= ARFCN_UPLINK;
+		}
+		pm->range.band_arfcn_from = htons(a);
+		pm->range.band_arfcn_to = htons(e);
+
+		l1a_l23_rx(SC_DLCI_L1A_L23, msg);
+
+		return;
+	}
+
+	if (pm_mode == PM_RESULT) {
+		pm_mode = PM_IDLE;
+		if (pm_count == pm_max) {
+			int i = 0;
+			int sum = 0;
+
+			if (uplink) {
+				/* find max */
+				for (i = 0; i < pm_count; i++) {
+					if (pm_meas[i] > sum)
+						sum = pm_meas[i];
+				}
+				power = sum;
+			} else {
+				for (i = 0; i < pm_count; i++)
+					sum += pm_meas[i];
+				power = sum / pm_count;
+			}
+			if (power > max_power)
+				max_power = power;
+			pm_count = 0;
+			pm_max = (uplink) ? NUM_PM_UL : NUM_PM_DL;
+			if (!tone_on)
+				refresh_display();
+		}
+		return;
+	}
+
+	if (pm_mode == PM_RANGE_RESULT) {
+		pm_mode = PM_IDLE;
+		refresh_display();
+		buzzer_volume(tone);
+		buzzer_note(NOTE(NOTE_C, OCTAVE_5));
+		tone_time = jiffies;
+		tone_on = 1;
+		return;
+	}
+}
+
+/* sync / SI */
+
+static void enter_sync(void)
+{
+	struct msgb *msg = l1ctl_msgb_alloc(L1CTL_FBSB_REQ);
+	struct l1ctl_fbsb_req *req;
+	uint16_t a = arfcn;
+
+	l1s_reset();
+	l1s_reset_hw();
+	pm_count = 0;
+	pm_mode = PM_IDLE;
+
+	req = (struct l1ctl_fbsb_req *) msgb_put(msg, sizeof(*req));
+	if (pcs && arfcn >= PCS_MIN && arfcn <= PCS_MAX)
+		a |= ARFCN_PCS;
+	req->band_arfcn = htons(a);
+	req->timeout = htons(100);
+	/* Threshold when to consider FB_MODE1: 4kHz - 1kHz */
+	req->freq_err_thresh1 = htons(11000 - 1000);
+	/* Threshold when to consider SCH: 1kHz - 200Hz */
+	req->freq_err_thresh2 = htons(1000 - 200);
+	/* not used yet! */
+	req->num_freqerr_avg = 3;
+	req->flags = L1CTL_FBSB_F_FB01SB;
+	req->sync_info_idx = 0;
+	req->ccch_mode = CCCH_MODE_NONE;
+	l1a_l23_rx(SC_DLCI_L1A_L23, msg);
+
+	mode = MODE_SYNC;
+	memset(ul_levels, 0, sizeof(ul_levels));
+	si_new = 0;
+	ul_new = 0;
+	ul_arfcn = arfcn;
+	si_1[2] = 0;
+	si_2[2] = 0;
+	si_2bis[2] = 0;
+	si_2ter[2] = 0;
+	si_3[2] = 0;
+	si_4[2] = 0;
+	mcc = mnc = lac = 0;
+	ccch_conf = -1;
+	memset(freq, 0, sizeof(freq));
+	cursor = 0;
+	nb_num = 0;
+	sync_msg = "trying";
+	refresh_display();
+}
+
+static void exit_sync(void)
+{
+	l1s_reset();
+	l1s_reset_hw();
+	pm_count = 0;
+	pm_mode = PM_IDLE;
+	mode = MODE_MAIN;
+}
+
+int gsm48_decode_lai(struct gsm48_loc_area_id *lai, uint16_t *_mcc,
+uint16_t *_mnc, uint16_t *_lac)
+{
+	*_mcc = ((lai->digits[0] & 0x0f) << 8)
+	 | (lai->digits[0] & 0xf0)
+	 | (lai->digits[1] & 0x0f);
+	*_mnc = ((lai->digits[2] & 0x0f) << 8)
+	 | (lai->digits[2] & 0xf0)
+	 | ((lai->digits[1] & 0xf0) >> 4);
+	*_lac = ntohs(lai->lac);
+
+	return 0;
+}
+
+static void request_ul_levels(uint16_t a)
+{
+	struct msgb *msg = l1ctl_msgb_alloc(L1CTL_NEIGH_PM_REQ);
+	struct l1ctl_neigh_pm_req *pm_req =
+		(struct l1ctl_neigh_pm_req *) msgb_put(msg, sizeof(*pm_req));
+	int i;
+
+	if (pcs && a >= PCS_MIN && a <= PCS_MAX)
+		a |= ARFCN_PCS;
+	if (uplink)
+		a |= ARFCN_UPLINK;
+	pm_req->n = 8;
+	for (i = 0; i < 8; i++) {
+		pm_req->band_arfcn[i] = htons(a);
+		pm_req->tn[i] = i;
+	}
+	l1a_l23_rx(SC_DLCI_L1A_L23, msg);
+}
+
+static void handle_sync(void)
+{
+	struct gsm48_system_information_type_1 *si1;
+	struct gsm48_system_information_type_2 *si2;
+	struct gsm48_system_information_type_2bis *si2bis;
+	struct gsm48_system_information_type_2ter *si2ter;
+	struct gsm48_system_information_type_3 *si3;
+	struct gsm48_system_information_type_4 *si4;
+
+	if (mode != MODE_SYNC)
+		return;
+
+	/* once we synced, we take the result and request UL measurement */
+	if (sync_result) {
+		uint16_t a = ul_arfcn;
+
+		sync_msg = sync_result;
+		sync_result = NULL;
+		refresh_display();
+
+		if (sync_msg[0] != 'o')
+			return;
+
+		request_ul_levels(a);
+
+		return;
+	}
+
+	if (tone_on)
+		return;
+
+	/* no UL result, no SI result */
+	if (!ul_new && !(si_new & 0x100))
+		return;
+
+	/* new UL result */
+	if (ul_new) {
+		ul_new = 0;
+		if (cursor < 0)
+			refresh_display();
+		return;
+	}
+
+	/* decode si */
+	switch (si_new & 0xff) {
+	case GSM48_MT_RR_SYSINFO_1:
+		si1 = (struct gsm48_system_information_type_1 *)si_1;
+		gsm48_decode_freq_list(freq, si1->cell_channel_description,
+	                sizeof(si1->cell_channel_description), 0xce,
+					FREQ_TYPE_SERV);
+		break;
+	case GSM48_MT_RR_SYSINFO_2:
+		si2 = (struct gsm48_system_information_type_2 *)si_2;
+		gsm48_decode_freq_list(freq, si2->bcch_frequency_list,
+	                sizeof(si2->bcch_frequency_list), 0xce,
+					FREQ_TYPE_NCELL_2);
+		break;
+	case GSM48_MT_RR_SYSINFO_2bis:
+		si2bis = (struct gsm48_system_information_type_2bis *)si_2bis;
+		gsm48_decode_freq_list(freq, si2bis->bcch_frequency_list,
+	                sizeof(si2bis->bcch_frequency_list), 0xce,
+					FREQ_TYPE_NCELL_2bis);
+		break;
+	case GSM48_MT_RR_SYSINFO_2ter:
+		si2ter = (struct gsm48_system_information_type_2ter *)si_2ter;
+		gsm48_decode_freq_list(freq, si2ter->ext_bcch_frequency_list,
+	                sizeof(si2ter->ext_bcch_frequency_list), 0x8e,
+					FREQ_TYPE_NCELL_2ter);
+		break;
+	case GSM48_MT_RR_SYSINFO_3:
+		si3 = (struct gsm48_system_information_type_3 *)si_3;
+		gsm48_decode_lai(&si3->lai, &mcc, &mnc, &lac);
+		cell_id = ntohs(si3->cell_identity);
+		if (ccch_conf < 0) {
+			struct msgb *msg =
+				l1ctl_msgb_alloc(L1CTL_CCCH_MODE_REQ);
+			struct l1ctl_ccch_mode_req *req =
+				(struct l1ctl_ccch_mode_req *)
+					msgb_put(msg, sizeof(*req));
+
+			ccch_conf = si3->control_channel_desc.ccch_conf;
+			req->ccch_mode = (ccch_conf == 1)
+					? CCCH_MODE_COMBINED
+					: CCCH_MODE_NON_COMBINED;
+			printf("ccch_mode=%d\n", ccch_conf);
+
+			l1a_l23_rx(SC_DLCI_L1A_L23, msg);
+		}
+		break;
+	case GSM48_MT_RR_SYSINFO_4:
+		si4 = (struct gsm48_system_information_type_4 *)si_4;
+		gsm48_decode_lai(&si4->lai, &mcc, &mnc, &lac);
+		break;
+	}
+
+	if (cursor >= 0)
+		refresh_display();
+
+	/* tone depends on successfully received BCCH */
+	buzzer_volume(tone);
+	tone_time = jiffies;
+	tone_on = 1;
+	if ((si_new & 0xff) == 0xff)
+		buzzer_note(NOTE(NOTE_C, OCTAVE_2));
+	else
+		buzzer_note(NOTE(NOTE_C, OCTAVE_5));
+	si_new = 0;
+}
+
+static void enter_rach(void)
+{
+	if (ccch_conf < 0)
+		return;
+
+	if (rach)
+		return;
+
+#ifndef CONFIG_TX_ENABLE
+	assign = ASSIGN_NO_TX;
+	mode = MODE_RACH;
+	/* display refresh is done by rach handler */
+#else
+	struct msgb *msg1 = l1ctl_msgb_alloc(L1CTL_NEIGH_PM_REQ);
+	struct msgb *msg2 = l1ctl_msgb_alloc(L1CTL_RACH_REQ);
+	struct l1ctl_neigh_pm_req *pm_req = (struct l1ctl_neigh_pm_req *)
+			msgb_put(msg1, sizeof(*pm_req));
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *)
+			msgb_put(msg2, sizeof(*ul));;
+	struct l1ctl_rach_req *rach_req = (struct l1ctl_rach_req *)
+			msgb_put(msg2, sizeof(*rach_req));
+
+	l1s.tx_power = 0;
+
+	pm_req->n = 0; /* disable */
+
+	rach_ra = 0x00;
+	rach_req->ra = rach_ra;
+	rach_req->offset = 0;
+	rach_req->combined = (ccch_conf == 1);
+
+	l1a_l23_rx(SC_DLCI_L1A_L23, msg1);
+	l1a_l23_rx(SC_DLCI_L1A_L23, msg2);
+	rach = 1;
+	rach_when = jiffies;
+	assign = ASSIGN_NONE;
+	mode = MODE_RACH;
+	refresh_display();
+#endif
+
+}
+
+static void exit_rach(void)
+{
+	rach = 0;
+
+	request_ul_levels(ul_arfcn);
+
+	mode = MODE_SYNC;
+	refresh_display();
+}
+
+static void handle_assign(void)
+{
+	if (mode != MODE_RACH)
+		return;
+
+	if (assign == ASSIGN_NONE) {
+		unsigned long elapsed = jiffies - rach_when;
+
+		if (!rach)
+			return;
+		if (elapsed < HZ * 2)
+			return;
+		assign = ASSIGN_TIMEOUT;
+		rach = 0;
+	}
+
+	refresh_display();
+	assign = ASSIGN_NONE;
+}
+
+/* Main Program */
+const char *hr = "======================================================================\n";
+
+/* match request reference agains request history */
+static int gsm48_match_ra(struct gsm48_req_ref *ref)
+{
+	uint8_t ia_t1, ia_t2, ia_t3;
+	uint8_t cr_t1, cr_t2, cr_t3;
+
+	if (rach && ref->ra == rach_ra) {
+		ia_t1 = ref->t1;
+		ia_t2 = ref->t2;
+		ia_t3 = (ref->t3_high << 3) | ref->t3_low;
+		ref = &rach_ref;
+		cr_t1 = ref->t1;
+		cr_t2 = ref->t2;
+		cr_t3 = (ref->t3_high << 3) | ref->t3_low;
+		if (ia_t1 == cr_t1 && ia_t2 == cr_t2 && ia_t3 == cr_t3)
+			return 1;
+	}
+
+	return 0;
+}
+
+
+/* note: called from IRQ context */
+static void rx_imm_ass(struct msgb *msg)
+{
+	struct gsm48_imm_ass *ia = msgb_l3(msg);
+
+	if (gsm48_match_ra(&ia->req_ref)) {
+		assign = ASSIGN_RESULT;
+		ta = ia->timing_advance;
+		rach = 0;
+	}
+}
+
+/* note: called from IRQ context */
+static void rx_imm_ass_ext(struct msgb *msg)
+{
+	struct gsm48_imm_ass_ext *ia = msgb_l3(msg);
+
+	if (gsm48_match_ra(&ia->req_ref1)) {
+		assign = ASSIGN_RESULT;
+		ta = ia->timing_advance1;
+		rach = 0;
+	}
+	if (gsm48_match_ra(&ia->req_ref2)) {
+		assign = ASSIGN_RESULT;
+		ta = ia->timing_advance2;
+		rach = 0;
+	}
+}
+
+/* note: called from IRQ context */
+static void rx_imm_ass_rej(struct msgb *msg)
+{
+	struct gsm48_imm_ass_rej *ia = msgb_l3(msg);
+	struct gsm48_req_ref *req_ref;
+	int i;
+
+	for (i = 0; i < 4; i++) {
+		/* request reference */
+		req_ref = (struct gsm48_req_ref *)
+			(((uint8_t *)&ia->req_ref1) + i * 4);
+		if (gsm48_match_ra(req_ref)) {
+			assign = ASSIGN_REJECT;
+			rach = 0;
+		}
+	}
+}
+
+/* note: called from IRQ context */
+static void rx_pch_agch(struct msgb *msg)
+{
+	struct gsm48_system_information_type_header *sih;
+
+	/* store SI */
+	sih = msgb_l3(msg);
+	switch (sih->system_information) {
+	case GSM48_MT_RR_IMM_ASS:
+		rx_imm_ass(msg);
+		break;
+	case GSM48_MT_RR_IMM_ASS_EXT:
+		rx_imm_ass_ext(msg);
+		break;
+	case GSM48_MT_RR_IMM_ASS_REJ:
+		rx_imm_ass_rej(msg);
+		break;
+	}
+}
+
+/* note: called from IRQ context */
+static void rx_bcch(struct msgb *msg)
+{
+	struct gsm48_system_information_type_header *sih;
+
+	/* store SI */
+	sih = msgb_l3(msg);
+	switch (sih->system_information) {
+	case GSM48_MT_RR_SYSINFO_1:
+		memcpy(si_1, msgb_l3(msg), msgb_l3len(msg));
+		break;
+	case GSM48_MT_RR_SYSINFO_2:
+		memcpy(si_2, msgb_l3(msg), msgb_l3len(msg));
+		break;
+	case GSM48_MT_RR_SYSINFO_2bis:
+		memcpy(si_2bis, msgb_l3(msg), msgb_l3len(msg));
+		break;
+	case GSM48_MT_RR_SYSINFO_2ter:
+		memcpy(si_2ter, msgb_l3(msg), msgb_l3len(msg));
+		break;
+	case GSM48_MT_RR_SYSINFO_3:
+		memcpy(si_3, msgb_l3(msg), msgb_l3len(msg));
+		break;
+	case GSM48_MT_RR_SYSINFO_4:
+		memcpy(si_4, msgb_l3(msg), msgb_l3len(msg));
+		break;
+	}
+	si_new = sih->system_information | 0x100;
+}
+
+/* note: called from IRQ context */
+static void l1a_l23_tx(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->l1h;
+	struct l1ctl_pm_conf *pmr;
+	struct l1ctl_info_dl *dl;
+	struct l1ctl_fbsb_conf *sb;
+	uint8_t chan_type, chan_ts, chan_ss;
+	struct l1ctl_neigh_pm_ind *pm_ind;
+	struct gsm_time tm;
+
+	switch (l1h->msg_type) {
+	case L1CTL_PM_CONF:
+		if (pm_mode == PM_SENT) {
+			pmr = (struct l1ctl_pm_conf *) l1h->data;
+			pm_meas[pm_count] = pmr->pm[0];
+			pm_count++;
+			pm_mode = PM_RESULT;
+		}
+		if (pm_mode == PM_RANGE_SENT) {
+			for (pmr = (struct l1ctl_pm_conf *) l1h->data;
+				(uint8_t *) pmr < msg->tail; pmr++) {
+				if (!max || pm_spectrum[ntohs(pmr->band_arfcn) & 1023] < pmr->pm[0])
+					pm_spectrum[ntohs(pmr->band_arfcn) & 1023] = pmr->pm[0];
+			}
+			if ((l1h->flags & L1CTL_F_DONE))
+				pm_mode = PM_RANGE_RESULT;
+		}
+		l1s.tpu_offset_correction += 5000 / NUM_PM_UL;
+		break;
+	case L1CTL_FBSB_CONF:
+		dl = (struct l1ctl_info_dl *) l1h->data;
+		sb = (struct l1ctl_fbsb_conf *) dl->payload;
+		if (sb->result == 0)
+			sync_result = "ok";
+		else
+			sync_result = "error";
+		bsic = sb->bsic;
+		break;
+	case L1CTL_DATA_IND:
+		dl = (struct l1ctl_info_dl *) l1h->data;
+		msg->l2h = dl->payload;
+		rsl_dec_chan_nr(dl->chan_nr, &chan_type, &chan_ss, &chan_ts);
+
+		power = dl->rx_level;
+		if (dl->fire_crc >= 2) {
+			if (chan_type == RSL_CHAN_BCCH)
+				si_new = 0x1ff; /* error frame indication */
+			break; /* free, but don't send to sercom */
+		}
+
+		switch (chan_type) {
+		case RSL_CHAN_BCCH:
+			msg->l3h = msg->l2h;
+			rx_bcch(msg);
+			break;
+		case RSL_CHAN_PCH_AGCH:
+			msg->l3h = msg->l2h;
+			rx_pch_agch(msg);
+			break;
+		}
+		sercomm_sendmsg(SC_DLCI_L1A_L23, msg);
+		return; /* msg is freed by sercom */
+	case L1CTL_NEIGH_PM_IND:
+		for (pm_ind = (struct l1ctl_neigh_pm_ind *) l1h->data;
+			(uint8_t *) pm_ind < msg->tail; pm_ind++) {
+			ul_levels[pm_ind->tn] = pm_ind->pm[0];
+			/* hold max only, if max enabled and level is lower */
+			if (!max || ul_levels[pm_ind->tn] > ul_max[pm_ind->tn])
+				ul_max[pm_ind->tn] = ul_levels[pm_ind->tn];
+			if (pm_ind->tn == 7)
+				ul_new = 1;
+		}
+		break;
+	case L1CTL_RACH_CONF:
+		dl = (struct l1ctl_info_dl *) l1h->data;
+		gsm_fn2gsmtime(&tm, ntohl(dl->frame_nr));
+		rach_ref.t1 = tm.t1;
+		rach_ref.t2 = tm.t2;
+		rach_ref.t3_low = tm.t3 & 0x7;
+		rach_ref.t3_high = tm.t3 >> 3;
+		break;
+	}
+
+	msgb_free(msg);
+
+}
+
+static void console_rx_cb(uint8_t dlci, struct msgb *msg)
+{
+	if (dlci != SC_DLCI_CONSOLE) {
+		printf("Message for unknown DLCI %u\n", dlci);
+		return;
+	}
+
+	printf("Message on console DLCI: '%s'\n", msg->data);
+	msgb_free(msg);
+}
+
+static void l1a_l23_rx_cb(uint8_t dlci, struct msgb *msg)
+{
+	int i;
+	printf("l1a_l23_rx_cb (DLCI %d): ", dlci);
+	for (i = 0; i < msg->len; i++)
+		printf("%02x ", msg->data[i]);
+	puts("\n");
+}
+
+static void key_handler(enum key_codes code, enum key_states state)
+{
+	if (state != PRESSED) {
+		key_pressed = 0;
+		return;
+	}
+	/* key repeat */
+	if (!key_pressed) {
+		key_pressed = 1;
+		key_pressed_when = jiffies;
+		key_pressed_code = code;
+		key_pressed_delay = HZ * 6 / 10;
+	}
+
+	key_code = code;
+}
+
+int main(void)
+{
+	board_init(1);
+
+	puts("\n\nOsmocomBB Monitor Tool (revision " GIT_REVISION ")\n");
+	puts(hr);
+
+	/* Dump device identification */
+	dump_dev_id();
+	puts(hr);
+
+	/* Dump clock config before PLL set */
+	calypso_clk_dump();
+	puts(hr);
+
+	keypad_set_handler(&key_handler);
+
+	/* Dump clock config after PLL set */
+	calypso_clk_dump();
+	puts(hr);
+
+	sercomm_register_rx_cb(SC_DLCI_CONSOLE, console_rx_cb);
+	sercomm_register_rx_cb(SC_DLCI_L1A_L23, l1a_l23_rx_cb);
+
+	layer1_init();
+	l1a_l23_tx_cb = l1a_l23_tx;
+
+//	display_unset_attr(DISP_ATTR_INVERT);
+
+	tpu_frame_irq_en(1, 1);
+
+	buzzer_mode_pwt(1);
+	buzzer_volume(0);
+
+	memset(pm_spectrum, 0, sizeof(pm_spectrum));
+	memset(ul_max, 0, sizeof(ul_max));
+
+	/* inc 0 to 1 and refresh */
+	inc_dec_arfcn(1);
+
+	while (1) {
+		l1a_compl_execute();
+		osmo_timers_update();
+		handle_key_code();
+		l1a_l23_handler();
+		handle_pm();
+		handle_sync();
+		handle_assign();
+		handle_tone();
+	}
+
+	/* NOT REACHED */
+
+	twl3025_power_off();
+}
+
diff --git a/src/target/firmware/apps/simtest/main.c b/src/target/firmware/apps/simtest/main.c
new file mode 100755
index 00000000..e20c52a1
--- /dev/null
+++ b/src/target/firmware/apps/simtest/main.c
@@ -0,0 +1,362 @@
+/* SIM test application */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <delay.h>
+#include <rffe.h>
+#include <keypad.h>
+#include <board.h>
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+#include <calypso/clock.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/irq.h>
+#include <calypso/misc.h>
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+
+#include <calypso/sim.h>
+
+#define DEBUG
+
+/* Dump bytes in hex on the console */
+static void myHexdump(uint8_t *data, int len)
+{
+	int i;
+
+	for(i=0;i<len;i++)
+		printf("%02x ",data[i]);
+
+	printf("(%i bytes)\n", len);
+
+	return;
+}
+
+/* SIM instructions
+   All instructions a standard sim card must feature: */
+#define SIM_CLASS 0xA0			/* Class that contains the following instructions */
+#define SIM_SELECT 0xA4			/* Select a file on the card */
+#define SIM_STATUS 0xF2			/* Get the status of the currently selected file */
+#define SIM_READ_BINARY 0xB0		/* Read file in binary mode */
+#define SIM_UPDATE_BINARY 0xD6		/* Write file in binary mode */
+#define SIM_READ_RECORD 0xB2		/* Read record of a record based file */
+#define SIM_UPDATE_RECORD 0xDC		/* Write record of a record based file */
+#define SIM_SEEK 0xA2			/* Seek in a record based file */
+#define SIM_INCREASE 0x32		/* Increase a record in a record based file */
+#define SIM_VERIFY_CHV 0x20		/* Authenticate with card (enter pin) */
+#define SIM_CHANGE_CHV 0x24		/* Change pin */
+#define SIM_DISABLE_CHV 0x26		/* Disable pin so that no authentication is needed anymore */
+#define SIM_ENABLE_CHV 0x28		/* Enable pin, authentication is now needed again */
+#define SIM_UNBLOCK_CHV 0x2C		/* Unblock pin when it is blocked by entering a wrong pin three times */
+#define SIM_INVALIDATE 0x04		/* Invalidate the current elementry file (file in a subdirectory) */
+#define SIM_REHABILITATE 0x44		/* Rehabilitate the current elementry file (file in a subdirectory) */
+#define SIM_RUN_GSM_ALGORITHM 0x88	/* Run the GSM A3 authentication algorithm in the card */
+#define SIM_SLEEP 0xFA			/* Sleep command (only used in Phase 1 GSM) */
+#define SIM_GET_RESPONSE 0xC0		/* Get the response of a command from the card */
+
+/* File identifiers (filenames)
+   The file identifiers are the standardized file identifiers mentioned in the
+   GSM-11-11 specification. */
+#define SIM_MF		0x3F00
+#define SIM_EF_ICCID	0x2FE2
+#define SIM_DF_TELECOM	0x7F10
+#define SIM_EF_ADN	0x6F3A
+#define SIM_EF_FDN	0x6F3B
+#define SIM_EF_SMS	0x6F3C
+#define SIM_EF_CCP	0x6F3D
+#define SIM_EF_MSISDN	0x6F40
+#define SIM_EF_SMSP	0x6F42
+#define SIM_EF_SMSS	0x6F43
+#define SIM_EF_LND	0x6F44
+#define SIM_EF_EXT1	0x6F4A
+#define SIM_EF_EXT2	0x6F4B
+#define SIM_DF_GSM	0x7F20
+#define SIM_EF_LP	0x6F05
+#define SIM_EF_IMSI	0x6F07
+#define SIM_EF_KC	0x6F20
+#define SIM_EF_PLMNsel	0x6F30
+#define SIM_EF_HPLMN	0x6F31
+#define SIM_EF_ACMmax	0x6F37
+#define SIM_EF_SST	0x6F38
+#define SIM_EF_ACM	0x6F39
+#define SIM_EF_GID1	0x6F3E
+#define SIM_EF_GID2	0x6F3F
+#define SIM_EF_PUCT	0x6F41
+#define SIM_EF_CBMI	0x6F45
+#define SIM_EF_SPN	0x6F46
+#define SIM_EF_BCCH	0x6F74
+#define SIM_EF_ACC	0x6F78
+#define SIM_EF_FPLMN	0x6F7B
+#define SIM_EF_LOCI	0x6F7E
+#define SIM_EF_AD	0x6FAD
+#define SIM_EF_PHASE	0x6FAE
+
+/* Select a file on the card */
+uint16_t sim_select(uint16_t fid)
+{
+	uint8_t txBuffer[2];
+	uint8_t status_word[2];
+
+	txBuffer[1] = (uint8_t) fid;
+	txBuffer[0] = (uint8_t) (fid >> 8);
+
+	if(calypso_sim_transceive(SIM_CLASS, SIM_SELECT, 0x00, 0x00, 0x02,
+				  txBuffer, status_word, SIM_APDU_PUT) != 0)
+		return 0xFFFF;
+
+	return (status_word[0] << 8) | status_word[1];
+}
+
+/* Get the status of the currently selected file */
+uint16_t sim_status(void)
+{
+	uint8_t status_word[2];
+
+	if(calypso_sim_transceive(SIM_CLASS, SIM_STATUS, 0x00, 0x00, 0x00, 0,
+				  status_word, SIM_APDU_PUT) != 0)
+		return 0xFFFF;
+
+	return (status_word[0] << 8) | status_word[1];
+}
+
+/* Read file in binary mode */
+uint16_t sim_readbinary(uint8_t offset_high, uint8_t offset_low, uint8_t length, uint8_t *data)
+{
+	uint8_t status_word[2];
+	if(calypso_sim_transceive(SIM_CLASS, SIM_READ_BINARY, offset_high,
+				  offset_low, length, data ,status_word,
+				  SIM_APDU_GET) != 0)
+		return 0xFFFF;
+
+	return (status_word[0] << 8) | status_word[1];
+}
+
+uint16_t sim_verify(char *pin)
+{
+	uint8_t txBuffer[8];
+	uint8_t status_word[2];
+
+	memset(txBuffer, 0xFF, 8);
+	memcpy(txBuffer, pin, strlen(pin));
+
+	if(calypso_sim_transceive(SIM_CLASS, SIM_VERIFY_CHV, 0x00, 0x01, 0x08, txBuffer,status_word, SIM_APDU_PUT) != 0)
+		return 0xFFFF;
+
+	return (status_word[0] << 8) | status_word[1];
+}
+
+uint16_t sim_run_gsm_algorith(uint8_t *data)
+{
+	uint8_t status_word[2];
+
+	if(calypso_sim_transceive(SIM_CLASS, SIM_RUN_GSM_ALGORITHM, 0x00, 0x00, 0x10, data, status_word, SIM_APDU_PUT) != 0)
+		return 0xFFFF;
+
+	printf("   ==> Status word: %x\n", (status_word[0] << 8) | status_word[1]);
+
+	if(status_word[0] != 0x9F || status_word[1] != 0x0C)
+		return (status_word[0] << 8) | status_word[1];
+
+	/* GET RESPONSE */
+
+	if(calypso_sim_transceive(SIM_CLASS, SIM_GET_RESPONSE, 0, 0, 0x0C, data ,status_word, SIM_APDU_GET) != 0)
+		return 0xFFFF;
+
+	return (status_word[0] << 8) | status_word[1];
+}
+
+
+/* FIXME: We need proper calibrated delay loops at some point! */
+void delay_us(unsigned int us)
+{
+	volatile unsigned int i;
+
+	for (i= 0; i < us*4; i++) { i; }
+}
+
+void delay_ms(unsigned int ms)
+{
+	volatile unsigned int i;
+	for (i= 0; i < ms*1300; i++) { i; }
+}
+
+/* Execute my (dexter's) personal test */
+void do_sim_test(void)
+{
+	uint8_t testBuffer[20];
+	uint8_t testtxBuffer[20];
+
+	uint8_t testDataBody[257];
+	uint8_t testStatusWord[2];
+	int recivedChars;
+	int i;
+
+	uint8_t atr[20];
+	uint8_t atrLength = 0;
+
+	memset(atr,0,sizeof(atr));
+
+
+
+	uint8_t buffer[20];
+
+
+	memset(testtxBuffer,0,sizeof(testtxBuffer));
+
+	puts("----------------SIMTEST----8<-----------------\n");
+
+	/* Initialize Sim-Controller driver */
+	puts("Initializing driver:\n");
+	calypso_sim_init(NULL);
+
+	/* Power up sim and display ATR */
+	puts("Power up simcard:\n");
+	memset(atr,0,sizeof(atr));
+	atrLength = calypso_sim_powerup(atr);
+	myHexdump(atr,atrLength);
+
+	/* Reset sim and display ATR */
+	puts("Reset simcard:\n");
+	memset(atr,0,sizeof(atr));
+	atrLength = calypso_sim_reset(atr);
+	myHexdump(atr,atrLength);
+
+
+
+	testDataBody[0] = 0x3F;
+	testDataBody[1] = 0x00;
+	calypso_sim_transceive(0xA0, 0xA4, 0x00, 0x00, 0x02, testDataBody,0, SIM_APDU_PUT);
+	calypso_sim_transceive(0xA0, 0xC0, 0x00, 0x00, 0x0f, testDataBody,0, SIM_APDU_GET);
+	myHexdump(testDataBody,0x0F);
+
+	puts("Test Phase 1: Testing bare sim commands...\n");
+
+	puts(" * Testing SELECT: Selecting MF\n");
+	printf("   ==> Status word: %x\n", sim_select(SIM_MF));
+
+	puts(" * Testing SELECT: Selecting DF_GSM\n");
+	printf("   ==> Status word: %x\n", sim_select(SIM_DF_GSM));
+
+	puts(" * Testing PIN VERIFY\n");
+	printf("   ==> Status word: %x\n", sim_verify("1234"));
+
+	puts(" * Testing SELECT: Selecting EF_IMSI\n");
+	printf("   ==> Status word: %x\n", sim_select(SIM_EF_IMSI));
+
+	puts(" * Testing STATUS:\n");
+	printf("   ==> Status word: %x\n", sim_status());
+
+	memset(buffer,0,sizeof(buffer));
+	puts(" * Testing READ BINARY:\n");
+	printf("   ==> Status word: %x\n", sim_readbinary(0,0,9,buffer));
+	printf("       Data: ");
+	myHexdump(buffer,9);
+
+	memset(buffer,0,sizeof(buffer));
+	memcpy(buffer,"\x00\x11\x22\x33\x44\x55\x66\x77\x88\x99\xaa\xbb\xcc\xdd\xee\xff",16);
+	puts(" * Testing RUN GSM ALGORITHM\n");
+	printf("   ==> Status word: %x\n", sim_run_gsm_algorith(buffer));
+	printf("       Result: ");
+	myHexdump(buffer,12);
+
+	delay_ms(5000);
+
+	calypso_sim_powerdown();
+
+	puts("------------END SIMTEST----8<-----------------\n");
+}
+
+/* Main Program */
+const char *hr = "======================================================================\n";
+
+void key_handler(enum key_codes code, enum key_states state);
+
+static void *console_rx_cb(uint8_t dlci, struct msgb *msg)
+{
+	if (dlci != SC_DLCI_CONSOLE) {
+		printf("Message for unknown DLCI %u\n", dlci);
+		return;
+	}
+
+	printf("Message on console DLCI: '%s'\n", msg->data);
+	msgb_free(msg);
+}
+
+int main(void)
+{
+	board_init(1);
+
+	puts("\n\nOsmocomBB SIM Test (revision " GIT_REVISION ")\n");
+	puts(hr);
+
+	/* Dump device identification */
+	dump_dev_id();
+	puts(hr);
+
+	/* Dump clock config before PLL set */
+	calypso_clk_dump();
+	puts(hr);
+
+	keypad_set_handler(&key_handler);
+
+	/* Dump clock config after PLL set */
+	calypso_clk_dump();
+	puts(hr);
+
+	/* Dump all memory */
+	//dump_mem();
+#if 0
+	/* Dump Bootloader */
+	memdump_range((void *)0x00000000, 0x2000);
+	puts(hr);
+#endif
+
+	sercomm_register_rx_cb(SC_DLCI_CONSOLE, console_rx_cb);
+
+	do_sim_test();
+
+	/* beyond this point we only react to interrupts */
+	puts("entering interrupt loop\n");
+	while (1) {
+	}
+
+	twl3025_power_off();
+	while (1) {}
+}
+
+void key_handler(enum key_codes code, enum key_states state)
+{
+	if (state != PRESSED)
+		return;
+
+	switch (code) {
+	default:
+		break;
+	}
+}
diff --git a/src/target/firmware/battery/compal_e88.c b/src/target/firmware/battery/compal_e88.c
new file mode 100644
index 00000000..609d4063
--- /dev/null
+++ b/src/target/firmware/battery/compal_e88.c
@@ -0,0 +1,384 @@
+/* Battery management for compal_e88 */
+
+/* (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/*
+ * ___C123 (compal e88) very simplified diagram of charging circuitry___
+ *
+ *                           ICTL
+ *                            |
+ *                            v
+ *  Charger -> OVP -------> P-Mosfet --->[0.15 Ohm]---> Battery
+ *             (NCP345,  |             |            |
+ *              6.85V)   v             v            v
+ *                      VCHG          VCCS        VBAT &
+ *                                                VBATS
+ *
+ * Inputs to IOTA:
+ *  VCHG:        senses voltage on the charger input
+ *  VCSS/VBATS:  to difference amplifier, to measure charge current
+ *  VBAT:        senses voltage on the battery terminal
+ * Outputs from IOTA:
+ *  ICTL:        Control signal for the switching mosfet
+ *
+ */
+
+#include <battery/battery.h>
+#include <battery/compal_e88.h>
+
+#include <stdint.h>
+#include <abb/twl3025.h>
+#include <comm/timer.h>
+#include <stdio.h>
+
+/* ADC calibration, scale is LSB/uV or LSB/uA, physical unit is mV or mA */
+#define ADC_TO_PHYSICAL(adc,scale) (((adc)*(scale)+500)/1000)
+#define PHYSICAL_TO_ADC(phy,scale) (((phy)*1000+(scale)/2)/(scale))
+
+/* conversion factors for internal IOTA battery charging/sensing circuitry */
+#define VREF_LSB_uV 1709  /* VREF = 1.75V    --> 1.709 mV/LSB */
+#define VBAT_LSB_uV 6836  /* VBAT = 7.0 V FS --> 6.836 mV/LSB */
+#define VCHG_LSB_uV 8545  /* VCHG = 8.75V FS --> 8.545 mV/LSB */
+#define ICHG_LSB_uA 854   /* ICHG = 875mA FS --> 0.854 mA/LSB */
+
+/* battery is considered full/empty at these thresholds... */
+#define VBAT_full   PHYSICAL_TO_ADC(4000,VBAT_LSB_uV)
+#define VBAT_empty  PHYSICAL_TO_ADC(3200,VBAT_LSB_uV)
+
+/* we declare overvoltage at this point... */
+#define VBAT_fail   PHYSICAL_TO_ADC(4250,VBAT_LSB_uV)
+
+/* DAC to ADC offsets in CC mode with my C123 
+   IMEI 358317015976471, P329431014
+
+   I/mA DAC     ADC
+   ----------------
+   100	117	108
+   150	176	168
+   200	234	227
+   250	293	291
+   300	351	349
+   350	410	410
+*/
+
+#define CHGDAC_GAIN   967  /* times 0.001 */
+#define CHGDAC_OFFS    13
+
+/* convert ADC reading to DAC value, according to calibration values
+   given above */
+#define CHGDAC_ADJ(x)   (CHGDAC_GAIN*(x)/1000+CHGDAC_OFFS)
+
+/* charging current in DAC LSBs, same ref. and # of bits, but keep
+   the correction specified above in mind!  */
+
+#define ICHG_set    CHGDAC_ADJ(PHYSICAL_TO_ADC(200,ICHG_LSB_uA))
+#define VCHG_set    CHGDAC_ADJ(VBAT_full)
+
+struct battery_info battery_info;	/* global battery info */
+uint16_t bat_compal_e88_madc[MADC_NUM_CHANNELS];	/* MADC measurements */
+
+static const int BATTERY_TIMER_DELAY=5000; /* 5000ms for control loop */
+static const int ADC_TIMER_DELAY=100;      /*  100ms for ADC conversion */
+
+/* thermistor sense current, turn it up to eleven! */
+#define  TH_SENS               (THSENS0|THSENS1|THSENS2|THEN)
+#define  BATTERY_ALL_SENSE     (TH_SENS|MESBAT|TYPEN)
+
+/*
+ * charger modes state machine
+ *
+ *    +------------------+-------------------+
+ *    |                  |                   | lost AC power
+ *    |                  ^                   ^
+ *    V  on AC power     |    @VBAT_full     |
+ * +-----+        +------------+ -----> +------------+
+ * | OFF | -----> | CONST_CURR |        | CONST_VOLT |
+ * +-----+        +------------+        +------------+
+ *    ^          ^        |                   |
+ *    |         /failure  v                   v failure
+ * +---------+ /  gone    |                   | condition
+ * | FAILURE | <----------+-------------------+
+ * +---------+
+ *
+ *  Failure modes currently detected:
+ *          + high battery voltage
+ *  Failure modes TODO:
+ *          + high battery temperature
+ */
+enum bat_compal_e88_chg_state {
+	CHARG_OFF,
+	CHARG_CONST_CURR,
+	CHARG_CONST_VOLT,
+	CHARG_FAIL
+};
+static enum bat_compal_e88_chg_state bat_compal_e88_chg_state;
+
+static const char *bat_compal_e88_chg_state_names[]={
+	"Off",
+	"Constant Current",
+	"Constant Voltage",
+	"Battery Failure"
+};
+
+static void
+bat_compal_e88_goto_state(enum bat_compal_e88_chg_state newstate){
+
+	if(bat_compal_e88_chg_state == newstate) /* already there? */
+		return;
+
+	printf("\033[34;1mCHARGER: %s --> %s.\033[0m\n",
+			bat_compal_e88_chg_state_names[bat_compal_e88_chg_state],
+			bat_compal_e88_chg_state_names[newstate]);
+
+	/* update user visible flags, set registers */
+	switch(newstate){
+	case CHARG_CONST_CURR:
+		battery_info.flags &= ~BATTERY_FAILURE;
+		battery_info.flags |= (BATTERY_CHG_ENABLED|
+						BATTERY_CHARGING);
+		twl3025_reg_write(BCICTL2,0);
+		twl3025_reg_write(CHGREG,0);
+		twl3025_reg_write(BCICTL2,CHEN|LEDC|CHIV);
+		twl3025_reg_write(CHGREG,ICHG_set);
+
+		break;
+
+	case CHARG_CONST_VOLT:
+		battery_info.flags &= ~( BATTERY_CHARGING |
+						BATTERY_FAILURE );
+		battery_info.flags |= BATTERY_CHG_ENABLED;
+		twl3025_reg_write(BCICTL2,0);
+		twl3025_reg_write(CHGREG,0);
+		twl3025_reg_write(BCICTL2,CHEN|LEDC);
+		twl3025_reg_write(CHGREG,VCHG_set);
+		break;
+
+	case CHARG_FAIL:
+	case CHARG_OFF:
+	default:
+		battery_info.flags &= ~( BATTERY_CHG_ENABLED |
+			BATTERY_CHARGING | BATTERY_FAILURE );
+		twl3025_reg_write(BCICTL2,0); /* turn off charger */
+		twl3025_reg_write(CHGREG,0);
+		break;
+	}
+
+	printf("BCICTL2 is 0x%03x, CHGREG=%d\n",
+			twl3025_reg_read(BCICTL2),
+			twl3025_reg_read(CHGREG));
+
+	bat_compal_e88_chg_state = newstate;
+}
+
+static void
+bat_compal_e88_chg_control(){
+	/* with AC power disconnected, always go to off state */
+	if(!(battery_info.flags & BATTERY_CHG_CONNECTED)){
+		bat_compal_e88_goto_state(CHARG_OFF);
+		return;
+	}
+
+	/* if failure condition is detected, always goto failure state */
+	if(bat_compal_e88_madc[MADC_VBAT] > VBAT_fail){
+		bat_compal_e88_goto_state(CHARG_FAIL);
+		return;
+	}
+
+	/* now AC power is present and battery is not over failure
+	   thresholds */
+	switch(bat_compal_e88_chg_state){
+	case CHARG_OFF:
+		if(bat_compal_e88_madc[MADC_VBAT] >= VBAT_full)
+			bat_compal_e88_goto_state(CHARG_CONST_VOLT);
+		else
+			bat_compal_e88_goto_state(CHARG_CONST_CURR);
+		break;
+	case CHARG_CONST_CURR:
+		if(bat_compal_e88_madc[MADC_VBAT] >= VBAT_full)
+			bat_compal_e88_goto_state(CHARG_CONST_VOLT);
+		break;
+	case CHARG_CONST_VOLT:
+		break;
+	default:
+	case CHARG_FAIL:
+		if(bat_compal_e88_madc[MADC_VBAT] < VBAT_full)
+			bat_compal_e88_goto_state(CHARG_CONST_CURR);
+		break;
+	}
+}
+
+/*
+ * Charging voltage connection - state machine, remembers
+ * state in battery_info.flags.
+ *
+ *                     VCHG > VCHG_thr_on
+ * +-----------------+ ------------------> +---------------+
+ * | ! CHG_CONNECTED |                     | CHG_CONNECTED |
+ * +-----------------+ <------------------ +---------------+
+ *                     VCHG < VCHG_thr_off
+ */
+static void
+bat_compal_e88_chk_ac_presence(){
+	int vrpcsts = twl3025_reg_read(VRPCSTS);
+
+	/* check for presence of charging voltage */
+	if(!(battery_info.flags & BATTERY_CHG_CONNECTED)){
+		if(vrpcsts & CHGPRES){
+			puts("\033[34;1mCHARGER: external voltage connected!\033[0m\n");
+			battery_info.flags |= BATTERY_CHG_CONNECTED;
+
+			/* always keep ADC, voltage dividers and bias voltages on */
+			twl3025_unit_enable(TWL3025_UNIT_MAD,1);
+			twl3025_reg_write(BCICTL1,BATTERY_ALL_SENSE);
+		}
+	} else {
+		if(!(vrpcsts & CHGPRES)){
+			/* we'll only run ADC on demand */
+			twl3025_unit_enable(TWL3025_UNIT_MAD,0);
+			twl3025_reg_write(BCICTL1,0);
+
+			battery_info.flags &= ~ BATTERY_CHG_CONNECTED;
+			puts("\033[34;1mCHARGER: external voltage disconnected!\033[0m\n");
+		}
+	}
+}
+
+/* ---- update voltages visible to the user ---- */
+static void
+bat_compal_e88_upd_measurements(){
+	int adc,i;
+
+	battery_info.charger_volt_mV=
+		ADC_TO_PHYSICAL(bat_compal_e88_madc[MADC_VCHG],VCHG_LSB_uV);
+	battery_info.bat_volt_mV=
+		ADC_TO_PHYSICAL(bat_compal_e88_madc[MADC_VBAT],VBAT_LSB_uV);
+	battery_info.bat_chg_curr_mA=
+		ADC_TO_PHYSICAL(bat_compal_e88_madc[MADC_ICHG],ICHG_LSB_uA);
+
+	adc = bat_compal_e88_madc[MADC_VBAT];
+	if(adc <= VBAT_empty){			/* battery 0..100% */
+		battery_info.battery_percent = 0;
+	} else if (adc >= VBAT_full){
+		battery_info.battery_percent = 100;
+	} else {
+		battery_info.battery_percent =
+			(50+100*(adc-VBAT_empty))/(VBAT_full-VBAT_empty);
+	}
+
+        /* DEBUG */
+        printf("BAT-ADC: ");
+        for(i=0;i<MADC_NUM_CHANNELS;i++)
+                printf("%3d ",bat_compal_e88_madc[i]);
+        printf("%c\n",32);
+        printf("\tCharger at %u mV.\n",battery_info.charger_volt_mV);
+        printf("\tBattery at %u mV.\n",battery_info.bat_volt_mV);
+        printf("\tCharging at %u mA.\n",battery_info.bat_chg_curr_mA);
+        printf("\tBattery capacity is %u%%.\n",battery_info.battery_percent);
+	printf("\tBattery range is %d..%d mV.\n",
+		ADC_TO_PHYSICAL(VBAT_empty,VBAT_LSB_uV),
+		ADC_TO_PHYSICAL(VBAT_full,VBAT_LSB_uV));
+        printf("\tBattery full at %d LSB .. full at %d LSB\n",VBAT_empty,VBAT_full);
+        printf("\tCharging at %d LSB (%d mA).\n",ICHG_set,
+                ADC_TO_PHYSICAL(ICHG_set,ICHG_LSB_uA));
+        i = twl3025_reg_read(BCICTL2);
+        printf("\tBCICTL2=0x%03x\n",i);      
+	printf("\tbattery-info.flags=0x%08x\n",battery_info.flags);
+	printf("\tbat_compal_e88_chg_state=%d\n",bat_compal_e88_chg_state);
+}
+
+/* bat_compal_e88_adc_read() :
+ *
+ * Schedule a ADC conversion or read values from ADC. If we are
+ * running on battery, bias currents/voltage dividers are turned
+ * on on demand.
+ *
+ * Return 0 if new ADC values have been acquired, 1 if ADC
+ * has been scheduled for a new conversion or is not yet finished.
+ * 
+ */
+
+enum bat_compal_e88_madc_stat {
+	ADC_CONVERSION = 1 << 0
+};
+static uint32_t bat_compal_e88_madc_stat=0;
+
+static int
+bat_compal_e88_adc_read(){
+	int i;
+
+	if(bat_compal_e88_madc_stat & ADC_CONVERSION){
+		i = twl3025_reg_read(MADCSTAT);
+		if(i & ADCBUSY)
+			return 1;
+		for(i=0;i<MADC_NUM_CHANNELS;i++)
+			bat_compal_e88_madc[i]=twl3025_reg_read(VBATREG+i);
+		/* if charger is connected, we keep the ADC and BIAS on
+		   continuously, if running on battery, we try to save power */
+		if(!(battery_info.flags & BATTERY_CHG_CONNECTED)){
+			twl3025_reg_write(BCICTL1,0x00); /* turn off bias */
+			twl3025_unit_enable(TWL3025_UNIT_MAD,0); /* & ADC */
+		}
+		bat_compal_e88_madc_stat &= ~ ADC_CONVERSION;
+		return 0;
+	} else {
+		/* if running on battery, turn on ADC & BIAS on demand */
+		if(!(battery_info.flags & BATTERY_CHG_CONNECTED)){
+			twl3025_unit_enable(TWL3025_UNIT_MAD,1);
+			twl3025_reg_write(BCICTL1,BATTERY_ALL_SENSE);
+		}
+
+		twl3025_reg_write(MADCTRL,0xff); /* convert all channels */
+		twl3025_reg_write(VBATREG,0);    /* trigger conversion */
+
+		bat_compal_e88_madc_stat |= ADC_CONVERSION;
+		return 1;
+	}
+}
+
+static void
+battery_compal_e88_timer_cb(void *p){
+	struct osmo_timer_list *tmr = (struct osmo_timer_list*)p;
+	int i;
+
+	if(bat_compal_e88_adc_read()){ /* read back ADCs after a brief delay */
+		osmo_timer_schedule(tmr,ADC_TIMER_DELAY);
+		return;
+	}
+
+	bat_compal_e88_upd_measurements();	/* convert user-accessible information */
+	bat_compal_e88_chk_ac_presence();	/* detect AC charger presence */
+	bat_compal_e88_chg_control();	/* battery charger state machine */
+
+	osmo_timer_schedule(tmr,BATTERY_TIMER_DELAY);
+}
+
+/* timer that fires the charging loop regularly */
+static struct osmo_timer_list battery_compal88_timer = {
+	.cb = &battery_compal_e88_timer_cb,
+	.data = &battery_compal88_timer
+};
+
+void
+battery_compal_e88_init(){
+	printf("%s: starting up\n",__FUNCTION__);
+	osmo_timer_schedule(&battery_compal88_timer,BATTERY_TIMER_DELAY);
+}
+
diff --git a/src/target/firmware/battery/dummy.c b/src/target/firmware/battery/dummy.c
new file mode 100644
index 00000000..3051a615
--- /dev/null
+++ b/src/target/firmware/battery/dummy.c
@@ -0,0 +1,9 @@
+#include <battery/battery.h>
+
+/* Battery Management: Dummy file when no charging logic exists. */
+struct battery_info battery_info;
+
+void battery_dummy_init(){
+	battery_info.flags = BATTERY_FAILURE; /* not implemented */
+}
+
diff --git a/src/target/firmware/board/common/calypso_pwl.S b/src/target/firmware/board/common/calypso_pwl.S
new file mode 100644
index 00000000..90e29bff
--- /dev/null
+++ b/src/target/firmware/board/common/calypso_pwl.S
@@ -0,0 +1,21 @@
+
+/* Calypso PWL driver */
+
+#define ASIC_CONF_REG	0xfffef008
+#define BA_PWL		0xfffe8000
+
+.globl pwl_init
+pwl_init:	ldr	r1, =ASIC_CONF_REG
+		ldr	r2, [r1]
+		orr	r2, r2, #0x10		@ set light output to PWL
+		str	r2, [r1]
+		ldr	r1, =BA_PWL
+		mov	r0, #1
+		strb	r0, [r1, #1]		@ enable clock of PWL unut
+		mov	pc, lr
+
+.globl pwl_set_level
+pwl_set_level:	ldr	r1, =BA_PWL
+		strb	r0, [r1]
+		mov	pc, lr
+
diff --git a/src/target/firmware/board/common/calypso_uart.S b/src/target/firmware/board/common/calypso_uart.S
new file mode 100644
index 00000000..808cb051
--- /dev/null
+++ b/src/target/firmware/board/common/calypso_uart.S
@@ -0,0 +1,92 @@
+/* uart routines for early assembly code */
+
+#define BA_UART_MODEM	0xFFFF5800
+
+.macro	senduart, rd, rx
+	strb	\rd, [\rx, #0]
+.endm
+
+.macro	busyuart, rd, rx
+1001:
+	@busy waiting until THR is empty
+	ldrb	\rd, [\rx, #5]		@ read LSR register
+	mov	\rd, \rd, lsr #6
+	tst	\rd, #1
+	beq	1001b
+.endm
+
+.macro	loadsp, rd
+	ldr	\rd, =BA_UART_MODEM
+.endm
+
+.section .text
+
+		.align	2
+		.type	phexbuf, #object
+phexbuf:	.space	12
+		.size	phexubf, . - phexbuf
+
+.globl phex
+phex:		adr	r3, phexbuf
+		mov	r2, #0
+		strb	r2, [r3, r1]
+1:		subs	r1, r1, #1
+		movmi	r0, r3
+		bmi	puts_asm
+		and	r2, r0, #15
+		mov	r0, r0, lsr #4
+		cmp	r2, #10
+		addge	r2, r2, #7
+		add	r2, r2, #'0'
+		strb	r2, [r3, r1]
+		b	1b
+
+.globl puts_asm
+puts_asm:	loadsp	r3
+1:		ldrb	r2, [r0], #1
+		teq	r2, #0
+		moveq	pc, lr
+2:		senduart r2, r3
+		busyuart r1, r3
+		teq	r2, #'\n'
+		moveq	r2, #'\r'
+		beq	2b
+		teq	r0, #0
+		bne	1b
+		mov	pc, lr
+
+.globl putchar_asm
+putchar_asm:
+		mov	r2, r0
+		mov	r0, #0
+		loadsp	r3
+		b	2b
+
+.globl memdump_asm
+memdump_asm:	mov	r12, r0
+		mov	r10, lr
+		mov	r11, #0
+2:		mov 	r0, r11, lsl #2
+		add	r0, r0, r12
+		mov	r1, #8
+		bl	phex
+		mov	r0, #':'
+		bl	putchar_asm
+1:		mov	r0, #' '
+		bl	putchar_asm
+		ldr	r0, [r12, r11, lsl #2]
+		mov	r1, #8
+		bl	phex
+		and	r0, r11, #7
+		teq	r0, #3
+		moveq	r0, #' '
+		bleq	putchar_asm
+		and	r0, r11, #7
+		add	r11, r11, #1
+		teq	r0, #7
+		bne	1b
+		mov	r0, #'\n'
+		bl	putchar_asm
+		cmp	r11, #64
+		blt	2b
+		mov	pc, r10
diff --git a/src/target/firmware/board/compal/LINKAGE.txt b/src/target/firmware/board/compal/LINKAGE.txt
new file mode 100644
index 00000000..1ae06fb3
--- /dev/null
+++ b/src/target/firmware/board/compal/LINKAGE.txt
@@ -0,0 +1,12 @@
+
+We provide the following common RAM linkages for all Compal phones:
+
+(both use the Calypso ROM loader for interrupt redirect, if required)
+
+  compalram:
+    Image for the Compal ramloader. Starts at a weird address and
+    contains various ramloader specifics.
+
+  highram:
+    Image linked to 0x820000, used for various special purposes.
+    This image is completely independent of the compal loader.
diff --git a/src/target/firmware/board/compal/exceptions_redirect.S b/src/target/firmware/board/compal/exceptions_redirect.S
new file mode 100644
index 00000000..a216e601
--- /dev/null
+++ b/src/target/firmware/board/compal/exceptions_redirect.S
@@ -0,0 +1,24 @@
+
+.section .text.exceptions
+_undef_instr:
+	ldr pc, _vec_undef_instr
+_sw_interr:
+	ldr pc, _vec_sw_interr
+_prefetch_abort:
+	ldr pc, _vec_prefetch_abort
+_data_abort:
+	ldr pc, _vec_data_abort
+_reserved:
+	ldr pc, _vec_reserved
+_irq:
+	ldr pc, _vec_irq
+_fiq:
+	ldr pc, _vec_fiq
+
+_vec_undef_instr:		.word(0x80001c)
+_vec_sw_interr:			.word(0x800020)
+_vec_prefetch_abort:	.word(0x800024)
+_vec_data_abort:		.word(0x800028)
+_vec_reserved:			.word(0x80002c)
+_vec_irq:				.word(0x800030)
+_vec_fiq:				.word(0x800034)
diff --git a/src/target/firmware/board/compal/exceptions_redirected.S b/src/target/firmware/board/compal/exceptions_redirected.S
new file mode 100644
index 00000000..69083962
--- /dev/null
+++ b/src/target/firmware/board/compal/exceptions_redirected.S
@@ -0,0 +1,20 @@
+
+/* Exception Vectors like they are needed for the exception vector
+   indirection of the internal boot ROM.  The following section must be liked
+   to appear at 0x80001c */
+.section .text.exceptions
+_undef_instr:
+	b	handle_abort
+_sw_interr:
+	b	_sw_interr
+_prefetch_abort:
+	b	handle_abort
+_data_abort:
+	b	handle_abort
+_reserved:
+	b	_reserved
+_irq:
+	b	irq_entry
+_fiq:
+	b	fiq_entry
+
diff --git a/src/target/firmware/board/compal/handlers.S b/src/target/firmware/board/compal/handlers.S
new file mode 100644
index 00000000..ef044e3f
--- /dev/null
+++ b/src/target/firmware/board/compal/handlers.S
@@ -0,0 +1,79 @@
+
+		.EQU	I_BIT,		0x80
+		.EQU	F_BIT,		0x40
+		
+.section .text
+
+/* handler for all kinds of aborts */
+.global handle_abort
+handle_abort:
+		@ print the PC we would jump back to...
+		sub	lr, lr, #4		@ we assume to be ARM32
+
+		mov	r0, lr
+		mov	r1, #8
+		bl phex
+
+		@ print abort message
+		mov	r0, #'A'
+		bl	putchar_asm
+		mov	r0, #'B'
+		bl	putchar_asm
+		mov	r0, #'O'
+		bl	putchar_asm
+		mov	r0, #'R'
+		bl	putchar_asm
+		mov	r0, #'T'
+		bl	putchar_asm
+
+		@ disable IRQ and FIQ
+		msr	CPSR_c, #I_BIT | F_BIT
+
+0:					@ dead
+		b	0b
+
+/* entry point for IRQs */
+.global irq_entry
+irq_entry:
+		/* Adjust and save LR_irq in IRQ stack */
+		sub	lr, lr, #4
+		stmfd	sp!, {lr}
+
+		/* Save SPSR for nested interrupt */
+		mrs	r14, SPSR
+		stmfd	sp!, {r14}
+
+		/* Call the interrupt handler C function */
+		stmfd	sp!, {r0-r4, r12}
+		bl	irq
+		ldmfd	sp!, {r0-r4, r12}
+
+		/* Restore SPSR_irq from IRQ stack */
+		ldmia	sp!, {r14}
+		msr	SPSR_cxsf, r14
+
+		/* Restore adjusted LR_irq from IRQ stack directly in the PC */
+		ldmia	sp!, {pc}^
+
+/* entry point for FIQs */
+.global fiq_entry
+fiq_entry:
+		/* Adjust and save LR_irq in IRQ stack */
+		sub	lr, lr, #4
+		stmfd	sp!, {lr}
+
+		/* Save SPSR for nested interrupt */
+		mrs	r14, SPSR
+		stmfd	sp!, {r14}
+
+		/* Call the interrupt handler C function */
+		stmfd	sp!, {r0-r4, r12}
+		bl	fiq
+		ldmfd	sp!, {r0-r4, r12}
+
+		/* Restore SPSR_irq from IRQ stack */
+		ldmia	sp!, {r14}
+		msr	SPSR_cxsf, r14
+
+		/* Restore adjusted LR_irq from IRQ stack directly in the PC */
+		ldmia	sp!, {pc}^
diff --git a/src/target/firmware/board/compal/header.S b/src/target/firmware/board/compal/header.S
new file mode 100644
index 00000000..747f6806
--- /dev/null
+++ b/src/target/firmware/board/compal/header.S
@@ -0,0 +1,11 @@
+/*
+ * This is a textual header that is prepended to images where appropriate.
+ *
+ * It is meant to ease identification of our firmwares in dumps as well
+ * as filling some space that is used for the same purpose by the vendor.
+ *
+ */
+.section .compal.header
+.ascii "OSMOCOM"
+. = 0x20
+.ascii GIT_REVISION
diff --git a/src/target/firmware/board/compal/highram.lds b/src/target/firmware/board/compal/highram.lds
new file mode 100644
index 00000000..9309d83f
--- /dev/null
+++ b/src/target/firmware/board/compal/highram.lds
@@ -0,0 +1,121 @@
+/*
+ * Linker script for running from upper internal RAM on the TI Calypso
+ *
+ * This script creates a binary that can be loaded into high ram on
+ * all Calypso devices. It can be jumped into directly at the load
+ * address.
+ *
+ * This is used for debugging the loader and for general hacking purposes.
+ */
+OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
+OUTPUT_ARCH(arm)
+ENTRY(_start)
+MEMORY
+{
+    /* lowram: could be anything, we place exception vectors here */
+    XRAM (rw) : ORIGIN = 0x00800000, LENGTH = 0x00020000
+    /* highram binary single big zone with all rest of internal SRAM */
+    /*  -> our text, initialized data */
+    /*  -> our unitialized data, stacks, heap */
+    RAM  (rw) : ORIGIN = 0x00820000, LENGTH = 0x00030000
+}
+SECTIONS
+{
+    . = 0x820000;
+
+    /* initialization code */
+    .text.start : {
+        PROVIDE(_start = .);
+        KEEP(*(.text.start))
+        *(.text.start)
+    } > RAM
+
+    /* exception vectors linked for 0x80001c to 0x800034 */
+    .text.exceptions 0x80001c : AT (LOADADDR(.text.start) + SIZEOF(.text.start)) {
+        KEEP(*(.text.exceptions))
+        * (.text.exceptions)
+        . = ALIGN(4);
+    } > XRAM
+    PROVIDE(_exceptions = LOADADDR(.text.exceptions));
+
+    /* code */
+    . = ALIGN(4);
+    .text (LOADADDR(.text.exceptions) + SIZEOF(.text.exceptions)) :
+          AT (LOADADDR(.text.exceptions) + SIZEOF(.text.exceptions)) {
+        /* regular code */
+        *(.text*)
+        /* always-in-ram code */
+        *(.ramtext*)
+        /* gcc voodoo */
+        *(.glue_7t) *(.glue_7) *(.vfp11_veneer) *(.v4_bx)
+        . = ALIGN(4);
+    } > RAM
+    PROVIDE(_text_start = LOADADDR(.text));
+    PROVIDE(_text_end = LOADADDR(.text) + SIZEOF(.text));
+
+    /* constructor pointers */
+    .ctors : {
+        /* ctor count */
+        LONG(SIZEOF(.ctors) / 4 - 2)
+        /* ctor pointers */
+        KEEP(*(SORT(.ctors)))
+        KEEP(*(SORT(.init_array)))
+        /* end of list */
+        LONG(0)
+    } > RAM
+    PROVIDE(_ctor_start = LOADADDR(.ctors));
+    PROVIDE(_ctor_end = LOADADDR(.ctors) + SIZEOF(.ctors));
+
+    /* destructor pointers */
+    .dtors : {
+        /* dtor count */
+        LONG(SIZEOF(.dtors) / 4 - 2)
+        /* dtor pointers */
+        KEEP(*(SORT(.dtors)))
+        /* end of list */
+        LONG(0)
+    } > RAM
+    PROVIDE(_dtor_start = LOADADDR(.dtors));
+    PROVIDE(_dtor_end = LOADADDR(.dtors) + SIZEOF(.dtors));
+
+    /* read-only data */
+    . = ALIGN(4);
+    .rodata : {
+        *(.rodata*)
+    } > RAM
+    PROVIDE(_rodata_start = LOADADDR(.rodata));
+    PROVIDE(_rodata_end = LOADADDR(.rodata) + SIZEOF(.rodata));
+
+    /* initialized data */
+    . = ALIGN(4);
+    .data : {
+        *(.data)
+    } > RAM
+    PROVIDE(_data_start = LOADADDR(.data));
+    PROVIDE(_data_end = LOADADDR(.data) + SIZEOF(.data));
+
+    /* pic offset tables */
+    . = ALIGN(4);
+    .got : {
+        *(.got)
+        *(.got.plt) *(.igot.plt) *(.got) *(.igot)
+    } > RAM
+    PROVIDE(_got_start = LOADADDR(.got));
+    PROVIDE(_got_end = LOADADDR(.got) + SIZEOF(.got));
+
+    /* uninitialized data */
+    .bss (NOLOAD) : {
+        . = ALIGN(4);
+        __bss_start = .;
+        *(.bss)
+    } > RAM
+    . = ALIGN(4);
+    __bss_end = .;
+    PROVIDE(_bss_start = __bss_start);
+    PROVIDE(_bss_end = __bss_end);
+
+    /* end of image */
+    . = ALIGN(4);
+    _end = .;
+    PROVIDE(end = .);
+}
diff --git a/src/target/firmware/board/compal/keymap.h b/src/target/firmware/board/compal/keymap.h
new file mode 100644
index 00000000..ce8f9c24
--- /dev/null
+++ b/src/target/firmware/board/compal/keymap.h
@@ -0,0 +1,27 @@
+/* keymap for the Compal C1xx phones */
+
+static const uint8_t keymap[] = {
+	[KEY_0]		= 13,
+	[KEY_1]		= 15,
+	[KEY_2]		= 10,
+	[KEY_3]		= 5,
+	[KEY_4]		= 16,
+	[KEY_5]		= 11,
+	[KEY_6]		= 6,
+	[KEY_7]		= 17,
+	[KEY_8]		= 12,
+	[KEY_9]		= 7,
+	[KEY_STAR]	= 18,
+	[KEY_HASH]	= 8,
+	[KEY_MENU]	= 14,
+	[KEY_LEFT_SB]	= 19,
+	[KEY_RIGHT_SB]	= 9,
+	[KEY_UP]	= 1,
+	[KEY_DOWN]	= 2,
+	[KEY_LEFT]	= 3,
+	[KEY_RIGHT]	= 4,
+	[KEY_OK]	= 0,
+	[KEY_POWER]	= 24,
+	[KEY_MINUS]	= 30,	/* not existent */
+	[KEY_PLUS]	= 31,	/* not existent */
+};
diff --git a/src/target/firmware/board/compal/macros.S b/src/target/firmware/board/compal/macros.S
new file mode 100644
index 00000000..613e6bda
--- /dev/null
+++ b/src/target/firmware/board/compal/macros.S
@@ -0,0 +1,76 @@
+
+.macro clear_bss
+	mov   r0, #0
+	ldr   r1, =__bss_start
+	ldr   r2, =__bss_end
+loop_bss:
+	cmp   r1, r2
+	strlo r0, [r1], #4
+	blo   loop_bss
+.endm
+
+.macro copy_data
+    ldr   r0, =__data_start
+    ldr   r1, =_data_start
+    ldr   r2, =__data_end
+	cmp r0, r2
+	beq done_data
+loop_data:
+    ldrb  r4, [r0], #1
+    strb  r4, [r1], #1
+	cmp r0, r2
+    bne   loop_data
+done_data:
+.endm
+
+.macro copy_ramtext
+    ldr   r0, =__ramtext_start
+    ldr   r1, =_ramtext_start
+    ldr   r2, =__ramtext_end
+	cmp r0, r2
+	beq done_ramtext
+loop_ramtext:
+    ldrb  r4, [r0], #1
+    strb  r4, [r1], #1
+	cmp r0, r2
+    bne   loop_ramtext
+done_ramtext:
+.endm
+		
+	.EQU	ARM_MODE_FIQ,	0x11
+	.EQU	ARM_MODE_IRQ,	0x12
+	.EQU	ARM_MODE_SVC,	0x13
+
+	.EQU	I_BIT,		0x80
+	.EQU	F_BIT,		0x40
+
+#define	TOP_OF_RAM	0x083fff0
+#define FIQ_STACK_SIZE	1024
+#define IRQ_STACK_SIZE	1024
+		
+.macro init_stacks
+	/* initialize stacks, starting at TOP_OF_RAM */
+	ldr	r0, =TOP_OF_RAM
+
+	/* initialize FIQ stack */
+	msr	CPSR_c, #ARM_MODE_FIQ | I_BIT | F_BIT
+	mov	r13, r0
+	sub	r0, r0, #FIQ_STACK_SIZE
+
+	/* initialize IRQ stack */
+	msr	CPSR_c, #ARM_MODE_IRQ | I_BIT | F_BIT
+	mov	r13, r0
+	sub	r0, r0, #IRQ_STACK_SIZE
+
+	/* initialize supervisor stack */
+	msr	CPSR_c, #ARM_MODE_SVC | I_BIT | F_BIT
+	mov	r13, r0
+.endm
+
+.macro call_ctors
+	/* call constructor functions */
+	ldr	r0, =_ctor_start
+	ldr	r1, =_ctor_end
+	bl	do_global_ctors
+.endm
+
diff --git a/src/target/firmware/board/compal/ram.lds b/src/target/firmware/board/compal/ram.lds
new file mode 100644
index 00000000..b52b619a
--- /dev/null
+++ b/src/target/firmware/board/compal/ram.lds
@@ -0,0 +1,124 @@
+/*
+ * Linker script for running from internal SRAM on Compal phones
+ *
+ * This script is tailored specifically to the requirements imposed
+ * on us by the Compal bootloader.
+ */
+OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
+OUTPUT_ARCH(arm)
+ENTRY(_start)
+MEMORY
+{
+    /* compal-loaded binary: our text, initialized data */
+    /* (only this zone can contain loaded data since loader is 64k limit) */
+    LRAM (rw) : ORIGIN = 0x00800000, LENGTH = 0x00010000
+    /* compal-loaded binary: our unitialized data, stacks, heap */
+    IRAM (rw) : ORIGIN = 0x00810000, LENGTH = 0x00030000
+}
+SECTIONS
+{
+    . = 0x800000;
+
+    /* romloader data section, contains passthru interrupt vectors */
+    .compal.loader (NOLOAD) : { . = 0x100; } > LRAM
+
+    /* image signature (prepended by osmocon according to phone type) */
+    .compal.header (NOLOAD) : { . = 4; } > LRAM
+
+    /* initialization code */
+    . = ALIGN(4);
+    .text.start : {
+        PROVIDE(_start = .);
+        KEEP(*(.text.start))
+        *(.text.start)
+    } > LRAM
+
+    /* exception vectors from 0x80001c to 0x800034 */
+    .text.exceptions 0x80001c : AT (LOADADDR(.text.start) + SIZEOF(.text.start)) {
+        KEEP(*(.text.exceptions))
+        * (.text.exceptions)
+        . = ALIGN(4);
+    } > LRAM
+    PROVIDE(_exceptions = LOADADDR(.text.exceptions));
+
+    /* code */
+    . = ALIGN(4);
+    .text (LOADADDR(.text.exceptions) + SIZEOF(.text.exceptions)) :
+          AT (LOADADDR(.text.exceptions) + SIZEOF(.text.exceptions)) {
+        /* regular code */
+        *(.text*)
+        /* always-in-ram code */
+        *(.ramtext*)
+        /* gcc voodoo */
+        *(.glue_7t) *(.glue_7) *(.vfp11_veneer) *(.v4_bx)
+        . = ALIGN(4);
+    } > LRAM
+    PROVIDE(_text_start = LOADADDR(.text));
+    PROVIDE(_text_end = LOADADDR(.text) + SIZEOF(.text));
+
+    /* constructor pointers */
+    .ctors : {
+        /* ctor count */
+        LONG(SIZEOF(.ctors) / 4 - 2)
+        /* ctor pointers */
+        KEEP(*(SORT(.ctors)))
+        KEEP(*(SORT(.init_array)))
+        /* end of list */
+        LONG(0)
+    } > LRAM
+    PROVIDE(_ctor_start = LOADADDR(.ctors));
+    PROVIDE(_ctor_end = LOADADDR(.ctors) + SIZEOF(.ctors));
+
+    /* destructor pointers */
+    .dtors : {
+        /* dtor count */
+        LONG(SIZEOF(.dtors) / 4 - 2)
+        /* dtor pointers */
+        KEEP(*(SORT(.dtors)))
+        /* end of list */
+        LONG(0)
+    } > LRAM
+    PROVIDE(_dtor_start = LOADADDR(.dtors));
+    PROVIDE(_dtor_end = LOADADDR(.dtors) + SIZEOF(.dtors));
+
+    /* read-only data */
+    . = ALIGN(4);
+    .rodata : {
+        *(.rodata*)
+    } > LRAM
+    PROVIDE(_rodata_start = LOADADDR(.rodata));
+    PROVIDE(_rodata_end = LOADADDR(.rodata) + SIZEOF(.rodata));
+
+    /* initialized data */
+    . = ALIGN(4);
+    .data : {
+        *(.data)
+    } > LRAM
+    PROVIDE(_data_start = LOADADDR(.data));
+    PROVIDE(_data_end = LOADADDR(.data) + SIZEOF(.data));
+
+    /* pic offset tables */
+    . = ALIGN(4);
+    .got : {
+        *(.got)
+        *(.got.plt) *(.igot.plt) *(.got) *(.igot)
+    } > LRAM
+    PROVIDE(_got_start = LOADADDR(.got));
+    PROVIDE(_got_end = LOADADDR(.got) + SIZEOF(.got));
+
+    /* uninitialized data */
+    .bss (NOLOAD) : {
+        . = ALIGN(4);
+        __bss_start = .;
+        *(.bss)
+    } > IRAM
+    . = ALIGN(4);
+    __bss_end = .;
+    PROVIDE(_bss_start = __bss_start);
+    PROVIDE(_bss_end = __bss_end);
+
+    /* end of image */
+    . = ALIGN(4);
+    _end = .;
+    PROVIDE(end = .);
+}
diff --git a/src/target/firmware/board/compal/rf_power.c b/src/target/firmware/board/compal/rf_power.c
new file mode 100644
index 00000000..fbbe65a3
--- /dev/null
+++ b/src/target/firmware/board/compal/rf_power.c
@@ -0,0 +1,62 @@
+/* Tx RF power calibration for the Compal/Motorola dualband phones */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <osmocom/core/utils.h>
+
+/* GSM900 ARFCN 33, Measurements by Steve Markgraf / May 2010 */
+const int16_t dbm2apc_gsm900[] = {
+	[0]     = 151,
+	[1]     = 152,
+	[2]     = 153,
+	[3]     = 155,
+	[4]     = 156,
+	[5]     = 158,
+	[6]     = 160,
+	[7]     = 162,
+	[8]     = 164,
+	[9]     = 167,
+	[10]    = 170,
+	[11]    = 173,
+	[12]    = 177,
+	[13]    = 182,
+	[14]    = 187,
+	[15]    = 192,
+	[16]    = 199,
+	[17]    = 206,
+	[18]    = 214,
+	[19]    = 223,
+	[20]    = 233,
+	[21]    = 244,
+	[22]    = 260,
+	[23]    = 271,
+	[24]    = 288,
+	[25]    = 307,
+	[26]    = 327,
+	[27]    = 350,
+	[28]    = 376,
+	[29]    = 407,
+	[30]    = 456,
+	[31]    = 575,
+};
+
+const int dbm2apc_gsm900_max = ARRAY_SIZE(dbm2apc_gsm900) - 1;
diff --git a/src/target/firmware/board/compal/rffe_dualband.c b/src/target/firmware/board/compal/rffe_dualband.c
new file mode 100644
index 00000000..de161899
--- /dev/null
+++ b/src/target/firmware/board/compal/rffe_dualband.c
@@ -0,0 +1,108 @@
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <rffe.h>
+#include <calypso/tsp.h>
+#include <rf/trf6151.h>
+
+/* This is a value that has been measured on the C123 by Harald: 71dBm,
+   it is the difference between the input level at the antenna and what
+   the DSP reports, subtracted by the total gain of the TRF6151 */
+#define SYSTEM_INHERENT_GAIN	71
+
+/* describe how the RF frontend is wired on the Motorola E88 board (C117/C118/C121/C123) */
+
+#define		RITA_RESET	TSPACT(0)	/* Reset of the Rita TRF6151 */
+#define		PA_ENABLE	TSPACT(1)	/* Enable the Power Amplifier */
+#define		TRENA		TSPACT(6)	/* Transmit Enable (Antenna Switch) */
+#define		GSM_TXEN	TSPACT(8)	/* GSM (as opposed to DCS) Transmit */
+
+#define		IOTA_STROBE	TSPEN(0)	/* Strobe for the Iota TSP */
+#define		RITA_STROBE	TSPEN(2)	/* Strobe for the Rita TSP */
+
+/* switch RF Frontend Mode */
+void rffe_mode(enum gsm_band band, int tx)
+{
+	uint16_t tspact = tsp_act_state();
+
+	/* First we mask off all bits from the state cache */
+	tspact &= ~PA_ENABLE;
+	tspact |= TRENA | GSM_TXEN;	/* low-active */
+
+#ifdef CONFIG_TX_ENABLE
+	/* Then we selectively set the bits on, if required */
+	if (tx) {
+		tspact &= ~TRENA;
+		if (band == GSM_BAND_850 || band == GSM_BAND_900)
+			tspact &= ~GSM_TXEN;
+		tspact |= PA_ENABLE;
+	}
+#endif /* TRANSMIT_SUPPORT */
+
+	tsp_act_update(tspact);
+}
+
+/* Returns RF wiring */
+uint32_t rffe_get_rx_ports(void)
+{
+	return (1 << PORT_LO) | (1 << PORT_DCS1800);
+}
+
+uint32_t rffe_get_tx_ports(void)
+{
+	return (1 << PORT_LO) | (1 << PORT_HI);
+}
+
+/* Returns need for IQ swap */
+int rffe_iq_swapped(uint16_t band_arfcn, int tx)
+{
+	return trf6151_iq_swapped(band_arfcn, tx);
+}
+
+
+#define MCU_SW_TRACE	0xfffef00e
+#define ARM_CONF_REG	0xfffef006
+
+void rffe_init(void)
+{
+	uint16_t reg;
+
+	reg = readw(ARM_CONF_REG);
+	reg &= ~ (1 << 5);	/* TSPACT6 I/O function, not nCS6 */
+	writew(reg, ARM_CONF_REG);
+
+	reg = readw(MCU_SW_TRACE);
+	reg &= ~(1 << 5);	/* TSPACT8 I/O function, not nMREQ */
+	writew(reg, MCU_SW_TRACE);
+
+	/* Configure the TSPEN which is connected to the TWL3025 */
+	tsp_setup(IOTA_STROBE, 1, 0, 0);
+
+	trf6151_init(RITA_STROBE, RITA_RESET);
+}
+
+uint8_t rffe_get_gain(void)
+{
+	return trf6151_get_gain();
+}
+
+void rffe_set_gain(uint8_t dbm)
+{
+	trf6151_set_gain(dbm);
+}
+
+const uint8_t system_inherent_gain = SYSTEM_INHERENT_GAIN;
+
+/* Given the expected input level of exp_inp dBm/8 and the target of target_bb
+ * dBm8, configure the RF Frontend with the respective gain */
+void rffe_compute_gain(int16_t exp_inp, int16_t target_bb)
+{
+	trf6151_compute_gain(exp_inp, target_bb);
+}
+
+void rffe_rx_win_ctrl(int16_t exp_inp, int16_t target_bb)
+{
+	/* FIXME */
+}
diff --git a/src/target/firmware/board/compal/start.ram.S b/src/target/firmware/board/compal/start.ram.S
new file mode 100644
index 00000000..c8f242c0
--- /dev/null
+++ b/src/target/firmware/board/compal/start.ram.S
@@ -0,0 +1,26 @@
+
+.section .text.start
+
+#include "macros.S"
+		
+.globl _start
+_start:
+	/* clear bss section */
+	clear_bss
+
+	/* initialize all stacks */
+	init_stacks
+
+	/* call constructors */
+	call_ctors
+
+	/* jump to main */
+	ldr	pc, _jump_main
+
+	/* endless loop at end of program */
+_loop:
+	b	_loop
+	b	_start
+
+_jump_main:
+	.word main
diff --git a/src/target/firmware/board/compal/start.rom.S b/src/target/firmware/board/compal/start.rom.S
new file mode 100644
index 00000000..211bea86
--- /dev/null
+++ b/src/target/firmware/board/compal/start.rom.S
@@ -0,0 +1,32 @@
+
+.section .text.start
+
+#include "macros.S"
+		
+.globl _start
+_start:
+	/* clear bss section */
+	clear_bss
+
+	/* copy data to ram */
+	copy_data
+
+	/* copy alway-in-ram code */
+	copy_ramtext
+
+	/* initialize all stacks */
+	init_stacks
+
+	/* call constructors */
+	call_ctors
+
+	/* jump to main */
+	ldr	pc, _jump_main
+
+	/* endless loop at end of program */
+_loop:
+	b	_loop
+	b	_start
+
+_jump_main:
+	.word main
diff --git a/src/target/firmware/board/compal_e86/init.c b/src/target/firmware/board/compal_e86/init.c
new file mode 100644
index 00000000..fed9f85a
--- /dev/null
+++ b/src/target/firmware/board/compal_e86/init.c
@@ -0,0 +1,149 @@
+/* Initialization for the Compal E86 (Motorola C139/C140) */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Steve Markgraf <steve@steve-m.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <ctors.h>
+#include <memory.h>
+#include <board.h>
+#include <keypad.h>
+#include <console.h>
+#include <flash/cfi_flash.h>
+
+#include <calypso/irq.h>
+#include <calypso/clock.h>
+#include <calypso/dma.h>
+#include <calypso/rtc.h>
+#include <calypso/timer.h>
+#include <uart.h>
+#include <calypso/backlight.h>
+
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+
+#include <fb/framebuffer.h>
+#include "../compal/keymap.h"
+
+#define ARMIO_LATCH_OUT 0xfffe4802
+#define IO_CNTL_REG	0xfffe4804
+#define ASIC_CONF_REG	0xfffef008
+
+static void board_io_init(void)
+{
+	uint16_t reg;
+
+	reg = readw(ASIC_CONF_REG);
+	/* LCD Set I/O(3) / SA0 to I/O(3) mode */
+	reg &= ~( (1 << 12) | (1 << 10) | (1 << 7) | (1 << 1)) ;
+	/* don't set function pins to I2C Mode, C155 uses UWire */
+	/* TWL3025: Set SPI+RIF RX clock to rising edge */
+	reg |= (1 << 13) | (1 << 14);
+	writew(reg, ASIC_CONF_REG);
+
+	/* LCD Set I/O(3) to output mode and enable C140 backlight (IO1) */
+	/* FIXME: Put the display backlight control to backlight.c */
+	reg = readw(IO_CNTL_REG);
+	reg &= ~((1 << 3) | (1 << 1));
+	writew(reg, IO_CNTL_REG);
+
+	/* LCD Set I/O(3) output low */
+	reg = readw(ARMIO_LATCH_OUT);
+	reg &= ~(1 << 3);
+	reg |= (1 << 1);
+	writew(reg, ARMIO_LATCH_OUT);
+}
+
+void board_init(int with_irq)
+{
+	/* Disable watchdog (compal loader leaves it enabled) */
+	wdog_enable(0);
+
+	/* Configure memory interface */
+	calypso_mem_cfg(CALYPSO_nCS0, 3, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS1, 3, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS2, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS3, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_CS4, 0, CALYPSO_MEM_8bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS6, 0, CALYPSO_MEM_32bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS7, 0, CALYPSO_MEM_32bit, 0);
+
+	/* Set VTCXO_DIV2 = 1, configure PLL for 104 MHz and give ARM half of that */
+	calypso_clock_set(2, CALYPSO_PLL13_104_MHZ, ARM_MCLK_DIV_2);
+
+	/* Configure the RHEA bridge with some sane default values */
+	calypso_rhea_cfg(0, 0, 0xff, 0, 1, 0, 0);
+
+	/* Initialize board-specific GPIO */
+	board_io_init();
+
+	/* Enable bootrom mapping to route exception vectors to RAM */
+	calypso_bootrom(with_irq);
+	calypso_exceptions_install();
+
+	/* Initialize interrupt controller */
+	if (with_irq)
+		irq_init();
+
+	sercomm_bind_uart(UART_MODEM);
+	cons_bind_uart(UART_IRDA);
+
+	/* initialize MODEM UART to be used for sercomm */
+	uart_init(UART_MODEM, with_irq);
+	uart_baudrate(UART_MODEM, UART_115200);
+
+	/* initialize IRDA UART to be used for old-school console code.
+	 * note: IRDA uart only accessible on C115 and C117 PCB */
+	uart_init(UART_IRDA, with_irq);
+	uart_baudrate(UART_IRDA, UART_115200);
+
+	/* Initialize hardware timers */
+	hwtimer_init();
+
+	/* Initialize DMA controller */
+	dma_init();
+
+	/* Initialize real time clock */
+	rtc_init();
+
+	/* Initialize system timers (uses hwtimer 2) */
+	timer_init();
+
+	/* Initialize LCD driver (uses UWire) */
+	fb_init();
+	bl_mode_pwl(1);
+	bl_level(0);
+
+	/* Initialize keypad driver */
+	keypad_init(keymap, with_irq);
+
+	/* Initialize ABB driver (uses SPI) */
+	twl3025_init();
+
+	/* enable LEDB driver of Iota for keypad backlight */
+	twl3025_reg_write(AUXLED, 0x02);
+}
diff --git a/src/target/firmware/board/compal_e86/rffe_dualband_e86.c b/src/target/firmware/board/compal_e86/rffe_dualband_e86.c
new file mode 100644
index 00000000..4ad85dcd
--- /dev/null
+++ b/src/target/firmware/board/compal_e86/rffe_dualband_e86.c
@@ -0,0 +1,112 @@
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <rffe.h>
+#include <calypso/tsp.h>
+#include <rf/trf6151.h>
+
+/* This is a value that has been measured on the C123 by Harald: 71dBm,
+   it is the difference between the input level at the antenna and what
+   the DSP reports, subtracted by the total gain of the TRF6151 */
+#define SYSTEM_INHERENT_GAIN	71
+
+/* describe how the RF frontend is wired on the Motorola E86 board (C139/C140) */
+
+#define		RITA_RESET	TSPACT(0)	/* Reset of the Rita TRF6151 */
+#define		PA_ENABLE	TSPACT(1)	/* Enable the Power Amplifier */
+#define		DCS_TX		TSPACT(6)	/* DCS Transmit Enable */
+#define		GSM_TX1		TSPACT(8)	/* GSM Transmit Enable 1 */
+
+/* in order to save a transistor, the E86 has a second signal for GSM TX */
+#define		GSM_TX2		TSPACT(2)	/* GSM Transmit Enable 2 */
+
+#define		IOTA_STROBE	TSPEN(0)	/* Strobe for the Iota TSP */
+#define		RITA_STROBE	TSPEN(2)	/* Strobe for the Rita TSP */
+
+/* switch RF Frontend Mode */
+void rffe_mode(enum gsm_band band, int tx)
+{
+	uint16_t tspact = tsp_act_state();
+
+	/* First we mask off all bits from the state cache */
+	tspact &= ~(PA_ENABLE);
+	tspact |=  DCS_TX | GSM_TX1 | GSM_TX2;	/* low-active */
+
+#ifdef CONFIG_TX_ENABLE
+	/* Then we selectively set the bits on, if required */
+	if (tx) {
+		if (band == GSM_BAND_850 || band == GSM_BAND_900)
+			tspact &= ~(GSM_TX1 | GSM_TX2);
+		else
+			tspact &= ~DCS_TX;
+		tspact |= PA_ENABLE;
+	}
+#endif /* TRANSMIT_SUPPORT */
+
+	tsp_act_update(tspact);
+}
+
+/* Returns RF wiring */
+uint32_t rffe_get_rx_ports(void)
+{
+	return (1 << PORT_LO) | (1 << PORT_DCS1800);
+}
+
+uint32_t rffe_get_tx_ports(void)
+{
+	return (1 << PORT_LO) | (1 << PORT_HI);
+}
+
+/* Returns need for IQ swap */
+int rffe_iq_swapped(uint16_t band_arfcn, int tx)
+{
+	return trf6151_iq_swapped(band_arfcn, tx);
+}
+
+
+#define MCU_SW_TRACE	0xfffef00e
+#define ARM_CONF_REG	0xfffef006
+
+void rffe_init(void)
+{
+	uint16_t reg;
+
+	reg = readw(ARM_CONF_REG);
+	reg &= ~ (1 << 5);	/* TSPACT6 I/O function, not nCS6 */
+	writew(reg, ARM_CONF_REG);
+
+	reg = readw(MCU_SW_TRACE);
+	reg &= ~(1 << 5);	/* TSPACT8 I/O function, not nMREQ */
+	writew(reg, MCU_SW_TRACE);
+
+	/* Configure the TSPEN which is connected to the TWL3025 */
+	tsp_setup(IOTA_STROBE, 1, 0, 0);
+
+	trf6151_init(RITA_STROBE, RITA_RESET);
+}
+
+uint8_t rffe_get_gain(void)
+{
+	return trf6151_get_gain();
+}
+
+void rffe_set_gain(uint8_t dbm)
+{
+	trf6151_set_gain(dbm);
+}
+
+const uint8_t system_inherent_gain = SYSTEM_INHERENT_GAIN;
+
+/* Given the expected input level of exp_inp dBm/8 and the target of target_bb
+ * dBm8, configure the RF Frontend with the respective gain */
+void rffe_compute_gain(int16_t exp_inp, int16_t target_bb)
+{
+	trf6151_compute_gain(exp_inp, target_bb);
+}
+
+void rffe_rx_win_ctrl(int16_t exp_inp, int16_t target_bb)
+{
+	/* FIXME */
+}
diff --git a/src/target/firmware/board/compal_e88/LINKAGE.txt b/src/target/firmware/board/compal_e88/LINKAGE.txt
new file mode 100644
index 00000000..8adaf86e
--- /dev/null
+++ b/src/target/firmware/board/compal_e88/LINKAGE.txt
@@ -0,0 +1,33 @@
+
+The Compal E88 supports the common Compal RAM linkages.
+These operate entirely from the Calypso internal RAM.
+
+Flash linkages are structured as follows:
+
+  e88loader:
+    Linked at address of original compal application (0x2000).
+    Provides interrupt vectors as expected by compal loader.
+    Allows interrupt redirection (XXX to where?).
+    
+    We introduce this for the following reasons:
+    1. We want to start our app at 0x10000, because that
+       is the first flash page after the loader page, allowing
+       us a higher degree of "unbrickability" by never reflashing
+       the bootloader.
+    2. We want to keep the compal loader so we do not need even
+       more boot options and to allow recovery of original firmware.
+    3. When there is a custom app in flash at 0xFFFF, just turning
+       the phone on with the compal loader would jump into an incomplete
+       motorola app. That might not even allow turning the phone off.
+       The loader provides this functionality.
+    4. We do not want to patch the compal loader for interrupt
+       redirect and entry vectors. So we need to place something between
+       0x2000 and 0x10000 anyway. And since there is space, why not put
+       the whole loader in there.
+    5. This loader has a good chance of being able to read crash buffers.
+       and examining RAM without it being clobbered by a ram upload.
+
+  e88flash:
+    Our main application linkage, starting at 0x10000 and going through
+    all of flash. Data storage locations are still to be determined.
+
diff --git a/src/target/firmware/board/compal_e88/MEMORY_MAP.txt b/src/target/firmware/board/compal_e88/MEMORY_MAP.txt
new file mode 100644
index 00000000..6094aa9b
--- /dev/null
+++ b/src/target/firmware/board/compal_e88/MEMORY_MAP.txt
@@ -0,0 +1,21 @@
+The Compal E88 has the following physical memory map:
+
+    /* 2 MBytes of external flash memory */
+    FLASH (rx) : ORIGIN = 0x00000000, LENGTH = 0x200000
+    /* 256 kBytes of internal zero-waitstate sram */
+    IRAM  (rw) : ORIGIN = 0x00800000, LENGTH = 0x040000
+    /* 256 kBytes of external slow sram */
+    ERAM  (rw) : ORIGIN = 0x01000000, LENGTH = 0x040000
+
+The flash layout, as distributed, is:
+
+    0x00000000 0x2000 Compal loader
+    0x00002000 >>>>>> Compal application and storage
+
+Our flash layout is:
+
+    0x00000000 0x2000 Compal loader
+    0x00002000 0xE000 OSMOCOM loader (see LINKAGE.txt for reasoning)
+    0x00010000 >>>>>> OSMOCOM application and storage
+
+(XXX: determine storage location / storage descriptor location)
diff --git a/src/target/firmware/board/compal_e88/flash.lds b/src/target/firmware/board/compal_e88/flash.lds
new file mode 100644
index 00000000..67d727ff
--- /dev/null
+++ b/src/target/firmware/board/compal_e88/flash.lds
@@ -0,0 +1,135 @@
+/*
+ * Linker script for flashed applications on the Compal E88
+ *
+ * This script creates a binary that can be linked at 0xFFFF, starting
+ * with the second flash page. This is what a phone application or
+ * pure layer1 device uses.
+ *
+ * XXX: interrupts?
+ *
+ */
+OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
+OUTPUT_ARCH(arm)
+ENTRY(_start)
+MEMORY
+{
+	LOADR (rx) : ORIGIN = 0x00000000, LENGTH = 0x10000
+    /* 2 MBytes of external flash memory (minus loader) */
+    FLASH (rx) : ORIGIN = 0x00010000, LENGTH = 0x1F0000
+    /* 256 kBytes of internal zero-waitstate sram */
+    IRAM  (rw) : ORIGIN = 0x00800000, LENGTH = 0x040000
+    /* 256 kBytes of external slow sram */
+    ERAM  (rw) : ORIGIN = 0x01000000, LENGTH = 0x040000
+}
+SECTIONS
+{
+    /* entrypoint */
+    .text.start : {
+        PROVIDE(_start = .);
+        KEEP(*(.text.start))
+        *(.text.start)
+    } > FLASH
+
+    /* exception vectors from 0x80001c to 0x800034 */
+    .text.exceptions 0x80001c : {
+        KEEP(*(.text.exceptions))
+        * (.text.exceptions)
+        . = ALIGN(4);
+    } > IRAM AT> FLASH
+    PROVIDE(_exceptions = LOADADDR(.text.exceptions));
+
+    /* code */
+    .text : {
+        /* regular code */
+        *(.text*)
+        /* gcc voodoo */
+        *(.glue_7t) *(.glue_7) *(.vfp11_veneer) *(.v4_bx)
+    } > FLASH
+    PROVIDE(_text_start = ADDR(.text));
+    PROVIDE(_text_end = ADDR(.text) + SIZEOF(.text));
+
+    /* constructor pointers */
+    .ctors : {
+        /* ctor count */
+        LONG(SIZEOF(.ctors) / 4 - 2)
+        /* ctor pointers */
+        KEEP(*(SORT(.ctors)))
+        KEEP(*(SORT(.init_array)))
+        /* end of list */
+        LONG(0)
+    } > FLASH
+    PROVIDE(_ctor_start = LOADADDR(.ctors));
+    PROVIDE(_ctor_end = LOADADDR(.ctors) + SIZEOF(.ctors));
+
+    /* destructor pointers */
+    .dtors : {
+        /* dtor count */
+        LONG(SIZEOF(.dtors) / 4 - 2)
+        /* dtor pointers */
+        KEEP(*(SORT(.dtors)))
+        /* end of list */
+        LONG(0)
+    } > FLASH
+    PROVIDE(_dtor_start = LOADADDR(.dtors));
+    PROVIDE(_dtor_end = LOADADDR(.dtors) + SIZEOF(.dtors));
+
+    /* read-only data */
+    .rodata : {
+        *(.rodata*)
+    } > FLASH
+    PROVIDE(_rodata_start = ADDR(.rodata));
+    PROVIDE(_rodata_end = ADDR(.rodata) + SIZEOF(.rodata));
+
+    /* pic offset tables */
+    .got : {
+        . = ALIGN(4);
+        *(.got)
+        *(.got.plt) *(.igot.plt) *(.got) *(.igot)
+        . = ALIGN(4);
+    } > FLASH
+    PROVIDE(_got_start = ADDR(.got));
+    PROVIDE(_got_end = ADDR(.got) + SIZEOF(.got));
+
+    /* reserved ram  */
+    .compal.reservedram 0x800000 (NOLOAD) : {
+        . = 0xff;
+    } > IRAM
+
+    /* initialized data */
+    .data : AT (LOADADDR(.got) + SIZEOF(.got)) {
+        . = ALIGN(4);
+        *(.data)
+        . = ALIGN(4);
+    } > IRAM
+    PROVIDE(__data_start = LOADADDR(.data));
+    PROVIDE(__data_end = LOADADDR(.data) + SIZEOF(.data));
+    PROVIDE(_data_start = ADDR(.data));
+    PROVIDE(_data_end = ADDR(.data) + SIZEOF(.data));
+
+    /* ram code */
+    .ramtext : AT (LOADADDR(.data) + SIZEOF(.data)) {
+        . = ALIGN(4);
+        *(.ramtext)
+        . = ALIGN(4);
+    } > IRAM
+    PROVIDE(__ramtext_start = LOADADDR(.ramtext));
+    PROVIDE(__ramtext_end = LOADADDR(.ramtext) + SIZEOF(.ramtext));
+    PROVIDE(_ramtext_start = ADDR(.ramtext));
+    PROVIDE(_ramtext_end = ADDR(.ramtext) + SIZEOF(.ramtext));
+
+    /* uninitialized data */
+    .bss (NOLOAD) : {
+        . = ALIGN(4);
+        *(.bss)
+        . = ALIGN(4);
+    } > IRAM
+    PROVIDE(__bss_start = ADDR(.bss));
+    PROVIDE(__bss_end = ADDR(.bss) + SIZEOF(.bss));
+    PROVIDE(_bss_start = __bss_start);
+    PROVIDE(_bss_end = __bss_end);
+
+    /* end of image */
+    . = ALIGN(4);
+    _end = .;
+    PROVIDE(end = .);
+}
diff --git a/src/target/firmware/board/compal_e88/init.c b/src/target/firmware/board/compal_e88/init.c
new file mode 100755
index 00000000..04ae4588
--- /dev/null
+++ b/src/target/firmware/board/compal_e88/init.c
@@ -0,0 +1,145 @@
+/* Initialization for the Compal E88 (Motorola C115...C123) */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <ctors.h>
+#include <memory.h>
+#include <board.h>
+#include <keypad.h>
+#include <console.h>
+#include <flash/cfi_flash.h>
+
+#include <calypso/irq.h>
+#include <calypso/clock.h>
+#include <calypso/dma.h>
+#include <calypso/rtc.h>
+#include <calypso/timer.h>
+#include <uart.h>
+#include <calypso/backlight.h>
+
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+#include <fb/framebuffer.h>
+#include <battery/compal_e88.h>
+#include "../compal/keymap.h"
+
+#define ARMIO_LATCH_OUT 0xfffe4802
+#define IO_CNTL_REG	0xfffe4804
+#define ASIC_CONF_REG	0xfffef008
+
+static void board_io_init(void)
+{
+	uint16_t reg;
+
+	reg = readw(ASIC_CONF_REG);
+	/* LCD Set I/O(3) / SA0 to I/O(3) mode */
+	reg &= ~(1 << 10);
+	/* Set function pins to I2C Mode */
+	reg |= ((1 << 12) | (1 << 7));		/* SCL / SDA */
+	/* TWL3025: Set SPI+RIF RX clock to rising edge */
+	reg |= (1 << 13) | (1 << 14);
+	writew(reg, ASIC_CONF_REG);
+
+	/* LCD Set I/O(3) to output mode */
+	reg = readw(IO_CNTL_REG);
+	reg &= ~(1 << 3);
+	writew(reg, IO_CNTL_REG);
+
+	/* LCD Set I/O(3) output low */
+	reg = readw(ARMIO_LATCH_OUT);
+	reg &= ~(1 << 3);
+	writew(reg, ARMIO_LATCH_OUT);
+}
+
+void board_init(int with_irq)
+{
+	/* Configure the memory interface */
+	calypso_mem_cfg(CALYPSO_nCS0, 3, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS1, 3, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS2, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS3, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_CS4, 0, CALYPSO_MEM_8bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS6, 0, CALYPSO_MEM_32bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS7, 0, CALYPSO_MEM_32bit, 0);
+
+	/* Set VTCXO_DIV2 = 1, configure PLL for 104 MHz and give ARM half of that */
+	calypso_clock_set(2, CALYPSO_PLL13_104_MHZ, ARM_MCLK_DIV_2);
+
+	/* Configure the RHEA bridge with some sane default values */
+	calypso_rhea_cfg(0, 0, 0xff, 0, 1, 0, 0);
+
+	/* Initialize board-specific GPIO */
+	board_io_init();
+
+	/* Enable bootrom mapping to route exception vectors to RAM */
+	calypso_bootrom(with_irq);
+	calypso_exceptions_install();
+
+	/* Initialize interrupt controller */
+	if (with_irq)
+		irq_init();
+
+	sercomm_bind_uart(UART_MODEM);
+	cons_bind_uart(UART_IRDA);
+
+	/* initialize MODEM UART to be used for sercomm */
+	uart_init(UART_MODEM, with_irq);
+	uart_baudrate(UART_MODEM, UART_115200);
+
+	/* Initialize IRDA UART to be used for old-school console code.
+	 * note: IRDA uart only accessible on C115 and C117 PCB */
+	uart_init(UART_IRDA, with_irq);
+	uart_baudrate(UART_IRDA, UART_115200);
+
+	/* Initialize hardware timers */
+	hwtimer_init();
+
+	/* Initialize DMA controller */
+	dma_init();
+
+	/* Initialize real time clock */
+	rtc_init();
+
+	/* Initialize system timers (uses hwtimer 2) */
+	timer_init();
+
+	/* Initialize LCD driver (uses I2C) and backlight */
+	fb_init();
+
+	bl_mode_pwl(1);
+	bl_level(50);
+
+	/* Initialize keypad driver */
+	keypad_init(keymap, with_irq);
+
+	/* Initialize ABB driver (uses SPI) */
+	twl3025_init();
+
+	/* Initialize the charging controller */
+	battery_compal_e88_init();
+}
diff --git a/src/target/firmware/board/compal_e88/loader.lds b/src/target/firmware/board/compal_e88/loader.lds
new file mode 100644
index 00000000..22febff4
--- /dev/null
+++ b/src/target/firmware/board/compal_e88/loader.lds
@@ -0,0 +1,148 @@
+/*
+ * Linker script for flashed loader on the Compal E88
+ *
+ * This script creates a binary that can replace a standard firmware
+ * located at 0x2000. It works in conjunction with the compal ramloader.
+ *
+ * The interrupt vectors and start address are at known, fixed offsets.
+ *
+ */
+OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
+OUTPUT_ARCH(arm)
+ENTRY(_start)
+MEMORY
+{
+    /* 2 MBytes of external flash memory */
+    FLASH (rx) : ORIGIN = 0x00000000, LENGTH = 0x200000
+    /* 256 kBytes of internal zero-waitstate sram */
+    IRAM  (rw) : ORIGIN = 0x00800000, LENGTH = 0x040000
+    /* 256 kBytes of external slow sram */
+    ERAM  (rw) : ORIGIN = 0x01000000, LENGTH = 0x040000
+}
+SECTIONS
+{
+    /* Provide symbols for the compal loader */
+    .compal.loader 0x00000000 (NOLOAD) : {
+        _compal_loader_start = .;
+        . = 0x2000;
+        _compal_loader_end = .;
+    } > FLASH
+
+    /* Compal-style image header */
+    .compal.header 0x00002000 : {
+        _compal_header_start = .;
+        KEEP(*(.compal.header))
+        *(.compal.header)
+        . = 0xA0;
+        _compal_header_end = .;
+    } > FLASH
+
+    /* Compal-style vector table */
+    .compal.vectors 0x000020A0 : {
+        PROVIDE(_exceptions = .);
+        KEEP(*(.text.exceptions))
+        *(.text.exceptions)
+    } > FLASH
+
+    /* Compal-style entry point */
+    .text.start 0x000020F8 : {
+        PROVIDE(_start = .);
+        KEEP(*(.text.start))
+        *(.text.start)
+    } > FLASH
+
+    /* code */
+    .text : {
+        /* regular code */
+        *(.text*)
+        /* gcc voodoo */
+        *(.glue_7t) *(.glue_7) *(.vfp11_veneer) *(.v4_bx)
+    } > FLASH
+    PROVIDE(_text_start = ADDR(.text));
+    PROVIDE(_text_end = ADDR(.text) + SIZEOF(.text));
+
+    /* constructor pointers */
+    .ctors : {
+        /* ctor count */
+        LONG(SIZEOF(.ctors) / 4 - 2)
+        /* ctor pointers */
+        KEEP(*(SORT(.ctors)))
+        KEEP(*(SORT(.init_array)))
+        /* end of list */
+        LONG(0)
+    } > FLASH
+    PROVIDE(_ctor_start = LOADADDR(.ctors));
+    PROVIDE(_ctor_end = LOADADDR(.ctors) + SIZEOF(.ctors));
+
+    /* destructor pointers */
+    .dtors : {
+        /* dtor count */
+        LONG(SIZEOF(.dtors) / 4 - 2)
+        /* dtor pointers */
+        KEEP(*(SORT(.dtors)))
+        /* end of list */
+        LONG(0)
+    } > FLASH
+    PROVIDE(_dtor_start = LOADADDR(.dtors));
+    PROVIDE(_dtor_end = LOADADDR(.dtors) + SIZEOF(.dtors));
+
+    /* read-only data */
+    .rodata : {
+        *(.rodata*)
+    } > FLASH
+    PROVIDE(_rodata_start = ADDR(.rodata));
+    PROVIDE(_rodata_end = ADDR(.rodata) + SIZEOF(.rodata));
+
+    /* pic offset tables */
+    .got : {
+        . = ALIGN(4);
+        *(.got)
+        *(.got.plt) *(.igot.plt) *(.got) *(.igot)
+        . = ALIGN(4);
+    } > FLASH
+    PROVIDE(_got_start = ADDR(.got));
+    PROVIDE(_got_end = ADDR(.got) + SIZEOF(.got));
+
+    /* reserved ram  */
+    .compal.reservedram 0x800000 (NOLOAD) : {
+        . = 0xff;
+    } > IRAM
+
+    /* initialized data */
+    .data : AT (LOADADDR(.got) + SIZEOF(.got)) {
+        . = ALIGN(4);
+        *(.data)
+        . = ALIGN(4);
+    } > IRAM
+    PROVIDE(__data_start = LOADADDR(.data));
+    PROVIDE(__data_end = LOADADDR(.data) + SIZEOF(.data));
+    PROVIDE(_data_start = ADDR(.data));
+    PROVIDE(_data_end = ADDR(.data) + SIZEOF(.data));
+
+    /* ram code */
+    .ramtext : AT (LOADADDR(.data) + SIZEOF(.data)) {
+        . = ALIGN(4);
+        *(.ramtext)
+        . = ALIGN(4);
+    } > IRAM
+    PROVIDE(__ramtext_start = LOADADDR(.ramtext));
+    PROVIDE(__ramtext_end = LOADADDR(.ramtext) + SIZEOF(.ramtext));
+    PROVIDE(_ramtext_start = ADDR(.ramtext));
+    PROVIDE(_ramtext_end = ADDR(.ramtext) + SIZEOF(.ramtext));
+
+    /* uninitialized data */
+    .bss (NOLOAD) : {
+        . = ALIGN(4);
+        *(.bss)
+        . = ALIGN(4);
+    } > IRAM
+    PROVIDE(__bss_start = ADDR(.bss));
+    PROVIDE(__bss_end = ADDR(.bss) + SIZEOF(.bss));
+    PROVIDE(_bss_start = __bss_start);
+    PROVIDE(_bss_end = __bss_end);
+
+    /* end of image */
+    . = ALIGN(4);
+    _end = .;
+    PROVIDE(end = .);
+}
diff --git a/src/target/firmware/board/compal_e99/init.c b/src/target/firmware/board/compal_e99/init.c
new file mode 100644
index 00000000..7cc3c67d
--- /dev/null
+++ b/src/target/firmware/board/compal_e99/init.c
@@ -0,0 +1,147 @@
+/* Initialization for the Compal E99 (Motorola C155) */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Steve Markgraf <steve@steve-m.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <ctors.h>
+#include <memory.h>
+#include <board.h>
+#include <keypad.h>
+#include <console.h>
+#include <flash/cfi_flash.h>
+
+#include <calypso/irq.h>
+#include <calypso/clock.h>
+#include <calypso/dma.h>
+#include <calypso/rtc.h>
+#include <calypso/timer.h>
+#include <uart.h>
+#include <calypso/backlight.h>
+
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+
+#include <fb/framebuffer.h>
+#include "../compal/keymap.h"
+
+#define ARMIO_LATCH_OUT 0xfffe4802
+#define IO_CNTL_REG	0xfffe4804
+#define ASIC_CONF_REG	0xfffef008
+
+static void board_io_init(void)
+{
+	uint16_t reg;
+
+	reg = readw(ASIC_CONF_REG);
+	/* LCD Set I/O(3) / SA0 to I/O(3) mode */
+	reg &= ~( (1 << 12) | (1 << 10) | (1 << 7) | (1 << 1)) ;
+	/* don't set function pins to I2C Mode, C155 uses UWire */
+	/* TWL3025: Set SPI+RIF RX clock to rising edge */
+	reg |= (1 << 13) | (1 << 14);
+	writew(reg, ASIC_CONF_REG);
+
+	/* LCD Set I/O(3) to output mode and enable C155 backlight (IO1) */
+	/* FIXME: Put the display backlight control to backlight.c */
+	reg = readw(IO_CNTL_REG);
+	reg &= ~( (1 << 3) | (1 << 1));
+	writew(reg, IO_CNTL_REG);
+
+	/* LCD Set I/O(3) output low */
+	reg = readw(ARMIO_LATCH_OUT);
+	reg &= ~(1 << 3);
+	reg |= (1 << 1);
+	writew(reg, ARMIO_LATCH_OUT);
+}
+
+void board_init(int with_irq)
+{
+	/* Disable watchdog (compal loader leaves it enabled) */
+	wdog_enable(0);
+
+	/* Configure memory interface */
+	calypso_mem_cfg(CALYPSO_nCS0, 3, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS1, 3, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS2, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS3, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_CS4, 0, CALYPSO_MEM_8bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS6, 0, CALYPSO_MEM_32bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS7, 0, CALYPSO_MEM_32bit, 0);
+
+	/* Set VTCXO_DIV2 = 1, configure PLL for 104 MHz and give ARM half of that */
+	calypso_clock_set(2, CALYPSO_PLL13_104_MHZ, ARM_MCLK_DIV_2);
+
+	/* Configure the RHEA bridge with some sane default values */
+	calypso_rhea_cfg(0, 0, 0xff, 0, 1, 0, 0);
+
+	/* Initialize board-specific GPIO */
+	board_io_init();
+
+	/* Enable bootrom mapping to route exception vectors to RAM */
+	calypso_bootrom(with_irq);
+	calypso_exceptions_install();
+
+	/* Initialize interrupt controller */
+	if (with_irq)
+		irq_init();
+
+	sercomm_bind_uart(UART_MODEM);
+	cons_bind_uart(UART_IRDA);
+
+	/* initialize MODEM UART to be used for sercomm */
+	uart_init(UART_MODEM, with_irq);
+	uart_baudrate(UART_MODEM, UART_115200);
+
+	/* initialize IRDA UART to be used for old-school console code.
+	 * note: IRDA uart only accessible on C115 and C117 PCB */
+	uart_init(UART_IRDA, with_irq);
+	uart_baudrate(UART_IRDA, UART_115200);
+
+	/* Initialize hardware timers */
+	hwtimer_init();
+
+	/* Initialize DMA controller */
+	dma_init();
+
+	/* Initialize real time clock */
+	rtc_init();
+
+	/* Initialize system timers (uses hwtimer 2) */
+	timer_init();
+
+	/* Initialize LCD driver (uses UWire) and backlight */
+	bl_mode_pwl(1);
+	bl_level(50);
+
+	fb_init();
+
+	/* Initialize keypad driver */
+	keypad_init(keymap, with_irq);
+
+	/* Initialize ABB driver (uses SPI) */
+	twl3025_init();
+}
diff --git a/src/target/firmware/board/gta0x/init.c b/src/target/firmware/board/gta0x/init.c
new file mode 100644
index 00000000..4f49e802
--- /dev/null
+++ b/src/target/firmware/board/gta0x/init.c
@@ -0,0 +1,138 @@
+/* Initialization for the Openmoko Freerunner modem */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <ctors.h>
+#include <memory.h>
+#include <board.h>
+#include <keypad.h>
+#include <console.h>
+#include <flash/cfi_flash.h>
+
+#include <calypso/irq.h>
+#include <calypso/clock.h>
+#include <calypso/dma.h>
+#include <calypso/rtc.h>
+#include <calypso/timer.h>
+#include <uart.h>
+#include <calypso/backlight.h>
+
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+#include "../compal/keymap.h"
+
+#define ARMIO_LATCH_OUT 0xfffe4802
+#define IO_CNTL_REG	0xfffe4804
+#define ASIC_CONF_REG	0xfffef008
+
+static void board_io_init(void)
+{
+	uint16_t reg;
+
+	reg = readw(ASIC_CONF_REG);
+	/* LCD Set I/O(3) / SA0 to I/O(3) mode */
+	reg &= ~(1 << 10);
+	/* Set function pins to I2C Mode */
+	reg |= ((1 << 12) | (1 << 7));		/* SCL / SDA */
+	/* TWL3025: Set SPI+RIF RX clock to rising edge */
+	reg |= (1 << 13) | (1 << 14);
+	writew(reg, ASIC_CONF_REG);
+
+	/* LCD Set I/O(3) to output mode */
+	reg = readw(IO_CNTL_REG);
+	reg &= ~(1 << 3);
+	writew(reg, IO_CNTL_REG);
+
+	/* LCD Set I/O(3) output low */
+	reg = readw(ARMIO_LATCH_OUT);
+	reg &= ~(1 << 3);
+	writew(reg, ARMIO_LATCH_OUT);
+}
+
+void board_init(int with_irq)
+{
+	/* Configure the memory interface */
+	calypso_mem_cfg(CALYPSO_nCS0, 3, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS1, 3, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS2, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS3, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_CS4, 0, CALYPSO_MEM_8bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS6, 0, CALYPSO_MEM_32bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS7, 0, CALYPSO_MEM_32bit, 0);
+
+	/* Set VTCXO_DIV2 = 1, configure PLL for 104 MHz and give ARM half of that */
+	calypso_clock_set(2, CALYPSO_PLL13_104_MHZ, ARM_MCLK_DIV_2);
+
+	/* Configure the RHEA bridge with some sane default values */
+	calypso_rhea_cfg(0, 0, 0xff, 0, 1, 0, 0);
+
+	/* Initialize board-specific GPIO */
+	board_io_init();
+
+	/* Enable bootrom mapping to route exception vectors to RAM */
+	calypso_bootrom(with_irq);
+	calypso_exceptions_install();
+
+	/* Initialize interrupt controller */
+	if (with_irq)
+		irq_init();
+
+	sercomm_bind_uart(UART_MODEM);
+	cons_bind_uart(UART_IRDA);
+
+	/* initialize MODEM UART to be used for sercomm */
+	uart_init(UART_MODEM, with_irq);
+	uart_baudrate(UART_MODEM, UART_115200);
+
+	/* Initialize IRDA UART to be used for old-school console code.
+	 * note: IRDA uart only accessible on C115 and C117 PCB */
+	uart_init(UART_IRDA, with_irq);
+	uart_baudrate(UART_IRDA, UART_115200);
+
+	/* Initialize hardware timers */
+	hwtimer_init();
+
+	/* Initialize DMA controller */
+	dma_init();
+
+	/* Initialize real time clock */
+	rtc_init();
+
+	/* Initialize system timers (uses hwtimer 2) */
+	timer_init();
+
+	/* Initialize LCD driver (uses I2C) and backlight */
+	bl_mode_pwl(1);
+	bl_level(50);
+
+	/* Initialize keypad driver */
+	keypad_init(keymap, with_irq);
+
+	/* Initialize ABB driver (uses SPI) */
+	twl3025_init();
+}
diff --git a/src/target/firmware/board/gta0x/rf_power.c b/src/target/firmware/board/gta0x/rf_power.c
new file mode 100644
index 00000000..1c896f74
--- /dev/null
+++ b/src/target/firmware/board/gta0x/rf_power.c
@@ -0,0 +1,63 @@
+/* Tx RF power calibration for the FIC GTA0x phones */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <osmocom/core/utils.h>
+
+/* GSM900 ARFCN 33, Measurements by Steve Markgraf / May 2010 */
+/* FIXME those are from compal ... need real GTA calibration */
+const int16_t dbm2apc_gsm900[] = {
+	[0]     = 151,
+	[1]     = 152,
+	[2]     = 153,
+	[3]     = 155,
+	[4]     = 156,
+	[5]     = 158,
+	[6]     = 160,
+	[7]     = 162,
+	[8]     = 164,
+	[9]     = 167,
+	[10]    = 170,
+	[11]    = 173,
+	[12]    = 177,
+	[13]    = 182,
+	[14]    = 187,
+	[15]    = 192,
+	[16]    = 199,
+	[17]    = 206,
+	[18]    = 214,
+	[19]    = 223,
+	[20]    = 233,
+	[21]    = 244,
+	[22]    = 260,
+	[23]    = 271,
+	[24]    = 288,
+	[25]    = 307,
+	[26]    = 327,
+	[27]    = 350,
+	[28]    = 376,
+	[29]    = 407,
+	[30]    = 456,
+	[31]    = 575,
+};
+
+const int dbm2apc_gsm900_max = ARRAY_SIZE(dbm2apc_gsm900) - 1;
diff --git a/src/target/firmware/board/gta0x/rffe_gta0x_triband.c b/src/target/firmware/board/gta0x/rffe_gta0x_triband.c
new file mode 100644
index 00000000..b520f656
--- /dev/null
+++ b/src/target/firmware/board/gta0x/rffe_gta0x_triband.c
@@ -0,0 +1,137 @@
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <rffe.h>
+#include <calypso/tsp.h>
+#include <rf/trf6151.h>
+
+/* This is a value that has been measured on the C123 by Harald: 71dBm,
+   it is the difference between the input level at the antenna and what
+   the DSP reports, subtracted by the total gain of the TRF6151 */
+#define SYSTEM_INHERENT_GAIN	71
+
+/* describe how the RF frontend is wired on the Openmoko GTA0x boards */
+
+#define		RITA_RESET	TSPACT(0)	/* Reset of the Rita TRF6151 */
+#define		PA_ENABLE	TSPACT(9)	/* Enable the Power Amplifier */
+#define		GSM_TXEN	TSPACT(3)	/* PA GSM switch, low-active */
+
+/* All VCn controls are low-active */
+#define		ASM_VC1		TSPACT(2)	/* Antenna switch VC1 */
+#define		ASM_VC2		TSPACT(1)	/* Antenna switch VC2 */
+#define		ASM_VC3		TSPACT(4)	/* Antenna switch VC3 */
+
+#define		IOTA_STROBE	TSPEN(0)	/* Strobe for the Iota TSP */
+#define		RITA_STROBE	TSPEN(2)	/* Strobe for the Rita TSP */
+
+/* switch RF Frontend Mode */
+void rffe_mode(enum gsm_band band, int tx)
+{
+	uint16_t tspact = tsp_act_state();
+
+	/* First we mask off all bits from the state cache */
+	tspact &= ~PA_ENABLE;
+	tspact &= ~GSM_TXEN;
+	tspact |= ASM_VC1 | ASM_VC2 | ASM_VC3; /* low-active */
+
+	switch (band) {
+	case GSM_BAND_850:
+	case GSM_BAND_900:
+	case GSM_BAND_1800:
+		break;
+	case GSM_BAND_1900:
+		tspact &= ~ASM_VC2;
+		break;
+	default:
+		/* TODO return/signal error here */
+		break;
+	}
+
+#ifdef CONFIG_TX_ENABLE
+	/* Then we selectively set the bits on, if required */
+	if (tx) {
+		switch (band) {
+		case GSM_BAND_850:
+		case GSM_BAND_900:
+			tspact &= ~ASM_VC3;
+			break;
+		case GSM_BAND_1800:
+		case GSM_BAND_1900:
+			tspact &= ~ASM_VC1;
+			tspact |= ASM_VC2;
+			tspact |= GSM_TXEN;
+			break;
+		default:
+			break;
+		}
+		tspact |= PA_ENABLE;
+	}
+#endif /* TRANSMIT_SUPPORT */
+
+	tsp_act_update(tspact);
+}
+
+/* Returns RF wiring */
+uint32_t rffe_get_rx_ports(void)
+{
+	return (1 << PORT_LO) | (1 << PORT_DCS1800) | (1 << PORT_PCS1900);
+}
+
+uint32_t rffe_get_tx_ports(void)
+{
+	return (1 << PORT_LO) | (1 << PORT_HI);
+}
+
+/* Returns need for IQ swap */
+int rffe_iq_swapped(uint16_t band_arfcn, int tx)
+{
+	return trf6151_iq_swapped(band_arfcn, tx);
+}
+
+
+#define MCU_SW_TRACE	0xfffef00e
+#define ARM_CONF_REG	0xfffef006
+
+void rffe_init(void)
+{
+	uint16_t reg;
+
+	reg = readw(ARM_CONF_REG);
+	reg &= ~ (1 << 7);	/* TSPACT4 I/O function, not nRDYMEM */
+	writew(reg, ARM_CONF_REG);
+
+	reg = readw(MCU_SW_TRACE);
+	reg &= ~(1 << 1);	/* TSPACT9 I/O function, not MAS(1) */
+	writew(reg, MCU_SW_TRACE);
+
+	/* Configure the TSPEN which is connected to the TWL3025 */
+	tsp_setup(IOTA_STROBE, 1, 0, 0);
+
+	trf6151_init(RITA_STROBE, RITA_RESET);
+}
+
+uint8_t rffe_get_gain(void)
+{
+	return trf6151_get_gain();
+}
+
+void rffe_set_gain(uint8_t dbm)
+{
+	trf6151_set_gain(dbm);
+}
+
+const uint8_t system_inherent_gain = SYSTEM_INHERENT_GAIN;
+
+/* Given the expected input level of exp_inp dBm/8 and the target of target_bb
+ * dBm8, configure the RF Frontend with the respective gain */
+void rffe_compute_gain(int16_t exp_inp, int16_t target_bb)
+{
+	trf6151_compute_gain(exp_inp, target_bb);
+}
+
+void rffe_rx_win_ctrl(int16_t exp_inp, int16_t target_bb)
+{
+	/* FIXME */
+}
diff --git a/src/target/firmware/board/manifest.c b/src/target/firmware/board/manifest.c
new file mode 100644
index 00000000..025a7224
--- /dev/null
+++ b/src/target/firmware/board/manifest.c
@@ -0,0 +1,7 @@
+
+#include "manifest.h"
+
+const char *manifest_application = APPLICATION;
+const char *manifest_revision = GIT_REVISION;
+const char *manifest_board = BOARD;
+const char *manifest_environment = ENVIRONMENT;
diff --git a/src/target/firmware/board/mediatek/macros.S b/src/target/firmware/board/mediatek/macros.S
new file mode 100644
index 00000000..14ee6e6a
--- /dev/null
+++ b/src/target/firmware/board/mediatek/macros.S
@@ -0,0 +1,76 @@
+
+.macro clear_bss
+	mov   r0, #0
+	ldr   r1, =__bss_start
+	ldr   r2, =__bss_end
+loop_bss:
+	cmp   r1, r2
+	strlo r0, [r1], #4
+	blo   loop_bss
+.endm
+
+.macro copy_data
+    ldr   r0, =__data_start
+    ldr   r1, =_data_start
+    ldr   r2, =__data_end
+	cmp r0, r2
+	beq done_data
+loop_data:
+    ldrb  r4, [r0], #1
+    strb  r4, [r1], #1
+	cmp r0, r2
+    bne   loop_data
+done_data:
+.endm
+
+.macro copy_ramtext
+    ldr   r0, =__ramtext_start
+    ldr   r1, =_ramtext_start
+    ldr   r2, =__ramtext_end
+	cmp r0, r2
+	beq done_ramtext
+loop_ramtext:
+    ldrb  r4, [r0], #1
+    strb  r4, [r1], #1
+	cmp r0, r2
+    bne   loop_ramtext
+done_ramtext:
+.endm
+		
+	.EQU	ARM_MODE_FIQ,	0x11
+	.EQU	ARM_MODE_IRQ,	0x12
+	.EQU	ARM_MODE_SVC,	0x13
+
+	.EQU	I_BIT,		0x80
+	.EQU	F_BIT,		0x40
+
+#define	TOP_OF_RAM	0x4000a000
+#define FIQ_STACK_SIZE	1024
+#define IRQ_STACK_SIZE	1024
+		
+.macro init_stacks
+	/* initialize stacks, starting at TOP_OF_RAM */
+	ldr	r0, =TOP_OF_RAM
+
+	/* initialize FIQ stack */
+	msr	CPSR_c, #ARM_MODE_FIQ | I_BIT | F_BIT
+	mov	r13, r0
+	sub	r0, r0, #FIQ_STACK_SIZE
+
+	/* initialize IRQ stack */
+	msr	CPSR_c, #ARM_MODE_IRQ | I_BIT | F_BIT
+	mov	r13, r0
+	sub	r0, r0, #IRQ_STACK_SIZE
+
+	/* initialize supervisor stack */
+	msr	CPSR_c, #ARM_MODE_SVC | I_BIT | F_BIT
+	mov	r13, r0
+.endm
+
+.macro call_ctors
+	/* call constructor functions */
+	ldr	r0, =_ctor_start
+	ldr	r1, =_ctor_end
+	bl	do_global_ctors
+.endm
+
diff --git a/src/target/firmware/board/mediatek/ram.lds b/src/target/firmware/board/mediatek/ram.lds
new file mode 100644
index 00000000..7083c273
--- /dev/null
+++ b/src/target/firmware/board/mediatek/ram.lds
@@ -0,0 +1,113 @@
+/*
+ * Linker script for running from internal SRAM on MTK phones
+ *
+ * This script is tailored specifically to the requirements imposed
+ * on us by the Mediatek bootloader.
+ *
+ */
+OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
+OUTPUT_ARCH(arm)
+ENTRY(_start)
+MEMORY
+{
+    /* mtk-loaded binary: our text, initialized data */
+    LRAM (rw) : ORIGIN = 0x40000000, LENGTH = 0x00006000
+    /* mtk-loaded binary: our unitialized data, stacks, heap */
+    IRAM (rw) : ORIGIN = 0x40006000, LENGTH = 0x00006000
+}
+SECTIONS
+{
+    . = 0x40000000;
+
+    /* romloader data section, contains passthru interrupt vectors */
+    .mtk.loader (NOLOAD) : { . = 0x1400; } > LRAM
+
+    /* initialization code */
+    . = ALIGN(4);
+    .text.start : {
+        PROVIDE(_start = .);
+        KEEP(*(.text.start))
+        *(.text.start)
+    } > LRAM
+
+    /* code */
+    . = ALIGN(4);
+    .text (LOADADDR(.text.start) + SIZEOF(.text.start)) :
+          AT (LOADADDR(.text.start) + SIZEOF(.text.start)) {
+        /* regular code */
+        *(.text*)
+        /* always-in-ram code */
+        *(.ramtext*)
+        /* gcc voodoo */
+        *(.glue_7t) *(.glue_7) *(.vfp11_veneer) *(.v4_bx)
+        . = ALIGN(4);
+    } > LRAM
+    PROVIDE(_text_start = LOADADDR(.text));
+    PROVIDE(_text_end = LOADADDR(.text) + SIZEOF(.text));
+
+    /* constructor pointers */
+    .ctors : {
+        /* ctor count */
+        LONG(SIZEOF(.ctors) / 4 - 2)
+        /* ctor pointers */
+        KEEP(*(SORT(.ctors)))
+        KEEP(*(SORT(.init_array)))
+        /* end of list */
+        LONG(0)
+    } > LRAM
+    PROVIDE(_ctor_start = LOADADDR(.ctors));
+    PROVIDE(_ctor_end = LOADADDR(.ctors) + SIZEOF(.ctors));
+
+    /* destructor pointers */
+    .dtors : {
+        /* dtor count */
+        LONG(SIZEOF(.dtors) / 4 - 2)
+        /* dtor pointers */
+        KEEP(*(SORT(.dtors)))
+        /* end of list */
+        LONG(0)
+    } > LRAM
+    PROVIDE(_dtor_start = LOADADDR(.dtors));
+    PROVIDE(_dtor_end = LOADADDR(.dtors) + SIZEOF(.dtors));
+
+    /* read-only data */
+    . = ALIGN(4);
+    .rodata : {
+        *(.rodata*)
+    } > LRAM
+    PROVIDE(_rodata_start = LOADADDR(.rodata));
+    PROVIDE(_rodata_end = LOADADDR(.rodata) + SIZEOF(.rodata));
+
+    /* initialized data */
+    . = ALIGN(4);
+    .data : {
+        *(.data)
+    } > LRAM
+    PROVIDE(_data_start = LOADADDR(.data));
+    PROVIDE(_data_end = LOADADDR(.data) + SIZEOF(.data));
+
+    /* pic offset tables */
+    . = ALIGN(4);
+    .got : {
+        *(.got)
+        *(.got.plt) *(.igot.plt) *(.got) *(.igot)
+    } > LRAM
+    PROVIDE(_got_start = LOADADDR(.got));
+    PROVIDE(_got_end = LOADADDR(.got) + SIZEOF(.got));
+
+    /* uninitialized data */
+    .bss (NOLOAD) : {
+        . = ALIGN(4);
+        __bss_start = .;
+        *(.bss)
+    } > IRAM
+    . = ALIGN(4);
+    __bss_end = .;
+    PROVIDE(_bss_start = __bss_start);
+    PROVIDE(_bss_end = __bss_end);
+
+    /* end of image */
+    . = ALIGN(4);
+    _end = .;
+    PROVIDE(end = .);
+}
diff --git a/src/target/firmware/board/mediatek/start.ram.S b/src/target/firmware/board/mediatek/start.ram.S
new file mode 100644
index 00000000..c8f242c0
--- /dev/null
+++ b/src/target/firmware/board/mediatek/start.ram.S
@@ -0,0 +1,26 @@
+
+.section .text.start
+
+#include "macros.S"
+		
+.globl _start
+_start:
+	/* clear bss section */
+	clear_bss
+
+	/* initialize all stacks */
+	init_stacks
+
+	/* call constructors */
+	call_ctors
+
+	/* jump to main */
+	ldr	pc, _jump_main
+
+	/* endless loop at end of program */
+_loop:
+	b	_loop
+	b	_start
+
+_jump_main:
+	.word main
diff --git a/src/target/firmware/board/mediatek/uart.c b/src/target/firmware/board/mediatek/uart.c
new file mode 100644
index 00000000..f9e3283b
--- /dev/null
+++ b/src/target/firmware/board/mediatek/uart.c
@@ -0,0 +1,426 @@
+/* MediaTek MT62xx internal UART Driver
+ *
+ * based on the Calypso driver, so there might be some cruft from it left...
+ *
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Ingo Albrecht <prom@berlin.ccc.de>
+ * (C) 2010 by Steve Markgraf <steve@steve-m.de>
+ * (C) 2011 by Wolfram Sang <wolfram@the-dreams.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <debug.h>
+#include <memory.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include <defines.h>
+#include <uart.h>
+#include <console.h>
+
+#include <comm/sercomm.h>
+
+/* MT622x */
+#if 0
+#define BASE_ADDR_UART1	0x80130000
+#define BASE_ADDR_UART2	0x80180000
+#define BASE_ADDR_UART3	0x801b0000
+#endif
+
+/* MT 6235 */
+#define BASE_ADDR_UART1	0x81030000
+
+//TODO make UART2 and 3 work
+#define UART_REG(n,m)	(BASE_ADDR_UART1 + (m))
+
+#define LCR7BIT		0x80
+#define LCRBFBIT	0x40
+#define MCR6BIT		0x20
+#define REG_OFFS(m)	((m) & ~(LCR7BIT|LCRBFBIT|MCR6BIT))
+/* read access LCR[7] = 0 */
+enum uart_reg {
+	RBR		= 0x00,
+	IER		= 0x04,
+	IIR		= 0x08,
+	LCR		= 0x0c,
+	MCR		= 0x10,
+	LSR		= 0x14,
+	MSR		= 0x18,
+	SCR		= 0x1c,
+	AUTOBAUD_EN	= 0x20,
+	HIGHSPEED	= 0x24,
+	SAMPLE_COUNT	= 0x28,
+	SAMPLE_POINT	= 0x2c,
+	AUTOBAUD_REG	= 0x30,
+	RATE_FIX_REG	= 0x34, /* undocumented */
+	AUTOBAUDSAMPLE	= 0x38,
+	GUARD		= 0x3c,
+	ESCAPE_DAT	= 0x40,
+	ESCAPE_EN	= 0x44,
+	SLEEP_EN	= 0x48,
+	VFIFO_EN	= 0x4c,
+/* read access LCR[7] = 1 */
+	DLL	= RBR,
+	DLH	= IER,
+/* read/write access LCR[7:0] = 0xbf */
+	EFR	= IIR | LCRBFBIT,
+	XON1	= MCR | LCRBFBIT,
+	XON2	= LSR | LCRBFBIT,
+	XOFF1	= MSR | LCRBFBIT,
+	XOFF2 	= SCR | LCRBFBIT,
+};
+
+enum fcr_bits {
+	FIFO_EN		= (1 << 0),
+	RX_FIFO_CLEAR	= (1 << 1),
+	TX_FIFO_CLEAR	= (1 << 2),
+	DMA_MODE	= (1 << 3),
+};
+#define TX_FIFO_TRIG_SHIFT	4
+#define RX_FIFO_TRIG_SHIFT	6
+
+enum iir_bits {
+	IIR_INT_PENDING			= 0x01,
+	IIR_INT_TYPE			= 0x3E,
+	IIR_INT_TYPE_RX_STATUS_ERROR 	= 0x06,
+	IIR_INT_TYPE_RX_TIMEOUT		= 0x0C,
+	IIR_INT_TYPE_RBR		= 0x04,
+	IIR_INT_TYPE_THR		= 0x02,
+	IIR_INT_TYPE_MSR		= 0x00,
+	IIR_INT_TYPE_XOFF		= 0x10,
+	IIR_INT_TYPE_FLOW		= 0x20,
+	IIR_FCR0_MIRROR			= 0xC0,
+};
+
+
+/* enable or disable the divisor latch for access to DLL, DLH */
+static void uart_set_lcr7bit(int uart, int on)
+{
+	uint8_t reg;
+
+	reg = readb(UART_REG(uart, LCR));
+	if (on)
+		reg |= (1 << 7);
+	else
+		reg &= ~(1 << 7);
+	writeb(reg, UART_REG(uart, LCR));
+}
+
+static uint8_t old_lcr;
+static void uart_set_lcr_bf(int uart, int on)
+{
+	if (on) {
+		old_lcr = readb(UART_REG(uart, LCR));
+		writeb(0xBF, UART_REG(uart, LCR));
+	} else {
+		writeb(old_lcr, UART_REG(uart, LCR));
+	}
+}
+
+/* Enable or disable the TCR_TLR latch bit in MCR[6] */
+static void uart_set_mcr6bit(int uart, int on)
+{
+	uint8_t mcr;
+	/* we assume EFR[4] is always set to 1 */
+	mcr = readb(UART_REG(uart, MCR));
+	if (on)
+		mcr |= (1 << 6);
+	else
+		mcr &= ~(1 << 6);
+	writeb(mcr, UART_REG(uart, MCR));
+}
+
+static void uart_reg_write(int uart, enum uart_reg reg, uint8_t val)
+{
+	if (reg & LCRBFBIT)
+		uart_set_lcr_bf(uart, 1);
+	else if (reg & LCR7BIT)
+		uart_set_lcr7bit(uart, 1);
+	else if (reg & MCR6BIT)
+		uart_set_mcr6bit(uart, 1);
+
+	writeb(val, UART_REG(uart, REG_OFFS(reg)));
+
+	if (reg & LCRBFBIT)
+		uart_set_lcr_bf(uart, 0);
+	else if (reg & LCR7BIT)
+		uart_set_lcr7bit(uart, 0);
+	else if (reg & MCR6BIT)
+		uart_set_mcr6bit(uart, 0);
+}
+
+/* read from a UART register, applying any required latch bits */
+static uint8_t uart_reg_read(int uart, enum uart_reg reg)
+{
+	uint8_t ret;
+
+	if (reg & LCRBFBIT)
+		uart_set_lcr_bf(uart, 1);
+	else if (reg & LCR7BIT)
+		uart_set_lcr7bit(uart, 1);
+	else if (reg & MCR6BIT)
+		uart_set_mcr6bit(uart, 1);
+
+	ret = readb(UART_REG(uart, REG_OFFS(reg)));
+
+	if (reg & LCRBFBIT)
+		uart_set_lcr_bf(uart, 0);
+	else if (reg & LCR7BIT)
+		uart_set_lcr7bit(uart, 0);
+	else if (reg & MCR6BIT)
+		uart_set_mcr6bit(uart, 0);
+
+	return ret;
+}
+
+static void uart_irq_handler_cons(__unused int irqnr)
+{
+	const uint8_t uart = cons_get_uart();
+	uint8_t iir;
+
+	//uart_putchar_nb(uart, 'U');
+
+	iir = uart_reg_read(uart, IIR);
+	if (iir & IIR_INT_PENDING)
+		return;
+
+	switch (iir & IIR_INT_TYPE) {
+	case IIR_INT_TYPE_RBR:
+		break;
+	case IIR_INT_TYPE_THR:
+		if (cons_rb_flush() == 1) {
+			/* everything was flushed, disable RBR IRQ */
+			uint8_t ier = uart_reg_read(uart, IER);
+			ier &= ~(1 << 1);
+			uart_reg_write(uart, IER, ier);
+		}
+		break;
+	case IIR_INT_TYPE_MSR:
+		break;
+	case IIR_INT_TYPE_RX_STATUS_ERROR:
+		break;
+	case IIR_INT_TYPE_RX_TIMEOUT:
+		break;
+	case IIR_INT_TYPE_XOFF:
+		break;
+	}
+}
+
+static void uart_irq_handler_sercomm(__unused int irqnr)
+{
+	const uint8_t uart = sercomm_get_uart();
+	uint8_t iir, ch;
+
+	//uart_putchar_nb(uart, 'U');
+
+	iir = uart_reg_read(uart, IIR);
+	if (iir & IIR_INT_PENDING)
+		return;
+
+	switch (iir & IIR_INT_TYPE) {
+	case IIR_INT_TYPE_RX_TIMEOUT:
+	case IIR_INT_TYPE_RBR:
+		/* as long as we have rx data available */
+		while (uart_getchar_nb(uart, &ch)) {
+			if (sercomm_drv_rx_char(ch) < 0) {
+				/* sercomm cannot receive more data right now */
+				uart_irq_enable(uart, UART_IRQ_RX_CHAR, 0);
+			}
+		}
+		break;
+	case IIR_INT_TYPE_THR:
+		/* as long as we have space in the FIFO */
+		while (!uart_tx_busy(uart)) {
+			/* get a byte from sercomm */
+			if (!sercomm_drv_pull(&ch)) {
+				/* no more bytes in sercomm, stop TX interrupts */
+				uart_irq_enable(uart, UART_IRQ_TX_EMPTY, 0);
+				break;
+			}
+			/* write the byte into the TX FIFO */
+			uart_putchar_nb(uart, ch);
+		}
+		break;
+	case IIR_INT_TYPE_MSR:
+		printf("UART IRQ MSR\n");
+		break;
+	case IIR_INT_TYPE_RX_STATUS_ERROR:
+		printf("UART IRQ RX_SE\n");
+		break;
+	case IIR_INT_TYPE_XOFF:
+		printf("UART IRQXOFF\n");
+		break;
+	}
+}
+
+void uart_init(uint8_t uart, __unused uint8_t interrupts)
+{
+	/* no interrupts, only polling so far */
+
+	uart_reg_write(uart, IER, 0x00);
+	if (uart == cons_get_uart()) {
+		cons_init();
+	} else if (uart == sercomm_get_uart()) {
+		sercomm_init();
+		uart_irq_enable(uart, UART_IRQ_RX_CHAR, 1);
+	} else {
+		return;
+	}
+
+	uart_reg_write(uart, AUTOBAUD_EN, 0x00); /* disable AUTOBAUD */
+	uart_reg_write(uart,   EFR, 0x10); /* Enhanced Features Register */
+
+	/* no XON/XOFF flow control, ENHANCED_EN, no auto-RTS/CTS */
+	uart_reg_write(uart, EFR, (1 << 4));
+	/* enable Tx/Rx FIFO, Tx trigger at 56 spaces, Rx trigger at 60 chars */
+	//FIXME check those FIFO settings
+	uart_reg_write(uart, IIR, FIFO_EN | RX_FIFO_CLEAR | TX_FIFO_CLEAR |
+			(3 << TX_FIFO_TRIG_SHIFT) | (1 << RX_FIFO_TRIG_SHIFT));
+
+	/* RBR interrupt only when TX FIFO and TX shift register are empty */
+	uart_reg_write(uart, SCR, (1 << 0));// | (1 << 3));
+
+	/* 8 bit, 1 stop bit, no parity, no break */
+	uart_reg_write(uart, LCR, 0x03);
+
+	uart_set_lcr7bit(uart, 0);
+}
+
+void uart_poll(uint8_t uart) {
+	if(uart == cons_get_uart()) {
+		uart_irq_handler_cons(0);
+	} else {
+		uart_irq_handler_sercomm(0);
+	}
+}
+
+void uart_irq_enable(uint8_t uart, enum uart_irq irq, int on)
+{
+	uint8_t ier = uart_reg_read(uart, IER);
+	uint8_t mask = 0;
+
+	switch (irq) {
+	case UART_IRQ_TX_EMPTY:
+		mask = (1 << 1);
+		break;
+	case UART_IRQ_RX_CHAR:
+		mask = (1 << 0);
+		break;
+	}
+
+	if (on)
+		ier |= mask;
+	else
+		ier &= ~mask;
+
+	uart_reg_write(uart, IER, ier);
+}
+
+
+void uart_putchar_wait(uint8_t uart, int c)
+{
+	/* wait while TX FIFO indicates full */
+	while (~readb(UART_REG(uart, LSR)) & 0x20) { }
+
+	/* put character in TX FIFO */
+	writeb(c, UART_REG(uart, RBR));
+}
+
+int uart_putchar_nb(uint8_t uart, int c)
+{
+	/* if TX FIFO indicates full, abort */
+	if (~readb(UART_REG(uart, LSR)) & 0x20)
+		return 0;
+
+	writeb(c, UART_REG(uart, RBR));
+	return 1;
+}
+
+int uart_getchar_nb(uint8_t uart, uint8_t *ch)
+{
+	uint8_t lsr;
+
+	lsr = readb(UART_REG(uart, LSR));
+
+	/* something strange happened */
+	if (lsr & 0x02)
+		printf("LSR RX_OE\n");
+	if (lsr & 0x04)
+		printf("LSR RX_PE\n");
+	if (lsr & 0x08)
+		printf("LSR RX_FE\n");
+	if (lsr & 0x10)
+		printf("LSR RX_BI\n");
+	if (lsr & 0x80)
+		printf("LSR RX_FIFO_STS\n");
+
+	/* is the Rx FIFO empty? */
+	if (!(lsr & 0x01))
+		return 0;
+
+	*ch = readb(UART_REG(uart, RBR));
+	//printf("getchar_nb(%u) = %02x\n", uart, *ch);
+	return 1;
+}
+
+int uart_tx_busy(uint8_t uart)
+{
+	/* Check THRE bit (LSR[5]) to see if FIFO is full */
+	if (~readb(UART_REG(uart, LSR)) & 0x20)
+		return 1;
+	return 0;
+}
+
+#if 0
+/* 26MHz clock input (used when no PLL initialized directly after poweron) */
+static const uint16_t divider[] = {
+	[UART_38400]	= 42,
+	[UART_57600]	= 28,
+	[UART_115200]	= 14,
+	[UART_230400]	= 7,
+	[UART_460800]	= 14,	/* would need UART_REG(HIGHSPEED) = 1 or 2 */
+	[UART_921600]	= 7,	/* would need UART_REG(HIGHSPEED) = 2 */
+};
+#endif
+
+/* 52MHz clock input (after PLL init) */
+static const uint16_t divider[] = {
+	[UART_38400]	= 85,
+	[UART_57600]	= 56,
+	[UART_115200]	= 28,
+	[UART_230400]	= 14,
+	[UART_460800]	= 7,
+	[UART_921600]	= 7,	/* would need UART_REG(HIGHSPEED) = 1 */
+};
+
+int uart_baudrate(uint8_t uart, enum uart_baudrate bdrt)
+{
+	uint16_t div;
+
+	if (bdrt > ARRAY_SIZE(divider))
+		return -1;
+
+	div = divider[bdrt];
+	uart_set_lcr7bit(uart, 1);
+	writeb(div & 0xff, UART_REG(uart, DLL));
+	writeb(div >> 8, UART_REG(uart, DLH));
+	uart_set_lcr7bit(uart, 0);
+
+	return 0;
+}
diff --git a/src/target/firmware/board/mt62xx/init.c b/src/target/firmware/board/mt62xx/init.c
new file mode 100644
index 00000000..dae38cf4
--- /dev/null
+++ b/src/target/firmware/board/mt62xx/init.c
@@ -0,0 +1,141 @@
+/* Initialization for the MT62xx Basebands */
+
+/* (C) 2010 by Steve Markgraf <steve@steve-m.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <ctors.h>
+#include <memory.h>
+#include <board.h>
+#include <keypad.h>
+#include <uart.h>
+#include <console.h>
+#include <delay.h>
+
+#include <flash/cfi_flash.h>
+
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+
+#include <mtk/emi.h>
+#include <mtk/mt6235.h>
+#include <mtk/system.h>
+
+void pll_init(void)
+{
+	/* Power on PLL */
+	writew(0, MTK_PLL_PDN_CON);
+	writew(PLL_CLKSQ_DIV2_DSP | PLL_CLKSQ_DIV2_MCU, MTK_PLL_CLK_CON);
+
+	writew(PLL_RST, MTK_PLL_PLL);
+	writew(0, MTK_PLL_PLL);
+	delay_ms(1);
+
+	/* Turn on PLL for MCU, DSP and USB */
+	writew(PLL_MPLLSEL_PLL | PLL_DPLLSEL | PLL_UPLLSEL, MTK_PLL_PLL);
+
+	/*
+	 * Setup MCU clock register:
+	 * ARMCLK = 208MHz, AHBx4CLK = 52MHz, AHBx8CLK = 104MHz
+	 * we have to write to the read-only part (EMICLK) as well, otherwise
+	 * the EMI won't work! (datasheet lies)
+	 */
+	writew(7 << MCUCLK_CON_AHBX8CLK_SHIFT |
+	       3 << MCUCLK_CON_AHBX4CLK_SHIFT |
+	       15 << MCUCLK_CON_ARMCLK_SHIFT |
+	       7 << MCUCLK_CON_EMICLK_SHIFT,
+	       MTK_CONFG_MCUCLK_CON);
+}
+
+void memory_init(void)
+{
+	int i;
+
+	/* Initialization for Hynix RAM */
+
+	/* Configure DRAM controller */
+	writel(0x0001000e, MTK_EMI_GEND);
+	writel(0x00088a0a, MTK_EMI_GENA);
+	writel(0x00000280, MTK_EMI_GENB);
+	writel(0x52945294, MTK_EMI_GENC);
+	writel(0x1c016605, MTK_EMI_CONL);
+	writel(0x00002828, MTK_EMI_CONM);
+	writel(0x02334000, MTK_EMI_CONI);
+	writel(0x16c12212, MTK_EMI_CONJ);
+	writel(0x032d0000, MTK_EMI_CONK);
+
+	for (i = 0; i < 5; ++i) {
+		/* Setup five single bits, one by one for DRAM init */
+		writel((1 << (24 + i)) | (0x400013), MTK_EMI_CONN);
+		delay_ms(1);
+		writel(0x400013, MTK_EMI_CONN);
+		delay_ms(1);
+	}
+
+#if 0
+	/* Initialization for Toshiba RAM */
+
+	/* Configure DRAM controller */
+	writel(0x0001000E, MTK_EMI_GEND);
+	writel(0x00088E3A, MTK_EMI_GENA);
+	writel(0x000000C0, MTK_EMI_GENB);
+	writel(0x18C618C6, MTK_EMI_GENC);
+	writel(0x18007505, MTK_EMI_CONL);
+	writel(0x00002828, MTK_EMI_CONM);
+	writel(0x00332000, MTK_EMI_CONI);
+	writel(0x3CD24431, MTK_EMI_CONJ);
+	writel(0x02000000, MTK_EMI_CONK);
+
+	for (i = 0; i < 5; ++i) {
+		/* Setup five single bits, one by one for DRAM init */
+		writel((1 << (24 + i)) | (0x500013), MTK_EMI_CONN);
+		delay_ms(1);
+		writel(0x500013, MTK_EMI_CONN);
+		delay_ms(1);
+	}
+
+#endif
+}
+
+void board_init(int with_irq)
+{
+	/* powerup the baseband */
+	writew(POWERKEY1_MAGIC, MTK_RTC_POWERKEY1);
+	writew(POWERKEY2_MAGIC, MTK_RTC_POWERKEY2);
+	writew(BBPU_MAGIC | RTC_BBPU_WRITE_EN |
+	       RTC_BBPU_BBPU | RTC_BBPU_AUTO,
+	       MTK_RTC_BBPU);
+	writew(1, MTK_RTC_WRTGR);
+
+	/* disable watchdog timer */
+	writew(WDT_MODE_KEY, MTK_RGU_WDT_MODE);
+
+	pll_init();
+	memory_init();
+
+	/* Initialize UART */
+	sercomm_bind_uart(UART_MODEM);
+	cons_bind_uart(UART_IRDA);
+	uart_init(UART_MODEM, with_irq);
+	uart_baudrate(UART_MODEM, UART_115200);
+}
diff --git a/src/target/firmware/board/pirelli_dpl10/init.c b/src/target/firmware/board/pirelli_dpl10/init.c
new file mode 100644
index 00000000..4c74a6d3
--- /dev/null
+++ b/src/target/firmware/board/pirelli_dpl10/init.c
@@ -0,0 +1,159 @@
+/* Initialization for the Pirelli DP-L10 */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2011-12 by Steve Markgraf <steve@steve-m.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <ctors.h>
+#include <memory.h>
+#include <board.h>
+#include <keypad.h>
+#include <console.h>
+#include <flash/cfi_flash.h>
+
+#include <calypso/irq.h>
+#include <calypso/clock.h>
+#include <calypso/dma.h>
+#include <calypso/rtc.h>
+#include <calypso/timer.h>
+#include <uart.h>
+#include <calypso/backlight.h>
+
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+
+#include <fb/framebuffer.h>
+#include "keymap.h"
+
+#define ARMIO_LATCH_OUT 0xfffe4802
+#define IO_CNTL_REG	0xfffe4804
+#define ARM_CONF_REG	0xfffef006
+#define ASIC_CONF_REG	0xfffef008
+#define IO_CONF_REG	0xfffef00a
+
+static void board_io_init(void)
+{
+	uint16_t reg;
+
+	reg = readw(ASIC_CONF_REG);
+	/* Set function pins to I2C Mode */
+	reg |= ((1 << 12) | (1 << 7));		/* SCL / SDA */
+	/* TWL3025: Set SPI+RIF RX clock to rising edge */
+	reg |= (1 << 13) | (1 << 14);
+	reg &= ~(1 << 1);
+	writew(reg, ASIC_CONF_REG);
+
+	/* enable IO functionality */
+	reg = readw(IO_CONF_REG);
+	reg |= (1 << 9) | (1 << 4) | (1 << 3) | (1 << 2) | (1 << 1) | (1 << 0);
+	writew(reg, IO_CONF_REG);
+
+	/* set IO directions */
+	reg = readw(IO_CNTL_REG);
+	reg &= ~((1 << 7) | (1 << 4) | (1 << 1));
+	writew(reg, IO_CNTL_REG);
+
+	/* reset display controller, disable bypass mode, set nCS4 to display */
+	reg = readw(ARMIO_LATCH_OUT);
+	reg &= ~(1 << 4);
+	writew(reg, ARMIO_LATCH_OUT);
+	reg &= ~(1 << 7);
+	reg |= (1 << 4) | (1 << 1);
+	writew(reg, ARMIO_LATCH_OUT);
+
+	/* configure ADD(22), needed for second half of flash */
+	reg = readw(ARM_CONF_REG);
+	reg |= (1 << 3);
+	writew(reg, ARM_CONF_REG);
+}
+
+void board_init(int with_irq)
+{
+	/* Configure the memory interface */
+	calypso_mem_cfg(CALYPSO_nCS0, 4, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS1, 4, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS2, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS3, 4, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_CS4, 7, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS6, 0, CALYPSO_MEM_32bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS7, 0, CALYPSO_MEM_32bit, 0);
+
+	/* Set VTCXO_DIV2 = 1, configure PLL for 104 MHz and give ARM half of that */
+	calypso_clock_set(2, CALYPSO_PLL13_104_MHZ, ARM_MCLK_DIV_2);
+
+	/* Configure the RHEA bridge with some sane default values */
+	calypso_rhea_cfg(0, 0, 0xff, 0, 1, 0, 0);
+
+	/* Initialize board-specific GPIO */
+	board_io_init();
+
+	/* Enable bootrom mapping to route exception vectors to RAM */
+	calypso_bootrom(with_irq);
+	calypso_exceptions_install();
+
+	/* Initialize interrupt controller */
+	if (with_irq)
+		irq_init();
+
+	sercomm_bind_uart(UART_IRDA);
+	cons_bind_uart(UART_MODEM);
+
+	/* initialize IRDA UART to be used for sercomm */
+	uart_init(UART_IRDA, with_irq);
+	uart_baudrate(UART_IRDA, UART_115200);
+
+	/* Initialize MODEM UART to be used for old-school console code. */
+	uart_init(UART_MODEM, with_irq);
+	uart_baudrate(UART_MODEM, UART_115200);
+
+	/* Initialize hardware timers */
+	hwtimer_init();
+
+	/* Initialize DMA controller */
+	dma_init();
+
+	/* Initialize real time clock */
+	rtc_init();
+
+	/* Initialize system timers (uses hwtimer 2) */
+	timer_init();
+
+	/* Initialize LCD driver and backlight (0 is max, 255 min brightness) */
+	bl_mode_pwl(1);
+	bl_level(50);
+
+	fb_init();
+
+	/* Initialize keypad driver */
+	keypad_init(keymap, with_irq);
+
+	/* Initialize ABB driver (uses SPI) */
+	twl3025_init();
+
+	/* enable LEDB driver of Iota for keypad backlight */
+	twl3025_reg_write(AUXLED, 0x02);
+}
diff --git a/src/target/firmware/board/pirelli_dpl10/keymap.h b/src/target/firmware/board/pirelli_dpl10/keymap.h
new file mode 100644
index 00000000..b85621bd
--- /dev/null
+++ b/src/target/firmware/board/pirelli_dpl10/keymap.h
@@ -0,0 +1,28 @@
+/* keymap for the Pirelli DP-L10 */
+
+static const uint8_t keymap[] = {
+	[KEY_0]		= 18,
+	[KEY_1]		= 4,
+	[KEY_2]		= 3,
+	[KEY_3]		= 2,
+	[KEY_4]		= 9,
+	[KEY_5]		= 8,
+	[KEY_6]		= 7,
+	[KEY_7]		= 14,
+	[KEY_8]		= 13,
+	[KEY_9]		= 12,
+	[KEY_STAR]	= 19,
+	[KEY_HASH]	= 17,
+	[KEY_MENU]	= 0,
+	[KEY_LEFT_SB]	= 1,
+	[KEY_RIGHT_SB]	= 6,
+	[KEY_UP]	= 15,
+	[KEY_DOWN]	= 16,
+	[KEY_LEFT]	= 5,
+	[KEY_RIGHT]	= 10,
+	[KEY_OK]	= 11,
+/* power button is not connected, we use the camera button instead */
+	[KEY_POWER]	= 23,
+	[KEY_MINUS]	= 22,
+	[KEY_PLUS]	= 21,
+};
diff --git a/src/target/firmware/board/pirelli_dpl10/rf_power.c b/src/target/firmware/board/pirelli_dpl10/rf_power.c
new file mode 100644
index 00000000..9b89847d
--- /dev/null
+++ b/src/target/firmware/board/pirelli_dpl10/rf_power.c
@@ -0,0 +1,63 @@
+/* Tx RF power calibration for the Pirelli DP-L10 */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <osmocom/core/utils.h>
+
+/* GSM900 ARFCN 33, Measurements by Steve Markgraf / May 2010 */
+/* FIXME those are from the Compal phones, do measurements with the DP-L10 */
+const int16_t dbm2apc_gsm900[] = {
+	[0]     = 151,
+	[1]     = 152,
+	[2]     = 153,
+	[3]     = 155,
+	[4]     = 156,
+	[5]     = 158,
+	[6]     = 160,
+	[7]     = 162,
+	[8]     = 164,
+	[9]     = 167,
+	[10]    = 170,
+	[11]    = 173,
+	[12]    = 177,
+	[13]    = 182,
+	[14]    = 187,
+	[15]    = 192,
+	[16]    = 199,
+	[17]    = 206,
+	[18]    = 214,
+	[19]    = 223,
+	[20]    = 233,
+	[21]    = 244,
+	[22]    = 260,
+	[23]    = 271,
+	[24]    = 288,
+	[25]    = 307,
+	[26]    = 327,
+	[27]    = 350,
+	[28]    = 376,
+	[29]    = 407,
+	[30]    = 456,
+	[31]    = 575,
+};
+
+const int dbm2apc_gsm900_max = ARRAY_SIZE(dbm2apc_gsm900) - 1;
diff --git a/src/target/firmware/board/pirelli_dpl10/rffe_dpl10_triband.c b/src/target/firmware/board/pirelli_dpl10/rffe_dpl10_triband.c
new file mode 100644
index 00000000..b3ec0d4b
--- /dev/null
+++ b/src/target/firmware/board/pirelli_dpl10/rffe_dpl10_triband.c
@@ -0,0 +1,142 @@
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <rffe.h>
+#include <calypso/tsp.h>
+#include <rf/trf6151.h>
+
+/* This is a value that has been measured on the C123 by Harald: 71dBm,
+   it is the difference between the input level at the antenna and what
+   the DSP reports, subtracted by the total gain of the TRF6151 */
+#define SYSTEM_INHERENT_GAIN	71
+
+/* describe how the RF frontend is wired on the Pirelli DP-L10 */
+
+#define		RITA_RESET	TSPACT(5)	/* Reset of the Rita TRF6151 */
+#define		PA_ENABLE	TSPACT(0)	/* Enable the Power Amplifier */
+#define		GSM_TXEN	TSPACT(3)	/* PA GSM switch, low-active,
+						 * 1 for DCS1800/PCS1900 TX */
+
+/* All VCn controls are high-active */
+#define		ASM_VC1		TSPACT(4)	/* VC1 PCS1900 RX */
+#define		ASM_VC2		TSPACT(10)	/* VC2 DCS1800/PCS1900 TX */
+#define		ASM_VC3		TSPACT(11)	/* VC3 GSM900 TX */
+
+#define		IOTA_STROBE	TSPEN(0)	/* Strobe for the Iota TSP */
+#define		RITA_STROBE	TSPEN(1)	/* Strobe for the Rita TSP */
+
+/* switch RF Frontend Mode */
+void rffe_mode(enum gsm_band band, int tx)
+{
+	uint16_t tspact = tsp_act_state();
+
+	/* First we mask off all bits from the state cache */
+	tspact &= ~(PA_ENABLE| GSM_TXEN);
+	tspact &= ~(ASM_VC1 | ASM_VC2 | ASM_VC3);
+
+	switch (band) {
+	case GSM_BAND_850:
+	case GSM_BAND_900:
+	case GSM_BAND_1800:
+		break;
+	case GSM_BAND_1900:
+		tspact |= ASM_VC1;
+		break;
+	default:
+		/* TODO return/signal error here */
+		break;
+	}
+
+#ifdef CONFIG_TX_ENABLE
+	/* Then we selectively set the bits on, if required */
+	if (tx) {
+		switch (band) {
+		case GSM_BAND_850:
+		case GSM_BAND_900:
+			tspact |= ASM_VC3;
+			break;
+		case GSM_BAND_1800:
+		case GSM_BAND_1900:
+			tspact |= GSM_TXEN;
+			tspact |= ASM_VC2;
+			break;
+		default:
+			break;
+		}
+		tspact |= PA_ENABLE;
+	}
+#endif /* TRANSMIT_SUPPORT */
+
+	tsp_act_update(tspact);
+}
+
+/* Returns RF wiring */
+uint32_t rffe_get_rx_ports(void)
+{
+	return (1 << PORT_LO) | (1 << PORT_DCS1800) | (1 << PORT_PCS1900);
+}
+
+uint32_t rffe_get_tx_ports(void)
+{
+	return (1 << PORT_LO) | (1 << PORT_HI);
+}
+
+/* Returns need for IQ swap */
+int rffe_iq_swapped(uint16_t band_arfcn, int tx)
+{
+	return trf6151_iq_swapped(band_arfcn, tx);
+}
+
+
+#define MCU_SW_TRACE	0xfffef00e
+#define ARM_CONF_REG	0xfffef006
+#define ASIC_CONF_REG	0xfffef008
+
+void rffe_init(void)
+{
+	uint16_t reg;
+
+	reg = readw(ARM_CONF_REG);
+	reg &= ~ (1 << 7);	/* TSPACT4 I/O function, not nRDYMEM */
+	writew(reg, ARM_CONF_REG);
+
+	reg = readw(ASIC_CONF_REG);
+	reg &= ~ (1 << 15);	/* TSPACT5 I/O function, not DPLLCLK */
+	writew(reg, ASIC_CONF_REG);
+
+	reg = readw(MCU_SW_TRACE);
+	reg &= ~(1 << 3);	/* TSPACT10 I/O function, not nWAIT(1) */
+	reg &= ~(1 << 2);	/* TSPACT11 I/O function, not MCLK(1) */
+	writew(reg, MCU_SW_TRACE);
+
+	/* Configure the TSPEN which is connected to the TWL3025 */
+	tsp_setup(IOTA_STROBE, 1, 0, 0);
+
+	trf6151_init(RITA_STROBE, RITA_RESET);
+}
+
+uint8_t rffe_get_gain(void)
+{
+	return trf6151_get_gain();
+}
+
+void rffe_set_gain(uint8_t dbm)
+{
+	trf6151_set_gain(dbm);
+}
+
+const uint8_t system_inherent_gain = SYSTEM_INHERENT_GAIN;
+
+/* Given the expected input level of exp_inp dBm/8 and the target of target_bb
+ * dBm8, configure the RF Frontend with the respective gain */
+void rffe_compute_gain(int16_t exp_inp, int16_t target_bb)
+{
+	trf6151_compute_gain(exp_inp, target_bb);
+}
+
+void rffe_rx_win_ctrl(int16_t exp_inp, int16_t target_bb)
+{
+	/* FIXME */
+}
diff --git a/src/target/firmware/board/se_j100/init.c b/src/target/firmware/board/se_j100/init.c
new file mode 100644
index 00000000..0ae477a4
--- /dev/null
+++ b/src/target/firmware/board/se_j100/init.c
@@ -0,0 +1,146 @@
+/* Initialization for the Sony Ericsson J100 */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010-11 by Steve Markgraf <steve@steve-m.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <ctors.h>
+#include <memory.h>
+#include <board.h>
+#include <keypad.h>
+#include <console.h>
+#include <flash/cfi_flash.h>
+
+#include <calypso/irq.h>
+#include <calypso/clock.h>
+#include <calypso/dma.h>
+#include <calypso/rtc.h>
+#include <calypso/timer.h>
+#include <uart.h>
+#include <calypso/backlight.h>
+
+#include <comm/sercomm.h>
+#include <comm/timer.h>
+
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+
+#include <fb/framebuffer.h>
+#include "../compal/keymap.h"
+
+#define ARMIO_LATCH_OUT 0xfffe4802
+#define IO_CNTL_REG	0xfffe4804
+#define ASIC_CONF_REG	0xfffef008
+
+static void board_io_init(void)
+{
+	uint16_t reg;
+
+	reg = readw(ASIC_CONF_REG);
+	/* LCD Set I/O(3) / SA0 to I/O(3) mode */
+	reg &= ~( (1 << 12) | (1 << 10) | (1 << 7) | (1 << 1)) ;
+	/* don't set function pins to I2C Mode, J100 uses UWire */
+	/* TWL3025: Set SPI+RIF RX clock to rising edge */
+	reg |= (1 << 13) | (1 << 14);
+	writew(reg, ASIC_CONF_REG);
+
+	/* LCD Set I/O(3) to output mode and enable C155 backlight (IO1) */
+	/* FIXME: Put the display backlight control to backlight.c */
+	reg = readw(IO_CNTL_REG);
+	reg &= ~( (1 << 3) | (1 << 1));
+	writew(reg, IO_CNTL_REG);
+
+	/* LCD Set I/O(3) output low */
+	reg = readw(ARMIO_LATCH_OUT);
+	reg &= ~(1 << 3);
+	reg |= (1 << 1);
+	writew(reg, ARMIO_LATCH_OUT);
+}
+
+void board_init(int with_irq)
+{
+	/* Disable watchdog (compal loader leaves it enabled) */
+	wdog_enable(0);
+
+	/* Configure memory interface */
+	calypso_mem_cfg(CALYPSO_nCS0, 3, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS1, 3, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS2, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS3, 5, CALYPSO_MEM_16bit, 1);
+	calypso_mem_cfg(CALYPSO_CS4, 0, CALYPSO_MEM_8bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS6, 0, CALYPSO_MEM_32bit, 1);
+	calypso_mem_cfg(CALYPSO_nCS7, 0, CALYPSO_MEM_32bit, 0);
+
+	/* Set VTCXO_DIV2 = 1, configure PLL for 104 MHz and give ARM half of that */
+	calypso_clock_set(2, CALYPSO_PLL13_104_MHZ, ARM_MCLK_DIV_2);
+
+	/* Configure the RHEA bridge with some sane default values */
+	calypso_rhea_cfg(0, 0, 0xff, 0, 1, 0, 0);
+
+	/* Initialize board-specific GPIO */
+	board_io_init();
+
+	/* Enable bootrom mapping to route exception vectors to RAM */
+	calypso_bootrom(with_irq);
+	calypso_exceptions_install();
+
+	/* Initialize interrupt controller */
+	if (with_irq)
+		irq_init();
+
+	sercomm_bind_uart(UART_MODEM);
+	cons_bind_uart(UART_IRDA);
+
+	/* initialize MODEM UART to be used for sercomm */
+	uart_init(UART_MODEM, with_irq);
+	uart_baudrate(UART_MODEM, UART_115200);
+
+	/* initialize IRDA UART to be used for old-school console code.
+	 * note: IRDA uart only accessible on C115 and C117 PCB */
+	uart_init(UART_IRDA, with_irq);
+	uart_baudrate(UART_IRDA, UART_115200);
+
+	/* Initialize hardware timers */
+	hwtimer_init();
+
+	/* Initialize DMA controller */
+	dma_init();
+
+	/* Initialize real time clock */
+	rtc_init();
+
+	/* Initialize system timers (uses hwtimer 2) */
+	timer_init();
+
+	/* Initialize LCD driver (uses UWire) and backlight */
+	fb_init();
+	bl_mode_pwl(1);
+	bl_level(50);
+
+	/* Initialize keypad driver */
+	keypad_init(keymap, with_irq);
+
+	/* Initialize ABB driver (uses SPI) */
+	twl3025_init();
+}
diff --git a/src/target/firmware/calypso/Makefile b/src/target/firmware/calypso/Makefile
new file mode 100644
index 00000000..9add62b8
--- /dev/null
+++ b/src/target/firmware/calypso/Makefile
@@ -0,0 +1,4 @@
+
+LIBRARIES+=calypso
+LIB_calypso_DIR=calypso
+LIB_calypso_SRCS=arm.c buzzer.c clock.c dma.c dsp.c du.c i2c.c irq.c rtc.c sim.c spi.c tpu.c tsp.c keypad.c misc.c timer.c backlight.c uart.c uwire.c
diff --git a/src/target/firmware/calypso/arm.c b/src/target/firmware/calypso/arm.c
new file mode 100644
index 00000000..8794ee35
--- /dev/null
+++ b/src/target/firmware/calypso/arm.c
@@ -0,0 +1,26 @@
+
+/* enable IRQ+FIQ interrupts */
+void arm_enable_interrupts (void)
+{
+	unsigned long temp;
+	__asm__ __volatile__("mrs %0, cpsr\n"
+			     "bic %0, %0, #0xc0\n"
+			     "msr cpsr_c, %0"
+			     : "=r" (temp)
+			     :
+			     : "memory");
+}
+
+/* disable IRQ/FIQ interrupts
+ * returns true if interrupts had been enabled before we disabled them */
+int arm_disable_interrupts(void)
+{
+	unsigned long old,temp;
+	__asm__ __volatile__("mrs %0, cpsr\n"
+			     "orr %1, %0, #0xc0\n"
+			     "msr cpsr_c, %1"
+			     : "=r" (old), "=r" (temp)
+			     :
+			     : "memory");
+	return (old & 0x80) == 0;
+}
diff --git a/src/target/firmware/calypso/backlight.c b/src/target/firmware/calypso/backlight.c
new file mode 100644
index 00000000..cf29984a
--- /dev/null
+++ b/src/target/firmware/calypso/backlight.c
@@ -0,0 +1,69 @@
+/* Calypso DBB internal PWL (Pulse Width / Light) Driver */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <memory.h>
+
+#define BASE_ADDR_PWL	0xfffe8000
+#define PWL_REG(m)	(BASE_ADDR_PWL + (m))
+
+#define ASIC_CONF_REG		0xfffef008
+#define LIGHT_LEVEL_REG		0xfffe4810
+
+enum pwl_reg {
+	PWL_LEVEL	= 0,
+	PWL_CTRL	= 1,
+};
+
+#define ASCONF_PWL_ENA	(1 << 4)
+
+void bl_mode_pwl(int on)
+{
+	uint16_t reg;
+
+	reg = readw(ASIC_CONF_REG);
+
+	if (on) {
+		/* Enable pwl */
+		writeb(0x01, PWL_REG(PWL_CTRL));
+		/* Switch pin from LT to PWL */
+		reg |= ASCONF_PWL_ENA;
+		writew(reg, ASIC_CONF_REG);
+	} else {
+		/* Switch pin from PWL to LT */
+		reg &= ~ASCONF_PWL_ENA;
+		writew(reg, ASIC_CONF_REG);
+		/* Disable pwl */
+		writeb(0x00, PWL_REG(PWL_CTRL));
+	}
+}
+
+void bl_level(uint8_t level)
+{
+	if (readw(ASIC_CONF_REG) & ASCONF_PWL_ENA) {
+		writeb(level, PWL_REG(PWL_LEVEL));
+	} else {
+		/* we need to scale the light level, as the
+		 * ARMIO light controller only knows 0..63 */
+		writeb(level>>2, LIGHT_LEVEL_REG);
+	}
+}
diff --git a/src/target/firmware/calypso/buzzer.c b/src/target/firmware/calypso/buzzer.c
new file mode 100644
index 00000000..e76906f9
--- /dev/null
+++ b/src/target/firmware/calypso/buzzer.c
@@ -0,0 +1,86 @@
+/* Calypso DBB internal PWT (Pulse Width / T) Buzzer Driver */
+
+/* (C) 2010 by Jose Pereira <onaips@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <memory.h>
+
+#define BASE_ADDR_PWL	0xfffe8800
+#define PWT_REG(m)	(BASE_ADDR_PWL + (m))
+
+#define ASIC_CONF_REG		0xfffef008
+#define BUZZ_LEVEL_REG		0xfffe480e
+
+enum pwt_reg {
+	FRC_REG	= 0,
+	VRC_REG = 1,
+	GCR_REG = 2,
+};
+
+#define ASCONF_PWT_ENA	(1 << 5)
+
+void buzzer_mode_pwt(int on)
+{
+	uint16_t reg;
+
+	reg = readw(ASIC_CONF_REG);
+
+	if (on) {
+		/* Enable pwt */
+		writeb(0x01, PWT_REG(GCR_REG));
+		/* Switch pin from LT to PWL */
+		reg |= ASCONF_PWT_ENA;
+		writew(reg, ASIC_CONF_REG);
+	} else {
+		/* Switch pin from PWT to BU */
+		reg |= ~ASCONF_PWT_ENA;
+		writew(reg, ASIC_CONF_REG);
+		/* Disable pwt */
+		writeb(0x00, PWT_REG(GCR_REG));
+	}
+}
+
+void buzzer_volume(uint8_t level)
+{
+
+	if (readw(ASIC_CONF_REG) & ASCONF_PWT_ENA) {
+
+	  if (level) {
+		//scaling the volume as pwt only knows 0..63
+		level = level >> 1;
+		//if level > 0 buzzer is on
+		level |= 0x01;
+	  }
+
+	  writeb(level,PWT_REG(VRC_REG));
+
+	} else {
+		/* we need to scale the buzz level, as the
+		 * ARMIO buzz controller only knows 0..63 */
+		writeb(level>>2, BUZZ_LEVEL_REG);
+	}
+}
+
+void buzzer_note(uint8_t note)
+{
+  if ( (readw(ASIC_CONF_REG) & ASCONF_PWT_ENA) )
+      writeb(note,PWT_REG(FRC_REG));
+}
diff --git a/src/target/firmware/calypso/clock.c b/src/target/firmware/calypso/clock.c
new file mode 100644
index 00000000..246b6e00
--- /dev/null
+++ b/src/target/firmware/calypso/clock.c
@@ -0,0 +1,200 @@
+/* Driver for Calypso clock management */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+//#define DEBUG
+#include <debug.h>
+
+#include <memory.h>
+#include <calypso/clock.h>
+
+#define REG_DPLL		0xffff9800
+#define DPLL_LOCK		(1 << 0)
+#define DPLL_BREAKLN		(1 << 1)
+#define DPLL_BYPASS_DIV_SHIFT	2		/* 2 bits */
+#define DPLL_PLL_ENABLE		(1 << 4)
+#define DPLL_PLL_DIV_SHIFT	5		/* 2 bits */
+#define DPLL_PLL_MULT_SHIFT	7		/* 5 bits */
+#define DPLL_TEST		(1 << 12)
+#define DPLL_IOB		(1 << 13)	/* Initialize on break */
+#define DPLL_IAI		(1 << 14)	/* Initialize after Idle */
+
+#define BASE_ADDR_CLKM	0xfffffd00
+#define CLKM_REG(m)	(BASE_ADDR_CLKM+(m))
+
+enum clkm_reg {
+	CNTL_ARM_CLK	= 0,
+	CNTL_CLK	= 2,
+	CNTL_RST	= 4,
+	CNTL_ARM_DIV	= 8,
+};
+
+/* CNTL_ARM_CLK */
+#define ARM_CLK_BIG_SLEEP	(1 << 0)	/* MCU Master Clock enabled? */
+#define ARM_CLK_CLKIN_SEL0	(1 << 1)	/* MCU source clock (0 = DPLL output, 1 = VTCXO or CLKIN */
+#define ARM_CLK_CLKIN_SEL	(1 << 2)	/* 0 = VTCXO or 1 = CLKIN */
+#define ARM_CLK_MCLK_DIV5	(1 << 3)	/* enable 1.5 or 2.5 division factor */
+#define ARM_CLK_MCLK_DIV_SHIFT	4		/* 3 bits */
+#define ARM_CLK_DEEP_POWER_SHIFT	8
+#define ARM_CLK_DEEP_SLEEP	12
+
+/* CNTL_CLK */
+#define CLK_IRQ_CLK_DIS		(1 << 0)	/* IRQ clock control (0 always, 1 according ARM_MCLK_EN) */
+#define CLK_BRIDGE_CLK_DIS	(1 << 1)
+#define CLK_TIMER_CLK_DIS	(1 << 2)
+#define CLK_DPLL_DIS		(1 << 3)	/* 0: DPLL is not stopped during SLEEP */
+#define CLK_CLKOUT_EN		(1 << 4)	/* Enable CLKOUT output pins */
+#define CLK_EN_IDLE3_FLG	(1 << 5)	/* DSP idle flag control (1 =
+						 * SAM/HOM register forced to HOM when DSP IDLE3) */
+#define CLK_VCLKOUT_DIV2	(1 << 6)	/* 1: VCLKOUT-FR is divided by 2 */
+#define CLK_VTCXO_DIV2		(1 << 7)	/* 1: VTCXO is dividied by 2 */
+
+#define BASE_ADDR_MEMIF		0xfffffb00
+#define MEMIF_REG(x)		(BASE_ADDR_MEMIF+(x))
+
+enum memif_reg {
+	API_RHEA_CTL	= 0x0e,
+	EXTRA_CONF	= 0x10,
+};
+
+static void dump_reg16(uint32_t addr, char *name)
+{
+	printf("%s=0x%04x\n", name, readw(addr));
+}
+
+void calypso_clk_dump(void)
+{
+	dump_reg16(REG_DPLL, "REG_DPLL");
+	dump_reg16(CLKM_REG(CNTL_ARM_CLK), "CNTL_ARM_CLK");
+	dump_reg16(CLKM_REG(CNTL_CLK), "CNTL_CLK");
+	dump_reg16(CLKM_REG(CNTL_RST), "CNTL_RST");
+	dump_reg16(CLKM_REG(CNTL_ARM_DIV), "CNTL_ARM_DIV");
+}
+
+void calypso_pll_set(uint16_t inp)
+{
+	uint8_t mult = inp >> 8;
+	uint8_t div = inp & 0xff;
+	uint16_t reg = readw(REG_DPLL);
+
+	reg &= ~0x0fe0;
+	reg |= (div & 0x3) << DPLL_PLL_DIV_SHIFT;
+	reg |= (mult & 0x1f) << DPLL_PLL_MULT_SHIFT;
+	reg |= DPLL_PLL_ENABLE;
+
+	writew(reg, REG_DPLL);
+}
+
+void calypso_reset_set(enum calypso_rst calypso_rst, int active)
+{
+	uint8_t reg = readb(CLKM_REG(CNTL_RST));
+
+	if (active)
+		reg |= calypso_rst;
+	else
+		reg &= ~calypso_rst;
+
+	writeb(reg, CLKM_REG(CNTL_RST));
+}
+
+int calypso_reset_get(enum calypso_rst calypso_rst)
+{
+	uint8_t reg = readb(CLKM_REG(CNTL_RST));
+
+	if (reg & calypso_rst)
+		return 1;
+	else
+		return 0;
+}
+
+void calypso_clock_set(uint8_t vtcxo_div2, uint16_t inp, enum mclk_div mclk_div)
+{
+	uint16_t cntl_clock = readw(CLKM_REG(CNTL_CLK));
+	uint16_t cntl_arm_clk = readw(CLKM_REG(CNTL_ARM_CLK));
+
+	/* First set the vtcxo_div2 */
+	cntl_clock &= ~CLK_VCLKOUT_DIV2;
+	if (vtcxo_div2)
+		cntl_clock |= CLK_VTCXO_DIV2;
+	else
+		cntl_clock &= ~CLK_VTCXO_DIV2;
+	writew(cntl_clock, CLKM_REG(CNTL_CLK));
+
+	/* Then configure the MCLK divider */
+	cntl_arm_clk &= ~ARM_CLK_CLKIN_SEL0;
+	if (mclk_div & 0x80) {
+		mclk_div &= ~0x80;
+		cntl_arm_clk |= ARM_CLK_MCLK_DIV5;
+	} else
+		cntl_arm_clk &= ~ARM_CLK_MCLK_DIV5;
+	cntl_arm_clk &= ~(0x7 << ARM_CLK_MCLK_DIV_SHIFT);
+	cntl_arm_clk |= (mclk_div << ARM_CLK_MCLK_DIV_SHIFT);
+	writew(cntl_arm_clk, CLKM_REG(CNTL_ARM_CLK));
+
+	/* Then finally set the PLL */
+	calypso_pll_set(inp);
+}
+
+void calypso_mem_cfg(enum calypso_bank bank, uint8_t ws,
+		     enum calypso_mem_width width, int we)
+{
+	writew((ws & 0x1f) | ((width & 3) << 5) | ((we & 1) << 7),
+	       BASE_ADDR_MEMIF + bank);
+}
+
+void calypso_bootrom(int enable)
+{
+	uint16_t conf = readw(MEMIF_REG(EXTRA_CONF));
+
+	conf |= (3 << 8);
+
+	if (enable)
+		conf &= ~(1 << 9);
+
+	writew(conf, MEMIF_REG(EXTRA_CONF));
+}
+
+void calypso_debugunit(int enable)
+{
+	uint16_t conf = readw(MEMIF_REG(EXTRA_CONF));
+
+	if (enable)
+		conf &= ~(1 << 11);
+	else
+		conf |= (1 << 11);
+
+	writew(conf, MEMIF_REG(EXTRA_CONF));
+}
+
+#define REG_RHEA_CNTL	0xfffff900
+#define REG_API_CNTL	0xfffff902
+#define REG_ARM_RHEA	0xfffff904
+
+void calypso_rhea_cfg(uint8_t fac0, uint8_t fac1, uint8_t timeout,
+		      uint8_t ws_h, uint8_t ws_l, uint8_t w_en0, uint8_t w_en1)
+{
+	writew(fac0 | (fac1 << 4) | (timeout << 8), REG_RHEA_CNTL);
+	writew(ws_h | (ws_l << 5), REG_API_CNTL);
+	writew(w_en0 | (w_en1 << 1), REG_ARM_RHEA);
+}
diff --git a/src/target/firmware/calypso/dma.c b/src/target/firmware/calypso/dma.c
new file mode 100644
index 00000000..35c5be82
--- /dev/null
+++ b/src/target/firmware/calypso/dma.c
@@ -0,0 +1,44 @@
+/* Driver for Calypso DMA controller */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <memory.h>
+
+#define BASE_ADDR_DMA 0xfffffc00
+
+enum dma_reg {
+	CONTROLLER_CONF		= 0x00,
+	ALLOC_CONFIG		= 0x02,
+};
+#define DMA_REG(m)		(BASE_ADDR_DMA + (m))
+
+#define DMA_RAD(x)		DMA_REG((x)*0x10 + 0x0)
+#define DMA_RDPATH(x)		DMA_REG((x)*0x10 + 0x2)
+#define DMA_AAD(x)		DMA_REG((x)*0x10 + 0x4)
+#define DMA_ALGTH(x)		DMA_REG((x)*0x10 + 0x6)
+#define DMA_CTRL(x)		DMA_REG((x)*0x10 + 0x8)
+#define DMA_CUR_OFF_API(x)	DMA_REG((x)*0x10 + 0xa)
+
+void dma_init(void)
+{
+	/* DMA 1 (RIF Tx), 2 (RIF Rx) allocated to DSP, all others to ARM */
+	writew(0x000c, DMA_REG(ALLOC_CONFIG));
+}
diff --git a/src/target/firmware/calypso/dsp.c b/src/target/firmware/calypso/dsp.c
new file mode 100644
index 00000000..235d359b
--- /dev/null
+++ b/src/target/firmware/calypso/dsp.c
@@ -0,0 +1,696 @@
+#define DEBUG
+/* Driver for the Calypso integrated DSP */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <delay.h>
+#include <memory.h>
+#include <calypso/clock.h>
+#include <calypso/dsp.h>
+#include <calypso/dsp_api.h>
+#include <calypso/tpu.h>
+
+#include <abb/twl3025.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+
+
+#define REG_API_CONTROL		0xfffe0000
+#define APIC_R_SMODE_HOM	(1 << 1)	/* API is configured in HOM mode */
+#define APIC_R_HINT		(1 << 3)	/* Host processor interrupt (DSP->MCU) */
+#define APIC_W_DSPINT		(1 << 2)	/* ARM issues interrupt to DSP */
+
+#define REG_API_WS		0xfffff902	/* Number of wait states for ARM access to API memory */
+#define REG_ARM_RHEA_CTL	0xfffff904	/* Write buffer bypassing */
+#define REG_EXT_RHEA_CTL	0xfffff906	/* Some timeout */
+
+#define API_SIZE		0x2000U		/* in words */
+
+#define BASE_API_RAM		0xffd00000	/* Base address of API RAM from ARM point of view */
+
+#define DSP_BASE_API		0x0800		/* Base address of API RAM for DSP */
+#define DSP_BASE_API_MIRROR	0xe000		/* Base address of API RAM for DSP (API boot mirror) */
+#define DSP_START		0x7000		/* DSP Start address */
+
+/* Boot loader */
+#define BL_CMD_STATUS		(BASE_API_RAM + 0x0ffe)	/* Status / Command var    */
+#define BL_ADDR_LO		(BASE_API_RAM + 0x0ffc)	/* Address (16 lsbs)       */
+#define BL_ADDR_HI		(BASE_API_RAM + 0x0ff8)	/* Address (ext page bits) */
+#define BL_SIZE			(BASE_API_RAM + 0x0ffa) /* Size                    */
+
+#define BL_MAX_BLOCK_SIZE	0x7F0			/* Maximum size of copied block */
+
+	/* Possible values for the download status */
+#define BL_STATUS_NA		0
+#define BL_STATUS_IDLE		1
+#define BL_CMD_COPY_BLOCK	2
+#define BL_CMD_COPY_MODE	4
+
+#define BL_MODE_PROG_WRITE	0
+#define BL_MODE_DATA_WRITE	1
+#define BL_MODE_PROG_READ	2
+#define BL_MODE_DATA_READ	3
+#define BL_MODE_PROM_READ	4
+#define BL_MODE_DROM_READ	5
+
+
+struct dsp_section {
+	uint32_t addr;		/* addr for DSP  */
+	uint32_t size;		/* size in words */
+	const uint16_t *data;
+};
+
+#include "dsp_params.c"
+#include "dsp_bootcode.c"
+#include "dsp_dumpcode.c"
+
+struct dsp_api dsp_api = {
+	.ndb	= (T_NDB_MCU_DSP *) BASE_API_NDB,
+	.db_r	= (T_DB_DSP_TO_MCU *) BASE_API_R_PAGE_0,
+	.db_w	= (T_DB_MCU_TO_DSP *) BASE_API_W_PAGE_0,
+	.param	= (T_PARAM_MCU_DSP *) BASE_API_PARAM,
+	.r_page	= 0,
+	.w_page = 0,
+};
+
+
+void dsp_dump_version(void)
+{
+	printf("DSP Download Status: 0x%04x\n", readw(BL_CMD_STATUS));
+	printf("DSP API Version: 0x%04x 0x%04x\n",
+		dsp_api.ndb->d_version_number1, dsp_api.ndb->d_version_number2);
+}
+
+static void dsp_bl_wait_ready(void)
+{
+	while (readw(BL_CMD_STATUS) != BL_STATUS_IDLE);
+}
+
+static void dsp_bl_start_at(uint16_t addr)
+{
+	writew(0, BL_ADDR_HI);
+	writew(addr, BL_ADDR_LO);
+	writew(0, BL_SIZE);
+	writew(BL_CMD_COPY_BLOCK, BL_CMD_STATUS);
+}
+
+static int dsp_bl_upload_sections(const struct dsp_section *sec)
+{
+	/* Make sure the bootloader is ready */
+	dsp_bl_wait_ready();
+
+	/* Set mode */
+	writew(BL_MODE_DATA_WRITE, BASE_API_RAM);
+	writew(BL_CMD_COPY_MODE, BL_CMD_STATUS);
+	dsp_bl_wait_ready();
+
+	/* Scan all sections */
+	for (; sec->data; sec++) {
+		volatile uint16_t *api = (volatile uint16_t *)BASE_API_RAM;
+		unsigned int i;
+
+		if (sec->size > BL_MAX_BLOCK_SIZE)
+			return -1; /* not supported for now */
+
+		/* Copy data to API */
+		for (i=0; i<sec->size; i++)
+			api[i] = sec->data[i];
+
+		/* Issue DRAM write */
+		writew(sec->addr >> 16, BL_ADDR_HI);
+		writew(sec->addr & 0xffff, BL_ADDR_LO);
+		writew(sec->size, BL_SIZE);
+		writew(BL_CMD_COPY_BLOCK, BL_CMD_STATUS);
+
+		/* Wait for completion */
+		dsp_bl_wait_ready();
+	}
+
+	return 0;
+}
+
+static int dsp_upload_sections_api(const struct dsp_section *sec, uint16_t dsp_base_api)
+{
+	for (; sec->data; sec++) {
+		unsigned int i;
+		volatile uint16_t *dptr;
+
+		if (sec->addr & ~((1<<16)-1))	/* 64k max addr */
+			return -1;
+		if (sec->addr < dsp_base_api)
+			return -1;
+		if ((sec->addr + sec->size) > (dsp_base_api + API_SIZE))
+			return -1;
+
+		dptr = (volatile uint16_t *)(BASE_API_RAM + ((sec->addr - dsp_base_api) * sizeof(uint16_t)));
+		for (i=0; i<sec->size; i++)
+			*dptr++ = sec->data[i];
+	}
+
+	/* FIXME need eioio or wb ? */
+
+	return 0;
+}
+
+static void dsp_pre_boot(const struct dsp_section *bootcode)
+{
+	dputs("Assert DSP into Reset\n");
+	calypso_reset_set(RESET_DSP, 1);
+
+	if (bootcode) {
+		dputs("Loading initial DSP bootcode (API boot mode)\n");
+		dsp_upload_sections_api(bootcode, DSP_BASE_API_MIRROR);
+
+		writew(BL_STATUS_NA, BL_CMD_STATUS);
+	} else
+		delay_ms(10);
+
+	dputs("Releasing DSP from Reset\n");
+	calypso_reset_set(RESET_DSP, 0);
+
+	/* Wait 10 us */
+	delay_ms(100);
+
+	dsp_bl_wait_ready();
+}
+
+static void dsp_set_params(int16_t *param_tab, int param_size)
+{
+	int i;
+	int16_t *param_ptr = (int16_t *) BASE_API_PARAM;
+
+	/* Start DSP up to bootloader */
+	dsp_pre_boot(dsp_bootcode);
+
+	/* FIXME: Implement Patch download, if any */
+
+	dputs("Setting some dsp_api.ndb values\n");
+	dsp_api.ndb->d_background_enable = 0;
+	dsp_api.ndb->d_background_abort = 0;
+	dsp_api.ndb->d_background_state = 0;
+	dsp_api.ndb->d_debug_ptr = 0x0074;
+	dsp_api.ndb->d_debug_bk = 0x0001;
+	dsp_api.ndb->d_pll_config = 0x154; //C_PLL_CONFIG;
+	dsp_api.ndb->p_debug_buffer = 0x17ff; //C_DEBUG_BUFFER_ADD;
+	dsp_api.ndb->d_debug_buffer_size = 7; //C_DEBUG_BUFFER_SIZE;
+	dsp_api.ndb->d_debug_trace_type = 0; //C_DEBUG_TRACE_TYPE;
+	dsp_api.ndb->d_dsp_state = 3; //C_DSP_IDLE3;
+	dsp_api.ndb->d_audio_gain_ul = 0;
+	dsp_api.ndb->d_audio_gain_dl = 0;
+	dsp_api.ndb->d_es_level_api = 0x5213;
+	dsp_api.ndb->d_mu_api = 0x5000;
+
+	dputs("Setting API NDB parameters\n");
+	for (i = 0; i < param_size; i ++)
+		*param_ptr++ = param_tab[i];
+	
+	dsp_dump_version();
+
+	dputs("Finishing download phase\n");
+	dsp_bl_start_at(DSP_START);
+
+	dsp_dump_version();
+}
+
+void dsp_api_memset(uint16_t *ptr, int octets)
+{
+	uint16_t i;
+	for (i = 0; i < octets / sizeof(uint16_t); i++)
+		*ptr++ = 0;
+}
+
+/* memcpy from RAM to DSP API, 16 bits by 16 bits. If odd byte count, last word will
+ * be zero filled */
+void dsp_memcpy_to_api(volatile uint16_t *dsp_buf, const uint8_t *mcu_buf, int n, int be)
+{
+	int odd, i;
+
+	odd = n & 1;
+	n >>= 1;
+
+	if (be) {
+		for (i=0; i<n; i++) {
+			uint16_t w;
+			w  = *(mcu_buf++) << 8;
+			w |= *(mcu_buf++);
+			*(dsp_buf++) = w;
+		}
+		if (odd)
+			*dsp_buf = *mcu_buf << 8;
+	} else {
+		for (i=0; i<n; i++) {
+			uint16_t w;
+			w  = *(mcu_buf++);
+			w |= *(mcu_buf++) << 8;
+			*(dsp_buf++) = w;
+		}
+		if (odd)
+			*dsp_buf = *mcu_buf;
+	}
+}
+
+/* memcpy from DSP API to RAM, accessing API 16 bits word at a time */
+void dsp_memcpy_from_api(uint8_t *mcu_buf, const volatile uint16_t *dsp_buf, int n, int be)
+{
+	int odd, i;
+
+	odd = n & 1;
+	n >>= 1;
+
+	if (be) {
+		for (i=0; i<n; i++) {
+			uint16_t w = *(dsp_buf++);
+			*(mcu_buf++) = w >> 8;
+			*(mcu_buf++) = w;
+		}
+		if (odd)
+			*mcu_buf = *(dsp_buf++) >> 8;
+	} else {
+		for (i=0; i<n; i++) {
+			uint16_t w = *(dsp_buf++);
+			*(mcu_buf++) = w;
+			*(mcu_buf++) = w >> 8;
+		}
+		if (odd)
+			*mcu_buf = *(dsp_buf++);
+	}
+}
+
+static void dsp_audio_init(void)
+{
+	T_NDB_MCU_DSP *ndb = dsp_api.ndb;
+	uint8_t i;
+
+	ndb->d_vbctrl1  = ABB_VAL_T(VBCTRL1, 0x00B); 	/* VULSWITCH=0, VDLAUX=1, VDLEAR=1 */
+	ndb->d_vbctrl2	= ABB_VAL_T(VBCTRL2, 0x000); 	/* MICBIASEL=0, VDLHSO=0, MICAUX=0 */
+
+	/*
+	 * TODO: the following two settings are used to control
+	 * the volume and uplink/downlink/sidetone gain. Make them
+	 * adjustable by the user.
+	 */
+
+	ndb->d_vbuctrl	= ABB_VAL_T(VBUCTRL, 0x009);	/* Uplink gain amp 3dB, Sidetone gain -5dB */
+	ndb->d_vbdctrl	= ABB_VAL_T(VBDCTRL, 0x066);	/* Downlink gain amp 0dB, Volume control -6 dB */
+
+	ndb->d_toneskb_init = 0;			/* MCU/DSP audio task com. register */
+	ndb->d_toneskb_status = 0;			/* MCU/DSP audio task com. register */
+
+	ndb->d_shiftul = 0x100;
+	ndb->d_shiftdl = 0x100;
+
+	ndb->d_melo_osc_used    = 0;
+	ndb->d_melo_osc_active  = 0;
+
+#define SC_END_OSCILLATOR_MASK        0xfffe
+
+	ndb->a_melo_note0[0] = SC_END_OSCILLATOR_MASK;
+	ndb->a_melo_note1[0] = SC_END_OSCILLATOR_MASK;
+	ndb->a_melo_note2[0] = SC_END_OSCILLATOR_MASK;
+	ndb->a_melo_note3[0] = SC_END_OSCILLATOR_MASK;
+	ndb->a_melo_note4[0] = SC_END_OSCILLATOR_MASK;
+	ndb->a_melo_note5[0] = SC_END_OSCILLATOR_MASK;
+	ndb->a_melo_note6[0] = SC_END_OSCILLATOR_MASK;
+	ndb->a_melo_note7[0] = SC_END_OSCILLATOR_MASK;
+
+#define MAX_FIR_COEF  31
+
+	/* Initialize the FIR as an all band pass */
+	dsp_api.param->a_fir31_downlink[0] = 0x4000;
+	dsp_api.param->a_fir31_uplink[0]   = 0x4000;
+	for (i = 1; i < MAX_FIR_COEF; i++)
+	{
+		dsp_api.param->a_fir31_downlink[i]  = 0;
+		dsp_api.param->a_fir31_uplink[i]    = 0;
+	}
+
+#define B_GSM_ONLY	((1L <<  13) | (1L <<  11))	/* GSM normal mode */
+#define B_BT_CORDLESS	(1L <<  12)			/* Bluetooth cordless mode */
+#define B_BT_HEADSET	(1L <<  14)			/* Bluetooth headset mode */
+
+		/* Bit set by the MCU to close the loop between the audio UL and DL path. */
+		/* This features is used to find the FIR coefficient. */
+#define B_FIR_LOOP	(1L <<  1)
+
+	/* Reset the FIR loopback and the audio mode */
+	ndb->d_audio_init &= ~(B_FIR_LOOP | B_GSM_ONLY | B_BT_HEADSET | B_BT_CORDLESS);
+
+	/* Set the GSM mode  */
+	ndb->d_audio_init |= (B_GSM_ONLY);
+
+	ndb->d_aec_ctrl = 0;
+
+	/* DSP background task through pending task queue */
+	dsp_api.param->d_gsm_bgd_mgt = 0;
+
+	ndb->d_audio_compressor_ctrl = 0x0401;
+
+#define NO_MELODY_SELECTED    (0)
+
+	ndb->d_melody_selection = NO_MELODY_SELECTED;
+}
+
+static void dsp_ndb_init(void)
+{
+	T_NDB_MCU_DSP *ndb = dsp_api.ndb;
+	uint8_t i;
+
+	#define APCDEL_DOWN     (2+0)   // minimum value: 2
+	#define APCDEL_UP       (6+3+1) // minimum value: 6
+
+	/* load APC ramp: set to "no ramp" so that there will be no output if
+	 * not properly initialised at some other place. */
+	for (i = 0; i < 16; i++)
+		dsp_api.ndb->a_ramp[i] = ABB_VAL(APCRAM, ABB_RAMP_VAL(0, 0));
+
+	/* Iota registers values will be programmed at 1st DSP communication interrupt */
+
+	/* Enable f_tx delay of 400000 cyc DEBUG */
+	ndb->d_debug1 	= ABB_VAL_T(0, 0x000);
+	ndb->d_afcctladd= ABB_VAL_T(AFCCTLADD, 0x000);  // Value at reset
+	ndb->d_vbuctrl	= ABB_VAL_T(VBUCTRL, 0x0C9);	// Uplink gain amp 0dB, Sidetone gain to mute
+	ndb->d_vbdctrl	= ABB_VAL_T(VBDCTRL, 0x006);	// Downlink gain amp 0dB, Volume control 0 dB
+	ndb->d_bbctrl	= ABB_VAL_T(BBCTRL,  0x2C1);	// value at reset
+	ndb->d_bulgcal	= ABB_VAL_T(BULGCAL, 0x000);	// value at reset
+	ndb->d_apcoff	= ABB_VAL_T(APCOFF,  0x040);	// value at reset
+	ndb->d_bulioff	= ABB_VAL_T(BULIOFF, 0x0FF);	// value at reset
+	ndb->d_bulqoff	= ABB_VAL_T(BULQOFF, 0x0FF);	// value at reset
+	ndb->d_dai_onoff= ABB_VAL_T(APCOFF,  0x000);	// value at reset
+	ndb->d_auxdac	= ABB_VAL_T(AUXDAC,  0x000);	// value at reset
+	ndb->d_vbctrl1  = ABB_VAL_T(VBCTRL1, 0x00B); 	// VULSWITCH=0, VDLAUX=1, VDLEAR=1.
+	ndb->d_vbctrl2	= ABB_VAL_T(VBCTRL2, 0x000); 	// MICBIASEL=0, VDLHSO=0, MICAUX=0
+
+	/* APCDEL will be initialized on rach only */
+	ndb->d_apcdel1	= ABB_VAL_T(APCDEL1, ((APCDEL_DOWN-2) << 5) | (APCDEL_UP-6));
+	ndb->d_apcdel2	= ABB_VAL_T(APCDEL2, 0x000);
+
+	ndb->d_fb_mode	= 1;		/* mode 1 FCCH burst detection */
+	ndb->d_fb_det	= 0;		/* we have not yet detected a FB */
+	ndb->a_cd[0]	= (1<<B_FIRE1);	/* CCCH/SACCH downlink */
+	ndb->a_dd_0[0]	= 0;
+	ndb->a_dd_0[2]	= 0xffff;
+	ndb->a_dd_1[0]	= 0;
+	ndb->a_dd_1[2]	= 0xffff;
+	ndb->a_du_0[0]	= 0;
+	ndb->a_du_0[2]	= 0xffff;
+	ndb->a_du_1[0]	= 0;
+	ndb->a_du_1[2]	= 0xffff;
+	ndb->a_fd[0]	= (1<<B_FIRE1);
+	ndb->a_fd[2]	= 0xffff;
+	ndb->d_a5mode	= 0;
+	ndb->d_tch_mode	= 0x0800; /* Set ABB model to Iota */
+
+	#define GUARD_BITS 8 // 11 or 9 for TSM30, 7 for Freerunner
+	ndb->d_tch_mode |= (((GUARD_BITS - 4) & 0x000F) << 7); //Bit 7..10: guard bits
+
+	ndb->a_sch26[0]	= (1<<B_SCH_CRC);
+
+	/* Interrupt RIF transmit if FIFO <= threshold with threshold == 0 */
+	/* MCM = 1, XRST = 0, CLKX_AUTO=1, TXM=1, NCLK_EN=1, NCLK13_EN=1,
+	 * THRESHOLD = 0, DIV_CLK = 0 (13MHz) */
+	ndb->d_spcx_rif	= 0x179;
+
+	/* Init audio related parameters */
+	dsp_audio_init();
+}
+
+static void dsp_db_init(void)
+{
+	dsp_api_memset((uint16_t *)BASE_API_W_PAGE_0, sizeof(T_DB_MCU_TO_DSP));
+	dsp_api_memset((uint16_t *)BASE_API_W_PAGE_1, sizeof(T_DB_MCU_TO_DSP));
+	dsp_api_memset((uint16_t *)BASE_API_R_PAGE_0, sizeof(T_DB_DSP_TO_MCU));
+	dsp_api_memset((uint16_t *)BASE_API_R_PAGE_1, sizeof(T_DB_DSP_TO_MCU));
+}
+
+void dsp_power_on(void)
+{
+	/* probably a good idea to initialize the whole API area to a known value */
+	dsp_api_memset((uint16_t *)BASE_API_RAM, API_SIZE * 2); // size is in words
+
+	dsp_set_params((int16_t *)&dsp_params, sizeof(dsp_params)/2);
+	dsp_ndb_init();
+	dsp_db_init();
+	dsp_api.frame_ctr = 0;
+	dsp_api.r_page = dsp_api.w_page = dsp_api.r_page_used = 0;
+}
+
+/* test for frequency burst detection */
+#define REG_INT_STAT 0xffff1004
+static void wait_for_frame_irq(void)
+{
+	//puts("Waiting for Frame Interrupt");
+	//while (readb(REG_INT_STAT) & 1)
+	while (readb((void *)0xffff1000) & (1<<4))
+	;//	putchar('.');
+	//puts("Done!\n");
+}
+
+void dsp_end_scenario(void)
+{
+	/* FIXME: we don't yet deal with the MISC_TASK */
+
+	/* End the DSP Scenario */
+	dsp_api.ndb->d_dsp_page = B_GSM_TASK | dsp_api.w_page;
+	dsp_api.w_page ^= 1;
+
+	/* Tell TPU to generate a FRAME interrupt to the DSP */
+	tpu_dsp_frameirq_enable();
+	tpu_frame_irq_en(1, 1);
+}
+
+void dsp_load_rx_task(uint16_t task, uint8_t burst_id, uint8_t tsc)
+{
+	dsp_api.db_w->d_task_d = task;
+	dsp_api.db_w->d_burst_d = burst_id;
+	dsp_api.db_w->d_ctrl_system |= tsc & 0x7;
+}
+
+void dsp_load_tx_task(uint16_t task, uint8_t burst_id, uint8_t tsc)
+{
+	dsp_api.db_w->d_task_u = task;
+	dsp_api.db_w->d_burst_u = burst_id;
+	dsp_api.db_w->d_ctrl_system |= tsc & 0x7;
+}
+
+/* no AMR yet */
+void dsp_load_tch_param(struct gsm_time *next_time,
+                        uint8_t chan_mode, uint8_t chan_type, uint8_t chan_sub,
+                        uint8_t tch_loop, uint8_t sync_tch, uint8_t tn)
+{
+	uint16_t d_ctrl_tch;
+	uint16_t fn, a5fn0, a5fn1;
+
+	/* d_ctrl_tch
+	   ----------
+	    bit [0..3]   -> b_chan_mode
+	    bit [4..7]   -> b_chan_type
+	    bit [8]      -> b_sync_tch_ul
+	    bit [9]      -> b_sync_tch_dl
+	    bit [10]     -> b_stop_tch_ul
+	    bit [11]     -> b_stop_tch_dl
+	    bit [12..14] -> b_tch_loop
+	    bit [15]     -> b_subchannel */
+	d_ctrl_tch = (chan_mode  << B_CHAN_MODE) |
+		     (chan_type  << B_CHAN_TYPE)  |
+		     (chan_sub   << B_SUBCHANNEL) |
+		     (sync_tch   << B_SYNC_TCH_UL) |
+		     (sync_tch   << B_SYNC_TCH_DL) |
+		     (tch_loop   << B_TCH_LOOP);
+
+	/* used for ciphering and TCH traffic */
+
+	/* d_fn
+	   ----
+
+	   for TCH_F:
+	     bit [0..7]  -> b_fn_report = (fn - (tn * 13) + 104) % 104)
+	     bit [8..15] -> b_fn_sid    = (fn % 104)
+
+	   for TCH_H:
+	                    tn_report = (tn & ~1) | subchannel
+	     bit [0..7]  -> b_fn_report = (fn - tn_report * 13) + 104) % 104)
+	     bit [8..15] -> b_fn_sid    = (fn % 104)
+
+	   for other: irrelevant
+	 */
+
+	if (chan_type == TCH_F) {
+		fn = ((next_time->fn - (tn * 13) + 104) % 104) |
+		     ((next_time->fn % 104) << 8);
+	} else if (chan_type == TCH_H) {
+		uint8_t tn_report = (tn & ~1) | chan_sub;
+		fn = ((next_time->fn - (tn_report * 13) + 104) % 104) |
+		     ((next_time->fn % 104) << 8);
+	} else {
+		/* irrelevant */
+		fn = 0;
+	}
+
+	/* a_a5fn
+	   ------
+	     byte[0] bit [0..4]  -> T2
+	     byte[0] bit [5..10] -> T3
+	     byte[1] bit [0..10] -> T1 */
+
+	a5fn0 = ((uint16_t)next_time->t3 << 5) |
+	         (uint16_t)next_time->t2;
+	a5fn1 =  (uint16_t)next_time->t1;
+
+	dsp_api.db_w->d_fn        = fn;         /* Fn_sid & Fn_report  */
+	dsp_api.db_w->a_a5fn[0]   = a5fn0;      /* ciphering FN part 1 */
+	dsp_api.db_w->a_a5fn[1]   = a5fn1;      /* ciphering FN part 2 */
+	dsp_api.db_w->d_ctrl_tch  = d_ctrl_tch; /* Channel config.     */
+}
+
+void dsp_load_ciph_param(int mode, uint8_t *key)
+{
+	dsp_api.ndb->d_a5mode = mode;
+
+	if (mode >= 3) /* Only A5/0, A5/1, A5/2 are supported by calypso */
+		printd("Algo A5/%u is not supported!!!\n", mode);
+
+	if (!mode || !key)
+		return;
+
+		/* key is expected in the same format as in RSL
+		 * Encryption information IE. So we need to load the
+		 * bytes backward in A5 unit */
+	dsp_api.ndb->a_kc[0] = (uint16_t)key[7] | ((uint16_t)key[6] << 8);
+	dsp_api.ndb->a_kc[1] = (uint16_t)key[5] | ((uint16_t)key[4] << 8);
+	dsp_api.ndb->a_kc[2] = (uint16_t)key[3] | ((uint16_t)key[2] << 8);
+	dsp_api.ndb->a_kc[3] = (uint16_t)key[1] | ((uint16_t)key[0] << 8);
+}
+
+#define SC_CHKSUM_VER     (BASE_API_W_PAGE_0 + (2 * (0x08DB - 0x800)))
+static void dsp_dump_csum(void)
+{
+	printf("dsp page          : %u\n", dsp_api.ndb->d_dsp_page);
+	printf("dsp code version  : 0x%04x\n", dsp_api.db_r->a_pm[0]);
+	printf("dsp checksum      : 0x%04x\n", dsp_api.db_r->a_pm[1]);
+	printf("dsp patch version : 0x%04x\n", readw(SC_CHKSUM_VER));
+}
+
+void dsp_checksum_task(void)
+{
+	dsp_dump_csum();
+	dsp_api.db_w->d_task_md = CHECKSUM_DSP_TASK;
+	dsp_api.ndb->d_fb_mode = 1;
+
+	dsp_end_scenario();
+
+	wait_for_frame_irq();
+
+	dsp_dump_csum();
+}
+
+#define L1D_AUXAPC              0x0012
+#define L1D_APCRAM              0x0014
+
+void dsp_load_apc_dac(uint16_t apc)
+{
+	dsp_api.db_w->d_power_ctl = (apc << 6) | L1D_AUXAPC;
+}
+
+
+static void _dsp_dump_range(uint32_t addr, uint32_t size, int mode)
+{
+	uint32_t bs;
+
+	/* Mode selection */
+	writew(mode, BASE_API_RAM);
+	writew(BL_CMD_COPY_MODE, BL_CMD_STATUS);
+	dsp_bl_wait_ready();
+
+	/* Block by block dump */
+	while (size) {
+		volatile uint16_t *api = (volatile uint16_t *)BASE_API_RAM;
+
+		bs = (size > BL_MAX_BLOCK_SIZE) ? BL_MAX_BLOCK_SIZE : size;
+		size -= bs;
+
+		writew(addr >> 16, BL_ADDR_HI);
+		writew(addr & 0xffff, BL_ADDR_LO);
+		writew(bs, BL_SIZE);
+		writew(BL_CMD_COPY_BLOCK, BL_CMD_STATUS);
+
+		dsp_bl_wait_ready();
+
+		while (bs--) {
+			/* FIXME workaround: small delay to prevent overflowing
+			 * the sercomm buffer */
+			delay_ms(2);
+			if ((addr&15)==0)
+				printf("%05lx : ", addr);
+			printf("%04hx%c", *api++, ((addr&15)==15)?'\n':' ');
+			addr++;
+		}
+	};
+	puts("\n");
+}
+
+void dsp_dump(void)
+{
+	static const struct {
+		const char *name;
+		uint32_t addr;
+		uint32_t size;
+		int mode;
+	} dr[] = {
+		{ "Registers",	0x00000, 0x0060, BL_MODE_DATA_READ },
+		{ "DROM",	0x09000, 0x5000, BL_MODE_DROM_READ },
+		{ "PDROM",	0x0e000, 0x2000, BL_MODE_DROM_READ },
+		{ "PROM0",	0x07000, 0x7000, BL_MODE_PROM_READ },
+		{ "PROM1",	0x18000, 0x8000, BL_MODE_PROM_READ },
+		{ "PROM2",	0x28000, 0x8000, BL_MODE_PROM_READ },
+		{ "PROM3",	0x38000, 0x2000, BL_MODE_PROM_READ },
+		{ NULL, 0, 0, -1 }
+	};
+
+	int i;
+
+	/* Start DSP up to bootloader */
+	dsp_pre_boot(dsp_bootcode);
+
+	/* Load and execute our dump code in the DSP */
+	dsp_upload_sections_api(dsp_dumpcode, DSP_BASE_API);
+	dsp_bl_start_at(DSP_DUMPCODE_START);
+
+		/* our dump code actually simulates the boot loader
+		 * but with added read commands */
+	dsp_bl_wait_ready();
+
+	/* Test the 'version' command */
+	writew(0xffff, BL_CMD_STATUS);
+	dsp_bl_wait_ready();
+	printf("DSP bootloader version 0x%04x\n", readw(BASE_API_RAM));
+
+	/* Dump each range */
+	for (i=0; dr[i].name; i++) {
+		printf("DSP dump: %s [%05lx-%05lx]\n", dr[i].name,
+			dr[i].addr, dr[i].addr+dr[i].size-1);
+		_dsp_dump_range(dr[i].addr, dr[i].size, dr[i].mode);
+	}
+}
+
diff --git a/src/target/firmware/calypso/dsp_bootcode.c b/src/target/firmware/calypso/dsp_bootcode.c
new file mode 100644
index 00000000..2db46568
--- /dev/null
+++ b/src/target/firmware/calypso/dsp_bootcode.c
@@ -0,0 +1,9 @@
+/* Calypso integrated DSP boot code */
+
+#define _SA_DECL (const uint16_t *)&(const uint16_t [])
+
+/* We don't really need any DSP boot code, it happily works with its own ROM */
+static const struct dsp_section *dsp_bootcode = NULL;
+
+#undef _SA_DECL
+
diff --git a/src/target/firmware/calypso/dsp_dumpcode.c b/src/target/firmware/calypso/dsp_dumpcode.c
new file mode 100644
index 00000000..265a1c12
--- /dev/null
+++ b/src/target/firmware/calypso/dsp_dumpcode.c
@@ -0,0 +1,45 @@
+/* Generated from src/target_dsp/calypso/dsp_dump.bin */
+
+#define _SA_DECL (const uint16_t *)&(const uint16_t [])
+
+static const struct dsp_section dsp_dumpcode[] = {
+	{
+		.addr = 0x1000,
+		.size = 0x005b,
+		.data = _SA_DECL {
+			0x69f8, 0x0029, 0x0002, 0xea1f,
+			0x7718, 0x1100, 0x7714, 0x0000,
+			0x7712, 0x0800, 0x767f, 0x0001,
+			0x607f, 0xffff, 0xf820, 0x1014,
+			0xf273, 0x1008, 0x7682, 0x0100,
+			0x607f, 0x0004, 0xf820, 0x101c,
+			0xf273, 0x1008, 0x7214, 0x0800,
+			0x607f, 0x0002, 0xf820, 0x100c,
+			0x127e, 0x8813, 0x3c7c, 0x137d,
+			0x8911, 0xf84c, 0x1028, 0xf4e2,
+			0x7715, 0x0014, 0x963d, 0xfa30,
+			0x104b, 0x6d89, 0x963f, 0xfa30,
+			0x103f, 0x963e, 0xf495, 0xf830,
+			0x103a, 0x47f8, 0x0011, 0x7f92,
+			0xf073, 0x1008, 0x47f8, 0x0011,
+			0x7e92, 0xf073, 0x1008, 0xf830,
+			0x1046, 0x47f8, 0x0011, 0xe589,
+			0xf073, 0x1008, 0x47f8, 0x0011,
+			0xe598, 0xf073, 0x1008, 0x4911,
+			0x891a, 0xf830, 0x1055, 0xf072,
+			0x1052, 0xf074, 0x7213, 0xf073,
+			0x1008, 0xf072, 0x1058, 0xf074,
+			0xe4b8, 0xf073, 0x1008,
+		},
+	},
+	{ /* Guard */
+		.addr = 0,
+		.size = 0,
+		.data = NULL,
+	},
+};
+
+#define DSP_DUMPCODE_START 0x1000
+
+#undef _SA_DECL
+
diff --git a/src/target/firmware/calypso/dsp_params.c b/src/target/firmware/calypso/dsp_params.c
new file mode 100644
index 00000000..e08b46e6
--- /dev/null
+++ b/src/target/firmware/calypso/dsp_params.c
@@ -0,0 +1,94 @@
+/* Values from an actual phone firmware that uses the 3306 DSP ROM code version */
+static T_PARAM_MCU_DSP dsp_params = {
+	.d_transfer_rate		= 0x6666,
+	/* Latencies */
+	.d_lat_mcu_bridge		= 15,
+	.d_lat_mcu_hom2sam		= 12,
+	.d_lat_mcu_bef_fast_access	= 5,
+	.d_lat_dsp_after_sam		= 4,
+	/* DSP Start Address */
+	.d_gprs_install_address		= 0x7002,	/* needs to be set by patch or manually */
+	.d_misc_config			= 1,
+	.d_cn_sw_workaround		= 0xE,
+	.d_hole2_param			= { 0, 0, 0, 0 },
+	/* Frequency Burst */
+	.d_fb_margin_beg		= 24,
+	.d_fb_margin_end		= 22,
+	.d_nsubb_idle			= 296,
+	.d_nsubb_dedic			= 30,
+	.d_fb_thr_det_iacq		= 0x3333,
+	.d_fb_thr_det_track		= 0x28f6,
+	/* Demodulation */
+	.d_dc_off_thres			= 0x7fff,
+	.d_dummy_thres			= 17408,
+	.d_dem_pond_gewl		= 26624,
+	.d_dem_pond_red			= 20152,
+	/* TCH Full Speech */
+	.d_maccthresh1			= 7872,
+	.d_mldt				= -4,
+	.d_maccthresh			= 7872,
+	.d_gu				= 5772,
+	.d_go				= 7872,
+	.d_attmax			= 53,
+	.d_sm				= -892,
+	.d_b				= 208,
+	/* V.42 bis */
+	.d_v42b_switch_hyst		= 16,
+	.d_v42b_switch_min		= 64,
+	.d_v42b_switch_max		= 250,
+	.d_v42b_reset_delay		= 10,
+	/* TCH Half Speech */
+	.d_ldT_hr			= -5,
+	.d_maccthresh_hr		= 6500,
+	.d_maccthresh1_hr		= 6500,
+	.d_gu_hr			= 2620,
+	.d_go_hr			= 3700,
+	.d_b_hr				= 182,
+	.d_sm_hr			= -1608,
+	.d_attmax_hr			= 53,
+	/* TCH Enhanced FR Speech */
+	.c_mldt_efr			= -4,
+	.c_maccthresh_efr		= 8000,
+	.c_maccthresh1_efr		= 8000,
+	.c_gu_efr			= 4522,
+	.c_go_efr			= 6500,
+	.c_b_efr			= 174,
+	.c_sm_efr			= -878,
+	.c_attmax_efr			= 53,
+	/* CHED TCH Full Speech */
+	.d_sd_min_thr_tchfs		= 15,
+	.d_ma_min_thr_tchfs		= 738,
+	.d_md_max_thr_tchfs		= 1700,
+	.d_md1_max_thr_tchfs		= 99,
+	/* CHED TCH Half Speech */
+	.d_sd_min_thr_tchhs		= 37,
+	.d_ma_min_thr_tchhs		= 344,
+	.d_sd_av_thr_tchhs		= 1845,
+	.d_md_max_thr_tchhs		= 2175,
+	.d_md1_max_thr_tchhs		= 138,
+	/* CHED TCH/F EFR Speech */
+	.d_sd_min_thr_tchefs		= 15,
+	.d_ma_min_thr_tchefs		= 738,
+	.d_md_max_thr_tchefs		= 0x4ce,
+	.d_md1_max_thr_tchefs		= 0x63,
+	/* */
+	.d_wed_fil_ini			= 0x122a,
+	.d_wed_fil_tc			= 0x7c00,
+	.d_x_min			= 0xf,
+	.d_x_max			= 0x17,
+	.d_slope			= 0x87,
+	.d_y_min			= 0x2bf,
+	.d_y_max			= 0x99c,
+	.d_wed_diff_threshold		= 0x196,
+	.d_mabfi_min_thr_tchhs		= 0x14c8,
+	/* FACCH module */
+	.d_facch_thr			= 0,
+	/* IDS module */
+	.d_max_ovsp_ul			= 8,
+	.d_sync_thres			= 0x3f50,
+	.d_idle_thres			= 0x4000,
+	.d_m1_thres			= 5,
+	.d_max_ovsp_dl			= 8,
+	.d_gsm_bgd_mgt			= 0,
+	/* we don't set the FIR coefficients !?! */
+};
diff --git a/src/target/firmware/calypso/du.c b/src/target/firmware/calypso/du.c
new file mode 100644
index 00000000..58783b06
--- /dev/null
+++ b/src/target/firmware/calypso/du.c
@@ -0,0 +1,51 @@
+/* Calypso DU (Debug Unit) Driver */
+
+/* (C) 2010 by Ingo Albrecht <prom@berlin.ccc.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <memory.h>
+#include <stdint.h>
+#include <stdio.h>
+
+#include <calypso/du.h>
+
+#define BASE_ADDR_DU	0x03c00000
+#define DU_REG(m)	(BASE_ADDR_DU+(m))
+
+void calypso_du_init() {
+	unsigned char c;
+	calypso_debugunit(1);
+	for(c = 0; c < 64; c++) {
+		writew(DU_REG(c), 0x00000000);
+	}
+}
+
+void calypso_du_stop() {
+	calypso_debugunit(0);
+}
+
+void calypso_du_dump() {
+	unsigned char c;
+	puts("Debug unit traceback:\n");
+	for(c = 0; c < 64; c++) {
+		uint32_t w = readw(DU_REG(c));
+		printf("t-%2x: 0x%8x\n", c, (unsigned int)w);
+	}
+}
diff --git a/src/target/firmware/calypso/i2c.c b/src/target/firmware/calypso/i2c.c
new file mode 100644
index 00000000..bf441780
--- /dev/null
+++ b/src/target/firmware/calypso/i2c.c
@@ -0,0 +1,123 @@
+/* Driver for I2C Master Controller inside TI Calypso */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <i2c.h>
+
+#define BASE_ADDR_I2C	0xfffe2800
+#define I2C_REG(x)	(BASE_ADDR_I2C+(x))
+
+enum i2c_reg {
+	DEVICE_REG	= 0,
+	ADDRESS_REG,
+	DATA_WR_REG,	
+	DATA_RD_REG,
+	CMD_REG,
+	CONF_FIFO_REG,
+	CONF_CLK_REG,
+	CONF_CLK_FUNC_REF,
+	STATUS_FIFO_REG,
+	STATUS_ACTIVITY_REG,
+};
+
+#define I2C_CMD_SOFT_RESET	(1 << 0)
+#define I2C_CMD_EN_CLK		(1 << 1)
+#define I2C_CMD_START		(1 << 2)
+#define I2C_CMD_RW_READ		(1 << 3)
+#define I2C_CMD_COMP_READ	(1 << 4)
+#define I2C_CMD_IRQ_ENABLE	(1 << 5)
+
+#define I2C_STATUS_ERROR_DATA	(1 << 0)
+#define I2C_STATUS_ERROR_DEV	(1 << 1)
+#define I2C_STATUS_IDLE		(1 << 2) // 1: not idle, 0: idle
+#define I2C_STATUS_INTERRUPT	(1 << 3)
+
+int i2c_write(uint8_t chip, uint32_t addr, int alen, const uint8_t *buffer, int len)
+{
+	uint8_t cmd;
+
+	/* Calypso I2C controller doesn't support fancy addressing */
+	if (alen > 1)
+		return -1;
+
+	/* FIXME: implement writes longer than fifo size */
+	if (len > 16)
+		return -1;
+
+	printd("i2c_write(chip=0x%02u, addr=0x%02u): ", chip, addr);
+
+	writeb(chip & 0x7f, I2C_REG(DEVICE_REG));
+	writeb(addr & 0xff, I2C_REG(ADDRESS_REG));
+	
+	/* we have to tell the controller how many bits we'll put into the fifo ?!? */
+	writeb(len-1, I2C_REG(CONF_FIFO_REG));
+
+	/* fill the FIFO */
+	while (len--) {
+		uint8_t byte = *buffer++;
+		writeb(byte, I2C_REG(DATA_WR_REG));
+		printd("%02X ", byte);
+	}
+	dputchar('\n');
+
+	/* start the transfer */
+	cmd = readb(I2C_REG(CMD_REG));
+	cmd |= I2C_CMD_START;
+	writeb(cmd, I2C_REG(CMD_REG));
+
+	/* wait until transfer completes */
+	while (1) {
+		uint8_t reg = readb(I2C_REG(STATUS_ACTIVITY_REG));
+		printd("I2C Status: 0x%02x\n", reg & 0xf);
+		if (!(reg & I2C_STATUS_IDLE)) // 0: idle 1: not idle
+			break;
+	}
+	dputs("I2C transfer completed\n");
+
+	return 0;
+}
+
+void i2c_init(int speed, int slaveadd)
+{
+	/* scl_out = clk_func_ref / 3,
+	   clk_func_ref = master_clock_freq / (divisor_2 + 1)
+	   master_clock_freq = ext_clock_freq / divisor_1 */
+	/* clk_func_ref = scl_out * 3,
+	   divisor_2 = (master_clock_freq / clk_func_ref) - 1
+	   divisor_1 = ext_clock_freq / master_clock_freq */
+	/* for a target freq of 200kHz:
+		ext_clock_freq = 13MHz
+		clk_func_ref = 3 * 300kHZ = 600kHz
+		divisor_1 = 1 => master_clock_freq = ext_clock_freq = 13MHz
+		divisor_2 = 21 => clk_func_ref = 13MHz / (21+2) = 590.91 kHz
+		scl_out = clk_func_ref / 3 = 509.91 kHz / 3 = 196.97kHz */
+	writeb(I2C_CMD_SOFT_RESET, I2C_REG(CMD_REG));
+
+	writeb(0x00, I2C_REG(CONF_CLK_REG));
+	writeb(21, I2C_REG(CONF_CLK_FUNC_REF));
+
+	writeb(I2C_CMD_EN_CLK, I2C_REG(CMD_REG));
+}
diff --git a/src/target/firmware/calypso/irq.c b/src/target/firmware/calypso/irq.c
new file mode 100644
index 00000000..136fd55e
--- /dev/null
+++ b/src/target/firmware/calypso/irq.c
@@ -0,0 +1,266 @@
+/* Driver for Calypso IRQ controller */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <arm.h>
+#include <calypso/irq.h>
+
+#define BASE_ADDR_IRQ	0xfffffa00
+
+enum irq_reg {
+	IT_REG1		= 0x00,
+	IT_REG2		= 0x02,
+	MASK_IT_REG1	= 0x08,
+	MASK_IT_REG2	= 0x0a,
+	IRQ_NUM		= 0x10,
+	FIQ_NUM		= 0x12,
+	IRQ_CTRL	= 0x14,
+};
+
+#define ILR_IRQ(x)	(0x20 + (x*2))
+#define IRQ_REG(x)	((void *)BASE_ADDR_IRQ + (x))
+
+#define NR_IRQS	32
+
+static uint8_t default_irq_prio[] = {
+	[IRQ_WATCHDOG]		= 0xff,
+	[IRQ_TIMER1]		= 0xff,
+	[IRQ_TIMER2]		= 0xff,
+	[IRQ_TSP_RX]		= 0,
+	[IRQ_TPU_FRAME]		= 3,
+	[IRQ_TPU_PAGE]		= 0xff,
+	[IRQ_SIMCARD]		= 0xff,
+	[IRQ_UART_MODEM]	= 8,
+	[IRQ_KEYPAD_GPIO]	= 4,
+	[IRQ_RTC_TIMER]		= 9,
+	[IRQ_RTC_ALARM_I2C]	= 10,
+	[IRQ_ULPD_GAUGING]	= 2,
+	[IRQ_EXTERNAL]		= 12,
+	[IRQ_SPI]		= 0xff,
+	[IRQ_DMA]		= 0xff,
+	[IRQ_API]		= 0xff,
+	[IRQ_SIM_DETECT]	= 0,
+	[IRQ_EXTERNAL_FIQ]	= 7,
+	[IRQ_UART_IRDA]		= 2,
+	[IRQ_ULPD_GSM_TIMER]	= 1,
+	[IRQ_GEA]		= 0xff,
+};
+
+static irq_handler *irq_handlers[NR_IRQS];
+
+static void _irq_enable(enum irq_nr nr, int enable)
+{
+	uint16_t *reg = IRQ_REG(MASK_IT_REG1);
+	uint16_t val;
+
+	if (nr > 15) {
+		reg = IRQ_REG(MASK_IT_REG2);
+		nr -= 16;
+	}
+
+	val = readw(reg);
+	if (enable)
+		val &= ~(1 << nr);
+	else
+		val |= (1 << nr);
+	writew(val, reg);
+}
+
+void irq_enable(enum irq_nr nr)
+{
+	_irq_enable(nr, 1);
+}
+
+void irq_disable(enum irq_nr nr)
+{
+	_irq_enable(nr, 0);
+}
+
+void irq_config(enum irq_nr nr, int fiq, int edge, int8_t prio)
+{
+	uint16_t val;
+
+	if (prio == -1)
+		prio = default_irq_prio[nr];
+
+	if (prio > 31)
+		prio = 31;
+
+	val = prio << 2;
+	if (edge)
+		val |= 0x02;
+	if (fiq)
+		val |= 0x01;
+
+	writew(val, IRQ_REG(ILR_IRQ(nr)));
+}
+
+/* Entry point for interrupts */
+void irq(void)
+{
+	uint8_t num, tmp;
+	irq_handler *handler;
+
+#if 1
+	/* Hardware interrupt detection mode */
+	num = readb(IRQ_REG(IRQ_NUM)) & 0x1f;
+
+	printd("i%02x\n", num);
+
+	handler = irq_handlers[num];
+
+	if (handler)
+		handler(num);
+#else
+	/* Software interrupt detection mode */
+	{
+		uint16_t it_reg, mask_reg;
+		uint32_t irqs;
+
+		it_reg = readw(IRQ_REG(IT_REG1));
+		mask_reg = readw(IRQ_REG(MASK_IT_REG1));
+		irqs = it_reg & ~mask_reg;
+
+		it_reg = readw(IRQ_REG(IT_REG2));
+		mask_reg = readw(IRQ_REG(MASK_IT_REG2));
+		irqs |= (it_reg & ~mask_reg) << 16;
+
+		for (num = 0; num < 32; num++) {
+			if (irqs & (1 << num)) {
+				printd("i%d\n", num);
+				handler = irq_handlers[num];
+				if (handler)
+					handler(num);
+				/* clear this interrupt */
+				if (num < 16)
+					writew(~(1 << num), IRQ_REG(IT_REG1));
+				else
+					writew(~(1 << (num-16)), IRQ_REG(IT_REG2));
+			}
+		}
+		dputchar('\n');
+	}
+#endif
+	/* Start new IRQ agreement */
+	tmp = readb(IRQ_REG(IRQ_CTRL));
+	tmp |= 0x01;
+	writeb(tmp, IRQ_REG(IRQ_CTRL));
+}
+
+/* Entry point for FIQs */
+void fiq(void)
+{
+	uint8_t num, tmp;
+	irq_handler *handler;
+
+	num = readb(IRQ_REG(FIQ_NUM)) & 0x1f;
+	if (num) {
+		printd("f%02x\n", num);
+	}
+
+	handler = irq_handlers[num];
+
+	if (handler)
+		handler(num);
+
+	/* Start new FIQ agreement */
+	tmp = readb(IRQ_REG(IRQ_CTRL));
+	tmp |= 0x02;
+	writeb(tmp, IRQ_REG(IRQ_CTRL));
+}
+
+void irq_register_handler(enum irq_nr nr, irq_handler *handler)
+{
+	if (nr >= NR_IRQS)
+		return;
+
+	irq_handlers[nr] = handler;
+}
+
+#define BASE_ADDR_IBOOT_EXC	0x0080001C
+extern uint32_t _exceptions;
+
+/* Install the exception handlers to where the ROM loader jumps */
+void calypso_exceptions_install(void)
+{
+	uint32_t *exceptions_dst = (uint32_t *) BASE_ADDR_IBOOT_EXC;
+	uint32_t *exceptions_src = &_exceptions;
+	int i;
+
+	for (i = 0; i < 7; i++)
+		*exceptions_dst++ = *exceptions_src++;
+
+}
+
+static void set_default_priorities(void)
+{
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(default_irq_prio); i++) {
+		uint16_t val;
+		uint8_t prio = default_irq_prio[i];
+		if (prio > 31)
+			prio = 31;
+
+		val = readw(IRQ_REG(ILR_IRQ(i)));
+		val &= ~(0x1f << 2);
+		val |= prio << 2;
+		writew(val, IRQ_REG(ILR_IRQ(i)));
+	}
+}
+
+static uint32_t irq_nest_mask;
+/* mask off all interrupts that have a lower priority than irq_nr */
+static void mask_all_lower_prio_irqs(enum irq_nr irqnr)
+{
+	uint8_t our_prio = readb(IRQ_REG(ILR_IRQ(irqnr))) >> 2;
+	int i;
+
+	for (i = 0; i < _NR_IRQ; i++) {
+		uint8_t prio;
+
+		if (i == irqnr)
+			continue;
+
+		prio = readb(IRQ_REG(ILR_IRQ(i))) >> 2;
+		if (prio >= our_prio)
+			irq_nest_mask |= (1 << i);
+	}
+}
+
+void irq_init(void)
+{
+	/* set default priorities */
+	set_default_priorities();
+	/* mask all interrupts off */
+	writew(0xffff, IRQ_REG(MASK_IT_REG1));
+	writew(0xffff, IRQ_REG(MASK_IT_REG2));
+	/* clear all pending interrupts */
+	writew(0, IRQ_REG(IT_REG1));
+	writew(0, IRQ_REG(IT_REG2));
+	/* enable interrupts globally to the ARM core */
+	arm_enable_interrupts();
+}
diff --git a/src/target/firmware/calypso/keypad.c b/src/target/firmware/calypso/keypad.c
new file mode 100644
index 00000000..937f8bd8
--- /dev/null
+++ b/src/target/firmware/calypso/keypad.c
@@ -0,0 +1,176 @@
+/* Driver for the keypad attached to the TI Calypso */
+
+/* (C) 2010 by roh <roh@hyte.de>
+ * (C) 2013 by Steve Markgraf <steve@steve-m.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <defines.h>
+#include <debug.h>
+#include <delay.h>
+#include <memory.h>
+#include <keypad.h>
+
+#include <calypso/irq.h>
+#include <abb/twl3025.h>
+#include <comm/timer.h>
+
+#define KBR_LATCH_REG	0xfffe480a
+#define KBC_REG		0xfffe480c
+#define KBD_GPIO_INT	0xfffe4816
+#define KBD_GPIO_MASKIT	0xfffe4818
+
+static key_handler_t key_handler = NULL;
+
+void emit_key(uint8_t key, uint8_t state)
+{
+	printf("key=%u %s\n", key, state == PRESSED ? "pressed" : "released");
+
+	if(key_handler) {
+		key_handler(key, state);
+	}
+}
+
+volatile uint32_t lastbuttons = 0;
+static const uint8_t *btn_map;
+unsigned long power_hold = 0;
+
+void dispatch_buttons(uint32_t buttons)
+{
+	int i;
+	uint8_t state;
+
+	if ((buttons & (1 << btn_map[KEY_POWER]))) {
+		/* hold button 500ms to shut down */
+		if ((lastbuttons & (1 << btn_map[KEY_POWER]))) {
+			unsigned long elapsed = jiffies - power_hold;
+			if (elapsed > 50)
+				twl3025_power_off();
+			power_hold++;
+		} else
+		power_hold = jiffies;
+	}
+
+	if (buttons == lastbuttons)
+		return;
+
+	uint32_t diff = buttons ^ lastbuttons;
+	for (i = 0; i < BUTTON_CNT; i++) {
+		if (diff & (1 << btn_map[i])) {
+			state = (buttons & (1 << btn_map[i])) ? PRESSED : RELEASED;
+			emit_key(i, state);
+		}
+	}
+	lastbuttons = buttons;
+}
+
+static uint8_t	polling = 0;
+static uint8_t  with_interrupts = 0;
+
+static void keypad_irq(__unused enum irq_nr nr)
+{
+	/* enable polling */
+	polling = 1;
+	irq_disable(IRQ_KEYPAD_GPIO);
+}
+
+void keypad_init(const uint8_t *keymap, uint8_t interrupts)
+{
+	btn_map = keymap;
+	lastbuttons = 0;
+	polling = 0;
+	writew(0, KBD_GPIO_MASKIT);
+	writew(0, KBC_REG);
+
+	if(interrupts) {
+		with_interrupts = 1;
+		irq_register_handler(IRQ_KEYPAD_GPIO, &keypad_irq);
+		irq_config(IRQ_KEYPAD_GPIO, 0, 0, 0);
+		irq_enable(IRQ_KEYPAD_GPIO);
+	}
+}
+
+void keypad_set_handler(key_handler_t handler)
+{
+	key_handler = handler;
+}
+
+void keypad_poll()
+{
+	static uint16_t reg;
+	static uint16_t col;
+	static uint32_t buttons = 0, debounce1 = 0, debounce2 = 0;
+
+	if (with_interrupts && !polling)
+		return;
+
+	/* start polling */
+	if (polling == 1) {
+		writew(0x1f & ~0x1, KBC_REG); /* first col */
+		col = 0;
+		polling = 2;
+		return;
+	}
+
+	/* enable keypad irq after the signal settles */
+	if (polling == 3) {
+		if(with_interrupts) {
+			irq_enable(IRQ_KEYPAD_GPIO);
+			polling = 0;
+		} else {
+			polling = 1;
+		}
+		return;
+	}
+
+	reg = readw(KBR_LATCH_REG);
+	buttons = (buttons & ~(0x1f << (col * 5)))
+		| ((~reg & 0x1f) << (col * 5 ));
+	/* if key is released, stay in column for faster debounce */
+	if ((debounce1 | debounce2) & ~buttons) {
+		debounce2 = debounce1;
+		debounce1 = buttons;
+		return;
+	}
+
+	col++;
+	if (col > 5) {
+		uint32_t pwr_mask = (1 << btn_map[KEY_POWER]);
+		col = 0;
+		/* if power button, ignore other states */
+		if (buttons & pwr_mask)
+			buttons = lastbuttons | pwr_mask;
+		else if (lastbuttons & pwr_mask)
+			buttons = lastbuttons & ~pwr_mask;
+		dispatch_buttons(buttons);
+		if (buttons == 0) {
+			writew(0x0, KBC_REG);
+			polling = 3;
+			return;
+		}
+	}
+	if (col == 5)
+		writew(0xff, KBC_REG);
+	else
+		writew(0x1f & ~(0x1 << col ), KBC_REG);
+
+}
diff --git a/src/target/firmware/calypso/misc.c b/src/target/firmware/calypso/misc.c
new file mode 100644
index 00000000..460cc5d5
--- /dev/null
+++ b/src/target/firmware/calypso/misc.c
@@ -0,0 +1,60 @@
+
+#include <stdint.h>
+#include <stdio.h>
+#include <memory.h>
+
+/* dump a memory range */
+void memdump_range(unsigned int *ptr, unsigned int len)
+{
+	unsigned int *end = ptr + (len/4);
+	unsigned int *tmp;
+
+	for (tmp = ptr; tmp < end; tmp += 8) {
+		int i;
+		printf("%08X: ", (unsigned int) tmp);
+
+		for (i = 0; i < 8; i++)
+			printf("%08X %s", *(tmp+i), i == 3 ? " " : "");
+
+		putchar('\n');
+	}
+}
+
+#define KBIT 1024
+#define	MBIT (1024*KBIT)
+void dump_mem(void)
+{
+	puts("Dump 64kBits of internal ROM\n");
+	memdump_range((void *)0x03800000, 64*KBIT/8);
+
+	puts("Dump 8Mbits of external flash\n");
+	memdump_range((void *)0x00000000, 8*MBIT/8);
+
+	puts("Dump 2Mbits of internal RAM\n");
+	memdump_range((void *)0x00800000, 2*MBIT/8);
+
+	puts("Dump 2Mbits of external RAM\n");
+	memdump_range((void *)0x01000000, 2*MBIT/8);
+}
+
+#define REG_DEV_ID_CODE 	0xfffef000
+#define REG_DEV_VER_CODE	0xfffef002
+#define REG_DEV_ARMVER_CODE	0xfffffe00
+#define REG_cDSP_ID_CODE	0xfffffe02
+#define REG_DIE_ID_CODE		0xfffef010
+
+void dump_dev_id(void)
+{
+	int i;
+
+	printf("Device ID code: 0x%04x\n", readw(REG_DEV_ID_CODE));
+	printf("Device Version code: 0x%04x\n", readw(REG_DEV_VER_CODE));
+	printf("ARM ID code: 0x%04x\n", readw(REG_DEV_ARMVER_CODE));
+	printf("cDSP ID code: 0x%04x\n", readw(REG_cDSP_ID_CODE));
+	puts("Die ID code: ");
+	for (i = 0; i < 64/8; i += 4)
+		printf("%08x", readl(REG_DIE_ID_CODE+i));
+	putchar('\n');
+}
+
+
diff --git a/src/target/firmware/calypso/rtc.c b/src/target/firmware/calypso/rtc.c
new file mode 100644
index 00000000..45d759f3
--- /dev/null
+++ b/src/target/firmware/calypso/rtc.c
@@ -0,0 +1,78 @@
+/* Driver for Calypso RTC controller */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <defines.h>
+#include <debug.h>
+#include <memory.h>
+#include <calypso/irq.h>
+
+#define BASE_ADDR_RTC	0xfffe1800
+#define RTC_REG(x)	((void *)BASE_ADDR_RTC + (x))
+
+enum rtc_reg {
+	SECOND_REG		= 0x00,
+	MINUTES_REG		= 0x01,
+	HOURS_REG		= 0x02,
+	DAYS_REG		= 0x03,
+	MONTHS_REG		= 0x04,
+	YEARS_REG		= 0x05,
+	WEEK_REG		= 0x06,
+	/* reserved */
+	ALARM_SECOND_REG	= 0x08,
+	ALARM_MINUTES_REG	= 0x09,
+	ALARM_HOURS_REG		= 0x0a,
+	ALARM_DAYS_REG		= 0x0b,
+	ALARM_MONTHS_REG	= 0x0c,
+	ALARM_YEARS_REG		= 0x0d,
+	/* reserved */
+	/* reserved */
+	CTRL_REG		= 0x10,
+	STATUS_REG		= 0x11,
+	INT_REG			= 0x12,
+	COMP_LSB_REG		= 0x13,
+	COMP_MSB_REG		= 0x14,
+	RES_PROG_REG		= 0x15,
+};
+
+static int tick_ctr;
+
+static void rtc_irq_tick(__unused enum irq_nr nr)
+{
+	tick_ctr++;
+}
+
+void rtc_init(void)
+{
+	irq_register_handler(IRQ_RTC_TIMER, &rtc_irq_tick);
+	irq_config(IRQ_RTC_TIMER, 0, 1, 0);
+	irq_enable(IRQ_RTC_TIMER);
+
+	/* clear power-up reset */
+	writeb(0x80, RTC_REG(STATUS_REG));
+	/* enable RTC running */
+	writeb(0x01, RTC_REG(CTRL_REG));
+	/* enable periodic interrupts every second */
+	writeb(0x04, RTC_REG(INT_REG));
+}
diff --git a/src/target/firmware/calypso/sim.c b/src/target/firmware/calypso/sim.c
new file mode 100644
index 00000000..752628fd
--- /dev/null
+++ b/src/target/firmware/calypso/sim.c
@@ -0,0 +1,741 @@
+/* Driver for Simcard Controller inside TI Calypso/Iota */
+
+/* (C) 2010 by Philipp Fabian Benedikt Maier <philipp-maier@runningserver.com>
+ * (C) 2011 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+/* Uncomment to debug sim */
+/* #define DEBUG */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <string.h>
+#include <delay.h>
+#include <osmocom/core/msgb.h>
+#include <layer1/l23_api.h>
+#include <abb/twl3025.h>
+#include <calypso/sim.h>
+#include <calypso/irq.h>
+
+#include <l1ctl_proto.h>
+
+#define SIM_CLASS		0xA0
+	/* Class that contains the following instructions */
+#define SIM_GET_RESPONSE	0xC0
+	/* Get the response of a command from the card */
+#define SIM_READ_BINARY		0xB0	/* Read file in binary mode */
+#define SIM_READ_RECORD		0xB2	/* Read record in binary mode */
+
+enum {
+	SIM_STATE_IDLE,
+	SIM_STATE_TX_HEADER,
+	SIM_STATE_RX_STATUS,
+	SIM_STATE_RX_ACK,
+	SIM_STATE_RX_ACK_DATA,
+	SIM_STATE_TX_DATA,
+};
+
+#define L3_MSG_HEAD 4
+
+static uint8_t sim_data[256]; /* buffer for SIM command */
+static volatile uint16_t sim_len = 0; /* lenght of data in sim_data[] */
+static volatile uint8_t sim_state = SIM_STATE_IDLE;
+	/* current state of SIM process */
+static volatile uint8_t sim_ignore_waiting_char = 0;
+	/* signal ignoring of NULL procedure byte */
+static volatile int sim_rx_character_count = 0;
+	/* How many bytes have been received by calypso_sim_receive() */
+static volatile int sim_rx_max_character_count = 0;
+	/* How many bytes have been received by calypso_sim_receive() */
+static volatile int sim_tx_character_count = 0;
+	/* How many bytes have been transmitted by calypso_sim_transmit() */
+static volatile int sim_tx_character_length = 0;
+	/* How many bytes have to be transmitted by calypso_sim_transmit() */
+static uint8_t *rx_buffer = 0;
+	/* RX-Buffer that is issued by calypso_sim_receive() */
+static uint8_t *tx_buffer = 0;
+	/* TX-Buffer that is issued by calypso_sim_transmit() */
+static volatile int rxDoneFlag = 0;
+	/* Used for rx synchronization instead of a semaphore in calypso_sim_receive() */
+static volatile int txDoneFlag = 0;
+	/* Used for rx synchronization instead of a semaphore in calypso_sim_transmit() */
+
+/* Display Register dump */
+void calypso_sim_regdump(void)
+{
+#ifdef DEBUG
+	unsigned int regVal;
+
+#define SIM_DEBUG_OUTPUTDELAY 200
+
+	puts("\n\n\n");
+	puts("====================== CALYPSO SIM REGISTER DUMP =====================\n");
+	puts("Reg_sim_cmd register (R/W) - FFFE:0000\n");
+
+	regVal = readw(REG_SIM_CMD);
+	printf("  |-REG_SIM_CMD = %04x\n", readw(REG_SIM_CMD));
+
+	if(regVal & REG_SIM_CMD_CMDCARDRST)
+		puts("  |  |-REG_SIM_CMD_CMDCARDRST = 1 ==> SIM card reset sequence enabled.\n");
+	else
+		puts("  |  |-REG_SIM_CMD_CMDCARDRST = 0 ==> SIM card reset sequence disabled.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CMD_CMDIFRST)
+		puts("  |  |-REG_SIM_CMD_CMDIFRST = 1\n");
+	else
+		puts("  |  |-REG_SIM_CMD_CMDIFRST = 0\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CMD_CMDSTOP)
+		puts("  |  |-REG_SIM_CMD_CMDSTOP = 1\n");
+	else
+		puts("  |  |-REG_SIM_CMD_CMDSTOP = 0\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CMD_CMDSTART)
+		puts("  |  |-REG_SIM_CMD_CMDSTART = 1 ==> SIM card start procedure active.\n");
+	else
+		puts("  |  |-REG_SIM_CMD_CMDSTART = 0\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CMD_CMDSTART)
+		puts("  |  |-REG_SIM_CMD_MODULE_CLK_EN = 1 ==> Clock of the module enabled.\n");
+	else
+		puts("  |  |-REG_SIM_CMD_MODULE_CLK_EN = 0 ==> Clock of the module disabled.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	regVal = readw(REG_SIM_STAT);
+	printf("  |-REG_SIM_STAT = %04x\n", regVal);
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_STAT_STATNOCARD)
+		puts("  |  |-REG_SIM_STAT_STATNOCARD = 1 ==> No card!\n");
+	else
+		puts("  |  |-REG_SIM_STAT_STATNOCARD = 0 ==> Card detected!\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_STAT_STATTXPAR)
+		puts("  |  |-REG_SIM_STAT_STATTXPAR = 1 ==> Parity ok!\n");
+	else
+		puts("  |  |-REG_SIM_STAT_STATTXPAR = 0 ==> Parity error!\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_STAT_STATFIFOFULL)
+		puts("  |  |-REG_SIM_STAT_STATFIFOFULL = 1 ==> Fifo full!\n");
+	else
+		puts("  |  |-REG_SIM_STAT_STATFIFOFULL = 0\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_STAT_STATFIFOEMPTY)
+		puts("  |  |-REG_SIM_STAT_STATFIFOEMPTY = 1 ==> Fifo empty!\n");
+	else
+		puts("  |  |-REG_SIM_STAT_STATFIFOEMPTY = 0\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	regVal = readw(REG_SIM_CONF1);
+	printf("  |-REG_SIM_CONF1 = %04x\n", regVal);
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFCHKPAR)
+		puts("  |  |-REG_SIM_CONF1_CONFCHKPAR = 1 ==> Parity check on reception enabled.\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFCHKPAR = 0 ==> Parity check on reception disabled.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFCODCONV)
+		puts("  |  |-REG_SIM_CONF1_CONFCODCONV = 1 ==> Coding convention is inverse.\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFCODCONV = 0 ==> Coding convention is direct (normal).\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFTXRX)
+		puts("  |  |-REG_SIM_CONF1_CONFTXRX = 1 ==> SIO line direction is in transmit mode.\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFTXRX = 0 ==> SIO line direction is in receive mode.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFSCLKEN)
+		puts("  |  |-REG_SIM_CONF1_CONFSCLKEN = 1 ==> SIM clock in normal mode.\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFSCLKEN = 0 ==> SIM clock in standby mode.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_reserved)
+		puts("  |  |-REG_SIM_CONF1_reserved = 1 ==> ETU period is 4*1/Fsclk.\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_reserved = 0 ==> ETU period is CONFETUPERIOD.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFSCLKDIV)
+		puts("  |  |-REG_SIM_CONF1_CONFSCLKDIV = 1 ==> SIM clock frequency is 13/8 Mhz.\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFSCLKDIV = 0 ==> SIM clock frequency is 13/4 Mhz.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFSCLKLEV)
+		puts("  |  |-REG_SIM_CONF1_CONFSCLKLEV = 1 ==> SIM clock idle level is high.\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFSCLKLEV = 0 ==> SIM clock idle level is low.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFETUPERIOD)
+		puts("  |  |-REG_SIM_CONF1_CONFETUPERIOD = 1 ==> ETU period is 512/8*1/Fsclk.\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFETUPERIOD = 0 ==> ETU period is 372/8*1/Fsclk.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFBYPASS)
+		puts("  |  |-REG_SIM_CONF1_CONFBYPASS = 1 ==> Hardware timers and start and stop sequences are bypassed.\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFBYPASS = 0 ==> Hardware timers and start and stop sequences are normal.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFSVCCLEV)
+		puts("  |  |-REG_SIM_CONF1_CONFSVCCLEV = 1 ==> SVCC Level is high (Only valid when CONFBYPASS = 1).\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFSVCCLEV = 0 ==> SVCC Level is low (Only valid when CONFBYPASS = 1).\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFSRSTLEV)
+		puts("  |  |-REG_SIM_CONF1_CONFSRSTLEV = 1 ==> SRST Level is high (Only valid when CONFBYPASS = 1).\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFSRSTLEV = 0 ==> SRST Level is low (Only valid when CONFBYPASS = 1).\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+ 	printf("  |  |-REG_SIM_CONF1_CONFTRIG = 0x%x (FIFO trigger level)\n",(regVal >> REG_SIM_CONF1_CONFTRIG) & REG_SIM_CONF1_CONFTRIG_MASK);
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_CONF1_CONFSIOLOW)
+		puts("  |  |-REG_SIM_CONF1_CONFSIOLOW = 1 ==> I/O is forced to low.\n");
+	else
+		puts("  |  |-REG_SIM_CONF1_CONFSIOLOW = 0\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	regVal = readw(REG_SIM_CONF2);
+	printf("  |-REG_SIM_CONF2 = %04x\n", regVal);
+ 	printf("  |  |-REG_SIM_CONF2_CONFTFSIM = 0x%x (time delay for filtering of SIM_CD)\n",(regVal >> REG_SIM_CONF2_CONFTFSIM) & REG_SIM_CONF2_CONFTFSIM_MASK);
+ 	printf("  |  |-REG_SIM_CONF2_CONFTDSIM = 0x%x (time delay for contact activation/deactivation)\n",(regVal >> REG_SIM_CONF2_CONFTDSIM) & REG_SIM_CONF2_CONFTDSIM_MASK);
+ 	printf("  |  |-REG_SIM_CONF2_CONFWAITI = 0x%x (CONFWAITI overflow wait time between two received chars)\n",(regVal >> REG_SIM_CONF2_CONFWAITI) & REG_SIM_CONF2_CONFWAITI_MASK);
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	regVal = readw(REG_SIM_IT);
+	printf("  |-REG_SIM_IT = %04x\n", regVal);
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_IT_SIM_NATR)
+		puts("  |  |-REG_SIM_IT_SIM_NATR = 1 ==> No answer to reset!\n");
+	else
+		puts("  |  |-REG_SIM_IT_SIM_NATR = 0 ==> On read access to REG_SIM_IT.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_IT_SIM_WT)
+		puts("  |  |-REG_SIM_IT_SIM_WT = 1 ==> Character underflow!\n");
+	else
+		puts("  |  |-REG_SIM_IT_SIM_WT = 0 ==> On read access to REG_SIM_IT.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_IT_SIM_OV)
+		puts("  |  |-REG_SIM_IT_SIM_OV = 1 ==> Receive overflow!\n");
+	else
+		puts("  |  |-REG_SIM_IT_SIM_OV = 0 ==> On read access to REG_SIM_IT.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_IT_SIM_TX)
+		puts("  |  |-REG_SIM_IT_SIM_TX = 1 ==> Waiting for character to transmit...\n");
+	else
+	{
+		puts("  |  |-REG_SIM_IT_SIM_TX = 0 ==> On write access to REG_SIM_DTX or on switching\n");
+		puts("  |  |                           from transmit to receive mode (CONFTXRX bit)\n");
+	}
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_IT_SIM_RX)
+		puts("  |  |-REG_SIM_IT_SIM_RX = 1 ==> Waiting characters to be read...\n");
+	else
+		puts("  |  |-REG_SIM_IT_SIM_RX = 0 ==> On read access to REG_SIM_DRX.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	regVal = readw(REG_SIM_DRX);
+	printf("  |-REG_SIM_DRX = %04x\n", regVal);
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+ 	printf("  |  |-REG_SIM_DRX_SIM_DRX = 0x%x (next data byte in FIFO available for reading)\n",(regVal >> REG_SIM_DRX_SIM_DRX) & REG_SIM_DRX_SIM_DRX_MASK);
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_DRX_STATRXPAR)
+		puts("  |  |-REG_SIM_DRX_STATRXPAR = 1 ==> Parity Ok.\n");
+	else
+		puts("  |  |-REG_SIM_DRX_STATRXPAR = 0 ==> Parity error!\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	regVal = readw(REG_SIM_DTX);
+	printf("  |-REG_SIM_DTX = %02x (next data byte to be transmitted)\n", regVal);
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	regVal = readw(REG_SIM_MASKIT);
+	printf("  |-REG_SIM_MASKIT = %04x\n", regVal);
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_MASKIT_MASK_SIM_NATR)
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_NATR = 1 ==> No-answer-to-reset interrupt is masked.\n");
+	else
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_NATR = 0 ==> No-answer-to-reset interrupt is unmasked.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_MASKIT_MASK_SIM_WT)
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_WT = 1 ==> Character wait-time overflow interrupt is masked.\n");
+	else
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_WT = 0 ==> Character wait-time overflow interrupt is unmasked.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_MASKIT_MASK_SIM_OV)
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_OV = 1 ==> Receive overflow interrupt is masked.\n");
+	else
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_OV = 0 ==> Receive overflow interrupt is unmasked.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_MASKIT_MASK_SIM_TX)
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_TX = 1 ==> Waiting characters to be transmit interrupt is masked.\n");
+	else
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_TX = 0 ==> Waiting characters to be transmit interrupt is unmasked.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_MASKIT_MASK_SIM_RX)
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_RX = 1 ==> Waiting characters to be read interrupt is masked.\n");
+	else
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_RX = 0 ==> Waiting characters to be read interrupt is unmasked.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	if(regVal & REG_SIM_MASKIT_MASK_SIM_CD)
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_CD = 1 ==> SIM card insertion/extraction interrupt is masked.\n");
+	else
+		puts("  |  |-REG_SIM_MASKIT_MASK_SIM_CD = 0 ==> SIM card insertion/extraction interrupt is unmasked.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+
+	regVal = REG_SIM_IT_CD;
+	printf("  |-REG_SIM_IT_CD = %04x\n", regVal);
+	if(regVal & REG_SIM_IT_CD_IT_CD)
+		puts("     |-REG_SIM_IT_CD_IT_CD = 1 ==> SIM card insertion/extraction interrupt is masked.\n");
+	else
+		puts("     |-REG_SIM_IT_CD_IT_CD = 0 ==> SIM card insertion/extraction interrupt is unmasked.\n");
+	delay_ms(SIM_DEBUG_OUTPUTDELAY);
+#endif
+	return;
+}
+
+/* Receive raw data through the sim interface */
+int calypso_sim_receive(uint8_t *data, uint8_t len)
+{
+	printd("Triggering SIM reception\n");
+
+	/* Prepare buffers and flags */
+	rx_buffer = data;
+	sim_rx_character_count = 0;
+	rxDoneFlag = 0;
+	sim_rx_max_character_count = len;
+
+	/* Switch I/O direction to input */
+	writew(readw(REG_SIM_CONF1) & ~REG_SIM_CONF1_CONFTXRX, REG_SIM_CONF1);
+
+	/* Unmask the interrupts that are needed to perform this action */
+	writew(~(REG_SIM_MASKIT_MASK_SIM_RX | REG_SIM_MASKIT_MASK_SIM_WT),
+		REG_SIM_MASKIT);
+
+	return 0;
+}
+
+/* Transmit raw data through the sim interface */
+int calypso_sim_transmit(uint8_t *data, int length)
+{
+	printd("Triggering SIM transmission\n");
+
+	/* Prepare buffers and flags */
+	tx_buffer = data;
+	sim_tx_character_count = 0;
+	txDoneFlag = 0;
+	sim_tx_character_length = length;
+
+	/* Switch I/O direction to output */
+	writew(readw(REG_SIM_CONF1) | REG_SIM_CONF1_CONFTXRX, REG_SIM_CONF1);
+
+	/* Unmask the interrupts that are needed to perform this action */
+	writew(~(REG_SIM_MASKIT_MASK_SIM_TX), REG_SIM_MASKIT);
+
+	/* Transmit the first byte manually to start the interrupt cascade */
+	writew(*tx_buffer,REG_SIM_DTX);
+	tx_buffer++;
+	sim_tx_character_count++;
+
+	return 0;
+}
+
+
+/* IRQ-Handler for simcard interface */
+void sim_irq_handler(enum irq_nr irq)
+{
+	int regVal = readw(REG_SIM_IT);
+
+
+	/* Display interrupt information */
+	printd("SIM-ISR: ");
+
+	if(regVal & REG_SIM_IT_SIM_NATR) {
+		printd(" No answer to reset!\n");
+	}
+
+	/* Used by: calypso_sim_receive() to determine when the transmission
+	 * is over
+	 */
+	if(regVal & REG_SIM_IT_SIM_WT) {
+		printd(" Character underflow!\n");
+		rxDoneFlag = 1;
+
+	}
+
+	if(regVal & REG_SIM_IT_SIM_OV) {
+		printd(" Receive overflow!\n");
+	}
+
+	/* Used by: calypso_sim_transmit() to transmit the data */
+	if(regVal & REG_SIM_IT_SIM_TX) {
+		printd(" Waiting for transmit...\n");
+		if(sim_tx_character_count >= sim_tx_character_length) {
+			txDoneFlag = 1;
+		} else {
+			writew(*tx_buffer,REG_SIM_DTX);
+			tx_buffer++;
+			sim_tx_character_count++;
+
+			/* its essential to immediately switch to RX after TX
+			 * is done
+			 */
+			if(sim_tx_character_count >= sim_tx_character_length) {
+				/* TODO: set a proper delay here, 4 is to
+				   long if not debugging and no delay is too
+				   short */
+//				delay_ms(1);
+				/* Switch I/O direction to input */
+				writew(readw(REG_SIM_CONF1) &
+					~REG_SIM_CONF1_CONFTXRX, REG_SIM_CONF1);
+			}
+		}
+	}
+
+	/* Used by: calypso_sim_receive() to receive the incoming data */
+	if(regVal & REG_SIM_IT_SIM_RX) {
+		uint8_t ch = (uint8_t) (readw(REG_SIM_DRX) & 0xFF);
+
+		/* ignore NULL procedure byte */
+		if(ch == 0x60 && sim_ignore_waiting_char) {
+			printd(" 0x60 received...\n");
+			return;
+		}
+
+		printd(" Waiting for read (%02X)...\n", ch);
+
+		/* Increment character count - this is what
+		 * calypso_sim_receive() hands back
+		 */
+		sim_rx_character_count++;
+
+		/* Read byte from rx-fifo and write it to the issued buffer */
+		*rx_buffer = ch;
+		rx_buffer++;
+
+		/* to maximise SIM access speed, stop waiting after
+		   all the expected characters have been received. */
+		if (sim_rx_max_character_count
+		 && sim_rx_character_count >= sim_rx_max_character_count) {
+			printd(" Max characters received!\n");
+			rxDoneFlag = 1;
+		}
+	}
+}
+
+/* simm command from layer 23 */
+void sim_apdu(uint16_t len, uint8_t *data)
+{
+	if (sim_state != SIM_STATE_IDLE) {
+		puts("Sim reader currently busy...\n");
+		return;
+	}
+	memcpy(sim_data, data, len);
+	sim_len = len;
+}
+
+/* handling sim events */
+void sim_handler(void)
+{
+	static struct msgb *msg;
+	struct l1ctl_hdr *l1h;
+	static uint8_t mode;
+	static uint8_t *response;
+	static uint16_t length;
+
+	switch (sim_state) {
+	case SIM_STATE_IDLE:
+		if (!sim_len)
+			break; /* wait for SIM command */
+		/* check if instructions expects a response */
+		if (/* GET RESPONSE needs SIM_APDU_GET */
+		    (sim_len == 5 && sim_data[0] == SIM_CLASS &&
+		     sim_data[1] == SIM_GET_RESPONSE && sim_data[2] == 0x00 &&
+		     sim_data[3] == 0x00) ||
+		    /* READ BINARY/RECORD needs SIM_APDU_GET */
+		     (sim_len >= 5 && sim_data[0] == SIM_CLASS &&
+		      (sim_data[1] == SIM_READ_BINARY ||
+		       sim_data[1] == SIM_READ_RECORD)))
+			mode = SIM_APDU_GET;
+		else
+			mode = SIM_APDU_PUT;
+
+		length = sim_data[4];
+
+		/* allocate space for expected response */
+		msg = msgb_alloc_headroom(256, L3_MSG_HEAD
+					+ sizeof(struct l1ctl_hdr), "l1ctl1");
+		response = msgb_put(msg, length + 2 + 1);
+
+		sim_state = SIM_STATE_TX_HEADER;
+
+		/* send APDU header */
+		calypso_sim_transmit(sim_data, 5);
+		break;
+	case SIM_STATE_TX_HEADER:
+		if (!txDoneFlag)
+			break; /* wait until header is transmitted */
+		/* Disable all interrupt driven functions */
+		writew(0xFF, REG_SIM_MASKIT);
+		/* Case 1: No input, No Output */
+		if (length == 0) {
+			sim_state = SIM_STATE_RX_STATUS;
+			calypso_sim_receive(response + 1, 2);
+			break;
+		}
+		/* Case 2: No input / Output of known length */
+		if (mode == SIM_APDU_PUT) {
+			sim_state = SIM_STATE_RX_ACK;
+			calypso_sim_receive(response, 1);
+			break;
+		/* Case 4: Input / No output */
+		} else {
+			sim_state = SIM_STATE_RX_ACK_DATA;
+			calypso_sim_receive(response, length + 1 + 2);
+		}
+		break;
+	case SIM_STATE_RX_STATUS:
+		if (!rxDoneFlag)
+			break; /* wait until data is received */
+		/* Disable all interrupt driven functions */
+		writew(0xFF, REG_SIM_MASKIT);
+		/* disable special ignore case */
+		sim_ignore_waiting_char = 0;
+		/* wrong number of bytes received */
+		if (sim_rx_character_count != 2) {
+			puts("SIM: Failed to read status\n");
+			goto error;
+		}
+		msgb_pull(msg, length + 1); /* pull up to status info */
+		goto queue;
+	case SIM_STATE_RX_ACK:
+		if (!rxDoneFlag)
+			break; /* wait until data is received */
+		/* Disable all interrupt driven functions */
+		writew(0xFF, REG_SIM_MASKIT);
+		/* error received */
+		if (sim_rx_character_count == 2) {
+			puts("SIM: command failed\n");
+			msgb_pull(msg, msg->len - 2);
+			msg->data[0] = response[0];
+			msg->data[1] = response[1];
+			goto queue;
+		}
+		/* wrong number of bytes received */
+		if (sim_rx_character_count != 1) {
+			puts("SIM: ACK read failed\n");
+			goto error;
+		}
+		if (response[0] != sim_data[1]) {
+			puts("SIM: ACK does not match request\n");
+			goto error;
+		}
+		sim_state = SIM_STATE_TX_DATA;
+		calypso_sim_transmit(sim_data + 5, length);
+		break;
+	case SIM_STATE_TX_DATA:
+		if (!txDoneFlag)
+			break; /* wait until data is transmitted */
+		/* Disable all interrupt driven functions */
+		writew(0xFF, REG_SIM_MASKIT);
+		/* Ignore waiting char for RUN GSM ALGORITHM */
+		/* TODO: implement proper handling of the "Procedure Bytes"
+		   than this is no longer needed */
+		if(sim_data[1] == 0x88)
+			sim_ignore_waiting_char = 1;
+		sim_state = SIM_STATE_RX_STATUS;
+		calypso_sim_receive(response + length + 1, 2);
+		break;
+	case SIM_STATE_RX_ACK_DATA:
+		if (!rxDoneFlag)
+			break; /* wait until data is received */
+		/* Disable all interrupt driven functions */
+		writew(0xFF, REG_SIM_MASKIT);
+		/* error received */
+		if (sim_rx_character_count == 2) {
+			puts("SIM: command failed\n");
+			msgb_pull(msg, msg->len - 2);
+			msg->data[0] = response[0];
+			msg->data[1] = response[1];
+			goto queue;
+		}
+		/* wrong number of bytes received */
+		if (sim_rx_character_count != length + 1 + 2) {
+			puts("SIM: Failed to read data\n");
+			goto error;
+		}
+		msgb_pull(msg, 1); /* pull ACK byte */
+		goto queue;
+	}
+
+	return;
+
+error:
+	msgb_pull(msg, msg->len - 2);
+	msg->data[0] = 0;
+	msg->data[1] = 0;
+queue:
+	printf("SIM Response (%d): %s\n", msg->len,
+		osmo_hexdump(msg->data, msg->len));
+	l1h = (struct l1ctl_hdr *) msgb_push(msg, sizeof(*l1h));
+	l1h->msg_type = L1CTL_SIM_CONF;
+	l1h->flags = 0;
+	msg->l1h = (uint8_t *)l1h;
+	l1_queue_for_l2(msg);
+	/* go IDLE */
+	sim_state = SIM_STATE_IDLE;
+	sim_len = 0;
+
+	return;
+}
+
+/* Initialize simcard interface */
+void calypso_sim_init(void)
+{
+	/* Register IRQ handler and turn interrupts on */
+	printd("SIM: Registering interrupt handler for simcard-interface\n");
+
+	irq_register_handler(IRQ_SIMCARD, &sim_irq_handler);
+
+#if 1
+	irq_config(IRQ_SIMCARD, 0, 0, 0xff);
+#else
+	irq_config(IRQ_SIMCARD, 0, 0, 1);
+#endif
+
+	irq_enable(IRQ_SIMCARD);
+}
+
+/* Apply power to the simcard (use nullpointer to ignore atr) */
+int calypso_sim_powerup(uint8_t *atr)
+{
+	/* Enable level shifters and voltage regulator */
+#if 1  // 2.9V
+	twl3025_reg_write(VRPCSIM, VRPCSIM_SIMLEN | VRPCSIM_RSIMEN
+					| VRPCSIM_SIMSEL);
+#else // 1.8V
+	twl3025_reg_write(VRPCSIM, VRPCSIM_SIMLEN | VRPCSIM_RSIMEN);
+#endif
+	printd(" * Power enabled!\n");
+	delay_ms(SIM_OPERATION_DELAY);
+
+	/* Enable clock */
+	writew(REG_SIM_CMD_MODULE_CLK_EN | REG_SIM_CMD_CMDSTART, REG_SIM_CMD);
+	printd(" * Clock enabled!\n");
+	delay_ms(SIM_OPERATION_DELAY);
+
+	/* Release reset */
+	writew(readw(REG_SIM_CONF1) | REG_SIM_CONF1_CONFBYPASS
+				| REG_SIM_CONF1_CONFSRSTLEV
+				| REG_SIM_CONF1_CONFSVCCLEV, REG_SIM_CONF1);
+	printd(" * Reset released!\n");
+
+	/* Catch ATR */
+	if(atr != 0) {
+		calypso_sim_receive(atr, 0);
+		while (!rxDoneFlag)
+			;
+	}
+
+	return 0;
+}
+
+
+/* Powerdown simcard */
+void calypso_sim_powerdown(void)
+{
+	writew(readw(REG_SIM_CONF1) & ~REG_SIM_CONF1_CONFBYPASS, REG_SIM_CONF1);
+	printd(" * Reset pulled down!\n");
+	delay_ms(SIM_OPERATION_DELAY);
+
+	writew(REG_SIM_CMD_MODULE_CLK_EN | REG_SIM_CMD_CMDSTOP, REG_SIM_CMD);
+	printd(" * Clock disabled!\n");
+	delay_ms(SIM_OPERATION_DELAY);
+
+	writew(0, REG_SIM_CMD);
+	printd(" * Module disabled!\n");
+	delay_ms(SIM_OPERATION_DELAY);
+
+	/* Disable level shifters and voltage regulator */
+	twl3025_reg_write(VRPCSIM, 0);
+	printd(" * Power disabled!\n");
+	delay_ms(SIM_OPERATION_DELAY);
+
+	return;
+}
+
+/* reset the simcard (see note 1) */
+int calypso_sim_reset(uint8_t *atr)
+{
+
+	/* Pull reset down */
+	writew(readw(REG_SIM_CONF1) & ~REG_SIM_CONF1_CONFSRSTLEV,
+		REG_SIM_CONF1);
+	printd(" * Reset pulled down!\n");
+
+	delay_ms(SIM_OPERATION_DELAY);
+
+	/* Pull reset down */
+	writew(readw(REG_SIM_CONF1) | REG_SIM_CONF1_CONFSRSTLEV, REG_SIM_CONF1);
+	printd(" * Reset released!\n");
+
+	/* Catch ATR */
+	if(atr != 0) {
+		calypso_sim_receive(atr, 0);
+		while (!rxDoneFlag)
+			;
+	}
+
+	return 0;
+}
+
diff --git a/src/target/firmware/calypso/spi.c b/src/target/firmware/calypso/spi.c
new file mode 100644
index 00000000..049ac080
--- /dev/null
+++ b/src/target/firmware/calypso/spi.c
@@ -0,0 +1,141 @@
+/* Driver for SPI Master Controller inside TI Calypso */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+//#define DEBUG
+#include <debug.h>
+
+#include <memory.h>
+#include <spi.h>
+#include <delay.h>
+
+#define BASE_ADDR_SPI	0xfffe3000
+#define SPI_REG(n)	(BASE_ADDR_SPI+(n))
+
+enum spi_regs {
+	REG_SET1	= 0x00,
+	REG_SET2	= 0x02,
+	REG_CTRL	= 0x04,
+	REG_STATUS	= 0x06,
+	REG_TX_LSB	= 0x08,
+	REG_TX_MSB	= 0x0a,
+	REG_RX_LSB	= 0x0c,
+	REG_RX_MSB	= 0x0e,
+};
+
+#define SPI_SET1_EN_CLK		(1 << 0)
+#define SPI_SET1_WR_IRQ_DIS	(1 << 4)
+#define SPI_SET1_RDWR_IRQ_DIS	(1 << 5)
+
+#define SPI_CTRL_RDWR		(1 << 0)
+#define SPI_CTRL_WR		(1 << 1)
+#define SPI_CTRL_NB_SHIFT	2
+#define SPI_CTRL_AD_SHIFT	7
+
+#define SPI_STATUS_RE		(1 << 0)	/* Read End */
+#define SPI_STATUS_WE		(1 << 1)	/* Write End */
+
+void spi_init(void)
+{
+	writew(SPI_SET1_EN_CLK | SPI_SET1_WR_IRQ_DIS | SPI_SET1_RDWR_IRQ_DIS,
+	       SPI_REG(REG_SET1));
+
+	writew(0x0001, SPI_REG(REG_SET2));
+}
+
+int spi_xfer(uint8_t dev_idx, uint8_t bitlen, const void *dout, void *din)
+{
+	uint8_t bytes_per_xfer;
+	uint8_t reg_status, reg_ctrl = 0;
+	uint32_t tmp;
+
+	if (bitlen == 0)
+		return 0;
+
+	if (bitlen > 32)
+		return -1;
+
+	if (dev_idx > 4)
+		return -1;
+
+	bytes_per_xfer = bitlen / 8;
+	if (bitlen % 8)
+		bytes_per_xfer ++;
+
+	reg_ctrl |= (bitlen - 1) << SPI_CTRL_NB_SHIFT;
+	reg_ctrl |= (dev_idx & 0x7) << SPI_CTRL_AD_SHIFT;
+
+	if (bitlen <= 8) {
+		tmp = *(uint8_t *)dout;
+		tmp <<= 24 + (8-bitlen);	/* align to MSB */
+	} else if (bitlen <= 16) {
+		tmp = *(uint16_t *)dout;
+		tmp <<= 16 + (16-bitlen);	/* align to MSB */
+	} else {
+		tmp = *(uint32_t *)dout;
+		tmp <<= (32-bitlen);		/* align to MSB */
+	}
+	printd("spi_xfer(dev_idx=%u, bitlen=%u, data_out=0x%08x): ",
+		dev_idx, bitlen, tmp);
+
+	/* fill transmit registers */
+	writew(tmp >> 16, SPI_REG(REG_TX_MSB));
+	writew(tmp & 0xffff, SPI_REG(REG_TX_LSB));
+
+	/* initiate transfer */
+	if (din)
+		reg_ctrl |= SPI_CTRL_RDWR;
+	else
+		reg_ctrl |= SPI_CTRL_WR;
+	writew(reg_ctrl, SPI_REG(REG_CTRL));
+	printd("reg_ctrl=0x%04x ", reg_ctrl);
+
+	/* wait until the transfer is complete */
+	while (1) {
+		reg_status = readw(SPI_REG(REG_STATUS));
+		printd("status=0x%04x ", reg_status);
+		if (din && (reg_status & SPI_STATUS_RE))
+			break;
+		else if (reg_status & SPI_STATUS_WE)
+			break;
+	}
+	/* FIXME: calibrate how much delay we really need (seven 13MHz cycles) */
+	delay_ms(1);
+
+	if (din) {
+		tmp = readw(SPI_REG(REG_RX_MSB)) << 16;
+		tmp |= readw(SPI_REG(REG_RX_LSB));
+		printd("data_in=0x%08x ", tmp);
+
+		if (bitlen <= 8)
+			*(uint8_t *)din = tmp & 0xff;
+		else if (bitlen <= 16)
+			*(uint16_t *)din = tmp & 0xffff;
+		else
+			*(uint32_t *)din = tmp;
+	}
+	dputchar('\n');
+
+	return 0;
+}
diff --git a/src/target/firmware/calypso/timer.c b/src/target/firmware/calypso/timer.c
new file mode 100644
index 00000000..1dd55f26
--- /dev/null
+++ b/src/target/firmware/calypso/timer.c
@@ -0,0 +1,156 @@
+/* Calypso DBB internal Timer Driver */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdio.h>
+#include <memory.h>
+#include <stdint.h>
+
+#include <defines.h>
+
+#include <calypso/timer.h>
+#include <calypso/irq.h>
+
+#define BASE_ADDR_TIMER		0xfffe3800
+#define TIMER2_OFFSET		0x3000
+
+#define TIMER_REG(n, m)		(((n)-1) ? (BASE_ADDR_TIMER + TIMER2_OFFSET + (m)) : (BASE_ADDR_TIMER + (m)))
+
+enum timer_reg {
+	CNTL_TIMER	= 0x00,
+	LOAD_TIMER	= 0x02,
+	READ_TIMER	= 0x04,
+};
+
+enum timer_ctl {
+	CNTL_START		= (1 << 0),
+	CNTL_AUTO_RELOAD	= (1 << 1),
+	CNTL_CLOCK_ENABLE	= (1 << 5),
+};
+
+/* Regular Timers (1 and 2) */
+
+void hwtimer_enable(int num, int on)
+{
+	uint8_t ctl;
+
+	if (num < 1 || num > 2) {
+		printf("Unknown timer %u\n", num);
+		return;
+	}
+
+	ctl = readb(TIMER_REG(num, CNTL_TIMER));
+	if (on)
+		ctl |= CNTL_START|CNTL_CLOCK_ENABLE;
+	else
+		ctl &= ~CNTL_START;
+	writeb(ctl, TIMER_REG(num, CNTL_TIMER));
+}
+
+void hwtimer_config(int num, uint8_t pre_scale, int auto_reload)
+{
+	uint8_t ctl;
+
+	ctl = (pre_scale & 0x7) << 2;
+	if (auto_reload)
+		ctl |= CNTL_AUTO_RELOAD;
+
+	writeb(ctl, TIMER_REG(num, CNTL_TIMER));
+}
+
+void hwtimer_load(int num, uint16_t val)
+{
+	writew(val, TIMER_REG(num, LOAD_TIMER));
+}
+
+uint16_t hwtimer_read(int num)
+{
+	uint8_t ctl = readb(TIMER_REG(num, CNTL_TIMER));
+
+	/* somehow a read results in an abort */
+	if ((ctl & (CNTL_START|CNTL_CLOCK_ENABLE)) != (CNTL_START|CNTL_CLOCK_ENABLE))
+		return 0xFFFF;
+	return readw(TIMER_REG(num, READ_TIMER));
+}
+
+void hwtimer_init(void)
+{
+	writeb(CNTL_CLOCK_ENABLE, TIMER_REG(1, CNTL_TIMER));
+	writeb(CNTL_CLOCK_ENABLE, TIMER_REG(2, CNTL_TIMER));
+}
+
+/* Watchdog Timer */
+
+#define BASE_ADDR_WDOG		0xfffff800
+#define WDOG_REG(m)		(BASE_ADDR_WDOG + m)
+
+enum wdog_reg {
+	WD_CNTL_TIMER	= CNTL_TIMER,
+	WD_LOAD_TIMER	= LOAD_TIMER,
+	WD_READ_TIMER	= 0x02,
+	WD_MODE		= 0x04,
+};
+
+enum wdog_ctl {
+	WD_CTL_START = (1 << 7),
+	WD_CTL_AUTO_RELOAD = (1 << 8)
+};
+
+enum wdog_mode {
+	WD_MODE_DIS_ARM = 0xF5,
+	WD_MODE_DIS_CONFIRM = 0xA0,
+	WD_MODE_ENABLE = (1 << 15)
+};
+
+#define WD_CTL_PRESCALE(value) (((value)&0x07) << 9)
+
+static void wdog_irq(__unused enum irq_nr nr)
+{
+	puts("=> WATCHDOG\n");
+}
+
+void wdog_enable(int on)
+{
+	if (on) {
+		irq_config(IRQ_WATCHDOG, 0, 0, 0);
+		irq_register_handler(IRQ_WATCHDOG, &wdog_irq);
+		irq_enable(IRQ_WATCHDOG);
+		writew(WD_MODE_ENABLE, WDOG_REG(WD_MODE));
+	} else {
+		writew(WD_MODE_DIS_ARM, WDOG_REG(WD_MODE));
+		writew(WD_MODE_DIS_CONFIRM, WDOG_REG(WD_MODE));
+	}
+}
+
+void wdog_reset(void)
+{
+#if 0
+	// XXX: this is supposed to reset immediately but does not seem to
+	writew(0xF5, WDOG_REG(WD_MODE));
+	writew(0xFF, WDOG_REG(WD_MODE));
+#else
+	// enable watchdog
+	writew(WD_MODE_ENABLE, WDOG_REG(WD_MODE));
+	// force expiration
+	writew(0x0000, WDOG_REG(WD_LOAD_TIMER));
+	writew(0x0000, WDOG_REG(WD_LOAD_TIMER));
+#endif
+}
diff --git a/src/target/firmware/calypso/tpu.c b/src/target/firmware/calypso/tpu.c
new file mode 100644
index 00000000..0b60292a
--- /dev/null
+++ b/src/target/firmware/calypso/tpu.c
@@ -0,0 +1,346 @@
+/* Calypso DBB internal TPU (Time Processing Unit) Driver */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <delay.h>
+#include <memory.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+
+/* Using TPU_DEBUG you will send special HLDC messages to the host PC
+ * containing the full TPU RAM content at the time you call tpu_enable() */
+//#define TPU_DEBUG
+
+#define BASE_ADDR_TPU	0xffff1000
+#define TPU_REG(x)	(BASE_ADDR_TPU+(x))
+
+#define BASE_ADDR_TPU_RAM	0xffff9000
+#define TPU_RAM_END		0xffff97ff
+
+enum tpu_reg_arm {
+	TPU_CTRL	= 0x0,	/* Control & Status Register */
+	INT_CTRL	= 0x2,	/* Interrupt Control Register */
+	INT_STAT	= 0x4,	/* Interrupt Status Register */
+	TPU_OFFSET	= 0xC,	/* Offset operand value register */
+	TPU_SYNCHRO	= 0xE,	/* synchro operand value register */
+	IT_DSP_PG	= 0x20,
+};
+
+enum tpu_ctrl_bits {
+	TPU_CTRL_RESET		= (1 << 0),
+	TPU_CTRL_PAGE		= (1 << 1),
+	TPU_CTRL_EN		= (1 << 2),
+	/* unused */
+	TPU_CTRL_DSP_EN		= (1 << 4),
+	/* unused */
+	TPU_CTRL_MCU_RAM_ACC	= (1 << 6),
+	TPU_CTRL_TSP_RESET	= (1 << 7),
+	TPU_CTRL_IDLE		= (1 << 8),
+	TPU_CTRL_WAIT		= (1 << 9),
+	TPU_CTRL_CK_ENABLE	= (1 << 10),
+	TPU_CTRL_FULL_WRITE	= (1 << 11),
+};
+
+enum tpu_int_ctrl_bits {
+	ICTRL_MCU_FRAME		= (1 << 0),
+	ICTRL_MCU_PAGE		= (1 << 1),
+	ICTRL_DSP_FRAME		= (1 << 2),
+	ICTRL_DSP_FRAME_FORCE	= (1 << 3),
+};
+
+static uint16_t *tpu_ptr = (uint16_t *)BASE_ADDR_TPU_RAM;
+
+#ifdef TPU_DEBUG
+#include <comm/sercomm.h>
+#include <layer1/sync.h>
+static void tpu_ram_read_en(int enable)
+{
+	uint16_t reg;
+
+	reg = readw(TPU_REG(TPU_CTRL));
+	if (enable)
+		reg |= TPU_CTRL_MCU_RAM_ACC;
+	else
+		reg &= ~TPU_CTRL_MCU_RAM_ACC;
+	writew(reg, TPU_REG(TPU_CTRL));
+}
+
+static void tpu_debug(void)
+{
+	uint16_t *tpu_base = (uint16_t *)BASE_ADDR_TPU_RAM;
+	unsigned int tpu_size = tpu_ptr - tpu_base;
+	struct msgb *msg = sercomm_alloc_msgb(tpu_size*2);
+	uint16_t *data;
+	uint32_t *fn;
+	uint16_t reg;
+	int i;
+
+	/* prepend tpu memory dump with frame number */
+	fn = (uint32_t *) msgb_put(msg, sizeof(fn));
+	*fn = l1s.current_time.fn;
+
+	tpu_ram_read_en(1);
+
+	data = (uint16_t *) msgb_put(msg, tpu_size*2);
+	for (i = 0; i < tpu_size; i ++)
+		data[i] = tpu_base[i];
+
+	tpu_ram_read_en(0);
+
+	sercomm_sendmsg(SC_DLCI_DEBUG, msg);
+}
+#else
+static void tpu_debug(void) { }
+#endif
+
+#define BIT_SET	1
+#define BIT_CLEAR 0
+
+/* wait for a certain control bit to be set */
+static int tpu_wait_ctrl_bit(uint16_t bit, int set)
+{
+	int timeout = 10*1000;
+
+	while (1) {
+		uint16_t reg = readw(TPU_REG(TPU_CTRL));
+		if (set) {
+			if (reg & bit)
+				break;
+		} else {
+			if (!(reg & bit))
+				break;
+		}
+		timeout--;
+		if (timeout <= 0) {
+			puts("Timeout while waiting for TPU ctrl bit!\n");
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+/* assert or de-assert TPU reset */
+void tpu_reset(int active)
+{
+	uint16_t reg;
+
+	printd("tpu_reset(%u)\n", active);
+	reg = readw(TPU_REG(TPU_CTRL));
+	if (active) {
+		reg |= (TPU_CTRL_RESET|TPU_CTRL_TSP_RESET);
+		writew(reg, TPU_REG(TPU_CTRL));
+		tpu_wait_ctrl_bit(TPU_CTRL_RESET, BIT_SET);
+	} else {
+		reg &= ~(TPU_CTRL_RESET|TPU_CTRL_TSP_RESET);
+		writew(reg, TPU_REG(TPU_CTRL));
+		tpu_wait_ctrl_bit(TPU_CTRL_RESET, BIT_CLEAR);
+	}
+}
+
+/* Enable or Disable a new scenario loaded into the TPU */
+void tpu_enable(int active)
+{
+	uint16_t reg = readw(TPU_REG(TPU_CTRL));
+
+	printd("tpu_enable(%u)\n", active);
+
+	tpu_debug();
+
+	if (active)
+		reg |= TPU_CTRL_EN;
+	else
+		reg &= ~TPU_CTRL_EN;
+	writew(reg, TPU_REG(TPU_CTRL));
+
+	/* After the new scenario is loaded, TPU switches the MCU-visible memory
+	 * page, i.e. we can write without any danger */
+	tpu_rewind();
+#if 0
+	{
+		int i;
+		uint16_t oldreg = 0;
+
+		for (i = 0; i < 100000; i++) {
+			reg = readw(TPU_REG(TPU_CTRL));
+			if (i == 0 || oldreg != reg) {
+				printd("%d TPU state: 0x%04x\n", i, reg);
+			}
+			oldreg = reg;
+		}
+	}
+#endif
+}
+
+/* Enable or Disable the clock of the TPU Module */
+void tpu_clk_enable(int active)
+{
+	uint16_t reg = readw(TPU_REG(TPU_CTRL));
+
+	printd("tpu_clk_enable(%u)\n", active);
+	if (active) {
+		reg |= TPU_CTRL_CK_ENABLE;
+		writew(reg, TPU_REG(TPU_CTRL));
+		tpu_wait_ctrl_bit(TPU_CTRL_CK_ENABLE, BIT_SET);
+	} else {
+		reg &= ~TPU_CTRL_CK_ENABLE;
+		writew(reg, TPU_REG(TPU_CTRL));
+		tpu_wait_ctrl_bit(TPU_CTRL_CK_ENABLE, BIT_CLEAR);
+	}
+}
+
+/* Enable Frame Interrupt generation on next frame.  DSP will reset it */
+void tpu_dsp_frameirq_enable(void)
+{
+	uint16_t reg = readw(TPU_REG(TPU_CTRL));
+	reg |= TPU_CTRL_DSP_EN;
+	writew(reg, TPU_REG(TPU_CTRL));
+
+	tpu_wait_ctrl_bit(TPU_CTRL_DSP_EN, BIT_SET);
+}
+
+/* Is a Frame interrupt still pending for the DSP ? */
+int tpu_dsp_fameirq_pending(void)
+{
+	uint16_t reg = readw(TPU_REG(TPU_CTRL));
+
+	if (reg & TPU_CTRL_DSP_EN)
+		return 1;
+
+	return 0;
+}
+
+void tpu_rewind(void)
+{
+	dputs("tpu_rewind()\n");
+	tpu_ptr = (uint16_t *) BASE_ADDR_TPU_RAM;
+}
+
+void tpu_enqueue(uint16_t instr)
+{
+	printd("tpu_enqueue(tpu_ptr=%p, instr=0x%04x)\n", tpu_ptr, instr);
+	*tpu_ptr++ = instr;
+	if (tpu_ptr > (uint16_t *) TPU_RAM_END)
+		puts("TPU enqueue beyond end of TPU memory\n");
+}
+
+void tpu_init(void)
+{
+	uint16_t *ptr;
+
+	/* Put TPU into Reset and enable clock */
+	tpu_reset(1);
+	tpu_clk_enable(1);
+
+	/* set all TPU RAM to zero */
+	for (ptr = (uint16_t *) BASE_ADDR_TPU_RAM; ptr < (uint16_t *) TPU_RAM_END; ptr++)
+		*ptr = 0x0000;
+
+	/* Get TPU out of reset */
+	tpu_reset(0);
+	/* Disable all interrupts */
+	writeb(0x7, TPU_REG(INT_CTRL));
+
+	tpu_rewind();
+	tpu_enq_offset(0);
+	tpu_enq_sync(0);
+}
+
+void tpu_test(void)
+{
+	int i;
+
+	/* program a sequence of TSPACT events into the TPU */
+	for (i = 0; i < 10; i++) {
+		puts("TSP ACT enable: ");
+		tsp_act_enable(0x0001);
+		tpu_enq_wait(10);
+		puts("TSP ACT disable: ");
+		tsp_act_disable(0x0001);
+		tpu_enq_wait(10);
+	}
+	tpu_enq_sleep();
+
+	/* tell the chip to execute the scenario */
+	tpu_enable(1);
+}
+
+void tpu_wait_idle(void)
+{
+	dputs("Waiting for TPU Idle ");
+	/* Wait until TPU is doing something */
+	delay_us(3);
+	/* Wait until TPU is idle */
+	while (readw(TPU_REG(TPU_CTRL)) & TPU_CTRL_IDLE)
+		dputchar('.');
+	dputs("Done!\n");
+}
+
+void tpu_frame_irq_en(int mcu, int dsp)
+{
+	uint8_t reg = readb(TPU_REG(INT_CTRL));
+	if (mcu)
+		reg &= ~ICTRL_MCU_FRAME;
+	else
+		reg |= ICTRL_MCU_FRAME;
+
+	if (dsp)
+		reg &= ~ICTRL_DSP_FRAME;
+	else
+		reg |= ICTRL_DSP_FRAME;
+
+	writeb(reg, TPU_REG(INT_CTRL));
+}
+
+void tpu_force_dsp_frame_irq(void)
+{
+	uint8_t reg = readb(TPU_REG(INT_CTRL));
+	reg |= ICTRL_DSP_FRAME_FORCE;
+	writeb(reg, TPU_REG(INT_CTRL));
+}
+
+uint16_t tpu_get_offset(void)
+{
+	return readw(TPU_REG(TPU_OFFSET));
+}
+
+uint16_t tpu_get_synchro(void)
+{
+	return readw(TPU_REG(TPU_SYNCHRO));
+}
+
+/* add two numbers, modulo 5000, and ensure the result is positive */
+uint16_t add_mod5000(int16_t a, int16_t b)
+{
+	int32_t sum = (int32_t)a + (int32_t)b;
+
+	sum %= 5000;
+
+	/* wrap around zero */
+	if (sum < 0)
+		sum += 5000;
+
+	return sum;
+}
diff --git a/src/target/firmware/calypso/tsp.c b/src/target/firmware/calypso/tsp.c
new file mode 100644
index 00000000..5d24f48e
--- /dev/null
+++ b/src/target/firmware/calypso/tsp.c
@@ -0,0 +1,121 @@
+/* Calypso DBB internal TSP (Time Serial Port) Driver */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+
+static uint16_t tspact_state;
+
+/* initiate a TSP write through the TPU */
+void tsp_write(uint8_t dev_idx, uint8_t bitlen, uint32_t dout)
+{
+	if (bitlen <= 8) {
+		tpu_enq_move(TPUI_TX_1, dout & 0xff);
+	} else if (bitlen <= 16) {
+		tpu_enq_move(TPUI_TX_1, (dout >> 8) & 0xff);
+		tpu_enq_move(TPUI_TX_2, dout & 0xff);
+	} else if (bitlen <= 24) {
+		tpu_enq_move(TPUI_TX_1, (dout >> 16) & 0xff);
+		tpu_enq_move(TPUI_TX_2, (dout >> 8) & 0xff);
+		tpu_enq_move(TPUI_TX_3, dout & 0xff);
+	} else {
+		tpu_enq_move(TPUI_TX_1, (dout >> 24) & 0xff);
+		tpu_enq_move(TPUI_TX_2, (dout >> 16) & 0xff);
+		tpu_enq_move(TPUI_TX_3, (dout >> 8) & 0xff);
+		tpu_enq_move(TPUI_TX_4, dout & 0xff);
+	}
+	tpu_enq_move(TPUI_TSP_CTRL1, (dev_idx << 5) | (bitlen - 1));
+	tpu_enq_move(TPUI_TSP_CTRL2, TPUI_CTRL2_WR);
+}
+
+/* Configure clock edge and chip enable polarity for a device */
+void tsp_setup(uint8_t dev_idx, int clk_rising, int en_positive, int en_edge)
+{
+	uint8_t reg = TPUI_TSP_SET1 + (dev_idx / 2);
+	uint8_t val = 0;
+	uint8_t shift;
+
+	if (dev_idx & 1)
+		shift = 4;
+	else
+		shift = 0;
+
+	if (clk_rising)
+		val |= 1;
+	if (en_positive)
+		val |= 2;
+	if (en_edge)
+		val |= 4;
+
+	tpu_enq_move(reg, (val << shift));
+}
+
+/* Update the TSPACT state, including enable and disable */
+void tsp_act_update(uint16_t new_act)
+{
+	uint8_t low = new_act & 0xff;
+	uint8_t high = new_act >> 8;
+
+	if (low != (tspact_state & 0xff))
+		tpu_enq_move(TPUI_TSP_ACT_L, low);
+	if (high != (tspact_state >> 8))
+		tpu_enq_move(TPUI_TSP_ACT_U, high);
+
+	tspact_state = new_act;
+}
+
+/* Enable one or multiple TSPACT signals */
+void tsp_act_enable(uint16_t bitmask)
+{
+	uint16_t new_act = tspact_state | bitmask;
+	tsp_act_update(new_act);
+}
+
+/* Disable one or multiple TSPACT signals */
+void tsp_act_disable(uint16_t bitmask)
+{
+	uint16_t new_act = tspact_state & ~bitmask;
+	tsp_act_update(new_act);
+}
+
+/* Obtain the current tspact state */
+uint16_t tsp_act_state(void)
+{
+	return tspact_state;
+}
+
+/* Toggle one or multiple TSPACT signals */
+void tsp_act_toggle(uint16_t bitmask)
+{
+	uint16_t new_act = tspact_state ^ bitmask;
+	tsp_act_update(new_act);
+}
+
+void tsp_init(void)
+{
+	tsp_act_update(0);
+}
diff --git a/src/target/firmware/calypso/uart.c b/src/target/firmware/calypso/uart.c
new file mode 100644
index 00000000..ec587de5
--- /dev/null
+++ b/src/target/firmware/calypso/uart.c
@@ -0,0 +1,442 @@
+/* Calypso DBB internal UART Driver */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Ingo Albrecht <prom@berlin.ccc.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <debug.h>
+
+#include <memory.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+
+#include <defines.h>
+#include <console.h>
+#include <comm/sercomm.h>
+
+#include <calypso/irq.h>
+#include <uart.h>
+
+#define BASE_ADDR_UART_MODEM	0xffff5000
+#define OFFSET_IRDA		0x800
+
+#define UART_REG(n,m)	(BASE_ADDR_UART_MODEM + ((n)*OFFSET_IRDA)+(m))
+
+#define LCR7BIT		0x80
+#define LCRBFBIT	0x40
+#define MCR6BIT		0x20
+#define REG_OFFS(m)	((m) & ~(LCR7BIT|LCRBFBIT|MCR6BIT))
+/* read access LCR[7] = 0 */
+enum uart_reg {
+	RHR	= 0,
+	IER	= 1,
+	IIR	= 2,
+	LCR	= 3,
+	MCR	= 4,
+	LSR	= 5,
+	MSR	= 6,
+	SPR	= 7,
+	MDR1	= 8,
+	DMR2	= 9,
+	SFLSR	= 0x0a,
+	RESUME	= 0x0b,
+	SFREGL	= 0x0c,
+	SFREGH	= 0x0d,
+	BLR	= 0x0e,
+	ACREG	= 0x0f,
+	SCR	= 0x10,
+	SSR	= 0x11,
+	EBLR	= 0x12,
+/* read access LCR[7] = 1 */
+	DLL	= RHR | LCR7BIT,
+	DLH	= IER | LCR7BIT,
+	DIV1_6	= ACREG | LCR7BIT,
+/* read/write access LCR[7:0] = 0xbf */
+	EFR	= IIR | LCRBFBIT,
+	XON1	= MCR | LCRBFBIT,
+	XON2	= LSR | LCRBFBIT,
+	XOFF1	= MSR | LCRBFBIT,
+	XOFF2 	= SPR | LCRBFBIT,
+/* read/write access if EFR[4] = 1 and MCR[6] = 1 */
+	TCR	= MSR | MCR6BIT,
+	TLR	= SPR | MCR6BIT,
+};
+/* write access LCR[7] = 0 */
+#define THR	RHR
+#define FCR	IIR		/* only if EFR[4] = 1 */
+#define TXFLL	SFLSR
+#define TXFLH	RESUME
+#define RXFLL	SFREGL
+#define RXFLH	SFREGH
+
+enum fcr_bits {
+	FIFO_EN		= (1 << 0),
+	RX_FIFO_CLEAR	= (1 << 1),
+	TX_FIFO_CLEAR	= (1 << 2),
+	DMA_MODE	= (1 << 3),
+};
+#define TX_FIFO_TRIG_SHIFT	4
+#define RX_FIFO_TRIG_SHIFT	6
+
+enum iir_bits {
+	IIR_INT_PENDING			= 0x01,
+	IIR_INT_TYPE			= 0x3E,
+	IIR_INT_TYPE_RX_STATUS_ERROR 	= 0x06,
+	IIR_INT_TYPE_RX_TIMEOUT		= 0x0C,
+	IIR_INT_TYPE_RHR		= 0x04,
+	IIR_INT_TYPE_THR		= 0x02,
+	IIR_INT_TYPE_MSR		= 0x00,
+	IIR_INT_TYPE_XOFF		= 0x10,
+	IIR_INT_TYPE_FLOW		= 0x20,
+	IIR_FCR0_MIRROR			= 0xC0,
+};
+
+#define UART_REG_UIR	0xffff6000
+
+/* enable or disable the divisor latch for access to DLL, DLH */
+static void uart_set_lcr7bit(int uart, int on)
+{
+	uint8_t reg;
+
+	reg = readb(UART_REG(uart, LCR));
+	if (on)
+		reg |= (1 << 7);
+	else
+		reg &= ~(1 << 7);
+	writeb(reg, UART_REG(uart, LCR));
+}
+
+static uint8_t old_lcr;
+static void uart_set_lcr_bf(int uart, int on)
+{
+	if (on) {
+		old_lcr = readb(UART_REG(uart, LCR));
+		writeb(0xBF, UART_REG(uart, LCR));
+	} else {
+		writeb(old_lcr, UART_REG(uart, LCR));
+	}
+}
+
+/* Enable or disable the TCR_TLR latch bit in MCR[6] */
+static void uart_set_mcr6bit(int uart, int on)
+{
+	uint8_t mcr;
+	/* we assume EFR[4] is always set to 1 */
+	mcr = readb(UART_REG(uart, MCR));
+	if (on)
+		mcr |= (1 << 6);
+	else
+		mcr &= ~(1 << 6);
+	writeb(mcr, UART_REG(uart, MCR));
+}
+
+static void uart_reg_write(int uart, enum uart_reg reg, uint8_t val)
+{
+	if (reg & LCRBFBIT)
+		uart_set_lcr_bf(uart, 1);
+	else if (reg & LCR7BIT)
+		uart_set_lcr7bit(uart, 1);
+	else if (reg & MCR6BIT)
+		uart_set_mcr6bit(uart, 1);
+
+	writeb(val, UART_REG(uart, REG_OFFS(reg)));
+
+	if (reg & LCRBFBIT)
+		uart_set_lcr_bf(uart, 0);
+	else if (reg & LCR7BIT)
+		uart_set_lcr7bit(uart, 0);
+	else if (reg & MCR6BIT)
+		uart_set_mcr6bit(uart, 0);
+}
+
+/* read from a UART register, applying any required latch bits */
+static uint8_t uart_reg_read(int uart, enum uart_reg reg)
+{
+	uint8_t ret;
+
+	if (reg & LCRBFBIT)
+		uart_set_lcr_bf(uart, 1);
+	else if (reg & LCR7BIT)
+		uart_set_lcr7bit(uart, 1);
+	else if (reg & MCR6BIT)
+		uart_set_mcr6bit(uart, 1);
+
+	ret = readb(UART_REG(uart, REG_OFFS(reg)));
+
+	if (reg & LCRBFBIT)
+		uart_set_lcr_bf(uart, 0);
+	else if (reg & LCR7BIT)
+		uart_set_lcr7bit(uart, 0);
+	else if (reg & MCR6BIT)
+		uart_set_mcr6bit(uart, 0);
+
+	return ret;
+}
+
+static void uart_irq_handler_cons(__unused enum irq_nr irqnr)
+{
+	const uint8_t uart = cons_get_uart();
+	uint8_t iir;
+
+	//uart_putchar_nb(uart, 'U');
+
+	iir = uart_reg_read(uart, IIR);
+	if (iir & IIR_INT_PENDING)
+		return;
+
+	switch (iir & IIR_INT_TYPE) {
+	case IIR_INT_TYPE_RHR:
+		break;
+	case IIR_INT_TYPE_THR:
+		if (cons_rb_flush() == 1) {
+			/* everything was flushed, disable THR IRQ */
+			uint8_t ier = uart_reg_read(uart, IER);
+			ier &= ~(1 << 1);
+			uart_reg_write(uart, IER, ier);
+		}
+		break;
+	case IIR_INT_TYPE_MSR:
+		break;
+	case IIR_INT_TYPE_RX_STATUS_ERROR:
+		break;
+	case IIR_INT_TYPE_RX_TIMEOUT:
+		break;
+	case IIR_INT_TYPE_XOFF:
+		break;
+	}
+}
+
+static void uart_irq_handler_sercomm(__unused enum irq_nr irqnr)
+{
+	const uint8_t uart = sercomm_get_uart();
+	uint8_t iir, ch;
+
+	//uart_putchar_nb(uart, 'U');
+
+	iir = uart_reg_read(uart, IIR);
+	if (iir & IIR_INT_PENDING)
+		return;
+
+	switch (iir & IIR_INT_TYPE) {
+	case IIR_INT_TYPE_RX_TIMEOUT:
+	case IIR_INT_TYPE_RHR:
+		/* as long as we have rx data available */
+		while (uart_getchar_nb(uart, &ch)) {
+			if (sercomm_drv_rx_char(ch) < 0) {
+				/* sercomm cannot receive more data right now */
+				uart_irq_enable(uart, UART_IRQ_RX_CHAR, 0);
+			}
+		}
+		break;
+	case IIR_INT_TYPE_THR:
+		/* as long as we have space in the FIFO */
+		while (!uart_tx_busy(uart)) {
+			/* get a byte from sercomm */
+			if (!sercomm_drv_pull(&ch)) {
+				/* no more bytes in sercomm, stop TX interrupts */
+				uart_irq_enable(uart, UART_IRQ_TX_EMPTY, 0);
+				break;
+			}
+			/* write the byte into the TX FIFO */
+			uart_putchar_nb(uart, ch);
+		}
+		break;
+	case IIR_INT_TYPE_MSR:
+		printf("UART IRQ MSR\n");
+		break;
+	case IIR_INT_TYPE_RX_STATUS_ERROR:
+		printf("UART IRQ RX_SE\n");
+		break;
+	case IIR_INT_TYPE_XOFF:
+		printf("UART IRQXOFF\n");
+		break;
+	}
+}
+
+static const uint8_t uart2irq[] = {
+	[0]	= IRQ_UART_IRDA,
+	[1]	= IRQ_UART_MODEM,
+};
+
+void uart_init(uint8_t uart, uint8_t interrupts)
+{
+	uint8_t irq = uart2irq[uart];
+
+	uart_reg_write(uart, IER, 0x00);
+	if (uart == cons_get_uart()) {
+		cons_init();
+		if(interrupts) {
+			irq_register_handler(irq, &uart_irq_handler_cons);
+			irq_config(irq, 0, 0, 0xff);
+			irq_enable(irq);
+		}
+	} else if (uart == sercomm_get_uart()) {
+		sercomm_init();
+		if(interrupts) {
+			irq_register_handler(irq, &uart_irq_handler_sercomm);
+			irq_config(irq, 0, 0, 0xff);
+			irq_enable(irq);
+		}
+		uart_irq_enable(uart, UART_IRQ_RX_CHAR, 1);
+	} else {
+		return;
+	}
+#if 0
+	if (uart == 1) {
+		/* assign UART to MCU and unmask interrupts*/
+		writeb(UART_REG_UIR, 0x00);
+	}
+#endif
+
+	/* if we don't initialize these, we get strange corruptions in the
+	   received data... :-( */
+	uart_reg_write(uart,  MDR1, 0x07); /* turn off UART */
+	uart_reg_write(uart,  XON1, 0x00); /* Xon1/Addr Register */
+	uart_reg_write(uart,  XON2, 0x00); /* Xon2/Addr Register */
+	uart_reg_write(uart, XOFF1, 0x00); /* Xoff1 Register */
+	uart_reg_write(uart, XOFF2, 0x00); /* Xoff2 Register */
+	uart_reg_write(uart,   EFR, 0x00); /* Enhanced Features Register */
+
+	/* select  UART mode */
+	uart_reg_write(uart, MDR1, 0);
+	/* no XON/XOFF flow control, ENHANCED_EN, no auto-RTS/CTS */
+	uart_reg_write(uart, EFR, (1 << 4));
+	/* enable Tx/Rx FIFO, Tx trigger at 56 spaces, Rx trigger at 60 chars */
+	uart_reg_write(uart, FCR, FIFO_EN | RX_FIFO_CLEAR | TX_FIFO_CLEAR |
+			(3 << TX_FIFO_TRIG_SHIFT) | (3 << RX_FIFO_TRIG_SHIFT));
+
+	/* THR interrupt only when TX FIFO and TX shift register are empty */
+	uart_reg_write(uart, SCR, (1 << 0));// | (1 << 3));
+
+	/* 8 bit, 1 stop bit, no parity, no break */
+	uart_reg_write(uart, LCR, 0x03);
+
+	uart_set_lcr7bit(uart, 0);
+}
+
+void uart_poll(uint8_t uart) {
+	if(uart == cons_get_uart()) {
+		uart_irq_handler_cons(0);
+	} else {
+		uart_irq_handler_sercomm(0);
+	}
+}
+
+void uart_irq_enable(uint8_t uart, enum uart_irq irq, int on)
+{
+	uint8_t ier = uart_reg_read(uart, IER);
+	uint8_t mask = 0;
+
+	switch (irq) {
+	case UART_IRQ_TX_EMPTY:
+		mask = (1 << 1);
+		break;
+	case UART_IRQ_RX_CHAR:
+		mask = (1 << 0);
+		break;
+	}
+
+	if (on)
+		ier |= mask;
+	else
+		ier &= ~mask;
+
+	uart_reg_write(uart, IER, ier);
+}
+
+
+void uart_putchar_wait(uint8_t uart, int c)
+{
+	/* wait while TX FIFO indicates full */
+	while (readb(UART_REG(uart, SSR)) & 0x01) { }
+
+	/* put character in TX FIFO */
+	writeb(c, UART_REG(uart, THR));
+}
+
+int uart_putchar_nb(uint8_t uart, int c)
+{
+	/* if TX FIFO indicates full, abort */
+	if (readb(UART_REG(uart, SSR)) & 0x01)
+		return 0;
+
+	writeb(c, UART_REG(uart, THR));
+	return 1;
+}
+
+int uart_getchar_nb(uint8_t uart, uint8_t *ch)
+{
+	uint8_t lsr;
+
+	lsr = readb(UART_REG(uart, LSR));
+
+	/* something strange happened */
+	if (lsr & 0x02)
+		printf("LSR RX_OE\n");
+	if (lsr & 0x04)
+		printf("LSR RX_PE\n");
+	if (lsr & 0x08)
+		printf("LSR RX_FE\n");
+	if (lsr & 0x10)
+		printf("LSR RX_BI\n");
+	if (lsr & 0x80)
+		printf("LSR RX_FIFO_STS\n");
+
+	/* is the Rx FIFO empty? */
+	if (!(lsr & 0x01))
+		return 0;
+
+	*ch = readb(UART_REG(uart, RHR));
+	//printf("getchar_nb(%u) = %02x\n", uart, *ch);
+	return 1;
+}
+
+int uart_tx_busy(uint8_t uart)
+{
+	if (readb(UART_REG(uart, SSR)) & 0x01)
+		return 1;
+	return 0;
+}
+
+static const uint16_t divider[] = {
+	[UART_38400]	= 21,	/*   38,690 */
+	[UART_57600]	= 14,	/*   58,035 */
+	[UART_115200]	= 7,	/*  116,071 */
+	[UART_230400]	= 4,	/*  203,125! (-3% would be 223,488) */
+	[UART_460800]	= 2,	/*  406,250! (-3% would be 446,976) */
+	[UART_921600]	= 1,	/*  812,500! (-3% would be 893,952) */
+};
+
+int uart_baudrate(uint8_t uart, enum uart_baudrate bdrt)
+{
+	uint16_t div;
+
+	if (bdrt >= ARRAY_SIZE(divider))
+		return -1;
+
+	div = divider[bdrt];
+	uart_set_lcr7bit(uart, 1);
+	writeb(div & 0xff, UART_REG(uart, DLL));
+	writeb(div >> 8, UART_REG(uart, DLH));
+	uart_set_lcr7bit(uart, 0);
+
+	return 0;
+}
diff --git a/src/target/firmware/calypso/uwire.c b/src/target/firmware/calypso/uwire.c
new file mode 100644
index 00000000..ac8f15e4
--- /dev/null
+++ b/src/target/firmware/calypso/uwire.c
@@ -0,0 +1,136 @@
+/* Driver for uWire Master Controller inside TI Calypso */
+
+/* (C) 2010 by Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+//#define DEBUG
+#include <debug.h>
+
+#include <memory.h>
+#include <uwire.h>
+#include <delay.h>
+
+#define BASE_ADDR_UWIRE	0xfffe4000
+#define UWIRE_REG(n)	(BASE_ADDR_UWIRE+(n))
+
+enum uwire_regs {
+	REG_DATA	= 0x00,
+	REG_CSR		= 0x02,
+	REG_SR1		= 0x04,
+	REG_SR2		= 0x06,
+	REG_SR3		= 0x08,
+};
+
+#define UWIRE_CSR_BITS_RD(n)	(((n) & 0x1f) << 0)
+#define UWIRE_CSR_BITS_WR(n)	(((n) & 0x1f) << 5)
+#define UWIRE_CSR_IDX(n)	(((n) & 3) << 10)
+#define UWIRE_CSR_CS_CMD	(1 << 12)
+#define UWIRE_CSR_START		(1 << 13)
+#define UWIRE_CSR_CSRB		(1 << 14)
+#define UWIRE_CSR_RDRB		(1 << 15)
+
+#define UWIRE_CSn_EDGE_RD	(1 << 0)	/* 1=falling 0=rising */
+#define UWIRE_CSn_EDGE_WR	(1 << 1)	/* 1=falling 0=rising */
+#define UWIRE_CSn_CS_LVL	(1 << 2)
+#define UWIRE_CSn_FRQ_DIV2	(0 << 3)
+#define UWIRE_CSn_FRQ_DIV4	(1 << 3)
+#define UWIRE_CSn_FRQ_DIV8	(2 << 3)
+#define UWIRE_CSn_CKH
+
+#define UWIRE_CSn_SHIFT(n)	(((n) & 1) ? 6 : 0)
+#define UWIRE_CSn_REG(n)	(((n) & 2) ? REG_SR2 : REG_SR1)
+
+#define UWIRE_SR3_CLK_EN	(1 << 0)
+#define UWIRE_SR3_CLK_DIV2	(0 << 1)
+#define UWIRE_SR3_CLK_DIV4	(1 << 1)
+#define UWIRE_SR3_CLK_DIV7	(2 << 1)
+#define UWIRE_SR3_CLK_DIV10	(3 << 1)
+
+static inline void _uwire_wait(int mask, int val)
+{
+	while ((readw(UWIRE_REG(REG_CSR)) & mask) != val);
+}
+
+void uwire_init(void)
+{
+	writew(UWIRE_SR3_CLK_EN | UWIRE_SR3_CLK_DIV2, UWIRE_REG(REG_SR3));
+	/* FIXME only init CS0 for now */
+	writew(((UWIRE_CSn_CS_LVL | UWIRE_CSn_FRQ_DIV2) << UWIRE_CSn_SHIFT(0)),
+		UWIRE_REG(UWIRE_CSn_REG(0)));
+	writew(UWIRE_CSR_IDX(0) | UWIRE_CSR_CS_CMD, UWIRE_REG(REG_CSR));
+	_uwire_wait(UWIRE_CSR_CSRB, 0);
+}
+
+int uwire_xfer(int cs, int bitlen, const void *dout, void *din)
+{
+	uint16_t tmp = 0;
+
+	if (bitlen <= 0 || bitlen > 16)
+		return -1;
+	if (cs < 0 || cs > 4)
+		return -1;
+
+	/* FIXME uwire_init always selects CS0 for now */
+
+	printd("uwire_xfer(dev_idx=%u, bitlen=%u\n", cs, bitlen);
+
+	/* select the chip */
+	writew(UWIRE_CSR_IDX(0) | UWIRE_CSR_CS_CMD, UWIRE_REG(REG_CSR));
+	_uwire_wait(UWIRE_CSR_CSRB, 0);
+
+	if (dout) {
+		if (bitlen <= 8)
+			tmp = *(uint8_t *)dout;
+		else if (bitlen <= 16)
+			tmp = *(uint16_t *)dout;
+		tmp <<= 16 - bitlen; /* align to MSB */
+		writew(tmp, UWIRE_REG(REG_DATA));
+		printd(", data_out=0x%04hx", tmp);
+	}
+
+	tmp =	(dout ? UWIRE_CSR_BITS_WR(bitlen) : 0) |
+		(din  ? UWIRE_CSR_BITS_RD(bitlen) : 0) |
+		UWIRE_CSR_START;
+	writew(tmp, UWIRE_REG(REG_CSR));
+
+	_uwire_wait(UWIRE_CSR_CSRB, 0);
+
+	if (din) {
+		_uwire_wait(UWIRE_CSR_RDRB, UWIRE_CSR_RDRB);
+
+		tmp = readw(UWIRE_REG(REG_DATA));
+		printd(", data_in=0x%08x", tmp);
+
+		if (bitlen <= 8)
+			*(uint8_t *)din = tmp & 0xff;
+		else if (bitlen <= 16)
+			*(uint16_t *)din = tmp & 0xffff;
+	}
+	/* unselect the chip */
+	writew(UWIRE_CSR_IDX(0) | 0, UWIRE_REG(REG_CSR));
+	_uwire_wait(UWIRE_CSR_CSRB, 0);
+
+	printd(")\n");
+
+	return 0;
+}
diff --git a/src/target/firmware/comm/Makefile b/src/target/firmware/comm/Makefile
new file mode 100644
index 00000000..ad69e240
--- /dev/null
+++ b/src/target/firmware/comm/Makefile
@@ -0,0 +1,5 @@
+
+LIBRARIES+=comm
+LIB_comm_DIR=comm
+LIB_comm_SRCS=msgb.c sercomm.c sercomm_cons.c timer.c
+
diff --git a/src/target/firmware/comm/msgb.c b/src/target/firmware/comm/msgb.c
new file mode 100644
index 00000000..3524ba58
--- /dev/null
+++ b/src/target/firmware/comm/msgb.c
@@ -0,0 +1,79 @@
+/* (C) 2008-2010 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+#include <asm/system.h>
+
+#include <debug.h>
+#include <delay.h>
+#include <console.h>
+
+#include <osmocom/core/msgb.h>
+
+#define NO_TALLOC
+
+void *tall_msgb_ctx;
+
+#ifdef NO_TALLOC
+/* This is a poor mans static allocator for msgb objects */
+#define MSGB_DATA_SIZE	256+4
+#define MSGB_NUM	32
+struct supermsg {
+	uint8_t allocated;
+	struct msgb msg;
+	uint8_t buf[MSGB_DATA_SIZE];
+};
+static struct supermsg msgs[MSGB_NUM];
+void *_talloc_zero(void *ctx, unsigned int size, const char *name)
+{
+	unsigned long flags;
+	unsigned int i;
+
+	local_firq_save(flags);
+
+	if (size > sizeof(struct msgb) + MSGB_DATA_SIZE)
+		goto panic;
+
+	for (i = 0; i < ARRAY_SIZE(msgs); i++) {
+		if (!msgs[i].allocated) {
+			msgs[i].allocated = 1;
+			memset(&msgs[i].msg, 0, sizeof(msgs[i].msg));
+			memset(&msgs[i].buf, 0, sizeof(msgs[i].buf));
+			local_irq_restore(flags);
+			return &msgs[i].msg;
+		}
+	}
+
+panic:
+	cons_puts("unable to allocate msgb\n");
+	while (1);
+
+	return NULL; /* not reached */
+}
+void talloc_free(void *msg)
+{
+	struct supermsg *smsg = container_of(msg, struct supermsg, msg);
+	/* no locking required, since this is atomic */
+	smsg->allocated = 0;
+}
+#endif
diff --git a/src/target/firmware/comm/sercomm.c b/src/target/firmware/comm/sercomm.c
new file mode 100644
index 00000000..490e2254
--- /dev/null
+++ b/src/target/firmware/comm/sercomm.c
@@ -0,0 +1,310 @@
+/* Serial communications layer, based on HDLC */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <errno.h>
+
+#include <osmocom/core/msgb.h>
+
+#ifdef HOST_BUILD
+
+# define SERCOMM_RX_MSG_SIZE	2048
+# ifndef ARRAY_SIZE
+#  define ARRAY_SIZE(x) (sizeof(x)/sizeof(x[0]))
+# endif
+# include <sercomm.h>
+
+static inline void sercomm_lock(unsigned long __attribute__((unused)) *flags) {}
+static inline void sercomm_unlock(unsigned long __attribute__((unused)) *flags) {}
+
+#else
+
+# define SERCOMM_RX_MSG_SIZE	256
+# include <debug.h>
+# include <osmocom/core/linuxlist.h>
+# include <asm/system.h>
+
+static inline void sercomm_lock(unsigned long *flags)
+{
+	local_firq_save(*flags);
+}
+
+static inline void sercomm_unlock(unsigned long *flags)
+{
+	local_irq_restore(*flags);
+}
+
+# include <comm/sercomm.h>
+# include <uart.h>
+
+#endif
+
+
+enum rx_state {
+	RX_ST_WAIT_START,
+	RX_ST_ADDR,
+	RX_ST_CTRL,
+	RX_ST_DATA,
+	RX_ST_ESCAPE,
+};
+
+static struct {
+	int initialized;
+	int uart_id;
+
+	/* transmit side */
+	struct {
+		struct llist_head dlci_queues[_SC_DLCI_MAX];
+		struct msgb *msg;
+		enum rx_state state;
+		uint8_t *next_char;
+	} tx;
+
+	/* receive side */
+	struct {
+		dlci_cb_t dlci_handler[_SC_DLCI_MAX];
+		struct msgb *msg;
+		enum rx_state state;
+		uint8_t dlci;
+		uint8_t ctrl;
+	} rx;
+	
+} sercomm;
+
+#ifndef HOST_BUILD
+void sercomm_bind_uart(int uart)
+{
+	sercomm.uart_id = uart;
+}
+
+int sercomm_get_uart(void)
+{
+	return sercomm.uart_id;
+}
+#endif
+
+void sercomm_init(void)
+{
+	unsigned int i;
+	for (i = 0; i < ARRAY_SIZE(sercomm.tx.dlci_queues); i++)
+		INIT_LLIST_HEAD(&sercomm.tx.dlci_queues[i]);
+
+	sercomm.rx.msg = NULL;
+	sercomm.initialized = 1;
+
+	/* set up the echo dlci */
+	sercomm_register_rx_cb(SC_DLCI_ECHO, &sercomm_sendmsg);
+}
+
+int sercomm_initialized(void)
+{
+	return sercomm.initialized;
+}
+
+/* user interface for transmitting messages for a given DLCI */
+void sercomm_sendmsg(uint8_t dlci, struct msgb *msg)
+{
+	unsigned long flags;
+	uint8_t *hdr;
+
+	/* prepend address + control octet */
+	hdr = msgb_push(msg, 2);
+	hdr[0] = dlci;
+	hdr[1] = HDLC_C_UI;
+
+	/* This functiion can be called from any context: FIQ, IRQ
+	 * and supervisor context.  Proper locking is important! */
+	sercomm_lock(&flags);
+	msgb_enqueue(&sercomm.tx.dlci_queues[dlci], msg);
+	sercomm_unlock(&flags);
+
+#ifndef HOST_BUILD
+	/* tell UART that we have something to send */
+	uart_irq_enable(sercomm.uart_id, UART_IRQ_TX_EMPTY, 1);
+#endif
+}
+
+/* how deep is the Tx queue for a given DLCI */
+unsigned int sercomm_tx_queue_depth(uint8_t dlci)
+{
+	struct llist_head *le;
+	unsigned int num = 0;
+
+	llist_for_each(le, &sercomm.tx.dlci_queues[dlci]) {
+		num++;
+	}
+
+	return num;
+}
+
+/* fetch one octet of to-be-transmitted serial data */
+int sercomm_drv_pull(uint8_t *ch)
+{
+	unsigned long flags;
+
+	/* we may be called from interrupt context, but we stiff need to lock
+	 * because sercomm could be accessed from a FIQ context ... */
+
+	sercomm_lock(&flags);
+
+	if (!sercomm.tx.msg) {
+		unsigned int i;
+		/* dequeue a new message from the queues */
+		for (i = 0; i < ARRAY_SIZE(sercomm.tx.dlci_queues); i++) {
+			sercomm.tx.msg = msgb_dequeue(&sercomm.tx.dlci_queues[i]);
+			if (sercomm.tx.msg)
+				break;
+		}
+		if (sercomm.tx.msg) {
+			/* start of a new message, send start flag octet */
+			*ch = HDLC_FLAG;
+			sercomm.tx.next_char = sercomm.tx.msg->data;
+			sercomm_unlock(&flags);
+			return 1;
+		} else {
+			/* no more data avilable */
+			sercomm_unlock(&flags);
+			return 0;
+		}
+	}
+
+	if (sercomm.tx.state == RX_ST_ESCAPE) {
+		/* we've already transmitted the ESCAPE octet,
+		 * we now need to transmit the escaped data */
+		*ch = *sercomm.tx.next_char++;
+		sercomm.tx.state = RX_ST_DATA;
+	} else if (sercomm.tx.next_char >= sercomm.tx.msg->tail) {
+		/* last character has already been transmitted,
+		 * send end-of-message octet */
+		*ch = HDLC_FLAG;
+		/* we've reached the end of the message buffer */
+		msgb_free(sercomm.tx.msg);
+		sercomm.tx.msg = NULL;
+		sercomm.tx.next_char = NULL;
+	/* escaping for the two control octets */
+	} else if (*sercomm.tx.next_char == HDLC_FLAG ||
+		   *sercomm.tx.next_char == HDLC_ESCAPE ||
+		   *sercomm.tx.next_char == 0x00) {
+		/* send an escape octet */
+		*ch = HDLC_ESCAPE;
+		/* invert bit 5 of the next octet to be sent */
+		*sercomm.tx.next_char ^= (1 << 5);
+		sercomm.tx.state = RX_ST_ESCAPE;
+	} else {
+		/* standard case, simply send next octet */
+		*ch = *sercomm.tx.next_char++;
+	}
+
+	sercomm_unlock(&flags);
+	return 1;
+}
+
+/* register a handler for a given DLCI */
+int sercomm_register_rx_cb(uint8_t dlci, dlci_cb_t cb)
+{
+	if (dlci >= ARRAY_SIZE(sercomm.rx.dlci_handler))
+		return -EINVAL;
+
+	if (sercomm.rx.dlci_handler[dlci])
+		return -EBUSY;
+
+	sercomm.rx.dlci_handler[dlci] = cb;
+	return 0;
+}
+
+/* dispatch an incoming message once it is completely received */
+static void dispatch_rx_msg(uint8_t dlci, struct msgb *msg)
+{
+	if (dlci >= ARRAY_SIZE(sercomm.rx.dlci_handler) ||
+	    !sercomm.rx.dlci_handler[dlci]) {
+		msgb_free(msg);
+		return;
+	}
+	sercomm.rx.dlci_handler[dlci](dlci, msg);
+}
+
+/* the driver has received one byte, pass it into sercomm layer */
+int sercomm_drv_rx_char(uint8_t ch)
+{
+	uint8_t *ptr;
+
+	/* we are always called from interrupt context in this function,
+	 * which means that any data structures we use need to be for
+	 * our exclusive access */
+	if (!sercomm.rx.msg)
+		sercomm.rx.msg = sercomm_alloc_msgb(SERCOMM_RX_MSG_SIZE);
+
+	if (msgb_tailroom(sercomm.rx.msg) == 0) {
+		//cons_puts("sercomm_drv_rx_char() overflow!\n");
+		msgb_free(sercomm.rx.msg);
+		sercomm.rx.msg = sercomm_alloc_msgb(SERCOMM_RX_MSG_SIZE);
+		sercomm.rx.state = RX_ST_WAIT_START;
+		return 0;
+	}
+
+	switch (sercomm.rx.state) {
+	case RX_ST_WAIT_START:
+		if (ch != HDLC_FLAG)
+			break;
+		sercomm.rx.state = RX_ST_ADDR;
+		break;
+	case RX_ST_ADDR:
+		sercomm.rx.dlci = ch;
+		sercomm.rx.state = RX_ST_CTRL;
+		break;
+	case RX_ST_CTRL:
+		sercomm.rx.ctrl = ch;
+		sercomm.rx.state = RX_ST_DATA;
+		break;
+	case RX_ST_DATA:
+		if (ch == HDLC_ESCAPE) {
+			/* drop the escape octet, but change state */
+			sercomm.rx.state = RX_ST_ESCAPE;
+			break;
+		} else if (ch == HDLC_FLAG) {
+			/* message is finished */
+			dispatch_rx_msg(sercomm.rx.dlci, sercomm.rx.msg);
+			/* allocate new buffer */
+			sercomm.rx.msg = NULL;
+			/* start all over again */
+			sercomm.rx.state = RX_ST_WAIT_START;
+
+			/* do not add the control char */
+			break;
+		}
+		/* default case: store the octet */
+		ptr = msgb_put(sercomm.rx.msg, 1);
+		*ptr = ch;
+		break;
+	case RX_ST_ESCAPE:
+		/* store bif-5-inverted octet in buffer */
+		ch ^= (1 << 5);
+		ptr = msgb_put(sercomm.rx.msg, 1);
+		*ptr = ch;
+		/* transition back to normal DATA state */
+		sercomm.rx.state = RX_ST_DATA;
+		break;
+	}
+
+	return 1;
+}
diff --git a/src/target/firmware/comm/sercomm_cons.c b/src/target/firmware/comm/sercomm_cons.c
new file mode 100644
index 00000000..e6b6934f
--- /dev/null
+++ b/src/target/firmware/comm/sercomm_cons.c
@@ -0,0 +1,141 @@
+/* Serial console layer, layered on top of sercomm HDLC */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+#include <string.h>
+
+#include <asm/system.h>
+
+#include <uart.h>
+
+#include <console.h>
+#include <osmocom/core/msgb.h>
+#include <comm/sercomm.h>
+#include <comm/sercomm_cons.h>
+
+static struct {
+	struct msgb *cur_msg;
+} scons;
+
+static void raw_puts(const char *s)
+{
+	int i = strlen(s);
+	int uart_id = sercomm_get_uart();
+	while (i--)
+		uart_putchar_wait(uart_id, *s++);
+}
+
+#ifdef DEBUG
+#define raw_putd(x)	raw_puts(x)
+#else
+#define raw_putd(x)
+#endif
+
+int sercomm_puts(const char *s)
+{
+	unsigned long flags;
+	const int len = strlen(s);
+	unsigned int bytes_left = len;
+
+	if (!sercomm_initialized()) {
+		raw_putd("sercomm not initialized: ");
+		raw_puts(s);
+		return len - 1;
+	}
+
+	/* This function is called from any context: Supervisor, IRQ, FIQ, ...
+	 * as such, we need to ensure re-entrant calls are either supported or
+	 * avoided. */
+	local_irq_save(flags);
+	local_fiq_disable();
+
+	while (bytes_left > 0) {
+		unsigned int write_num, space_left, flush;
+		uint8_t *data;
+
+		if (!scons.cur_msg)
+			scons.cur_msg = sercomm_alloc_msgb(SERCOMM_CONS_ALLOC);
+
+		if (!scons.cur_msg) {
+			raw_putd("cannot allocate sercomm msgb: ");
+			raw_puts(s);
+			return -ENOMEM;
+		}
+
+		/* space left in the current msgb */
+		space_left = msgb_tailroom(scons.cur_msg);
+
+		if (space_left <= bytes_left) {
+			write_num = space_left;
+			/* flush buffer when it is full */
+			flush = 1;
+		} else {
+			write_num = bytes_left;
+			flush = 0;
+		}
+
+		/* obtain pointer where to copy the data */
+		data = msgb_put(scons.cur_msg, write_num);
+
+		/* copy data while looking for \n line termination */
+		{
+			unsigned int i;
+			for (i = 0; i < write_num; i++) {
+				/* flush buffer at end of line, but skip
+				 * flushing if we have a backlog in order to
+				 * increase efficiency of msgb filling */
+				if (*s == '\n' &&
+				    sercomm_tx_queue_depth(SC_DLCI_CONSOLE) < 4)
+					flush = 1;
+				*data++ = *s++;
+			}
+		}
+		bytes_left -= write_num;
+
+		if (flush) {
+			sercomm_sendmsg(SC_DLCI_CONSOLE, scons.cur_msg);
+			/* reset scons.cur_msg pointer to ensure we allocate
+			 * a new one next round */
+			scons.cur_msg = NULL;
+		}
+	}
+
+	local_irq_restore(flags);
+
+	return len - 1;
+}
+
+int sercomm_putchar(int c)
+{
+	char s[2];
+	int rc;
+
+	s[0] = c & 0xff;
+	s[1] = '\0';
+
+	rc = sercomm_puts(s);
+	if (rc < 0)
+		return rc;
+
+	return c;
+}
diff --git a/src/target/firmware/comm/timer.c b/src/target/firmware/comm/timer.c
new file mode 100644
index 00000000..ce4f06d3
--- /dev/null
+++ b/src/target/firmware/comm/timer.c
@@ -0,0 +1,215 @@
+/* (C) 2008 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <debug.h>
+#include <osmocom/core/linuxlist.h>
+
+#include <comm/timer.h>
+
+#include <calypso/timer.h>
+#include <calypso/irq.h>
+
+#include <keypad.h>
+
+static LLIST_HEAD(timer_list);
+
+unsigned long volatile jiffies;
+
+#define time_after(a,b)         \
+	(typecheck(unsigned long, a) && \
+	 typecheck(unsigned long, b) && \
+	 ((long)(b) - (long)(a) < 0))
+#define time_before(a,b)        time_after(b,a)
+
+void osmo_timer_add(struct osmo_timer_list *timer)
+{
+	struct osmo_timer_list *list_timer;
+
+	/* TODO: Optimize and remember the closest item... */
+	timer->active = 1;
+
+	/* this might be called from within osmo_timers_update */
+	llist_for_each_entry(list_timer, &timer_list, entry)
+		if (timer == list_timer)
+			return;
+
+	timer->in_list = 1;
+	llist_add(&timer->entry, &timer_list);
+}
+
+void osmo_timer_schedule(struct osmo_timer_list *timer, int milliseconds)
+{
+	timer->expires = jiffies + ((milliseconds * HZ) / 1000);
+	osmo_timer_add(timer);
+}
+
+void osmo_timer_del(struct osmo_timer_list *timer)
+{
+	if (timer->in_list) {
+		timer->active = 0;
+		timer->in_list = 0;
+		llist_del(&timer->entry);
+	}
+}
+
+int osmo_timer_pending(struct osmo_timer_list *timer)
+{
+	return timer->active;
+}
+
+#if 0
+/*
+ * if we have a nearest time return the delta between the current
+ * time and the time of the nearest timer.
+ * If the nearest timer timed out return NULL and then we will
+ * dispatch everything after the select
+ */
+struct timeval *nearest_timer()
+{
+	struct timeval current_time;
+
+	if (s_nearest_time.tv_sec == 0 && s_nearest_time.tv_usec == 0)
+		return NULL;
+
+	if (gettimeofday(&current_time, NULL) == -1)
+		return NULL;
+
+	unsigned long long nearestTime = s_nearest_time.tv_sec * MICRO_SECONDS + s_nearest_time.tv_usec;
+	unsigned long long currentTime = current_time.tv_sec * MICRO_SECONDS + current_time.tv_usec;
+
+	if (nearestTime < currentTime) {
+		s_select_time.tv_sec = 0;
+		s_select_time.tv_usec = 0;
+	} else {
+		s_select_time.tv_sec = (nearestTime - currentTime) / MICRO_SECONDS;
+		s_select_time.tv_usec = (nearestTime - currentTime) % MICRO_SECONDS;
+	}
+
+	return &s_select_time;
+}
+
+/*
+ * Find the nearest time and update s_nearest_time
+ */
+void prepare_timers()
+{
+	struct osmo_timer_list *timer, *nearest_timer = NULL;
+	llist_for_each_entry(timer, &timer_list, entry) {
+		if (!nearest_timer || time_before(timer->expires, nearest_timer->expires)) {
+			nearest_timer = timer;
+		}
+	}
+
+	if (nearest_timer) {
+		s_nearest_time = nearest_timer->timeout;
+	} else {
+		memset(&s_nearest_time, 0, sizeof(struct timeval));
+	}
+}
+#endif
+
+/*
+ * fire all timers... and remove them
+ */
+int osmo_timers_update(void)
+{
+	struct osmo_timer_list *timer, *tmp;
+	int work = 0;
+
+	/*
+	 * The callbacks might mess with our list and in this case
+	 * even llist_for_each_entry_safe is not safe to use. To allow
+	 * osmo_timer_del, osmo_timer_add, osmo_timer_schedule to be called from within
+	 * the callback we jump through some loops.
+	 *
+	 * First we set the handled flag of each active timer to zero,
+	 * then we iterate over the list and execute the callbacks. As the
+	 * list might have been changed (specially the next) from within
+	 * the callback we have to start over again. Once every callback
+	 * is dispatched we will remove the non-active from the list.
+	 *
+	 * TODO: If this is a performance issue we can poison a global
+	 * variable in osmo_timer_add and osmo_timer_del and only then restart.
+	 */
+	llist_for_each_entry(timer, &timer_list, entry) {
+		timer->handled = 0;
+	}
+
+restart:
+	llist_for_each_entry(timer, &timer_list, entry) {
+		if (!timer->handled && time_before(timer->expires, jiffies)) {
+			timer->handled = 1;
+			timer->active = 0;
+			(*timer->cb)(timer->data);
+			work = 1;
+			goto restart;
+		}
+	}
+
+	llist_for_each_entry_safe(timer, tmp, &timer_list, entry) {
+		timer->handled = 0;
+		if (!timer->active) {
+			osmo_timer_del(timer);
+		}
+	}
+
+	return work;
+}
+
+int osmo_timers_check(void)
+{
+	struct osmo_timer_list *timer;
+	int i = 0;
+
+	llist_for_each_entry(timer, &timer_list, entry) {
+		i++;
+	}
+	return i;
+}
+
+static void timer_irq(enum irq_nr irq)
+{
+	/* we only increment jiffies here.  FIXME: does this need to be atomic? */
+	jiffies++;
+
+	keypad_poll();
+}
+
+void timer_init(void)
+{
+	/* configure TIMER2 for our purpose */
+	hwtimer_enable(2, 1);
+	/* The timer runs at 13MHz / 32, i.e. 406.25kHz */
+#if (HZ == 100)
+	hwtimer_load(2, 4062);
+	hwtimer_config(2, 0, 1);
+#elif (HZ == 10)
+	/* prescaler 4, 1015 ticks until expiry */
+	hwtimer_load(2, 1015);
+	hwtimer_config(2, 4, 1);
+#endif
+	hwtimer_enable(2, 1);
+
+	/* register interrupt handler with default priority, EDGE triggered */
+	irq_register_handler(IRQ_TIMER2, &timer_irq);
+	irq_config(IRQ_TIMER2, 0, 1, -1);
+	irq_enable(IRQ_TIMER2);
+}
diff --git a/src/target/firmware/fb/4x6.c b/src/target/firmware/fb/4x6.c
new file mode 100644
index 00000000..2a35eba6
--- /dev/null
+++ b/src/target/firmware/fb/4x6.c
@@ -0,0 +1,731 @@
+#include <fb/font.h>
+static const uint8_t font_4x6_data[] = {
+/* --- new character space (32) starting at offset 0x0000 --- */
+	/*0000:*/	4, 4, 1, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0005:*/	0x00,  /* ........ */
+/* --- new character exclam (33) starting at offset 0x0006 --- */
+	/*0006:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*000b:*/	0x40,  /* .#...... */
+	/*000c:*/	0x40,  /* .#...... */
+	/*000d:*/	0x40,  /* .#...... */
+	/*000e:*/	0x00,  /* ........ */
+	/*000f:*/	0x40,  /* .#...... */
+/* --- new character quotedbl (34) starting at offset 0x0010 --- */
+	/*0010:*/	4, 4, 2, 0, 3, /* width and bbox (w,h,x,y) */ 
+	/*0015:*/	0xa0,  /* #.#..... */
+	/*0016:*/	0xa0,  /* #.#..... */
+/* --- new character numbersign (35) starting at offset 0x0017 --- */
+	/*0017:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*001c:*/	0xa0,  /* #.#..... */
+	/*001d:*/	0xf0,  /* ####.... */
+	/*001e:*/	0xa0,  /* #.#..... */
+	/*001f:*/	0xf0,  /* ####.... */
+	/*0020:*/	0xa0,  /* #.#..... */
+/* --- new character dollar (36) starting at offset 0x0021 --- */
+	/*0021:*/	4, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0026:*/	0x40,  /* .#...... */
+	/*0027:*/	0xe0,  /* ###..... */
+	/*0028:*/	0xc0,  /* ##...... */
+	/*0029:*/	0x20,  /* ..#..... */
+	/*002a:*/	0xe0,  /* ###..... */
+	/*002b:*/	0x40,  /* .#...... */
+/* --- new character percent (37) starting at offset 0x002c --- */
+	/*002c:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0031:*/	0x80,  /* #....... */
+	/*0032:*/	0x20,  /* ..#..... */
+	/*0033:*/	0x40,  /* .#...... */
+	/*0034:*/	0x80,  /* #....... */
+	/*0035:*/	0x20,  /* ..#..... */
+/* --- new character ampersand (38) starting at offset 0x0036 --- */
+	/*0036:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*003b:*/	0x40,  /* .#...... */
+	/*003c:*/	0xa0,  /* #.#..... */
+	/*003d:*/	0x40,  /* .#...... */
+	/*003e:*/	0xa0,  /* #.#..... */
+	/*003f:*/	0x50,  /* .#.#.... */
+/* --- new character quotesingle (39) starting at offset 0x0040 --- */
+	/*0040:*/	4, 4, 2, 0, 3, /* width and bbox (w,h,x,y) */ 
+	/*0045:*/	0x40,  /* .#...... */
+	/*0046:*/	0x40,  /* .#...... */
+/* --- new character parenleft (40) starting at offset 0x0047 --- */
+	/*0047:*/	4, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*004c:*/	0x20,  /* ..#..... */
+	/*004d:*/	0x40,  /* .#...... */
+	/*004e:*/	0x40,  /* .#...... */
+	/*004f:*/	0x40,  /* .#...... */
+	/*0050:*/	0x40,  /* .#...... */
+	/*0051:*/	0x20,  /* ..#..... */
+/* --- new character parenright (41) starting at offset 0x0052 --- */
+	/*0052:*/	4, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0057:*/	0x80,  /* #....... */
+	/*0058:*/	0x40,  /* .#...... */
+	/*0059:*/	0x40,  /* .#...... */
+	/*005a:*/	0x40,  /* .#...... */
+	/*005b:*/	0x40,  /* .#...... */
+	/*005c:*/	0x80,  /* #....... */
+/* --- new character asterisk (42) starting at offset 0x005d --- */
+	/*005d:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0062:*/	0xa0,  /* #.#..... */
+	/*0063:*/	0x40,  /* .#...... */
+	/*0064:*/	0xe0,  /* ###..... */
+	/*0065:*/	0x40,  /* .#...... */
+	/*0066:*/	0xa0,  /* #.#..... */
+/* --- new character plus (43) starting at offset 0x0067 --- */
+	/*0067:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*006c:*/	0x40,  /* .#...... */
+	/*006d:*/	0x40,  /* .#...... */
+	/*006e:*/	0xe0,  /* ###..... */
+	/*006f:*/	0x40,  /* .#...... */
+	/*0070:*/	0x40,  /* .#...... */
+/* --- new character comma (44) starting at offset 0x0071 --- */
+	/*0071:*/	4, 4, 2, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0076:*/	0x40,  /* .#...... */
+	/*0077:*/	0x80,  /* #....... */
+/* --- new character hyphen (45) starting at offset 0x0078 --- */
+	/*0078:*/	4, 4, 1, 0, 2, /* width and bbox (w,h,x,y) */ 
+	/*007d:*/	0xe0,  /* ###..... */
+/* --- new character period (46) starting at offset 0x007e --- */
+	/*007e:*/	4, 4, 1, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0083:*/	0x40,  /* .#...... */
+/* --- new character slash (47) starting at offset 0x0084 --- */
+	/*0084:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0089:*/	0x20,  /* ..#..... */
+	/*008a:*/	0x20,  /* ..#..... */
+	/*008b:*/	0x40,  /* .#...... */
+	/*008c:*/	0x80,  /* #....... */
+	/*008d:*/	0x80,  /* #....... */
+/* --- new character zero (48) starting at offset 0x008e --- */
+	/*008e:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0093:*/	0x40,  /* .#...... */
+	/*0094:*/	0xa0,  /* #.#..... */
+	/*0095:*/	0xe0,  /* ###..... */
+	/*0096:*/	0xa0,  /* #.#..... */
+	/*0097:*/	0x40,  /* .#...... */
+/* --- new character one (49) starting at offset 0x0098 --- */
+	/*0098:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*009d:*/	0x40,  /* .#...... */
+	/*009e:*/	0xc0,  /* ##...... */
+	/*009f:*/	0x40,  /* .#...... */
+	/*00a0:*/	0x40,  /* .#...... */
+	/*00a1:*/	0xe0,  /* ###..... */
+/* --- new character two (50) starting at offset 0x00a2 --- */
+	/*00a2:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00a7:*/	0x40,  /* .#...... */
+	/*00a8:*/	0xa0,  /* #.#..... */
+	/*00a9:*/	0x20,  /* ..#..... */
+	/*00aa:*/	0x40,  /* .#...... */
+	/*00ab:*/	0xe0,  /* ###..... */
+/* --- new character three (51) starting at offset 0x00ac --- */
+	/*00ac:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00b1:*/	0xe0,  /* ###..... */
+	/*00b2:*/	0x20,  /* ..#..... */
+	/*00b3:*/	0x40,  /* .#...... */
+	/*00b4:*/	0x20,  /* ..#..... */
+	/*00b5:*/	0xc0,  /* ##...... */
+/* --- new character four (52) starting at offset 0x00b6 --- */
+	/*00b6:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00bb:*/	0xa0,  /* #.#..... */
+	/*00bc:*/	0xa0,  /* #.#..... */
+	/*00bd:*/	0xe0,  /* ###..... */
+	/*00be:*/	0x20,  /* ..#..... */
+	/*00bf:*/	0x20,  /* ..#..... */
+/* --- new character five (53) starting at offset 0x00c0 --- */
+	/*00c0:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00c5:*/	0xe0,  /* ###..... */
+	/*00c6:*/	0x80,  /* #....... */
+	/*00c7:*/	0xc0,  /* ##...... */
+	/*00c8:*/	0x20,  /* ..#..... */
+	/*00c9:*/	0xc0,  /* ##...... */
+/* --- new character six (54) starting at offset 0x00ca --- */
+	/*00ca:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00cf:*/	0x60,  /* .##..... */
+	/*00d0:*/	0x80,  /* #....... */
+	/*00d1:*/	0xc0,  /* ##...... */
+	/*00d2:*/	0xa0,  /* #.#..... */
+	/*00d3:*/	0x40,  /* .#...... */
+/* --- new character seven (55) starting at offset 0x00d4 --- */
+	/*00d4:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00d9:*/	0xe0,  /* ###..... */
+	/*00da:*/	0x20,  /* ..#..... */
+	/*00db:*/	0x40,  /* .#...... */
+	/*00dc:*/	0x80,  /* #....... */
+	/*00dd:*/	0x80,  /* #....... */
+/* --- new character eight (56) starting at offset 0x00de --- */
+	/*00de:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00e3:*/	0x60,  /* .##..... */
+	/*00e4:*/	0xa0,  /* #.#..... */
+	/*00e5:*/	0x40,  /* .#...... */
+	/*00e6:*/	0xa0,  /* #.#..... */
+	/*00e7:*/	0xc0,  /* ##...... */
+/* --- new character nine (57) starting at offset 0x00e8 --- */
+	/*00e8:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00ed:*/	0x40,  /* .#...... */
+	/*00ee:*/	0xa0,  /* #.#..... */
+	/*00ef:*/	0x60,  /* .##..... */
+	/*00f0:*/	0x20,  /* ..#..... */
+	/*00f1:*/	0xc0,  /* ##...... */
+/* --- new character colon (58) starting at offset 0x00f2 --- */
+	/*00f2:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00f7:*/	0x40,  /* .#...... */
+	/*00f8:*/	0x00,  /* ........ */
+	/*00f9:*/	0x00,  /* ........ */
+	/*00fa:*/	0x40,  /* .#...... */
+/* --- new character semicolon (59) starting at offset 0x00fb --- */
+	/*00fb:*/	4, 4, 5, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0100:*/	0x40,  /* .#...... */
+	/*0101:*/	0x00,  /* ........ */
+	/*0102:*/	0x00,  /* ........ */
+	/*0103:*/	0x40,  /* .#...... */
+	/*0104:*/	0x80,  /* #....... */
+/* --- new character less (60) starting at offset 0x0105 --- */
+	/*0105:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*010a:*/	0x20,  /* ..#..... */
+	/*010b:*/	0x40,  /* .#...... */
+	/*010c:*/	0x80,  /* #....... */
+	/*010d:*/	0x40,  /* .#...... */
+	/*010e:*/	0x20,  /* ..#..... */
+/* --- new character equal (61) starting at offset 0x010f --- */
+	/*010f:*/	4, 4, 3, 0, 1, /* width and bbox (w,h,x,y) */ 
+	/*0114:*/	0xe0,  /* ###..... */
+	/*0115:*/	0x00,  /* ........ */
+	/*0116:*/	0xe0,  /* ###..... */
+/* --- new character greater (62) starting at offset 0x0117 --- */
+	/*0117:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*011c:*/	0x80,  /* #....... */
+	/*011d:*/	0x40,  /* .#...... */
+	/*011e:*/	0x20,  /* ..#..... */
+	/*011f:*/	0x40,  /* .#...... */
+	/*0120:*/	0x80,  /* #....... */
+/* --- new character question (63) starting at offset 0x0121 --- */
+	/*0121:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0126:*/	0xc0,  /* ##...... */
+	/*0127:*/	0x20,  /* ..#..... */
+	/*0128:*/	0x40,  /* .#...... */
+	/*0129:*/	0x00,  /* ........ */
+	/*012a:*/	0x40,  /* .#...... */
+/* --- new character at (64) starting at offset 0x012b --- */
+	/*012b:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0130:*/	0x60,  /* .##..... */
+	/*0131:*/	0xa0,  /* #.#..... */
+	/*0132:*/	0xa0,  /* #.#..... */
+	/*0133:*/	0x80,  /* #....... */
+	/*0134:*/	0x60,  /* .##..... */
+/* --- new character A (65) starting at offset 0x0135 --- */
+	/*0135:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*013a:*/	0x40,  /* .#...... */
+	/*013b:*/	0xa0,  /* #.#..... */
+	/*013c:*/	0xe0,  /* ###..... */
+	/*013d:*/	0xa0,  /* #.#..... */
+	/*013e:*/	0xa0,  /* #.#..... */
+/* --- new character B (66) starting at offset 0x013f --- */
+	/*013f:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0144:*/	0xc0,  /* ##...... */
+	/*0145:*/	0xa0,  /* #.#..... */
+	/*0146:*/	0xc0,  /* ##...... */
+	/*0147:*/	0xa0,  /* #.#..... */
+	/*0148:*/	0xc0,  /* ##...... */
+/* --- new character C (67) starting at offset 0x0149 --- */
+	/*0149:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*014e:*/	0x40,  /* .#...... */
+	/*014f:*/	0xa0,  /* #.#..... */
+	/*0150:*/	0x80,  /* #....... */
+	/*0151:*/	0xa0,  /* #.#..... */
+	/*0152:*/	0x40,  /* .#...... */
+/* --- new character D (68) starting at offset 0x0153 --- */
+	/*0153:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0158:*/	0xc0,  /* ##...... */
+	/*0159:*/	0xa0,  /* #.#..... */
+	/*015a:*/	0xa0,  /* #.#..... */
+	/*015b:*/	0xa0,  /* #.#..... */
+	/*015c:*/	0xc0,  /* ##...... */
+/* --- new character E (69) starting at offset 0x015d --- */
+	/*015d:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0162:*/	0xe0,  /* ###..... */
+	/*0163:*/	0x80,  /* #....... */
+	/*0164:*/	0xc0,  /* ##...... */
+	/*0165:*/	0x80,  /* #....... */
+	/*0166:*/	0xe0,  /* ###..... */
+/* --- new character F (70) starting at offset 0x0167 --- */
+	/*0167:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*016c:*/	0xe0,  /* ###..... */
+	/*016d:*/	0x80,  /* #....... */
+	/*016e:*/	0xc0,  /* ##...... */
+	/*016f:*/	0x80,  /* #....... */
+	/*0170:*/	0x80,  /* #....... */
+/* --- new character G (71) starting at offset 0x0171 --- */
+	/*0171:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0176:*/	0x60,  /* .##..... */
+	/*0177:*/	0x80,  /* #....... */
+	/*0178:*/	0xa0,  /* #.#..... */
+	/*0179:*/	0xa0,  /* #.#..... */
+	/*017a:*/	0x60,  /* .##..... */
+/* --- new character H (72) starting at offset 0x017b --- */
+	/*017b:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0180:*/	0xa0,  /* #.#..... */
+	/*0181:*/	0xa0,  /* #.#..... */
+	/*0182:*/	0xe0,  /* ###..... */
+	/*0183:*/	0xa0,  /* #.#..... */
+	/*0184:*/	0xa0,  /* #.#..... */
+/* --- new character I (73) starting at offset 0x0185 --- */
+	/*0185:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*018a:*/	0xe0,  /* ###..... */
+	/*018b:*/	0x40,  /* .#...... */
+	/*018c:*/	0x40,  /* .#...... */
+	/*018d:*/	0x40,  /* .#...... */
+	/*018e:*/	0xe0,  /* ###..... */
+/* --- new character J (74) starting at offset 0x018f --- */
+	/*018f:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0194:*/	0x20,  /* ..#..... */
+	/*0195:*/	0x20,  /* ..#..... */
+	/*0196:*/	0x20,  /* ..#..... */
+	/*0197:*/	0xa0,  /* #.#..... */
+	/*0198:*/	0x40,  /* .#...... */
+/* --- new character K (75) starting at offset 0x0199 --- */
+	/*0199:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*019e:*/	0xa0,  /* #.#..... */
+	/*019f:*/	0xa0,  /* #.#..... */
+	/*01a0:*/	0xc0,  /* ##...... */
+	/*01a1:*/	0xa0,  /* #.#..... */
+	/*01a2:*/	0xa0,  /* #.#..... */
+/* --- new character L (76) starting at offset 0x01a3 --- */
+	/*01a3:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01a8:*/	0x80,  /* #....... */
+	/*01a9:*/	0x80,  /* #....... */
+	/*01aa:*/	0x80,  /* #....... */
+	/*01ab:*/	0x80,  /* #....... */
+	/*01ac:*/	0xe0,  /* ###..... */
+/* --- new character M (77) starting at offset 0x01ad --- */
+	/*01ad:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01b2:*/	0xa0,  /* #.#..... */
+	/*01b3:*/	0xe0,  /* ###..... */
+	/*01b4:*/	0xe0,  /* ###..... */
+	/*01b5:*/	0xa0,  /* #.#..... */
+	/*01b6:*/	0xa0,  /* #.#..... */
+/* --- new character N (78) starting at offset 0x01b7 --- */
+	/*01b7:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01bc:*/	0x20,  /* ..#..... */
+	/*01bd:*/	0xa0,  /* #.#..... */
+	/*01be:*/	0xe0,  /* ###..... */
+	/*01bf:*/	0xa0,  /* #.#..... */
+	/*01c0:*/	0x80,  /* #....... */
+/* --- new character O (79) starting at offset 0x01c1 --- */
+	/*01c1:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01c6:*/	0x40,  /* .#...... */
+	/*01c7:*/	0xa0,  /* #.#..... */
+	/*01c8:*/	0xa0,  /* #.#..... */
+	/*01c9:*/	0xa0,  /* #.#..... */
+	/*01ca:*/	0x40,  /* .#...... */
+/* --- new character P (80) starting at offset 0x01cb --- */
+	/*01cb:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01d0:*/	0xc0,  /* ##...... */
+	/*01d1:*/	0xa0,  /* #.#..... */
+	/*01d2:*/	0xc0,  /* ##...... */
+	/*01d3:*/	0x80,  /* #....... */
+	/*01d4:*/	0x80,  /* #....... */
+/* --- new character Q (81) starting at offset 0x01d5 --- */
+	/*01d5:*/	4, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*01da:*/	0x40,  /* .#...... */
+	/*01db:*/	0xa0,  /* #.#..... */
+	/*01dc:*/	0xa0,  /* #.#..... */
+	/*01dd:*/	0xa0,  /* #.#..... */
+	/*01de:*/	0x40,  /* .#...... */
+	/*01df:*/	0x20,  /* ..#..... */
+/* --- new character R (82) starting at offset 0x01e0 --- */
+	/*01e0:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01e5:*/	0xc0,  /* ##...... */
+	/*01e6:*/	0xa0,  /* #.#..... */
+	/*01e7:*/	0xc0,  /* ##...... */
+	/*01e8:*/	0xa0,  /* #.#..... */
+	/*01e9:*/	0xa0,  /* #.#..... */
+/* --- new character S (83) starting at offset 0x01ea --- */
+	/*01ea:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01ef:*/	0x60,  /* .##..... */
+	/*01f0:*/	0x80,  /* #....... */
+	/*01f1:*/	0x40,  /* .#...... */
+	/*01f2:*/	0x20,  /* ..#..... */
+	/*01f3:*/	0xc0,  /* ##...... */
+/* --- new character T (84) starting at offset 0x01f4 --- */
+	/*01f4:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01f9:*/	0xe0,  /* ###..... */
+	/*01fa:*/	0x40,  /* .#...... */
+	/*01fb:*/	0x40,  /* .#...... */
+	/*01fc:*/	0x40,  /* .#...... */
+	/*01fd:*/	0x40,  /* .#...... */
+/* --- new character U (85) starting at offset 0x01fe --- */
+	/*01fe:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0203:*/	0xa0,  /* #.#..... */
+	/*0204:*/	0xa0,  /* #.#..... */
+	/*0205:*/	0xa0,  /* #.#..... */
+	/*0206:*/	0xa0,  /* #.#..... */
+	/*0207:*/	0xe0,  /* ###..... */
+/* --- new character V (86) starting at offset 0x0208 --- */
+	/*0208:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*020d:*/	0xa0,  /* #.#..... */
+	/*020e:*/	0xa0,  /* #.#..... */
+	/*020f:*/	0xa0,  /* #.#..... */
+	/*0210:*/	0xe0,  /* ###..... */
+	/*0211:*/	0x40,  /* .#...... */
+/* --- new character W (87) starting at offset 0x0212 --- */
+	/*0212:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0217:*/	0xa0,  /* #.#..... */
+	/*0218:*/	0xa0,  /* #.#..... */
+	/*0219:*/	0xe0,  /* ###..... */
+	/*021a:*/	0xe0,  /* ###..... */
+	/*021b:*/	0xa0,  /* #.#..... */
+/* --- new character X (88) starting at offset 0x021c --- */
+	/*021c:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0221:*/	0xa0,  /* #.#..... */
+	/*0222:*/	0xa0,  /* #.#..... */
+	/*0223:*/	0x40,  /* .#...... */
+	/*0224:*/	0xa0,  /* #.#..... */
+	/*0225:*/	0xa0,  /* #.#..... */
+/* --- new character Y (89) starting at offset 0x0226 --- */
+	/*0226:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*022b:*/	0xa0,  /* #.#..... */
+	/*022c:*/	0xa0,  /* #.#..... */
+	/*022d:*/	0x40,  /* .#...... */
+	/*022e:*/	0x40,  /* .#...... */
+	/*022f:*/	0x40,  /* .#...... */
+/* --- new character Z (90) starting at offset 0x0230 --- */
+	/*0230:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0235:*/	0xe0,  /* ###..... */
+	/*0236:*/	0x20,  /* ..#..... */
+	/*0237:*/	0x40,  /* .#...... */
+	/*0238:*/	0x80,  /* #....... */
+	/*0239:*/	0xe0,  /* ###..... */
+/* --- new character bracketleft (91) starting at offset 0x023a --- */
+	/*023a:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*023f:*/	0x60,  /* .##..... */
+	/*0240:*/	0x40,  /* .#...... */
+	/*0241:*/	0x40,  /* .#...... */
+	/*0242:*/	0x40,  /* .#...... */
+	/*0243:*/	0x60,  /* .##..... */
+/* --- new character backslash (92) starting at offset 0x0244 --- */
+	/*0244:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0249:*/	0x80,  /* #....... */
+	/*024a:*/	0x80,  /* #....... */
+	/*024b:*/	0x40,  /* .#...... */
+	/*024c:*/	0x20,  /* ..#..... */
+	/*024d:*/	0x20,  /* ..#..... */
+/* --- new character bracketright (93) starting at offset 0x024e --- */
+	/*024e:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0253:*/	0xc0,  /* ##...... */
+	/*0254:*/	0x40,  /* .#...... */
+	/*0255:*/	0x40,  /* .#...... */
+	/*0256:*/	0x40,  /* .#...... */
+	/*0257:*/	0xc0,  /* ##...... */
+/* --- new character asciicircum (94) starting at offset 0x0258 --- */
+	/*0258:*/	4, 4, 2, 0, 3, /* width and bbox (w,h,x,y) */ 
+	/*025d:*/	0x40,  /* .#...... */
+	/*025e:*/	0xa0,  /* #.#..... */
+/* --- new character underscore (95) starting at offset 0x025f --- */
+	/*025f:*/	4, 4, 1, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0264:*/	0xe0,  /* ###..... */
+/* --- new character grave (96) starting at offset 0x0265 --- */
+	/*0265:*/	4, 4, 2, 0, 3, /* width and bbox (w,h,x,y) */ 
+	/*026a:*/	0x40,  /* .#...... */
+	/*026b:*/	0x20,  /* ..#..... */
+/* --- new character a (97) starting at offset 0x026c --- */
+	/*026c:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0271:*/	0x60,  /* .##..... */
+	/*0272:*/	0xa0,  /* #.#..... */
+	/*0273:*/	0xa0,  /* #.#..... */
+	/*0274:*/	0x60,  /* .##..... */
+/* --- new character b (98) starting at offset 0x0275 --- */
+	/*0275:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*027a:*/	0x80,  /* #....... */
+	/*027b:*/	0xc0,  /* ##...... */
+	/*027c:*/	0xa0,  /* #.#..... */
+	/*027d:*/	0xa0,  /* #.#..... */
+	/*027e:*/	0xc0,  /* ##...... */
+/* --- new character c (99) starting at offset 0x027f --- */
+	/*027f:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0284:*/	0x60,  /* .##..... */
+	/*0285:*/	0x80,  /* #....... */
+	/*0286:*/	0x80,  /* #....... */
+	/*0287:*/	0x60,  /* .##..... */
+/* --- new character d (100) starting at offset 0x0288 --- */
+	/*0288:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*028d:*/	0x20,  /* ..#..... */
+	/*028e:*/	0x60,  /* .##..... */
+	/*028f:*/	0xa0,  /* #.#..... */
+	/*0290:*/	0xa0,  /* #.#..... */
+	/*0291:*/	0x60,  /* .##..... */
+/* --- new character e (101) starting at offset 0x0292 --- */
+	/*0292:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0297:*/	0x40,  /* .#...... */
+	/*0298:*/	0xa0,  /* #.#..... */
+	/*0299:*/	0xc0,  /* ##...... */
+	/*029a:*/	0x60,  /* .##..... */
+/* --- new character f (102) starting at offset 0x029b --- */
+	/*029b:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02a0:*/	0x20,  /* ..#..... */
+	/*02a1:*/	0x40,  /* .#...... */
+	/*02a2:*/	0xe0,  /* ###..... */
+	/*02a3:*/	0x40,  /* .#...... */
+	/*02a4:*/	0x40,  /* .#...... */
+/* --- new character g (103) starting at offset 0x02a5 --- */
+	/*02a5:*/	4, 4, 5, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*02aa:*/	0x60,  /* .##..... */
+	/*02ab:*/	0xa0,  /* #.#..... */
+	/*02ac:*/	0x60,  /* .##..... */
+	/*02ad:*/	0x20,  /* ..#..... */
+	/*02ae:*/	0xc0,  /* ##...... */
+/* --- new character h (104) starting at offset 0x02af --- */
+	/*02af:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02b4:*/	0x80,  /* #....... */
+	/*02b5:*/	0xc0,  /* ##...... */
+	/*02b6:*/	0xa0,  /* #.#..... */
+	/*02b7:*/	0xa0,  /* #.#..... */
+	/*02b8:*/	0xa0,  /* #.#..... */
+/* --- new character i (105) starting at offset 0x02b9 --- */
+	/*02b9:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02be:*/	0x40,  /* .#...... */
+	/*02bf:*/	0x00,  /* ........ */
+	/*02c0:*/	0xc0,  /* ##...... */
+	/*02c1:*/	0x40,  /* .#...... */
+	/*02c2:*/	0xe0,  /* ###..... */
+/* --- new character j (106) starting at offset 0x02c3 --- */
+	/*02c3:*/	4, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*02c8:*/	0x20,  /* ..#..... */
+	/*02c9:*/	0x00,  /* ........ */
+	/*02ca:*/	0x20,  /* ..#..... */
+	/*02cb:*/	0x20,  /* ..#..... */
+	/*02cc:*/	0x20,  /* ..#..... */
+	/*02cd:*/	0xc0,  /* ##...... */
+/* --- new character k (107) starting at offset 0x02ce --- */
+	/*02ce:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02d3:*/	0x80,  /* #....... */
+	/*02d4:*/	0xa0,  /* #.#..... */
+	/*02d5:*/	0xc0,  /* ##...... */
+	/*02d6:*/	0xa0,  /* #.#..... */
+	/*02d7:*/	0xa0,  /* #.#..... */
+/* --- new character l (108) starting at offset 0x02d8 --- */
+	/*02d8:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02dd:*/	0xc0,  /* ##...... */
+	/*02de:*/	0x40,  /* .#...... */
+	/*02df:*/	0x40,  /* .#...... */
+	/*02e0:*/	0x40,  /* .#...... */
+	/*02e1:*/	0xe0,  /* ###..... */
+/* --- new character m (109) starting at offset 0x02e2 --- */
+	/*02e2:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02e7:*/	0xa0,  /* #.#..... */
+	/*02e8:*/	0xe0,  /* ###..... */
+	/*02e9:*/	0xa0,  /* #.#..... */
+	/*02ea:*/	0xa0,  /* #.#..... */
+/* --- new character n (110) starting at offset 0x02eb --- */
+	/*02eb:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02f0:*/	0xc0,  /* ##...... */
+	/*02f1:*/	0xa0,  /* #.#..... */
+	/*02f2:*/	0xa0,  /* #.#..... */
+	/*02f3:*/	0xa0,  /* #.#..... */
+/* --- new character o (111) starting at offset 0x02f4 --- */
+	/*02f4:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02f9:*/	0x40,  /* .#...... */
+	/*02fa:*/	0xa0,  /* #.#..... */
+	/*02fb:*/	0xa0,  /* #.#..... */
+	/*02fc:*/	0x40,  /* .#...... */
+/* --- new character p (112) starting at offset 0x02fd --- */
+	/*02fd:*/	4, 4, 5, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0302:*/	0xc0,  /* ##...... */
+	/*0303:*/	0xa0,  /* #.#..... */
+	/*0304:*/	0xc0,  /* ##...... */
+	/*0305:*/	0x80,  /* #....... */
+	/*0306:*/	0x80,  /* #....... */
+/* --- new character q (113) starting at offset 0x0307 --- */
+	/*0307:*/	4, 4, 5, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*030c:*/	0x60,  /* .##..... */
+	/*030d:*/	0xa0,  /* #.#..... */
+	/*030e:*/	0xa0,  /* #.#..... */
+	/*030f:*/	0x60,  /* .##..... */
+	/*0310:*/	0x20,  /* ..#..... */
+/* --- new character r (114) starting at offset 0x0311 --- */
+	/*0311:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0316:*/	0xa0,  /* #.#..... */
+	/*0317:*/	0xc0,  /* ##...... */
+	/*0318:*/	0x80,  /* #....... */
+	/*0319:*/	0x80,  /* #....... */
+/* --- new character s (115) starting at offset 0x031a --- */
+	/*031a:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*031f:*/	0x60,  /* .##..... */
+	/*0320:*/	0xc0,  /* ##...... */
+	/*0321:*/	0x20,  /* ..#..... */
+	/*0322:*/	0xc0,  /* ##...... */
+/* --- new character t (116) starting at offset 0x0323 --- */
+	/*0323:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0328:*/	0x40,  /* .#...... */
+	/*0329:*/	0xe0,  /* ###..... */
+	/*032a:*/	0x40,  /* .#...... */
+	/*032b:*/	0x40,  /* .#...... */
+	/*032c:*/	0x20,  /* ..#..... */
+/* --- new character u (117) starting at offset 0x032d --- */
+	/*032d:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0332:*/	0xa0,  /* #.#..... */
+	/*0333:*/	0xa0,  /* #.#..... */
+	/*0334:*/	0xa0,  /* #.#..... */
+	/*0335:*/	0x60,  /* .##..... */
+/* --- new character v (118) starting at offset 0x0336 --- */
+	/*0336:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*033b:*/	0xa0,  /* #.#..... */
+	/*033c:*/	0xa0,  /* #.#..... */
+	/*033d:*/	0xa0,  /* #.#..... */
+	/*033e:*/	0x40,  /* .#...... */
+/* --- new character w (119) starting at offset 0x033f --- */
+	/*033f:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0344:*/	0xa0,  /* #.#..... */
+	/*0345:*/	0xa0,  /* #.#..... */
+	/*0346:*/	0xe0,  /* ###..... */
+	/*0347:*/	0xa0,  /* #.#..... */
+/* --- new character x (120) starting at offset 0x0348 --- */
+	/*0348:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*034d:*/	0xa0,  /* #.#..... */
+	/*034e:*/	0x40,  /* .#...... */
+	/*034f:*/	0x40,  /* .#...... */
+	/*0350:*/	0xa0,  /* #.#..... */
+/* --- new character y (121) starting at offset 0x0351 --- */
+	/*0351:*/	4, 4, 5, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0356:*/	0xa0,  /* #.#..... */
+	/*0357:*/	0xa0,  /* #.#..... */
+	/*0358:*/	0x60,  /* .##..... */
+	/*0359:*/	0x20,  /* ..#..... */
+	/*035a:*/	0xc0,  /* ##...... */
+/* --- new character z (122) starting at offset 0x035b --- */
+	/*035b:*/	4, 4, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0360:*/	0xe0,  /* ###..... */
+	/*0361:*/	0x20,  /* ..#..... */
+	/*0362:*/	0x40,  /* .#...... */
+	/*0363:*/	0xe0,  /* ###..... */
+/* --- new character braceleft (123) starting at offset 0x0364 --- */
+	/*0364:*/	4, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0369:*/	0x20,  /* ..#..... */
+	/*036a:*/	0x40,  /* .#...... */
+	/*036b:*/	0xc0,  /* ##...... */
+	/*036c:*/	0x40,  /* .#...... */
+	/*036d:*/	0x40,  /* .#...... */
+	/*036e:*/	0x20,  /* ..#..... */
+/* --- new character bar (124) starting at offset 0x036f --- */
+	/*036f:*/	4, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0374:*/	0x40,  /* .#...... */
+	/*0375:*/	0x40,  /* .#...... */
+	/*0376:*/	0x40,  /* .#...... */
+	/*0377:*/	0x40,  /* .#...... */
+	/*0378:*/	0x40,  /* .#...... */
+/* --- new character braceright (125) starting at offset 0x0379 --- */
+	/*0379:*/	4, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*037e:*/	0x80,  /* #....... */
+	/*037f:*/	0x40,  /* .#...... */
+	/*0380:*/	0x60,  /* .##..... */
+	/*0381:*/	0x40,  /* .#...... */
+	/*0382:*/	0x40,  /* .#...... */
+	/*0383:*/	0x80,  /* #....... */
+/* --- new character asciitilde (126) starting at offset 0x0384 --- */
+	/*0384:*/	4, 4, 2, 0, 3, /* width and bbox (w,h,x,y) */ 
+	/*0389:*/	0x50,  /* .#.#.... */
+	/*038a:*/	0xa0,  /* #.#..... */
+};
+static const uint16_t font_4x6_offsets[] = {
+0x0000 /* space */,
+	0x0006 /* exclam */,
+	0x0010 /* quotedbl */,
+	0x0017 /* numbersign */,
+	0x0021 /* dollar */,
+	0x002c /* percent */,
+	0x0036 /* ampersand */,
+	0x0040 /* quotesingle */,
+	0x0047 /* parenleft */,
+	0x0052 /* parenright */,
+	0x005d /* asterisk */,
+	0x0067 /* plus */,
+	0x0071 /* comma */,
+	0x0078 /* hyphen */,
+	0x007e /* period */,
+	0x0084 /* slash */,
+	0x008e /* zero */,
+	0x0098 /* one */,
+	0x00a2 /* two */,
+	0x00ac /* three */,
+	0x00b6 /* four */,
+	0x00c0 /* five */,
+	0x00ca /* six */,
+	0x00d4 /* seven */,
+	0x00de /* eight */,
+	0x00e8 /* nine */,
+	0x00f2 /* colon */,
+	0x00fb /* semicolon */,
+	0x0105 /* less */,
+	0x010f /* equal */,
+	0x0117 /* greater */,
+	0x0121 /* question */,
+	0x012b /* at */,
+	0x0135 /* A */,
+	0x013f /* B */,
+	0x0149 /* C */,
+	0x0153 /* D */,
+	0x015d /* E */,
+	0x0167 /* F */,
+	0x0171 /* G */,
+	0x017b /* H */,
+	0x0185 /* I */,
+	0x018f /* J */,
+	0x0199 /* K */,
+	0x01a3 /* L */,
+	0x01ad /* M */,
+	0x01b7 /* N */,
+	0x01c1 /* O */,
+	0x01cb /* P */,
+	0x01d5 /* Q */,
+	0x01e0 /* R */,
+	0x01ea /* S */,
+	0x01f4 /* T */,
+	0x01fe /* U */,
+	0x0208 /* V */,
+	0x0212 /* W */,
+	0x021c /* X */,
+	0x0226 /* Y */,
+	0x0230 /* Z */,
+	0x023a /* bracketleft */,
+	0x0244 /* backslash */,
+	0x024e /* bracketright */,
+	0x0258 /* asciicircum */,
+	0x025f /* underscore */,
+	0x0265 /* grave */,
+	0x026c /* a */,
+	0x0275 /* b */,
+	0x027f /* c */,
+	0x0288 /* d */,
+	0x0292 /* e */,
+	0x029b /* f */,
+	0x02a5 /* g */,
+	0x02af /* h */,
+	0x02b9 /* i */,
+	0x02c3 /* j */,
+	0x02ce /* k */,
+	0x02d8 /* l */,
+	0x02e2 /* m */,
+	0x02eb /* n */,
+	0x02f4 /* o */,
+	0x02fd /* p */,
+	0x0307 /* q */,
+	0x0311 /* r */,
+	0x031a /* s */,
+	0x0323 /* t */,
+	0x032d /* u */,
+	0x0336 /* v */,
+	0x033f /* w */,
+	0x0348 /* x */,
+	0x0351 /* y */,
+	0x035b /* z */,
+	0x0364 /* braceleft */,
+	0x036f /* bar */,
+	0x0379 /* braceright */,
+	0x0384 /* asciitilde */,
+	0xffff /* (no glyph) */
+};
+const struct fb_font font_4x6 = {
+	.height = 6,
+	.ascent = 5,
+	.firstchar = 32, /* space */
+	.lastchar = 127, /* ? */
+	.chardata = font_4x6_data,
+	.charoffs = font_4x6_offsets,
+};
diff --git a/src/target/firmware/fb/5x8.c b/src/target/firmware/fb/5x8.c
new file mode 100644
index 00000000..e2003298
--- /dev/null
+++ b/src/target/firmware/fb/5x8.c
@@ -0,0 +1,802 @@
+#include <fb/font.h>
+static const uint8_t font_5x8_data[] = {
+/* --- new character space (32) starting at offset 0x0000 --- */
+	/*0000:*/	5, 5, 1, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0005:*/	0x00,  /* ........ */
+/* --- new character exclam (33) starting at offset 0x0006 --- */
+	/*0006:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*000b:*/	0x20,  /* ..#..... */
+	/*000c:*/	0x20,  /* ..#..... */
+	/*000d:*/	0x20,  /* ..#..... */
+	/*000e:*/	0x20,  /* ..#..... */
+	/*000f:*/	0x00,  /* ........ */
+	/*0010:*/	0x20,  /* ..#..... */
+/* --- new character quotedbl (34) starting at offset 0x0011 --- */
+	/*0011:*/	5, 5, 3, 0, 3, /* width and bbox (w,h,x,y) */ 
+	/*0016:*/	0x50,  /* .#.#.... */
+	/*0017:*/	0x50,  /* .#.#.... */
+	/*0018:*/	0x50,  /* .#.#.... */
+/* --- new character numbersign (35) starting at offset 0x0019 --- */
+	/*0019:*/	5, 5, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*001e:*/	0x50,  /* .#.#.... */
+	/*001f:*/	0x50,  /* .#.#.... */
+	/*0020:*/	0xf8,  /* #####... */
+	/*0021:*/	0x50,  /* .#.#.... */
+	/*0022:*/	0xf8,  /* #####... */
+	/*0023:*/	0x50,  /* .#.#.... */
+	/*0024:*/	0x50,  /* .#.#.... */
+/* --- new character dollar (36) starting at offset 0x0025 --- */
+	/*0025:*/	5, 5, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*002a:*/	0x20,  /* ..#..... */
+	/*002b:*/	0x70,  /* .###.... */
+	/*002c:*/	0xa0,  /* #.#..... */
+	/*002d:*/	0x70,  /* .###.... */
+	/*002e:*/	0x28,  /* ..#.#... */
+	/*002f:*/	0x70,  /* .###.... */
+	/*0030:*/	0x20,  /* ..#..... */
+/* --- new character percent (37) starting at offset 0x0031 --- */
+	/*0031:*/	5, 5, 5, 0, 1, /* width and bbox (w,h,x,y) */ 
+	/*0036:*/	0x40,  /* .#...... */
+	/*0037:*/	0x50,  /* .#.#.... */
+	/*0038:*/	0x20,  /* ..#..... */
+	/*0039:*/	0x50,  /* .#.#.... */
+	/*003a:*/	0x10,  /* ...#.... */
+/* --- new character ampersand (38) starting at offset 0x003b --- */
+	/*003b:*/	5, 5, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0040:*/	0x40,  /* .#...... */
+	/*0041:*/	0xa0,  /* #.#..... */
+	/*0042:*/	0xa0,  /* #.#..... */
+	/*0043:*/	0x40,  /* .#...... */
+	/*0044:*/	0xa0,  /* #.#..... */
+	/*0045:*/	0xa0,  /* #.#..... */
+	/*0046:*/	0x50,  /* .#.#.... */
+/* --- new character quotesingle (39) starting at offset 0x0047 --- */
+	/*0047:*/	5, 5, 3, 0, 3, /* width and bbox (w,h,x,y) */ 
+	/*004c:*/	0x20,  /* ..#..... */
+	/*004d:*/	0x20,  /* ..#..... */
+	/*004e:*/	0x20,  /* ..#..... */
+/* --- new character parenleft (40) starting at offset 0x004f --- */
+	/*004f:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0054:*/	0x20,  /* ..#..... */
+	/*0055:*/	0x40,  /* .#...... */
+	/*0056:*/	0x40,  /* .#...... */
+	/*0057:*/	0x40,  /* .#...... */
+	/*0058:*/	0x40,  /* .#...... */
+	/*0059:*/	0x20,  /* ..#..... */
+/* --- new character parenright (41) starting at offset 0x005a --- */
+	/*005a:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*005f:*/	0x40,  /* .#...... */
+	/*0060:*/	0x20,  /* ..#..... */
+	/*0061:*/	0x20,  /* ..#..... */
+	/*0062:*/	0x20,  /* ..#..... */
+	/*0063:*/	0x20,  /* ..#..... */
+	/*0064:*/	0x40,  /* .#...... */
+/* --- new character asterisk (42) starting at offset 0x0065 --- */
+	/*0065:*/	5, 5, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*006a:*/	0x90,  /* #..#.... */
+	/*006b:*/	0x60,  /* .##..... */
+	/*006c:*/	0xf0,  /* ####.... */
+	/*006d:*/	0x60,  /* .##..... */
+	/*006e:*/	0x90,  /* #..#.... */
+/* --- new character plus (43) starting at offset 0x006f --- */
+	/*006f:*/	5, 5, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0074:*/	0x20,  /* ..#..... */
+	/*0075:*/	0x20,  /* ..#..... */
+	/*0076:*/	0xf8,  /* #####... */
+	/*0077:*/	0x20,  /* ..#..... */
+	/*0078:*/	0x20,  /* ..#..... */
+/* --- new character comma (44) starting at offset 0x0079 --- */
+	/*0079:*/	5, 5, 3, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*007e:*/	0x30,  /* ..##.... */
+	/*007f:*/	0x20,  /* ..#..... */
+	/*0080:*/	0x40,  /* .#...... */
+/* --- new character hyphen (45) starting at offset 0x0081 --- */
+	/*0081:*/	5, 5, 1, 0, 2, /* width and bbox (w,h,x,y) */ 
+	/*0086:*/	0x70,  /* .###.... */
+/* --- new character period (46) starting at offset 0x0087 --- */
+	/*0087:*/	5, 5, 3, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*008c:*/	0x20,  /* ..#..... */
+	/*008d:*/	0x70,  /* .###.... */
+	/*008e:*/	0x20,  /* ..#..... */
+/* --- new character slash (47) starting at offset 0x008f --- */
+	/*008f:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0094:*/	0x10,  /* ...#.... */
+	/*0095:*/	0x10,  /* ...#.... */
+	/*0096:*/	0x20,  /* ..#..... */
+	/*0097:*/	0x40,  /* .#...... */
+	/*0098:*/	0x80,  /* #....... */
+	/*0099:*/	0x80,  /* #....... */
+/* --- new character zero (48) starting at offset 0x009a --- */
+	/*009a:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*009f:*/	0x20,  /* ..#..... */
+	/*00a0:*/	0x50,  /* .#.#.... */
+	/*00a1:*/	0x50,  /* .#.#.... */
+	/*00a2:*/	0x50,  /* .#.#.... */
+	/*00a3:*/	0x50,  /* .#.#.... */
+	/*00a4:*/	0x20,  /* ..#..... */
+/* --- new character one (49) starting at offset 0x00a5 --- */
+	/*00a5:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00aa:*/	0x20,  /* ..#..... */
+	/*00ab:*/	0x60,  /* .##..... */
+	/*00ac:*/	0x20,  /* ..#..... */
+	/*00ad:*/	0x20,  /* ..#..... */
+	/*00ae:*/	0x20,  /* ..#..... */
+	/*00af:*/	0x70,  /* .###.... */
+/* --- new character two (50) starting at offset 0x00b0 --- */
+	/*00b0:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00b5:*/	0x60,  /* .##..... */
+	/*00b6:*/	0x90,  /* #..#.... */
+	/*00b7:*/	0x10,  /* ...#.... */
+	/*00b8:*/	0x60,  /* .##..... */
+	/*00b9:*/	0x80,  /* #....... */
+	/*00ba:*/	0xf0,  /* ####.... */
+/* --- new character three (51) starting at offset 0x00bb --- */
+	/*00bb:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00c0:*/	0xf0,  /* ####.... */
+	/*00c1:*/	0x20,  /* ..#..... */
+	/*00c2:*/	0x60,  /* .##..... */
+	/*00c3:*/	0x10,  /* ...#.... */
+	/*00c4:*/	0x90,  /* #..#.... */
+	/*00c5:*/	0x60,  /* .##..... */
+/* --- new character four (52) starting at offset 0x00c6 --- */
+	/*00c6:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00cb:*/	0x20,  /* ..#..... */
+	/*00cc:*/	0x60,  /* .##..... */
+	/*00cd:*/	0xa0,  /* #.#..... */
+	/*00ce:*/	0xf0,  /* ####.... */
+	/*00cf:*/	0x20,  /* ..#..... */
+	/*00d0:*/	0x20,  /* ..#..... */
+/* --- new character five (53) starting at offset 0x00d1 --- */
+	/*00d1:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00d6:*/	0xf0,  /* ####.... */
+	/*00d7:*/	0x80,  /* #....... */
+	/*00d8:*/	0xe0,  /* ###..... */
+	/*00d9:*/	0x10,  /* ...#.... */
+	/*00da:*/	0x90,  /* #..#.... */
+	/*00db:*/	0x60,  /* .##..... */
+/* --- new character six (54) starting at offset 0x00dc --- */
+	/*00dc:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00e1:*/	0x60,  /* .##..... */
+	/*00e2:*/	0x80,  /* #....... */
+	/*00e3:*/	0xe0,  /* ###..... */
+	/*00e4:*/	0x90,  /* #..#.... */
+	/*00e5:*/	0x90,  /* #..#.... */
+	/*00e6:*/	0x60,  /* .##..... */
+/* --- new character seven (55) starting at offset 0x00e7 --- */
+	/*00e7:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00ec:*/	0xf0,  /* ####.... */
+	/*00ed:*/	0x10,  /* ...#.... */
+	/*00ee:*/	0x20,  /* ..#..... */
+	/*00ef:*/	0x20,  /* ..#..... */
+	/*00f0:*/	0x40,  /* .#...... */
+	/*00f1:*/	0x40,  /* .#...... */
+/* --- new character eight (56) starting at offset 0x00f2 --- */
+	/*00f2:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00f7:*/	0x60,  /* .##..... */
+	/*00f8:*/	0x90,  /* #..#.... */
+	/*00f9:*/	0x60,  /* .##..... */
+	/*00fa:*/	0x90,  /* #..#.... */
+	/*00fb:*/	0x90,  /* #..#.... */
+	/*00fc:*/	0x60,  /* .##..... */
+/* --- new character nine (57) starting at offset 0x00fd --- */
+	/*00fd:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0102:*/	0x60,  /* .##..... */
+	/*0103:*/	0x90,  /* #..#.... */
+	/*0104:*/	0x90,  /* #..#.... */
+	/*0105:*/	0x70,  /* .###.... */
+	/*0106:*/	0x10,  /* ...#.... */
+	/*0107:*/	0x60,  /* .##..... */
+/* --- new character colon (58) starting at offset 0x0108 --- */
+	/*0108:*/	5, 5, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*010d:*/	0x60,  /* .##..... */
+	/*010e:*/	0x60,  /* .##..... */
+	/*010f:*/	0x00,  /* ........ */
+	/*0110:*/	0x60,  /* .##..... */
+	/*0111:*/	0x60,  /* .##..... */
+/* --- new character semicolon (59) starting at offset 0x0112 --- */
+	/*0112:*/	5, 5, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0117:*/	0x30,  /* ..##.... */
+	/*0118:*/	0x30,  /* ..##.... */
+	/*0119:*/	0x00,  /* ........ */
+	/*011a:*/	0x30,  /* ..##.... */
+	/*011b:*/	0x20,  /* ..#..... */
+	/*011c:*/	0x40,  /* .#...... */
+/* --- new character less (60) starting at offset 0x011d --- */
+	/*011d:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0122:*/	0x10,  /* ...#.... */
+	/*0123:*/	0x20,  /* ..#..... */
+	/*0124:*/	0x40,  /* .#...... */
+	/*0125:*/	0x40,  /* .#...... */
+	/*0126:*/	0x20,  /* ..#..... */
+	/*0127:*/	0x10,  /* ...#.... */
+/* --- new character equal (61) starting at offset 0x0128 --- */
+	/*0128:*/	5, 5, 3, 0, 1, /* width and bbox (w,h,x,y) */ 
+	/*012d:*/	0xf0,  /* ####.... */
+	/*012e:*/	0x00,  /* ........ */
+	/*012f:*/	0xf0,  /* ####.... */
+/* --- new character greater (62) starting at offset 0x0130 --- */
+	/*0130:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0135:*/	0x40,  /* .#...... */
+	/*0136:*/	0x20,  /* ..#..... */
+	/*0137:*/	0x10,  /* ...#.... */
+	/*0138:*/	0x10,  /* ...#.... */
+	/*0139:*/	0x20,  /* ..#..... */
+	/*013a:*/	0x40,  /* .#...... */
+/* --- new character question (63) starting at offset 0x013b --- */
+	/*013b:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0140:*/	0x20,  /* ..#..... */
+	/*0141:*/	0x50,  /* .#.#.... */
+	/*0142:*/	0x10,  /* ...#.... */
+	/*0143:*/	0x20,  /* ..#..... */
+	/*0144:*/	0x00,  /* ........ */
+	/*0145:*/	0x20,  /* ..#..... */
+/* --- new character at (64) starting at offset 0x0146 --- */
+	/*0146:*/	5, 5, 8, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*014b:*/	0x30,  /* ..##.... */
+	/*014c:*/	0x48,  /* .#..#... */
+	/*014d:*/	0x98,  /* #..##... */
+	/*014e:*/	0xa8,  /* #.#.#... */
+	/*014f:*/	0xa8,  /* #.#.#... */
+	/*0150:*/	0x90,  /* #..#.... */
+	/*0151:*/	0x40,  /* .#...... */
+	/*0152:*/	0x30,  /* ..##.... */
+/* --- new character A (65) starting at offset 0x0153 --- */
+	/*0153:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0158:*/	0x60,  /* .##..... */
+	/*0159:*/	0x90,  /* #..#.... */
+	/*015a:*/	0x90,  /* #..#.... */
+	/*015b:*/	0xf0,  /* ####.... */
+	/*015c:*/	0x90,  /* #..#.... */
+	/*015d:*/	0x90,  /* #..#.... */
+/* --- new character B (66) starting at offset 0x015e --- */
+	/*015e:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0163:*/	0xe0,  /* ###..... */
+	/*0164:*/	0x90,  /* #..#.... */
+	/*0165:*/	0xe0,  /* ###..... */
+	/*0166:*/	0x90,  /* #..#.... */
+	/*0167:*/	0x90,  /* #..#.... */
+	/*0168:*/	0xe0,  /* ###..... */
+/* --- new character C (67) starting at offset 0x0169 --- */
+	/*0169:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*016e:*/	0x60,  /* .##..... */
+	/*016f:*/	0x90,  /* #..#.... */
+	/*0170:*/	0x80,  /* #....... */
+	/*0171:*/	0x80,  /* #....... */
+	/*0172:*/	0x90,  /* #..#.... */
+	/*0173:*/	0x60,  /* .##..... */
+/* --- new character D (68) starting at offset 0x0174 --- */
+	/*0174:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0179:*/	0xe0,  /* ###..... */
+	/*017a:*/	0x90,  /* #..#.... */
+	/*017b:*/	0x90,  /* #..#.... */
+	/*017c:*/	0x90,  /* #..#.... */
+	/*017d:*/	0x90,  /* #..#.... */
+	/*017e:*/	0xe0,  /* ###..... */
+/* --- new character E (69) starting at offset 0x017f --- */
+	/*017f:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0184:*/	0xf0,  /* ####.... */
+	/*0185:*/	0x80,  /* #....... */
+	/*0186:*/	0xe0,  /* ###..... */
+	/*0187:*/	0x80,  /* #....... */
+	/*0188:*/	0x80,  /* #....... */
+	/*0189:*/	0xf0,  /* ####.... */
+/* --- new character F (70) starting at offset 0x018a --- */
+	/*018a:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*018f:*/	0xf0,  /* ####.... */
+	/*0190:*/	0x80,  /* #....... */
+	/*0191:*/	0xe0,  /* ###..... */
+	/*0192:*/	0x80,  /* #....... */
+	/*0193:*/	0x80,  /* #....... */
+	/*0194:*/	0x80,  /* #....... */
+/* --- new character G (71) starting at offset 0x0195 --- */
+	/*0195:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*019a:*/	0x60,  /* .##..... */
+	/*019b:*/	0x90,  /* #..#.... */
+	/*019c:*/	0x80,  /* #....... */
+	/*019d:*/	0xb0,  /* #.##.... */
+	/*019e:*/	0x90,  /* #..#.... */
+	/*019f:*/	0x60,  /* .##..... */
+/* --- new character H (72) starting at offset 0x01a0 --- */
+	/*01a0:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01a5:*/	0x90,  /* #..#.... */
+	/*01a6:*/	0x90,  /* #..#.... */
+	/*01a7:*/	0xf0,  /* ####.... */
+	/*01a8:*/	0x90,  /* #..#.... */
+	/*01a9:*/	0x90,  /* #..#.... */
+	/*01aa:*/	0x90,  /* #..#.... */
+/* --- new character I (73) starting at offset 0x01ab --- */
+	/*01ab:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01b0:*/	0x70,  /* .###.... */
+	/*01b1:*/	0x20,  /* ..#..... */
+	/*01b2:*/	0x20,  /* ..#..... */
+	/*01b3:*/	0x20,  /* ..#..... */
+	/*01b4:*/	0x20,  /* ..#..... */
+	/*01b5:*/	0x70,  /* .###.... */
+/* --- new character J (74) starting at offset 0x01b6 --- */
+	/*01b6:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01bb:*/	0x70,  /* .###.... */
+	/*01bc:*/	0x20,  /* ..#..... */
+	/*01bd:*/	0x20,  /* ..#..... */
+	/*01be:*/	0x20,  /* ..#..... */
+	/*01bf:*/	0xa0,  /* #.#..... */
+	/*01c0:*/	0x40,  /* .#...... */
+/* --- new character K (75) starting at offset 0x01c1 --- */
+	/*01c1:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01c6:*/	0x90,  /* #..#.... */
+	/*01c7:*/	0xa0,  /* #.#..... */
+	/*01c8:*/	0xc0,  /* ##...... */
+	/*01c9:*/	0xa0,  /* #.#..... */
+	/*01ca:*/	0xa0,  /* #.#..... */
+	/*01cb:*/	0x90,  /* #..#.... */
+/* --- new character L (76) starting at offset 0x01cc --- */
+	/*01cc:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01d1:*/	0x80,  /* #....... */
+	/*01d2:*/	0x80,  /* #....... */
+	/*01d3:*/	0x80,  /* #....... */
+	/*01d4:*/	0x80,  /* #....... */
+	/*01d5:*/	0x80,  /* #....... */
+	/*01d6:*/	0xf0,  /* ####.... */
+/* --- new character M (77) starting at offset 0x01d7 --- */
+	/*01d7:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01dc:*/	0x90,  /* #..#.... */
+	/*01dd:*/	0xf0,  /* ####.... */
+	/*01de:*/	0xf0,  /* ####.... */
+	/*01df:*/	0x90,  /* #..#.... */
+	/*01e0:*/	0x90,  /* #..#.... */
+	/*01e1:*/	0x90,  /* #..#.... */
+/* --- new character N (78) starting at offset 0x01e2 --- */
+	/*01e2:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01e7:*/	0x90,  /* #..#.... */
+	/*01e8:*/	0xd0,  /* ##.#.... */
+	/*01e9:*/	0xf0,  /* ####.... */
+	/*01ea:*/	0xb0,  /* #.##.... */
+	/*01eb:*/	0xb0,  /* #.##.... */
+	/*01ec:*/	0x90,  /* #..#.... */
+/* --- new character O (79) starting at offset 0x01ed --- */
+	/*01ed:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01f2:*/	0x60,  /* .##..... */
+	/*01f3:*/	0x90,  /* #..#.... */
+	/*01f4:*/	0x90,  /* #..#.... */
+	/*01f5:*/	0x90,  /* #..#.... */
+	/*01f6:*/	0x90,  /* #..#.... */
+	/*01f7:*/	0x60,  /* .##..... */
+/* --- new character P (80) starting at offset 0x01f8 --- */
+	/*01f8:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01fd:*/	0xe0,  /* ###..... */
+	/*01fe:*/	0x90,  /* #..#.... */
+	/*01ff:*/	0x90,  /* #..#.... */
+	/*0200:*/	0xe0,  /* ###..... */
+	/*0201:*/	0x80,  /* #....... */
+	/*0202:*/	0x80,  /* #....... */
+/* --- new character Q (81) starting at offset 0x0203 --- */
+	/*0203:*/	5, 5, 7, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0208:*/	0x60,  /* .##..... */
+	/*0209:*/	0x90,  /* #..#.... */
+	/*020a:*/	0x90,  /* #..#.... */
+	/*020b:*/	0xd0,  /* ##.#.... */
+	/*020c:*/	0xb0,  /* #.##.... */
+	/*020d:*/	0x60,  /* .##..... */
+	/*020e:*/	0x10,  /* ...#.... */
+/* --- new character R (82) starting at offset 0x020f --- */
+	/*020f:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0214:*/	0xe0,  /* ###..... */
+	/*0215:*/	0x90,  /* #..#.... */
+	/*0216:*/	0x90,  /* #..#.... */
+	/*0217:*/	0xe0,  /* ###..... */
+	/*0218:*/	0x90,  /* #..#.... */
+	/*0219:*/	0x90,  /* #..#.... */
+/* --- new character S (83) starting at offset 0x021a --- */
+	/*021a:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*021f:*/	0x60,  /* .##..... */
+	/*0220:*/	0x90,  /* #..#.... */
+	/*0221:*/	0x40,  /* .#...... */
+	/*0222:*/	0x20,  /* ..#..... */
+	/*0223:*/	0x90,  /* #..#.... */
+	/*0224:*/	0x60,  /* .##..... */
+/* --- new character T (84) starting at offset 0x0225 --- */
+	/*0225:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*022a:*/	0x70,  /* .###.... */
+	/*022b:*/	0x20,  /* ..#..... */
+	/*022c:*/	0x20,  /* ..#..... */
+	/*022d:*/	0x20,  /* ..#..... */
+	/*022e:*/	0x20,  /* ..#..... */
+	/*022f:*/	0x20,  /* ..#..... */
+/* --- new character U (85) starting at offset 0x0230 --- */
+	/*0230:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0235:*/	0x90,  /* #..#.... */
+	/*0236:*/	0x90,  /* #..#.... */
+	/*0237:*/	0x90,  /* #..#.... */
+	/*0238:*/	0x90,  /* #..#.... */
+	/*0239:*/	0x90,  /* #..#.... */
+	/*023a:*/	0x60,  /* .##..... */
+/* --- new character V (86) starting at offset 0x023b --- */
+	/*023b:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0240:*/	0x90,  /* #..#.... */
+	/*0241:*/	0x90,  /* #..#.... */
+	/*0242:*/	0x90,  /* #..#.... */
+	/*0243:*/	0x90,  /* #..#.... */
+	/*0244:*/	0x60,  /* .##..... */
+	/*0245:*/	0x60,  /* .##..... */
+/* --- new character W (87) starting at offset 0x0246 --- */
+	/*0246:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*024b:*/	0x90,  /* #..#.... */
+	/*024c:*/	0x90,  /* #..#.... */
+	/*024d:*/	0x90,  /* #..#.... */
+	/*024e:*/	0xf0,  /* ####.... */
+	/*024f:*/	0xf0,  /* ####.... */
+	/*0250:*/	0x90,  /* #..#.... */
+/* --- new character X (88) starting at offset 0x0251 --- */
+	/*0251:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0256:*/	0x90,  /* #..#.... */
+	/*0257:*/	0x90,  /* #..#.... */
+	/*0258:*/	0x60,  /* .##..... */
+	/*0259:*/	0x60,  /* .##..... */
+	/*025a:*/	0x90,  /* #..#.... */
+	/*025b:*/	0x90,  /* #..#.... */
+/* --- new character Y (89) starting at offset 0x025c --- */
+	/*025c:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0261:*/	0x88,  /* #...#... */
+	/*0262:*/	0x88,  /* #...#... */
+	/*0263:*/	0x50,  /* .#.#.... */
+	/*0264:*/	0x20,  /* ..#..... */
+	/*0265:*/	0x20,  /* ..#..... */
+	/*0266:*/	0x20,  /* ..#..... */
+/* --- new character Z (90) starting at offset 0x0267 --- */
+	/*0267:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*026c:*/	0xf0,  /* ####.... */
+	/*026d:*/	0x10,  /* ...#.... */
+	/*026e:*/	0x20,  /* ..#..... */
+	/*026f:*/	0x40,  /* .#...... */
+	/*0270:*/	0x80,  /* #....... */
+	/*0271:*/	0xf0,  /* ####.... */
+/* --- new character bracketleft (91) starting at offset 0x0272 --- */
+	/*0272:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0277:*/	0x70,  /* .###.... */
+	/*0278:*/	0x40,  /* .#...... */
+	/*0279:*/	0x40,  /* .#...... */
+	/*027a:*/	0x40,  /* .#...... */
+	/*027b:*/	0x40,  /* .#...... */
+	/*027c:*/	0x70,  /* .###.... */
+/* --- new character backslash (92) starting at offset 0x027d --- */
+	/*027d:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0282:*/	0x80,  /* #....... */
+	/*0283:*/	0x80,  /* #....... */
+	/*0284:*/	0x40,  /* .#...... */
+	/*0285:*/	0x20,  /* ..#..... */
+	/*0286:*/	0x10,  /* ...#.... */
+	/*0287:*/	0x10,  /* ...#.... */
+/* --- new character bracketright (93) starting at offset 0x0288 --- */
+	/*0288:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*028d:*/	0x70,  /* .###.... */
+	/*028e:*/	0x10,  /* ...#.... */
+	/*028f:*/	0x10,  /* ...#.... */
+	/*0290:*/	0x10,  /* ...#.... */
+	/*0291:*/	0x10,  /* ...#.... */
+	/*0292:*/	0x70,  /* .###.... */
+/* --- new character asciicircum (94) starting at offset 0x0293 --- */
+	/*0293:*/	5, 5, 2, 0, 4, /* width and bbox (w,h,x,y) */ 
+	/*0298:*/	0x20,  /* ..#..... */
+	/*0299:*/	0x50,  /* .#.#.... */
+/* --- new character underscore (95) starting at offset 0x029a --- */
+	/*029a:*/	5, 5, 1, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*029f:*/	0xf0,  /* ####.... */
+/* --- new character grave (96) starting at offset 0x02a0 --- */
+	/*02a0:*/	5, 5, 2, 0, 4, /* width and bbox (w,h,x,y) */ 
+	/*02a5:*/	0x40,  /* .#...... */
+	/*02a6:*/	0x20,  /* ..#..... */
+/* --- new character a (97) starting at offset 0x02a7 --- */
+	/*02a7:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02ac:*/	0x70,  /* .###.... */
+	/*02ad:*/	0x90,  /* #..#.... */
+	/*02ae:*/	0x90,  /* #..#.... */
+	/*02af:*/	0x70,  /* .###.... */
+/* --- new character b (98) starting at offset 0x02b0 --- */
+	/*02b0:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02b5:*/	0x80,  /* #....... */
+	/*02b6:*/	0x80,  /* #....... */
+	/*02b7:*/	0xe0,  /* ###..... */
+	/*02b8:*/	0x90,  /* #..#.... */
+	/*02b9:*/	0x90,  /* #..#.... */
+	/*02ba:*/	0xe0,  /* ###..... */
+/* --- new character c (99) starting at offset 0x02bb --- */
+	/*02bb:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02c0:*/	0x30,  /* ..##.... */
+	/*02c1:*/	0x40,  /* .#...... */
+	/*02c2:*/	0x40,  /* .#...... */
+	/*02c3:*/	0x30,  /* ..##.... */
+/* --- new character d (100) starting at offset 0x02c4 --- */
+	/*02c4:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02c9:*/	0x10,  /* ...#.... */
+	/*02ca:*/	0x10,  /* ...#.... */
+	/*02cb:*/	0x70,  /* .###.... */
+	/*02cc:*/	0x90,  /* #..#.... */
+	/*02cd:*/	0x90,  /* #..#.... */
+	/*02ce:*/	0x70,  /* .###.... */
+/* --- new character e (101) starting at offset 0x02cf --- */
+	/*02cf:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02d4:*/	0x60,  /* .##..... */
+	/*02d5:*/	0xb0,  /* #.##.... */
+	/*02d6:*/	0xc0,  /* ##...... */
+	/*02d7:*/	0x60,  /* .##..... */
+/* --- new character f (102) starting at offset 0x02d8 --- */
+	/*02d8:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02dd:*/	0x20,  /* ..#..... */
+	/*02de:*/	0x50,  /* .#.#.... */
+	/*02df:*/	0x40,  /* .#...... */
+	/*02e0:*/	0xe0,  /* ###..... */
+	/*02e1:*/	0x40,  /* .#...... */
+	/*02e2:*/	0x40,  /* .#...... */
+/* --- new character g (103) starting at offset 0x02e3 --- */
+	/*02e3:*/	5, 5, 5, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*02e8:*/	0x60,  /* .##..... */
+	/*02e9:*/	0x90,  /* #..#.... */
+	/*02ea:*/	0x70,  /* .###.... */
+	/*02eb:*/	0x10,  /* ...#.... */
+	/*02ec:*/	0x60,  /* .##..... */
+/* --- new character h (104) starting at offset 0x02ed --- */
+	/*02ed:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02f2:*/	0x80,  /* #....... */
+	/*02f3:*/	0x80,  /* #....... */
+	/*02f4:*/	0xe0,  /* ###..... */
+	/*02f5:*/	0x90,  /* #..#.... */
+	/*02f6:*/	0x90,  /* #..#.... */
+	/*02f7:*/	0x90,  /* #..#.... */
+/* --- new character i (105) starting at offset 0x02f8 --- */
+	/*02f8:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02fd:*/	0x20,  /* ..#..... */
+	/*02fe:*/	0x00,  /* ........ */
+	/*02ff:*/	0x60,  /* .##..... */
+	/*0300:*/	0x20,  /* ..#..... */
+	/*0301:*/	0x20,  /* ..#..... */
+	/*0302:*/	0x70,  /* .###.... */
+/* --- new character j (106) starting at offset 0x0303 --- */
+	/*0303:*/	5, 5, 7, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0308:*/	0x10,  /* ...#.... */
+	/*0309:*/	0x00,  /* ........ */
+	/*030a:*/	0x10,  /* ...#.... */
+	/*030b:*/	0x10,  /* ...#.... */
+	/*030c:*/	0x10,  /* ...#.... */
+	/*030d:*/	0x50,  /* .#.#.... */
+	/*030e:*/	0x20,  /* ..#..... */
+/* --- new character k (107) starting at offset 0x030f --- */
+	/*030f:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0314:*/	0x80,  /* #....... */
+	/*0315:*/	0x80,  /* #....... */
+	/*0316:*/	0x90,  /* #..#.... */
+	/*0317:*/	0xe0,  /* ###..... */
+	/*0318:*/	0x90,  /* #..#.... */
+	/*0319:*/	0x90,  /* #..#.... */
+/* --- new character l (108) starting at offset 0x031a --- */
+	/*031a:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*031f:*/	0x60,  /* .##..... */
+	/*0320:*/	0x20,  /* ..#..... */
+	/*0321:*/	0x20,  /* ..#..... */
+	/*0322:*/	0x20,  /* ..#..... */
+	/*0323:*/	0x20,  /* ..#..... */
+	/*0324:*/	0x70,  /* .###.... */
+/* --- new character m (109) starting at offset 0x0325 --- */
+	/*0325:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*032a:*/	0xd0,  /* ##.#.... */
+	/*032b:*/	0xa8,  /* #.#.#... */
+	/*032c:*/	0xa8,  /* #.#.#... */
+	/*032d:*/	0xa8,  /* #.#.#... */
+/* --- new character n (110) starting at offset 0x032e --- */
+	/*032e:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0333:*/	0xe0,  /* ###..... */
+	/*0334:*/	0x90,  /* #..#.... */
+	/*0335:*/	0x90,  /* #..#.... */
+	/*0336:*/	0x90,  /* #..#.... */
+/* --- new character o (111) starting at offset 0x0337 --- */
+	/*0337:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*033c:*/	0x60,  /* .##..... */
+	/*033d:*/	0x90,  /* #..#.... */
+	/*033e:*/	0x90,  /* #..#.... */
+	/*033f:*/	0x60,  /* .##..... */
+/* --- new character p (112) starting at offset 0x0340 --- */
+	/*0340:*/	5, 5, 5, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0345:*/	0xe0,  /* ###..... */
+	/*0346:*/	0x90,  /* #..#.... */
+	/*0347:*/	0xe0,  /* ###..... */
+	/*0348:*/	0x80,  /* #....... */
+	/*0349:*/	0x80,  /* #....... */
+/* --- new character q (113) starting at offset 0x034a --- */
+	/*034a:*/	5, 5, 5, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*034f:*/	0x70,  /* .###.... */
+	/*0350:*/	0x90,  /* #..#.... */
+	/*0351:*/	0x70,  /* .###.... */
+	/*0352:*/	0x10,  /* ...#.... */
+	/*0353:*/	0x10,  /* ...#.... */
+/* --- new character r (114) starting at offset 0x0354 --- */
+	/*0354:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0359:*/	0xa0,  /* #.#..... */
+	/*035a:*/	0xd0,  /* ##.#.... */
+	/*035b:*/	0x80,  /* #....... */
+	/*035c:*/	0x80,  /* #....... */
+/* --- new character s (115) starting at offset 0x035d --- */
+	/*035d:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0362:*/	0x30,  /* ..##.... */
+	/*0363:*/	0x60,  /* .##..... */
+	/*0364:*/	0x10,  /* ...#.... */
+	/*0365:*/	0x60,  /* .##..... */
+/* --- new character t (116) starting at offset 0x0366 --- */
+	/*0366:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*036b:*/	0x40,  /* .#...... */
+	/*036c:*/	0x40,  /* .#...... */
+	/*036d:*/	0xe0,  /* ###..... */
+	/*036e:*/	0x40,  /* .#...... */
+	/*036f:*/	0x50,  /* .#.#.... */
+	/*0370:*/	0x20,  /* ..#..... */
+/* --- new character u (117) starting at offset 0x0371 --- */
+	/*0371:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0376:*/	0x90,  /* #..#.... */
+	/*0377:*/	0x90,  /* #..#.... */
+	/*0378:*/	0x90,  /* #..#.... */
+	/*0379:*/	0x70,  /* .###.... */
+/* --- new character v (118) starting at offset 0x037a --- */
+	/*037a:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*037f:*/	0x50,  /* .#.#.... */
+	/*0380:*/	0x50,  /* .#.#.... */
+	/*0381:*/	0x50,  /* .#.#.... */
+	/*0382:*/	0x20,  /* ..#..... */
+/* --- new character w (119) starting at offset 0x0383 --- */
+	/*0383:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0388:*/	0x88,  /* #...#... */
+	/*0389:*/	0xa8,  /* #.#.#... */
+	/*038a:*/	0xa8,  /* #.#.#... */
+	/*038b:*/	0x50,  /* .#.#.... */
+/* --- new character x (120) starting at offset 0x038c --- */
+	/*038c:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0391:*/	0x90,  /* #..#.... */
+	/*0392:*/	0x60,  /* .##..... */
+	/*0393:*/	0x60,  /* .##..... */
+	/*0394:*/	0x90,  /* #..#.... */
+/* --- new character y (121) starting at offset 0x0395 --- */
+	/*0395:*/	5, 5, 5, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*039a:*/	0x90,  /* #..#.... */
+	/*039b:*/	0x90,  /* #..#.... */
+	/*039c:*/	0x70,  /* .###.... */
+	/*039d:*/	0x90,  /* #..#.... */
+	/*039e:*/	0x60,  /* .##..... */
+/* --- new character z (122) starting at offset 0x039f --- */
+	/*039f:*/	5, 5, 4, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03a4:*/	0xf0,  /* ####.... */
+	/*03a5:*/	0x20,  /* ..#..... */
+	/*03a6:*/	0x40,  /* .#...... */
+	/*03a7:*/	0xf0,  /* ####.... */
+/* --- new character braceleft (123) starting at offset 0x03a8 --- */
+	/*03a8:*/	5, 5, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03ad:*/	0x30,  /* ..##.... */
+	/*03ae:*/	0x40,  /* .#...... */
+	/*03af:*/	0x20,  /* ..#..... */
+	/*03b0:*/	0xc0,  /* ##...... */
+	/*03b1:*/	0x20,  /* ..#..... */
+	/*03b2:*/	0x40,  /* .#...... */
+	/*03b3:*/	0x30,  /* ..##.... */
+/* --- new character bar (124) starting at offset 0x03b4 --- */
+	/*03b4:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03b9:*/	0x20,  /* ..#..... */
+	/*03ba:*/	0x20,  /* ..#..... */
+	/*03bb:*/	0x20,  /* ..#..... */
+	/*03bc:*/	0x20,  /* ..#..... */
+	/*03bd:*/	0x20,  /* ..#..... */
+	/*03be:*/	0x20,  /* ..#..... */
+/* --- new character braceright (125) starting at offset 0x03bf --- */
+	/*03bf:*/	5, 5, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03c4:*/	0xc0,  /* ##...... */
+	/*03c5:*/	0x20,  /* ..#..... */
+	/*03c6:*/	0x40,  /* .#...... */
+	/*03c7:*/	0x30,  /* ..##.... */
+	/*03c8:*/	0x40,  /* .#...... */
+	/*03c9:*/	0x20,  /* ..#..... */
+	/*03ca:*/	0xc0,  /* ##...... */
+/* --- new character asciitilde (126) starting at offset 0x03cb --- */
+	/*03cb:*/	5, 5, 2, 0, 4, /* width and bbox (w,h,x,y) */ 
+	/*03d0:*/	0x50,  /* .#.#.... */
+	/*03d1:*/	0xa0,  /* #.#..... */
+};
+static const uint16_t font_5x8_offsets[] = {
+0x0000 /* space */,
+	0x0006 /* exclam */,
+	0x0011 /* quotedbl */,
+	0x0019 /* numbersign */,
+	0x0025 /* dollar */,
+	0x0031 /* percent */,
+	0x003b /* ampersand */,
+	0x0047 /* quotesingle */,
+	0x004f /* parenleft */,
+	0x005a /* parenright */,
+	0x0065 /* asterisk */,
+	0x006f /* plus */,
+	0x0079 /* comma */,
+	0x0081 /* hyphen */,
+	0x0087 /* period */,
+	0x008f /* slash */,
+	0x009a /* zero */,
+	0x00a5 /* one */,
+	0x00b0 /* two */,
+	0x00bb /* three */,
+	0x00c6 /* four */,
+	0x00d1 /* five */,
+	0x00dc /* six */,
+	0x00e7 /* seven */,
+	0x00f2 /* eight */,
+	0x00fd /* nine */,
+	0x0108 /* colon */,
+	0x0112 /* semicolon */,
+	0x011d /* less */,
+	0x0128 /* equal */,
+	0x0130 /* greater */,
+	0x013b /* question */,
+	0x0146 /* at */,
+	0x0153 /* A */,
+	0x015e /* B */,
+	0x0169 /* C */,
+	0x0174 /* D */,
+	0x017f /* E */,
+	0x018a /* F */,
+	0x0195 /* G */,
+	0x01a0 /* H */,
+	0x01ab /* I */,
+	0x01b6 /* J */,
+	0x01c1 /* K */,
+	0x01cc /* L */,
+	0x01d7 /* M */,
+	0x01e2 /* N */,
+	0x01ed /* O */,
+	0x01f8 /* P */,
+	0x0203 /* Q */,
+	0x020f /* R */,
+	0x021a /* S */,
+	0x0225 /* T */,
+	0x0230 /* U */,
+	0x023b /* V */,
+	0x0246 /* W */,
+	0x0251 /* X */,
+	0x025c /* Y */,
+	0x0267 /* Z */,
+	0x0272 /* bracketleft */,
+	0x027d /* backslash */,
+	0x0288 /* bracketright */,
+	0x0293 /* asciicircum */,
+	0x029a /* underscore */,
+	0x02a0 /* grave */,
+	0x02a7 /* a */,
+	0x02b0 /* b */,
+	0x02bb /* c */,
+	0x02c4 /* d */,
+	0x02cf /* e */,
+	0x02d8 /* f */,
+	0x02e3 /* g */,
+	0x02ed /* h */,
+	0x02f8 /* i */,
+	0x0303 /* j */,
+	0x030f /* k */,
+	0x031a /* l */,
+	0x0325 /* m */,
+	0x032e /* n */,
+	0x0337 /* o */,
+	0x0340 /* p */,
+	0x034a /* q */,
+	0x0354 /* r */,
+	0x035d /* s */,
+	0x0366 /* t */,
+	0x0371 /* u */,
+	0x037a /* v */,
+	0x0383 /* w */,
+	0x038c /* x */,
+	0x0395 /* y */,
+	0x039f /* z */,
+	0x03a8 /* braceleft */,
+	0x03b4 /* bar */,
+	0x03bf /* braceright */,
+	0x03cb /* asciitilde */,
+	0xffff /* (no glyph) */
+};
+const struct fb_font font_5x8 = {
+	.height = 8,
+	.ascent = 7,
+	.firstchar = 32, /* space */
+	.lastchar = 127, /* ? */
+	.chardata = font_5x8_data,
+	.charoffs = font_5x8_offsets,
+};
diff --git a/src/target/firmware/fb/c64.c b/src/target/firmware/fb/c64.c
new file mode 100644
index 00000000..82ebfa35
--- /dev/null
+++ b/src/target/firmware/fb/c64.c
@@ -0,0 +1,1069 @@
+#include <fb/font.h>
+static const uint8_t font_c64_data[] = {
+/* --- new character ' ' (32) starting at offset 0x0000 --- */
+	/*0000:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0005:*/	0x00,	/* ........ */
+	/*0006:*/	0x00,	/* ........ */
+	/*0007:*/	0x00,	/* ........ */
+	/*0008:*/	0x00,	/* ........ */
+	/*0009:*/	0x00,	/* ........ */
+	/*000a:*/	0x00,	/* ........ */
+	/*000b:*/	0x00,	/* ........ */
+	/*000c:*/	0x00,	/* ........ */
+/* --- new character '!' (33) starting at offset 0x000d --- */
+	/*000d:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0012:*/	0x18,	/* ...##... */
+	/*0013:*/	0x18,	/* ...##... */
+	/*0014:*/	0x18,	/* ...##... */
+	/*0015:*/	0x18,	/* ...##... */
+	/*0016:*/	0x00,	/* ........ */
+	/*0017:*/	0x00,	/* ........ */
+	/*0018:*/	0x18,	/* ...##... */
+	/*0019:*/	0x00,	/* ........ */
+/* --- new character '"' (34) starting at offset 0x001a --- */
+	/*001a:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*001f:*/	0x66,	/* .##..##. */
+	/*0020:*/	0x66,	/* .##..##. */
+	/*0021:*/	0x66,	/* .##..##. */
+	/*0022:*/	0x00,	/* ........ */
+	/*0023:*/	0x00,	/* ........ */
+	/*0024:*/	0x00,	/* ........ */
+	/*0025:*/	0x00,	/* ........ */
+	/*0026:*/	0x00,	/* ........ */
+/* --- new character '#' (35) starting at offset 0x0027 --- */
+	/*0027:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*002c:*/	0x66,	/* .##..##. */
+	/*002d:*/	0x66,	/* .##..##. */
+	/*002e:*/	0xff,	/* ######## */
+	/*002f:*/	0x66,	/* .##..##. */
+	/*0030:*/	0xff,	/* ######## */
+	/*0031:*/	0x66,	/* .##..##. */
+	/*0032:*/	0x66,	/* .##..##. */
+	/*0033:*/	0x00,	/* ........ */
+/* --- new character '$' (36) starting at offset 0x0034 --- */
+	/*0034:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0039:*/	0x18,	/* ...##... */
+	/*003a:*/	0x3e,	/* ..#####. */
+	/*003b:*/	0x60,	/* .##..... */
+	/*003c:*/	0x3c,	/* ..####.. */
+	/*003d:*/	0x06,	/* .....##. */
+	/*003e:*/	0x7c,	/* .#####.. */
+	/*003f:*/	0x18,	/* ...##... */
+	/*0040:*/	0x00,	/* ........ */
+/* --- new character '%' (37) starting at offset 0x0041 --- */
+	/*0041:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0046:*/	0x62,	/* .##...#. */
+	/*0047:*/	0x66,	/* .##..##. */
+	/*0048:*/	0x0c,	/* ....##.. */
+	/*0049:*/	0x18,	/* ...##... */
+	/*004a:*/	0x30,	/* ..##.... */
+	/*004b:*/	0x66,	/* .##..##. */
+	/*004c:*/	0x46,	/* .#...##. */
+	/*004d:*/	0x00,	/* ........ */
+/* --- new character '&' (38) starting at offset 0x004e --- */
+	/*004e:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0053:*/	0x3c,	/* ..####.. */
+	/*0054:*/	0x66,	/* .##..##. */
+	/*0055:*/	0x3c,	/* ..####.. */
+	/*0056:*/	0x38,	/* ..###... */
+	/*0057:*/	0x67,	/* .##..### */
+	/*0058:*/	0x66,	/* .##..##. */
+	/*0059:*/	0x3f,	/* ..###### */
+	/*005a:*/	0x00,	/* ........ */
+/* --- new character ''' (39) starting at offset 0x005b --- */
+	/*005b:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0060:*/	0x06,	/* .....##. */
+	/*0061:*/	0x0c,	/* ....##.. */
+	/*0062:*/	0x18,	/* ...##... */
+	/*0063:*/	0x00,	/* ........ */
+	/*0064:*/	0x00,	/* ........ */
+	/*0065:*/	0x00,	/* ........ */
+	/*0066:*/	0x00,	/* ........ */
+	/*0067:*/	0x00,	/* ........ */
+/* --- new character '(' (40) starting at offset 0x0068 --- */
+	/*0068:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*006d:*/	0x0c,	/* ....##.. */
+	/*006e:*/	0x18,	/* ...##... */
+	/*006f:*/	0x30,	/* ..##.... */
+	/*0070:*/	0x30,	/* ..##.... */
+	/*0071:*/	0x30,	/* ..##.... */
+	/*0072:*/	0x18,	/* ...##... */
+	/*0073:*/	0x0c,	/* ....##.. */
+	/*0074:*/	0x00,	/* ........ */
+/* --- new character ')' (41) starting at offset 0x0075 --- */
+	/*0075:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*007a:*/	0x30,	/* ..##.... */
+	/*007b:*/	0x18,	/* ...##... */
+	/*007c:*/	0x0c,	/* ....##.. */
+	/*007d:*/	0x0c,	/* ....##.. */
+	/*007e:*/	0x0c,	/* ....##.. */
+	/*007f:*/	0x18,	/* ...##... */
+	/*0080:*/	0x30,	/* ..##.... */
+	/*0081:*/	0x00,	/* ........ */
+/* --- new character '*' (42) starting at offset 0x0082 --- */
+	/*0082:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0087:*/	0x00,	/* ........ */
+	/*0088:*/	0x66,	/* .##..##. */
+	/*0089:*/	0x3c,	/* ..####.. */
+	/*008a:*/	0xff,	/* ######## */
+	/*008b:*/	0x3c,	/* ..####.. */
+	/*008c:*/	0x66,	/* .##..##. */
+	/*008d:*/	0x00,	/* ........ */
+	/*008e:*/	0x00,	/* ........ */
+/* --- new character '+' (43) starting at offset 0x008f --- */
+	/*008f:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0094:*/	0x00,	/* ........ */
+	/*0095:*/	0x18,	/* ...##... */
+	/*0096:*/	0x18,	/* ...##... */
+	/*0097:*/	0x7e,	/* .######. */
+	/*0098:*/	0x18,	/* ...##... */
+	/*0099:*/	0x18,	/* ...##... */
+	/*009a:*/	0x00,	/* ........ */
+	/*009b:*/	0x00,	/* ........ */
+/* --- new character ',' (44) starting at offset 0x009c --- */
+	/*009c:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*00a1:*/	0x00,	/* ........ */
+	/*00a2:*/	0x00,	/* ........ */
+	/*00a3:*/	0x00,	/* ........ */
+	/*00a4:*/	0x00,	/* ........ */
+	/*00a5:*/	0x00,	/* ........ */
+	/*00a6:*/	0x18,	/* ...##... */
+	/*00a7:*/	0x18,	/* ...##... */
+	/*00a8:*/	0x30,	/* ..##.... */
+/* --- new character '-' (45) starting at offset 0x00a9 --- */
+	/*00a9:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*00ae:*/	0x00,	/* ........ */
+	/*00af:*/	0x00,	/* ........ */
+	/*00b0:*/	0x00,	/* ........ */
+	/*00b1:*/	0x7e,	/* .######. */
+	/*00b2:*/	0x00,	/* ........ */
+	/*00b3:*/	0x00,	/* ........ */
+	/*00b4:*/	0x00,	/* ........ */
+	/*00b5:*/	0x00,	/* ........ */
+/* --- new character '.' (46) starting at offset 0x00b6 --- */
+	/*00b6:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*00bb:*/	0x00,	/* ........ */
+	/*00bc:*/	0x00,	/* ........ */
+	/*00bd:*/	0x00,	/* ........ */
+	/*00be:*/	0x00,	/* ........ */
+	/*00bf:*/	0x00,	/* ........ */
+	/*00c0:*/	0x18,	/* ...##... */
+	/*00c1:*/	0x18,	/* ...##... */
+	/*00c2:*/	0x00,	/* ........ */
+/* --- new character '/' (47) starting at offset 0x00c3 --- */
+	/*00c3:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*00c8:*/	0x00,	/* ........ */
+	/*00c9:*/	0x03,	/* ......## */
+	/*00ca:*/	0x06,	/* .....##. */
+	/*00cb:*/	0x0c,	/* ....##.. */
+	/*00cc:*/	0x18,	/* ...##... */
+	/*00cd:*/	0x30,	/* ..##.... */
+	/*00ce:*/	0x60,	/* .##..... */
+	/*00cf:*/	0x00,	/* ........ */
+/* --- new character '0' (48) starting at offset 0x00d0 --- */
+	/*00d0:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*00d5:*/	0x3c,	/* ..####.. */
+	/*00d6:*/	0x66,	/* .##..##. */
+	/*00d7:*/	0x6e,	/* .##.###. */
+	/*00d8:*/	0x76,	/* .###.##. */
+	/*00d9:*/	0x66,	/* .##..##. */
+	/*00da:*/	0x66,	/* .##..##. */
+	/*00db:*/	0x3c,	/* ..####.. */
+	/*00dc:*/	0x00,	/* ........ */
+/* --- new character '1' (49) starting at offset 0x00dd --- */
+	/*00dd:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*00e2:*/	0x18,	/* ...##... */
+	/*00e3:*/	0x18,	/* ...##... */
+	/*00e4:*/	0x38,	/* ..###... */
+	/*00e5:*/	0x18,	/* ...##... */
+	/*00e6:*/	0x18,	/* ...##... */
+	/*00e7:*/	0x18,	/* ...##... */
+	/*00e8:*/	0x7e,	/* .######. */
+	/*00e9:*/	0x00,	/* ........ */
+/* --- new character '2' (50) starting at offset 0x00ea --- */
+	/*00ea:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*00ef:*/	0x3c,	/* ..####.. */
+	/*00f0:*/	0x66,	/* .##..##. */
+	/*00f1:*/	0x06,	/* .....##. */
+	/*00f2:*/	0x0c,	/* ....##.. */
+	/*00f3:*/	0x30,	/* ..##.... */
+	/*00f4:*/	0x60,	/* .##..... */
+	/*00f5:*/	0x7e,	/* .######. */
+	/*00f6:*/	0x00,	/* ........ */
+/* --- new character '3' (51) starting at offset 0x00f7 --- */
+	/*00f7:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*00fc:*/	0x3c,	/* ..####.. */
+	/*00fd:*/	0x66,	/* .##..##. */
+	/*00fe:*/	0x06,	/* .....##. */
+	/*00ff:*/	0x1c,	/* ...###.. */
+	/*0100:*/	0x06,	/* .....##. */
+	/*0101:*/	0x66,	/* .##..##. */
+	/*0102:*/	0x3c,	/* ..####.. */
+	/*0103:*/	0x00,	/* ........ */
+/* --- new character '4' (52) starting at offset 0x0104 --- */
+	/*0104:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0109:*/	0x06,	/* .....##. */
+	/*010a:*/	0x0e,	/* ....###. */
+	/*010b:*/	0x1e,	/* ...####. */
+	/*010c:*/	0x66,	/* .##..##. */
+	/*010d:*/	0x7f,	/* .####### */
+	/*010e:*/	0x06,	/* .....##. */
+	/*010f:*/	0x06,	/* .....##. */
+	/*0110:*/	0x00,	/* ........ */
+/* --- new character '5' (53) starting at offset 0x0111 --- */
+	/*0111:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0116:*/	0x7e,	/* .######. */
+	/*0117:*/	0x60,	/* .##..... */
+	/*0118:*/	0x7c,	/* .#####.. */
+	/*0119:*/	0x06,	/* .....##. */
+	/*011a:*/	0x06,	/* .....##. */
+	/*011b:*/	0x66,	/* .##..##. */
+	/*011c:*/	0x3c,	/* ..####.. */
+	/*011d:*/	0x00,	/* ........ */
+/* --- new character '6' (54) starting at offset 0x011e --- */
+	/*011e:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0123:*/	0x3c,	/* ..####.. */
+	/*0124:*/	0x66,	/* .##..##. */
+	/*0125:*/	0x60,	/* .##..... */
+	/*0126:*/	0x7c,	/* .#####.. */
+	/*0127:*/	0x66,	/* .##..##. */
+	/*0128:*/	0x66,	/* .##..##. */
+	/*0129:*/	0x3c,	/* ..####.. */
+	/*012a:*/	0x00,	/* ........ */
+/* --- new character '7' (55) starting at offset 0x012b --- */
+	/*012b:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0130:*/	0x7e,	/* .######. */
+	/*0131:*/	0x66,	/* .##..##. */
+	/*0132:*/	0x0c,	/* ....##.. */
+	/*0133:*/	0x18,	/* ...##... */
+	/*0134:*/	0x18,	/* ...##... */
+	/*0135:*/	0x18,	/* ...##... */
+	/*0136:*/	0x18,	/* ...##... */
+	/*0137:*/	0x00,	/* ........ */
+/* --- new character '8' (56) starting at offset 0x0138 --- */
+	/*0138:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*013d:*/	0x3c,	/* ..####.. */
+	/*013e:*/	0x66,	/* .##..##. */
+	/*013f:*/	0x66,	/* .##..##. */
+	/*0140:*/	0x3c,	/* ..####.. */
+	/*0141:*/	0x66,	/* .##..##. */
+	/*0142:*/	0x66,	/* .##..##. */
+	/*0143:*/	0x3c,	/* ..####.. */
+	/*0144:*/	0x00,	/* ........ */
+/* --- new character '9' (57) starting at offset 0x0145 --- */
+	/*0145:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*014a:*/	0x3c,	/* ..####.. */
+	/*014b:*/	0x66,	/* .##..##. */
+	/*014c:*/	0x66,	/* .##..##. */
+	/*014d:*/	0x3e,	/* ..#####. */
+	/*014e:*/	0x06,	/* .....##. */
+	/*014f:*/	0x66,	/* .##..##. */
+	/*0150:*/	0x3c,	/* ..####.. */
+	/*0151:*/	0x00,	/* ........ */
+/* --- new character ':' (58) starting at offset 0x0152 --- */
+	/*0152:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0157:*/	0x00,	/* ........ */
+	/*0158:*/	0x00,	/* ........ */
+	/*0159:*/	0x18,	/* ...##... */
+	/*015a:*/	0x00,	/* ........ */
+	/*015b:*/	0x00,	/* ........ */
+	/*015c:*/	0x18,	/* ...##... */
+	/*015d:*/	0x00,	/* ........ */
+	/*015e:*/	0x00,	/* ........ */
+/* --- new character ';' (59) starting at offset 0x015f --- */
+	/*015f:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0164:*/	0x00,	/* ........ */
+	/*0165:*/	0x00,	/* ........ */
+	/*0166:*/	0x18,	/* ...##... */
+	/*0167:*/	0x00,	/* ........ */
+	/*0168:*/	0x00,	/* ........ */
+	/*0169:*/	0x18,	/* ...##... */
+	/*016a:*/	0x18,	/* ...##... */
+	/*016b:*/	0x30,	/* ..##.... */
+/* --- new character '<' (60) starting at offset 0x016c --- */
+	/*016c:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0171:*/	0x0e,	/* ....###. */
+	/*0172:*/	0x18,	/* ...##... */
+	/*0173:*/	0x30,	/* ..##.... */
+	/*0174:*/	0x60,	/* .##..... */
+	/*0175:*/	0x30,	/* ..##.... */
+	/*0176:*/	0x18,	/* ...##... */
+	/*0177:*/	0x0e,	/* ....###. */
+	/*0178:*/	0x00,	/* ........ */
+/* --- new character '=' (61) starting at offset 0x0179 --- */
+	/*0179:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*017e:*/	0x00,	/* ........ */
+	/*017f:*/	0x00,	/* ........ */
+	/*0180:*/	0x7e,	/* .######. */
+	/*0181:*/	0x00,	/* ........ */
+	/*0182:*/	0x7e,	/* .######. */
+	/*0183:*/	0x00,	/* ........ */
+	/*0184:*/	0x00,	/* ........ */
+	/*0185:*/	0x00,	/* ........ */
+/* --- new character '>' (62) starting at offset 0x0186 --- */
+	/*0186:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*018b:*/	0x70,	/* .###.... */
+	/*018c:*/	0x18,	/* ...##... */
+	/*018d:*/	0x0c,	/* ....##.. */
+	/*018e:*/	0x06,	/* .....##. */
+	/*018f:*/	0x0c,	/* ....##.. */
+	/*0190:*/	0x18,	/* ...##... */
+	/*0191:*/	0x70,	/* .###.... */
+	/*0192:*/	0x00,	/* ........ */
+/* --- new character '?' (63) starting at offset 0x0193 --- */
+	/*0193:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0198:*/	0x3c,	/* ..####.. */
+	/*0199:*/	0x66,	/* .##..##. */
+	/*019a:*/	0x06,	/* .....##. */
+	/*019b:*/	0x0c,	/* ....##.. */
+	/*019c:*/	0x18,	/* ...##... */
+	/*019d:*/	0x00,	/* ........ */
+	/*019e:*/	0x18,	/* ...##... */
+	/*019f:*/	0x00,	/* ........ */
+/* --- new character '@' (64) starting at offset 0x01a0 --- */
+	/*01a0:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*01a5:*/	0x3c,	/* ..####.. */
+	/*01a6:*/	0x66,	/* .##..##. */
+	/*01a7:*/	0x6e,	/* .##.###. */
+	/*01a8:*/	0x6e,	/* .##.###. */
+	/*01a9:*/	0x60,	/* .##..... */
+	/*01aa:*/	0x62,	/* .##...#. */
+	/*01ab:*/	0x3c,	/* ..####.. */
+	/*01ac:*/	0x00,	/* ........ */
+/* --- new character 'A' (65) starting at offset 0x01ad --- */
+	/*01ad:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*01b2:*/	0x18,	/* ...##... */
+	/*01b3:*/	0x3c,	/* ..####.. */
+	/*01b4:*/	0x66,	/* .##..##. */
+	/*01b5:*/	0x7e,	/* .######. */
+	/*01b6:*/	0x66,	/* .##..##. */
+	/*01b7:*/	0x66,	/* .##..##. */
+	/*01b8:*/	0x66,	/* .##..##. */
+	/*01b9:*/	0x00,	/* ........ */
+/* --- new character 'B' (66) starting at offset 0x01ba --- */
+	/*01ba:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*01bf:*/	0x7c,	/* .#####.. */
+	/*01c0:*/	0x66,	/* .##..##. */
+	/*01c1:*/	0x66,	/* .##..##. */
+	/*01c2:*/	0x7c,	/* .#####.. */
+	/*01c3:*/	0x66,	/* .##..##. */
+	/*01c4:*/	0x66,	/* .##..##. */
+	/*01c5:*/	0x7c,	/* .#####.. */
+	/*01c6:*/	0x00,	/* ........ */
+/* --- new character 'C' (67) starting at offset 0x01c7 --- */
+	/*01c7:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*01cc:*/	0x3c,	/* ..####.. */
+	/*01cd:*/	0x66,	/* .##..##. */
+	/*01ce:*/	0x60,	/* .##..... */
+	/*01cf:*/	0x60,	/* .##..... */
+	/*01d0:*/	0x60,	/* .##..... */
+	/*01d1:*/	0x66,	/* .##..##. */
+	/*01d2:*/	0x3c,	/* ..####.. */
+	/*01d3:*/	0x00,	/* ........ */
+/* --- new character 'D' (68) starting at offset 0x01d4 --- */
+	/*01d4:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*01d9:*/	0x78,	/* .####... */
+	/*01da:*/	0x6c,	/* .##.##.. */
+	/*01db:*/	0x66,	/* .##..##. */
+	/*01dc:*/	0x66,	/* .##..##. */
+	/*01dd:*/	0x66,	/* .##..##. */
+	/*01de:*/	0x6c,	/* .##.##.. */
+	/*01df:*/	0x78,	/* .####... */
+	/*01e0:*/	0x00,	/* ........ */
+/* --- new character 'E' (69) starting at offset 0x01e1 --- */
+	/*01e1:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*01e6:*/	0x7e,	/* .######. */
+	/*01e7:*/	0x60,	/* .##..... */
+	/*01e8:*/	0x60,	/* .##..... */
+	/*01e9:*/	0x78,	/* .####... */
+	/*01ea:*/	0x60,	/* .##..... */
+	/*01eb:*/	0x60,	/* .##..... */
+	/*01ec:*/	0x7e,	/* .######. */
+	/*01ed:*/	0x00,	/* ........ */
+/* --- new character 'F' (70) starting at offset 0x01ee --- */
+	/*01ee:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*01f3:*/	0x7e,	/* .######. */
+	/*01f4:*/	0x60,	/* .##..... */
+	/*01f5:*/	0x60,	/* .##..... */
+	/*01f6:*/	0x78,	/* .####... */
+	/*01f7:*/	0x60,	/* .##..... */
+	/*01f8:*/	0x60,	/* .##..... */
+	/*01f9:*/	0x60,	/* .##..... */
+	/*01fa:*/	0x00,	/* ........ */
+/* --- new character 'G' (71) starting at offset 0x01fb --- */
+	/*01fb:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0200:*/	0x3c,	/* ..####.. */
+	/*0201:*/	0x66,	/* .##..##. */
+	/*0202:*/	0x60,	/* .##..... */
+	/*0203:*/	0x6e,	/* .##.###. */
+	/*0204:*/	0x66,	/* .##..##. */
+	/*0205:*/	0x66,	/* .##..##. */
+	/*0206:*/	0x3c,	/* ..####.. */
+	/*0207:*/	0x00,	/* ........ */
+/* --- new character 'H' (72) starting at offset 0x0208 --- */
+	/*0208:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*020d:*/	0x66,	/* .##..##. */
+	/*020e:*/	0x66,	/* .##..##. */
+	/*020f:*/	0x66,	/* .##..##. */
+	/*0210:*/	0x7e,	/* .######. */
+	/*0211:*/	0x66,	/* .##..##. */
+	/*0212:*/	0x66,	/* .##..##. */
+	/*0213:*/	0x66,	/* .##..##. */
+	/*0214:*/	0x00,	/* ........ */
+/* --- new character 'I' (73) starting at offset 0x0215 --- */
+	/*0215:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*021a:*/	0x3c,	/* ..####.. */
+	/*021b:*/	0x18,	/* ...##... */
+	/*021c:*/	0x18,	/* ...##... */
+	/*021d:*/	0x18,	/* ...##... */
+	/*021e:*/	0x18,	/* ...##... */
+	/*021f:*/	0x18,	/* ...##... */
+	/*0220:*/	0x3c,	/* ..####.. */
+	/*0221:*/	0x00,	/* ........ */
+/* --- new character 'J' (74) starting at offset 0x0222 --- */
+	/*0222:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0227:*/	0x1e,	/* ...####. */
+	/*0228:*/	0x0c,	/* ....##.. */
+	/*0229:*/	0x0c,	/* ....##.. */
+	/*022a:*/	0x0c,	/* ....##.. */
+	/*022b:*/	0x0c,	/* ....##.. */
+	/*022c:*/	0x6c,	/* .##.##.. */
+	/*022d:*/	0x38,	/* ..###... */
+	/*022e:*/	0x00,	/* ........ */
+/* --- new character 'K' (75) starting at offset 0x022f --- */
+	/*022f:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0234:*/	0x66,	/* .##..##. */
+	/*0235:*/	0x6c,	/* .##.##.. */
+	/*0236:*/	0x78,	/* .####... */
+	/*0237:*/	0x70,	/* .###.... */
+	/*0238:*/	0x78,	/* .####... */
+	/*0239:*/	0x6c,	/* .##.##.. */
+	/*023a:*/	0x66,	/* .##..##. */
+	/*023b:*/	0x00,	/* ........ */
+/* --- new character 'L' (76) starting at offset 0x023c --- */
+	/*023c:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0241:*/	0x60,	/* .##..... */
+	/*0242:*/	0x60,	/* .##..... */
+	/*0243:*/	0x60,	/* .##..... */
+	/*0244:*/	0x60,	/* .##..... */
+	/*0245:*/	0x60,	/* .##..... */
+	/*0246:*/	0x60,	/* .##..... */
+	/*0247:*/	0x7e,	/* .######. */
+	/*0248:*/	0x00,	/* ........ */
+/* --- new character 'M' (77) starting at offset 0x0249 --- */
+	/*0249:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*024e:*/	0x63,	/* .##...## */
+	/*024f:*/	0x77,	/* .###.### */
+	/*0250:*/	0x7f,	/* .####### */
+	/*0251:*/	0x6b,	/* .##.#.## */
+	/*0252:*/	0x63,	/* .##...## */
+	/*0253:*/	0x63,	/* .##...## */
+	/*0254:*/	0x63,	/* .##...## */
+	/*0255:*/	0x00,	/* ........ */
+/* --- new character 'N' (78) starting at offset 0x0256 --- */
+	/*0256:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*025b:*/	0x66,	/* .##..##. */
+	/*025c:*/	0x76,	/* .###.##. */
+	/*025d:*/	0x7e,	/* .######. */
+	/*025e:*/	0x7e,	/* .######. */
+	/*025f:*/	0x6e,	/* .##.###. */
+	/*0260:*/	0x66,	/* .##..##. */
+	/*0261:*/	0x66,	/* .##..##. */
+	/*0262:*/	0x00,	/* ........ */
+/* --- new character 'O' (79) starting at offset 0x0263 --- */
+	/*0263:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0268:*/	0x3c,	/* ..####.. */
+	/*0269:*/	0x66,	/* .##..##. */
+	/*026a:*/	0x66,	/* .##..##. */
+	/*026b:*/	0x66,	/* .##..##. */
+	/*026c:*/	0x66,	/* .##..##. */
+	/*026d:*/	0x66,	/* .##..##. */
+	/*026e:*/	0x3c,	/* ..####.. */
+	/*026f:*/	0x00,	/* ........ */
+/* --- new character 'P' (80) starting at offset 0x0270 --- */
+	/*0270:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0275:*/	0x7c,	/* .#####.. */
+	/*0276:*/	0x66,	/* .##..##. */
+	/*0277:*/	0x66,	/* .##..##. */
+	/*0278:*/	0x7c,	/* .#####.. */
+	/*0279:*/	0x60,	/* .##..... */
+	/*027a:*/	0x60,	/* .##..... */
+	/*027b:*/	0x60,	/* .##..... */
+	/*027c:*/	0x00,	/* ........ */
+/* --- new character 'Q' (81) starting at offset 0x027d --- */
+	/*027d:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0282:*/	0x3c,	/* ..####.. */
+	/*0283:*/	0x66,	/* .##..##. */
+	/*0284:*/	0x66,	/* .##..##. */
+	/*0285:*/	0x66,	/* .##..##. */
+	/*0286:*/	0x66,	/* .##..##. */
+	/*0287:*/	0x3c,	/* ..####.. */
+	/*0288:*/	0x0e,	/* ....###. */
+	/*0289:*/	0x00,	/* ........ */
+/* --- new character 'R' (82) starting at offset 0x028a --- */
+	/*028a:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*028f:*/	0x7c,	/* .#####.. */
+	/*0290:*/	0x66,	/* .##..##. */
+	/*0291:*/	0x66,	/* .##..##. */
+	/*0292:*/	0x7c,	/* .#####.. */
+	/*0293:*/	0x78,	/* .####... */
+	/*0294:*/	0x6c,	/* .##.##.. */
+	/*0295:*/	0x66,	/* .##..##. */
+	/*0296:*/	0x00,	/* ........ */
+/* --- new character 'S' (83) starting at offset 0x0297 --- */
+	/*0297:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*029c:*/	0x3c,	/* ..####.. */
+	/*029d:*/	0x66,	/* .##..##. */
+	/*029e:*/	0x60,	/* .##..... */
+	/*029f:*/	0x3c,	/* ..####.. */
+	/*02a0:*/	0x06,	/* .....##. */
+	/*02a1:*/	0x66,	/* .##..##. */
+	/*02a2:*/	0x3c,	/* ..####.. */
+	/*02a3:*/	0x00,	/* ........ */
+/* --- new character 'T' (84) starting at offset 0x02a4 --- */
+	/*02a4:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*02a9:*/	0x7e,	/* .######. */
+	/*02aa:*/	0x18,	/* ...##... */
+	/*02ab:*/	0x18,	/* ...##... */
+	/*02ac:*/	0x18,	/* ...##... */
+	/*02ad:*/	0x18,	/* ...##... */
+	/*02ae:*/	0x18,	/* ...##... */
+	/*02af:*/	0x18,	/* ...##... */
+	/*02b0:*/	0x00,	/* ........ */
+/* --- new character 'U' (85) starting at offset 0x02b1 --- */
+	/*02b1:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*02b6:*/	0x66,	/* .##..##. */
+	/*02b7:*/	0x66,	/* .##..##. */
+	/*02b8:*/	0x66,	/* .##..##. */
+	/*02b9:*/	0x66,	/* .##..##. */
+	/*02ba:*/	0x66,	/* .##..##. */
+	/*02bb:*/	0x66,	/* .##..##. */
+	/*02bc:*/	0x3c,	/* ..####.. */
+	/*02bd:*/	0x00,	/* ........ */
+/* --- new character 'V' (86) starting at offset 0x02be --- */
+	/*02be:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*02c3:*/	0x66,	/* .##..##. */
+	/*02c4:*/	0x66,	/* .##..##. */
+	/*02c5:*/	0x66,	/* .##..##. */
+	/*02c6:*/	0x66,	/* .##..##. */
+	/*02c7:*/	0x66,	/* .##..##. */
+	/*02c8:*/	0x3c,	/* ..####.. */
+	/*02c9:*/	0x18,	/* ...##... */
+	/*02ca:*/	0x00,	/* ........ */
+/* --- new character 'W' (87) starting at offset 0x02cb --- */
+	/*02cb:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*02d0:*/	0x63,	/* .##...## */
+	/*02d1:*/	0x63,	/* .##...## */
+	/*02d2:*/	0x63,	/* .##...## */
+	/*02d3:*/	0x6b,	/* .##.#.## */
+	/*02d4:*/	0x7f,	/* .####### */
+	/*02d5:*/	0x77,	/* .###.### */
+	/*02d6:*/	0x63,	/* .##...## */
+	/*02d7:*/	0x00,	/* ........ */
+/* --- new character 'X' (88) starting at offset 0x02d8 --- */
+	/*02d8:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*02dd:*/	0x66,	/* .##..##. */
+	/*02de:*/	0x66,	/* .##..##. */
+	/*02df:*/	0x3c,	/* ..####.. */
+	/*02e0:*/	0x18,	/* ...##... */
+	/*02e1:*/	0x3c,	/* ..####.. */
+	/*02e2:*/	0x66,	/* .##..##. */
+	/*02e3:*/	0x66,	/* .##..##. */
+	/*02e4:*/	0x00,	/* ........ */
+/* --- new character 'Y' (89) starting at offset 0x02e5 --- */
+	/*02e5:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*02ea:*/	0x66,	/* .##..##. */
+	/*02eb:*/	0x66,	/* .##..##. */
+	/*02ec:*/	0x66,	/* .##..##. */
+	/*02ed:*/	0x3c,	/* ..####.. */
+	/*02ee:*/	0x18,	/* ...##... */
+	/*02ef:*/	0x18,	/* ...##... */
+	/*02f0:*/	0x18,	/* ...##... */
+	/*02f1:*/	0x00,	/* ........ */
+/* --- new character 'Z' (90) starting at offset 0x02f2 --- */
+	/*02f2:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*02f7:*/	0x7e,	/* .######. */
+	/*02f8:*/	0x06,	/* .....##. */
+	/*02f9:*/	0x0c,	/* ....##.. */
+	/*02fa:*/	0x18,	/* ...##... */
+	/*02fb:*/	0x30,	/* ..##.... */
+	/*02fc:*/	0x60,	/* .##..... */
+	/*02fd:*/	0x7e,	/* .######. */
+	/*02fe:*/	0x00,	/* ........ */
+/* --- new character '[' (91) starting at offset 0x02ff --- */
+	/*02ff:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0304:*/	0x3c,	/* ..####.. */
+	/*0305:*/	0x30,	/* ..##.... */
+	/*0306:*/	0x30,	/* ..##.... */
+	/*0307:*/	0x30,	/* ..##.... */
+	/*0308:*/	0x30,	/* ..##.... */
+	/*0309:*/	0x30,	/* ..##.... */
+	/*030a:*/	0x3c,	/* ..####.. */
+	/*030b:*/	0x00,	/* ........ */
+/* --- new character '\' (92) starting at offset 0x030c --- */
+	/*030c:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0311:*/	0x00,	/* ........ */
+	/*0312:*/	0xc0,	/* ##...... */
+	/*0313:*/	0x60,	/* .##..... */
+	/*0314:*/	0x30,	/* ..##.... */
+	/*0315:*/	0x18,	/* ...##... */
+	/*0316:*/	0x0c,	/* ....##.. */
+	/*0317:*/	0x06,	/* .....##. */
+	/*0318:*/	0x00,	/* ........ */
+/* --- new character ']' (93) starting at offset 0x0319 --- */
+	/*0319:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*031e:*/	0x3c,	/* ..####.. */
+	/*031f:*/	0x0c,	/* ....##.. */
+	/*0320:*/	0x0c,	/* ....##.. */
+	/*0321:*/	0x0c,	/* ....##.. */
+	/*0322:*/	0x0c,	/* ....##.. */
+	/*0323:*/	0x0c,	/* ....##.. */
+	/*0324:*/	0x3c,	/* ..####.. */
+	/*0325:*/	0x00,	/* ........ */
+/* --- new character '^' (94) starting at offset 0x0326 --- */
+	/*0326:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*032b:*/	0x18,	/* ...##... */
+	/*032c:*/	0x3c,	/* ..####.. */
+	/*032d:*/	0x66,	/* .##..##. */
+	/*032e:*/	0x00,	/* ........ */
+	/*032f:*/	0x00,	/* ........ */
+	/*0330:*/	0x00,	/* ........ */
+	/*0331:*/	0x00,	/* ........ */
+	/*0332:*/	0x00,	/* ........ */
+/* --- new character '_' (95) starting at offset 0x0333 --- */
+	/*0333:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0338:*/	0x00,	/* ........ */
+	/*0339:*/	0x00,	/* ........ */
+	/*033a:*/	0x00,	/* ........ */
+	/*033b:*/	0x00,	/* ........ */
+	/*033c:*/	0x00,	/* ........ */
+	/*033d:*/	0x00,	/* ........ */
+	/*033e:*/	0x00,	/* ........ */
+	/*033f:*/	0xff,	/* ######## */
+/* --- new character '`' (96) starting at offset 0x0340 --- */
+	/*0340:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0345:*/	0x60,	/* .##..... */
+	/*0346:*/	0x30,	/* ..##.... */
+	/*0347:*/	0x18,	/* ...##... */
+	/*0348:*/	0x00,	/* ........ */
+	/*0349:*/	0x00,	/* ........ */
+	/*034a:*/	0x00,	/* ........ */
+	/*034b:*/	0x00,	/* ........ */
+	/*034c:*/	0x00,	/* ........ */
+/* --- new character 'a' (97) starting at offset 0x034d --- */
+	/*034d:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0352:*/	0x00,	/* ........ */
+	/*0353:*/	0x00,	/* ........ */
+	/*0354:*/	0x3c,	/* ..####.. */
+	/*0355:*/	0x06,	/* .....##. */
+	/*0356:*/	0x3e,	/* ..#####. */
+	/*0357:*/	0x66,	/* .##..##. */
+	/*0358:*/	0x3e,	/* ..#####. */
+	/*0359:*/	0x00,	/* ........ */
+/* --- new character 'b' (98) starting at offset 0x035a --- */
+	/*035a:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*035f:*/	0x00,	/* ........ */
+	/*0360:*/	0x60,	/* .##..... */
+	/*0361:*/	0x60,	/* .##..... */
+	/*0362:*/	0x7c,	/* .#####.. */
+	/*0363:*/	0x66,	/* .##..##. */
+	/*0364:*/	0x66,	/* .##..##. */
+	/*0365:*/	0x7c,	/* .#####.. */
+	/*0366:*/	0x00,	/* ........ */
+/* --- new character 'c' (99) starting at offset 0x0367 --- */
+	/*0367:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*036c:*/	0x00,	/* ........ */
+	/*036d:*/	0x00,	/* ........ */
+	/*036e:*/	0x3c,	/* ..####.. */
+	/*036f:*/	0x60,	/* .##..... */
+	/*0370:*/	0x60,	/* .##..... */
+	/*0371:*/	0x60,	/* .##..... */
+	/*0372:*/	0x3c,	/* ..####.. */
+	/*0373:*/	0x00,	/* ........ */
+/* --- new character 'd' (100) starting at offset 0x0374 --- */
+	/*0374:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0379:*/	0x00,	/* ........ */
+	/*037a:*/	0x06,	/* .....##. */
+	/*037b:*/	0x06,	/* .....##. */
+	/*037c:*/	0x3e,	/* ..#####. */
+	/*037d:*/	0x66,	/* .##..##. */
+	/*037e:*/	0x66,	/* .##..##. */
+	/*037f:*/	0x3e,	/* ..#####. */
+	/*0380:*/	0x00,	/* ........ */
+/* --- new character 'e' (101) starting at offset 0x0381 --- */
+	/*0381:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0386:*/	0x00,	/* ........ */
+	/*0387:*/	0x00,	/* ........ */
+	/*0388:*/	0x3c,	/* ..####.. */
+	/*0389:*/	0x66,	/* .##..##. */
+	/*038a:*/	0x7e,	/* .######. */
+	/*038b:*/	0x60,	/* .##..... */
+	/*038c:*/	0x3c,	/* ..####.. */
+	/*038d:*/	0x00,	/* ........ */
+/* --- new character 'f' (102) starting at offset 0x038e --- */
+	/*038e:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0393:*/	0x00,	/* ........ */
+	/*0394:*/	0x0e,	/* ....###. */
+	/*0395:*/	0x18,	/* ...##... */
+	/*0396:*/	0x3e,	/* ..#####. */
+	/*0397:*/	0x18,	/* ...##... */
+	/*0398:*/	0x18,	/* ...##... */
+	/*0399:*/	0x18,	/* ...##... */
+	/*039a:*/	0x00,	/* ........ */
+/* --- new character 'g' (103) starting at offset 0x039b --- */
+	/*039b:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*03a0:*/	0x00,	/* ........ */
+	/*03a1:*/	0x00,	/* ........ */
+	/*03a2:*/	0x3e,	/* ..#####. */
+	/*03a3:*/	0x66,	/* .##..##. */
+	/*03a4:*/	0x66,	/* .##..##. */
+	/*03a5:*/	0x3e,	/* ..#####. */
+	/*03a6:*/	0x06,	/* .....##. */
+	/*03a7:*/	0x7c,	/* .#####.. */
+/* --- new character 'h' (104) starting at offset 0x03a8 --- */
+	/*03a8:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*03ad:*/	0x00,	/* ........ */
+	/*03ae:*/	0x60,	/* .##..... */
+	/*03af:*/	0x60,	/* .##..... */
+	/*03b0:*/	0x7c,	/* .#####.. */
+	/*03b1:*/	0x66,	/* .##..##. */
+	/*03b2:*/	0x66,	/* .##..##. */
+	/*03b3:*/	0x66,	/* .##..##. */
+	/*03b4:*/	0x00,	/* ........ */
+/* --- new character 'i' (105) starting at offset 0x03b5 --- */
+	/*03b5:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*03ba:*/	0x00,	/* ........ */
+	/*03bb:*/	0x18,	/* ...##... */
+	/*03bc:*/	0x00,	/* ........ */
+	/*03bd:*/	0x38,	/* ..###... */
+	/*03be:*/	0x18,	/* ...##... */
+	/*03bf:*/	0x18,	/* ...##... */
+	/*03c0:*/	0x3c,	/* ..####.. */
+	/*03c1:*/	0x00,	/* ........ */
+/* --- new character 'j' (106) starting at offset 0x03c2 --- */
+	/*03c2:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*03c7:*/	0x00,	/* ........ */
+	/*03c8:*/	0x06,	/* .....##. */
+	/*03c9:*/	0x00,	/* ........ */
+	/*03ca:*/	0x06,	/* .....##. */
+	/*03cb:*/	0x06,	/* .....##. */
+	/*03cc:*/	0x06,	/* .....##. */
+	/*03cd:*/	0x06,	/* .....##. */
+	/*03ce:*/	0x3c,	/* ..####.. */
+/* --- new character 'k' (107) starting at offset 0x03cf --- */
+	/*03cf:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*03d4:*/	0x00,	/* ........ */
+	/*03d5:*/	0x60,	/* .##..... */
+	/*03d6:*/	0x60,	/* .##..... */
+	/*03d7:*/	0x6c,	/* .##.##.. */
+	/*03d8:*/	0x78,	/* .####... */
+	/*03d9:*/	0x6c,	/* .##.##.. */
+	/*03da:*/	0x66,	/* .##..##. */
+	/*03db:*/	0x00,	/* ........ */
+/* --- new character 'l' (108) starting at offset 0x03dc --- */
+	/*03dc:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*03e1:*/	0x00,	/* ........ */
+	/*03e2:*/	0x38,	/* ..###... */
+	/*03e3:*/	0x18,	/* ...##... */
+	/*03e4:*/	0x18,	/* ...##... */
+	/*03e5:*/	0x18,	/* ...##... */
+	/*03e6:*/	0x18,	/* ...##... */
+	/*03e7:*/	0x3c,	/* ..####.. */
+	/*03e8:*/	0x00,	/* ........ */
+/* --- new character 'm' (109) starting at offset 0x03e9 --- */
+	/*03e9:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*03ee:*/	0x00,	/* ........ */
+	/*03ef:*/	0x00,	/* ........ */
+	/*03f0:*/	0x66,	/* .##..##. */
+	/*03f1:*/	0x7f,	/* .####### */
+	/*03f2:*/	0x7f,	/* .####### */
+	/*03f3:*/	0x6b,	/* .##.#.## */
+	/*03f4:*/	0x63,	/* .##...## */
+	/*03f5:*/	0x00,	/* ........ */
+/* --- new character 'n' (110) starting at offset 0x03f6 --- */
+	/*03f6:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*03fb:*/	0x00,	/* ........ */
+	/*03fc:*/	0x00,	/* ........ */
+	/*03fd:*/	0x7c,	/* .#####.. */
+	/*03fe:*/	0x66,	/* .##..##. */
+	/*03ff:*/	0x66,	/* .##..##. */
+	/*0400:*/	0x66,	/* .##..##. */
+	/*0401:*/	0x66,	/* .##..##. */
+	/*0402:*/	0x00,	/* ........ */
+/* --- new character 'o' (111) starting at offset 0x0403 --- */
+	/*0403:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0408:*/	0x00,	/* ........ */
+	/*0409:*/	0x00,	/* ........ */
+	/*040a:*/	0x3c,	/* ..####.. */
+	/*040b:*/	0x66,	/* .##..##. */
+	/*040c:*/	0x66,	/* .##..##. */
+	/*040d:*/	0x66,	/* .##..##. */
+	/*040e:*/	0x3c,	/* ..####.. */
+	/*040f:*/	0x00,	/* ........ */
+/* --- new character 'p' (112) starting at offset 0x0410 --- */
+	/*0410:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0415:*/	0x00,	/* ........ */
+	/*0416:*/	0x00,	/* ........ */
+	/*0417:*/	0x7c,	/* .#####.. */
+	/*0418:*/	0x66,	/* .##..##. */
+	/*0419:*/	0x66,	/* .##..##. */
+	/*041a:*/	0x7c,	/* .#####.. */
+	/*041b:*/	0x60,	/* .##..... */
+	/*041c:*/	0x60,	/* .##..... */
+/* --- new character 'q' (113) starting at offset 0x041d --- */
+	/*041d:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0422:*/	0x00,	/* ........ */
+	/*0423:*/	0x00,	/* ........ */
+	/*0424:*/	0x3e,	/* ..#####. */
+	/*0425:*/	0x66,	/* .##..##. */
+	/*0426:*/	0x66,	/* .##..##. */
+	/*0427:*/	0x3e,	/* ..#####. */
+	/*0428:*/	0x06,	/* .....##. */
+	/*0429:*/	0x06,	/* .....##. */
+/* --- new character 'r' (114) starting at offset 0x042a --- */
+	/*042a:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*042f:*/	0x00,	/* ........ */
+	/*0430:*/	0x00,	/* ........ */
+	/*0431:*/	0x7c,	/* .#####.. */
+	/*0432:*/	0x66,	/* .##..##. */
+	/*0433:*/	0x60,	/* .##..... */
+	/*0434:*/	0x60,	/* .##..... */
+	/*0435:*/	0x60,	/* .##..... */
+	/*0436:*/	0x00,	/* ........ */
+/* --- new character 's' (115) starting at offset 0x0437 --- */
+	/*0437:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*043c:*/	0x00,	/* ........ */
+	/*043d:*/	0x00,	/* ........ */
+	/*043e:*/	0x3e,	/* ..#####. */
+	/*043f:*/	0x60,	/* .##..... */
+	/*0440:*/	0x3c,	/* ..####.. */
+	/*0441:*/	0x06,	/* .....##. */
+	/*0442:*/	0x7c,	/* .#####.. */
+	/*0443:*/	0x00,	/* ........ */
+/* --- new character 't' (116) starting at offset 0x0444 --- */
+	/*0444:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0449:*/	0x00,	/* ........ */
+	/*044a:*/	0x18,	/* ...##... */
+	/*044b:*/	0x7e,	/* .######. */
+	/*044c:*/	0x18,	/* ...##... */
+	/*044d:*/	0x18,	/* ...##... */
+	/*044e:*/	0x18,	/* ...##... */
+	/*044f:*/	0x0e,	/* ....###. */
+	/*0450:*/	0x00,	/* ........ */
+/* --- new character 'u' (117) starting at offset 0x0451 --- */
+	/*0451:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0456:*/	0x00,	/* ........ */
+	/*0457:*/	0x00,	/* ........ */
+	/*0458:*/	0x66,	/* .##..##. */
+	/*0459:*/	0x66,	/* .##..##. */
+	/*045a:*/	0x66,	/* .##..##. */
+	/*045b:*/	0x66,	/* .##..##. */
+	/*045c:*/	0x3e,	/* ..#####. */
+	/*045d:*/	0x00,	/* ........ */
+/* --- new character 'v' (118) starting at offset 0x045e --- */
+	/*045e:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0463:*/	0x00,	/* ........ */
+	/*0464:*/	0x00,	/* ........ */
+	/*0465:*/	0x66,	/* .##..##. */
+	/*0466:*/	0x66,	/* .##..##. */
+	/*0467:*/	0x66,	/* .##..##. */
+	/*0468:*/	0x3c,	/* ..####.. */
+	/*0469:*/	0x18,	/* ...##... */
+	/*046a:*/	0x00,	/* ........ */
+/* --- new character 'w' (119) starting at offset 0x046b --- */
+	/*046b:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0470:*/	0x00,	/* ........ */
+	/*0471:*/	0x00,	/* ........ */
+	/*0472:*/	0x63,	/* .##...## */
+	/*0473:*/	0x6b,	/* .##.#.## */
+	/*0474:*/	0x7f,	/* .####### */
+	/*0475:*/	0x3e,	/* ..#####. */
+	/*0476:*/	0x36,	/* ..##.##. */
+	/*0477:*/	0x00,	/* ........ */
+/* --- new character 'x' (120) starting at offset 0x0478 --- */
+	/*0478:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*047d:*/	0x00,	/* ........ */
+	/*047e:*/	0x00,	/* ........ */
+	/*047f:*/	0x66,	/* .##..##. */
+	/*0480:*/	0x3c,	/* ..####.. */
+	/*0481:*/	0x18,	/* ...##... */
+	/*0482:*/	0x3c,	/* ..####.. */
+	/*0483:*/	0x66,	/* .##..##. */
+	/*0484:*/	0x00,	/* ........ */
+/* --- new character 'y' (121) starting at offset 0x0485 --- */
+	/*0485:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*048a:*/	0x00,	/* ........ */
+	/*048b:*/	0x00,	/* ........ */
+	/*048c:*/	0x66,	/* .##..##. */
+	/*048d:*/	0x66,	/* .##..##. */
+	/*048e:*/	0x66,	/* .##..##. */
+	/*048f:*/	0x3e,	/* ..#####. */
+	/*0490:*/	0x0c,	/* ....##.. */
+	/*0491:*/	0x78,	/* .####... */
+/* --- new character 'z' (122) starting at offset 0x0492 --- */
+	/*0492:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0497:*/	0x00,	/* ........ */
+	/*0498:*/	0x00,	/* ........ */
+	/*0499:*/	0x7e,	/* .######. */
+	/*049a:*/	0x0c,	/* ....##.. */
+	/*049b:*/	0x18,	/* ...##... */
+	/*049c:*/	0x30,	/* ..##.... */
+	/*049d:*/	0x7e,	/* .######. */
+	/*049e:*/	0x00,	/* ........ */
+/* --- new character '{' (123) starting at offset 0x049f --- */
+	/*049f:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*04a4:*/	0x1c,	/* ...###.. */
+	/*04a5:*/	0x30,	/* ..##.... */
+	/*04a6:*/	0x30,	/* ..##.... */
+	/*04a7:*/	0x60,	/* .##..... */
+	/*04a8:*/	0x30,	/* ..##.... */
+	/*04a9:*/	0x30,	/* ..##.... */
+	/*04aa:*/	0x1c,	/* ...###.. */
+	/*04ab:*/	0x00,	/* ........ */
+/* --- new character '|' (124) starting at offset 0x04ac --- */
+	/*04ac:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*04b1:*/	0x18,	/* ...##... */
+	/*04b2:*/	0x18,	/* ...##... */
+	/*04b3:*/	0x18,	/* ...##... */
+	/*04b4:*/	0x18,	/* ...##... */
+	/*04b5:*/	0x18,	/* ...##... */
+	/*04b6:*/	0x18,	/* ...##... */
+	/*04b7:*/	0x18,	/* ...##... */
+	/*04b8:*/	0x00,	/* ........ */
+/* --- new character '}' (125) starting at offset 0x04b9 --- */
+	/*04b9:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*04be:*/	0x38,	/* ..###... */
+	/*04bf:*/	0x0c,	/* ....##.. */
+	/*04c0:*/	0x0c,	/* ....##.. */
+	/*04c1:*/	0x06,	/* .....##. */
+	/*04c2:*/	0x0c,	/* ....##.. */
+	/*04c3:*/	0x0c,	/* ....##.. */
+	/*04c4:*/	0x38,	/* ..###... */
+	/*04c5:*/	0x00,	/* ........ */
+/* --- new character '~' (126) starting at offset 0x04c6 --- */
+	/*04c6:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*04cb:*/	0x33,	/* ..##..## */
+	/*04cc:*/	0x7e,	/* .######. */
+	/*04cd:*/	0xcc,	/* ##..##.. */
+	/*04ce:*/	0x00,	/* ........ */
+	/*04cf:*/	0x00,	/* ........ */
+	/*04d0:*/	0x00,	/* ........ */
+	/*04d1:*/	0x00,	/* ........ */
+	/*04d2:*/	0x00,	/* ........ */
+/* --- new character '' (127) starting at offset 0x04d3 --- */
+	/*04d3:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*04d8:*/	0x00,	/* ........ */
+	/*04d9:*/	0x08,	/* ....#... */
+	/*04da:*/	0x0c,	/* ....##.. */
+	/*04db:*/	0xfe,	/* #######. */
+	/*04dc:*/	0xfe,	/* #######. */
+	/*04dd:*/	0x0c,	/* ....##.. */
+	/*04de:*/	0x08,	/* ....#... */
+	/*04df:*/	0x00,	/* ........ */
+};
+static const uint16_t font_c64_offsets[] = {
+	0x0000 /* ' ' */,
+	0x000d /* '!' */,
+	0x001a /* '"' */,
+	0x0027 /* '#' */,
+	0x0034 /* '$' */,
+	0x0041 /* '%' */,
+	0x004e /* '&' */,
+	0x005b /* ''' */,
+	0x0068 /* '(' */,
+	0x0075 /* ')' */,
+	0x0082 /* '*' */,
+	0x008f /* '+' */,
+	0x009c /* ',' */,
+	0x00a9 /* '-' */,
+	0x00b6 /* '.' */,
+	0x00c3 /* '/' */,
+	0x00d0 /* '0' */,
+	0x00dd /* '1' */,
+	0x00ea /* '2' */,
+	0x00f7 /* '3' */,
+	0x0104 /* '4' */,
+	0x0111 /* '5' */,
+	0x011e /* '6' */,
+	0x012b /* '7' */,
+	0x0138 /* '8' */,
+	0x0145 /* '9' */,
+	0x0152 /* ':' */,
+	0x015f /* ';' */,
+	0x016c /* '<' */,
+	0x0179 /* '=' */,
+	0x0186 /* '>' */,
+	0x0193 /* '?' */,
+	0x01a0 /* '@' */,
+	0x01ad /* 'A' */,
+	0x01ba /* 'B' */,
+	0x01c7 /* 'C' */,
+	0x01d4 /* 'D' */,
+	0x01e1 /* 'E' */,
+	0x01ee /* 'F' */,
+	0x01fb /* 'G' */,
+	0x0208 /* 'H' */,
+	0x0215 /* 'I' */,
+	0x0222 /* 'J' */,
+	0x022f /* 'K' */,
+	0x023c /* 'L' */,
+	0x0249 /* 'M' */,
+	0x0256 /* 'N' */,
+	0x0263 /* 'O' */,
+	0x0270 /* 'P' */,
+	0x027d /* 'Q' */,
+	0x028a /* 'R' */,
+	0x0297 /* 'S' */,
+	0x02a4 /* 'T' */,
+	0x02b1 /* 'U' */,
+	0x02be /* 'V' */,
+	0x02cb /* 'W' */,
+	0x02d8 /* 'X' */,
+	0x02e5 /* 'Y' */,
+	0x02f2 /* 'Z' */,
+	0x02ff /* '[' */,
+	0x030c /* '\' */,
+	0x0319 /* ']' */,
+	0x0326 /* '^' */,
+	0x0333 /* '_' */,
+	0x0340 /* '`' */,
+	0x034d /* 'a' */,
+	0x035a /* 'b' */,
+	0x0367 /* 'c' */,
+	0x0374 /* 'd' */,
+	0x0381 /* 'e' */,
+	0x038e /* 'f' */,
+	0x039b /* 'g' */,
+	0x03a8 /* 'h' */,
+	0x03b5 /* 'i' */,
+	0x03c2 /* 'j' */,
+	0x03cf /* 'k' */,
+	0x03dc /* 'l' */,
+	0x03e9 /* 'm' */,
+	0x03f6 /* 'n' */,
+	0x0403 /* 'o' */,
+	0x0410 /* 'p' */,
+	0x041d /* 'q' */,
+	0x042a /* 'r' */,
+	0x0437 /* 's' */,
+	0x0444 /* 't' */,
+	0x0451 /* 'u' */,
+	0x045e /* 'v' */,
+	0x046b /* 'w' */,
+	0x0478 /* 'x' */,
+	0x0485 /* 'y' */,
+	0x0492 /* 'z' */,
+	0x049f /* '{' */,
+	0x04ac /* '|' */,
+	0x04b9 /* '}' */,
+	0x04c6 /* '~' */,
+	0x04d3 /* '' */,
+};
+const struct fb_font font_c64 = {
+	.height = 8,
+	.ascent = 8,
+	.firstchar = 32, /* space */
+	.lastchar = 127, /* ? */
+	.chardata = font_c64_data,
+	.charoffs = font_c64_offsets,
+};
diff --git a/src/target/firmware/fb/fb_bw8.c b/src/target/firmware/fb/fb_bw8.c
new file mode 100644
index 00000000..ffb59d81
--- /dev/null
+++ b/src/target/firmware/fb/fb_bw8.c
@@ -0,0 +1,311 @@
+/* utility functions for a black-and-white framebuffer organized
+   as 8-vertically-stacked-pixels per byte. This matches the
+   ST7558 LC Display Controller used on the Motorola C123 */
+
+/* (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <fb/framebuffer.h>
+#include <fb/fb_bw8.h>
+
+#include <stdio.h> // debugging
+
+void fb_bw8_clear(){
+	int i,n;
+
+	/* bytes to clear */
+	n = (framebuffer->height+7)/8 * framebuffer->width;
+	for(i=0;i<n;i++)
+		fb_bw8->mem[i]=0;
+
+	/* mark everything as dirty */
+	fb_bw8->damage_x1 = 0;
+	fb_bw8->damage_x2 = framebuffer->width;
+	fb_bw8->damage_y1 = 0;
+	fb_bw8->damage_y2 = framebuffer->height;
+}
+
+/* update damage rectangle to include the area
+   x1,y1 (upper left) to x2,y2 (lower right)
+   Note that all pixels *including* x1y2 and x2y2 are
+   marked as dirty */
+static void fb_bw8_update_damage(
+	uint16_t x1,uint16_t y1, /* left upper corner (inclusive) */
+	uint16_t x2,uint16_t y2  /* right lower corner (inclusive) */
+){
+	fb_sanitize_box(&x1,&y1,&x2,&y2);
+	
+	x2++; /* see definition of fb_bw8->damage_x2/y2 */
+	y2++;
+
+	/* maybe currently everything is clean? */
+	if(fb_bw8->damage_x1 == fb_bw8->damage_x2 ||
+		fb_bw8->damage_y1 == fb_bw8->damage_y2){
+			fb_bw8->damage_x1 = x1;
+			fb_bw8->damage_y1 = y1;
+			fb_bw8->damage_x2 = x2;
+			fb_bw8->damage_y2 = y2;
+/*
+		printf("%s: was clean! damage now %d %d %d %d\n",
+			__FUNCTION__,fb_bw8->damage_x1,fb_bw8->damage_y1,
+			fb_bw8->damage_x2,fb_bw8->damage_y2);
+*/
+			return;
+	}
+
+	/* grow damage box */
+	if(x1 < fb_bw8->damage_x1)
+		fb_bw8->damage_x1 = x1;
+	if(y1 < fb_bw8->damage_y1)
+		fb_bw8->damage_y1 = y1;
+	if(x2 > fb_bw8->damage_x2)
+		fb_bw8->damage_x2 = x2;
+	if(y2 > fb_bw8->damage_y2)
+		fb_bw8->damage_y2 = y2;
+#if 0
+	printf("%s: damage now %d %d %d %d\n",
+	       __FUNCTION__,fb_bw8->damage_x1,fb_bw8->damage_y1,
+	       fb_bw8->damage_x2,fb_bw8->damage_y2);
+#endif
+}
+
+static void fb_bw8_line(uint16_t x1,uint16_t y1,uint16_t x2,uint16_t y2){
+	fb_sanitize_box(&x1,&y1,&x2,&y2);
+	/* FIXME : this is currently unimplemented! */
+}
+
+void fb_bw8_lineto(uint16_t x,uint16_t y){
+	fb_bw8_line(framebuffer->cursor_x,framebuffer->cursor_y,x,y);
+	framebuffer->cursor_x = x;
+	framebuffer->cursor_y = y;	
+}
+
+/* depending on color set (add to or_mask) or clear
+   (remove from and_mask) bit number bitnum */
+static void set_pixel(uint8_t *and_mask,
+		      uint8_t *or_mask,
+		      int bitnum,
+		      uint32_t color
+){
+	if(color == FB_COLOR_TRANSP)
+		return;
+	if(color == FB_COLOR_WHITE)
+		*and_mask &= ~(1<<bitnum);
+	else
+		*or_mask  |=   1<<bitnum;
+}
+
+static void set_fg_pixel(uint8_t *and_mask,uint8_t *or_mask,int bitnum){
+	set_pixel(and_mask,or_mask,bitnum,framebuffer->fg_color);
+}
+
+static void set_bg_pixel(uint8_t *and_mask,uint8_t *or_mask,int bitnum){
+	set_pixel(and_mask,or_mask,bitnum,framebuffer->bg_color);
+}
+
+static void fb_bw8_box(uint16_t x1,uint16_t y1,uint16_t x2,uint16_t y2)
+{
+	uint16_t y,w;
+	uint8_t *p;
+
+	uint8_t and_mask,or_mask;	// filling
+	uint8_t and_mask_side,or_mask_side; // left and right side
+
+	fb_sanitize_box(&x1,&y1,&x2,&y2);
+	fb_bw8_update_damage(x1,y1,x2,y2);
+
+	for(y=y1&0xfff8;y<=y2;y+=8){
+		/* don't clear any pixels (white) */
+		and_mask = and_mask_side = 0xff;
+		or_mask = or_mask_side = 0;
+
+		for(w=0;w<8;w++){ /* check which pixels are affected */
+			if(y+w >= y1 && y+w <= y2){
+				set_bg_pixel(&and_mask,&or_mask,w);
+				set_fg_pixel(&and_mask_side,&or_mask_side,w);
+			}
+
+			if(y+w == y1 || y+w == y2){ /* top and bottom line */
+				set_fg_pixel(&and_mask,&or_mask,w);
+			}
+		}
+
+		p = fb_bw8->mem + (y/8)*framebuffer->width + x1;
+		for(w=x1;w<=x2;w++){
+			if(w == x1 || w == x2)
+				*p = (*p & and_mask_side)|or_mask_side;
+			else
+				*p = (*p & and_mask)|or_mask;
+			p++;
+		}
+	}
+}
+
+/* draw box from cursor to (x,y) */
+void
+fb_bw8_boxto(uint16_t x,uint16_t y){
+	fb_bw8_box(framebuffer->cursor_x,framebuffer->cursor_y,x,y);
+	framebuffer->cursor_x = x;
+	framebuffer->cursor_y = y;
+}
+
+/* this is the most ridiculous function ever, because it has to
+   fiddle with two braindead bitmaps at once, both being
+   organized differently */
+
+/* draw text at current position, with current font and colours up
+   to a width of maxwidth pixels, return pixelwidth consumed */
+
+int
+fb_bw8_putstr(char *str,int maxwidth){
+	const struct fb_font *font = fb_fonts[framebuffer->font];
+	const struct fb_char *fchr;
+
+	int x1,y1,x2,y2; 		// will become bounding box
+	int w;				// 0..7 while building bits per byte
+	int y;				// coordinates in display
+	int char_x,char_y;		// coordinates in font character
+	int bitmap_x,bitmap_y;		// coordinates in character's bitmap
+	int byte_per_line;		// depending on character width in font
+	int bitmap_offs,bitmap_bit;	// offset inside bitmap, bit number of pixel
+	int fb8_offs;			// offset to current pixel in framebuffer
+	uint8_t and_mask,or_mask;	// to draw on framebuffer
+	uint8_t *p;			// pointer into framebuffer memorya
+	int total_w;			// total width
+
+	/* center, if maxwidth < 0 */
+	if (maxwidth < 0) {
+		total_w = 0;
+		/* count width of string */
+		for(p=(uint8_t *)str;*p;p++){
+			fchr = fb_font_get_char(font,*p);
+			if(!fchr)  /* FIXME: Does '?' exist in every font? */
+				fchr = fb_font_get_char(font,'?');
+			total_w += fchr->width;
+
+		} // str
+		if (total_w <= framebuffer->width)
+			framebuffer->cursor_x =
+				(framebuffer->width - total_w) >> 1;
+		maxwidth = framebuffer->width;
+	}
+
+	x1 = framebuffer->cursor_x;	// first col (incl!)
+	x2 = x1 + maxwidth - 1;		// last col (incl!)
+	if(x2 >= framebuffer->width)
+		x2 = framebuffer->width - 1;
+
+	y1 = framebuffer->cursor_y - font->ascent + 1; // first row
+	y2 = y1 + font->height - 1;	// last row
+
+#if 0
+	printf("%s: %d %d %d %d\n",__FUNCTION__,x1,y1,x2,y2);
+#endif
+
+	if(y1 < 0)			// sanitize in case of overflow
+		y1 = 0;
+	if(y2 >= framebuffer->height)
+		y2 = framebuffer->height - 1;
+
+	fb8_offs = x1 + (y1 & 0xfff8)/8;
+
+	/* iterate over all characters */
+	for(;*str && framebuffer->cursor_x <= x2;str++){
+		fchr = fb_font_get_char(font,*str);
+		if(!fchr)  /* FIXME: Does '?' exist in every font? */
+			fchr = fb_font_get_char(font,'?');
+
+		byte_per_line = (fchr->bbox_w+7)/8;;
+
+		/* character pixels, left to right */
+		for(char_x=0;
+		    char_x<fchr->width && char_x + framebuffer->cursor_x <= x2;
+		    char_x++
+		){
+			/* character pixels, top to bottom, in stripes
+			   of 8 to match LCD RAM organisation */
+			for(y=y1&0xfff8;y<=y2;y+=8){ // display lines
+				/* bitmap coordinates, X= left to right */
+				bitmap_x = char_x - fchr->bbox_x;
+				/* character coords. Y increases from
+				   cursor upwards */
+				char_y = framebuffer->cursor_y-y;
+				/* bitmap index = height-(bitmap coords)-1 */
+				bitmap_y = fchr->bbox_h -
+					(char_y - fchr->bbox_y) - 1;
+
+				fb8_offs = framebuffer->cursor_x + 
+					char_x + (y/8)*framebuffer->width;
+
+				and_mask = 0xff;
+				or_mask = 0x00;
+
+				/* top to bottom inside of a 8bit column */
+				for(w=0;w<8;w++,bitmap_y++){
+					/* inside drawing area? */
+					if(y+w < y1 || y+w > y2)
+						continue;
+
+					/* outside pixel data of this
+					   character? */
+					if(bitmap_x < 0 ||
+					   bitmap_x >= fchr->bbox_w ||
+					   bitmap_y < 0 ||
+					   bitmap_y >= fchr->bbox_h
+					)
+						goto outside_char_bitmap;
+
+					/* check bit in pixel data for
+					   this character */
+					bitmap_offs = bitmap_x/8+
+						bitmap_y*byte_per_line;
+					bitmap_bit = 7-(bitmap_x%8);
+
+					/* bit is set  */
+					if(fchr->data[bitmap_offs] &
+					   (1<<bitmap_bit)){
+						set_fg_pixel(&and_mask,
+							     &or_mask,w);
+					} else { // unset, or outside bitmap
+outside_char_bitmap:
+						set_bg_pixel(&and_mask,
+							     &or_mask,w);
+					}
+				} // for(w...)
+				/* adjust byte in framebuffer */
+				p = fb_bw8->mem + fb8_offs;
+				*p = ( *p & and_mask ) | or_mask;
+			} // for(y...)
+		} // for(char_x...)
+		framebuffer->cursor_x += char_x;
+	} // str
+
+	x2 = framebuffer->cursor_x;
+	fb_bw8_update_damage(x1,y1,x2,y2);
+	return x2-x1;
+}
+
+int
+fb_bw8_putchar(char c,int maxwidth){
+	char tmp[2];
+	tmp[0]=c;
+	tmp[1]=c;
+	return fb_bw8_putstr(tmp,maxwidth);
+}
diff --git a/src/target/firmware/fb/fb_dummy.c b/src/target/firmware/fb/fb_dummy.c
new file mode 100644
index 00000000..cb053de4
--- /dev/null
+++ b/src/target/firmware/fb/fb_dummy.c
@@ -0,0 +1,70 @@
+/*
+    "hardware" driver for a dummy framebuffer. Used when no
+    display hardware is supported
+ */
+
+/* (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <fb/framebuffer.h>
+#include <defines.h>
+
+static void
+fb_dummy_init(){
+}
+
+static void
+fb_dummy_clear(){
+}
+
+static void
+fb_dummy_boxto(uint16_t x,uint16_t y){
+	framebuffer->cursor_x = x;
+	framebuffer->cursor_y = y;
+}
+
+static void
+fb_dummy_lineto(uint16_t x,uint16_t y){
+	framebuffer->cursor_x = x;
+	framebuffer->cursor_y = y;
+}
+
+static int
+fb_dummy_putstr(__unused char *c, __unused int maxwidth){
+	return 0;
+}
+
+static void
+fb_dummy_flush(){
+}
+
+struct framebuffer fb_dummy_framebuffer = {
+	.name = "dummyfb",
+	.init = fb_dummy_init,
+	.clear = fb_dummy_clear,
+	.boxto = fb_dummy_boxto,
+	.lineto = fb_dummy_lineto,
+	.putstr = fb_dummy_putstr,
+	.flush = fb_dummy_flush,
+	.width = 128,
+	.height = 64
+};
+
+struct framebuffer *framebuffer = & fb_dummy_framebuffer;
diff --git a/src/target/firmware/fb/fb_rgb332.c b/src/target/firmware/fb/fb_rgb332.c
new file mode 100644
index 00000000..08d64e13
--- /dev/null
+++ b/src/target/firmware/fb/fb_rgb332.c
@@ -0,0 +1,305 @@
+/* utility functions for a color framebuffer organized
+   as one pixel per byte, with bits mapped as RRRGGGBB.
+   This matches the SSD1783 LC Display Controller used
+   on the Motorola C155 */
+
+/* (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <fb/framebuffer.h>
+#include <fb/fb_rgb332.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+void
+fb_rgb332_clear(){
+	int i,n;
+	
+	/* bytes to clear */
+	n = framebuffer->height * framebuffer->width;
+	for(i=0;i<n;i++)
+		fb_rgb332->mem[i]=0xff; /* white */
+
+	/* mark everything as dirty */
+	fb_rgb332->damage_x1 = 0;
+	fb_rgb332->damage_x2 = framebuffer->width;
+	fb_rgb332->damage_y1 = 0;
+	fb_rgb332->damage_y2 = framebuffer->height;
+}
+
+/* update damage rectangle to include the area
+   x1,y1 (upper left) to x2,y2 (lower right)
+   Note that all pixels *including* x1y2 and x2y2 are
+   marked as dirty */
+static void
+fb_rgb332_update_damage(
+	uint16_t x1,uint16_t y1, /* left upper corner (inclusive) */
+	uint16_t x2,uint16_t y2  /* right lower corner (inclusive) */
+){
+	fb_sanitize_box(&x1,&y1,&x2,&y2);
+	
+	x2++; /* see definition of fb_rgb332->damage_x2/y2 */
+	y2++;
+
+	/* maybe currently everything is clean? */
+	if(fb_rgb332->damage_x1 == fb_rgb332->damage_x2 ||
+	   fb_rgb332->damage_y1 == fb_rgb332->damage_y2
+	){
+			fb_rgb332->damage_x1 = x1;
+			fb_rgb332->damage_y1 = y1;
+			fb_rgb332->damage_x2 = x2;
+			fb_rgb332->damage_y2 = y2;
+			return;
+	}
+
+	/* grow damage box */
+	if(x1 < fb_rgb332->damage_x1)
+		fb_rgb332->damage_x1 = x1;
+	if(y1 < fb_rgb332->damage_y1)
+		fb_rgb332->damage_y1 = y1;
+	if(x2 > fb_rgb332->damage_x2)
+		fb_rgb332->damage_x2 = x2;
+	if(y2 > fb_rgb332->damage_y2)
+		fb_rgb332->damage_y2 = y2;
+#if 0
+	printf("%s: damage now %d %d %d %d\n",
+	       __FUNCTION__,fb_rgb332->damage_x1,fb_rgb332->damage_y1,
+	       fb_rgb332->damage_x2,fb_rgb332->damage_y2);
+#endif
+}
+
+/* we trust gcc to move this expensive bitshifting out of
+   the loops in the drawing funtcions */
+static uint8_t rgb_to_pixel(uint32_t color){
+	uint8_t ret;
+	ret  = (FB_COLOR_TO_R(color) & 0xe0);      /* 765 = RRR */
+	ret |= (FB_COLOR_TO_G(color) & 0xe0) >> 3; /* 432 = GGG */
+	ret |= (FB_COLOR_TO_B(color) & 0xc0) >> 6; /*  10 =  BB */
+	return ret;
+}
+
+static void set_pix(uint8_t *pixel,uint32_t color){
+	if(color == FB_COLOR_TRANSP)
+		return;
+	*pixel = rgb_to_pixel(color);
+}
+
+static void set_fg(uint8_t *pixel){
+	set_pix(pixel,framebuffer->fg_color);
+}
+
+static void set_bg(uint8_t *pixel){
+	set_pix(pixel,framebuffer->bg_color);
+}
+
+void fb_rgb332_boxto(uint16_t x2,uint16_t y2)
+{
+	uint16_t x1 = framebuffer->cursor_x;
+	uint16_t y1 = framebuffer->cursor_y;
+	int x,y;
+	uint8_t *p;
+
+	framebuffer->cursor_x = x2;
+	framebuffer->cursor_y = y2;
+	
+	fb_sanitize_box(&x1,&y1,&x2,&y2);
+	fb_rgb332_update_damage(x1,y1,x2,y2);
+
+	for(y=y1; y<=y2; y++){
+		p = & fb_rgb332->mem[x1 + framebuffer->width * y];
+		for(x=x1;x<=x2;x++){
+			set_bg(p);
+			if(y==y1 || y==y2 || x==x1 || x==x2) /* border */
+				set_fg(p);
+			p++;
+		}
+	}
+}
+
+/* draw a line like Brensenham did... (roughly) */
+void fb_rgb332_lineto(uint16_t x2,uint16_t y2){
+	uint8_t *p,pixel;	/* framebuffer pointer */
+	int delta_regular;	/* framebuffer offset per step */
+	int delta_step;		/* " */
+
+	uint16_t x1 = framebuffer->cursor_x; /* start */
+	uint16_t y1 = framebuffer->cursor_y;
+
+	int t,tmax;		/* counter for steps */
+	int err_inc,err_accu=0;	/* error delta and accumulator for */
+				/* Brensenham's algorhithm */
+
+	fb_limit_fb_range(&x1,&y1);
+	fb_limit_fb_range(&x2,&y2);
+	fb_rgb332_update_damage(x1,y1,x2,y2);
+
+	framebuffer->cursor_x = x2; /* end pixel */
+	framebuffer->cursor_y = y2;
+
+	/* pointer to first pixel, pixel value in FB memory */
+	p = fb_rgb332->mem + framebuffer->width * y1 + x1;
+	pixel = rgb_to_pixel(framebuffer->fg_color);
+
+	if(abs(x2-x1) >= abs(y2-y1)){ /* shallow line */
+		/* set pointer deltas for directions */
+		delta_regular = 1;		    /* X */
+		if(x2 < x1)
+			delta_regular = -delta_regular;
+		delta_step = framebuffer->width;    /* Y */
+		if(y2 < y1)
+			delta_step = -delta_step;
+		tmax = abs(x2-x1);
+		err_inc = abs(y2-y1);
+	} else { /* steep line */
+		delta_regular = framebuffer->width; /* Y */
+		if(y2 < y1)
+			delta_regular = -delta_regular;
+		delta_step = 1; 		    /* X */
+		if(x2 < x1)
+			delta_step = -1;
+		tmax = abs(y2-y1);
+		err_inc = abs(x2-y1);
+	}
+
+#if 0
+	printf("%s: (%d,%d) -> (%d,%d) step=%d regular=%d err_inc=%d tmax=%d\n",
+	       __FUNCTION__,x1,y1,x2,y2,delta_step,delta_regular,err_inc,tmax);
+#endif
+
+	for(t=0;t<=tmax;t++){
+		*p = pixel;
+		err_accu += err_inc;
+		if(err_accu >= tmax){
+			p += delta_step;
+			err_accu -= tmax;
+		}
+		p += delta_regular;
+	}
+}
+
+int fb_rgb332_putstr(char *str,int maxwidth){
+	const struct fb_font *font = fb_fonts[framebuffer->font];
+	const struct fb_char *fchr;
+
+	int x1,y1,x2,y2; 		// will become bounding box
+	int y;				// coordinates in display
+	int char_x=0,char_y;		// coordinates in font character
+	int bitmap_x,bitmap_y;		// coordinates in character's bitmap
+	int byte_per_line;		// depending on character width in font
+	int bitmap_offs,bitmap_bit;	// offset inside bitmap, bit number of pixel
+	uint8_t *p,fgpixel,bgpixel,trans; // pointer into framebuffer memory
+	int total_w;			// total width
+
+	/* center, if maxwidth < 0 */
+	if (maxwidth < 0) {
+		total_w = 0;
+		/* count width of string */
+		for(p=(uint8_t *)str;*p;p++){
+			fchr = fb_font_get_char(font,*p);
+			if(!fchr)  /* FIXME: Does '?' exist in every font? */
+				fchr = fb_font_get_char(font,'?');
+			total_w += fchr->width;
+
+		} // str
+		if (total_w <= framebuffer->width)
+			framebuffer->cursor_x =
+				(framebuffer->width - total_w) >> 1;
+		else
+			framebuffer->cursor_x = 1;
+		maxwidth = framebuffer->width;
+	}
+
+	x1 = framebuffer->cursor_x;	// first col (incl!)
+	x2 = x1 + maxwidth - 1;		// last col (incl!)
+	if(x2 >= framebuffer->width)
+		x2 = framebuffer->width - 1;
+
+	y1 = framebuffer->cursor_y - font->ascent + 1; // first row
+	y2 = y1 + font->height - 1;	// last row
+
+	fgpixel = rgb_to_pixel(framebuffer->fg_color);
+	bgpixel = rgb_to_pixel(framebuffer->bg_color);
+	trans = (framebuffer->bg_color == FB_COLOR_TRANSP);
+
+	if(y1 < 0)			// sanitize in case of overflow
+		y1 = 0;
+	if(y2 >= framebuffer->height)
+		y2 = framebuffer->height - 1;
+
+	/* iterate over all characters */
+	for(;*str && framebuffer->cursor_x <= x2;str++){
+		fchr = fb_font_get_char(font,*str);
+		if(!fchr)  /* FIXME: Does '?' exist in every font? */
+			fchr = fb_font_get_char(font,'?');
+		if(!fchr)
+			return 0;
+		byte_per_line = (fchr->bbox_w+7)/8;
+
+		for(y=y1;y<=y2;y++){
+			p=fb_rgb332->mem+y*framebuffer->width;
+			p+=framebuffer->cursor_x;
+
+			for(char_x=0;
+			    char_x<fchr->width &&
+			    char_x+framebuffer->cursor_x <= x2;
+			    char_x++
+			){
+				/* bitmap coordinates, X= left to right */
+				bitmap_x = char_x - fchr->bbox_x;
+				/* character coords. Y increases from
+				   cursor upwards */
+				char_y = framebuffer->cursor_y-y;
+				/* bitmap index = height-(bitmap coords)-1 */
+				bitmap_y = fchr->bbox_h -
+					(char_y - fchr->bbox_y) - 1;
+
+				/* outside pixel data of this
+				   character? */
+				if(bitmap_x < 0 ||
+				   bitmap_x >= fchr->bbox_w ||
+				   bitmap_y < 0 ||
+				   bitmap_y >= fchr->bbox_h
+				)
+					goto outside_char_bitmap;
+
+				/* check bit in pixel data for
+				   this character */
+				bitmap_offs=bitmap_x/8+bitmap_y*byte_per_line;
+				bitmap_bit=7-(bitmap_x%8);
+
+				/* bit is set  */
+				if(fchr->data[bitmap_offs]&(1<<bitmap_bit)){
+					*p = fgpixel;
+				} else { // unset, or outside bitmap
+outside_char_bitmap:
+					if (!trans)
+						*p = bgpixel;
+				}
+				p++;
+			} // for(x...)
+		} // for(char_x...)
+		framebuffer->cursor_x += char_x;
+	} // str
+
+	x2 = framebuffer->cursor_x;
+	fb_rgb332_update_damage(x1,y1,x2,y2);
+	return x2-x1;
+}
+
diff --git a/src/target/firmware/fb/fb_s6b33b1x.c b/src/target/firmware/fb/fb_s6b33b1x.c
new file mode 100644
index 00000000..788ada7b
--- /dev/null
+++ b/src/target/firmware/fb/fb_s6b33b1x.c
@@ -0,0 +1,194 @@
+/* Framebuffer implementation - combined Sunplus SPCA552E and
+ * Samsung S6B33B1X LCD driver - as used in the Pirelli DP-L10 */
+
+/* (C) 2012 by Steve Markgraf <steve@steve-m.de>
+ *
+ * based on fb_ssd1783.c:
+ * (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <fb/framebuffer.h>
+#include <fb/fb_rgb332.h>
+
+#include <stdint.h>
+#include <stdio.h>
+#include <delay.h>
+#include <memory.h>
+
+#define S6B33B1X_WIDTH		128
+#define S6B33B1X_HEIGHT		128
+#define LCD_INVIS_X_PIXELS	4
+
+#define ARMIO_LATCH_OUT		0xfffe4802
+#define nCS4_ADDR		0x02800000
+
+static uint8_t fb_s6b33b1x_mem[S6B33B1X_WIDTH * S6B33B1X_HEIGHT];
+
+enum s6b33b1x_cmdflag { CMD, DATA, END };
+
+struct s6b33b1x_cmdlist {
+	enum s6b33b1x_cmdflag is_cmd:8;	/* 1: is a command, 0: is data, 2: end marker! */
+	uint8_t data;			/* 8 bit to send to LC display */
+} __attribute__((packed));
+
+static const struct s6b33b1x_cmdlist
+s6b33b1x_initdata[] = {
+	{ CMD,  0x26 }, /* CMD   DCDC and AMP ON/OFF set */
+	{ DATA, 0x00 }, /* DATA: everything off */
+	{ CMD,  0x02 }, /* CMD   Oscillation Mode Set */
+	{ DATA, 0x00 }, /* DATA: oscillator off */
+	{ CMD,  0x2c }, /* CMD   Standby Mode off */
+	{ CMD,  0x50 }, /* CMD   Display off */
+	{ CMD,  0x02 }, /* CMD   Oscillation Mode Set */
+	{ DATA, 0x01 }, /* DATA: oscillator on */
+	{ CMD,  0x26 }, /* CMD   DCDC and AMP ON/OFF set */
+	{ DATA, 0x01 }, /* DATA: Booster 1 on */
+	{ CMD,  0x26 }, /* CMD   DCDC and AMP ON/OFF set */
+	{ DATA, 0x09 }, /* DATA: Booster 1 on, OP-AMP on */
+	{ CMD,  0x26 }, /* CMD   DCDC and AMP ON/OFF set */
+	{ DATA, 0x0b }, /* DATA: Booster 1 + 2 on, OP-AMP on */
+	{ CMD,  0x26 }, /* CMD   DCDC and AMP ON/OFF set */
+	{ DATA, 0x0f }, /* DATA: Booster 1 + 2 + 3 on, OP-AMP on */
+	{ CMD,  0x20 }, /* CMD   DC-DC Select */
+	{ DATA, 0x01 }, /* DATA: step up x1.5 */
+	{ CMD,  0x24 }, /* CMD   DCDC Clock Division Set */
+	{ DATA, 0x0a }, /* DATA: fPCK = fOSC/6 */
+	{ CMD,  0x2a }, /* CMD   Contrast Control */
+	{ DATA, 0x2d }, /* DATA: default contrast */
+	{ CMD,  0x30 }, /* CMD   Adressing mode set */
+	{ DATA, 0x0b }, /* DATA: 65536 color mode */
+	{ CMD,  0x10 }, /* CMD   Driver output mode set */
+	{ DATA, 0x03 }, /* DATA: Display duty: 1/132 */
+	{ CMD,  0x34 }, /* CMD   N-line inversion set */
+	{ DATA, 0x88 }, /* DATA: inversion on, one frame, every 8 blocks */
+	{ CMD,  0x40 }, /* CMD   Entry mode set */
+	{ DATA, 0x00 }, /* DATA: Y address counter mode */
+	{ CMD,  0x28 }, /* CMD   Temperature Compensation set */
+	{ DATA, 0x01 }, /* DATA: slope -0.05%/degC */
+	{ CMD,  0x32 }, /* CMD   ROW vector mode set */
+	{ DATA, 0x01 }, /* DATA: every 2 subgroup */
+	{ CMD,  0x51 }, /* CMD   Display on */
+	{ END,  0x00 }, /* MARKER: end of list */
+};
+
+static void fb_s6b33b1x_send_cmdlist(const struct s6b33b1x_cmdlist *p)
+{
+	while(p->is_cmd != END){
+		writew(p->data, nCS4_ADDR);
+		p++;
+	}
+}
+
+static void fb_spca_write(uint16_t addr, uint16_t val)
+{
+	writew(addr, nCS4_ADDR);
+	delay_ms(1);
+	writew(val , nCS4_ADDR | 2);
+}
+
+static void fb_spca_init(void)
+{
+	uint16_t reg;
+
+	/* Initialize Sunplus SPCA552E Media Controller for bypass mode */
+	fb_spca_write(0x7e, 0x00);	/* internal register access */
+	delay_ms(10);
+	fb_spca_write(0x7a, 0x00);	/* keep CPU in reset state */
+	delay_ms(10);
+	fb_spca_write(0x7f, 0x00);	/* select main page */
+	delay_ms(5);
+	fb_spca_write(0x72, 0x07);	/* don't reshape timing, 16 bit mode */
+	fb_spca_write(0x14, 0x03);
+	fb_spca_write(0x7f, 0x00);	/* select main page */
+	delay_ms(5);
+	fb_spca_write(0x06, 0xff);
+	fb_spca_write(0x7f, 0x09);
+	fb_spca_write(0x19, 0x08);	/* backlight: 0x08 is on, 0x0c is off */
+	fb_spca_write(0x23, 0x18);
+
+	/* enable bypass mode */
+	reg = readw(ARMIO_LATCH_OUT);
+	reg |= (1 << 7);
+	writew(reg, ARMIO_LATCH_OUT);
+}
+
+static void fb_s6b33b1x_init(void)
+{
+	printf("%s: initializing LCD.\n",__FUNCTION__);
+
+	fb_spca_init();
+	fb_s6b33b1x_send_cmdlist(s6b33b1x_initdata);
+}
+
+static void fb_s6b33b1x_flush(void)
+{
+	int x,y;
+	uint8_t *p;
+	struct s6b33b1x_cmdlist prepare_disp_write_cmds[] = {
+		{ CMD,  0x42 },			 /*  set column address */
+		{ DATA, fb_rgb332->damage_x1 + LCD_INVIS_X_PIXELS },
+		{ DATA, fb_rgb332->damage_x2 + LCD_INVIS_X_PIXELS - 1 },
+		{ CMD,  0x43 },			 /*  set page address (Y) */
+		{ DATA, fb_rgb332->damage_y1 },
+		{ DATA, fb_rgb332->damage_y2 - 1 },
+		{ END,  0x00 }
+	};
+
+	/* If everything's clean, just return */
+	if(fb_rgb332->damage_x1 == fb_rgb332->damage_x2 ||
+		fb_rgb332->damage_y1 == fb_rgb332->damage_y2) {
+			printf("%s: no damage\n",__FUNCTION__);
+			return;
+	}
+
+	fb_s6b33b1x_send_cmdlist(prepare_disp_write_cmds);
+
+	for(y=fb_rgb332->damage_y1;y<fb_rgb332->damage_y2;y++) {
+		p = & fb_rgb332->mem[y * framebuffer->width]; // start of line
+		p += fb_rgb332->damage_x1; // start of damage area
+
+		for(x=fb_rgb332->damage_x1; x<fb_rgb332->damage_x2; x++) {
+			uint16_t data = rgb332_to_565(*p++);
+			writew(data , nCS4_ADDR | 2);
+		}
+	}
+
+	fb_rgb332->damage_x1 = fb_rgb332->damage_x2 = 0;
+	fb_rgb332->damage_y1 = fb_rgb332->damage_y2 = 0;
+}
+
+static struct framebuffer fb_s6b33b1x_framebuffer = {
+	.name = "s6b33b1x",
+	.init = fb_s6b33b1x_init,
+	.clear = fb_rgb332_clear,
+	.boxto = fb_rgb332_boxto,
+	.lineto = fb_rgb332_lineto,
+	.putstr = fb_rgb332_putstr,
+	.flush = fb_s6b33b1x_flush,
+	.width = S6B33B1X_WIDTH,
+	.height = S6B33B1X_HEIGHT
+};
+
+static struct fb_rgb332 fb_s6b33b1x_rgb332 = {
+	.mem = fb_s6b33b1x_mem
+};
+
+struct framebuffer *framebuffer = &fb_s6b33b1x_framebuffer;
+struct fb_rgb332 *fb_rgb332 = &fb_s6b33b1x_rgb332;
diff --git a/src/target/firmware/fb/fb_ssd1783.c b/src/target/firmware/fb/fb_ssd1783.c
new file mode 100644
index 00000000..cacdce03
--- /dev/null
+++ b/src/target/firmware/fb/fb_ssd1783.c
@@ -0,0 +1,204 @@
+/* Framebuffer implementation - SSD1783 LCD driver for C155 */
+/* Based on ssd1783.c by Steve Markgraf and Harald Welte */
+
+/* (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <fb/framebuffer.h>
+#include <fb/fb_rgb332.h>
+
+#include <stdint.h>
+#include <stdio.h>
+#include <delay.h>
+#include <uwire.h>
+#include <calypso/clock.h>
+
+#define SSD1783_WIDTH		98
+#define SSD1783_HEIGHT		67
+#define SSD1783_UWIRE_BITLEN 	9
+#define SSD1783_DEV_ID		0
+
+#define LCD_TOP_FREE_ROWS	3
+#define LCD_LEFT_FREE_COLS	0
+#define	PIXEL_BYTES		3
+#define FONT_HEIGHT		8
+#define FONT_WIDTH		8
+
+static uint8_t fb_ssd1783_mem[SSD1783_WIDTH * SSD1783_HEIGHT];
+
+enum ssd1783_cmdflag { CMD, DATA, END };
+
+struct ssd1783_cmdlist {
+	enum ssd1783_cmdflag is_cmd:8;	/* 1: is a command, 0: is data, 2: end marker! */
+	uint8_t data;  			/* 8 bit to send to LC display */
+} __attribute__((packed));
+
+static const struct ssd1783_cmdlist
+ssd1783_initdata[] = {
+	{ CMD,  0xD1 }, /* CMD   set internal oscillator on */
+	{ CMD,  0x94 }, /* CMD   leave sleep mode */
+	{ CMD,  0xbb }, /* CMD   Set COM Output Scan Direction: */
+	{ DATA, 0x01 }, /* DATA: 01: COM0-79, then COM159-80 */
+/* -------- DIFFERENT FROM ORIGINAL CODE: -------------- */
+/* we use 8bit per pixel packed RGB 332 */
+	{ CMD,  0xbc }, /* CMD   Set Data Output Scan Direction */
+	{ DATA, 0x00 }, /* DATA: column scan, normal rotation, normal display */
+	{ DATA, 0x00 }, /* DATA: RGB color arrangement R G B R G B ... */
+/*-->*/ { DATA, 0x01 }, /* DATA: 8 bit per pixel mode MSB <RRRGGGBB> LSB */
+/* --------- /DIFFERENT ---------- */
+	{ CMD,  0xce }, /* CMD   Set 256 Color Look Up Table LUT */
+	{ DATA, 0x00 },	/* DATA red 000 */
+	{ DATA, 0x03 },	/* DATA red 001 */
+	{ DATA, 0x05 },	/* DATA red 010 */
+	{ DATA, 0x07 },	/* DATA red 011 */
+	{ DATA, 0x09 },	/* DATA red 100 */
+	{ DATA, 0x0b },	/* DATA red 101 */
+	{ DATA, 0x0d },	/* DATA red 110 */
+	{ DATA, 0x0f },	/* DATA red 111 */
+	{ DATA, 0x00 },	/* DATA green 000 */
+	{ DATA, 0x03 },	/* DATA green 001 */
+	{ DATA, 0x05 },	/* DATA green 010 */
+	{ DATA, 0x07 },	/* DATA green 011 */
+	{ DATA, 0x09 },	/* DATA green 100 */
+	{ DATA, 0x0b },	/* DATA green 101 */
+	{ DATA, 0x0d },	/* DATA green 110 */
+	{ DATA, 0x0f },	/* DATA green 111 */
+	{ DATA, 0x00 },	/* DATA blue 00 */
+	{ DATA, 0x05 },	/* DATA blue 01 */
+	{ DATA, 0x0a },	/* DATA blue 10 */
+	{ DATA, 0x0f },	/* DATA blue 11 */
+	{ CMD,  0xca }, /* CMD   Set Display Control - Driver Duty Selection */
+	{ DATA, 0xff }, // can't find description of the values in the original
+	{ DATA, 0x10 }, // display/ssd1783.c in my datasheet :-(
+	{ DATA, 0x01 }, //
+	{ CMD,  0xab }, /* CMD   Set Scroll Start */
+	{ DATA, 0x00 }, /* DATA: Starting address at block 0 */
+	{ CMD,  0x20 }, /* CMD   Set power control register */
+	{ DATA, 0x0b }, /* DATA: booster 6x, reference gen. & int regulator */
+	{ CMD,  0x81 }, /* CMD   Contrast Lvl & Int. Regul. Resistor Ratio */
+	{ DATA, 0x29 }, /* DATA: contrast = 0x29 */
+	{ DATA, 0x05 }, /* DATA: 0x05 = 0b101 -> 1+R2/R1 = 11.37 */
+	{ CMD,  0xa7 }, /* CMD   Invert Display */
+	{ CMD,  0x82 }, /* CMD   Set Temperature Compensation Coefficient */
+	{ DATA, 0x00 }, /* DATA: Gradient is -0.10 % / degC */
+	{ CMD,  0xfb }, /* CMD   Set Biasing Ratio */
+	{ DATA, 0x03 }, /* DATA: 1/10 bias */
+	{ CMD,  0xf2 }, /* CMD   Set Frame Frequency and N-line inversion */
+	{ DATA, 0x08 }, /* DATA: 75 Hz (POR) */
+	{ DATA, 0x06 }, /* DATA: n-line inversion: 6 lines */
+	{ CMD,  0xf7 }, /* CMD   Select PWM/FRC Select Full Col./8col mode */
+	{ DATA, 0x28 }, /* DATA: always 0x28 */
+	{ DATA, 0x8c }, /* DATA: 4bit PWM + 2 bit FRC */
+	{ DATA, 0x05 }, /* DATA: full color mode */
+	{ CMD,  0xaf }, /* CMD   Display On */
+	{ END,  0x00 }, /* MARKER: end of list */
+};
+
+static void
+fb_ssd1783_send_cmdlist(const struct ssd1783_cmdlist *p){
+	int i=0;
+	while(p->is_cmd != END){
+		uint16_t sendcmd = p->data;
+		if(p->is_cmd == DATA)
+			sendcmd |= 0x0100; /* 9th bit is cmd/data flag */
+		uwire_xfer(SSD1783_DEV_ID, SSD1783_UWIRE_BITLEN, &sendcmd, NULL);
+		p++;
+		i++;
+	}
+}
+
+static void
+fb_ssd1783_init(void){
+	printf("%s: initializing LCD.\n",__FUNCTION__);
+	calypso_reset_set(RESET_EXT, 0);
+	delay_ms(5);
+	uwire_init();
+	delay_ms(5);
+	fb_ssd1783_send_cmdlist(ssd1783_initdata);
+}
+
+/* somehow the palette is messed up, RRR seems to have the
+   bits reversed!  R0 R1 R2 G G G B B ---> R2 R1 R0 G G G B B */
+static uint8_t fix_rrr(uint8_t v){
+	return (v & 0x5f) | (v & 0x80) >> 2 | (v & 0x20) << 2;
+}
+
+static void
+fb_ssd1783_flush(void){
+	int x,y;
+	uint8_t *p;
+	struct ssd1783_cmdlist prepare_disp_write_cmds[] = {
+		{ CMD,  0x15 },			 /*  set column address */
+		{ DATA, fb_rgb332->damage_x1 },
+		{ DATA, fb_rgb332->damage_x2-1 },
+		{ CMD,  0x75 },			 /*  set page address (Y) */
+		{ DATA, fb_rgb332->damage_y1 },
+		{ DATA, fb_rgb332->damage_y2-1 },
+		{ CMD,  0x5c },			 /* enter write display ram mode */
+		{ END,  0x00 }
+	};
+	struct ssd1783_cmdlist nop[] = {
+		{ CMD, 0x25 }, // NOP command
+		{ END, 0x00 }
+	};
+
+	/* If everything's clean, just return */
+	if(fb_rgb332->damage_x1 == fb_rgb332->damage_x2 ||
+		fb_rgb332->damage_y1 == fb_rgb332->damage_y2){
+			printf("%s: no damage\n",__FUNCTION__);
+			return;
+	}
+
+	fb_ssd1783_send_cmdlist(prepare_disp_write_cmds);
+
+	for(y=fb_rgb332->damage_y1;y<fb_rgb332->damage_y2;y++){
+		p = & fb_rgb332->mem[y * framebuffer->width]; // start of line
+		p += fb_rgb332->damage_x1; // start of damage area
+
+		for(x=fb_rgb332->damage_x1;x<fb_rgb332->damage_x2;x++){
+			uint16_t data = 0x0100 | fix_rrr(*p++); // dummy data
+			uwire_xfer(SSD1783_DEV_ID, SSD1783_UWIRE_BITLEN,
+					&data, NULL);
+		}
+	}
+	fb_ssd1783_send_cmdlist(nop);
+
+	fb_rgb332->damage_x1 = fb_rgb332->damage_x2 = 0;
+	fb_rgb332->damage_y1 = fb_rgb332->damage_y2 = 0;
+}
+
+static struct framebuffer fb_ssd1783_framebuffer = {
+	.name = "ssd1783",
+	.init = fb_ssd1783_init,
+	.clear = fb_rgb332_clear,
+	.boxto = fb_rgb332_boxto,
+	.lineto = fb_rgb332_lineto,
+	.putstr = fb_rgb332_putstr,
+	.flush = fb_ssd1783_flush,
+	.width = SSD1783_WIDTH,
+	.height = SSD1783_HEIGHT
+};
+
+static struct fb_rgb332 fb_ssd1783_rgb332 = {
+	.mem = fb_ssd1783_mem
+};
+
+struct framebuffer *framebuffer = &fb_ssd1783_framebuffer;
+struct fb_rgb332 *fb_rgb332 = &fb_ssd1783_rgb332;
diff --git a/src/target/firmware/fb/fb_ssd1963.c b/src/target/firmware/fb/fb_ssd1963.c
new file mode 100644
index 00000000..361434e4
--- /dev/null
+++ b/src/target/firmware/fb/fb_ssd1963.c
@@ -0,0 +1,196 @@
+/* Framebuffer implementation - SSD1963 (S1D15G14 clone) LCD driver for J100i */
+/* Based on ssd1963.c by Steve Markgraf and Harald Welte */
+
+/* (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ * (C) 2012 by Steve Markgraf <steve@steve-m.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <fb/framebuffer.h>
+#include <fb/fb_rgb332.h>
+
+#include <stdint.h>
+#include <stdio.h>
+#include <delay.h>
+#include <uwire.h>
+#include <calypso/clock.h>
+
+#define SSD1963_WIDTH		96
+#define SSD1963_HEIGHT		64
+#define SSD1963_UWIRE_BITLEN	9
+#define SSD1963_DEV_ID		0
+
+static uint8_t fb_ssd1963_mem[SSD1963_WIDTH * SSD1963_HEIGHT];
+
+enum ssd1963_cmdflag { CMD, DATA, END };
+
+struct ssd1963_cmdlist {
+	enum ssd1963_cmdflag is_cmd:8;	/* 1: is a command, 0: is data, 2: end marker! */
+	uint8_t data;  			/* 8 bit to send to LC display */
+} __attribute__((packed));
+
+static const struct ssd1963_cmdlist
+ssd1963_initdata[] = {
+	{ CMD,  0xb6 }, /* CMD   Display Control, set panel parameters */
+	{ DATA, 0x4b },
+	{ DATA, 0xf1 },
+	{ DATA, 0x40 },
+	{ DATA, 0x40 },
+	{ DATA, 0x00 },
+	{ DATA, 0x8c },
+	{ DATA, 0x00 },
+	{ CMD,  0x3a }, /* CMD   Set pixel format */
+	{ DATA, 0x02 }, /* DATA: 8 bit per pixel */
+	{ CMD,  0x2d }, /* Colour set, RGB332 -> RGB 565 mapping */
+	{ DATA, 0x00 }, /* DATA red 000 */ 
+	{ DATA, 0x04 }, /* DATA red 001 */ 
+	{ DATA, 0x09 }, /* DATA red 010 */ 
+	{ DATA, 0x0d }, /* DATA red 011 */ 
+	{ DATA, 0x12 }, /* DATA red 100 */ 
+	{ DATA, 0x16 }, /* DATA red 101 */ 
+	{ DATA, 0x1b }, /* DATA red 110 */ 
+	{ DATA, 0x1f }, /* DATA red 111 */ 
+	{ DATA, 0x00 }, /* Those bytes are probably a second palette */
+	{ DATA, 0x00 }, /* for an unused powersaving mode with reduced colors */
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 }, /* DATA green 000 */
+	{ DATA, 0x09 }, /* DATA green 001 */
+	{ DATA, 0x12 }, /* DATA green 010 */
+	{ DATA, 0x1b }, /* DATA green 011 */
+	{ DATA, 0x24 }, /* DATA green 100 */
+	{ DATA, 0x2d }, /* DATA green 101 */
+	{ DATA, 0x36 }, /* DATA green 110 */
+	{ DATA, 0x3f }, /* DATA green 111 */
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 }, /* DATA blue 00 */
+	{ DATA, 0x0a }, /* DATA blue 01 */
+	{ DATA, 0x15 }, /* DATA blue 10 */
+	{ DATA, 0x1f }, /* DATA blue 11 */
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ DATA, 0x00 },
+	{ CMD,  0x11 }, /* CMD   Exit sleep mode*/
+	{ CMD,  0xba }, /* CMD   Set contrast/Electronic Volume Control */
+	{ DATA, 0x5b }, /* DATA: */
+	{ DATA, 0x84 }, /* DATA: */
+	{ CMD,  0x36 }, /* CMD Memory access control */
+	{ DATA, 0x00 }, /* DATA: */
+	{ CMD,  0x13 }, /* CMD   Enter normal mode */
+	{ CMD,  0x29 }, /* CMD   Set display on */
+	{ END,  0x00 }, /* MARKER: end of list */
+};
+
+static void
+fb_ssd1963_send_cmdlist(const struct ssd1963_cmdlist *p) {
+	int i=0;
+	while(p->is_cmd != END){
+		uint16_t sendcmd = p->data;
+		if(p->is_cmd == DATA)
+			sendcmd |= 0x0100; /* 9th bit is cmd/data flag */
+		uwire_xfer(SSD1963_DEV_ID, SSD1963_UWIRE_BITLEN, &sendcmd, NULL);
+		p++;
+		i++;
+	}
+}
+
+static void
+fb_ssd1963_init(void){
+	printf("%s: initializing LCD.\n",__FUNCTION__);
+	calypso_reset_set(RESET_EXT, 0);
+	delay_ms(5);
+	uwire_init();
+	delay_ms(5);
+	fb_ssd1963_send_cmdlist(ssd1963_initdata);
+}
+
+static void
+fb_ssd1963_flush(void){
+	int x,y;
+	uint8_t *p;
+	struct ssd1963_cmdlist prepare_disp_write_cmds[] = {
+		{ CMD,  0x2a },			 /*  set column address */
+		{ DATA, fb_rgb332->damage_x1 },
+		{ DATA, fb_rgb332->damage_x2-1 },
+		{ CMD,  0x2b },			 /*  set page address (Y) */
+		{ DATA, fb_rgb332->damage_y1 },
+		{ DATA, fb_rgb332->damage_y2-1 },
+		{ CMD,  0x2c },			 /* enter write display ram mode */
+		{ END,  0x00 }
+	};
+	struct ssd1963_cmdlist nop[] = {
+		{ CMD, 0x00 }, // NOP command
+		{ END, 0x00 }
+	};
+
+	/* If everything's clean, just return */
+	if(fb_rgb332->damage_x1 == fb_rgb332->damage_x2 ||
+		fb_rgb332->damage_y1 == fb_rgb332->damage_y2) {
+			printf("%s: no damage\n",__FUNCTION__);
+			return;
+	}
+
+	fb_ssd1963_send_cmdlist(prepare_disp_write_cmds);
+
+	for(y=fb_rgb332->damage_y1;y<fb_rgb332->damage_y2;y++) {
+		p = & fb_rgb332->mem[y * framebuffer->width]; // start of line
+		p += fb_rgb332->damage_x1; // start of damage area
+
+		for(x=fb_rgb332->damage_x1;x<fb_rgb332->damage_x2;x++) {
+			uint16_t data = 0x0100 | *p++;
+			uwire_xfer(SSD1963_DEV_ID, SSD1963_UWIRE_BITLEN,
+					&data, NULL);
+		}
+	}
+	fb_ssd1963_send_cmdlist(nop);
+
+	fb_rgb332->damage_x1 = fb_rgb332->damage_x2 = 0;
+	fb_rgb332->damage_y1 = fb_rgb332->damage_y2 = 0;
+}
+
+static struct framebuffer fb_ssd1963_framebuffer = {
+	.name = "ssd1963",
+	.init = fb_ssd1963_init,
+	.clear = fb_rgb332_clear,
+	.boxto = fb_rgb332_boxto,
+	.lineto = fb_rgb332_lineto,
+	.putstr = fb_rgb332_putstr,
+	.flush = fb_ssd1963_flush,
+	.width = SSD1963_WIDTH,
+	.height = SSD1963_HEIGHT
+};
+
+static struct fb_rgb332 fb_ssd1963_rgb332 = {
+	.mem = fb_ssd1963_mem
+};
+
+struct framebuffer *framebuffer = &fb_ssd1963_framebuffer;
+struct fb_rgb332 *fb_rgb332 = &fb_ssd1963_rgb332;
diff --git a/src/target/firmware/fb/fb_st7558.c b/src/target/firmware/fb/fb_st7558.c
new file mode 100644
index 00000000..fdcd38fb
--- /dev/null
+++ b/src/target/firmware/fb/fb_st7558.c
@@ -0,0 +1,132 @@
+/* Framebuffer implementation - ST1783 LCD driver for C123 */
+/* Based on st7558.c by Harald Welte */
+
+/* (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <fb/framebuffer.h>
+#include <fb/fb_bw8.h>
+
+#include <i2c.h>
+#include <calypso/clock.h>
+#include <delay.h>
+
+#include <stdio.h>
+
+/* Sitronix ST7558 LCD Driver for OSMOCOM framebuffer interface. */
+/* (c) 2010 Christian Vogel <vogelchr@vogel.cx> */
+/* Based on the initial LCD driver by Harald Welte */
+
+#define CONTROL_RS_CMD
+
+#define ST7558_SLAVE_ADDR	0x3c
+#define ST7558_CMD_ADDR		0x00
+#define ST7558_RAM_ADDR		0x40
+
+#define ST7558_WIDTH		96	/* in pixels */
+#define ST7558_HEIGHT		65
+
+#define I2C_MAX_TRANSFER 16
+
+static uint8_t
+fb_st7558_mem[ST7558_WIDTH * ((ST7558_HEIGHT+7)/8)];
+
+/* setup as initially proposed by Harald in st7558.c */
+static const uint8_t st7558_setup[] = {
+	0x2e,	/* ext. display control, set mirror X, set mirror Y*/
+	0x21,	/* function set, enable extended instruction mode */
+	0x12,	/* bias system BS[2,1,0] = [0,1,0] */
+	0xc0,	/* set V_OP (V_OP6 = 1, V_OP[5:0] = 0) */
+	0x0b,	/* booster stages PC1=1, PC0=1 */
+	0x20,	/* function set, disable extended instruction mode */
+	0x11,	/* V_LCD L/H select, PRS=1 */
+	0x00,	/* NOP */
+	0x0c,	/* normal video mode */
+	0x40,	/* set X address to 0 */
+	0x80	/* set Y address to 0 */
+};
+
+
+static void
+fb_st7558_init(){
+	calypso_reset_set(RESET_EXT, 0);
+	i2c_init(0,0);
+
+	/* initialize controller */
+	i2c_write(ST7558_SLAVE_ADDR,ST7558_CMD_ADDR,1,
+		  st7558_setup,sizeof(st7558_setup));
+}
+
+static void
+fb_st7558_flush(){
+	uint16_t x;
+	int page,chunksize,nbytes;
+	uint8_t *p;
+	uint8_t cmd[2];
+
+	if(fb_bw8->damage_y1 == fb_bw8->damage_y2 ||
+		fb_bw8->damage_x1 == fb_bw8->damage_x2)
+			return; /* nothing to update */
+
+	/* update display in stripes of 8 rows, called "pages" */
+	for(page=fb_bw8->damage_y1 >> 3;page <= fb_bw8->damage_y2>>3;page++){
+		/* base offset in RAM framebuffer */
+		x = fb_bw8->damage_x1;
+		nbytes = fb_bw8->damage_x2 - fb_bw8->damage_x1;
+		p = fb_bw8->mem + (page * framebuffer->width + x);
+
+		/* i2c fifo can only handle a maximum of 16 bytes */
+		while(nbytes){
+			cmd[0]=0x40 | page; /* Set Y address of RAM. */
+			cmd[1]=0x80 | x;
+			chunksize = nbytes > I2C_MAX_TRANSFER ? I2C_MAX_TRANSFER : nbytes;
+
+			i2c_write(ST7558_SLAVE_ADDR,ST7558_CMD_ADDR,1,cmd,sizeof(cmd));
+			i2c_write(ST7558_SLAVE_ADDR,ST7558_RAM_ADDR,1,p,chunksize);
+
+			nbytes -= chunksize;
+			p+=I2C_MAX_TRANSFER;
+			x+=I2C_MAX_TRANSFER;
+		}
+	}
+
+	/* mark current buffer as unmodified! */
+	fb_bw8->damage_x1 = fb_bw8->damage_x2 = 0;
+	fb_bw8->damage_y1 = fb_bw8->damage_y2 = 0;
+}
+
+static struct framebuffer fb_st7558_framebuffer = {
+	.name = "st7558",
+	.init = fb_st7558_init,
+	.clear = fb_bw8_clear,
+	.boxto = fb_bw8_boxto,
+	.lineto = fb_bw8_lineto,
+	.putstr = fb_bw8_putstr,
+	.flush = fb_st7558_flush,
+	.width = ST7558_WIDTH,
+	.height = ST7558_HEIGHT
+};
+
+static struct fb_bw8 fb_st7558_bw8 = {
+	.mem = fb_st7558_mem
+};
+
+struct framebuffer *framebuffer = &fb_st7558_framebuffer;
+struct fb_bw8 *fb_bw8 = &fb_st7558_bw8;
diff --git a/src/target/firmware/fb/fb_td014.c b/src/target/firmware/fb/fb_td014.c
new file mode 100644
index 00000000..c7bde0ca
--- /dev/null
+++ b/src/target/firmware/fb/fb_td014.c
@@ -0,0 +1,150 @@
+/* Framebuffer implementation - Toppoly TD014 LCD driver for Motorola C139/40 */
+/* Based on td014.c by Steve Markgraf and Harald Welte */
+
+/* (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ * (C) 2012 by Steve Markgraf <steve@steve-m.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <fb/framebuffer.h>
+#include <fb/fb_rgb332.h>
+
+#include <stdint.h>
+#include <stdio.h>
+#include <delay.h>
+#include <uwire.h>
+#include <calypso/clock.h>
+
+#define TD014_WIDTH		96
+#define TD014_HEIGHT		64
+#define TD014_UWIRE_BITLEN	9
+#define TD014_DEV_ID		0
+
+static uint8_t fb_td014_mem[TD014_WIDTH * TD014_HEIGHT];
+
+enum td014_cmdflag { CMD, DATA, END };
+
+struct td014_cmdlist {
+	enum td014_cmdflag is_cmd:8;	/* 1: is a command, 0: is data, 2: end marker! */
+	uint8_t data;  			/* 8 bit to send to LC display */
+} __attribute__((packed));
+
+static const struct td014_cmdlist
+td014_initdata[] = {
+	{ CMD,  0x3f },
+	{ DATA, 0x01 },
+	{ CMD,  0x20 },
+	{ DATA, 0x03 },
+	{ CMD,  0x31 },
+	{ DATA, 0x03 },
+	{ END,  0x00 }, /* MARKER: end of list */
+};
+
+static void
+fb_td014_send_cmdlist(const struct td014_cmdlist *p) {
+	int i=0;
+	while(p->is_cmd != END){
+		uint16_t sendcmd = p->data;
+		if(p->is_cmd == DATA)
+			sendcmd |= 0x0100; /* 9th bit is cmd/data flag */
+		uwire_xfer(TD014_DEV_ID, TD014_UWIRE_BITLEN, &sendcmd, NULL);
+		p++;
+		i++;
+	}
+}
+
+static void
+fb_td014_init(void) {
+	printf("%s: initializing LCD.\n",__FUNCTION__);
+	calypso_reset_set(RESET_EXT, 0);
+	delay_ms(5);
+	uwire_init();
+	delay_ms(5);
+
+	fb_td014_send_cmdlist(td014_initdata);
+}
+
+static void
+fb_td014_flush(void) {
+	int x,y;
+	uint8_t *p;
+	struct td014_cmdlist prepare_disp_write_cmds[] = {
+		{ CMD,  0x10 },
+		{ DATA, fb_rgb332->damage_x1 },
+		{ CMD,  0x11 },
+		{ DATA, fb_rgb332->damage_y1 },
+		{ CMD,  0x12 },
+		{ DATA, fb_rgb332->damage_x2-1 },
+		{ CMD,  0x13 },
+		{ DATA, fb_rgb332->damage_y2-1 },
+		{ CMD,  0x14 },
+		{ DATA, fb_rgb332->damage_x1 },
+		{ CMD,  0x15 },
+		{ DATA, fb_rgb332->damage_y1 },
+		{ END,  0x00 }
+	};
+
+	/* If everything's clean, just return */
+	if(fb_rgb332->damage_x1 == fb_rgb332->damage_x2 ||
+		fb_rgb332->damage_y1 == fb_rgb332->damage_y2) {
+			printf("%s: no damage\n",__FUNCTION__);
+			return;
+	}
+
+	fb_td014_send_cmdlist(prepare_disp_write_cmds);
+
+	for(y=fb_rgb332->damage_y1;y<fb_rgb332->damage_y2;y++) {
+		p = & fb_rgb332->mem[y * framebuffer->width]; // start of line
+		p += fb_rgb332->damage_x1; // start of damage area
+
+		for(x=fb_rgb332->damage_x1; x<fb_rgb332->damage_x2; x++) {
+			uint16_t pixel = rgb332_to_565(*p++);
+			uint16_t data = 0x0100 | (pixel >> 8);
+
+			uwire_xfer(TD014_DEV_ID, TD014_UWIRE_BITLEN,
+					&data, NULL);
+
+			data = 0x0100 | (pixel & 0xff);
+			uwire_xfer(TD014_DEV_ID, TD014_UWIRE_BITLEN,
+				&data, NULL);
+		}
+	}
+
+	fb_rgb332->damage_x1 = fb_rgb332->damage_x2 = 0;
+	fb_rgb332->damage_y1 = fb_rgb332->damage_y2 = 0;
+}
+
+static struct framebuffer fb_td014_framebuffer = {
+	.name = "td014",
+	.init = fb_td014_init,
+	.clear = fb_rgb332_clear,
+	.boxto = fb_rgb332_boxto,
+	.lineto = fb_rgb332_lineto,
+	.putstr = fb_rgb332_putstr,
+	.flush = fb_td014_flush,
+	.width = TD014_WIDTH,
+	.height = TD014_HEIGHT
+};
+
+static struct fb_rgb332 fb_td014_rgb332 = {
+	.mem = fb_td014_mem
+};
+
+struct framebuffer *framebuffer = &fb_td014_framebuffer;
+struct fb_rgb332 *fb_rgb332 = &fb_td014_rgb332;
diff --git a/src/target/firmware/fb/font.c b/src/target/firmware/fb/font.c
new file mode 100644
index 00000000..18c1bfe9
--- /dev/null
+++ b/src/target/firmware/fb/font.c
@@ -0,0 +1,59 @@
+/* Font Handling - Utility Functions */
+
+/* (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <fb/font.h>
+
+/* what fonts are linked in? */
+extern const struct fb_font font_4x6;
+extern const struct fb_font font_5x8;
+extern const struct fb_font font_helvR08;
+extern const struct fb_font font_helvR14;
+//extern const struct fb_font font_helvR24;
+//extern const struct fb_font font_helvB08;
+extern const struct fb_font font_helvB14;
+// extern const struct fb_font font_helvB24;
+extern const struct fb_font font_c64;
+extern const struct fb_font font_symbols;
+
+const struct fb_font *fb_fonts[]={
+//	&font_4x6,
+//	&font_5x8,
+	&font_helvR08,
+//	&font_helvR14,
+//	&font_helvR24,
+//	&font_helvB08,
+	&font_helvB14,
+//	&font_helvB24,
+	&font_c64,
+	&font_symbols,
+};
+
+const struct fb_char *
+fb_font_get_char(const struct fb_font *fnt,unsigned char c){
+	if(c < fnt->firstchar || c > fnt->lastchar)
+		return NULL;
+	uint16_t offs = fnt->charoffs[c-fnt->firstchar];
+	if(offs == FB_FONT_NOCHAR)
+		return NULL;
+	return (struct fb_char *)(fnt->chardata + offs);
+}
+
diff --git a/src/target/firmware/fb/framebuffer.c b/src/target/firmware/fb/framebuffer.c
new file mode 100644
index 00000000..ab547694
--- /dev/null
+++ b/src/target/firmware/fb/framebuffer.c
@@ -0,0 +1,28 @@
+/* Framebuffer - Utility Functions */
+
+/* (C) 2010 by Christian Vogel <vogelchr@vogel.cx>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <fb/framebuffer.h>
+
+/* currently everything's inline in framebuffer .h */
+
+
+
diff --git a/src/target/firmware/fb/helvB08.c b/src/target/firmware/fb/helvB08.c
new file mode 100644
index 00000000..97dd92ca
--- /dev/null
+++ b/src/target/firmware/fb/helvB08.c
@@ -0,0 +1,833 @@
+#include <fb/font.h>
+static const uint8_t font_helvB08_data[] = {
+/* --- new character space (32) starting at offset 0x0000 --- */
+	/*0000:*/	2, 1, 1, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0005:*/	0x00,  /* ........ */
+/* --- new character exclam (33) starting at offset 0x0006 --- */
+	/*0006:*/	3, 2, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*000b:*/	0xc0,  /* ##...... */
+	/*000c:*/	0xc0,  /* ##...... */
+	/*000d:*/	0xc0,  /* ##...... */
+	/*000e:*/	0x80,  /* #....... */
+	/*000f:*/	0x00,  /* ........ */
+	/*0010:*/	0x80,  /* #....... */
+	/*0011:*/	0x80,  /* #....... */
+/* --- new character quotedbl (34) starting at offset 0x0012 --- */
+	/*0012:*/	4, 3, 2, 0, 4, /* width and bbox (w,h,x,y) */ 
+	/*0017:*/	0xa0,  /* #.#..... */
+	/*0018:*/	0xa0,  /* #.#..... */
+/* --- new character numbersign (35) starting at offset 0x0019 --- */
+	/*0019:*/	5, 5, 6, -1, 0, /* width and bbox (w,h,x,y) */ 
+	/*001e:*/	0x50,  /* .#.#.... */
+	/*001f:*/	0xf8,  /* #####... */
+	/*0020:*/	0x50,  /* .#.#.... */
+	/*0021:*/	0xf8,  /* #####... */
+	/*0022:*/	0xa0,  /* #.#..... */
+	/*0023:*/	0xa0,  /* #.#..... */
+/* --- new character dollar (36) starting at offset 0x0024 --- */
+	/*0024:*/	5, 4, 8, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0029:*/	0x20,  /* ..#..... */
+	/*002a:*/	0x70,  /* .###.... */
+	/*002b:*/	0xc0,  /* ##...... */
+	/*002c:*/	0xe0,  /* ###..... */
+	/*002d:*/	0x70,  /* .###.... */
+	/*002e:*/	0x30,  /* ..##.... */
+	/*002f:*/	0xe0,  /* ###..... */
+	/*0030:*/	0x40,  /* .#...... */
+/* --- new character percent (37) starting at offset 0x0031 --- */
+	/*0031:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0036:*/	0x68,  /* .##.#... */
+	/*0037:*/	0xb0,  /* #.##.... */
+	/*0038:*/	0xe0,  /* ###..... */
+	/*0039:*/	0x38,  /* ..###... */
+	/*003a:*/	0x68,  /* .##.#... */
+	/*003b:*/	0xb0,  /* #.##.... */
+/* --- new character ampersand (38) starting at offset 0x003c --- */
+	/*003c:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0041:*/	0x70,  /* .###.... */
+	/*0042:*/	0x50,  /* .#.#.... */
+	/*0043:*/	0x60,  /* .##..... */
+	/*0044:*/	0xf8,  /* #####... */
+	/*0045:*/	0xd0,  /* ##.#.... */
+	/*0046:*/	0x68,  /* .##.#... */
+/* --- new character quotesingle (39) starting at offset 0x0047 --- */
+	/*0047:*/	3, 1, 3, 1, 5, /* width and bbox (w,h,x,y) */ 
+	/*004c:*/	0x80,  /* #....... */
+	/*004d:*/	0x80,  /* #....... */
+	/*004e:*/	0x80,  /* #....... */
+/* --- new character parenleft (40) starting at offset 0x004f --- */
+	/*004f:*/	3, 2, 8, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*0054:*/	0x40,  /* .#...... */
+	/*0055:*/	0x40,  /* .#...... */
+	/*0056:*/	0x80,  /* #....... */
+	/*0057:*/	0x80,  /* #....... */
+	/*0058:*/	0x80,  /* #....... */
+	/*0059:*/	0x80,  /* #....... */
+	/*005a:*/	0x40,  /* .#...... */
+	/*005b:*/	0x40,  /* .#...... */
+/* --- new character parenright (41) starting at offset 0x005c --- */
+	/*005c:*/	3, 2, 8, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*0061:*/	0x80,  /* #....... */
+	/*0062:*/	0x80,  /* #....... */
+	/*0063:*/	0x40,  /* .#...... */
+	/*0064:*/	0x40,  /* .#...... */
+	/*0065:*/	0x40,  /* .#...... */
+	/*0066:*/	0x40,  /* .#...... */
+	/*0067:*/	0x80,  /* #....... */
+	/*0068:*/	0x80,  /* #....... */
+/* --- new character asterisk (42) starting at offset 0x0069 --- */
+	/*0069:*/	3, 3, 3, 0, 3, /* width and bbox (w,h,x,y) */ 
+	/*006e:*/	0x40,  /* .#...... */
+	/*006f:*/	0xe0,  /* ###..... */
+	/*0070:*/	0x40,  /* .#...... */
+/* --- new character plus (43) starting at offset 0x0071 --- */
+	/*0071:*/	5, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0076:*/	0x20,  /* ..#..... */
+	/*0077:*/	0x20,  /* ..#..... */
+	/*0078:*/	0xf0,  /* ####.... */
+	/*0079:*/	0x20,  /* ..#..... */
+	/*007a:*/	0x20,  /* ..#..... */
+/* --- new character comma (44) starting at offset 0x007b --- */
+	/*007b:*/	2, 2, 3, -1, -1, /* width and bbox (w,h,x,y) */ 
+	/*0080:*/	0x40,  /* .#...... */
+	/*0081:*/	0x40,  /* .#...... */
+	/*0082:*/	0x80,  /* #....... */
+/* --- new character hyphen (45) starting at offset 0x0083 --- */
+	/*0083:*/	4, 3, 1, 0, 2, /* width and bbox (w,h,x,y) */ 
+	/*0088:*/	0xe0,  /* ###..... */
+/* --- new character period (46) starting at offset 0x0089 --- */
+	/*0089:*/	2, 1, 2, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*008e:*/	0x80,  /* #....... */
+	/*008f:*/	0x80,  /* #....... */
+/* --- new character slash (47) starting at offset 0x0090 --- */
+	/*0090:*/	3, 3, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0095:*/	0x20,  /* ..#..... */
+	/*0096:*/	0x20,  /* ..#..... */
+	/*0097:*/	0x40,  /* .#...... */
+	/*0098:*/	0x40,  /* .#...... */
+	/*0099:*/	0x80,  /* #....... */
+	/*009a:*/	0x80,  /* #....... */
+/* --- new character zero (48) starting at offset 0x009b --- */
+	/*009b:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00a0:*/	0x60,  /* .##..... */
+	/*00a1:*/	0xd0,  /* ##.#.... */
+	/*00a2:*/	0xd0,  /* ##.#.... */
+	/*00a3:*/	0xd0,  /* ##.#.... */
+	/*00a4:*/	0xd0,  /* ##.#.... */
+	/*00a5:*/	0x60,  /* .##..... */
+/* --- new character one (49) starting at offset 0x00a6 --- */
+	/*00a6:*/	5, 3, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00ab:*/	0x20,  /* ..#..... */
+	/*00ac:*/	0xe0,  /* ###..... */
+	/*00ad:*/	0x60,  /* .##..... */
+	/*00ae:*/	0x60,  /* .##..... */
+	/*00af:*/	0x60,  /* .##..... */
+	/*00b0:*/	0x60,  /* .##..... */
+/* --- new character two (50) starting at offset 0x00b1 --- */
+	/*00b1:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00b6:*/	0x60,  /* .##..... */
+	/*00b7:*/	0xb0,  /* #.##.... */
+	/*00b8:*/	0x30,  /* ..##.... */
+	/*00b9:*/	0x60,  /* .##..... */
+	/*00ba:*/	0xc0,  /* ##...... */
+	/*00bb:*/	0xf0,  /* ####.... */
+/* --- new character three (51) starting at offset 0x00bc --- */
+	/*00bc:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00c1:*/	0x60,  /* .##..... */
+	/*00c2:*/	0xb0,  /* #.##.... */
+	/*00c3:*/	0x60,  /* .##..... */
+	/*00c4:*/	0x30,  /* ..##.... */
+	/*00c5:*/	0xb0,  /* #.##.... */
+	/*00c6:*/	0x60,  /* .##..... */
+/* --- new character four (52) starting at offset 0x00c7 --- */
+	/*00c7:*/	5, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00cc:*/	0x30,  /* ..##.... */
+	/*00cd:*/	0x50,  /* .#.#.... */
+	/*00ce:*/	0xd0,  /* ##.#.... */
+	/*00cf:*/	0xf8,  /* #####... */
+	/*00d0:*/	0x30,  /* ..##.... */
+	/*00d1:*/	0x30,  /* ..##.... */
+/* --- new character five (53) starting at offset 0x00d2 --- */
+	/*00d2:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00d7:*/	0x70,  /* .###.... */
+	/*00d8:*/	0xc0,  /* ##...... */
+	/*00d9:*/	0xe0,  /* ###..... */
+	/*00da:*/	0x30,  /* ..##.... */
+	/*00db:*/	0xb0,  /* #.##.... */
+	/*00dc:*/	0x60,  /* .##..... */
+/* --- new character six (54) starting at offset 0x00dd --- */
+	/*00dd:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00e2:*/	0x70,  /* .###.... */
+	/*00e3:*/	0xc0,  /* ##...... */
+	/*00e4:*/	0xe0,  /* ###..... */
+	/*00e5:*/	0xd0,  /* ##.#.... */
+	/*00e6:*/	0xd0,  /* ##.#.... */
+	/*00e7:*/	0x60,  /* .##..... */
+/* --- new character seven (55) starting at offset 0x00e8 --- */
+	/*00e8:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00ed:*/	0xf0,  /* ####.... */
+	/*00ee:*/	0x30,  /* ..##.... */
+	/*00ef:*/	0x30,  /* ..##.... */
+	/*00f0:*/	0x60,  /* .##..... */
+	/*00f1:*/	0x40,  /* .#...... */
+	/*00f2:*/	0xc0,  /* ##...... */
+/* --- new character eight (56) starting at offset 0x00f3 --- */
+	/*00f3:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00f8:*/	0x60,  /* .##..... */
+	/*00f9:*/	0xd0,  /* ##.#.... */
+	/*00fa:*/	0x60,  /* .##..... */
+	/*00fb:*/	0xd0,  /* ##.#.... */
+	/*00fc:*/	0xd0,  /* ##.#.... */
+	/*00fd:*/	0x60,  /* .##..... */
+/* --- new character nine (57) starting at offset 0x00fe --- */
+	/*00fe:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0103:*/	0x60,  /* .##..... */
+	/*0104:*/	0xb0,  /* #.##.... */
+	/*0105:*/	0xb0,  /* #.##.... */
+	/*0106:*/	0x70,  /* .###.... */
+	/*0107:*/	0x30,  /* ..##.... */
+	/*0108:*/	0xe0,  /* ###..... */
+/* --- new character colon (58) starting at offset 0x0109 --- */
+	/*0109:*/	2, 1, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*010e:*/	0x80,  /* #....... */
+	/*010f:*/	0x80,  /* #....... */
+	/*0110:*/	0x00,  /* ........ */
+	/*0111:*/	0x80,  /* #....... */
+	/*0112:*/	0x80,  /* #....... */
+/* --- new character semicolon (59) starting at offset 0x0113 --- */
+	/*0113:*/	2, 2, 6, -1, -1, /* width and bbox (w,h,x,y) */ 
+	/*0118:*/	0x40,  /* .#...... */
+	/*0119:*/	0x40,  /* .#...... */
+	/*011a:*/	0x00,  /* ........ */
+	/*011b:*/	0x40,  /* .#...... */
+	/*011c:*/	0x40,  /* .#...... */
+	/*011d:*/	0x80,  /* #....... */
+/* --- new character less (60) starting at offset 0x011e --- */
+	/*011e:*/	4, 3, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0123:*/	0x20,  /* ..#..... */
+	/*0124:*/	0x40,  /* .#...... */
+	/*0125:*/	0x80,  /* #....... */
+	/*0126:*/	0x40,  /* .#...... */
+	/*0127:*/	0x20,  /* ..#..... */
+/* --- new character equal (61) starting at offset 0x0128 --- */
+	/*0128:*/	5, 4, 3, 0, 1, /* width and bbox (w,h,x,y) */ 
+	/*012d:*/	0xf0,  /* ####.... */
+	/*012e:*/	0x00,  /* ........ */
+	/*012f:*/	0xf0,  /* ####.... */
+/* --- new character greater (62) starting at offset 0x0130 --- */
+	/*0130:*/	4, 3, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0135:*/	0x80,  /* #....... */
+	/*0136:*/	0x40,  /* .#...... */
+	/*0137:*/	0x20,  /* ..#..... */
+	/*0138:*/	0x40,  /* .#...... */
+	/*0139:*/	0x80,  /* #....... */
+/* --- new character question (63) starting at offset 0x013a --- */
+	/*013a:*/	5, 4, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*013f:*/	0xe0,  /* ###..... */
+	/*0140:*/	0x30,  /* ..##.... */
+	/*0141:*/	0x60,  /* .##..... */
+	/*0142:*/	0x40,  /* .#...... */
+	/*0143:*/	0x00,  /* ........ */
+	/*0144:*/	0x40,  /* .#...... */
+	/*0145:*/	0x40,  /* .#...... */
+/* --- new character at (64) starting at offset 0x0146 --- */
+	/*0146:*/	9, 8, 7, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*014b:*/	0x7e,  /* .######. */
+	/*014c:*/	0xc3,  /* ##....## */
+	/*014d:*/	0x99,  /* #..##..# */
+	/*014e:*/	0xa9,  /* #.#.#..# */
+	/*014f:*/	0x99,  /* #..##..# */
+	/*0150:*/	0xce,  /* ##..###. */
+	/*0151:*/	0x60,  /* .##..... */
+/* --- new character A (65) starting at offset 0x0152 --- */
+	/*0152:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0157:*/	0x70,  /* .###.... */
+	/*0158:*/	0xd8,  /* ##.##... */
+	/*0159:*/	0xd8,  /* ##.##... */
+	/*015a:*/	0xf8,  /* #####... */
+	/*015b:*/	0xd8,  /* ##.##... */
+	/*015c:*/	0xd8,  /* ##.##... */
+/* --- new character B (66) starting at offset 0x015d --- */
+	/*015d:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0162:*/	0xf0,  /* ####.... */
+	/*0163:*/	0xd8,  /* ##.##... */
+	/*0164:*/	0xf0,  /* ####.... */
+	/*0165:*/	0xd8,  /* ##.##... */
+	/*0166:*/	0xd8,  /* ##.##... */
+	/*0167:*/	0xf0,  /* ####.... */
+/* --- new character C (67) starting at offset 0x0168 --- */
+	/*0168:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*016d:*/	0x78,  /* .####... */
+	/*016e:*/	0xc8,  /* ##..#... */
+	/*016f:*/	0xc0,  /* ##...... */
+	/*0170:*/	0xc0,  /* ##...... */
+	/*0171:*/	0xc8,  /* ##..#... */
+	/*0172:*/	0x78,  /* .####... */
+/* --- new character D (68) starting at offset 0x0173 --- */
+	/*0173:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0178:*/	0xf0,  /* ####.... */
+	/*0179:*/	0xd8,  /* ##.##... */
+	/*017a:*/	0xd8,  /* ##.##... */
+	/*017b:*/	0xd8,  /* ##.##... */
+	/*017c:*/	0xd8,  /* ##.##... */
+	/*017d:*/	0xf0,  /* ####.... */
+/* --- new character E (69) starting at offset 0x017e --- */
+	/*017e:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0183:*/	0xf0,  /* ####.... */
+	/*0184:*/	0xc0,  /* ##...... */
+	/*0185:*/	0xf0,  /* ####.... */
+	/*0186:*/	0xc0,  /* ##...... */
+	/*0187:*/	0xc0,  /* ##...... */
+	/*0188:*/	0xf0,  /* ####.... */
+/* --- new character F (70) starting at offset 0x0189 --- */
+	/*0189:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*018e:*/	0xf0,  /* ####.... */
+	/*018f:*/	0xc0,  /* ##...... */
+	/*0190:*/	0xf0,  /* ####.... */
+	/*0191:*/	0xc0,  /* ##...... */
+	/*0192:*/	0xc0,  /* ##...... */
+	/*0193:*/	0xc0,  /* ##...... */
+/* --- new character G (71) starting at offset 0x0194 --- */
+	/*0194:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0199:*/	0x78,  /* .####... */
+	/*019a:*/	0xc8,  /* ##..#... */
+	/*019b:*/	0xc0,  /* ##...... */
+	/*019c:*/	0xd8,  /* ##.##... */
+	/*019d:*/	0xc8,  /* ##..#... */
+	/*019e:*/	0x78,  /* .####... */
+/* --- new character H (72) starting at offset 0x019f --- */
+	/*019f:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01a4:*/	0xd8,  /* ##.##... */
+	/*01a5:*/	0xd8,  /* ##.##... */
+	/*01a6:*/	0xf8,  /* #####... */
+	/*01a7:*/	0xd8,  /* ##.##... */
+	/*01a8:*/	0xd8,  /* ##.##... */
+	/*01a9:*/	0xd8,  /* ##.##... */
+/* --- new character I (73) starting at offset 0x01aa --- */
+	/*01aa:*/	2, 1, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01af:*/	0x80,  /* #....... */
+	/*01b0:*/	0x80,  /* #....... */
+	/*01b1:*/	0x80,  /* #....... */
+	/*01b2:*/	0x80,  /* #....... */
+	/*01b3:*/	0x80,  /* #....... */
+	/*01b4:*/	0x80,  /* #....... */
+/* --- new character J (74) starting at offset 0x01b5 --- */
+	/*01b5:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01ba:*/	0x30,  /* ..##.... */
+	/*01bb:*/	0x30,  /* ..##.... */
+	/*01bc:*/	0x30,  /* ..##.... */
+	/*01bd:*/	0x30,  /* ..##.... */
+	/*01be:*/	0xb0,  /* #.##.... */
+	/*01bf:*/	0x60,  /* .##..... */
+/* --- new character K (75) starting at offset 0x01c0 --- */
+	/*01c0:*/	6, 6, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01c5:*/	0xd8,  /* ##.##... */
+	/*01c6:*/	0xd0,  /* ##.#.... */
+	/*01c7:*/	0xe0,  /* ###..... */
+	/*01c8:*/	0xf0,  /* ####.... */
+	/*01c9:*/	0xd8,  /* ##.##... */
+	/*01ca:*/	0xcc,  /* ##..##.. */
+/* --- new character L (76) starting at offset 0x01cb --- */
+	/*01cb:*/	5, 4, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01d0:*/	0xc0,  /* ##...... */
+	/*01d1:*/	0xc0,  /* ##...... */
+	/*01d2:*/	0xc0,  /* ##...... */
+	/*01d3:*/	0xc0,  /* ##...... */
+	/*01d4:*/	0xc0,  /* ##...... */
+	/*01d5:*/	0xf0,  /* ####.... */
+/* --- new character M (77) starting at offset 0x01d6 --- */
+	/*01d6:*/	8, 7, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01db:*/	0xc6,  /* ##...##. */
+	/*01dc:*/	0xc6,  /* ##...##. */
+	/*01dd:*/	0xee,  /* ###.###. */
+	/*01de:*/	0xfe,  /* #######. */
+	/*01df:*/	0xd6,  /* ##.#.##. */
+	/*01e0:*/	0xd6,  /* ##.#.##. */
+/* --- new character N (78) starting at offset 0x01e1 --- */
+	/*01e1:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01e6:*/	0xc8,  /* ##..#... */
+	/*01e7:*/	0xc8,  /* ##..#... */
+	/*01e8:*/	0xe8,  /* ###.#... */
+	/*01e9:*/	0xf8,  /* #####... */
+	/*01ea:*/	0xd8,  /* ##.##... */
+	/*01eb:*/	0xc8,  /* ##..#... */
+/* --- new character O (79) starting at offset 0x01ec --- */
+	/*01ec:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01f1:*/	0x70,  /* .###.... */
+	/*01f2:*/	0xd8,  /* ##.##... */
+	/*01f3:*/	0xc8,  /* ##..#... */
+	/*01f4:*/	0xc8,  /* ##..#... */
+	/*01f5:*/	0xd8,  /* ##.##... */
+	/*01f6:*/	0x70,  /* .###.... */
+/* --- new character P (80) starting at offset 0x01f7 --- */
+	/*01f7:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01fc:*/	0xf0,  /* ####.... */
+	/*01fd:*/	0xd8,  /* ##.##... */
+	/*01fe:*/	0xd8,  /* ##.##... */
+	/*01ff:*/	0xf0,  /* ####.... */
+	/*0200:*/	0xc0,  /* ##...... */
+	/*0201:*/	0xc0,  /* ##...... */
+/* --- new character Q (81) starting at offset 0x0202 --- */
+	/*0202:*/	6, 6, 7, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0207:*/	0x70,  /* .###.... */
+	/*0208:*/	0xd8,  /* ##.##... */
+	/*0209:*/	0xc8,  /* ##..#... */
+	/*020a:*/	0xc8,  /* ##..#... */
+	/*020b:*/	0xd8,  /* ##.##... */
+	/*020c:*/	0x78,  /* .####... */
+	/*020d:*/	0x04,  /* .....#.. */
+/* --- new character R (82) starting at offset 0x020e --- */
+	/*020e:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0213:*/	0xf0,  /* ####.... */
+	/*0214:*/	0xd8,  /* ##.##... */
+	/*0215:*/	0xd8,  /* ##.##... */
+	/*0216:*/	0xf0,  /* ####.... */
+	/*0217:*/	0xd8,  /* ##.##... */
+	/*0218:*/	0xd8,  /* ##.##... */
+/* --- new character S (83) starting at offset 0x0219 --- */
+	/*0219:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*021e:*/	0x78,  /* .####... */
+	/*021f:*/	0xc0,  /* ##...... */
+	/*0220:*/	0xf0,  /* ####.... */
+	/*0221:*/	0x38,  /* ..###... */
+	/*0222:*/	0xd8,  /* ##.##... */
+	/*0223:*/	0x70,  /* .###.... */
+/* --- new character T (84) starting at offset 0x0224 --- */
+	/*0224:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0229:*/	0xf8,  /* #####... */
+	/*022a:*/	0x60,  /* .##..... */
+	/*022b:*/	0x60,  /* .##..... */
+	/*022c:*/	0x60,  /* .##..... */
+	/*022d:*/	0x60,  /* .##..... */
+	/*022e:*/	0x60,  /* .##..... */
+/* --- new character U (85) starting at offset 0x022f --- */
+	/*022f:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0234:*/	0xd8,  /* ##.##... */
+	/*0235:*/	0xd8,  /* ##.##... */
+	/*0236:*/	0xd8,  /* ##.##... */
+	/*0237:*/	0xd8,  /* ##.##... */
+	/*0238:*/	0xd8,  /* ##.##... */
+	/*0239:*/	0x70,  /* .###.... */
+/* --- new character V (86) starting at offset 0x023a --- */
+	/*023a:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*023f:*/	0xe8,  /* ###.#... */
+	/*0240:*/	0x68,  /* .##.#... */
+	/*0241:*/	0x68,  /* .##.#... */
+	/*0242:*/	0x68,  /* .##.#... */
+	/*0243:*/	0x70,  /* .###.... */
+	/*0244:*/	0x20,  /* ..#..... */
+/* --- new character W (87) starting at offset 0x0245 --- */
+	/*0245:*/	9, 8, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*024a:*/	0xdb,  /* ##.##.## */
+	/*024b:*/	0xdb,  /* ##.##.## */
+	/*024c:*/	0xda,  /* ##.##.#. */
+	/*024d:*/	0xda,  /* ##.##.#. */
+	/*024e:*/	0x6c,  /* .##.##.. */
+	/*024f:*/	0x6c,  /* .##.##.. */
+/* --- new character X (88) starting at offset 0x0250 --- */
+	/*0250:*/	6, 5, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0255:*/	0xd8,  /* ##.##... */
+	/*0256:*/	0xd8,  /* ##.##... */
+	/*0257:*/	0x70,  /* .###.... */
+	/*0258:*/	0x70,  /* .###.... */
+	/*0259:*/	0xd8,  /* ##.##... */
+	/*025a:*/	0xd8,  /* ##.##... */
+/* --- new character Y (89) starting at offset 0x025b --- */
+	/*025b:*/	7, 6, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0260:*/	0xec,  /* ###.##.. */
+	/*0261:*/	0x68,  /* .##.#... */
+	/*0262:*/	0x68,  /* .##.#... */
+	/*0263:*/	0x78,  /* .####... */
+	/*0264:*/	0x30,  /* ..##.... */
+	/*0265:*/	0x30,  /* ..##.... */
+/* --- new character Z (90) starting at offset 0x0266 --- */
+	/*0266:*/	6, 6, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*026b:*/	0xfc,  /* ######.. */
+	/*026c:*/	0x38,  /* ..###... */
+	/*026d:*/	0x30,  /* ..##.... */
+	/*026e:*/	0x60,  /* .##..... */
+	/*026f:*/	0xe0,  /* ###..... */
+	/*0270:*/	0xf8,  /* #####... */
+/* --- new character bracketleft (91) starting at offset 0x0271 --- */
+	/*0271:*/	3, 2, 8, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*0276:*/	0xc0,  /* ##...... */
+	/*0277:*/	0x80,  /* #....... */
+	/*0278:*/	0x80,  /* #....... */
+	/*0279:*/	0x80,  /* #....... */
+	/*027a:*/	0x80,  /* #....... */
+	/*027b:*/	0x80,  /* #....... */
+	/*027c:*/	0x80,  /* #....... */
+	/*027d:*/	0xc0,  /* ##...... */
+/* --- new character backslash (92) starting at offset 0x027e --- */
+	/*027e:*/	3, 3, 6, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0283:*/	0x80,  /* #....... */
+	/*0284:*/	0x80,  /* #....... */
+	/*0285:*/	0x40,  /* .#...... */
+	/*0286:*/	0x40,  /* .#...... */
+	/*0287:*/	0x20,  /* ..#..... */
+	/*0288:*/	0x20,  /* ..#..... */
+/* --- new character bracketright (93) starting at offset 0x0289 --- */
+	/*0289:*/	3, 2, 8, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*028e:*/	0xc0,  /* ##...... */
+	/*028f:*/	0x40,  /* .#...... */
+	/*0290:*/	0x40,  /* .#...... */
+	/*0291:*/	0x40,  /* .#...... */
+	/*0292:*/	0x40,  /* .#...... */
+	/*0293:*/	0x40,  /* .#...... */
+	/*0294:*/	0x40,  /* .#...... */
+	/*0295:*/	0xc0,  /* ##...... */
+/* --- new character asciicircum (94) starting at offset 0x0296 --- */
+	/*0296:*/	4, 4, 3, 0, 3, /* width and bbox (w,h,x,y) */ 
+	/*029b:*/	0x60,  /* .##..... */
+	/*029c:*/	0x60,  /* .##..... */
+	/*029d:*/	0x90,  /* #..#.... */
+/* --- new character underscore (95) starting at offset 0x029e --- */
+	/*029e:*/	5, 5, 1, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*02a3:*/	0xf8,  /* #####... */
+/* --- new character grave (96) starting at offset 0x02a4 --- */
+	/*02a4:*/	3, 2, 2, 0, 6, /* width and bbox (w,h,x,y) */ 
+	/*02a9:*/	0x80,  /* #....... */
+	/*02aa:*/	0x40,  /* .#...... */
+/* --- new character a (97) starting at offset 0x02ab --- */
+	/*02ab:*/	5, 5, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02b0:*/	0xe0,  /* ###..... */
+	/*02b1:*/	0x30,  /* ..##.... */
+	/*02b2:*/	0xf0,  /* ####.... */
+	/*02b3:*/	0xb0,  /* #.##.... */
+	/*02b4:*/	0xd8,  /* ##.##... */
+/* --- new character b (98) starting at offset 0x02b5 --- */
+	/*02b5:*/	5, 4, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02ba:*/	0xc0,  /* ##...... */
+	/*02bb:*/	0xc0,  /* ##...... */
+	/*02bc:*/	0xe0,  /* ###..... */
+	/*02bd:*/	0xd0,  /* ##.#.... */
+	/*02be:*/	0xd0,  /* ##.#.... */
+	/*02bf:*/	0xd0,  /* ##.#.... */
+	/*02c0:*/	0xe0,  /* ###..... */
+/* --- new character c (99) starting at offset 0x02c1 --- */
+	/*02c1:*/	4, 3, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02c6:*/	0x60,  /* .##..... */
+	/*02c7:*/	0xc0,  /* ##...... */
+	/*02c8:*/	0xc0,  /* ##...... */
+	/*02c9:*/	0xc0,  /* ##...... */
+	/*02ca:*/	0x60,  /* .##..... */
+/* --- new character d (100) starting at offset 0x02cb --- */
+	/*02cb:*/	5, 4, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02d0:*/	0x30,  /* ..##.... */
+	/*02d1:*/	0x30,  /* ..##.... */
+	/*02d2:*/	0x70,  /* .###.... */
+	/*02d3:*/	0xb0,  /* #.##.... */
+	/*02d4:*/	0xb0,  /* #.##.... */
+	/*02d5:*/	0xb0,  /* #.##.... */
+	/*02d6:*/	0x70,  /* .###.... */
+/* --- new character e (101) starting at offset 0x02d7 --- */
+	/*02d7:*/	5, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02dc:*/	0x60,  /* .##..... */
+	/*02dd:*/	0xd0,  /* ##.#.... */
+	/*02de:*/	0xf0,  /* ####.... */
+	/*02df:*/	0xc0,  /* ##...... */
+	/*02e0:*/	0x60,  /* .##..... */
+/* --- new character f (102) starting at offset 0x02e1 --- */
+	/*02e1:*/	3, 4, 7, -1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02e6:*/	0x30,  /* ..##.... */
+	/*02e7:*/	0x60,  /* .##..... */
+	/*02e8:*/	0xf0,  /* ####.... */
+	/*02e9:*/	0x60,  /* .##..... */
+	/*02ea:*/	0x60,  /* .##..... */
+	/*02eb:*/	0x60,  /* .##..... */
+	/*02ec:*/	0x60,  /* .##..... */
+/* --- new character g (103) starting at offset 0x02ed --- */
+	/*02ed:*/	5, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*02f2:*/	0xd0,  /* ##.#.... */
+	/*02f3:*/	0xb0,  /* #.##.... */
+	/*02f4:*/	0xb0,  /* #.##.... */
+	/*02f5:*/	0xf0,  /* ####.... */
+	/*02f6:*/	0x30,  /* ..##.... */
+	/*02f7:*/	0xe0,  /* ###..... */
+/* --- new character h (104) starting at offset 0x02f8 --- */
+	/*02f8:*/	5, 4, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02fd:*/	0xc0,  /* ##...... */
+	/*02fe:*/	0xc0,  /* ##...... */
+	/*02ff:*/	0xe0,  /* ###..... */
+	/*0300:*/	0xd0,  /* ##.#.... */
+	/*0301:*/	0xd0,  /* ##.#.... */
+	/*0302:*/	0xd0,  /* ##.#.... */
+	/*0303:*/	0xd0,  /* ##.#.... */
+/* --- new character i (105) starting at offset 0x0304 --- */
+	/*0304:*/	2, 1, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0309:*/	0x80,  /* #....... */
+	/*030a:*/	0x00,  /* ........ */
+	/*030b:*/	0x80,  /* #....... */
+	/*030c:*/	0x80,  /* #....... */
+	/*030d:*/	0x80,  /* #....... */
+	/*030e:*/	0x80,  /* #....... */
+	/*030f:*/	0x80,  /* #....... */
+/* --- new character j (106) starting at offset 0x0310 --- */
+	/*0310:*/	2, 2, 8, -1, -1, /* width and bbox (w,h,x,y) */ 
+	/*0315:*/	0x40,  /* .#...... */
+	/*0316:*/	0x00,  /* ........ */
+	/*0317:*/	0x40,  /* .#...... */
+	/*0318:*/	0x40,  /* .#...... */
+	/*0319:*/	0x40,  /* .#...... */
+	/*031a:*/	0x40,  /* .#...... */
+	/*031b:*/	0x40,  /* .#...... */
+	/*031c:*/	0x80,  /* #....... */
+/* --- new character k (107) starting at offset 0x031d --- */
+	/*031d:*/	5, 4, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0322:*/	0xc0,  /* ##...... */
+	/*0323:*/	0xc0,  /* ##...... */
+	/*0324:*/	0xd0,  /* ##.#.... */
+	/*0325:*/	0xd0,  /* ##.#.... */
+	/*0326:*/	0xe0,  /* ###..... */
+	/*0327:*/	0xd0,  /* ##.#.... */
+	/*0328:*/	0xd0,  /* ##.#.... */
+/* --- new character l (108) starting at offset 0x0329 --- */
+	/*0329:*/	2, 1, 7, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*032e:*/	0x80,  /* #....... */
+	/*032f:*/	0x80,  /* #....... */
+	/*0330:*/	0x80,  /* #....... */
+	/*0331:*/	0x80,  /* #....... */
+	/*0332:*/	0x80,  /* #....... */
+	/*0333:*/	0x80,  /* #....... */
+	/*0334:*/	0x80,  /* #....... */
+/* --- new character m (109) starting at offset 0x0335 --- */
+	/*0335:*/	7, 6, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*033a:*/	0xe8,  /* ###.#... */
+	/*033b:*/	0xd4,  /* ##.#.#.. */
+	/*033c:*/	0xd4,  /* ##.#.#.. */
+	/*033d:*/	0xd4,  /* ##.#.#.. */
+	/*033e:*/	0xd4,  /* ##.#.#.. */
+/* --- new character n (110) starting at offset 0x033f --- */
+	/*033f:*/	5, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0344:*/	0xe0,  /* ###..... */
+	/*0345:*/	0xd0,  /* ##.#.... */
+	/*0346:*/	0xd0,  /* ##.#.... */
+	/*0347:*/	0xd0,  /* ##.#.... */
+	/*0348:*/	0xd0,  /* ##.#.... */
+/* --- new character o (111) starting at offset 0x0349 --- */
+	/*0349:*/	5, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*034e:*/	0x60,  /* .##..... */
+	/*034f:*/	0xd0,  /* ##.#.... */
+	/*0350:*/	0xd0,  /* ##.#.... */
+	/*0351:*/	0xd0,  /* ##.#.... */
+	/*0352:*/	0x60,  /* .##..... */
+/* --- new character p (112) starting at offset 0x0353 --- */
+	/*0353:*/	5, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0358:*/	0xe0,  /* ###..... */
+	/*0359:*/	0xd0,  /* ##.#.... */
+	/*035a:*/	0xd0,  /* ##.#.... */
+	/*035b:*/	0xd0,  /* ##.#.... */
+	/*035c:*/	0xe0,  /* ###..... */
+	/*035d:*/	0xc0,  /* ##...... */
+/* --- new character q (113) starting at offset 0x035e --- */
+	/*035e:*/	5, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0363:*/	0x70,  /* .###.... */
+	/*0364:*/	0xb0,  /* #.##.... */
+	/*0365:*/	0xb0,  /* #.##.... */
+	/*0366:*/	0xb0,  /* #.##.... */
+	/*0367:*/	0x70,  /* .###.... */
+	/*0368:*/	0x30,  /* ..##.... */
+/* --- new character r (114) starting at offset 0x0369 --- */
+	/*0369:*/	3, 3, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*036e:*/	0xa0,  /* #.#..... */
+	/*036f:*/	0xe0,  /* ###..... */
+	/*0370:*/	0xc0,  /* ##...... */
+	/*0371:*/	0xc0,  /* ##...... */
+	/*0372:*/	0xc0,  /* ##...... */
+/* --- new character s (115) starting at offset 0x0373 --- */
+	/*0373:*/	5, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0378:*/	0x70,  /* .###.... */
+	/*0379:*/	0xc0,  /* ##...... */
+	/*037a:*/	0xf0,  /* ####.... */
+	/*037b:*/	0x30,  /* ..##.... */
+	/*037c:*/	0xe0,  /* ###..... */
+/* --- new character t (116) starting at offset 0x037d --- */
+	/*037d:*/	3, 4, 7, -1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0382:*/	0x20,  /* ..#..... */
+	/*0383:*/	0x60,  /* .##..... */
+	/*0384:*/	0xf0,  /* ####.... */
+	/*0385:*/	0x60,  /* .##..... */
+	/*0386:*/	0x60,  /* .##..... */
+	/*0387:*/	0x60,  /* .##..... */
+	/*0388:*/	0x30,  /* ..##.... */
+/* --- new character u (117) starting at offset 0x0389 --- */
+	/*0389:*/	5, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*038e:*/	0xd0,  /* ##.#.... */
+	/*038f:*/	0xd0,  /* ##.#.... */
+	/*0390:*/	0xd0,  /* ##.#.... */
+	/*0391:*/	0xf0,  /* ####.... */
+	/*0392:*/	0x50,  /* .#.#.... */
+/* --- new character v (118) starting at offset 0x0393 --- */
+	/*0393:*/	5, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0398:*/	0xd0,  /* ##.#.... */
+	/*0399:*/	0xd0,  /* ##.#.... */
+	/*039a:*/	0xd0,  /* ##.#.... */
+	/*039b:*/	0x60,  /* .##..... */
+	/*039c:*/	0x40,  /* .#...... */
+/* --- new character w (119) starting at offset 0x039d --- */
+	/*039d:*/	6, 5, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03a2:*/	0xa8,  /* #.#.#... */
+	/*03a3:*/	0xa8,  /* #.#.#... */
+	/*03a4:*/	0xf8,  /* #####... */
+	/*03a5:*/	0xf8,  /* #####... */
+	/*03a6:*/	0x48,  /* .#..#... */
+/* --- new character x (120) starting at offset 0x03a7 --- */
+	/*03a7:*/	6, 5, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03ac:*/	0xd8,  /* ##.##... */
+	/*03ad:*/	0xd8,  /* ##.##... */
+	/*03ae:*/	0x70,  /* .###.... */
+	/*03af:*/	0xd8,  /* ##.##... */
+	/*03b0:*/	0xd8,  /* ##.##... */
+/* --- new character y (121) starting at offset 0x03b1 --- */
+	/*03b1:*/	5, 4, 6, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*03b6:*/	0xd0,  /* ##.#.... */
+	/*03b7:*/	0xd0,  /* ##.#.... */
+	/*03b8:*/	0xd0,  /* ##.#.... */
+	/*03b9:*/	0x70,  /* .###.... */
+	/*03ba:*/	0x60,  /* .##..... */
+	/*03bb:*/	0x60,  /* .##..... */
+/* --- new character z (122) starting at offset 0x03bc --- */
+	/*03bc:*/	5, 4, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03c1:*/	0xf0,  /* ####.... */
+	/*03c2:*/	0x30,  /* ..##.... */
+	/*03c3:*/	0x60,  /* .##..... */
+	/*03c4:*/	0xc0,  /* ##...... */
+	/*03c5:*/	0xf0,  /* ####.... */
+/* --- new character braceleft (123) starting at offset 0x03c6 --- */
+	/*03c6:*/	4, 3, 7, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*03cb:*/	0x20,  /* ..#..... */
+	/*03cc:*/	0x40,  /* .#...... */
+	/*03cd:*/	0x40,  /* .#...... */
+	/*03ce:*/	0x80,  /* #....... */
+	/*03cf:*/	0x40,  /* .#...... */
+	/*03d0:*/	0x40,  /* .#...... */
+	/*03d1:*/	0x20,  /* ..#..... */
+/* --- new character bar (124) starting at offset 0x03d2 --- */
+	/*03d2:*/	2, 1, 7, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*03d7:*/	0x80,  /* #....... */
+	/*03d8:*/	0x80,  /* #....... */
+	/*03d9:*/	0x80,  /* #....... */
+	/*03da:*/	0x80,  /* #....... */
+	/*03db:*/	0x80,  /* #....... */
+	/*03dc:*/	0x80,  /* #....... */
+	/*03dd:*/	0x80,  /* #....... */
+/* --- new character braceright (125) starting at offset 0x03de --- */
+	/*03de:*/	4, 3, 7, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*03e3:*/	0x80,  /* #....... */
+	/*03e4:*/	0x40,  /* .#...... */
+	/*03e5:*/	0x40,  /* .#...... */
+	/*03e6:*/	0x20,  /* ..#..... */
+	/*03e7:*/	0x40,  /* .#...... */
+	/*03e8:*/	0x40,  /* .#...... */
+	/*03e9:*/	0x80,  /* #....... */
+/* --- new character asciitilde (126) starting at offset 0x03ea --- */
+	/*03ea:*/	5, 5, 2, 0, 2, /* width and bbox (w,h,x,y) */ 
+	/*03ef:*/	0x58,  /* .#.##... */
+	/*03f0:*/	0xb0,  /* #.##.... */
+};
+static const uint16_t font_helvB08_offsets[] = {
+0x0000 /* space */,
+	0x0006 /* exclam */,
+	0x0012 /* quotedbl */,
+	0x0019 /* numbersign */,
+	0x0024 /* dollar */,
+	0x0031 /* percent */,
+	0x003c /* ampersand */,
+	0x0047 /* quotesingle */,
+	0x004f /* parenleft */,
+	0x005c /* parenright */,
+	0x0069 /* asterisk */,
+	0x0071 /* plus */,
+	0x007b /* comma */,
+	0x0083 /* hyphen */,
+	0x0089 /* period */,
+	0x0090 /* slash */,
+	0x009b /* zero */,
+	0x00a6 /* one */,
+	0x00b1 /* two */,
+	0x00bc /* three */,
+	0x00c7 /* four */,
+	0x00d2 /* five */,
+	0x00dd /* six */,
+	0x00e8 /* seven */,
+	0x00f3 /* eight */,
+	0x00fe /* nine */,
+	0x0109 /* colon */,
+	0x0113 /* semicolon */,
+	0x011e /* less */,
+	0x0128 /* equal */,
+	0x0130 /* greater */,
+	0x013a /* question */,
+	0x0146 /* at */,
+	0x0152 /* A */,
+	0x015d /* B */,
+	0x0168 /* C */,
+	0x0173 /* D */,
+	0x017e /* E */,
+	0x0189 /* F */,
+	0x0194 /* G */,
+	0x019f /* H */,
+	0x01aa /* I */,
+	0x01b5 /* J */,
+	0x01c0 /* K */,
+	0x01cb /* L */,
+	0x01d6 /* M */,
+	0x01e1 /* N */,
+	0x01ec /* O */,
+	0x01f7 /* P */,
+	0x0202 /* Q */,
+	0x020e /* R */,
+	0x0219 /* S */,
+	0x0224 /* T */,
+	0x022f /* U */,
+	0x023a /* V */,
+	0x0245 /* W */,
+	0x0250 /* X */,
+	0x025b /* Y */,
+	0x0266 /* Z */,
+	0x0271 /* bracketleft */,
+	0x027e /* backslash */,
+	0x0289 /* bracketright */,
+	0x0296 /* asciicircum */,
+	0x029e /* underscore */,
+	0x02a4 /* grave */,
+	0x02ab /* a */,
+	0x02b5 /* b */,
+	0x02c1 /* c */,
+	0x02cb /* d */,
+	0x02d7 /* e */,
+	0x02e1 /* f */,
+	0x02ed /* g */,
+	0x02f8 /* h */,
+	0x0304 /* i */,
+	0x0310 /* j */,
+	0x031d /* k */,
+	0x0329 /* l */,
+	0x0335 /* m */,
+	0x033f /* n */,
+	0x0349 /* o */,
+	0x0353 /* p */,
+	0x035e /* q */,
+	0x0369 /* r */,
+	0x0373 /* s */,
+	0x037d /* t */,
+	0x0389 /* u */,
+	0x0393 /* v */,
+	0x039d /* w */,
+	0x03a7 /* x */,
+	0x03b1 /* y */,
+	0x03bc /* z */,
+	0x03c6 /* braceleft */,
+	0x03d2 /* bar */,
+	0x03de /* braceright */,
+	0x03ea /* asciitilde */,
+	0xffff /* (no glyph) */
+};
+const struct fb_font font_helvB08 = {
+	.height = 10,
+	.ascent = 8,
+	.firstchar = 32, /* space */
+	.lastchar = 127, /* ? */
+	.chardata = font_helvB08_data,
+	.charoffs = font_helvB08_offsets,
+};
diff --git a/src/target/firmware/fb/helvB14.c b/src/target/firmware/fb/helvB14.c
new file mode 100644
index 00000000..40c310ee
--- /dev/null
+++ b/src/target/firmware/fb/helvB14.c
@@ -0,0 +1,1195 @@
+#include <fb/font.h>
+static const uint8_t font_helvB14_data[] = {
+/* --- new character space (32) starting at offset 0x0000 --- */
+	/*0000:*/	4, 1, 1, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0005:*/	0x00,  /* ........ */
+/* --- new character exclam (33) starting at offset 0x0006 --- */
+	/*0006:*/	4, 2, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*000b:*/	0xc0,  /* ##...... */
+	/*000c:*/	0xc0,  /* ##...... */
+	/*000d:*/	0xc0,  /* ##...... */
+	/*000e:*/	0xc0,  /* ##...... */
+	/*000f:*/	0xc0,  /* ##...... */
+	/*0010:*/	0xc0,  /* ##...... */
+	/*0011:*/	0x80,  /* #....... */
+	/*0012:*/	0x80,  /* #....... */
+	/*0013:*/	0x00,  /* ........ */
+	/*0014:*/	0xc0,  /* ##...... */
+	/*0015:*/	0xc0,  /* ##...... */
+/* --- new character quotedbl (34) starting at offset 0x0016 --- */
+	/*0016:*/	7, 5, 3, 1, 8, /* width and bbox (w,h,x,y) */ 
+	/*001b:*/	0xd8,  /* ##.##... */
+	/*001c:*/	0xd8,  /* ##.##... */
+	/*001d:*/	0x90,  /* #..#.... */
+/* --- new character numbersign (35) starting at offset 0x001e --- */
+	/*001e:*/	9, 9, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0023:*/	0x1b,0x00,  /* ...##.##........ */
+	/*0025:*/	0x1b,0x00,  /* ...##.##........ */
+	/*0027:*/	0x1b,0x00,  /* ...##.##........ */
+	/*0029:*/	0x7f,0x80,  /* .########....... */
+	/*002b:*/	0x36,0x00,  /* ..##.##......... */
+	/*002d:*/	0x36,0x00,  /* ..##.##......... */
+	/*002f:*/	0xff,0x00,  /* ########........ */
+	/*0031:*/	0x6c,0x00,  /* .##.##.......... */
+	/*0033:*/	0x6c,0x00,  /* .##.##.......... */
+	/*0035:*/	0x6c,0x00,  /* .##.##.......... */
+/* --- new character dollar (36) starting at offset 0x0037 --- */
+	/*0037:*/	8, 7, 13, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*003c:*/	0x10,  /* ...#.... */
+	/*003d:*/	0x7c,  /* .#####.. */
+	/*003e:*/	0xd6,  /* ##.#.##. */
+	/*003f:*/	0xd6,  /* ##.#.##. */
+	/*0040:*/	0xf0,  /* ####.... */
+	/*0041:*/	0x78,  /* .####... */
+	/*0042:*/	0x1c,  /* ...###.. */
+	/*0043:*/	0x16,  /* ...#.##. */
+	/*0044:*/	0xd6,  /* ##.#.##. */
+	/*0045:*/	0xd6,  /* ##.#.##. */
+	/*0046:*/	0x7c,  /* .#####.. */
+	/*0047:*/	0x10,  /* ...#.... */
+	/*0048:*/	0x10,  /* ...#.... */
+/* --- new character percent (37) starting at offset 0x0049 --- */
+	/*0049:*/	13, 12, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*004e:*/	0x78,0x80,  /* .####...#....... */
+	/*0050:*/	0xcd,0x80,  /* ##..##.##....... */
+	/*0052:*/	0xcd,0x00,  /* ##..##.#........ */
+	/*0054:*/	0x7b,0x00,  /* .####.##........ */
+	/*0056:*/	0x06,0x00,  /* .....##......... */
+	/*0058:*/	0x04,0x00,  /* .....#.......... */
+	/*005a:*/	0x0d,0xe0,  /* ....##.####..... */
+	/*005c:*/	0x0b,0x30,  /* ....#.##..##.... */
+	/*005e:*/	0x1b,0x30,  /* ...##.##..##.... */
+	/*0060:*/	0x11,0xe0,  /* ...#...####..... */
+/* --- new character ampersand (38) starting at offset 0x0062 --- */
+	/*0062:*/	11, 9, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0067:*/	0x38,0x00,  /* ..###........... */
+	/*0069:*/	0x6c,0x00,  /* .##.##.......... */
+	/*006b:*/	0x6c,0x00,  /* .##.##.......... */
+	/*006d:*/	0x38,0x00,  /* ..###........... */
+	/*006f:*/	0x73,0x00,  /* .###..##........ */
+	/*0071:*/	0xfb,0x00,  /* #####.##........ */
+	/*0073:*/	0xce,0x00,  /* ##..###......... */
+	/*0075:*/	0xc6,0x00,  /* ##...##......... */
+	/*0077:*/	0xcf,0x00,  /* ##..####........ */
+	/*0079:*/	0x7d,0x80,  /* .#####.##....... */
+/* --- new character quotesingle (39) starting at offset 0x007b --- */
+	/*007b:*/	4, 2, 3, 1, 8, /* width and bbox (w,h,x,y) */ 
+	/*0080:*/	0xc0,  /* ##...... */
+	/*0081:*/	0xc0,  /* ##...... */
+	/*0082:*/	0x80,  /* #....... */
+/* --- new character parenleft (40) starting at offset 0x0083 --- */
+	/*0083:*/	5, 4, 14, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*0088:*/	0x30,  /* ..##.... */
+	/*0089:*/	0x60,  /* .##..... */
+	/*008a:*/	0x60,  /* .##..... */
+	/*008b:*/	0xc0,  /* ##...... */
+	/*008c:*/	0xc0,  /* ##...... */
+	/*008d:*/	0xc0,  /* ##...... */
+	/*008e:*/	0xc0,  /* ##...... */
+	/*008f:*/	0xc0,  /* ##...... */
+	/*0090:*/	0xc0,  /* ##...... */
+	/*0091:*/	0xc0,  /* ##...... */
+	/*0092:*/	0xc0,  /* ##...... */
+	/*0093:*/	0x60,  /* .##..... */
+	/*0094:*/	0x60,  /* .##..... */
+	/*0095:*/	0x30,  /* ..##.... */
+/* --- new character parenright (41) starting at offset 0x0096 --- */
+	/*0096:*/	5, 4, 14, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*009b:*/	0xc0,  /* ##...... */
+	/*009c:*/	0x60,  /* .##..... */
+	/*009d:*/	0x60,  /* .##..... */
+	/*009e:*/	0x30,  /* ..##.... */
+	/*009f:*/	0x30,  /* ..##.... */
+	/*00a0:*/	0x30,  /* ..##.... */
+	/*00a1:*/	0x30,  /* ..##.... */
+	/*00a2:*/	0x30,  /* ..##.... */
+	/*00a3:*/	0x30,  /* ..##.... */
+	/*00a4:*/	0x30,  /* ..##.... */
+	/*00a5:*/	0x30,  /* ..##.... */
+	/*00a6:*/	0x60,  /* .##..... */
+	/*00a7:*/	0x60,  /* .##..... */
+	/*00a8:*/	0xc0,  /* ##...... */
+/* --- new character asterisk (42) starting at offset 0x00a9 --- */
+	/*00a9:*/	6, 5, 4, 0, 7, /* width and bbox (w,h,x,y) */ 
+	/*00ae:*/	0x20,  /* ..#..... */
+	/*00af:*/	0xf8,  /* #####... */
+	/*00b0:*/	0x70,  /* .###.... */
+	/*00b1:*/	0xd8,  /* ##.##... */
+/* --- new character plus (43) starting at offset 0x00b2 --- */
+	/*00b2:*/	9, 8, 7, 0, 1, /* width and bbox (w,h,x,y) */ 
+	/*00b7:*/	0x18,  /* ...##... */
+	/*00b8:*/	0x18,  /* ...##... */
+	/*00b9:*/	0x18,  /* ...##... */
+	/*00ba:*/	0xff,  /* ######## */
+	/*00bb:*/	0x18,  /* ...##... */
+	/*00bc:*/	0x18,  /* ...##... */
+	/*00bd:*/	0x18,  /* ...##... */
+/* --- new character comma (44) starting at offset 0x00be --- */
+	/*00be:*/	4, 3, 3, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*00c3:*/	0x60,  /* .##..... */
+	/*00c4:*/	0x60,  /* .##..... */
+	/*00c5:*/	0xc0,  /* ##...... */
+/* --- new character hyphen (45) starting at offset 0x00c6 --- */
+	/*00c6:*/	5, 5, 1, 0, 4, /* width and bbox (w,h,x,y) */ 
+	/*00cb:*/	0xf8,  /* #####... */
+/* --- new character period (46) starting at offset 0x00cc --- */
+	/*00cc:*/	4, 2, 2, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00d1:*/	0xc0,  /* ##...... */
+	/*00d2:*/	0xc0,  /* ##...... */
+/* --- new character slash (47) starting at offset 0x00d3 --- */
+	/*00d3:*/	4, 4, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00d8:*/	0x30,  /* ..##.... */
+	/*00d9:*/	0x30,  /* ..##.... */
+	/*00da:*/	0x20,  /* ..#..... */
+	/*00db:*/	0x20,  /* ..#..... */
+	/*00dc:*/	0x60,  /* .##..... */
+	/*00dd:*/	0x60,  /* .##..... */
+	/*00de:*/	0x60,  /* .##..... */
+	/*00df:*/	0x40,  /* .#...... */
+	/*00e0:*/	0x40,  /* .#...... */
+	/*00e1:*/	0xc0,  /* ##...... */
+	/*00e2:*/	0xc0,  /* ##...... */
+/* --- new character zero (48) starting at offset 0x00e3 --- */
+	/*00e3:*/	8, 7, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00e8:*/	0x38,  /* ..###... */
+	/*00e9:*/	0x6c,  /* .##.##.. */
+	/*00ea:*/	0xc6,  /* ##...##. */
+	/*00eb:*/	0xc6,  /* ##...##. */
+	/*00ec:*/	0xc6,  /* ##...##. */
+	/*00ed:*/	0xc6,  /* ##...##. */
+	/*00ee:*/	0xc6,  /* ##...##. */
+	/*00ef:*/	0xc6,  /* ##...##. */
+	/*00f0:*/	0x6c,  /* .##.##.. */
+	/*00f1:*/	0x38,  /* ..###... */
+/* --- new character one (49) starting at offset 0x00f2 --- */
+	/*00f2:*/	8, 4, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00f7:*/	0x30,  /* ..##.... */
+	/*00f8:*/	0xf0,  /* ####.... */
+	/*00f9:*/	0x30,  /* ..##.... */
+	/*00fa:*/	0x30,  /* ..##.... */
+	/*00fb:*/	0x30,  /* ..##.... */
+	/*00fc:*/	0x30,  /* ..##.... */
+	/*00fd:*/	0x30,  /* ..##.... */
+	/*00fe:*/	0x30,  /* ..##.... */
+	/*00ff:*/	0x30,  /* ..##.... */
+	/*0100:*/	0x30,  /* ..##.... */
+/* --- new character two (50) starting at offset 0x0101 --- */
+	/*0101:*/	8, 7, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0106:*/	0x7c,  /* .#####.. */
+	/*0107:*/	0xe6,  /* ###..##. */
+	/*0108:*/	0xc6,  /* ##...##. */
+	/*0109:*/	0x0e,  /* ....###. */
+	/*010a:*/	0x0c,  /* ....##.. */
+	/*010b:*/	0x38,  /* ..###... */
+	/*010c:*/	0x70,  /* .###.... */
+	/*010d:*/	0xe0,  /* ###..... */
+	/*010e:*/	0xc0,  /* ##...... */
+	/*010f:*/	0xfe,  /* #######. */
+/* --- new character three (51) starting at offset 0x0110 --- */
+	/*0110:*/	8, 7, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0115:*/	0x7c,  /* .#####.. */
+	/*0116:*/	0xce,  /* ##..###. */
+	/*0117:*/	0xc6,  /* ##...##. */
+	/*0118:*/	0x06,  /* .....##. */
+	/*0119:*/	0x3c,  /* ..####.. */
+	/*011a:*/	0x06,  /* .....##. */
+	/*011b:*/	0x06,  /* .....##. */
+	/*011c:*/	0xc6,  /* ##...##. */
+	/*011d:*/	0xce,  /* ##..###. */
+	/*011e:*/	0x7c,  /* .#####.. */
+/* --- new character four (52) starting at offset 0x011f --- */
+	/*011f:*/	8, 8, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0124:*/	0x0e,  /* ....###. */
+	/*0125:*/	0x1e,  /* ...####. */
+	/*0126:*/	0x36,  /* ..##.##. */
+	/*0127:*/	0x66,  /* .##..##. */
+	/*0128:*/	0xc6,  /* ##...##. */
+	/*0129:*/	0xc6,  /* ##...##. */
+	/*012a:*/	0xff,  /* ######## */
+	/*012b:*/	0x06,  /* .....##. */
+	/*012c:*/	0x06,  /* .....##. */
+	/*012d:*/	0x06,  /* .....##. */
+/* --- new character five (53) starting at offset 0x012e --- */
+	/*012e:*/	8, 7, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0133:*/	0x7e,  /* .######. */
+	/*0134:*/	0x60,  /* .##..... */
+	/*0135:*/	0xc0,  /* ##...... */
+	/*0136:*/	0xf8,  /* #####... */
+	/*0137:*/	0x1c,  /* ...###.. */
+	/*0138:*/	0x06,  /* .....##. */
+	/*0139:*/	0x06,  /* .....##. */
+	/*013a:*/	0xc6,  /* ##...##. */
+	/*013b:*/	0xec,  /* ###.##.. */
+	/*013c:*/	0x78,  /* .####... */
+/* --- new character six (54) starting at offset 0x013d --- */
+	/*013d:*/	8, 7, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0142:*/	0x3c,  /* ..####.. */
+	/*0143:*/	0x76,  /* .###.##. */
+	/*0144:*/	0x66,  /* .##..##. */
+	/*0145:*/	0xc0,  /* ##...... */
+	/*0146:*/	0xdc,  /* ##.###.. */
+	/*0147:*/	0xf6,  /* ####.##. */
+	/*0148:*/	0xc6,  /* ##...##. */
+	/*0149:*/	0xc6,  /* ##...##. */
+	/*014a:*/	0x6e,  /* .##.###. */
+	/*014b:*/	0x3c,  /* ..####.. */
+/* --- new character seven (55) starting at offset 0x014c --- */
+	/*014c:*/	8, 7, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0151:*/	0xfe,  /* #######. */
+	/*0152:*/	0x06,  /* .....##. */
+	/*0153:*/	0x0c,  /* ....##.. */
+	/*0154:*/	0x0c,  /* ....##.. */
+	/*0155:*/	0x18,  /* ...##... */
+	/*0156:*/	0x18,  /* ...##... */
+	/*0157:*/	0x30,  /* ..##.... */
+	/*0158:*/	0x30,  /* ..##.... */
+	/*0159:*/	0x60,  /* .##..... */
+	/*015a:*/	0x60,  /* .##..... */
+/* --- new character eight (56) starting at offset 0x015b --- */
+	/*015b:*/	8, 7, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0160:*/	0x7c,  /* .#####.. */
+	/*0161:*/	0xee,  /* ###.###. */
+	/*0162:*/	0xc6,  /* ##...##. */
+	/*0163:*/	0xc6,  /* ##...##. */
+	/*0164:*/	0x7c,  /* .#####.. */
+	/*0165:*/	0xee,  /* ###.###. */
+	/*0166:*/	0xc6,  /* ##...##. */
+	/*0167:*/	0xc6,  /* ##...##. */
+	/*0168:*/	0xc6,  /* ##...##. */
+	/*0169:*/	0x7c,  /* .#####.. */
+/* --- new character nine (57) starting at offset 0x016a --- */
+	/*016a:*/	8, 7, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*016f:*/	0x7c,  /* .#####.. */
+	/*0170:*/	0xee,  /* ###.###. */
+	/*0171:*/	0xc6,  /* ##...##. */
+	/*0172:*/	0xc6,  /* ##...##. */
+	/*0173:*/	0xe6,  /* ###..##. */
+	/*0174:*/	0x7e,  /* .######. */
+	/*0175:*/	0x06,  /* .....##. */
+	/*0176:*/	0xc6,  /* ##...##. */
+	/*0177:*/	0xce,  /* ##..###. */
+	/*0178:*/	0x7c,  /* .#####.. */
+/* --- new character colon (58) starting at offset 0x0179 --- */
+	/*0179:*/	5, 2, 8, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*017e:*/	0xc0,  /* ##...... */
+	/*017f:*/	0xc0,  /* ##...... */
+	/*0180:*/	0x00,  /* ........ */
+	/*0181:*/	0x00,  /* ........ */
+	/*0182:*/	0x00,  /* ........ */
+	/*0183:*/	0x00,  /* ........ */
+	/*0184:*/	0xc0,  /* ##...... */
+	/*0185:*/	0xc0,  /* ##...... */
+/* --- new character semicolon (59) starting at offset 0x0186 --- */
+	/*0186:*/	5, 3, 9, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*018b:*/	0x60,  /* .##..... */
+	/*018c:*/	0x60,  /* .##..... */
+	/*018d:*/	0x00,  /* ........ */
+	/*018e:*/	0x00,  /* ........ */
+	/*018f:*/	0x00,  /* ........ */
+	/*0190:*/	0x00,  /* ........ */
+	/*0191:*/	0x60,  /* .##..... */
+	/*0192:*/	0x60,  /* .##..... */
+	/*0193:*/	0xc0,  /* ##...... */
+/* --- new character less (60) starting at offset 0x0194 --- */
+	/*0194:*/	8, 6, 5, 1, 2, /* width and bbox (w,h,x,y) */ 
+	/*0199:*/	0x1c,  /* ...###.. */
+	/*019a:*/	0x70,  /* .###.... */
+	/*019b:*/	0xc0,  /* ##...... */
+	/*019c:*/	0x70,  /* .###.... */
+	/*019d:*/	0x1c,  /* ...###.. */
+/* --- new character equal (61) starting at offset 0x019e --- */
+	/*019e:*/	9, 7, 3, 1, 3, /* width and bbox (w,h,x,y) */ 
+	/*01a3:*/	0xfe,  /* #######. */
+	/*01a4:*/	0x00,  /* ........ */
+	/*01a5:*/	0xfe,  /* #######. */
+/* --- new character greater (62) starting at offset 0x01a6 --- */
+	/*01a6:*/	8, 6, 5, 1, 2, /* width and bbox (w,h,x,y) */ 
+	/*01ab:*/	0xe0,  /* ###..... */
+	/*01ac:*/	0x38,  /* ..###... */
+	/*01ad:*/	0x0c,  /* ....##.. */
+	/*01ae:*/	0x38,  /* ..###... */
+	/*01af:*/	0xe0,  /* ###..... */
+/* --- new character question (63) starting at offset 0x01b0 --- */
+	/*01b0:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01b5:*/	0x7c,  /* .#####.. */
+	/*01b6:*/	0xc6,  /* ##...##. */
+	/*01b7:*/	0xc6,  /* ##...##. */
+	/*01b8:*/	0x06,  /* .....##. */
+	/*01b9:*/	0x0c,  /* ....##.. */
+	/*01ba:*/	0x18,  /* ...##... */
+	/*01bb:*/	0x30,  /* ..##.... */
+	/*01bc:*/	0x30,  /* ..##.... */
+	/*01bd:*/	0x00,  /* ........ */
+	/*01be:*/	0x30,  /* ..##.... */
+	/*01bf:*/	0x30,  /* ..##.... */
+/* --- new character at (64) starting at offset 0x01c0 --- */
+	/*01c0:*/	14, 13, 12, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*01c5:*/	0x0f,0x80,  /* ....#####....... */
+	/*01c7:*/	0x38,0xe0,  /* ..###...###..... */
+	/*01c9:*/	0x70,0x70,  /* .###.....###.... */
+	/*01cb:*/	0x66,0xb0,  /* .##..##.#.##.... */
+	/*01cd:*/	0xcd,0x98,  /* ##..##.##..##... */
+	/*01cf:*/	0xd9,0x98,  /* ##.##..##..##... */
+	/*01d1:*/	0xdb,0x18,  /* ##.##.##...##... */
+	/*01d3:*/	0xdb,0x30,  /* ##.##.##..##.... */
+	/*01d5:*/	0xce,0xe0,  /* ##..###.###..... */
+	/*01d7:*/	0x60,0x00,  /* .##............. */
+	/*01d9:*/	0x31,0x80,  /* ..##...##....... */
+	/*01db:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character A (65) starting at offset 0x01dd --- */
+	/*01dd:*/	10, 10, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01e2:*/	0x0c,0x00,  /* ....##.......... */
+	/*01e4:*/	0x0c,0x00,  /* ....##.......... */
+	/*01e6:*/	0x1e,0x00,  /* ...####......... */
+	/*01e8:*/	0x12,0x00,  /* ...#..#......... */
+	/*01ea:*/	0x33,0x00,  /* ..##..##........ */
+	/*01ec:*/	0x33,0x00,  /* ..##..##........ */
+	/*01ee:*/	0x61,0x80,  /* .##....##....... */
+	/*01f0:*/	0x7f,0x80,  /* .########....... */
+	/*01f2:*/	0x61,0x80,  /* .##....##....... */
+	/*01f4:*/	0xc0,0xc0,  /* ##......##...... */
+	/*01f6:*/	0xc0,0xc0,  /* ##......##...... */
+/* --- new character B (66) starting at offset 0x01f8 --- */
+	/*01f8:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01fd:*/	0xfe,  /* #######. */
+	/*01fe:*/	0xc7,  /* ##...### */
+	/*01ff:*/	0xc3,  /* ##....## */
+	/*0200:*/	0xc3,  /* ##....## */
+	/*0201:*/	0xc6,  /* ##...##. */
+	/*0202:*/	0xfc,  /* ######.. */
+	/*0203:*/	0xc6,  /* ##...##. */
+	/*0204:*/	0xc3,  /* ##....## */
+	/*0205:*/	0xc3,  /* ##....## */
+	/*0206:*/	0xc7,  /* ##...### */
+	/*0207:*/	0xfe,  /* #######. */
+/* --- new character C (67) starting at offset 0x0208 --- */
+	/*0208:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*020d:*/	0x1f,0x00,  /* ...#####........ */
+	/*020f:*/	0x7b,0x80,  /* .####.###....... */
+	/*0211:*/	0x60,0x80,  /* .##.....#....... */
+	/*0213:*/	0xc0,0x00,  /* ##.............. */
+	/*0215:*/	0xc0,0x00,  /* ##.............. */
+	/*0217:*/	0xc0,0x00,  /* ##.............. */
+	/*0219:*/	0xc0,0x00,  /* ##.............. */
+	/*021b:*/	0xc0,0x00,  /* ##.............. */
+	/*021d:*/	0x60,0x80,  /* .##.....#....... */
+	/*021f:*/	0x7b,0x80,  /* .####.###....... */
+	/*0221:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character D (68) starting at offset 0x0223 --- */
+	/*0223:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0228:*/	0xfc,0x00,  /* ######.......... */
+	/*022a:*/	0xc7,0x00,  /* ##...###........ */
+	/*022c:*/	0xc3,0x00,  /* ##....##........ */
+	/*022e:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0230:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0232:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0234:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0236:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0238:*/	0xc3,0x00,  /* ##....##........ */
+	/*023a:*/	0xc7,0x00,  /* ##...###........ */
+	/*023c:*/	0xfc,0x00,  /* ######.......... */
+/* --- new character E (69) starting at offset 0x023e --- */
+	/*023e:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0243:*/	0xfe,  /* #######. */
+	/*0244:*/	0xc0,  /* ##...... */
+	/*0245:*/	0xc0,  /* ##...... */
+	/*0246:*/	0xc0,  /* ##...... */
+	/*0247:*/	0xc0,  /* ##...... */
+	/*0248:*/	0xfe,  /* #######. */
+	/*0249:*/	0xc0,  /* ##...... */
+	/*024a:*/	0xc0,  /* ##...... */
+	/*024b:*/	0xc0,  /* ##...... */
+	/*024c:*/	0xc0,  /* ##...... */
+	/*024d:*/	0xfe,  /* #######. */
+/* --- new character F (70) starting at offset 0x024e --- */
+	/*024e:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0253:*/	0xfe,  /* #######. */
+	/*0254:*/	0xc0,  /* ##...... */
+	/*0255:*/	0xc0,  /* ##...... */
+	/*0256:*/	0xc0,  /* ##...... */
+	/*0257:*/	0xc0,  /* ##...... */
+	/*0258:*/	0xfc,  /* ######.. */
+	/*0259:*/	0xc0,  /* ##...... */
+	/*025a:*/	0xc0,  /* ##...... */
+	/*025b:*/	0xc0,  /* ##...... */
+	/*025c:*/	0xc0,  /* ##...... */
+	/*025d:*/	0xc0,  /* ##...... */
+/* --- new character G (71) starting at offset 0x025e --- */
+	/*025e:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0263:*/	0x1f,0x00,  /* ...#####........ */
+	/*0265:*/	0x7b,0x80,  /* .####.###....... */
+	/*0267:*/	0x60,0x80,  /* .##.....#....... */
+	/*0269:*/	0xc0,0x00,  /* ##.............. */
+	/*026b:*/	0xc0,0x00,  /* ##.............. */
+	/*026d:*/	0xc7,0x80,  /* ##...####....... */
+	/*026f:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0271:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0273:*/	0x61,0x80,  /* .##....##....... */
+	/*0275:*/	0x7b,0x80,  /* .####.###....... */
+	/*0277:*/	0x1e,0x80,  /* ...####.#....... */
+/* --- new character H (72) starting at offset 0x0279 --- */
+	/*0279:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*027e:*/	0xc3,  /* ##....## */
+	/*027f:*/	0xc3,  /* ##....## */
+	/*0280:*/	0xc3,  /* ##....## */
+	/*0281:*/	0xc3,  /* ##....## */
+	/*0282:*/	0xc3,  /* ##....## */
+	/*0283:*/	0xff,  /* ######## */
+	/*0284:*/	0xc3,  /* ##....## */
+	/*0285:*/	0xc3,  /* ##....## */
+	/*0286:*/	0xc3,  /* ##....## */
+	/*0287:*/	0xc3,  /* ##....## */
+	/*0288:*/	0xc3,  /* ##....## */
+/* --- new character I (73) starting at offset 0x0289 --- */
+	/*0289:*/	4, 2, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*028e:*/	0xc0,  /* ##...... */
+	/*028f:*/	0xc0,  /* ##...... */
+	/*0290:*/	0xc0,  /* ##...... */
+	/*0291:*/	0xc0,  /* ##...... */
+	/*0292:*/	0xc0,  /* ##...... */
+	/*0293:*/	0xc0,  /* ##...... */
+	/*0294:*/	0xc0,  /* ##...... */
+	/*0295:*/	0xc0,  /* ##...... */
+	/*0296:*/	0xc0,  /* ##...... */
+	/*0297:*/	0xc0,  /* ##...... */
+	/*0298:*/	0xc0,  /* ##...... */
+/* --- new character J (74) starting at offset 0x0299 --- */
+	/*0299:*/	8, 7, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*029e:*/	0x06,  /* .....##. */
+	/*029f:*/	0x06,  /* .....##. */
+	/*02a0:*/	0x06,  /* .....##. */
+	/*02a1:*/	0x06,  /* .....##. */
+	/*02a2:*/	0x06,  /* .....##. */
+	/*02a3:*/	0x06,  /* .....##. */
+	/*02a4:*/	0x06,  /* .....##. */
+	/*02a5:*/	0xc6,  /* ##...##. */
+	/*02a6:*/	0xc6,  /* ##...##. */
+	/*02a7:*/	0xee,  /* ###.###. */
+	/*02a8:*/	0x7c,  /* .#####.. */
+/* --- new character K (75) starting at offset 0x02a9 --- */
+	/*02a9:*/	10, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02ae:*/	0xc3,0x00,  /* ##....##........ */
+	/*02b0:*/	0xc6,0x00,  /* ##...##......... */
+	/*02b2:*/	0xcc,0x00,  /* ##..##.......... */
+	/*02b4:*/	0xd8,0x00,  /* ##.##........... */
+	/*02b6:*/	0xf0,0x00,  /* ####............ */
+	/*02b8:*/	0xf0,0x00,  /* ####............ */
+	/*02ba:*/	0xd8,0x00,  /* ##.##........... */
+	/*02bc:*/	0xcc,0x00,  /* ##..##.......... */
+	/*02be:*/	0xc6,0x00,  /* ##...##......... */
+	/*02c0:*/	0xc3,0x00,  /* ##....##........ */
+	/*02c2:*/	0xc1,0x80,  /* ##.....##....... */
+/* --- new character L (76) starting at offset 0x02c4 --- */
+	/*02c4:*/	8, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02c9:*/	0xc0,  /* ##...... */
+	/*02ca:*/	0xc0,  /* ##...... */
+	/*02cb:*/	0xc0,  /* ##...... */
+	/*02cc:*/	0xc0,  /* ##...... */
+	/*02cd:*/	0xc0,  /* ##...... */
+	/*02ce:*/	0xc0,  /* ##...... */
+	/*02cf:*/	0xc0,  /* ##...... */
+	/*02d0:*/	0xc0,  /* ##...... */
+	/*02d1:*/	0xc0,  /* ##...... */
+	/*02d2:*/	0xc0,  /* ##...... */
+	/*02d3:*/	0xfe,  /* #######. */
+/* --- new character M (77) starting at offset 0x02d4 --- */
+	/*02d4:*/	13, 11, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02d9:*/	0xc0,0x60,  /* ##.......##..... */
+	/*02db:*/	0xc0,0x60,  /* ##.......##..... */
+	/*02dd:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*02df:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*02e1:*/	0xf1,0xe0,  /* ####...####..... */
+	/*02e3:*/	0xd1,0x60,  /* ##.#...#.##..... */
+	/*02e5:*/	0xd1,0x60,  /* ##.#...#.##..... */
+	/*02e7:*/	0xdb,0x60,  /* ##.##.##.##..... */
+	/*02e9:*/	0xca,0x60,  /* ##..#.#..##..... */
+	/*02eb:*/	0xce,0x60,  /* ##..###..##..... */
+	/*02ed:*/	0xc4,0x60,  /* ##...#...##..... */
+/* --- new character N (78) starting at offset 0x02ef --- */
+	/*02ef:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02f4:*/	0xc1,0x80,  /* ##.....##....... */
+	/*02f6:*/	0xe1,0x80,  /* ###....##....... */
+	/*02f8:*/	0xe1,0x80,  /* ###....##....... */
+	/*02fa:*/	0xd1,0x80,  /* ##.#...##....... */
+	/*02fc:*/	0xd9,0x80,  /* ##.##..##....... */
+	/*02fe:*/	0xc9,0x80,  /* ##..#..##....... */
+	/*0300:*/	0xcd,0x80,  /* ##..##.##....... */
+	/*0302:*/	0xc5,0x80,  /* ##...#.##....... */
+	/*0304:*/	0xc3,0x80,  /* ##....###....... */
+	/*0306:*/	0xc3,0x80,  /* ##....###....... */
+	/*0308:*/	0xc1,0x80,  /* ##.....##....... */
+/* --- new character O (79) starting at offset 0x030a --- */
+	/*030a:*/	12, 10, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*030f:*/	0x1e,0x00,  /* ...####......... */
+	/*0311:*/	0x73,0x80,  /* .###..###....... */
+	/*0313:*/	0x61,0x80,  /* .##....##....... */
+	/*0315:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0317:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0319:*/	0xc0,0xc0,  /* ##......##...... */
+	/*031b:*/	0xc0,0xc0,  /* ##......##...... */
+	/*031d:*/	0xc0,0xc0,  /* ##......##...... */
+	/*031f:*/	0x61,0x80,  /* .##....##....... */
+	/*0321:*/	0x73,0x80,  /* .###..###....... */
+	/*0323:*/	0x1e,0x00,  /* ...####......... */
+/* --- new character P (80) starting at offset 0x0325 --- */
+	/*0325:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*032a:*/	0xfe,  /* #######. */
+	/*032b:*/	0xc7,  /* ##...### */
+	/*032c:*/	0xc3,  /* ##....## */
+	/*032d:*/	0xc3,  /* ##....## */
+	/*032e:*/	0xc7,  /* ##...### */
+	/*032f:*/	0xfe,  /* #######. */
+	/*0330:*/	0xc0,  /* ##...... */
+	/*0331:*/	0xc0,  /* ##...... */
+	/*0332:*/	0xc0,  /* ##...... */
+	/*0333:*/	0xc0,  /* ##...... */
+	/*0334:*/	0xc0,  /* ##...... */
+/* --- new character Q (81) starting at offset 0x0335 --- */
+	/*0335:*/	12, 10, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*033a:*/	0x1e,0x00,  /* ...####......... */
+	/*033c:*/	0x73,0x80,  /* .###..###....... */
+	/*033e:*/	0x61,0x80,  /* .##....##....... */
+	/*0340:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0342:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0344:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0346:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0348:*/	0xc6,0xc0,  /* ##...##.##...... */
+	/*034a:*/	0x63,0x80,  /* .##...###....... */
+	/*034c:*/	0x73,0x80,  /* .###..###....... */
+	/*034e:*/	0x1e,0xc0,  /* ...####.##...... */
+/* --- new character R (82) starting at offset 0x0350 --- */
+	/*0350:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0355:*/	0xfe,0x00,  /* #######......... */
+	/*0357:*/	0xc7,0x00,  /* ##...###........ */
+	/*0359:*/	0xc3,0x00,  /* ##....##........ */
+	/*035b:*/	0xc3,0x00,  /* ##....##........ */
+	/*035d:*/	0xc7,0x00,  /* ##...###........ */
+	/*035f:*/	0xfe,0x00,  /* #######......... */
+	/*0361:*/	0xc3,0x00,  /* ##....##........ */
+	/*0363:*/	0xc3,0x00,  /* ##....##........ */
+	/*0365:*/	0xc3,0x00,  /* ##....##........ */
+	/*0367:*/	0xc3,0x00,  /* ##....##........ */
+	/*0369:*/	0xc1,0x80,  /* ##.....##....... */
+/* --- new character S (83) starting at offset 0x036b --- */
+	/*036b:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0370:*/	0x7e,  /* .######. */
+	/*0371:*/	0xe7,  /* ###..### */
+	/*0372:*/	0xc3,  /* ##....## */
+	/*0373:*/	0xe0,  /* ###..... */
+	/*0374:*/	0x78,  /* .####... */
+	/*0375:*/	0x1e,  /* ...####. */
+	/*0376:*/	0x07,  /* .....### */
+	/*0377:*/	0x03,  /* ......## */
+	/*0378:*/	0xc3,  /* ##....## */
+	/*0379:*/	0xee,  /* ###.###. */
+	/*037a:*/	0x7c,  /* .#####.. */
+/* --- new character T (84) starting at offset 0x037b --- */
+	/*037b:*/	8, 8, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0380:*/	0xff,  /* ######## */
+	/*0381:*/	0x18,  /* ...##... */
+	/*0382:*/	0x18,  /* ...##... */
+	/*0383:*/	0x18,  /* ...##... */
+	/*0384:*/	0x18,  /* ...##... */
+	/*0385:*/	0x18,  /* ...##... */
+	/*0386:*/	0x18,  /* ...##... */
+	/*0387:*/	0x18,  /* ...##... */
+	/*0388:*/	0x18,  /* ...##... */
+	/*0389:*/	0x18,  /* ...##... */
+	/*038a:*/	0x18,  /* ...##... */
+/* --- new character U (85) starting at offset 0x038b --- */
+	/*038b:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0390:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0392:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0394:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0396:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0398:*/	0xc1,0x80,  /* ##.....##....... */
+	/*039a:*/	0xc1,0x80,  /* ##.....##....... */
+	/*039c:*/	0xc1,0x80,  /* ##.....##....... */
+	/*039e:*/	0xc1,0x80,  /* ##.....##....... */
+	/*03a0:*/	0xc1,0x80,  /* ##.....##....... */
+	/*03a2:*/	0x63,0x00,  /* .##...##........ */
+	/*03a4:*/	0x3e,0x00,  /* ..#####......... */
+/* --- new character V (86) starting at offset 0x03a6 --- */
+	/*03a6:*/	10, 10, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03ab:*/	0xc0,0xc0,  /* ##......##...... */
+	/*03ad:*/	0xc0,0xc0,  /* ##......##...... */
+	/*03af:*/	0x61,0x80,  /* .##....##....... */
+	/*03b1:*/	0x61,0x80,  /* .##....##....... */
+	/*03b3:*/	0x73,0x80,  /* .###..###....... */
+	/*03b5:*/	0x33,0x00,  /* ..##..##........ */
+	/*03b7:*/	0x33,0x00,  /* ..##..##........ */
+	/*03b9:*/	0x1e,0x00,  /* ...####......... */
+	/*03bb:*/	0x1e,0x00,  /* ...####......... */
+	/*03bd:*/	0x0c,0x00,  /* ....##.......... */
+	/*03bf:*/	0x0c,0x00,  /* ....##.......... */
+/* --- new character W (87) starting at offset 0x03c1 --- */
+	/*03c1:*/	14, 14, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03c6:*/	0xc3,0x0c,  /* ##....##....##.. */
+	/*03c8:*/	0xc3,0x0c,  /* ##....##....##.. */
+	/*03ca:*/	0xc3,0x0c,  /* ##....##....##.. */
+	/*03cc:*/	0x67,0x98,  /* .##..####..##... */
+	/*03ce:*/	0x64,0x98,  /* .##..#..#..##... */
+	/*03d0:*/	0x64,0x98,  /* .##..#..#..##... */
+	/*03d2:*/	0x6c,0xd8,  /* .##.##..##.##... */
+	/*03d4:*/	0x2c,0xd0,  /* ..#.##..##.#.... */
+	/*03d6:*/	0x38,0x70,  /* ..###....###.... */
+	/*03d8:*/	0x18,0x60,  /* ...##....##..... */
+	/*03da:*/	0x18,0x60,  /* ...##....##..... */
+/* --- new character X (88) starting at offset 0x03dc --- */
+	/*03dc:*/	9, 9, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03e1:*/	0xc1,0x80,  /* ##.....##....... */
+	/*03e3:*/	0xc1,0x80,  /* ##.....##....... */
+	/*03e5:*/	0x63,0x00,  /* .##...##........ */
+	/*03e7:*/	0x36,0x00,  /* ..##.##......... */
+	/*03e9:*/	0x1c,0x00,  /* ...###.......... */
+	/*03eb:*/	0x1c,0x00,  /* ...###.......... */
+	/*03ed:*/	0x36,0x00,  /* ..##.##......... */
+	/*03ef:*/	0x63,0x00,  /* .##...##........ */
+	/*03f1:*/	0x63,0x00,  /* .##...##........ */
+	/*03f3:*/	0xc1,0x80,  /* ##.....##....... */
+	/*03f5:*/	0xc1,0x80,  /* ##.....##....... */
+/* --- new character Y (89) starting at offset 0x03f7 --- */
+	/*03f7:*/	10, 10, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03fc:*/	0xc0,0xc0,  /* ##......##...... */
+	/*03fe:*/	0x61,0x80,  /* .##....##....... */
+	/*0400:*/	0x61,0x80,  /* .##....##....... */
+	/*0402:*/	0x33,0x00,  /* ..##..##........ */
+	/*0404:*/	0x33,0x00,  /* ..##..##........ */
+	/*0406:*/	0x1e,0x00,  /* ...####......... */
+	/*0408:*/	0x1e,0x00,  /* ...####......... */
+	/*040a:*/	0x0c,0x00,  /* ....##.......... */
+	/*040c:*/	0x0c,0x00,  /* ....##.......... */
+	/*040e:*/	0x0c,0x00,  /* ....##.......... */
+	/*0410:*/	0x0c,0x00,  /* ....##.......... */
+/* --- new character Z (90) starting at offset 0x0412 --- */
+	/*0412:*/	9, 8, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0417:*/	0xff,  /* ######## */
+	/*0418:*/	0x03,  /* ......## */
+	/*0419:*/	0x06,  /* .....##. */
+	/*041a:*/	0x0c,  /* ....##.. */
+	/*041b:*/	0x1c,  /* ...###.. */
+	/*041c:*/	0x18,  /* ...##... */
+	/*041d:*/	0x30,  /* ..##.... */
+	/*041e:*/	0x70,  /* .###.... */
+	/*041f:*/	0x60,  /* .##..... */
+	/*0420:*/	0xc0,  /* ##...... */
+	/*0421:*/	0xff,  /* ######## */
+/* --- new character bracketleft (91) starting at offset 0x0422 --- */
+	/*0422:*/	5, 4, 14, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*0427:*/	0xf0,  /* ####.... */
+	/*0428:*/	0xc0,  /* ##...... */
+	/*0429:*/	0xc0,  /* ##...... */
+	/*042a:*/	0xc0,  /* ##...... */
+	/*042b:*/	0xc0,  /* ##...... */
+	/*042c:*/	0xc0,  /* ##...... */
+	/*042d:*/	0xc0,  /* ##...... */
+	/*042e:*/	0xc0,  /* ##...... */
+	/*042f:*/	0xc0,  /* ##...... */
+	/*0430:*/	0xc0,  /* ##...... */
+	/*0431:*/	0xc0,  /* ##...... */
+	/*0432:*/	0xc0,  /* ##...... */
+	/*0433:*/	0xc0,  /* ##...... */
+	/*0434:*/	0xf0,  /* ####.... */
+/* --- new character backslash (92) starting at offset 0x0435 --- */
+	/*0435:*/	4, 4, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*043a:*/	0xc0,  /* ##...... */
+	/*043b:*/	0xc0,  /* ##...... */
+	/*043c:*/	0xc0,  /* ##...... */
+	/*043d:*/	0x40,  /* .#...... */
+	/*043e:*/	0x60,  /* .##..... */
+	/*043f:*/	0x60,  /* .##..... */
+	/*0440:*/	0x60,  /* .##..... */
+	/*0441:*/	0x20,  /* ..#..... */
+	/*0442:*/	0x30,  /* ..##.... */
+	/*0443:*/	0x30,  /* ..##.... */
+	/*0444:*/	0x30,  /* ..##.... */
+/* --- new character bracketright (93) starting at offset 0x0445 --- */
+	/*0445:*/	5, 4, 14, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*044a:*/	0xf0,  /* ####.... */
+	/*044b:*/	0x30,  /* ..##.... */
+	/*044c:*/	0x30,  /* ..##.... */
+	/*044d:*/	0x30,  /* ..##.... */
+	/*044e:*/	0x30,  /* ..##.... */
+	/*044f:*/	0x30,  /* ..##.... */
+	/*0450:*/	0x30,  /* ..##.... */
+	/*0451:*/	0x30,  /* ..##.... */
+	/*0452:*/	0x30,  /* ..##.... */
+	/*0453:*/	0x30,  /* ..##.... */
+	/*0454:*/	0x30,  /* ..##.... */
+	/*0455:*/	0x30,  /* ..##.... */
+	/*0456:*/	0x30,  /* ..##.... */
+	/*0457:*/	0xf0,  /* ####.... */
+/* --- new character asciicircum (94) starting at offset 0x0458 --- */
+	/*0458:*/	8, 6, 4, 1, 7, /* width and bbox (w,h,x,y) */ 
+	/*045d:*/	0x30,  /* ..##.... */
+	/*045e:*/	0x78,  /* .####... */
+	/*045f:*/	0xcc,  /* ##..##.. */
+	/*0460:*/	0x84,  /* #....#.. */
+/* --- new character underscore (95) starting at offset 0x0461 --- */
+	/*0461:*/	8, 8, 1, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*0466:*/	0xff,  /* ######## */
+/* --- new character grave (96) starting at offset 0x0467 --- */
+	/*0467:*/	5, 3, 2, 1, 9, /* width and bbox (w,h,x,y) */ 
+	/*046c:*/	0xc0,  /* ##...... */
+	/*046d:*/	0x60,  /* .##..... */
+/* --- new character a (97) starting at offset 0x046e --- */
+	/*046e:*/	8, 7, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0473:*/	0x78,  /* .####... */
+	/*0474:*/	0xcc,  /* ##..##.. */
+	/*0475:*/	0x0c,  /* ....##.. */
+	/*0476:*/	0x7c,  /* .#####.. */
+	/*0477:*/	0xcc,  /* ##..##.. */
+	/*0478:*/	0xcc,  /* ##..##.. */
+	/*0479:*/	0xfc,  /* ######.. */
+	/*047a:*/	0x76,  /* .###.##. */
+/* --- new character b (98) starting at offset 0x047b --- */
+	/*047b:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0480:*/	0xc0,  /* ##...... */
+	/*0481:*/	0xc0,  /* ##...... */
+	/*0482:*/	0xc0,  /* ##...... */
+	/*0483:*/	0xf8,  /* #####... */
+	/*0484:*/	0xec,  /* ###.##.. */
+	/*0485:*/	0xc6,  /* ##...##. */
+	/*0486:*/	0xc6,  /* ##...##. */
+	/*0487:*/	0xc6,  /* ##...##. */
+	/*0488:*/	0xc6,  /* ##...##. */
+	/*0489:*/	0xec,  /* ###.##.. */
+	/*048a:*/	0xd8,  /* ##.##... */
+/* --- new character c (99) starting at offset 0x048b --- */
+	/*048b:*/	8, 6, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0490:*/	0x38,  /* ..###... */
+	/*0491:*/	0x7c,  /* .#####.. */
+	/*0492:*/	0xc4,  /* ##...#.. */
+	/*0493:*/	0xc0,  /* ##...... */
+	/*0494:*/	0xc0,  /* ##...... */
+	/*0495:*/	0xc4,  /* ##...#.. */
+	/*0496:*/	0x7c,  /* .#####.. */
+	/*0497:*/	0x38,  /* ..###... */
+/* --- new character d (100) starting at offset 0x0498 --- */
+	/*0498:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*049d:*/	0x06,  /* .....##. */
+	/*049e:*/	0x06,  /* .....##. */
+	/*049f:*/	0x06,  /* .....##. */
+	/*04a0:*/	0x3e,  /* ..#####. */
+	/*04a1:*/	0x6e,  /* .##.###. */
+	/*04a2:*/	0xc6,  /* ##...##. */
+	/*04a3:*/	0xc6,  /* ##...##. */
+	/*04a4:*/	0xc6,  /* ##...##. */
+	/*04a5:*/	0xc6,  /* ##...##. */
+	/*04a6:*/	0x6e,  /* .##.###. */
+	/*04a7:*/	0x36,  /* ..##.##. */
+/* --- new character e (101) starting at offset 0x04a8 --- */
+	/*04a8:*/	8, 6, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*04ad:*/	0x78,  /* .####... */
+	/*04ae:*/	0xcc,  /* ##..##.. */
+	/*04af:*/	0xcc,  /* ##..##.. */
+	/*04b0:*/	0xfc,  /* ######.. */
+	/*04b1:*/	0xc0,  /* ##...... */
+	/*04b2:*/	0xc0,  /* ##...... */
+	/*04b3:*/	0xec,  /* ###.##.. */
+	/*04b4:*/	0x78,  /* .####... */
+/* --- new character f (102) starting at offset 0x04b5 --- */
+	/*04b5:*/	4, 5, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*04ba:*/	0x38,  /* ..###... */
+	/*04bb:*/	0x60,  /* .##..... */
+	/*04bc:*/	0x60,  /* .##..... */
+	/*04bd:*/	0xf0,  /* ####.... */
+	/*04be:*/	0x60,  /* .##..... */
+	/*04bf:*/	0x60,  /* .##..... */
+	/*04c0:*/	0x60,  /* .##..... */
+	/*04c1:*/	0x60,  /* .##..... */
+	/*04c2:*/	0x60,  /* .##..... */
+	/*04c3:*/	0x60,  /* .##..... */
+	/*04c4:*/	0x60,  /* .##..... */
+/* --- new character g (103) starting at offset 0x04c5 --- */
+	/*04c5:*/	9, 7, 11, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*04ca:*/	0x3a,  /* ..###.#. */
+	/*04cb:*/	0x6e,  /* .##.###. */
+	/*04cc:*/	0xc6,  /* ##...##. */
+	/*04cd:*/	0xc6,  /* ##...##. */
+	/*04ce:*/	0xc6,  /* ##...##. */
+	/*04cf:*/	0xc6,  /* ##...##. */
+	/*04d0:*/	0x6e,  /* .##.###. */
+	/*04d1:*/	0x3e,  /* ..#####. */
+	/*04d2:*/	0x06,  /* .....##. */
+	/*04d3:*/	0xce,  /* ##..###. */
+	/*04d4:*/	0x7c,  /* .#####.. */
+/* --- new character h (104) starting at offset 0x04d5 --- */
+	/*04d5:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*04da:*/	0xc0,  /* ##...... */
+	/*04db:*/	0xc0,  /* ##...... */
+	/*04dc:*/	0xc0,  /* ##...... */
+	/*04dd:*/	0xdc,  /* ##.###.. */
+	/*04de:*/	0xee,  /* ###.###. */
+	/*04df:*/	0xc6,  /* ##...##. */
+	/*04e0:*/	0xc6,  /* ##...##. */
+	/*04e1:*/	0xc6,  /* ##...##. */
+	/*04e2:*/	0xc6,  /* ##...##. */
+	/*04e3:*/	0xc6,  /* ##...##. */
+	/*04e4:*/	0xc6,  /* ##...##. */
+/* --- new character i (105) starting at offset 0x04e5 --- */
+	/*04e5:*/	4, 2, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*04ea:*/	0xc0,  /* ##...... */
+	/*04eb:*/	0xc0,  /* ##...... */
+	/*04ec:*/	0x00,  /* ........ */
+	/*04ed:*/	0xc0,  /* ##...... */
+	/*04ee:*/	0xc0,  /* ##...... */
+	/*04ef:*/	0xc0,  /* ##...... */
+	/*04f0:*/	0xc0,  /* ##...... */
+	/*04f1:*/	0xc0,  /* ##...... */
+	/*04f2:*/	0xc0,  /* ##...... */
+	/*04f3:*/	0xc0,  /* ##...... */
+	/*04f4:*/	0xc0,  /* ##...... */
+/* --- new character j (106) starting at offset 0x04f5 --- */
+	/*04f5:*/	4, 3, 14, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*04fa:*/	0x60,  /* .##..... */
+	/*04fb:*/	0x60,  /* .##..... */
+	/*04fc:*/	0x00,  /* ........ */
+	/*04fd:*/	0x60,  /* .##..... */
+	/*04fe:*/	0x60,  /* .##..... */
+	/*04ff:*/	0x60,  /* .##..... */
+	/*0500:*/	0x60,  /* .##..... */
+	/*0501:*/	0x60,  /* .##..... */
+	/*0502:*/	0x60,  /* .##..... */
+	/*0503:*/	0x60,  /* .##..... */
+	/*0504:*/	0x60,  /* .##..... */
+	/*0505:*/	0x60,  /* .##..... */
+	/*0506:*/	0xe0,  /* ###..... */
+	/*0507:*/	0xc0,  /* ##...... */
+/* --- new character k (107) starting at offset 0x0508 --- */
+	/*0508:*/	8, 6, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*050d:*/	0xc0,  /* ##...... */
+	/*050e:*/	0xc0,  /* ##...... */
+	/*050f:*/	0xc0,  /* ##...... */
+	/*0510:*/	0xcc,  /* ##..##.. */
+	/*0511:*/	0xd8,  /* ##.##... */
+	/*0512:*/	0xf0,  /* ####.... */
+	/*0513:*/	0xf0,  /* ####.... */
+	/*0514:*/	0xd8,  /* ##.##... */
+	/*0515:*/	0xd8,  /* ##.##... */
+	/*0516:*/	0xcc,  /* ##..##.. */
+	/*0517:*/	0xcc,  /* ##..##.. */
+/* --- new character l (108) starting at offset 0x0518 --- */
+	/*0518:*/	4, 2, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*051d:*/	0xc0,  /* ##...... */
+	/*051e:*/	0xc0,  /* ##...... */
+	/*051f:*/	0xc0,  /* ##...... */
+	/*0520:*/	0xc0,  /* ##...... */
+	/*0521:*/	0xc0,  /* ##...... */
+	/*0522:*/	0xc0,  /* ##...... */
+	/*0523:*/	0xc0,  /* ##...... */
+	/*0524:*/	0xc0,  /* ##...... */
+	/*0525:*/	0xc0,  /* ##...... */
+	/*0526:*/	0xc0,  /* ##...... */
+	/*0527:*/	0xc0,  /* ##...... */
+/* --- new character m (109) starting at offset 0x0528 --- */
+	/*0528:*/	12, 10, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*052d:*/	0xdb,0x80,  /* ##.##.###....... */
+	/*052f:*/	0xee,0xc0,  /* ###.###.##...... */
+	/*0531:*/	0xcc,0xc0,  /* ##..##..##...... */
+	/*0533:*/	0xcc,0xc0,  /* ##..##..##...... */
+	/*0535:*/	0xcc,0xc0,  /* ##..##..##...... */
+	/*0537:*/	0xcc,0xc0,  /* ##..##..##...... */
+	/*0539:*/	0xcc,0xc0,  /* ##..##..##...... */
+	/*053b:*/	0xcc,0xc0,  /* ##..##..##...... */
+/* --- new character n (110) starting at offset 0x053d --- */
+	/*053d:*/	9, 7, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0542:*/	0xdc,  /* ##.###.. */
+	/*0543:*/	0xee,  /* ###.###. */
+	/*0544:*/	0xc6,  /* ##...##. */
+	/*0545:*/	0xc6,  /* ##...##. */
+	/*0546:*/	0xc6,  /* ##...##. */
+	/*0547:*/	0xc6,  /* ##...##. */
+	/*0548:*/	0xc6,  /* ##...##. */
+	/*0549:*/	0xc6,  /* ##...##. */
+/* --- new character o (111) starting at offset 0x054a --- */
+	/*054a:*/	9, 7, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*054f:*/	0x38,  /* ..###... */
+	/*0550:*/	0x6c,  /* .##.##.. */
+	/*0551:*/	0xc6,  /* ##...##. */
+	/*0552:*/	0xc6,  /* ##...##. */
+	/*0553:*/	0xc6,  /* ##...##. */
+	/*0554:*/	0xc6,  /* ##...##. */
+	/*0555:*/	0x6c,  /* .##.##.. */
+	/*0556:*/	0x38,  /* ..###... */
+/* --- new character p (112) starting at offset 0x0557 --- */
+	/*0557:*/	9, 7, 11, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*055c:*/	0xd8,  /* ##.##... */
+	/*055d:*/	0xec,  /* ###.##.. */
+	/*055e:*/	0xc6,  /* ##...##. */
+	/*055f:*/	0xc6,  /* ##...##. */
+	/*0560:*/	0xc6,  /* ##...##. */
+	/*0561:*/	0xc6,  /* ##...##. */
+	/*0562:*/	0xec,  /* ###.##.. */
+	/*0563:*/	0xf8,  /* #####... */
+	/*0564:*/	0xc0,  /* ##...... */
+	/*0565:*/	0xc0,  /* ##...... */
+	/*0566:*/	0xc0,  /* ##...... */
+/* --- new character q (113) starting at offset 0x0567 --- */
+	/*0567:*/	9, 7, 11, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*056c:*/	0x36,  /* ..##.##. */
+	/*056d:*/	0x6e,  /* .##.###. */
+	/*056e:*/	0xc6,  /* ##...##. */
+	/*056f:*/	0xc6,  /* ##...##. */
+	/*0570:*/	0xc6,  /* ##...##. */
+	/*0571:*/	0xc6,  /* ##...##. */
+	/*0572:*/	0x6e,  /* .##.###. */
+	/*0573:*/	0x3e,  /* ..#####. */
+	/*0574:*/	0x06,  /* .....##. */
+	/*0575:*/	0x06,  /* .....##. */
+	/*0576:*/	0x06,  /* .....##. */
+/* --- new character r (114) starting at offset 0x0577 --- */
+	/*0577:*/	6, 5, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*057c:*/	0xd8,  /* ##.##... */
+	/*057d:*/	0xf8,  /* #####... */
+	/*057e:*/	0xc0,  /* ##...... */
+	/*057f:*/	0xc0,  /* ##...... */
+	/*0580:*/	0xc0,  /* ##...... */
+	/*0581:*/	0xc0,  /* ##...... */
+	/*0582:*/	0xc0,  /* ##...... */
+	/*0583:*/	0xc0,  /* ##...... */
+/* --- new character s (115) starting at offset 0x0584 --- */
+	/*0584:*/	8, 6, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0589:*/	0x78,  /* .####... */
+	/*058a:*/	0xec,  /* ###.##.. */
+	/*058b:*/	0xc0,  /* ##...... */
+	/*058c:*/	0x78,  /* .####... */
+	/*058d:*/	0x1c,  /* ...###.. */
+	/*058e:*/	0x0c,  /* ....##.. */
+	/*058f:*/	0xec,  /* ###.##.. */
+	/*0590:*/	0x78,  /* .####... */
+/* --- new character t (116) starting at offset 0x0591 --- */
+	/*0591:*/	5, 5, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0596:*/	0x60,  /* .##..... */
+	/*0597:*/	0x60,  /* .##..... */
+	/*0598:*/	0xf8,  /* #####... */
+	/*0599:*/	0x60,  /* .##..... */
+	/*059a:*/	0x60,  /* .##..... */
+	/*059b:*/	0x60,  /* .##..... */
+	/*059c:*/	0x60,  /* .##..... */
+	/*059d:*/	0x60,  /* .##..... */
+	/*059e:*/	0x68,  /* .##.#... */
+	/*059f:*/	0x30,  /* ..##.... */
+/* --- new character u (117) starting at offset 0x05a0 --- */
+	/*05a0:*/	9, 7, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*05a5:*/	0xc6,  /* ##...##. */
+	/*05a6:*/	0xc6,  /* ##...##. */
+	/*05a7:*/	0xc6,  /* ##...##. */
+	/*05a8:*/	0xc6,  /* ##...##. */
+	/*05a9:*/	0xc6,  /* ##...##. */
+	/*05aa:*/	0xc6,  /* ##...##. */
+	/*05ab:*/	0xee,  /* ###.###. */
+	/*05ac:*/	0x76,  /* .###.##. */
+/* --- new character v (118) starting at offset 0x05ad --- */
+	/*05ad:*/	8, 8, 8, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*05b2:*/	0xc3,  /* ##....## */
+	/*05b3:*/	0xc3,  /* ##....## */
+	/*05b4:*/	0x66,  /* .##..##. */
+	/*05b5:*/	0x66,  /* .##..##. */
+	/*05b6:*/	0x24,  /* ..#..#.. */
+	/*05b7:*/	0x3c,  /* ..####.. */
+	/*05b8:*/	0x18,  /* ...##... */
+	/*05b9:*/	0x18,  /* ...##... */
+/* --- new character w (119) starting at offset 0x05ba --- */
+	/*05ba:*/	10, 10, 8, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*05bf:*/	0xcc,0xc0,  /* ##..##..##...... */
+	/*05c1:*/	0xcc,0xc0,  /* ##..##..##...... */
+	/*05c3:*/	0xcc,0xc0,  /* ##..##..##...... */
+	/*05c5:*/	0x6d,0x80,  /* .##.##.##....... */
+	/*05c7:*/	0x6d,0x80,  /* .##.##.##....... */
+	/*05c9:*/	0x33,0x00,  /* ..##..##........ */
+	/*05cb:*/	0x33,0x00,  /* ..##..##........ */
+	/*05cd:*/	0x33,0x00,  /* ..##..##........ */
+/* --- new character x (120) starting at offset 0x05cf --- */
+	/*05cf:*/	7, 7, 8, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*05d4:*/	0xc6,  /* ##...##. */
+	/*05d5:*/	0xc6,  /* ##...##. */
+	/*05d6:*/	0x6c,  /* .##.##.. */
+	/*05d7:*/	0x38,  /* ..###... */
+	/*05d8:*/	0x38,  /* ..###... */
+	/*05d9:*/	0x6c,  /* .##.##.. */
+	/*05da:*/	0xc6,  /* ##...##. */
+	/*05db:*/	0xc6,  /* ##...##. */
+/* --- new character y (121) starting at offset 0x05dc --- */
+	/*05dc:*/	8, 8, 11, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*05e1:*/	0xc3,  /* ##....## */
+	/*05e2:*/	0xc3,  /* ##....## */
+	/*05e3:*/	0x66,  /* .##..##. */
+	/*05e4:*/	0x66,  /* .##..##. */
+	/*05e5:*/	0x24,  /* ..#..#.. */
+	/*05e6:*/	0x3c,  /* ..####.. */
+	/*05e7:*/	0x18,  /* ...##... */
+	/*05e8:*/	0x18,  /* ...##... */
+	/*05e9:*/	0x18,  /* ...##... */
+	/*05ea:*/	0x30,  /* ..##.... */
+	/*05eb:*/	0x70,  /* .###.... */
+/* --- new character z (122) starting at offset 0x05ec --- */
+	/*05ec:*/	6, 6, 8, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*05f1:*/	0xfc,  /* ######.. */
+	/*05f2:*/	0x0c,  /* ....##.. */
+	/*05f3:*/	0x18,  /* ...##... */
+	/*05f4:*/	0x30,  /* ..##.... */
+	/*05f5:*/	0x30,  /* ..##.... */
+	/*05f6:*/	0x60,  /* .##..... */
+	/*05f7:*/	0xc0,  /* ##...... */
+	/*05f8:*/	0xfc,  /* ######.. */
+/* --- new character braceleft (123) starting at offset 0x05f9 --- */
+	/*05f9:*/	6, 5, 14, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*05fe:*/	0x18,  /* ...##... */
+	/*05ff:*/	0x30,  /* ..##.... */
+	/*0600:*/	0x30,  /* ..##.... */
+	/*0601:*/	0x30,  /* ..##.... */
+	/*0602:*/	0x30,  /* ..##.... */
+	/*0603:*/	0x60,  /* .##..... */
+	/*0604:*/	0xc0,  /* ##...... */
+	/*0605:*/	0x60,  /* .##..... */
+	/*0606:*/	0x30,  /* ..##.... */
+	/*0607:*/	0x30,  /* ..##.... */
+	/*0608:*/	0x30,  /* ..##.... */
+	/*0609:*/	0x30,  /* ..##.... */
+	/*060a:*/	0x30,  /* ..##.... */
+	/*060b:*/	0x18,  /* ...##... */
+/* --- new character bar (124) starting at offset 0x060c --- */
+	/*060c:*/	4, 2, 14, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*0611:*/	0xc0,  /* ##...... */
+	/*0612:*/	0xc0,  /* ##...... */
+	/*0613:*/	0xc0,  /* ##...... */
+	/*0614:*/	0xc0,  /* ##...... */
+	/*0615:*/	0xc0,  /* ##...... */
+	/*0616:*/	0xc0,  /* ##...... */
+	/*0617:*/	0xc0,  /* ##...... */
+	/*0618:*/	0xc0,  /* ##...... */
+	/*0619:*/	0xc0,  /* ##...... */
+	/*061a:*/	0xc0,  /* ##...... */
+	/*061b:*/	0xc0,  /* ##...... */
+	/*061c:*/	0xc0,  /* ##...... */
+	/*061d:*/	0xc0,  /* ##...... */
+	/*061e:*/	0xc0,  /* ##...... */
+/* --- new character braceright (125) starting at offset 0x061f --- */
+	/*061f:*/	6, 5, 14, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*0624:*/	0xc0,  /* ##...... */
+	/*0625:*/	0x60,  /* .##..... */
+	/*0626:*/	0x60,  /* .##..... */
+	/*0627:*/	0x60,  /* .##..... */
+	/*0628:*/	0x60,  /* .##..... */
+	/*0629:*/	0x30,  /* ..##.... */
+	/*062a:*/	0x18,  /* ...##... */
+	/*062b:*/	0x30,  /* ..##.... */
+	/*062c:*/	0x60,  /* .##..... */
+	/*062d:*/	0x60,  /* .##..... */
+	/*062e:*/	0x60,  /* .##..... */
+	/*062f:*/	0x60,  /* .##..... */
+	/*0630:*/	0x60,  /* .##..... */
+	/*0631:*/	0xc0,  /* ##...... */
+/* --- new character asciitilde (126) starting at offset 0x0632 --- */
+	/*0632:*/	9, 7, 3, 1, 3, /* width and bbox (w,h,x,y) */ 
+	/*0637:*/	0x72,  /* .###..#. */
+	/*0638:*/	0xde,  /* ##.####. */
+	/*0639:*/	0x8c,  /* #...##.. */
+};
+static const uint16_t font_helvB14_offsets[] = {
+0x0000 /* space */,
+	0x0006 /* exclam */,
+	0x0016 /* quotedbl */,
+	0x001e /* numbersign */,
+	0x0037 /* dollar */,
+	0x0049 /* percent */,
+	0x0062 /* ampersand */,
+	0x007b /* quotesingle */,
+	0x0083 /* parenleft */,
+	0x0096 /* parenright */,
+	0x00a9 /* asterisk */,
+	0x00b2 /* plus */,
+	0x00be /* comma */,
+	0x00c6 /* hyphen */,
+	0x00cc /* period */,
+	0x00d3 /* slash */,
+	0x00e3 /* zero */,
+	0x00f2 /* one */,
+	0x0101 /* two */,
+	0x0110 /* three */,
+	0x011f /* four */,
+	0x012e /* five */,
+	0x013d /* six */,
+	0x014c /* seven */,
+	0x015b /* eight */,
+	0x016a /* nine */,
+	0x0179 /* colon */,
+	0x0186 /* semicolon */,
+	0x0194 /* less */,
+	0x019e /* equal */,
+	0x01a6 /* greater */,
+	0x01b0 /* question */,
+	0x01c0 /* at */,
+	0x01dd /* A */,
+	0x01f8 /* B */,
+	0x0208 /* C */,
+	0x0223 /* D */,
+	0x023e /* E */,
+	0x024e /* F */,
+	0x025e /* G */,
+	0x0279 /* H */,
+	0x0289 /* I */,
+	0x0299 /* J */,
+	0x02a9 /* K */,
+	0x02c4 /* L */,
+	0x02d4 /* M */,
+	0x02ef /* N */,
+	0x030a /* O */,
+	0x0325 /* P */,
+	0x0335 /* Q */,
+	0x0350 /* R */,
+	0x036b /* S */,
+	0x037b /* T */,
+	0x038b /* U */,
+	0x03a6 /* V */,
+	0x03c1 /* W */,
+	0x03dc /* X */,
+	0x03f7 /* Y */,
+	0x0412 /* Z */,
+	0x0422 /* bracketleft */,
+	0x0435 /* backslash */,
+	0x0445 /* bracketright */,
+	0x0458 /* asciicircum */,
+	0x0461 /* underscore */,
+	0x0467 /* grave */,
+	0x046e /* a */,
+	0x047b /* b */,
+	0x048b /* c */,
+	0x0498 /* d */,
+	0x04a8 /* e */,
+	0x04b5 /* f */,
+	0x04c5 /* g */,
+	0x04d5 /* h */,
+	0x04e5 /* i */,
+	0x04f5 /* j */,
+	0x0508 /* k */,
+	0x0518 /* l */,
+	0x0528 /* m */,
+	0x053d /* n */,
+	0x054a /* o */,
+	0x0557 /* p */,
+	0x0567 /* q */,
+	0x0577 /* r */,
+	0x0584 /* s */,
+	0x0591 /* t */,
+	0x05a0 /* u */,
+	0x05ad /* v */,
+	0x05ba /* w */,
+	0x05cf /* x */,
+	0x05dc /* y */,
+	0x05ec /* z */,
+	0x05f9 /* braceleft */,
+	0x060c /* bar */,
+	0x061f /* braceright */,
+	0x0632 /* asciitilde */,
+	0xffff /* (no glyph) */
+};
+const struct fb_font font_helvB14 = {
+	.height = 16,
+	.ascent = 13,
+	.firstchar = 32, /* space */
+	.lastchar = 127, /* ? */
+	.chardata = font_helvB14_data,
+	.charoffs = font_helvB14_offsets,
+};
diff --git a/src/target/firmware/fb/helvB24.c b/src/target/firmware/fb/helvB24.c
new file mode 100644
index 00000000..509b9db5
--- /dev/null
+++ b/src/target/firmware/fb/helvB24.c
@@ -0,0 +1,1871 @@
+#include <fb/font.h>
+static const uint8_t font_helvB24_data[] = {
+/* --- new character space (32) starting at offset 0x0000 --- */
+	/*0000:*/	6, 1, 1, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0005:*/	0x00,  /* ........ */
+/* --- new character exclam (33) starting at offset 0x0006 --- */
+	/*0006:*/	7, 3, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*000b:*/	0xe0,  /* ###..... */
+	/*000c:*/	0xe0,  /* ###..... */
+	/*000d:*/	0xe0,  /* ###..... */
+	/*000e:*/	0xe0,  /* ###..... */
+	/*000f:*/	0xe0,  /* ###..... */
+	/*0010:*/	0xe0,  /* ###..... */
+	/*0011:*/	0xe0,  /* ###..... */
+	/*0012:*/	0xe0,  /* ###..... */
+	/*0013:*/	0xe0,  /* ###..... */
+	/*0014:*/	0xe0,  /* ###..... */
+	/*0015:*/	0xe0,  /* ###..... */
+	/*0016:*/	0xe0,  /* ###..... */
+	/*0017:*/	0xe0,  /* ###..... */
+	/*0018:*/	0xe0,  /* ###..... */
+	/*0019:*/	0x00,  /* ........ */
+	/*001a:*/	0x00,  /* ........ */
+	/*001b:*/	0xe0,  /* ###..... */
+	/*001c:*/	0xe0,  /* ###..... */
+	/*001d:*/	0xe0,  /* ###..... */
+/* --- new character quotedbl (34) starting at offset 0x001e --- */
+	/*001e:*/	9, 5, 6, 2, 13, /* width and bbox (w,h,x,y) */ 
+	/*0023:*/	0xd8,  /* ##.##... */
+	/*0024:*/	0xd8,  /* ##.##... */
+	/*0025:*/	0xd8,  /* ##.##... */
+	/*0026:*/	0xd8,  /* ##.##... */
+	/*0027:*/	0xd8,  /* ##.##... */
+	/*0028:*/	0x90,  /* #..#.... */
+/* --- new character numbersign (35) starting at offset 0x0029 --- */
+	/*0029:*/	14, 12, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*002e:*/	0x0c,0xc0,  /* ....##..##...... */
+	/*0030:*/	0x0c,0xc0,  /* ....##..##...... */
+	/*0032:*/	0x0c,0xc0,  /* ....##..##...... */
+	/*0034:*/	0x0c,0xc0,  /* ....##..##...... */
+	/*0036:*/	0x0c,0xc0,  /* ....##..##...... */
+	/*0038:*/	0x7f,0xf0,  /* .###########.... */
+	/*003a:*/	0x7f,0xf0,  /* .###########.... */
+	/*003c:*/	0x19,0x80,  /* ...##..##....... */
+	/*003e:*/	0x19,0x80,  /* ...##..##....... */
+	/*0040:*/	0x19,0x80,  /* ...##..##....... */
+	/*0042:*/	0x19,0x80,  /* ...##..##....... */
+	/*0044:*/	0xff,0xe0,  /* ###########..... */
+	/*0046:*/	0xff,0xe0,  /* ###########..... */
+	/*0048:*/	0x33,0x00,  /* ..##..##........ */
+	/*004a:*/	0x33,0x00,  /* ..##..##........ */
+	/*004c:*/	0x33,0x00,  /* ..##..##........ */
+	/*004e:*/	0x33,0x00,  /* ..##..##........ */
+	/*0050:*/	0x33,0x00,  /* ..##..##........ */
+/* --- new character dollar (36) starting at offset 0x0052 --- */
+	/*0052:*/	13, 12, 21, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*0057:*/	0x06,0x00,  /* .....##......... */
+	/*0059:*/	0x3f,0x80,  /* ..#######....... */
+	/*005b:*/	0x7f,0xc0,  /* .#########...... */
+	/*005d:*/	0xf6,0xe0,  /* ####.##.###..... */
+	/*005f:*/	0xe6,0xe0,  /* ###..##.###..... */
+	/*0061:*/	0xe6,0xe0,  /* ###..##.###..... */
+	/*0063:*/	0xf6,0x00,  /* ####.##......... */
+	/*0065:*/	0x7e,0x00,  /* .######......... */
+	/*0067:*/	0x3e,0x00,  /* ..#####......... */
+	/*0069:*/	0x0f,0x00,  /* ....####........ */
+	/*006b:*/	0x07,0xc0,  /* .....#####...... */
+	/*006d:*/	0x07,0xe0,  /* .....######..... */
+	/*006f:*/	0x06,0xf0,  /* .....##.####.... */
+	/*0071:*/	0xe6,0x70,  /* ###..##..###.... */
+	/*0073:*/	0xe6,0x70,  /* ###..##..###.... */
+	/*0075:*/	0xe6,0x70,  /* ###..##..###.... */
+	/*0077:*/	0xf6,0xf0,  /* ####.##.####.... */
+	/*0079:*/	0x7f,0xe0,  /* .##########..... */
+	/*007b:*/	0x1f,0xc0,  /* ...#######...... */
+	/*007d:*/	0x06,0x00,  /* .....##......... */
+	/*007f:*/	0x06,0x00,  /* .....##......... */
+/* --- new character percent (37) starting at offset 0x0081 --- */
+	/*0081:*/	22, 21, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0086:*/	0x00,0x07,0x00,  /* .............###........ */
+	/*0089:*/	0x3e,0x07,0x00,  /* ..#####......###........ */
+	/*008c:*/	0x7f,0x0e,0x00,  /* .#######....###......... */
+	/*008f:*/	0xe3,0x8e,0x00,  /* ###...###...###......... */
+	/*0092:*/	0xc1,0x9c,0x00,  /* ##.....##..###.......... */
+	/*0095:*/	0xc1,0x9c,0x00,  /* ##.....##..###.......... */
+	/*0098:*/	0xe3,0xb8,0x00,  /* ###...###.###........... */
+	/*009b:*/	0x7f,0x38,0x00,  /* .#######..###........... */
+	/*009e:*/	0x3e,0x70,0x00,  /* ..#####..###............ */
+	/*00a1:*/	0x00,0x70,0x00,  /* .........###............ */
+	/*00a4:*/	0x00,0xe3,0xe0,  /* ........###...#####..... */
+	/*00a7:*/	0x00,0xe7,0xf0,  /* ........###..#######.... */
+	/*00aa:*/	0x01,0xce,0x38,  /* .......###..###...###... */
+	/*00ad:*/	0x01,0xcc,0x18,  /* .......###..##.....##... */
+	/*00b0:*/	0x03,0x8c,0x18,  /* ......###...##.....##... */
+	/*00b3:*/	0x03,0x8e,0x38,  /* ......###...###...###... */
+	/*00b6:*/	0x07,0x07,0xf0,  /* .....###.....#######.... */
+	/*00b9:*/	0x07,0x03,0xe0,  /* .....###......#####..... */
+/* --- new character ampersand (38) starting at offset 0x00bc --- */
+	/*00bc:*/	18, 16, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00c1:*/	0x0f,0x80,  /* ....#####....... */
+	/*00c3:*/	0x1f,0xc0,  /* ...#######...... */
+	/*00c5:*/	0x3d,0xe0,  /* ..####.####..... */
+	/*00c7:*/	0x38,0xe0,  /* ..###...###..... */
+	/*00c9:*/	0x38,0xe0,  /* ..###...###..... */
+	/*00cb:*/	0x38,0xe0,  /* ..###...###..... */
+	/*00cd:*/	0x1d,0xc0,  /* ...###.###...... */
+	/*00cf:*/	0x0f,0x80,  /* ....#####....... */
+	/*00d1:*/	0x1f,0x00,  /* ...#####........ */
+	/*00d3:*/	0x3f,0x9c,  /* ..#######..###.. */
+	/*00d5:*/	0x7b,0xdc,  /* .####.####.###.. */
+	/*00d7:*/	0x71,0xfc,  /* .###...#######.. */
+	/*00d9:*/	0xe0,0xf8,  /* ###.....#####... */
+	/*00db:*/	0xe0,0x70,  /* ###......###.... */
+	/*00dd:*/	0xe0,0xf8,  /* ###.....#####... */
+	/*00df:*/	0xf1,0xfc,  /* ####...#######.. */
+	/*00e1:*/	0x7f,0xce,  /* .#########..###. */
+	/*00e3:*/	0x1f,0x87,  /* ...######....### */
+/* --- new character quotesingle (39) starting at offset 0x00e5 --- */
+	/*00e5:*/	6, 2, 6, 2, 13, /* width and bbox (w,h,x,y) */ 
+	/*00ea:*/	0xc0,  /* ##...... */
+	/*00eb:*/	0xc0,  /* ##...... */
+	/*00ec:*/	0xc0,  /* ##...... */
+	/*00ed:*/	0xc0,  /* ##...... */
+	/*00ee:*/	0xc0,  /* ##...... */
+	/*00ef:*/	0x80,  /* #....... */
+/* --- new character parenleft (40) starting at offset 0x00f0 --- */
+	/*00f0:*/	8, 6, 24, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*00f5:*/	0x0c,  /* ....##.. */
+	/*00f6:*/	0x1c,  /* ...###.. */
+	/*00f7:*/	0x38,  /* ..###... */
+	/*00f8:*/	0x38,  /* ..###... */
+	/*00f9:*/	0x70,  /* .###.... */
+	/*00fa:*/	0x70,  /* .###.... */
+	/*00fb:*/	0x60,  /* .##..... */
+	/*00fc:*/	0xe0,  /* ###..... */
+	/*00fd:*/	0xe0,  /* ###..... */
+	/*00fe:*/	0xe0,  /* ###..... */
+	/*00ff:*/	0xe0,  /* ###..... */
+	/*0100:*/	0xe0,  /* ###..... */
+	/*0101:*/	0xe0,  /* ###..... */
+	/*0102:*/	0xe0,  /* ###..... */
+	/*0103:*/	0xe0,  /* ###..... */
+	/*0104:*/	0xe0,  /* ###..... */
+	/*0105:*/	0xe0,  /* ###..... */
+	/*0106:*/	0x60,  /* .##..... */
+	/*0107:*/	0x70,  /* .###.... */
+	/*0108:*/	0x70,  /* .###.... */
+	/*0109:*/	0x38,  /* ..###... */
+	/*010a:*/	0x38,  /* ..###... */
+	/*010b:*/	0x1c,  /* ...###.. */
+	/*010c:*/	0x0c,  /* ....##.. */
+/* --- new character parenright (41) starting at offset 0x010d --- */
+	/*010d:*/	8, 6, 24, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*0112:*/	0xc0,  /* ##...... */
+	/*0113:*/	0xe0,  /* ###..... */
+	/*0114:*/	0x70,  /* .###.... */
+	/*0115:*/	0x70,  /* .###.... */
+	/*0116:*/	0x38,  /* ..###... */
+	/*0117:*/	0x38,  /* ..###... */
+	/*0118:*/	0x18,  /* ...##... */
+	/*0119:*/	0x1c,  /* ...###.. */
+	/*011a:*/	0x1c,  /* ...###.. */
+	/*011b:*/	0x1c,  /* ...###.. */
+	/*011c:*/	0x1c,  /* ...###.. */
+	/*011d:*/	0x1c,  /* ...###.. */
+	/*011e:*/	0x1c,  /* ...###.. */
+	/*011f:*/	0x1c,  /* ...###.. */
+	/*0120:*/	0x1c,  /* ...###.. */
+	/*0121:*/	0x1c,  /* ...###.. */
+	/*0122:*/	0x1c,  /* ...###.. */
+	/*0123:*/	0x18,  /* ...##... */
+	/*0124:*/	0x38,  /* ..###... */
+	/*0125:*/	0x38,  /* ..###... */
+	/*0126:*/	0x70,  /* .###.... */
+	/*0127:*/	0x70,  /* .###.... */
+	/*0128:*/	0xe0,  /* ###..... */
+	/*0129:*/	0xc0,  /* ##...... */
+/* --- new character asterisk (42) starting at offset 0x012a --- */
+	/*012a:*/	10, 8, 7, 1, 12, /* width and bbox (w,h,x,y) */ 
+	/*012f:*/	0x18,  /* ...##... */
+	/*0130:*/	0x18,  /* ...##... */
+	/*0131:*/	0xdb,  /* ##.##.## */
+	/*0132:*/	0xff,  /* ######## */
+	/*0133:*/	0x3c,  /* ..####.. */
+	/*0134:*/	0x66,  /* .##..##. */
+	/*0135:*/	0x66,  /* .##..##. */
+/* --- new character plus (43) starting at offset 0x0136 --- */
+	/*0136:*/	15, 11, 12, 2, 1, /* width and bbox (w,h,x,y) */ 
+	/*013b:*/	0x0e,0x00,  /* ....###......... */
+	/*013d:*/	0x0e,0x00,  /* ....###......... */
+	/*013f:*/	0x0e,0x00,  /* ....###......... */
+	/*0141:*/	0x0e,0x00,  /* ....###......... */
+	/*0143:*/	0x0e,0x00,  /* ....###......... */
+	/*0145:*/	0xff,0xe0,  /* ###########..... */
+	/*0147:*/	0xff,0xe0,  /* ###########..... */
+	/*0149:*/	0x0e,0x00,  /* ....###......... */
+	/*014b:*/	0x0e,0x00,  /* ....###......... */
+	/*014d:*/	0x0e,0x00,  /* ....###......... */
+	/*014f:*/	0x0e,0x00,  /* ....###......... */
+	/*0151:*/	0x0e,0x00,  /* ....###......... */
+/* --- new character comma (44) starting at offset 0x0153 --- */
+	/*0153:*/	7, 3, 6, 2, -3, /* width and bbox (w,h,x,y) */ 
+	/*0158:*/	0xe0,  /* ###..... */
+	/*0159:*/	0xe0,  /* ###..... */
+	/*015a:*/	0xe0,  /* ###..... */
+	/*015b:*/	0x60,  /* .##..... */
+	/*015c:*/	0x60,  /* .##..... */
+	/*015d:*/	0xc0,  /* ##...... */
+/* --- new character hyphen (45) starting at offset 0x015e --- */
+	/*015e:*/	8, 7, 3, 0, 6, /* width and bbox (w,h,x,y) */ 
+	/*0163:*/	0xfe,  /* #######. */
+	/*0164:*/	0xfe,  /* #######. */
+	/*0165:*/	0xfe,  /* #######. */
+/* --- new character period (46) starting at offset 0x0166 --- */
+	/*0166:*/	7, 3, 3, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*016b:*/	0xe0,  /* ###..... */
+	/*016c:*/	0xe0,  /* ###..... */
+	/*016d:*/	0xe0,  /* ###..... */
+/* --- new character slash (47) starting at offset 0x016e --- */
+	/*016e:*/	8, 8, 19, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0173:*/	0x07,  /* .....### */
+	/*0174:*/	0x07,  /* .....### */
+	/*0175:*/	0x06,  /* .....##. */
+	/*0176:*/	0x06,  /* .....##. */
+	/*0177:*/	0x0e,  /* ....###. */
+	/*0178:*/	0x0c,  /* ....##.. */
+	/*0179:*/	0x0c,  /* ....##.. */
+	/*017a:*/	0x1c,  /* ...###.. */
+	/*017b:*/	0x1c,  /* ...###.. */
+	/*017c:*/	0x18,  /* ...##... */
+	/*017d:*/	0x18,  /* ...##... */
+	/*017e:*/	0x38,  /* ..###... */
+	/*017f:*/	0x30,  /* ..##.... */
+	/*0180:*/	0x30,  /* ..##.... */
+	/*0181:*/	0x70,  /* .###.... */
+	/*0182:*/	0x60,  /* .##..... */
+	/*0183:*/	0x60,  /* .##..... */
+	/*0184:*/	0xe0,  /* ###..... */
+	/*0185:*/	0xe0,  /* ###..... */
+/* --- new character zero (48) starting at offset 0x0186 --- */
+	/*0186:*/	13, 12, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*018b:*/	0x1f,0x80,  /* ...######....... */
+	/*018d:*/	0x3f,0xc0,  /* ..########...... */
+	/*018f:*/	0x79,0xe0,  /* .####..####..... */
+	/*0191:*/	0x70,0xe0,  /* .###....###..... */
+	/*0193:*/	0x70,0xe0,  /* .###....###..... */
+	/*0195:*/	0xe0,0x70,  /* ###......###.... */
+	/*0197:*/	0xe0,0x70,  /* ###......###.... */
+	/*0199:*/	0xe0,0x70,  /* ###......###.... */
+	/*019b:*/	0xe0,0x70,  /* ###......###.... */
+	/*019d:*/	0xe0,0x70,  /* ###......###.... */
+	/*019f:*/	0xe0,0x70,  /* ###......###.... */
+	/*01a1:*/	0xe0,0x70,  /* ###......###.... */
+	/*01a3:*/	0xe0,0x70,  /* ###......###.... */
+	/*01a5:*/	0x70,0xe0,  /* .###....###..... */
+	/*01a7:*/	0x70,0xe0,  /* .###....###..... */
+	/*01a9:*/	0x79,0xe0,  /* .####..####..... */
+	/*01ab:*/	0x3f,0xc0,  /* ..########...... */
+	/*01ad:*/	0x1f,0x80,  /* ...######....... */
+/* --- new character one (49) starting at offset 0x01af --- */
+	/*01af:*/	13, 7, 18, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*01b4:*/	0x0e,  /* ....###. */
+	/*01b5:*/	0x0e,  /* ....###. */
+	/*01b6:*/	0x1e,  /* ...####. */
+	/*01b7:*/	0xfe,  /* #######. */
+	/*01b8:*/	0xfe,  /* #######. */
+	/*01b9:*/	0x0e,  /* ....###. */
+	/*01ba:*/	0x0e,  /* ....###. */
+	/*01bb:*/	0x0e,  /* ....###. */
+	/*01bc:*/	0x0e,  /* ....###. */
+	/*01bd:*/	0x0e,  /* ....###. */
+	/*01be:*/	0x0e,  /* ....###. */
+	/*01bf:*/	0x0e,  /* ....###. */
+	/*01c0:*/	0x0e,  /* ....###. */
+	/*01c1:*/	0x0e,  /* ....###. */
+	/*01c2:*/	0x0e,  /* ....###. */
+	/*01c3:*/	0x0e,  /* ....###. */
+	/*01c4:*/	0x0e,  /* ....###. */
+	/*01c5:*/	0x0e,  /* ....###. */
+/* --- new character two (50) starting at offset 0x01c6 --- */
+	/*01c6:*/	13, 12, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01cb:*/	0x1f,0x00,  /* ...#####........ */
+	/*01cd:*/	0x7f,0xc0,  /* .#########...... */
+	/*01cf:*/	0x71,0xe0,  /* .###...####..... */
+	/*01d1:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*01d3:*/	0xe0,0x70,  /* ###......###.... */
+	/*01d5:*/	0xe0,0x70,  /* ###......###.... */
+	/*01d7:*/	0x00,0x70,  /* .........###.... */
+	/*01d9:*/	0x00,0xe0,  /* ........###..... */
+	/*01db:*/	0x01,0xe0,  /* .......####..... */
+	/*01dd:*/	0x03,0xc0,  /* ......####...... */
+	/*01df:*/	0x07,0x80,  /* .....####....... */
+	/*01e1:*/	0x1f,0x00,  /* ...#####........ */
+	/*01e3:*/	0x3c,0x00,  /* ..####.......... */
+	/*01e5:*/	0x78,0x00,  /* .####........... */
+	/*01e7:*/	0xf0,0x00,  /* ####............ */
+	/*01e9:*/	0xe0,0x00,  /* ###............. */
+	/*01eb:*/	0xff,0xf0,  /* ############.... */
+	/*01ed:*/	0xff,0xf0,  /* ############.... */
+/* --- new character three (51) starting at offset 0x01ef --- */
+	/*01ef:*/	13, 12, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*01f4:*/	0x1f,0x00,  /* ...#####........ */
+	/*01f6:*/	0x7f,0xc0,  /* .#########...... */
+	/*01f8:*/	0x71,0xc0,  /* .###...###...... */
+	/*01fa:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*01fc:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*01fe:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0200:*/	0x00,0xe0,  /* ........###..... */
+	/*0202:*/	0x01,0xc0,  /* .......###...... */
+	/*0204:*/	0x0f,0x80,  /* ....#####....... */
+	/*0206:*/	0x0f,0xe0,  /* ....#######..... */
+	/*0208:*/	0x00,0xe0,  /* ........###..... */
+	/*020a:*/	0x00,0x70,  /* .........###.... */
+	/*020c:*/	0x00,0x70,  /* .........###.... */
+	/*020e:*/	0xe0,0x70,  /* ###......###.... */
+	/*0210:*/	0xe0,0xf0,  /* ###.....####.... */
+	/*0212:*/	0x71,0xe0,  /* .###...####..... */
+	/*0214:*/	0x7f,0xe0,  /* .##########..... */
+	/*0216:*/	0x1f,0x80,  /* ...######....... */
+/* --- new character four (52) starting at offset 0x0218 --- */
+	/*0218:*/	13, 12, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*021d:*/	0x01,0xc0,  /* .......###...... */
+	/*021f:*/	0x03,0xc0,  /* ......####...... */
+	/*0221:*/	0x03,0xc0,  /* ......####...... */
+	/*0223:*/	0x07,0xc0,  /* .....#####...... */
+	/*0225:*/	0x07,0xc0,  /* .....#####...... */
+	/*0227:*/	0x0d,0xc0,  /* ....##.###...... */
+	/*0229:*/	0x1d,0xc0,  /* ...###.###...... */
+	/*022b:*/	0x19,0xc0,  /* ...##..###...... */
+	/*022d:*/	0x31,0xc0,  /* ..##...###...... */
+	/*022f:*/	0x71,0xc0,  /* .###...###...... */
+	/*0231:*/	0x61,0xc0,  /* .##....###...... */
+	/*0233:*/	0xe1,0xc0,  /* ###....###...... */
+	/*0235:*/	0xff,0xf0,  /* ############.... */
+	/*0237:*/	0xff,0xf0,  /* ############.... */
+	/*0239:*/	0x01,0xc0,  /* .......###...... */
+	/*023b:*/	0x01,0xc0,  /* .......###...... */
+	/*023d:*/	0x01,0xc0,  /* .......###...... */
+	/*023f:*/	0x01,0xc0,  /* .......###...... */
+/* --- new character five (53) starting at offset 0x0241 --- */
+	/*0241:*/	13, 12, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0246:*/	0x7f,0xe0,  /* .##########..... */
+	/*0248:*/	0x7f,0xe0,  /* .##########..... */
+	/*024a:*/	0x70,0x00,  /* .###............ */
+	/*024c:*/	0x70,0x00,  /* .###............ */
+	/*024e:*/	0x70,0x00,  /* .###............ */
+	/*0250:*/	0x70,0x00,  /* .###............ */
+	/*0252:*/	0x7f,0x80,  /* .########....... */
+	/*0254:*/	0x7f,0xc0,  /* .#########...... */
+	/*0256:*/	0x71,0xe0,  /* .###...####..... */
+	/*0258:*/	0x00,0xe0,  /* ........###..... */
+	/*025a:*/	0x00,0x70,  /* .........###.... */
+	/*025c:*/	0x00,0x70,  /* .........###.... */
+	/*025e:*/	0x00,0x70,  /* .........###.... */
+	/*0260:*/	0xe0,0x70,  /* ###......###.... */
+	/*0262:*/	0xe0,0xf0,  /* ###.....####.... */
+	/*0264:*/	0xf1,0xe0,  /* ####...####..... */
+	/*0266:*/	0x7f,0xc0,  /* .#########...... */
+	/*0268:*/	0x1f,0x80,  /* ...######....... */
+/* --- new character six (54) starting at offset 0x026a --- */
+	/*026a:*/	13, 12, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*026f:*/	0x0f,0x80,  /* ....#####....... */
+	/*0271:*/	0x3f,0xe0,  /* ..#########..... */
+	/*0273:*/	0x78,0xe0,  /* .####...###..... */
+	/*0275:*/	0x70,0x70,  /* .###.....###.... */
+	/*0277:*/	0xe0,0x70,  /* ###......###.... */
+	/*0279:*/	0xe0,0x00,  /* ###............. */
+	/*027b:*/	0xe0,0x00,  /* ###............. */
+	/*027d:*/	0xef,0x00,  /* ###.####........ */
+	/*027f:*/	0xff,0xc0,  /* ##########...... */
+	/*0281:*/	0xf9,0xe0,  /* #####..####..... */
+	/*0283:*/	0xf0,0xe0,  /* ####....###..... */
+	/*0285:*/	0xe0,0x70,  /* ###......###.... */
+	/*0287:*/	0xe0,0x70,  /* ###......###.... */
+	/*0289:*/	0xe0,0x70,  /* ###......###.... */
+	/*028b:*/	0x70,0xe0,  /* .###....###..... */
+	/*028d:*/	0x79,0xe0,  /* .####..####..... */
+	/*028f:*/	0x3f,0xc0,  /* ..########...... */
+	/*0291:*/	0x1f,0x80,  /* ...######....... */
+/* --- new character seven (55) starting at offset 0x0293 --- */
+	/*0293:*/	13, 12, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0298:*/	0xff,0xf0,  /* ############.... */
+	/*029a:*/	0xff,0xf0,  /* ############.... */
+	/*029c:*/	0x00,0xf0,  /* ........####.... */
+	/*029e:*/	0x00,0xe0,  /* ........###..... */
+	/*02a0:*/	0x01,0xc0,  /* .......###...... */
+	/*02a2:*/	0x01,0xc0,  /* .......###...... */
+	/*02a4:*/	0x03,0x80,  /* ......###....... */
+	/*02a6:*/	0x03,0x80,  /* ......###....... */
+	/*02a8:*/	0x07,0x00,  /* .....###........ */
+	/*02aa:*/	0x07,0x00,  /* .....###........ */
+	/*02ac:*/	0x0e,0x00,  /* ....###......... */
+	/*02ae:*/	0x0e,0x00,  /* ....###......... */
+	/*02b0:*/	0x1e,0x00,  /* ...####......... */
+	/*02b2:*/	0x1c,0x00,  /* ...###.......... */
+	/*02b4:*/	0x1c,0x00,  /* ...###.......... */
+	/*02b6:*/	0x3c,0x00,  /* ..####.......... */
+	/*02b8:*/	0x38,0x00,  /* ..###........... */
+	/*02ba:*/	0x38,0x00,  /* ..###........... */
+/* --- new character eight (56) starting at offset 0x02bc --- */
+	/*02bc:*/	13, 12, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02c1:*/	0x0f,0x00,  /* ....####........ */
+	/*02c3:*/	0x3f,0xc0,  /* ..########...... */
+	/*02c5:*/	0x39,0xc0,  /* ..###..###...... */
+	/*02c7:*/	0x70,0xe0,  /* .###....###..... */
+	/*02c9:*/	0x70,0xe0,  /* .###....###..... */
+	/*02cb:*/	0x70,0xe0,  /* .###....###..... */
+	/*02cd:*/	0x70,0xe0,  /* .###....###..... */
+	/*02cf:*/	0x39,0xc0,  /* ..###..###...... */
+	/*02d1:*/	0x1f,0x80,  /* ...######....... */
+	/*02d3:*/	0x3f,0xc0,  /* ..########...... */
+	/*02d5:*/	0x70,0xe0,  /* .###....###..... */
+	/*02d7:*/	0xe0,0x70,  /* ###......###.... */
+	/*02d9:*/	0xe0,0x70,  /* ###......###.... */
+	/*02db:*/	0xe0,0x70,  /* ###......###.... */
+	/*02dd:*/	0xe0,0x70,  /* ###......###.... */
+	/*02df:*/	0x70,0xe0,  /* .###....###..... */
+	/*02e1:*/	0x7f,0xe0,  /* .##########..... */
+	/*02e3:*/	0x1f,0x80,  /* ...######....... */
+/* --- new character nine (57) starting at offset 0x02e5 --- */
+	/*02e5:*/	13, 12, 18, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*02ea:*/	0x1f,0x80,  /* ...######....... */
+	/*02ec:*/	0x7f,0xc0,  /* .#########...... */
+	/*02ee:*/	0x79,0xe0,  /* .####..####..... */
+	/*02f0:*/	0xf0,0xe0,  /* ####....###..... */
+	/*02f2:*/	0xe0,0x70,  /* ###......###.... */
+	/*02f4:*/	0xe0,0x70,  /* ###......###.... */
+	/*02f6:*/	0xe0,0x70,  /* ###......###.... */
+	/*02f8:*/	0xe0,0x70,  /* ###......###.... */
+	/*02fa:*/	0xf0,0xf0,  /* ####....####.... */
+	/*02fc:*/	0x79,0xf0,  /* .####..#####.... */
+	/*02fe:*/	0x7f,0xf0,  /* .###########.... */
+	/*0300:*/	0x1f,0x70,  /* ...#####.###.... */
+	/*0302:*/	0x00,0x70,  /* .........###.... */
+	/*0304:*/	0x00,0x70,  /* .........###.... */
+	/*0306:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0308:*/	0xf3,0xe0,  /* ####..#####..... */
+	/*030a:*/	0x7f,0xc0,  /* .#########...... */
+	/*030c:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character colon (58) starting at offset 0x030e --- */
+	/*030e:*/	7, 3, 14, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0313:*/	0xe0,  /* ###..... */
+	/*0314:*/	0xe0,  /* ###..... */
+	/*0315:*/	0xe0,  /* ###..... */
+	/*0316:*/	0x00,  /* ........ */
+	/*0317:*/	0x00,  /* ........ */
+	/*0318:*/	0x00,  /* ........ */
+	/*0319:*/	0x00,  /* ........ */
+	/*031a:*/	0x00,  /* ........ */
+	/*031b:*/	0x00,  /* ........ */
+	/*031c:*/	0x00,  /* ........ */
+	/*031d:*/	0x00,  /* ........ */
+	/*031e:*/	0xe0,  /* ###..... */
+	/*031f:*/	0xe0,  /* ###..... */
+	/*0320:*/	0xe0,  /* ###..... */
+/* --- new character semicolon (59) starting at offset 0x0321 --- */
+	/*0321:*/	7, 3, 17, 2, -3, /* width and bbox (w,h,x,y) */ 
+	/*0326:*/	0xe0,  /* ###..... */
+	/*0327:*/	0xe0,  /* ###..... */
+	/*0328:*/	0xe0,  /* ###..... */
+	/*0329:*/	0x00,  /* ........ */
+	/*032a:*/	0x00,  /* ........ */
+	/*032b:*/	0x00,  /* ........ */
+	/*032c:*/	0x00,  /* ........ */
+	/*032d:*/	0x00,  /* ........ */
+	/*032e:*/	0x00,  /* ........ */
+	/*032f:*/	0x00,  /* ........ */
+	/*0330:*/	0x00,  /* ........ */
+	/*0331:*/	0xe0,  /* ###..... */
+	/*0332:*/	0xe0,  /* ###..... */
+	/*0333:*/	0xe0,  /* ###..... */
+	/*0334:*/	0x60,  /* .##..... */
+	/*0335:*/	0x60,  /* .##..... */
+	/*0336:*/	0xc0,  /* ##...... */
+/* --- new character less (60) starting at offset 0x0337 --- */
+	/*0337:*/	15, 13, 12, 0, 1, /* width and bbox (w,h,x,y) */ 
+	/*033c:*/	0x00,0x38,  /* ..........###... */
+	/*033e:*/	0x00,0xf8,  /* ........#####... */
+	/*0340:*/	0x03,0xe0,  /* ......#####..... */
+	/*0342:*/	0x0f,0x80,  /* ....#####....... */
+	/*0344:*/	0x3e,0x00,  /* ..#####......... */
+	/*0346:*/	0xf0,0x00,  /* ####............ */
+	/*0348:*/	0xf0,0x00,  /* ####............ */
+	/*034a:*/	0x3e,0x00,  /* ..#####......... */
+	/*034c:*/	0x0f,0x80,  /* ....#####....... */
+	/*034e:*/	0x03,0xe0,  /* ......#####..... */
+	/*0350:*/	0x00,0xf8,  /* ........#####... */
+	/*0352:*/	0x00,0x38,  /* ..........###... */
+/* --- new character equal (61) starting at offset 0x0354 --- */
+	/*0354:*/	14, 10, 6, 2, 4, /* width and bbox (w,h,x,y) */ 
+	/*0359:*/	0xff,0xc0,  /* ##########...... */
+	/*035b:*/	0xff,0xc0,  /* ##########...... */
+	/*035d:*/	0x00,0x00,  /* ................ */
+	/*035f:*/	0x00,0x00,  /* ................ */
+	/*0361:*/	0xff,0xc0,  /* ##########...... */
+	/*0363:*/	0xff,0xc0,  /* ##########...... */
+/* --- new character greater (62) starting at offset 0x0365 --- */
+	/*0365:*/	14, 13, 12, 0, 1, /* width and bbox (w,h,x,y) */ 
+	/*036a:*/	0xe0,0x00,  /* ###............. */
+	/*036c:*/	0xf8,0x00,  /* #####........... */
+	/*036e:*/	0x3e,0x00,  /* ..#####......... */
+	/*0370:*/	0x0f,0x80,  /* ....#####....... */
+	/*0372:*/	0x03,0xe0,  /* ......#####..... */
+	/*0374:*/	0x00,0x78,  /* .........####... */
+	/*0376:*/	0x00,0x78,  /* .........####... */
+	/*0378:*/	0x03,0xe0,  /* ......#####..... */
+	/*037a:*/	0x0f,0x80,  /* ....#####....... */
+	/*037c:*/	0x3e,0x00,  /* ..#####......... */
+	/*037e:*/	0xf8,0x00,  /* #####........... */
+	/*0380:*/	0xe0,0x00,  /* ###............. */
+/* --- new character question (63) starting at offset 0x0382 --- */
+	/*0382:*/	15, 11, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0387:*/	0x1f,0x80,  /* ...######....... */
+	/*0389:*/	0x7f,0xc0,  /* .#########...... */
+	/*038b:*/	0x79,0xe0,  /* .####..####..... */
+	/*038d:*/	0xf0,0xe0,  /* ####....###..... */
+	/*038f:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0391:*/	0xe1,0xe0,  /* ###....####..... */
+	/*0393:*/	0x01,0xc0,  /* .......###...... */
+	/*0395:*/	0x03,0xc0,  /* ......####...... */
+	/*0397:*/	0x07,0x80,  /* .....####....... */
+	/*0399:*/	0x07,0x00,  /* .....###........ */
+	/*039b:*/	0x0e,0x00,  /* ....###......... */
+	/*039d:*/	0x0e,0x00,  /* ....###......... */
+	/*039f:*/	0x0e,0x00,  /* ....###......... */
+	/*03a1:*/	0x0e,0x00,  /* ....###......... */
+	/*03a3:*/	0x00,0x00,  /* ................ */
+	/*03a5:*/	0x00,0x00,  /* ................ */
+	/*03a7:*/	0x0e,0x00,  /* ....###......... */
+	/*03a9:*/	0x0e,0x00,  /* ....###......... */
+	/*03ab:*/	0x0e,0x00,  /* ....###......... */
+/* --- new character at (64) starting at offset 0x03ad --- */
+	/*03ad:*/	24, 22, 22, 1, -4, /* width and bbox (w,h,x,y) */ 
+	/*03b2:*/	0x01,0xff,0x00,  /* .......#########........ */
+	/*03b5:*/	0x07,0xff,0xc0,  /* .....#############...... */
+	/*03b8:*/	0x0f,0x81,0xf0,  /* ....#####......#####.... */
+	/*03bb:*/	0x1e,0x00,0x78,  /* ...####..........####... */
+	/*03be:*/	0x3c,0x00,0x38,  /* ..####............###... */
+	/*03c1:*/	0x78,0x7d,0x9c,  /* .####....#####.##..###.. */
+	/*03c4:*/	0x70,0xff,0x9c,  /* .###....#########..###.. */
+	/*03c7:*/	0xf1,0xc7,0x1c,  /* ####...###...###...###.. */
+	/*03ca:*/	0xe3,0x87,0x1c,  /* ###...###....###...###.. */
+	/*03cd:*/	0xe3,0x0e,0x1c,  /* ###...##....###....###.. */
+	/*03d0:*/	0xe7,0x0e,0x38,  /* ###..###....###...###... */
+	/*03d3:*/	0xe7,0x0c,0x38,  /* ###..###....##....###... */
+	/*03d6:*/	0xe7,0x1c,0x70,  /* ###..###...###...###.... */
+	/*03d9:*/	0xe7,0x1c,0x70,  /* ###..###...###...###.... */
+	/*03dc:*/	0xe3,0x9d,0xe0,  /* ###...###..###.####..... */
+	/*03df:*/	0xf3,0xff,0xc0,  /* ####..############...... */
+	/*03e2:*/	0x71,0xf7,0x00,  /* .###...#####.###........ */
+	/*03e5:*/	0x78,0x00,0x00,  /* .####................... */
+	/*03e8:*/	0x3c,0x00,0x00,  /* ..####.................. */
+	/*03eb:*/	0x1f,0x07,0x00,  /* ...#####.....###........ */
+	/*03ee:*/	0x0f,0xff,0x00,  /* ....############........ */
+	/*03f1:*/	0x03,0xfc,0x00,  /* ......########.......... */
+/* --- new character A (65) starting at offset 0x03f4 --- */
+	/*03f4:*/	18, 16, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*03f9:*/	0x03,0xc0,  /* ......####...... */
+	/*03fb:*/	0x03,0xc0,  /* ......####...... */
+	/*03fd:*/	0x07,0xe0,  /* .....######..... */
+	/*03ff:*/	0x07,0xe0,  /* .....######..... */
+	/*0401:*/	0x0e,0x60,  /* ....###..##..... */
+	/*0403:*/	0x0e,0x70,  /* ....###..###.... */
+	/*0405:*/	0x0e,0x70,  /* ....###..###.... */
+	/*0407:*/	0x1c,0x38,  /* ...###....###... */
+	/*0409:*/	0x1c,0x38,  /* ...###....###... */
+	/*040b:*/	0x1c,0x38,  /* ...###....###... */
+	/*040d:*/	0x38,0x1c,  /* ..###......###.. */
+	/*040f:*/	0x38,0x1c,  /* ..###......###.. */
+	/*0411:*/	0x3f,0xfc,  /* ..############.. */
+	/*0413:*/	0x7f,0xfe,  /* .##############. */
+	/*0415:*/	0x70,0x0e,  /* .###........###. */
+	/*0417:*/	0x70,0x0e,  /* .###........###. */
+	/*0419:*/	0xe0,0x07,  /* ###..........### */
+	/*041b:*/	0xe0,0x07,  /* ###..........### */
+	/*041d:*/	0xe0,0x07,  /* ###..........### */
+/* --- new character B (66) starting at offset 0x041f --- */
+	/*041f:*/	18, 15, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0424:*/	0xff,0xe0,  /* ###########..... */
+	/*0426:*/	0xff,0xf8,  /* #############... */
+	/*0428:*/	0xe0,0x78,  /* ###......####... */
+	/*042a:*/	0xe0,0x1c,  /* ###........###.. */
+	/*042c:*/	0xe0,0x1c,  /* ###........###.. */
+	/*042e:*/	0xe0,0x1c,  /* ###........###.. */
+	/*0430:*/	0xe0,0x1c,  /* ###........###.. */
+	/*0432:*/	0xe0,0x38,  /* ###.......###... */
+	/*0434:*/	0xff,0xf0,  /* ############.... */
+	/*0436:*/	0xff,0xf8,  /* #############... */
+	/*0438:*/	0xe0,0x1c,  /* ###........###.. */
+	/*043a:*/	0xe0,0x0e,  /* ###.........###. */
+	/*043c:*/	0xe0,0x0e,  /* ###.........###. */
+	/*043e:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0440:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0442:*/	0xe0,0x1e,  /* ###........####. */
+	/*0444:*/	0xe0,0x7c,  /* ###......#####.. */
+	/*0446:*/	0xff,0xf8,  /* #############... */
+	/*0448:*/	0xff,0xe0,  /* ###########..... */
+/* --- new character C (67) starting at offset 0x044a --- */
+	/*044a:*/	18, 16, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*044f:*/	0x07,0xf0,  /* .....#######.... */
+	/*0451:*/	0x1f,0xfc,  /* ...###########.. */
+	/*0453:*/	0x3e,0x3e,  /* ..#####...#####. */
+	/*0455:*/	0x78,0x0f,  /* .####.......#### */
+	/*0457:*/	0x70,0x07,  /* .###.........### */
+	/*0459:*/	0xf0,0x00,  /* ####............ */
+	/*045b:*/	0xe0,0x00,  /* ###............. */
+	/*045d:*/	0xe0,0x00,  /* ###............. */
+	/*045f:*/	0xe0,0x00,  /* ###............. */
+	/*0461:*/	0xe0,0x00,  /* ###............. */
+	/*0463:*/	0xe0,0x00,  /* ###............. */
+	/*0465:*/	0xe0,0x00,  /* ###............. */
+	/*0467:*/	0xe0,0x00,  /* ###............. */
+	/*0469:*/	0xf0,0x07,  /* ####.........### */
+	/*046b:*/	0x70,0x07,  /* .###.........### */
+	/*046d:*/	0x78,0x0f,  /* .####.......#### */
+	/*046f:*/	0x3e,0x3e,  /* ..#####...#####. */
+	/*0471:*/	0x1f,0xfc,  /* ...###########.. */
+	/*0473:*/	0x07,0xf0,  /* .....#######.... */
+/* --- new character D (68) starting at offset 0x0475 --- */
+	/*0475:*/	19, 16, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*047a:*/	0xff,0xe0,  /* ###########..... */
+	/*047c:*/	0xff,0xf8,  /* #############... */
+	/*047e:*/	0xe0,0x7c,  /* ###......#####.. */
+	/*0480:*/	0xe0,0x1e,  /* ###........####. */
+	/*0482:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0484:*/	0xe0,0x0f,  /* ###.........#### */
+	/*0486:*/	0xe0,0x07,  /* ###..........### */
+	/*0488:*/	0xe0,0x07,  /* ###..........### */
+	/*048a:*/	0xe0,0x07,  /* ###..........### */
+	/*048c:*/	0xe0,0x07,  /* ###..........### */
+	/*048e:*/	0xe0,0x07,  /* ###..........### */
+	/*0490:*/	0xe0,0x07,  /* ###..........### */
+	/*0492:*/	0xe0,0x07,  /* ###..........### */
+	/*0494:*/	0xe0,0x0f,  /* ###.........#### */
+	/*0496:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0498:*/	0xe0,0x1e,  /* ###........####. */
+	/*049a:*/	0xe0,0x7c,  /* ###......#####.. */
+	/*049c:*/	0xff,0xf8,  /* #############... */
+	/*049e:*/	0xff,0xe0,  /* ###########..... */
+/* --- new character E (69) starting at offset 0x04a0 --- */
+	/*04a0:*/	16, 13, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*04a5:*/	0xff,0xf0,  /* ############.... */
+	/*04a7:*/	0xff,0xf0,  /* ############.... */
+	/*04a9:*/	0xe0,0x00,  /* ###............. */
+	/*04ab:*/	0xe0,0x00,  /* ###............. */
+	/*04ad:*/	0xe0,0x00,  /* ###............. */
+	/*04af:*/	0xe0,0x00,  /* ###............. */
+	/*04b1:*/	0xe0,0x00,  /* ###............. */
+	/*04b3:*/	0xe0,0x00,  /* ###............. */
+	/*04b5:*/	0xff,0xe0,  /* ###########..... */
+	/*04b7:*/	0xff,0xe0,  /* ###########..... */
+	/*04b9:*/	0xe0,0x00,  /* ###............. */
+	/*04bb:*/	0xe0,0x00,  /* ###............. */
+	/*04bd:*/	0xe0,0x00,  /* ###............. */
+	/*04bf:*/	0xe0,0x00,  /* ###............. */
+	/*04c1:*/	0xe0,0x00,  /* ###............. */
+	/*04c3:*/	0xe0,0x00,  /* ###............. */
+	/*04c5:*/	0xe0,0x00,  /* ###............. */
+	/*04c7:*/	0xff,0xf8,  /* #############... */
+	/*04c9:*/	0xff,0xf8,  /* #############... */
+/* --- new character F (70) starting at offset 0x04cb --- */
+	/*04cb:*/	15, 12, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*04d0:*/	0xff,0xf0,  /* ############.... */
+	/*04d2:*/	0xff,0xf0,  /* ############.... */
+	/*04d4:*/	0xe0,0x00,  /* ###............. */
+	/*04d6:*/	0xe0,0x00,  /* ###............. */
+	/*04d8:*/	0xe0,0x00,  /* ###............. */
+	/*04da:*/	0xe0,0x00,  /* ###............. */
+	/*04dc:*/	0xe0,0x00,  /* ###............. */
+	/*04de:*/	0xe0,0x00,  /* ###............. */
+	/*04e0:*/	0xff,0xe0,  /* ###########..... */
+	/*04e2:*/	0xff,0xe0,  /* ###########..... */
+	/*04e4:*/	0xe0,0x00,  /* ###............. */
+	/*04e6:*/	0xe0,0x00,  /* ###............. */
+	/*04e8:*/	0xe0,0x00,  /* ###............. */
+	/*04ea:*/	0xe0,0x00,  /* ###............. */
+	/*04ec:*/	0xe0,0x00,  /* ###............. */
+	/*04ee:*/	0xe0,0x00,  /* ###............. */
+	/*04f0:*/	0xe0,0x00,  /* ###............. */
+	/*04f2:*/	0xe0,0x00,  /* ###............. */
+	/*04f4:*/	0xe0,0x00,  /* ###............. */
+/* --- new character G (71) starting at offset 0x04f6 --- */
+	/*04f6:*/	19, 17, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*04fb:*/	0x07,0xf0,0x00,  /* .....#######............ */
+	/*04fe:*/	0x1f,0xfc,0x00,  /* ...###########.......... */
+	/*0501:*/	0x3e,0x3e,0x00,  /* ..#####...#####......... */
+	/*0504:*/	0x78,0x0f,0x00,  /* .####.......####........ */
+	/*0507:*/	0x70,0x07,0x00,  /* .###.........###........ */
+	/*050a:*/	0xf0,0x00,0x00,  /* ####.................... */
+	/*050d:*/	0xe0,0x00,0x00,  /* ###..................... */
+	/*0510:*/	0xe0,0x00,0x00,  /* ###..................... */
+	/*0513:*/	0xe0,0x00,0x00,  /* ###..................... */
+	/*0516:*/	0xe0,0x7f,0x80,  /* ###......########....... */
+	/*0519:*/	0xe0,0x7f,0x80,  /* ###......########....... */
+	/*051c:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*051f:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*0522:*/	0xf0,0x03,0x80,  /* ####..........###....... */
+	/*0525:*/	0x70,0x07,0x80,  /* .###.........####....... */
+	/*0528:*/	0x78,0x0f,0x80,  /* .####.......#####....... */
+	/*052b:*/	0x3e,0x3f,0x80,  /* ..#####...#######....... */
+	/*052e:*/	0x1f,0xfb,0x80,  /* ...##########.###....... */
+	/*0531:*/	0x07,0xf1,0x80,  /* .....#######...##....... */
+/* --- new character H (72) starting at offset 0x0534 --- */
+	/*0534:*/	19, 15, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0539:*/	0xe0,0x0e,  /* ###.........###. */
+	/*053b:*/	0xe0,0x0e,  /* ###.........###. */
+	/*053d:*/	0xe0,0x0e,  /* ###.........###. */
+	/*053f:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0541:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0543:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0545:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0547:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0549:*/	0xff,0xfe,  /* ###############. */
+	/*054b:*/	0xff,0xfe,  /* ###############. */
+	/*054d:*/	0xe0,0x0e,  /* ###.........###. */
+	/*054f:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0551:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0553:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0555:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0557:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0559:*/	0xe0,0x0e,  /* ###.........###. */
+	/*055b:*/	0xe0,0x0e,  /* ###.........###. */
+	/*055d:*/	0xe0,0x0e,  /* ###.........###. */
+/* --- new character I (73) starting at offset 0x055f --- */
+	/*055f:*/	7, 3, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0564:*/	0xe0,  /* ###..... */
+	/*0565:*/	0xe0,  /* ###..... */
+	/*0566:*/	0xe0,  /* ###..... */
+	/*0567:*/	0xe0,  /* ###..... */
+	/*0568:*/	0xe0,  /* ###..... */
+	/*0569:*/	0xe0,  /* ###..... */
+	/*056a:*/	0xe0,  /* ###..... */
+	/*056b:*/	0xe0,  /* ###..... */
+	/*056c:*/	0xe0,  /* ###..... */
+	/*056d:*/	0xe0,  /* ###..... */
+	/*056e:*/	0xe0,  /* ###..... */
+	/*056f:*/	0xe0,  /* ###..... */
+	/*0570:*/	0xe0,  /* ###..... */
+	/*0571:*/	0xe0,  /* ###..... */
+	/*0572:*/	0xe0,  /* ###..... */
+	/*0573:*/	0xe0,  /* ###..... */
+	/*0574:*/	0xe0,  /* ###..... */
+	/*0575:*/	0xe0,  /* ###..... */
+	/*0576:*/	0xe0,  /* ###..... */
+/* --- new character J (74) starting at offset 0x0577 --- */
+	/*0577:*/	14, 11, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*057c:*/	0x00,0xe0,  /* ........###..... */
+	/*057e:*/	0x00,0xe0,  /* ........###..... */
+	/*0580:*/	0x00,0xe0,  /* ........###..... */
+	/*0582:*/	0x00,0xe0,  /* ........###..... */
+	/*0584:*/	0x00,0xe0,  /* ........###..... */
+	/*0586:*/	0x00,0xe0,  /* ........###..... */
+	/*0588:*/	0x00,0xe0,  /* ........###..... */
+	/*058a:*/	0x00,0xe0,  /* ........###..... */
+	/*058c:*/	0x00,0xe0,  /* ........###..... */
+	/*058e:*/	0x00,0xe0,  /* ........###..... */
+	/*0590:*/	0x00,0xe0,  /* ........###..... */
+	/*0592:*/	0x00,0xe0,  /* ........###..... */
+	/*0594:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0596:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0598:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*059a:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*059c:*/	0x71,0xe0,  /* .###...####..... */
+	/*059e:*/	0x7f,0xc0,  /* .#########...... */
+	/*05a0:*/	0x3f,0x80,  /* ..#######....... */
+/* --- new character K (75) starting at offset 0x05a2 --- */
+	/*05a2:*/	18, 16, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*05a7:*/	0xe0,0x3c,  /* ###.......####.. */
+	/*05a9:*/	0xe0,0x78,  /* ###......####... */
+	/*05ab:*/	0xe0,0xf0,  /* ###.....####.... */
+	/*05ad:*/	0xe1,0xe0,  /* ###....####..... */
+	/*05af:*/	0xe3,0xc0,  /* ###...####...... */
+	/*05b1:*/	0xe7,0x80,  /* ###..####....... */
+	/*05b3:*/	0xef,0x00,  /* ###.####........ */
+	/*05b5:*/	0xfe,0x00,  /* #######......... */
+	/*05b7:*/	0xfe,0x00,  /* #######......... */
+	/*05b9:*/	0xff,0x00,  /* ########........ */
+	/*05bb:*/	0xf7,0x80,  /* ####.####....... */
+	/*05bd:*/	0xe3,0xc0,  /* ###...####...... */
+	/*05bf:*/	0xe1,0xe0,  /* ###....####..... */
+	/*05c1:*/	0xe0,0xf0,  /* ###.....####.... */
+	/*05c3:*/	0xe0,0x78,  /* ###......####... */
+	/*05c5:*/	0xe0,0x3c,  /* ###.......####.. */
+	/*05c7:*/	0xe0,0x1e,  /* ###........####. */
+	/*05c9:*/	0xe0,0x0f,  /* ###.........#### */
+	/*05cb:*/	0xe0,0x07,  /* ###..........### */
+/* --- new character L (76) starting at offset 0x05cd --- */
+	/*05cd:*/	15, 12, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*05d2:*/	0xe0,0x00,  /* ###............. */
+	/*05d4:*/	0xe0,0x00,  /* ###............. */
+	/*05d6:*/	0xe0,0x00,  /* ###............. */
+	/*05d8:*/	0xe0,0x00,  /* ###............. */
+	/*05da:*/	0xe0,0x00,  /* ###............. */
+	/*05dc:*/	0xe0,0x00,  /* ###............. */
+	/*05de:*/	0xe0,0x00,  /* ###............. */
+	/*05e0:*/	0xe0,0x00,  /* ###............. */
+	/*05e2:*/	0xe0,0x00,  /* ###............. */
+	/*05e4:*/	0xe0,0x00,  /* ###............. */
+	/*05e6:*/	0xe0,0x00,  /* ###............. */
+	/*05e8:*/	0xe0,0x00,  /* ###............. */
+	/*05ea:*/	0xe0,0x00,  /* ###............. */
+	/*05ec:*/	0xe0,0x00,  /* ###............. */
+	/*05ee:*/	0xe0,0x00,  /* ###............. */
+	/*05f0:*/	0xe0,0x00,  /* ###............. */
+	/*05f2:*/	0xe0,0x00,  /* ###............. */
+	/*05f4:*/	0xff,0xf0,  /* ############.... */
+	/*05f6:*/	0xff,0xf0,  /* ############.... */
+/* --- new character M (77) starting at offset 0x05f8 --- */
+	/*05f8:*/	23, 19, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*05fd:*/	0xe0,0x00,0xe0,  /* ###.............###..... */
+	/*0600:*/	0xf0,0x01,0xe0,  /* ####...........####..... */
+	/*0603:*/	0xf0,0x01,0xe0,  /* ####...........####..... */
+	/*0606:*/	0xf8,0x03,0xe0,  /* #####.........#####..... */
+	/*0609:*/	0xf8,0x03,0xe0,  /* #####.........#####..... */
+	/*060c:*/	0xfc,0x07,0xe0,  /* ######.......######..... */
+	/*060f:*/	0xec,0x06,0xe0,  /* ###.##.......##.###..... */
+	/*0612:*/	0xee,0x0e,0xe0,  /* ###.###.....###.###..... */
+	/*0615:*/	0xe6,0x0c,0xe0,  /* ###..##.....##..###..... */
+	/*0618:*/	0xe7,0x1c,0xe0,  /* ###..###...###..###..... */
+	/*061b:*/	0xe7,0x1c,0xe0,  /* ###..###...###..###..... */
+	/*061e:*/	0xe3,0x18,0xe0,  /* ###...##...##...###..... */
+	/*0621:*/	0xe3,0xb8,0xe0,  /* ###...###.###...###..... */
+	/*0624:*/	0xe3,0xb8,0xe0,  /* ###...###.###...###..... */
+	/*0627:*/	0xe1,0xf0,0xe0,  /* ###....#####....###..... */
+	/*062a:*/	0xe1,0xf0,0xe0,  /* ###....#####....###..... */
+	/*062d:*/	0xe0,0xe0,0xe0,  /* ###.....###.....###..... */
+	/*0630:*/	0xe0,0xe0,0xe0,  /* ###.....###.....###..... */
+	/*0633:*/	0xe0,0xe0,0xe0,  /* ###.....###.....###..... */
+/* --- new character N (78) starting at offset 0x0636 --- */
+	/*0636:*/	19, 15, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*063b:*/	0xe0,0x0e,  /* ###.........###. */
+	/*063d:*/	0xf0,0x0e,  /* ####........###. */
+	/*063f:*/	0xf0,0x0e,  /* ####........###. */
+	/*0641:*/	0xf8,0x0e,  /* #####.......###. */
+	/*0643:*/	0xf8,0x0e,  /* #####.......###. */
+	/*0645:*/	0xfc,0x0e,  /* ######......###. */
+	/*0647:*/	0xee,0x0e,  /* ###.###.....###. */
+	/*0649:*/	0xee,0x0e,  /* ###.###.....###. */
+	/*064b:*/	0xe7,0x0e,  /* ###..###....###. */
+	/*064d:*/	0xe3,0x8e,  /* ###...###...###. */
+	/*064f:*/	0xe3,0x8e,  /* ###...###...###. */
+	/*0651:*/	0xe1,0xce,  /* ###....###..###. */
+	/*0653:*/	0xe0,0xce,  /* ###.....##..###. */
+	/*0655:*/	0xe0,0xee,  /* ###.....###.###. */
+	/*0657:*/	0xe0,0x7e,  /* ###......######. */
+	/*0659:*/	0xe0,0x3e,  /* ###.......#####. */
+	/*065b:*/	0xe0,0x3e,  /* ###.......#####. */
+	/*065d:*/	0xe0,0x1e,  /* ###........####. */
+	/*065f:*/	0xe0,0x0e,  /* ###.........###. */
+/* --- new character O (79) starting at offset 0x0661 --- */
+	/*0661:*/	19, 17, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0666:*/	0x07,0xf0,0x00,  /* .....#######............ */
+	/*0669:*/	0x1f,0xfc,0x00,  /* ...###########.......... */
+	/*066c:*/	0x3e,0x3e,0x00,  /* ..#####...#####......... */
+	/*066f:*/	0x78,0x0f,0x00,  /* .####.......####........ */
+	/*0672:*/	0x70,0x07,0x00,  /* .###.........###........ */
+	/*0675:*/	0xf0,0x07,0x80,  /* ####.........####....... */
+	/*0678:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*067b:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*067e:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*0681:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*0684:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*0687:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*068a:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*068d:*/	0xf0,0x07,0x80,  /* ####.........####....... */
+	/*0690:*/	0x70,0x07,0x00,  /* .###.........###........ */
+	/*0693:*/	0x78,0x0f,0x00,  /* .####.......####........ */
+	/*0696:*/	0x3e,0x3e,0x00,  /* ..#####...#####......... */
+	/*0699:*/	0x1f,0xfc,0x00,  /* ...###########.......... */
+	/*069c:*/	0x07,0xf0,0x00,  /* .....#######............ */
+/* --- new character P (80) starting at offset 0x069f --- */
+	/*069f:*/	17, 14, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*06a4:*/	0xff,0xe0,  /* ###########..... */
+	/*06a6:*/	0xff,0xf8,  /* #############... */
+	/*06a8:*/	0xe0,0x38,  /* ###.......###... */
+	/*06aa:*/	0xe0,0x1c,  /* ###........###.. */
+	/*06ac:*/	0xe0,0x1c,  /* ###........###.. */
+	/*06ae:*/	0xe0,0x1c,  /* ###........###.. */
+	/*06b0:*/	0xe0,0x1c,  /* ###........###.. */
+	/*06b2:*/	0xe0,0x38,  /* ###.......###... */
+	/*06b4:*/	0xff,0xf8,  /* #############... */
+	/*06b6:*/	0xff,0xf0,  /* ############.... */
+	/*06b8:*/	0xe0,0x00,  /* ###............. */
+	/*06ba:*/	0xe0,0x00,  /* ###............. */
+	/*06bc:*/	0xe0,0x00,  /* ###............. */
+	/*06be:*/	0xe0,0x00,  /* ###............. */
+	/*06c0:*/	0xe0,0x00,  /* ###............. */
+	/*06c2:*/	0xe0,0x00,  /* ###............. */
+	/*06c4:*/	0xe0,0x00,  /* ###............. */
+	/*06c6:*/	0xe0,0x00,  /* ###............. */
+	/*06c8:*/	0xe0,0x00,  /* ###............. */
+/* --- new character Q (81) starting at offset 0x06ca --- */
+	/*06ca:*/	19, 17, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*06cf:*/	0x07,0xf0,0x00,  /* .....#######............ */
+	/*06d2:*/	0x1f,0xfc,0x00,  /* ...###########.......... */
+	/*06d5:*/	0x3e,0x3e,0x00,  /* ..#####...#####......... */
+	/*06d8:*/	0x78,0x0f,0x00,  /* .####.......####........ */
+	/*06db:*/	0x70,0x07,0x00,  /* .###.........###........ */
+	/*06de:*/	0xf0,0x07,0x80,  /* ####.........####....... */
+	/*06e1:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*06e4:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*06e7:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*06ea:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*06ed:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*06f0:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*06f3:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*06f6:*/	0xf0,0x07,0x80,  /* ####.........####....... */
+	/*06f9:*/	0x70,0xf7,0x00,  /* .###....####.###........ */
+	/*06fc:*/	0x78,0x7f,0x00,  /* .####....#######........ */
+	/*06ff:*/	0x3e,0x1e,0x00,  /* ..#####....####......... */
+	/*0702:*/	0x1f,0xff,0x00,  /* ...#############........ */
+	/*0705:*/	0x07,0xf7,0x80,  /* .....#######.####....... */
+/* --- new character R (82) starting at offset 0x0708 --- */
+	/*0708:*/	17, 14, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*070d:*/	0xff,0xe0,  /* ###########..... */
+	/*070f:*/	0xff,0xf8,  /* #############... */
+	/*0711:*/	0xe0,0x38,  /* ###.......###... */
+	/*0713:*/	0xe0,0x1c,  /* ###........###.. */
+	/*0715:*/	0xe0,0x1c,  /* ###........###.. */
+	/*0717:*/	0xe0,0x1c,  /* ###........###.. */
+	/*0719:*/	0xe0,0x1c,  /* ###........###.. */
+	/*071b:*/	0xe0,0x38,  /* ###.......###... */
+	/*071d:*/	0xff,0xf8,  /* #############... */
+	/*071f:*/	0xff,0xf0,  /* ############.... */
+	/*0721:*/	0xe0,0x78,  /* ###......####... */
+	/*0723:*/	0xe0,0x38,  /* ###.......###... */
+	/*0725:*/	0xe0,0x1c,  /* ###........###.. */
+	/*0727:*/	0xe0,0x1c,  /* ###........###.. */
+	/*0729:*/	0xe0,0x1c,  /* ###........###.. */
+	/*072b:*/	0xe0,0x1c,  /* ###........###.. */
+	/*072d:*/	0xe0,0x1c,  /* ###........###.. */
+	/*072f:*/	0xe0,0x1c,  /* ###........###.. */
+	/*0731:*/	0xe0,0x1c,  /* ###........###.. */
+/* --- new character S (83) starting at offset 0x0733 --- */
+	/*0733:*/	17, 15, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0738:*/	0x07,0xe0,  /* .....######..... */
+	/*073a:*/	0x1f,0xf8,  /* ...##########... */
+	/*073c:*/	0x3c,0x7c,  /* ..####...#####.. */
+	/*073e:*/	0x78,0x1c,  /* .####......###.. */
+	/*0740:*/	0x70,0x1c,  /* .###.......###.. */
+	/*0742:*/	0x70,0x00,  /* .###............ */
+	/*0744:*/	0x78,0x00,  /* .####........... */
+	/*0746:*/	0x3e,0x00,  /* ..#####......... */
+	/*0748:*/	0x1f,0xe0,  /* ...########..... */
+	/*074a:*/	0x03,0xf8,  /* ......#######... */
+	/*074c:*/	0x00,0x7c,  /* .........#####.. */
+	/*074e:*/	0x00,0x1e,  /* ...........####. */
+	/*0750:*/	0x00,0x0e,  /* ............###. */
+	/*0752:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0754:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0756:*/	0xf0,0x1e,  /* ####.......####. */
+	/*0758:*/	0x7c,0x7c,  /* .#####...#####.. */
+	/*075a:*/	0x3f,0xf8,  /* ..###########... */
+	/*075c:*/	0x0f,0xe0,  /* ....#######..... */
+/* --- new character T (84) starting at offset 0x075e --- */
+	/*075e:*/	15, 15, 19, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0763:*/	0xff,0xfe,  /* ###############. */
+	/*0765:*/	0xff,0xfe,  /* ###############. */
+	/*0767:*/	0x03,0x80,  /* ......###....... */
+	/*0769:*/	0x03,0x80,  /* ......###....... */
+	/*076b:*/	0x03,0x80,  /* ......###....... */
+	/*076d:*/	0x03,0x80,  /* ......###....... */
+	/*076f:*/	0x03,0x80,  /* ......###....... */
+	/*0771:*/	0x03,0x80,  /* ......###....... */
+	/*0773:*/	0x03,0x80,  /* ......###....... */
+	/*0775:*/	0x03,0x80,  /* ......###....... */
+	/*0777:*/	0x03,0x80,  /* ......###....... */
+	/*0779:*/	0x03,0x80,  /* ......###....... */
+	/*077b:*/	0x03,0x80,  /* ......###....... */
+	/*077d:*/	0x03,0x80,  /* ......###....... */
+	/*077f:*/	0x03,0x80,  /* ......###....... */
+	/*0781:*/	0x03,0x80,  /* ......###....... */
+	/*0783:*/	0x03,0x80,  /* ......###....... */
+	/*0785:*/	0x03,0x80,  /* ......###....... */
+	/*0787:*/	0x03,0x80,  /* ......###....... */
+/* --- new character U (85) starting at offset 0x0789 --- */
+	/*0789:*/	19, 15, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*078e:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0790:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0792:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0794:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0796:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0798:*/	0xe0,0x0e,  /* ###.........###. */
+	/*079a:*/	0xe0,0x0e,  /* ###.........###. */
+	/*079c:*/	0xe0,0x0e,  /* ###.........###. */
+	/*079e:*/	0xe0,0x0e,  /* ###.........###. */
+	/*07a0:*/	0xe0,0x0e,  /* ###.........###. */
+	/*07a2:*/	0xe0,0x0e,  /* ###.........###. */
+	/*07a4:*/	0xe0,0x0e,  /* ###.........###. */
+	/*07a6:*/	0xe0,0x0e,  /* ###.........###. */
+	/*07a8:*/	0xe0,0x0e,  /* ###.........###. */
+	/*07aa:*/	0xf0,0x1e,  /* ####.......####. */
+	/*07ac:*/	0x70,0x1c,  /* .###.......###.. */
+	/*07ae:*/	0x7c,0x7c,  /* .#####...#####.. */
+	/*07b0:*/	0x3f,0xf8,  /* ..###########... */
+	/*07b2:*/	0x0f,0xe0,  /* ....#######..... */
+/* --- new character V (86) starting at offset 0x07b4 --- */
+	/*07b4:*/	18, 16, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*07b9:*/	0xe0,0x07,  /* ###..........### */
+	/*07bb:*/	0xe0,0x07,  /* ###..........### */
+	/*07bd:*/	0xf0,0x0f,  /* ####........#### */
+	/*07bf:*/	0x70,0x0e,  /* .###........###. */
+	/*07c1:*/	0x78,0x1e,  /* .####......####. */
+	/*07c3:*/	0x38,0x1c,  /* ..###......###.. */
+	/*07c5:*/	0x38,0x1c,  /* ..###......###.. */
+	/*07c7:*/	0x3c,0x3c,  /* ..####....####.. */
+	/*07c9:*/	0x1c,0x38,  /* ...###....###... */
+	/*07cb:*/	0x1c,0x38,  /* ...###....###... */
+	/*07cd:*/	0x1e,0x78,  /* ...####..####... */
+	/*07cf:*/	0x0e,0x70,  /* ....###..###.... */
+	/*07d1:*/	0x0e,0x70,  /* ....###..###.... */
+	/*07d3:*/	0x0e,0x70,  /* ....###..###.... */
+	/*07d5:*/	0x07,0xe0,  /* .....######..... */
+	/*07d7:*/	0x07,0xe0,  /* .....######..... */
+	/*07d9:*/	0x03,0xc0,  /* ......####...... */
+	/*07db:*/	0x03,0xc0,  /* ......####...... */
+	/*07dd:*/	0x03,0xc0,  /* ......####...... */
+/* --- new character W (87) starting at offset 0x07df --- */
+	/*07df:*/	23, 21, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*07e4:*/	0xe0,0x70,0x38,  /* ###......###......###... */
+	/*07e7:*/	0xe0,0x70,0x38,  /* ###......###......###... */
+	/*07ea:*/	0xe0,0x70,0x38,  /* ###......###......###... */
+	/*07ed:*/	0xe0,0x70,0x38,  /* ###......###......###... */
+	/*07f0:*/	0x70,0xf8,0x70,  /* .###....#####....###.... */
+	/*07f3:*/	0x70,0xf8,0x70,  /* .###....#####....###.... */
+	/*07f6:*/	0x70,0xd8,0x70,  /* .###....##.##....###.... */
+	/*07f9:*/	0x71,0xdc,0x70,  /* .###...###.###...###.... */
+	/*07fc:*/	0x31,0xdc,0x60,  /* ..##...###.###...##..... */
+	/*07ff:*/	0x39,0xdc,0xe0,  /* ..###..###.###..###..... */
+	/*0802:*/	0x39,0x8c,0xe0,  /* ..###..##...##..###..... */
+	/*0805:*/	0x3b,0x8e,0xe0,  /* ..###.###...###.###..... */
+	/*0808:*/	0x1b,0x8e,0xc0,  /* ...##.###...###.##...... */
+	/*080b:*/	0x1b,0x8e,0xc0,  /* ...##.###...###.##...... */
+	/*080e:*/	0x1f,0x07,0xc0,  /* ...#####.....#####...... */
+	/*0811:*/	0x1f,0x07,0xc0,  /* ...#####.....#####...... */
+	/*0814:*/	0x0e,0x03,0x80,  /* ....###.......###....... */
+	/*0817:*/	0x0e,0x03,0x80,  /* ....###.......###....... */
+	/*081a:*/	0x0e,0x03,0x80,  /* ....###.......###....... */
+/* --- new character X (88) starting at offset 0x081d --- */
+	/*081d:*/	18, 16, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0822:*/	0xe0,0x07,  /* ###..........### */
+	/*0824:*/	0xf0,0x0f,  /* ####........#### */
+	/*0826:*/	0x78,0x1e,  /* .####......####. */
+	/*0828:*/	0x38,0x1c,  /* ..###......###.. */
+	/*082a:*/	0x1c,0x38,  /* ...###....###... */
+	/*082c:*/	0x0e,0x70,  /* ....###..###.... */
+	/*082e:*/	0x0f,0xf0,  /* ....########.... */
+	/*0830:*/	0x07,0xe0,  /* .....######..... */
+	/*0832:*/	0x03,0xc0,  /* ......####...... */
+	/*0834:*/	0x03,0xc0,  /* ......####...... */
+	/*0836:*/	0x07,0xe0,  /* .....######..... */
+	/*0838:*/	0x0f,0xf0,  /* ....########.... */
+	/*083a:*/	0x0e,0x70,  /* ....###..###.... */
+	/*083c:*/	0x1c,0x38,  /* ...###....###... */
+	/*083e:*/	0x3c,0x3c,  /* ..####....####.. */
+	/*0840:*/	0x38,0x1c,  /* ..###......###.. */
+	/*0842:*/	0x70,0x0e,  /* .###........###. */
+	/*0844:*/	0xf0,0x0f,  /* ####........#### */
+	/*0846:*/	0xe0,0x07,  /* ###..........### */
+/* --- new character Y (89) starting at offset 0x0848 --- */
+	/*0848:*/	17, 15, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*084d:*/	0xe0,0x0e,  /* ###.........###. */
+	/*084f:*/	0xf0,0x1e,  /* ####.......####. */
+	/*0851:*/	0x70,0x1c,  /* .###.......###.. */
+	/*0853:*/	0x78,0x3c,  /* .####.....####.. */
+	/*0855:*/	0x38,0x38,  /* ..###.....###... */
+	/*0857:*/	0x3c,0x78,  /* ..####...####... */
+	/*0859:*/	0x1c,0x70,  /* ...###...###.... */
+	/*085b:*/	0x1e,0xf0,  /* ...####.####.... */
+	/*085d:*/	0x0e,0xe0,  /* ....###.###..... */
+	/*085f:*/	0x0f,0xe0,  /* ....#######..... */
+	/*0861:*/	0x07,0xc0,  /* .....#####...... */
+	/*0863:*/	0x07,0xc0,  /* .....#####...... */
+	/*0865:*/	0x03,0x80,  /* ......###....... */
+	/*0867:*/	0x03,0x80,  /* ......###....... */
+	/*0869:*/	0x03,0x80,  /* ......###....... */
+	/*086b:*/	0x03,0x80,  /* ......###....... */
+	/*086d:*/	0x03,0x80,  /* ......###....... */
+	/*086f:*/	0x03,0x80,  /* ......###....... */
+	/*0871:*/	0x03,0x80,  /* ......###....... */
+/* --- new character Z (90) starting at offset 0x0873 --- */
+	/*0873:*/	16, 14, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0878:*/	0xff,0xfc,  /* ##############.. */
+	/*087a:*/	0xff,0xfc,  /* ##############.. */
+	/*087c:*/	0x00,0x3c,  /* ..........####.. */
+	/*087e:*/	0x00,0x78,  /* .........####... */
+	/*0880:*/	0x00,0xf0,  /* ........####.... */
+	/*0882:*/	0x01,0xe0,  /* .......####..... */
+	/*0884:*/	0x01,0xe0,  /* .......####..... */
+	/*0886:*/	0x03,0xc0,  /* ......####...... */
+	/*0888:*/	0x07,0x80,  /* .....####....... */
+	/*088a:*/	0x07,0x80,  /* .....####....... */
+	/*088c:*/	0x0f,0x00,  /* ....####........ */
+	/*088e:*/	0x1e,0x00,  /* ...####......... */
+	/*0890:*/	0x1e,0x00,  /* ...####......... */
+	/*0892:*/	0x3c,0x00,  /* ..####.......... */
+	/*0894:*/	0x38,0x00,  /* ..###........... */
+	/*0896:*/	0x78,0x00,  /* .####........... */
+	/*0898:*/	0xf0,0x00,  /* ####............ */
+	/*089a:*/	0xff,0xfc,  /* ##############.. */
+	/*089c:*/	0xff,0xfc,  /* ##############.. */
+/* --- new character bracketleft (91) starting at offset 0x089e --- */
+	/*089e:*/	8, 5, 24, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*08a3:*/	0xf8,  /* #####... */
+	/*08a4:*/	0xf8,  /* #####... */
+	/*08a5:*/	0xe0,  /* ###..... */
+	/*08a6:*/	0xe0,  /* ###..... */
+	/*08a7:*/	0xe0,  /* ###..... */
+	/*08a8:*/	0xe0,  /* ###..... */
+	/*08a9:*/	0xe0,  /* ###..... */
+	/*08aa:*/	0xe0,  /* ###..... */
+	/*08ab:*/	0xe0,  /* ###..... */
+	/*08ac:*/	0xe0,  /* ###..... */
+	/*08ad:*/	0xe0,  /* ###..... */
+	/*08ae:*/	0xe0,  /* ###..... */
+	/*08af:*/	0xe0,  /* ###..... */
+	/*08b0:*/	0xe0,  /* ###..... */
+	/*08b1:*/	0xe0,  /* ###..... */
+	/*08b2:*/	0xe0,  /* ###..... */
+	/*08b3:*/	0xe0,  /* ###..... */
+	/*08b4:*/	0xe0,  /* ###..... */
+	/*08b5:*/	0xe0,  /* ###..... */
+	/*08b6:*/	0xe0,  /* ###..... */
+	/*08b7:*/	0xe0,  /* ###..... */
+	/*08b8:*/	0xe0,  /* ###..... */
+	/*08b9:*/	0xf8,  /* #####... */
+	/*08ba:*/	0xf8,  /* #####... */
+/* --- new character backslash (92) starting at offset 0x08bb --- */
+	/*08bb:*/	8, 8, 19, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*08c0:*/	0xe0,  /* ###..... */
+	/*08c1:*/	0xe0,  /* ###..... */
+	/*08c2:*/	0x60,  /* .##..... */
+	/*08c3:*/	0x60,  /* .##..... */
+	/*08c4:*/	0x70,  /* .###.... */
+	/*08c5:*/	0x30,  /* ..##.... */
+	/*08c6:*/	0x30,  /* ..##.... */
+	/*08c7:*/	0x38,  /* ..###... */
+	/*08c8:*/	0x38,  /* ..###... */
+	/*08c9:*/	0x18,  /* ...##... */
+	/*08ca:*/	0x18,  /* ...##... */
+	/*08cb:*/	0x1c,  /* ...###.. */
+	/*08cc:*/	0x0c,  /* ....##.. */
+	/*08cd:*/	0x0c,  /* ....##.. */
+	/*08ce:*/	0x0e,  /* ....###. */
+	/*08cf:*/	0x06,  /* .....##. */
+	/*08d0:*/	0x06,  /* .....##. */
+	/*08d1:*/	0x07,  /* .....### */
+	/*08d2:*/	0x07,  /* .....### */
+/* --- new character bracketright (93) starting at offset 0x08d3 --- */
+	/*08d3:*/	8, 5, 24, 2, -5, /* width and bbox (w,h,x,y) */ 
+	/*08d8:*/	0xf8,  /* #####... */
+	/*08d9:*/	0xf8,  /* #####... */
+	/*08da:*/	0x38,  /* ..###... */
+	/*08db:*/	0x38,  /* ..###... */
+	/*08dc:*/	0x38,  /* ..###... */
+	/*08dd:*/	0x38,  /* ..###... */
+	/*08de:*/	0x38,  /* ..###... */
+	/*08df:*/	0x38,  /* ..###... */
+	/*08e0:*/	0x38,  /* ..###... */
+	/*08e1:*/	0x38,  /* ..###... */
+	/*08e2:*/	0x38,  /* ..###... */
+	/*08e3:*/	0x38,  /* ..###... */
+	/*08e4:*/	0x38,  /* ..###... */
+	/*08e5:*/	0x38,  /* ..###... */
+	/*08e6:*/	0x38,  /* ..###... */
+	/*08e7:*/	0x38,  /* ..###... */
+	/*08e8:*/	0x38,  /* ..###... */
+	/*08e9:*/	0x38,  /* ..###... */
+	/*08ea:*/	0x38,  /* ..###... */
+	/*08eb:*/	0x38,  /* ..###... */
+	/*08ec:*/	0x38,  /* ..###... */
+	/*08ed:*/	0x38,  /* ..###... */
+	/*08ee:*/	0xf8,  /* #####... */
+	/*08ef:*/	0xf8,  /* #####... */
+/* --- new character asciicircum (94) starting at offset 0x08f0 --- */
+	/*08f0:*/	14, 11, 9, 1, 10, /* width and bbox (w,h,x,y) */ 
+	/*08f5:*/	0x0e,0x00,  /* ....###......... */
+	/*08f7:*/	0x0e,0x00,  /* ....###......... */
+	/*08f9:*/	0x1f,0x00,  /* ...#####........ */
+	/*08fb:*/	0x1b,0x00,  /* ...##.##........ */
+	/*08fd:*/	0x3b,0x80,  /* ..###.###....... */
+	/*08ff:*/	0x71,0xc0,  /* .###...###...... */
+	/*0901:*/	0x71,0xc0,  /* .###...###...... */
+	/*0903:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0905:*/	0xe0,0xe0,  /* ###.....###..... */
+/* --- new character underscore (95) starting at offset 0x0907 --- */
+	/*0907:*/	14, 14, 2, 0, -5, /* width and bbox (w,h,x,y) */ 
+	/*090c:*/	0xff,0xfc,  /* ##############.. */
+	/*090e:*/	0xff,0xfc,  /* ##############.. */
+/* --- new character grave (96) starting at offset 0x0910 --- */
+	/*0910:*/	8, 6, 4, 1, 15, /* width and bbox (w,h,x,y) */ 
+	/*0915:*/	0xe0,  /* ###..... */
+	/*0916:*/	0x70,  /* .###.... */
+	/*0917:*/	0x38,  /* ..###... */
+	/*0918:*/	0x1c,  /* ...###.. */
+/* --- new character a (97) starting at offset 0x0919 --- */
+	/*0919:*/	14, 12, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*091e:*/	0x1f,0x80,  /* ...######....... */
+	/*0920:*/	0x3f,0xc0,  /* ..########...... */
+	/*0922:*/	0x71,0xe0,  /* .###...####..... */
+	/*0924:*/	0x70,0xe0,  /* .###....###..... */
+	/*0926:*/	0x00,0xe0,  /* ........###..... */
+	/*0928:*/	0x07,0xe0,  /* .....######..... */
+	/*092a:*/	0x3f,0xe0,  /* ..#########..... */
+	/*092c:*/	0x7c,0xe0,  /* .#####..###..... */
+	/*092e:*/	0xf0,0xe0,  /* ####....###..... */
+	/*0930:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0932:*/	0xe1,0xe0,  /* ###....####..... */
+	/*0934:*/	0xf3,0xe0,  /* ####..#####..... */
+	/*0936:*/	0x7f,0xf0,  /* .###########.... */
+	/*0938:*/	0x3e,0x70,  /* ..#####..###.... */
+/* --- new character b (98) starting at offset 0x093a --- */
+	/*093a:*/	15, 12, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*093f:*/	0xe0,0x00,  /* ###............. */
+	/*0941:*/	0xe0,0x00,  /* ###............. */
+	/*0943:*/	0xe0,0x00,  /* ###............. */
+	/*0945:*/	0xe0,0x00,  /* ###............. */
+	/*0947:*/	0xe0,0x00,  /* ###............. */
+	/*0949:*/	0xef,0x80,  /* ###.#####....... */
+	/*094b:*/	0xff,0xc0,  /* ##########...... */
+	/*094d:*/	0xf9,0xe0,  /* #####..####..... */
+	/*094f:*/	0xf0,0xe0,  /* ####....###..... */
+	/*0951:*/	0xe0,0x70,  /* ###......###.... */
+	/*0953:*/	0xe0,0x70,  /* ###......###.... */
+	/*0955:*/	0xe0,0x70,  /* ###......###.... */
+	/*0957:*/	0xe0,0x70,  /* ###......###.... */
+	/*0959:*/	0xe0,0x70,  /* ###......###.... */
+	/*095b:*/	0xe0,0x70,  /* ###......###.... */
+	/*095d:*/	0xf0,0xe0,  /* ####....###..... */
+	/*095f:*/	0xf9,0xe0,  /* #####..####..... */
+	/*0961:*/	0xff,0xc0,  /* ##########...... */
+	/*0963:*/	0xef,0x80,  /* ###.#####....... */
+/* --- new character c (99) starting at offset 0x0965 --- */
+	/*0965:*/	13, 11, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*096a:*/	0x1f,0x80,  /* ...######....... */
+	/*096c:*/	0x3f,0xc0,  /* ..########...... */
+	/*096e:*/	0x79,0xe0,  /* .####..####..... */
+	/*0970:*/	0x70,0xe0,  /* .###....###..... */
+	/*0972:*/	0xe0,0x00,  /* ###............. */
+	/*0974:*/	0xe0,0x00,  /* ###............. */
+	/*0976:*/	0xe0,0x00,  /* ###............. */
+	/*0978:*/	0xe0,0x00,  /* ###............. */
+	/*097a:*/	0xe0,0x00,  /* ###............. */
+	/*097c:*/	0xe0,0x00,  /* ###............. */
+	/*097e:*/	0x70,0xe0,  /* .###....###..... */
+	/*0980:*/	0x79,0xe0,  /* .####..####..... */
+	/*0982:*/	0x3f,0xc0,  /* ..########...... */
+	/*0984:*/	0x1f,0x80,  /* ...######....... */
+/* --- new character d (100) starting at offset 0x0986 --- */
+	/*0986:*/	15, 12, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*098b:*/	0x00,0x70,  /* .........###.... */
+	/*098d:*/	0x00,0x70,  /* .........###.... */
+	/*098f:*/	0x00,0x70,  /* .........###.... */
+	/*0991:*/	0x00,0x70,  /* .........###.... */
+	/*0993:*/	0x00,0x70,  /* .........###.... */
+	/*0995:*/	0x1f,0x70,  /* ...#####.###.... */
+	/*0997:*/	0x3f,0xf0,  /* ..##########.... */
+	/*0999:*/	0x79,0xf0,  /* .####..#####.... */
+	/*099b:*/	0x70,0xf0,  /* .###....####.... */
+	/*099d:*/	0xe0,0x70,  /* ###......###.... */
+	/*099f:*/	0xe0,0x70,  /* ###......###.... */
+	/*09a1:*/	0xe0,0x70,  /* ###......###.... */
+	/*09a3:*/	0xe0,0x70,  /* ###......###.... */
+	/*09a5:*/	0xe0,0x70,  /* ###......###.... */
+	/*09a7:*/	0xe0,0x70,  /* ###......###.... */
+	/*09a9:*/	0x70,0xf0,  /* .###....####.... */
+	/*09ab:*/	0x79,0xf0,  /* .####..#####.... */
+	/*09ad:*/	0x3f,0xf0,  /* ..##########.... */
+	/*09af:*/	0x1f,0x70,  /* ...#####.###.... */
+/* --- new character e (101) starting at offset 0x09b1 --- */
+	/*09b1:*/	14, 12, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*09b6:*/	0x0f,0x00,  /* ....####........ */
+	/*09b8:*/	0x3f,0xc0,  /* ..########...... */
+	/*09ba:*/	0x79,0xe0,  /* .####..####..... */
+	/*09bc:*/	0x70,0xe0,  /* .###....###..... */
+	/*09be:*/	0xe0,0x70,  /* ###......###.... */
+	/*09c0:*/	0xe0,0x70,  /* ###......###.... */
+	/*09c2:*/	0xff,0xf0,  /* ############.... */
+	/*09c4:*/	0xff,0xf0,  /* ############.... */
+	/*09c6:*/	0xe0,0x00,  /* ###............. */
+	/*09c8:*/	0xe0,0x00,  /* ###............. */
+	/*09ca:*/	0x70,0x70,  /* .###.....###.... */
+	/*09cc:*/	0x78,0xf0,  /* .####...####.... */
+	/*09ce:*/	0x3f,0xe0,  /* ..#########..... */
+	/*09d0:*/	0x0f,0x80,  /* ....#####....... */
+/* --- new character f (102) starting at offset 0x09d2 --- */
+	/*09d2:*/	9, 7, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*09d7:*/	0x1e,  /* ...####. */
+	/*09d8:*/	0x3e,  /* ..#####. */
+	/*09d9:*/	0x38,  /* ..###... */
+	/*09da:*/	0x38,  /* ..###... */
+	/*09db:*/	0x38,  /* ..###... */
+	/*09dc:*/	0xfe,  /* #######. */
+	/*09dd:*/	0xfe,  /* #######. */
+	/*09de:*/	0x38,  /* ..###... */
+	/*09df:*/	0x38,  /* ..###... */
+	/*09e0:*/	0x38,  /* ..###... */
+	/*09e1:*/	0x38,  /* ..###... */
+	/*09e2:*/	0x38,  /* ..###... */
+	/*09e3:*/	0x38,  /* ..###... */
+	/*09e4:*/	0x38,  /* ..###... */
+	/*09e5:*/	0x38,  /* ..###... */
+	/*09e6:*/	0x38,  /* ..###... */
+	/*09e7:*/	0x38,  /* ..###... */
+	/*09e8:*/	0x38,  /* ..###... */
+	/*09e9:*/	0x38,  /* ..###... */
+/* --- new character g (103) starting at offset 0x09ea --- */
+	/*09ea:*/	15, 12, 19, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*09ef:*/	0x1f,0x70,  /* ...#####.###.... */
+	/*09f1:*/	0x3f,0xf0,  /* ..##########.... */
+	/*09f3:*/	0x79,0xf0,  /* .####..#####.... */
+	/*09f5:*/	0x70,0xf0,  /* .###....####.... */
+	/*09f7:*/	0xe0,0x70,  /* ###......###.... */
+	/*09f9:*/	0xe0,0x70,  /* ###......###.... */
+	/*09fb:*/	0xe0,0x70,  /* ###......###.... */
+	/*09fd:*/	0xe0,0x70,  /* ###......###.... */
+	/*09ff:*/	0xe0,0x70,  /* ###......###.... */
+	/*0a01:*/	0xe0,0x70,  /* ###......###.... */
+	/*0a03:*/	0x70,0xf0,  /* .###....####.... */
+	/*0a05:*/	0x79,0xf0,  /* .####..#####.... */
+	/*0a07:*/	0x3f,0xf0,  /* ..##########.... */
+	/*0a09:*/	0x1f,0x70,  /* ...#####.###.... */
+	/*0a0b:*/	0x00,0x70,  /* .........###.... */
+	/*0a0d:*/	0xe0,0x70,  /* ###......###.... */
+	/*0a0f:*/	0xf0,0xe0,  /* ####....###..... */
+	/*0a11:*/	0x7f,0xe0,  /* .##########..... */
+	/*0a13:*/	0x1f,0x80,  /* ...######....... */
+/* --- new character h (104) starting at offset 0x0a15 --- */
+	/*0a15:*/	15, 11, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0a1a:*/	0xe0,0x00,  /* ###............. */
+	/*0a1c:*/	0xe0,0x00,  /* ###............. */
+	/*0a1e:*/	0xe0,0x00,  /* ###............. */
+	/*0a20:*/	0xe0,0x00,  /* ###............. */
+	/*0a22:*/	0xe0,0x00,  /* ###............. */
+	/*0a24:*/	0xef,0x00,  /* ###.####........ */
+	/*0a26:*/	0xff,0xc0,  /* ##########...... */
+	/*0a28:*/	0xf1,0xc0,  /* ####...###...... */
+	/*0a2a:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0a2c:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0a2e:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0a30:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0a32:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0a34:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0a36:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0a38:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0a3a:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0a3c:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0a3e:*/	0xe0,0xe0,  /* ###.....###..... */
+/* --- new character i (105) starting at offset 0x0a40 --- */
+	/*0a40:*/	7, 3, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0a45:*/	0xe0,  /* ###..... */
+	/*0a46:*/	0xe0,  /* ###..... */
+	/*0a47:*/	0xe0,  /* ###..... */
+	/*0a48:*/	0x00,  /* ........ */
+	/*0a49:*/	0x00,  /* ........ */
+	/*0a4a:*/	0xe0,  /* ###..... */
+	/*0a4b:*/	0xe0,  /* ###..... */
+	/*0a4c:*/	0xe0,  /* ###..... */
+	/*0a4d:*/	0xe0,  /* ###..... */
+	/*0a4e:*/	0xe0,  /* ###..... */
+	/*0a4f:*/	0xe0,  /* ###..... */
+	/*0a50:*/	0xe0,  /* ###..... */
+	/*0a51:*/	0xe0,  /* ###..... */
+	/*0a52:*/	0xe0,  /* ###..... */
+	/*0a53:*/	0xe0,  /* ###..... */
+	/*0a54:*/	0xe0,  /* ###..... */
+	/*0a55:*/	0xe0,  /* ###..... */
+	/*0a56:*/	0xe0,  /* ###..... */
+	/*0a57:*/	0xe0,  /* ###..... */
+/* --- new character j (106) starting at offset 0x0a58 --- */
+	/*0a58:*/	7, 5, 24, 0, -5, /* width and bbox (w,h,x,y) */ 
+	/*0a5d:*/	0x38,  /* ..###... */
+	/*0a5e:*/	0x38,  /* ..###... */
+	/*0a5f:*/	0x38,  /* ..###... */
+	/*0a60:*/	0x00,  /* ........ */
+	/*0a61:*/	0x00,  /* ........ */
+	/*0a62:*/	0x38,  /* ..###... */
+	/*0a63:*/	0x38,  /* ..###... */
+	/*0a64:*/	0x38,  /* ..###... */
+	/*0a65:*/	0x38,  /* ..###... */
+	/*0a66:*/	0x38,  /* ..###... */
+	/*0a67:*/	0x38,  /* ..###... */
+	/*0a68:*/	0x38,  /* ..###... */
+	/*0a69:*/	0x38,  /* ..###... */
+	/*0a6a:*/	0x38,  /* ..###... */
+	/*0a6b:*/	0x38,  /* ..###... */
+	/*0a6c:*/	0x38,  /* ..###... */
+	/*0a6d:*/	0x38,  /* ..###... */
+	/*0a6e:*/	0x38,  /* ..###... */
+	/*0a6f:*/	0x38,  /* ..###... */
+	/*0a70:*/	0x38,  /* ..###... */
+	/*0a71:*/	0x38,  /* ..###... */
+	/*0a72:*/	0x38,  /* ..###... */
+	/*0a73:*/	0xf8,  /* #####... */
+	/*0a74:*/	0xf0,  /* ####.... */
+/* --- new character k (107) starting at offset 0x0a75 --- */
+	/*0a75:*/	14, 12, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0a7a:*/	0xe0,0x00,  /* ###............. */
+	/*0a7c:*/	0xe0,0x00,  /* ###............. */
+	/*0a7e:*/	0xe0,0x00,  /* ###............. */
+	/*0a80:*/	0xe0,0x00,  /* ###............. */
+	/*0a82:*/	0xe0,0x00,  /* ###............. */
+	/*0a84:*/	0xe1,0xe0,  /* ###....####..... */
+	/*0a86:*/	0xe3,0xc0,  /* ###...####...... */
+	/*0a88:*/	0xe7,0x80,  /* ###..####....... */
+	/*0a8a:*/	0xef,0x00,  /* ###.####........ */
+	/*0a8c:*/	0xfe,0x00,  /* #######......... */
+	/*0a8e:*/	0xfc,0x00,  /* ######.......... */
+	/*0a90:*/	0xfe,0x00,  /* #######......... */
+	/*0a92:*/	0xef,0x00,  /* ###.####........ */
+	/*0a94:*/	0xe7,0x00,  /* ###..###........ */
+	/*0a96:*/	0xe7,0x80,  /* ###..####....... */
+	/*0a98:*/	0xe3,0xc0,  /* ###...####...... */
+	/*0a9a:*/	0xe1,0xc0,  /* ###....###...... */
+	/*0a9c:*/	0xe1,0xe0,  /* ###....####..... */
+	/*0a9e:*/	0xe0,0xf0,  /* ###.....####.... */
+/* --- new character l (108) starting at offset 0x0aa0 --- */
+	/*0aa0:*/	7, 3, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0aa5:*/	0xe0,  /* ###..... */
+	/*0aa6:*/	0xe0,  /* ###..... */
+	/*0aa7:*/	0xe0,  /* ###..... */
+	/*0aa8:*/	0xe0,  /* ###..... */
+	/*0aa9:*/	0xe0,  /* ###..... */
+	/*0aaa:*/	0xe0,  /* ###..... */
+	/*0aab:*/	0xe0,  /* ###..... */
+	/*0aac:*/	0xe0,  /* ###..... */
+	/*0aad:*/	0xe0,  /* ###..... */
+	/*0aae:*/	0xe0,  /* ###..... */
+	/*0aaf:*/	0xe0,  /* ###..... */
+	/*0ab0:*/	0xe0,  /* ###..... */
+	/*0ab1:*/	0xe0,  /* ###..... */
+	/*0ab2:*/	0xe0,  /* ###..... */
+	/*0ab3:*/	0xe0,  /* ###..... */
+	/*0ab4:*/	0xe0,  /* ###..... */
+	/*0ab5:*/	0xe0,  /* ###..... */
+	/*0ab6:*/	0xe0,  /* ###..... */
+	/*0ab7:*/	0xe0,  /* ###..... */
+/* --- new character m (109) starting at offset 0x0ab8 --- */
+	/*0ab8:*/	21, 17, 14, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0abd:*/	0xef,0x3e,0x00,  /* ###.####..#####......... */
+	/*0ac0:*/	0xff,0xff,0x00,  /* ################........ */
+	/*0ac3:*/	0xf3,0xe7,0x80,  /* ####..#####..####....... */
+	/*0ac6:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+	/*0ac9:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+	/*0acc:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+	/*0acf:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+	/*0ad2:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+	/*0ad5:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+	/*0ad8:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+	/*0adb:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+	/*0ade:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+	/*0ae1:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+	/*0ae4:*/	0xe1,0xc3,0x80,  /* ###....###....###....... */
+/* --- new character n (110) starting at offset 0x0ae7 --- */
+	/*0ae7:*/	15, 11, 14, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0aec:*/	0xef,0x80,  /* ###.#####....... */
+	/*0aee:*/	0xff,0xc0,  /* ##########...... */
+	/*0af0:*/	0xf1,0xc0,  /* ####...###...... */
+	/*0af2:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0af4:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0af6:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0af8:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0afa:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0afc:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0afe:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0b00:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0b02:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0b04:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0b06:*/	0xe0,0xe0,  /* ###.....###..... */
+/* --- new character o (111) starting at offset 0x0b08 --- */
+	/*0b08:*/	14, 12, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0b0d:*/	0x0f,0x00,  /* ....####........ */
+	/*0b0f:*/	0x3f,0xc0,  /* ..########...... */
+	/*0b11:*/	0x79,0xe0,  /* .####..####..... */
+	/*0b13:*/	0x70,0xe0,  /* .###....###..... */
+	/*0b15:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b17:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b19:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b1b:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b1d:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b1f:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b21:*/	0x70,0xe0,  /* .###....###..... */
+	/*0b23:*/	0x79,0xe0,  /* .####..####..... */
+	/*0b25:*/	0x3f,0xc0,  /* ..########...... */
+	/*0b27:*/	0x0f,0x00,  /* ....####........ */
+/* --- new character p (112) starting at offset 0x0b29 --- */
+	/*0b29:*/	15, 12, 19, 2, -5, /* width and bbox (w,h,x,y) */ 
+	/*0b2e:*/	0xef,0x80,  /* ###.#####....... */
+	/*0b30:*/	0xff,0xc0,  /* ##########...... */
+	/*0b32:*/	0xf9,0xe0,  /* #####..####..... */
+	/*0b34:*/	0xf0,0xe0,  /* ####....###..... */
+	/*0b36:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b38:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b3a:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b3c:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b3e:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b40:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b42:*/	0xf0,0xe0,  /* ####....###..... */
+	/*0b44:*/	0xf9,0xe0,  /* #####..####..... */
+	/*0b46:*/	0xff,0xc0,  /* ##########...... */
+	/*0b48:*/	0xef,0x80,  /* ###.#####....... */
+	/*0b4a:*/	0xe0,0x00,  /* ###............. */
+	/*0b4c:*/	0xe0,0x00,  /* ###............. */
+	/*0b4e:*/	0xe0,0x00,  /* ###............. */
+	/*0b50:*/	0xe0,0x00,  /* ###............. */
+	/*0b52:*/	0xe0,0x00,  /* ###............. */
+/* --- new character q (113) starting at offset 0x0b54 --- */
+	/*0b54:*/	15, 12, 19, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*0b59:*/	0x1f,0x70,  /* ...#####.###.... */
+	/*0b5b:*/	0x3f,0xf0,  /* ..##########.... */
+	/*0b5d:*/	0x79,0xf0,  /* .####..#####.... */
+	/*0b5f:*/	0x70,0xf0,  /* .###....####.... */
+	/*0b61:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b63:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b65:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b67:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b69:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b6b:*/	0xe0,0x70,  /* ###......###.... */
+	/*0b6d:*/	0x70,0xf0,  /* .###....####.... */
+	/*0b6f:*/	0x79,0xf0,  /* .####..#####.... */
+	/*0b71:*/	0x3f,0xf0,  /* ..##########.... */
+	/*0b73:*/	0x1f,0x70,  /* ...#####.###.... */
+	/*0b75:*/	0x00,0x70,  /* .........###.... */
+	/*0b77:*/	0x00,0x70,  /* .........###.... */
+	/*0b79:*/	0x00,0x70,  /* .........###.... */
+	/*0b7b:*/	0x00,0x70,  /* .........###.... */
+	/*0b7d:*/	0x00,0x70,  /* .........###.... */
+/* --- new character r (114) starting at offset 0x0b7f --- */
+	/*0b7f:*/	10, 7, 14, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0b84:*/	0xe6,  /* ###..##. */
+	/*0b85:*/	0xee,  /* ###.###. */
+	/*0b86:*/	0xfe,  /* #######. */
+	/*0b87:*/	0xf0,  /* ####.... */
+	/*0b88:*/	0xe0,  /* ###..... */
+	/*0b89:*/	0xe0,  /* ###..... */
+	/*0b8a:*/	0xe0,  /* ###..... */
+	/*0b8b:*/	0xe0,  /* ###..... */
+	/*0b8c:*/	0xe0,  /* ###..... */
+	/*0b8d:*/	0xe0,  /* ###..... */
+	/*0b8e:*/	0xe0,  /* ###..... */
+	/*0b8f:*/	0xe0,  /* ###..... */
+	/*0b90:*/	0xe0,  /* ###..... */
+	/*0b91:*/	0xe0,  /* ###..... */
+/* --- new character s (115) starting at offset 0x0b92 --- */
+	/*0b92:*/	13, 11, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0b97:*/	0x3f,0x00,  /* ..######........ */
+	/*0b99:*/	0x7f,0x80,  /* .########....... */
+	/*0b9b:*/	0xf3,0xc0,  /* ####..####...... */
+	/*0b9d:*/	0xe1,0xc0,  /* ###....###...... */
+	/*0b9f:*/	0xe0,0x00,  /* ###............. */
+	/*0ba1:*/	0xfc,0x00,  /* ######.......... */
+	/*0ba3:*/	0x7f,0x80,  /* .########....... */
+	/*0ba5:*/	0x0f,0xc0,  /* ....######...... */
+	/*0ba7:*/	0x01,0xe0,  /* .......####..... */
+	/*0ba9:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0bab:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0bad:*/	0xf1,0xe0,  /* ####...####..... */
+	/*0baf:*/	0x7f,0xc0,  /* .#########...... */
+	/*0bb1:*/	0x3f,0x80,  /* ..#######....... */
+/* --- new character t (116) starting at offset 0x0bb3 --- */
+	/*0bb3:*/	9, 7, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0bb8:*/	0x38,  /* ..###... */
+	/*0bb9:*/	0x38,  /* ..###... */
+	/*0bba:*/	0x38,  /* ..###... */
+	/*0bbb:*/	0x38,  /* ..###... */
+	/*0bbc:*/	0xfe,  /* #######. */
+	/*0bbd:*/	0xfe,  /* #######. */
+	/*0bbe:*/	0x38,  /* ..###... */
+	/*0bbf:*/	0x38,  /* ..###... */
+	/*0bc0:*/	0x38,  /* ..###... */
+	/*0bc1:*/	0x38,  /* ..###... */
+	/*0bc2:*/	0x38,  /* ..###... */
+	/*0bc3:*/	0x38,  /* ..###... */
+	/*0bc4:*/	0x38,  /* ..###... */
+	/*0bc5:*/	0x38,  /* ..###... */
+	/*0bc6:*/	0x38,  /* ..###... */
+	/*0bc7:*/	0x38,  /* ..###... */
+	/*0bc8:*/	0x3e,  /* ..#####. */
+	/*0bc9:*/	0x1e,  /* ...####. */
+/* --- new character u (117) starting at offset 0x0bca --- */
+	/*0bca:*/	15, 11, 14, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0bcf:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0bd1:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0bd3:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0bd5:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0bd7:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0bd9:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0bdb:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0bdd:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0bdf:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0be1:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0be3:*/	0xe1,0xe0,  /* ###....####..... */
+	/*0be5:*/	0x73,0xe0,  /* .###..#####..... */
+	/*0be7:*/	0x7e,0xe0,  /* .######.###..... */
+	/*0be9:*/	0x1c,0xe0,  /* ...###..###..... */
+/* --- new character v (118) starting at offset 0x0beb --- */
+	/*0beb:*/	14, 12, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0bf0:*/	0xe0,0x70,  /* ###......###.... */
+	/*0bf2:*/	0xe0,0x70,  /* ###......###.... */
+	/*0bf4:*/	0xe0,0x70,  /* ###......###.... */
+	/*0bf6:*/	0x70,0xe0,  /* .###....###..... */
+	/*0bf8:*/	0x70,0xe0,  /* .###....###..... */
+	/*0bfa:*/	0x70,0xe0,  /* .###....###..... */
+	/*0bfc:*/	0x39,0xc0,  /* ..###..###...... */
+	/*0bfe:*/	0x39,0xc0,  /* ..###..###...... */
+	/*0c00:*/	0x39,0xc0,  /* ..###..###...... */
+	/*0c02:*/	0x1f,0x80,  /* ...######....... */
+	/*0c04:*/	0x1f,0x80,  /* ...######....... */
+	/*0c06:*/	0x0f,0x00,  /* ....####........ */
+	/*0c08:*/	0x0f,0x00,  /* ....####........ */
+	/*0c0a:*/	0x0f,0x00,  /* ....####........ */
+/* --- new character w (119) starting at offset 0x0c0c --- */
+	/*0c0c:*/	19, 19, 14, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0c11:*/	0xe0,0xe0,0xe0,  /* ###.....###.....###..... */
+	/*0c14:*/	0xe0,0xe0,0xe0,  /* ###.....###.....###..... */
+	/*0c17:*/	0x60,0xe0,0xc0,  /* .##.....###.....##...... */
+	/*0c1a:*/	0x71,0xf1,0xc0,  /* .###...#####...###...... */
+	/*0c1d:*/	0x71,0xf1,0xc0,  /* .###...#####...###...... */
+	/*0c20:*/	0x31,0xb1,0x80,  /* ..##...##.##...##....... */
+	/*0c23:*/	0x33,0xb9,0x80,  /* ..##..###.###..##....... */
+	/*0c26:*/	0x3b,0xbb,0x80,  /* ..###.###.###.###....... */
+	/*0c29:*/	0x1b,0x1b,0x00,  /* ...##.##...##.##........ */
+	/*0c2c:*/	0x1f,0x1f,0x00,  /* ...#####...#####........ */
+	/*0c2f:*/	0x1f,0x1f,0x00,  /* ...#####...#####........ */
+	/*0c32:*/	0x0e,0x0e,0x00,  /* ....###.....###......... */
+	/*0c35:*/	0x0e,0x0e,0x00,  /* ....###.....###......... */
+	/*0c38:*/	0x0e,0x0e,0x00,  /* ....###.....###......... */
+/* --- new character x (120) starting at offset 0x0c3b --- */
+	/*0c3b:*/	13, 11, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0c40:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*0c42:*/	0xf1,0xe0,  /* ####...####..... */
+	/*0c44:*/	0x71,0xc0,  /* .###...###...... */
+	/*0c46:*/	0x3b,0x80,  /* ..###.###....... */
+	/*0c48:*/	0x3f,0x80,  /* ..#######....... */
+	/*0c4a:*/	0x1f,0x00,  /* ...#####........ */
+	/*0c4c:*/	0x0e,0x00,  /* ....###......... */
+	/*0c4e:*/	0x1f,0x00,  /* ...#####........ */
+	/*0c50:*/	0x1f,0x00,  /* ...#####........ */
+	/*0c52:*/	0x3b,0x80,  /* ..###.###....... */
+	/*0c54:*/	0x7b,0xc0,  /* .####.####...... */
+	/*0c56:*/	0x71,0xc0,  /* .###...###...... */
+	/*0c58:*/	0xf1,0xe0,  /* ####...####..... */
+	/*0c5a:*/	0xe0,0xe0,  /* ###.....###..... */
+/* --- new character y (121) starting at offset 0x0c5c --- */
+	/*0c5c:*/	15, 13, 19, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*0c61:*/	0xe0,0x38,  /* ###.......###... */
+	/*0c63:*/	0xe0,0x38,  /* ###.......###... */
+	/*0c65:*/	0x70,0x38,  /* .###......###... */
+	/*0c67:*/	0x78,0x70,  /* .####....###.... */
+	/*0c69:*/	0x38,0x70,  /* ..###....###.... */
+	/*0c6b:*/	0x3c,0xf0,  /* ..####..####.... */
+	/*0c6d:*/	0x1c,0xe0,  /* ...###..###..... */
+	/*0c6f:*/	0x1c,0xe0,  /* ...###..###..... */
+	/*0c71:*/	0x0f,0xc0,  /* ....######...... */
+	/*0c73:*/	0x0f,0xc0,  /* ....######...... */
+	/*0c75:*/	0x07,0xc0,  /* .....#####...... */
+	/*0c77:*/	0x07,0x80,  /* .....####....... */
+	/*0c79:*/	0x03,0x80,  /* ......###....... */
+	/*0c7b:*/	0x03,0x80,  /* ......###....... */
+	/*0c7d:*/	0x07,0x00,  /* .....###........ */
+	/*0c7f:*/	0x07,0x00,  /* .....###........ */
+	/*0c81:*/	0x0e,0x00,  /* ....###......... */
+	/*0c83:*/	0x3e,0x00,  /* ..#####......... */
+	/*0c85:*/	0x3c,0x00,  /* ..####.......... */
+/* --- new character z (122) starting at offset 0x0c87 --- */
+	/*0c87:*/	13, 11, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0c8c:*/	0xff,0xe0,  /* ###########..... */
+	/*0c8e:*/	0xff,0xe0,  /* ###########..... */
+	/*0c90:*/	0x01,0xc0,  /* .......###...... */
+	/*0c92:*/	0x03,0x80,  /* ......###....... */
+	/*0c94:*/	0x07,0x80,  /* .....####....... */
+	/*0c96:*/	0x0f,0x00,  /* ....####........ */
+	/*0c98:*/	0x0e,0x00,  /* ....###......... */
+	/*0c9a:*/	0x1e,0x00,  /* ...####......... */
+	/*0c9c:*/	0x3c,0x00,  /* ..####.......... */
+	/*0c9e:*/	0x38,0x00,  /* ..###........... */
+	/*0ca0:*/	0x70,0x00,  /* .###............ */
+	/*0ca2:*/	0xf0,0x00,  /* ####............ */
+	/*0ca4:*/	0xff,0xe0,  /* ###########..... */
+	/*0ca6:*/	0xff,0xe0,  /* ###########..... */
+/* --- new character braceleft (123) starting at offset 0x0ca8 --- */
+	/*0ca8:*/	10, 7, 24, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*0cad:*/	0x0e,  /* ....###. */
+	/*0cae:*/	0x1c,  /* ...###.. */
+	/*0caf:*/	0x38,  /* ..###... */
+	/*0cb0:*/	0x38,  /* ..###... */
+	/*0cb1:*/	0x38,  /* ..###... */
+	/*0cb2:*/	0x38,  /* ..###... */
+	/*0cb3:*/	0x38,  /* ..###... */
+	/*0cb4:*/	0x38,  /* ..###... */
+	/*0cb5:*/	0x38,  /* ..###... */
+	/*0cb6:*/	0x38,  /* ..###... */
+	/*0cb7:*/	0x70,  /* .###.... */
+	/*0cb8:*/	0xe0,  /* ###..... */
+	/*0cb9:*/	0xe0,  /* ###..... */
+	/*0cba:*/	0x70,  /* .###.... */
+	/*0cbb:*/	0x38,  /* ..###... */
+	/*0cbc:*/	0x38,  /* ..###... */
+	/*0cbd:*/	0x38,  /* ..###... */
+	/*0cbe:*/	0x38,  /* ..###... */
+	/*0cbf:*/	0x38,  /* ..###... */
+	/*0cc0:*/	0x38,  /* ..###... */
+	/*0cc1:*/	0x38,  /* ..###... */
+	/*0cc2:*/	0x38,  /* ..###... */
+	/*0cc3:*/	0x1c,  /* ...###.. */
+	/*0cc4:*/	0x0e,  /* ....###. */
+/* --- new character bar (124) starting at offset 0x0cc5 --- */
+	/*0cc5:*/	7, 3, 24, 2, -5, /* width and bbox (w,h,x,y) */ 
+	/*0cca:*/	0xe0,  /* ###..... */
+	/*0ccb:*/	0xe0,  /* ###..... */
+	/*0ccc:*/	0xe0,  /* ###..... */
+	/*0ccd:*/	0xe0,  /* ###..... */
+	/*0cce:*/	0xe0,  /* ###..... */
+	/*0ccf:*/	0xe0,  /* ###..... */
+	/*0cd0:*/	0xe0,  /* ###..... */
+	/*0cd1:*/	0xe0,  /* ###..... */
+	/*0cd2:*/	0xe0,  /* ###..... */
+	/*0cd3:*/	0xe0,  /* ###..... */
+	/*0cd4:*/	0xe0,  /* ###..... */
+	/*0cd5:*/	0xe0,  /* ###..... */
+	/*0cd6:*/	0xe0,  /* ###..... */
+	/*0cd7:*/	0xe0,  /* ###..... */
+	/*0cd8:*/	0xe0,  /* ###..... */
+	/*0cd9:*/	0xe0,  /* ###..... */
+	/*0cda:*/	0xe0,  /* ###..... */
+	/*0cdb:*/	0xe0,  /* ###..... */
+	/*0cdc:*/	0xe0,  /* ###..... */
+	/*0cdd:*/	0xe0,  /* ###..... */
+	/*0cde:*/	0xe0,  /* ###..... */
+	/*0cdf:*/	0xe0,  /* ###..... */
+	/*0ce0:*/	0xe0,  /* ###..... */
+	/*0ce1:*/	0xe0,  /* ###..... */
+/* --- new character braceright (125) starting at offset 0x0ce2 --- */
+	/*0ce2:*/	10, 7, 24, 2, -5, /* width and bbox (w,h,x,y) */ 
+	/*0ce7:*/	0xe0,  /* ###..... */
+	/*0ce8:*/	0x70,  /* .###.... */
+	/*0ce9:*/	0x38,  /* ..###... */
+	/*0cea:*/	0x38,  /* ..###... */
+	/*0ceb:*/	0x38,  /* ..###... */
+	/*0cec:*/	0x38,  /* ..###... */
+	/*0ced:*/	0x38,  /* ..###... */
+	/*0cee:*/	0x38,  /* ..###... */
+	/*0cef:*/	0x38,  /* ..###... */
+	/*0cf0:*/	0x38,  /* ..###... */
+	/*0cf1:*/	0x1c,  /* ...###.. */
+	/*0cf2:*/	0x0e,  /* ....###. */
+	/*0cf3:*/	0x0e,  /* ....###. */
+	/*0cf4:*/	0x1c,  /* ...###.. */
+	/*0cf5:*/	0x38,  /* ..###... */
+	/*0cf6:*/	0x38,  /* ..###... */
+	/*0cf7:*/	0x38,  /* ..###... */
+	/*0cf8:*/	0x38,  /* ..###... */
+	/*0cf9:*/	0x38,  /* ..###... */
+	/*0cfa:*/	0x38,  /* ..###... */
+	/*0cfb:*/	0x38,  /* ..###... */
+	/*0cfc:*/	0x38,  /* ..###... */
+	/*0cfd:*/	0x70,  /* .###.... */
+	/*0cfe:*/	0xe0,  /* ###..... */
+/* --- new character asciitilde (126) starting at offset 0x0cff --- */
+	/*0cff:*/	14, 11, 4, 1, 5, /* width and bbox (w,h,x,y) */ 
+	/*0d04:*/	0x78,0xe0,  /* .####...###..... */
+	/*0d06:*/	0xfe,0xe0,  /* #######.###..... */
+	/*0d08:*/	0xef,0xe0,  /* ###.#######..... */
+	/*0d0a:*/	0xe3,0xc0,  /* ###...####...... */
+};
+static const uint16_t font_helvB24_offsets[] = {
+0x0000 /* space */,
+	0x0006 /* exclam */,
+	0x001e /* quotedbl */,
+	0x0029 /* numbersign */,
+	0x0052 /* dollar */,
+	0x0081 /* percent */,
+	0x00bc /* ampersand */,
+	0x00e5 /* quotesingle */,
+	0x00f0 /* parenleft */,
+	0x010d /* parenright */,
+	0x012a /* asterisk */,
+	0x0136 /* plus */,
+	0x0153 /* comma */,
+	0x015e /* hyphen */,
+	0x0166 /* period */,
+	0x016e /* slash */,
+	0x0186 /* zero */,
+	0x01af /* one */,
+	0x01c6 /* two */,
+	0x01ef /* three */,
+	0x0218 /* four */,
+	0x0241 /* five */,
+	0x026a /* six */,
+	0x0293 /* seven */,
+	0x02bc /* eight */,
+	0x02e5 /* nine */,
+	0x030e /* colon */,
+	0x0321 /* semicolon */,
+	0x0337 /* less */,
+	0x0354 /* equal */,
+	0x0365 /* greater */,
+	0x0382 /* question */,
+	0x03ad /* at */,
+	0x03f4 /* A */,
+	0x041f /* B */,
+	0x044a /* C */,
+	0x0475 /* D */,
+	0x04a0 /* E */,
+	0x04cb /* F */,
+	0x04f6 /* G */,
+	0x0534 /* H */,
+	0x055f /* I */,
+	0x0577 /* J */,
+	0x05a2 /* K */,
+	0x05cd /* L */,
+	0x05f8 /* M */,
+	0x0636 /* N */,
+	0x0661 /* O */,
+	0x069f /* P */,
+	0x06ca /* Q */,
+	0x0708 /* R */,
+	0x0733 /* S */,
+	0x075e /* T */,
+	0x0789 /* U */,
+	0x07b4 /* V */,
+	0x07df /* W */,
+	0x081d /* X */,
+	0x0848 /* Y */,
+	0x0873 /* Z */,
+	0x089e /* bracketleft */,
+	0x08bb /* backslash */,
+	0x08d3 /* bracketright */,
+	0x08f0 /* asciicircum */,
+	0x0907 /* underscore */,
+	0x0910 /* grave */,
+	0x0919 /* a */,
+	0x093a /* b */,
+	0x0965 /* c */,
+	0x0986 /* d */,
+	0x09b1 /* e */,
+	0x09d2 /* f */,
+	0x09ea /* g */,
+	0x0a15 /* h */,
+	0x0a40 /* i */,
+	0x0a58 /* j */,
+	0x0a75 /* k */,
+	0x0aa0 /* l */,
+	0x0ab8 /* m */,
+	0x0ae7 /* n */,
+	0x0b08 /* o */,
+	0x0b29 /* p */,
+	0x0b54 /* q */,
+	0x0b7f /* r */,
+	0x0b92 /* s */,
+	0x0bb3 /* t */,
+	0x0bca /* u */,
+	0x0beb /* v */,
+	0x0c0c /* w */,
+	0x0c3b /* x */,
+	0x0c5c /* y */,
+	0x0c87 /* z */,
+	0x0ca8 /* braceleft */,
+	0x0cc5 /* bar */,
+	0x0ce2 /* braceright */,
+	0x0cff /* asciitilde */,
+	0xffff /* (no glyph) */
+};
+const struct fb_font font_helvB24 = {
+	.height = 27,
+	.ascent = 22,
+	.firstchar = 32, /* space */
+	.lastchar = 127, /* ? */
+	.chardata = font_helvB24_data,
+	.charoffs = font_helvB24_offsets,
+};
diff --git a/src/target/firmware/fb/helvR08.c b/src/target/firmware/fb/helvR08.c
new file mode 100644
index 00000000..7ebf82ea
--- /dev/null
+++ b/src/target/firmware/fb/helvR08.c
@@ -0,0 +1,826 @@
+#include <fb/font.h>
+static const uint8_t font_helvR08_data[] = {
+/* --- new character space (32) starting at offset 0x0000 --- */
+	/*0000:*/	2, 1, 1, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0005:*/	0x00,  /* ........ */
+/* --- new character exclam (33) starting at offset 0x0006 --- */
+	/*0006:*/	2, 1, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*000b:*/	0x80,  /* #....... */
+	/*000c:*/	0x80,  /* #....... */
+	/*000d:*/	0x80,  /* #....... */
+	/*000e:*/	0x80,  /* #....... */
+	/*000f:*/	0x00,  /* ........ */
+	/*0010:*/	0x80,  /* #....... */
+/* --- new character quotedbl (34) starting at offset 0x0011 --- */
+	/*0011:*/	3, 3, 3, 1, 3, /* width and bbox (w,h,x,y) */ 
+	/*0016:*/	0xa0,  /* #.#..... */
+	/*0017:*/	0xa0,  /* #.#..... */
+	/*0018:*/	0xa0,  /* #.#..... */
+/* --- new character numbersign (35) starting at offset 0x0019 --- */
+	/*0019:*/	5, 5, 5, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*001e:*/	0x50,  /* .#.#.... */
+	/*001f:*/	0xf8,  /* #####... */
+	/*0020:*/	0x50,  /* .#.#.... */
+	/*0021:*/	0xf8,  /* #####... */
+	/*0022:*/	0x50,  /* .#.#.... */
+/* --- new character dollar (36) starting at offset 0x0023 --- */
+	/*0023:*/	5, 4, 7, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*0028:*/	0x20,  /* ..#..... */
+	/*0029:*/	0x70,  /* .###.... */
+	/*002a:*/	0x80,  /* #....... */
+	/*002b:*/	0x60,  /* .##..... */
+	/*002c:*/	0x10,  /* ...#.... */
+	/*002d:*/	0xe0,  /* ###..... */
+	/*002e:*/	0x40,  /* .#...... */
+/* --- new character percent (37) starting at offset 0x002f --- */
+	/*002f:*/	7, 6, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0034:*/	0xe8,  /* ###.#... */
+	/*0035:*/	0xa8,  /* #.#.#... */
+	/*0036:*/	0xd0,  /* ##.#.... */
+	/*0037:*/	0x2c,  /* ..#.##.. */
+	/*0038:*/	0x54,  /* .#.#.#.. */
+	/*0039:*/	0x5c,  /* .#.###.. */
+/* --- new character ampersand (38) starting at offset 0x003a --- */
+	/*003a:*/	6, 5, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*003f:*/	0x40,  /* .#...... */
+	/*0040:*/	0xa0,  /* #.#..... */
+	/*0041:*/	0x48,  /* .#..#... */
+	/*0042:*/	0xa8,  /* #.#.#... */
+	/*0043:*/	0xb0,  /* #.##.... */
+	/*0044:*/	0x58,  /* .#.##... */
+/* --- new character quotesingle (39) starting at offset 0x0045 --- */
+	/*0045:*/	2, 1, 2, 0, 6, /* width and bbox (w,h,x,y) */ 
+	/*004a:*/	0x80,  /* #....... */
+	/*004b:*/	0x80,  /* #....... */
+/* --- new character parenleft (40) starting at offset 0x004c --- */
+	/*004c:*/	3, 2, 7, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*0051:*/	0x40,  /* .#...... */
+	/*0052:*/	0x80,  /* #....... */
+	/*0053:*/	0x80,  /* #....... */
+	/*0054:*/	0x80,  /* #....... */
+	/*0055:*/	0x80,  /* #....... */
+	/*0056:*/	0x80,  /* #....... */
+	/*0057:*/	0x40,  /* .#...... */
+/* --- new character parenright (41) starting at offset 0x0058 --- */
+	/*0058:*/	3, 2, 7, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*005d:*/	0x80,  /* #....... */
+	/*005e:*/	0x40,  /* .#...... */
+	/*005f:*/	0x40,  /* .#...... */
+	/*0060:*/	0x40,  /* .#...... */
+	/*0061:*/	0x40,  /* .#...... */
+	/*0062:*/	0x40,  /* .#...... */
+	/*0063:*/	0x80,  /* #....... */
+/* --- new character asterisk (42) starting at offset 0x0064 --- */
+	/*0064:*/	3, 3, 3, 1, 2, /* width and bbox (w,h,x,y) */ 
+	/*0069:*/	0x40,  /* .#...... */
+	/*006a:*/	0xe0,  /* ###..... */
+	/*006b:*/	0x40,  /* .#...... */
+/* --- new character plus (43) starting at offset 0x006c --- */
+	/*006c:*/	5, 5, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0071:*/	0x20,  /* ..#..... */
+	/*0072:*/	0x20,  /* ..#..... */
+	/*0073:*/	0xf8,  /* #####... */
+	/*0074:*/	0x20,  /* ..#..... */
+	/*0075:*/	0x20,  /* ..#..... */
+/* --- new character comma (44) starting at offset 0x0076 --- */
+	/*0076:*/	2, 2, 3, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*007b:*/	0x40,  /* .#...... */
+	/*007c:*/	0x40,  /* .#...... */
+	/*007d:*/	0x80,  /* #....... */
+/* --- new character hyphen (45) starting at offset 0x007e --- */
+	/*007e:*/	3, 2, 1, 0, 2, /* width and bbox (w,h,x,y) */ 
+	/*0083:*/	0xc0,  /* ##...... */
+/* --- new character period (46) starting at offset 0x0084 --- */
+	/*0084:*/	2, 1, 1, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0089:*/	0x80,  /* #....... */
+/* --- new character slash (47) starting at offset 0x008a --- */
+	/*008a:*/	2, 2, 7, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*008f:*/	0x40,  /* .#...... */
+	/*0090:*/	0x40,  /* .#...... */
+	/*0091:*/	0x40,  /* .#...... */
+	/*0092:*/	0x80,  /* #....... */
+	/*0093:*/	0x80,  /* #....... */
+	/*0094:*/	0x80,  /* #....... */
+	/*0095:*/	0x80,  /* #....... */
+/* --- new character zero (48) starting at offset 0x0096 --- */
+	/*0096:*/	5, 4, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*009b:*/	0x60,  /* .##..... */
+	/*009c:*/	0x90,  /* #..#.... */
+	/*009d:*/	0x90,  /* #..#.... */
+	/*009e:*/	0x90,  /* #..#.... */
+	/*009f:*/	0x90,  /* #..#.... */
+	/*00a0:*/	0x60,  /* .##..... */
+/* --- new character one (49) starting at offset 0x00a1 --- */
+	/*00a1:*/	5, 2, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*00a6:*/	0x40,  /* .#...... */
+	/*00a7:*/	0xc0,  /* ##...... */
+	/*00a8:*/	0x40,  /* .#...... */
+	/*00a9:*/	0x40,  /* .#...... */
+	/*00aa:*/	0x40,  /* .#...... */
+	/*00ab:*/	0x40,  /* .#...... */
+/* --- new character two (50) starting at offset 0x00ac --- */
+	/*00ac:*/	5, 4, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00b1:*/	0x60,  /* .##..... */
+	/*00b2:*/	0x90,  /* #..#.... */
+	/*00b3:*/	0x10,  /* ...#.... */
+	/*00b4:*/	0x20,  /* ..#..... */
+	/*00b5:*/	0x40,  /* .#...... */
+	/*00b6:*/	0xf0,  /* ####.... */
+/* --- new character three (51) starting at offset 0x00b7 --- */
+	/*00b7:*/	5, 3, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*00bc:*/	0xc0,  /* ##...... */
+	/*00bd:*/	0x20,  /* ..#..... */
+	/*00be:*/	0xc0,  /* ##...... */
+	/*00bf:*/	0x20,  /* ..#..... */
+	/*00c0:*/	0x20,  /* ..#..... */
+	/*00c1:*/	0xc0,  /* ##...... */
+/* --- new character four (52) starting at offset 0x00c2 --- */
+	/*00c2:*/	5, 4, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00c7:*/	0x20,  /* ..#..... */
+	/*00c8:*/	0x20,  /* ..#..... */
+	/*00c9:*/	0x60,  /* .##..... */
+	/*00ca:*/	0xf0,  /* ####.... */
+	/*00cb:*/	0x20,  /* ..#..... */
+	/*00cc:*/	0x20,  /* ..#..... */
+/* --- new character five (53) starting at offset 0x00cd --- */
+	/*00cd:*/	5, 3, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*00d2:*/	0xe0,  /* ###..... */
+	/*00d3:*/	0x80,  /* #....... */
+	/*00d4:*/	0xc0,  /* ##...... */
+	/*00d5:*/	0x20,  /* ..#..... */
+	/*00d6:*/	0x20,  /* ..#..... */
+	/*00d7:*/	0xc0,  /* ##...... */
+/* --- new character six (54) starting at offset 0x00d8 --- */
+	/*00d8:*/	5, 4, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00dd:*/	0x70,  /* .###.... */
+	/*00de:*/	0x80,  /* #....... */
+	/*00df:*/	0xe0,  /* ###..... */
+	/*00e0:*/	0x90,  /* #..#.... */
+	/*00e1:*/	0x90,  /* #..#.... */
+	/*00e2:*/	0x60,  /* .##..... */
+/* --- new character seven (55) starting at offset 0x00e3 --- */
+	/*00e3:*/	5, 4, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00e8:*/	0xf0,  /* ####.... */
+	/*00e9:*/	0x10,  /* ...#.... */
+	/*00ea:*/	0x20,  /* ..#..... */
+	/*00eb:*/	0x40,  /* .#...... */
+	/*00ec:*/	0x40,  /* .#...... */
+	/*00ed:*/	0x40,  /* .#...... */
+/* --- new character eight (56) starting at offset 0x00ee --- */
+	/*00ee:*/	5, 4, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00f3:*/	0x60,  /* .##..... */
+	/*00f4:*/	0x90,  /* #..#.... */
+	/*00f5:*/	0x60,  /* .##..... */
+	/*00f6:*/	0x90,  /* #..#.... */
+	/*00f7:*/	0x90,  /* #..#.... */
+	/*00f8:*/	0x60,  /* .##..... */
+/* --- new character nine (57) starting at offset 0x00f9 --- */
+	/*00f9:*/	5, 4, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00fe:*/	0x60,  /* .##..... */
+	/*00ff:*/	0x90,  /* #..#.... */
+	/*0100:*/	0x90,  /* #..#.... */
+	/*0101:*/	0x70,  /* .###.... */
+	/*0102:*/	0x10,  /* ...#.... */
+	/*0103:*/	0x60,  /* .##..... */
+/* --- new character colon (58) starting at offset 0x0104 --- */
+	/*0104:*/	2, 1, 4, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0109:*/	0x80,  /* #....... */
+	/*010a:*/	0x00,  /* ........ */
+	/*010b:*/	0x00,  /* ........ */
+	/*010c:*/	0x80,  /* #....... */
+/* --- new character semicolon (59) starting at offset 0x010d --- */
+	/*010d:*/	2, 2, 6, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*0112:*/	0x40,  /* .#...... */
+	/*0113:*/	0x00,  /* ........ */
+	/*0114:*/	0x00,  /* ........ */
+	/*0115:*/	0x40,  /* .#...... */
+	/*0116:*/	0x40,  /* .#...... */
+	/*0117:*/	0x80,  /* #....... */
+/* --- new character less (60) starting at offset 0x0118 --- */
+	/*0118:*/	5, 3, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*011d:*/	0x20,  /* ..#..... */
+	/*011e:*/	0x40,  /* .#...... */
+	/*011f:*/	0x80,  /* #....... */
+	/*0120:*/	0x40,  /* .#...... */
+	/*0121:*/	0x20,  /* ..#..... */
+/* --- new character equal (61) starting at offset 0x0122 --- */
+	/*0122:*/	4, 3, 3, 1, 1, /* width and bbox (w,h,x,y) */ 
+	/*0127:*/	0xe0,  /* ###..... */
+	/*0128:*/	0x00,  /* ........ */
+	/*0129:*/	0xe0,  /* ###..... */
+/* --- new character greater (62) starting at offset 0x012a --- */
+	/*012a:*/	5, 3, 5, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*012f:*/	0x80,  /* #....... */
+	/*0130:*/	0x40,  /* .#...... */
+	/*0131:*/	0x20,  /* ..#..... */
+	/*0132:*/	0x40,  /* .#...... */
+	/*0133:*/	0x80,  /* #....... */
+/* --- new character question (63) starting at offset 0x0134 --- */
+	/*0134:*/	5, 3, 5, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0139:*/	0xc0,  /* ##...... */
+	/*013a:*/	0x20,  /* ..#..... */
+	/*013b:*/	0x40,  /* .#...... */
+	/*013c:*/	0x00,  /* ........ */
+	/*013d:*/	0x40,  /* .#...... */
+/* --- new character at (64) starting at offset 0x013e --- */
+	/*013e:*/	9, 8, 7, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*0143:*/	0x3e,  /* ..#####. */
+	/*0144:*/	0x41,  /* .#.....# */
+	/*0145:*/	0x99,  /* #..##..# */
+	/*0146:*/	0xa5,  /* #.#..#.# */
+	/*0147:*/	0x9e,  /* #..####. */
+	/*0148:*/	0x80,  /* #....... */
+	/*0149:*/	0x78,  /* .####... */
+/* --- new character A (65) starting at offset 0x014a --- */
+	/*014a:*/	6, 5, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*014f:*/	0x20,  /* ..#..... */
+	/*0150:*/	0x20,  /* ..#..... */
+	/*0151:*/	0x50,  /* .#.#.... */
+	/*0152:*/	0x70,  /* .###.... */
+	/*0153:*/	0x88,  /* #...#... */
+	/*0154:*/	0x88,  /* #...#... */
+/* --- new character B (66) starting at offset 0x0155 --- */
+	/*0155:*/	6, 4, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*015a:*/	0xe0,  /* ###..... */
+	/*015b:*/	0x90,  /* #..#.... */
+	/*015c:*/	0xe0,  /* ###..... */
+	/*015d:*/	0x90,  /* #..#.... */
+	/*015e:*/	0x90,  /* #..#.... */
+	/*015f:*/	0xe0,  /* ###..... */
+/* --- new character C (67) starting at offset 0x0160 --- */
+	/*0160:*/	6, 5, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0165:*/	0x70,  /* .###.... */
+	/*0166:*/	0x88,  /* #...#... */
+	/*0167:*/	0x80,  /* #....... */
+	/*0168:*/	0x80,  /* #....... */
+	/*0169:*/	0x88,  /* #...#... */
+	/*016a:*/	0x70,  /* .###.... */
+/* --- new character D (68) starting at offset 0x016b --- */
+	/*016b:*/	6, 5, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0170:*/	0xf0,  /* ####.... */
+	/*0171:*/	0x88,  /* #...#... */
+	/*0172:*/	0x88,  /* #...#... */
+	/*0173:*/	0x88,  /* #...#... */
+	/*0174:*/	0x88,  /* #...#... */
+	/*0175:*/	0xf0,  /* ####.... */
+/* --- new character E (69) starting at offset 0x0176 --- */
+	/*0176:*/	6, 4, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*017b:*/	0xf0,  /* ####.... */
+	/*017c:*/	0x80,  /* #....... */
+	/*017d:*/	0xe0,  /* ###..... */
+	/*017e:*/	0x80,  /* #....... */
+	/*017f:*/	0x80,  /* #....... */
+	/*0180:*/	0xf0,  /* ####.... */
+/* --- new character F (70) starting at offset 0x0181 --- */
+	/*0181:*/	5, 4, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0186:*/	0xf0,  /* ####.... */
+	/*0187:*/	0x80,  /* #....... */
+	/*0188:*/	0xe0,  /* ###..... */
+	/*0189:*/	0x80,  /* #....... */
+	/*018a:*/	0x80,  /* #....... */
+	/*018b:*/	0x80,  /* #....... */
+/* --- new character G (71) starting at offset 0x018c --- */
+	/*018c:*/	6, 5, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0191:*/	0x70,  /* .###.... */
+	/*0192:*/	0x80,  /* #....... */
+	/*0193:*/	0x98,  /* #..##... */
+	/*0194:*/	0x88,  /* #...#... */
+	/*0195:*/	0x88,  /* #...#... */
+	/*0196:*/	0x70,  /* .###.... */
+/* --- new character H (72) starting at offset 0x0197 --- */
+	/*0197:*/	6, 5, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*019c:*/	0x88,  /* #...#... */
+	/*019d:*/	0x88,  /* #...#... */
+	/*019e:*/	0xf8,  /* #####... */
+	/*019f:*/	0x88,  /* #...#... */
+	/*01a0:*/	0x88,  /* #...#... */
+	/*01a1:*/	0x88,  /* #...#... */
+/* --- new character I (73) starting at offset 0x01a2 --- */
+	/*01a2:*/	2, 1, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01a7:*/	0x80,  /* #....... */
+	/*01a8:*/	0x80,  /* #....... */
+	/*01a9:*/	0x80,  /* #....... */
+	/*01aa:*/	0x80,  /* #....... */
+	/*01ab:*/	0x80,  /* #....... */
+	/*01ac:*/	0x80,  /* #....... */
+/* --- new character J (74) starting at offset 0x01ad --- */
+	/*01ad:*/	4, 3, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01b2:*/	0x20,  /* ..#..... */
+	/*01b3:*/	0x20,  /* ..#..... */
+	/*01b4:*/	0x20,  /* ..#..... */
+	/*01b5:*/	0x20,  /* ..#..... */
+	/*01b6:*/	0xa0,  /* #.#..... */
+	/*01b7:*/	0x40,  /* .#...... */
+/* --- new character K (75) starting at offset 0x01b8 --- */
+	/*01b8:*/	6, 4, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*01bd:*/	0x90,  /* #..#.... */
+	/*01be:*/	0xa0,  /* #.#..... */
+	/*01bf:*/	0xc0,  /* ##...... */
+	/*01c0:*/	0xe0,  /* ###..... */
+	/*01c1:*/	0x90,  /* #..#.... */
+	/*01c2:*/	0x90,  /* #..#.... */
+/* --- new character L (76) starting at offset 0x01c3 --- */
+	/*01c3:*/	5, 3, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*01c8:*/	0x80,  /* #....... */
+	/*01c9:*/	0x80,  /* #....... */
+	/*01ca:*/	0x80,  /* #....... */
+	/*01cb:*/	0x80,  /* #....... */
+	/*01cc:*/	0x80,  /* #....... */
+	/*01cd:*/	0xe0,  /* ###..... */
+/* --- new character M (77) starting at offset 0x01ce --- */
+	/*01ce:*/	7, 5, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*01d3:*/	0x88,  /* #...#... */
+	/*01d4:*/	0xd8,  /* ##.##... */
+	/*01d5:*/	0xa8,  /* #.#.#... */
+	/*01d6:*/	0xa8,  /* #.#.#... */
+	/*01d7:*/	0xa8,  /* #.#.#... */
+	/*01d8:*/	0xa8,  /* #.#.#... */
+/* --- new character N (78) starting at offset 0x01d9 --- */
+	/*01d9:*/	6, 5, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01de:*/	0x88,  /* #...#... */
+	/*01df:*/	0xc8,  /* ##..#... */
+	/*01e0:*/	0xa8,  /* #.#.#... */
+	/*01e1:*/	0xa8,  /* #.#.#... */
+	/*01e2:*/	0x98,  /* #..##... */
+	/*01e3:*/	0x88,  /* #...#... */
+/* --- new character O (79) starting at offset 0x01e4 --- */
+	/*01e4:*/	6, 5, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01e9:*/	0x70,  /* .###.... */
+	/*01ea:*/	0x88,  /* #...#... */
+	/*01eb:*/	0x88,  /* #...#... */
+	/*01ec:*/	0x88,  /* #...#... */
+	/*01ed:*/	0x88,  /* #...#... */
+	/*01ee:*/	0x70,  /* .###.... */
+/* --- new character P (80) starting at offset 0x01ef --- */
+	/*01ef:*/	6, 4, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*01f4:*/	0xe0,  /* ###..... */
+	/*01f5:*/	0x90,  /* #..#.... */
+	/*01f6:*/	0x90,  /* #..#.... */
+	/*01f7:*/	0xe0,  /* ###..... */
+	/*01f8:*/	0x80,  /* #....... */
+	/*01f9:*/	0x80,  /* #....... */
+/* --- new character Q (81) starting at offset 0x01fa --- */
+	/*01fa:*/	6, 5, 8, 1, -2, /* width and bbox (w,h,x,y) */ 
+	/*01ff:*/	0x70,  /* .###.... */
+	/*0200:*/	0x88,  /* #...#... */
+	/*0201:*/	0x88,  /* #...#... */
+	/*0202:*/	0x88,  /* #...#... */
+	/*0203:*/	0x88,  /* #...#... */
+	/*0204:*/	0x70,  /* .###.... */
+	/*0205:*/	0x20,  /* ..#..... */
+	/*0206:*/	0x10,  /* ...#.... */
+/* --- new character R (82) starting at offset 0x0207 --- */
+	/*0207:*/	6, 4, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*020c:*/	0xe0,  /* ###..... */
+	/*020d:*/	0x90,  /* #..#.... */
+	/*020e:*/	0x90,  /* #..#.... */
+	/*020f:*/	0xe0,  /* ###..... */
+	/*0210:*/	0x90,  /* #..#.... */
+	/*0211:*/	0x90,  /* #..#.... */
+/* --- new character S (83) starting at offset 0x0212 --- */
+	/*0212:*/	6, 4, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0217:*/	0x70,  /* .###.... */
+	/*0218:*/	0x80,  /* #....... */
+	/*0219:*/	0xe0,  /* ###..... */
+	/*021a:*/	0x10,  /* ...#.... */
+	/*021b:*/	0x10,  /* ...#.... */
+	/*021c:*/	0xe0,  /* ###..... */
+/* --- new character T (84) starting at offset 0x021d --- */
+	/*021d:*/	4, 3, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0222:*/	0xe0,  /* ###..... */
+	/*0223:*/	0x40,  /* .#...... */
+	/*0224:*/	0x40,  /* .#...... */
+	/*0225:*/	0x40,  /* .#...... */
+	/*0226:*/	0x40,  /* .#...... */
+	/*0227:*/	0x40,  /* .#...... */
+/* --- new character U (85) starting at offset 0x0228 --- */
+	/*0228:*/	6, 5, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*022d:*/	0x88,  /* #...#... */
+	/*022e:*/	0x88,  /* #...#... */
+	/*022f:*/	0x88,  /* #...#... */
+	/*0230:*/	0x88,  /* #...#... */
+	/*0231:*/	0x88,  /* #...#... */
+	/*0232:*/	0x70,  /* .###.... */
+/* --- new character V (86) starting at offset 0x0233 --- */
+	/*0233:*/	6, 4, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0238:*/	0x90,  /* #..#.... */
+	/*0239:*/	0x90,  /* #..#.... */
+	/*023a:*/	0x90,  /* #..#.... */
+	/*023b:*/	0x90,  /* #..#.... */
+	/*023c:*/	0xa0,  /* #.#..... */
+	/*023d:*/	0x40,  /* .#...... */
+/* --- new character W (87) starting at offset 0x023e --- */
+	/*023e:*/	7, 7, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0243:*/	0x92,  /* #..#..#. */
+	/*0244:*/	0x92,  /* #..#..#. */
+	/*0245:*/	0x92,  /* #..#..#. */
+	/*0246:*/	0x6c,  /* .##.##.. */
+	/*0247:*/	0x48,  /* .#..#... */
+	/*0248:*/	0x48,  /* .#..#... */
+/* --- new character X (88) starting at offset 0x0249 --- */
+	/*0249:*/	6, 4, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*024e:*/	0x90,  /* #..#.... */
+	/*024f:*/	0x90,  /* #..#.... */
+	/*0250:*/	0x60,  /* .##..... */
+	/*0251:*/	0x60,  /* .##..... */
+	/*0252:*/	0x90,  /* #..#.... */
+	/*0253:*/	0x90,  /* #..#.... */
+/* --- new character Y (89) starting at offset 0x0254 --- */
+	/*0254:*/	6, 5, 6, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0259:*/	0xc8,  /* ##..#... */
+	/*025a:*/	0x48,  /* .#..#... */
+	/*025b:*/	0x48,  /* .#..#... */
+	/*025c:*/	0x30,  /* ..##.... */
+	/*025d:*/	0x20,  /* ..#..... */
+	/*025e:*/	0x20,  /* ..#..... */
+/* --- new character Z (90) starting at offset 0x025f --- */
+	/*025f:*/	6, 4, 6, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0264:*/	0xf0,  /* ####.... */
+	/*0265:*/	0x10,  /* ...#.... */
+	/*0266:*/	0x20,  /* ..#..... */
+	/*0267:*/	0x40,  /* .#...... */
+	/*0268:*/	0x80,  /* #....... */
+	/*0269:*/	0xf0,  /* ####.... */
+/* --- new character bracketleft (91) starting at offset 0x026a --- */
+	/*026a:*/	2, 2, 7, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*026f:*/	0xc0,  /* ##...... */
+	/*0270:*/	0x80,  /* #....... */
+	/*0271:*/	0x80,  /* #....... */
+	/*0272:*/	0x80,  /* #....... */
+	/*0273:*/	0x80,  /* #....... */
+	/*0274:*/	0x80,  /* #....... */
+	/*0275:*/	0xc0,  /* ##...... */
+/* --- new character backslash (92) starting at offset 0x0276 --- */
+	/*0276:*/	2, 2, 7, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*027b:*/	0x80,  /* #....... */
+	/*027c:*/	0x80,  /* #....... */
+	/*027d:*/	0x80,  /* #....... */
+	/*027e:*/	0x40,  /* .#...... */
+	/*027f:*/	0x40,  /* .#...... */
+	/*0280:*/	0x40,  /* .#...... */
+	/*0281:*/	0x40,  /* .#...... */
+/* --- new character bracketright (93) starting at offset 0x0282 --- */
+	/*0282:*/	2, 2, 7, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*0287:*/	0xc0,  /* ##...... */
+	/*0288:*/	0x40,  /* .#...... */
+	/*0289:*/	0x40,  /* .#...... */
+	/*028a:*/	0x40,  /* .#...... */
+	/*028b:*/	0x40,  /* .#...... */
+	/*028c:*/	0x40,  /* .#...... */
+	/*028d:*/	0xc0,  /* ##...... */
+/* --- new character asciicircum (94) starting at offset 0x028e --- */
+	/*028e:*/	5, 5, 3, 0, 2, /* width and bbox (w,h,x,y) */ 
+	/*0293:*/	0x20,  /* ..#..... */
+	/*0294:*/	0x50,  /* .#.#.... */
+	/*0295:*/	0x88,  /* #...#... */
+/* --- new character underscore (95) starting at offset 0x0296 --- */
+	/*0296:*/	5, 5, 1, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*029b:*/	0xf8,  /* #####... */
+/* --- new character grave (96) starting at offset 0x029c --- */
+	/*029c:*/	3, 2, 2, 0, 6, /* width and bbox (w,h,x,y) */ 
+	/*02a1:*/	0x80,  /* #....... */
+	/*02a2:*/	0x40,  /* .#...... */
+/* --- new character a (97) starting at offset 0x02a3 --- */
+	/*02a3:*/	4, 4, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02a8:*/	0xc0,  /* ##...... */
+	/*02a9:*/	0x20,  /* ..#..... */
+	/*02aa:*/	0xe0,  /* ###..... */
+	/*02ab:*/	0xa0,  /* #.#..... */
+	/*02ac:*/	0xd0,  /* ##.#.... */
+/* --- new character b (98) starting at offset 0x02ad --- */
+	/*02ad:*/	5, 4, 7, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02b2:*/	0x80,  /* #....... */
+	/*02b3:*/	0x80,  /* #....... */
+	/*02b4:*/	0xe0,  /* ###..... */
+	/*02b5:*/	0x90,  /* #..#.... */
+	/*02b6:*/	0x90,  /* #..#.... */
+	/*02b7:*/	0x90,  /* #..#.... */
+	/*02b8:*/	0xe0,  /* ###..... */
+/* --- new character c (99) starting at offset 0x02b9 --- */
+	/*02b9:*/	4, 3, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02be:*/	0x60,  /* .##..... */
+	/*02bf:*/	0x80,  /* #....... */
+	/*02c0:*/	0x80,  /* #....... */
+	/*02c1:*/	0x80,  /* #....... */
+	/*02c2:*/	0x60,  /* .##..... */
+/* --- new character d (100) starting at offset 0x02c3 --- */
+	/*02c3:*/	5, 4, 7, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02c8:*/	0x10,  /* ...#.... */
+	/*02c9:*/	0x10,  /* ...#.... */
+	/*02ca:*/	0x70,  /* .###.... */
+	/*02cb:*/	0x90,  /* #..#.... */
+	/*02cc:*/	0x90,  /* #..#.... */
+	/*02cd:*/	0x90,  /* #..#.... */
+	/*02ce:*/	0x70,  /* .###.... */
+/* --- new character e (101) starting at offset 0x02cf --- */
+	/*02cf:*/	4, 3, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02d4:*/	0x40,  /* .#...... */
+	/*02d5:*/	0xa0,  /* #.#..... */
+	/*02d6:*/	0xe0,  /* ###..... */
+	/*02d7:*/	0x80,  /* #....... */
+	/*02d8:*/	0x60,  /* .##..... */
+/* --- new character f (102) starting at offset 0x02d9 --- */
+	/*02d9:*/	4, 3, 7, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02de:*/	0x20,  /* ..#..... */
+	/*02df:*/	0x40,  /* .#...... */
+	/*02e0:*/	0xe0,  /* ###..... */
+	/*02e1:*/	0x40,  /* .#...... */
+	/*02e2:*/	0x40,  /* .#...... */
+	/*02e3:*/	0x40,  /* .#...... */
+	/*02e4:*/	0x40,  /* .#...... */
+/* --- new character g (103) starting at offset 0x02e5 --- */
+	/*02e5:*/	5, 4, 6, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*02ea:*/	0x70,  /* .###.... */
+	/*02eb:*/	0x90,  /* #..#.... */
+	/*02ec:*/	0x90,  /* #..#.... */
+	/*02ed:*/	0x70,  /* .###.... */
+	/*02ee:*/	0x10,  /* ...#.... */
+	/*02ef:*/	0x60,  /* .##..... */
+/* --- new character h (104) starting at offset 0x02f0 --- */
+	/*02f0:*/	5, 4, 7, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02f5:*/	0x80,  /* #....... */
+	/*02f6:*/	0x80,  /* #....... */
+	/*02f7:*/	0xe0,  /* ###..... */
+	/*02f8:*/	0x90,  /* #..#.... */
+	/*02f9:*/	0x90,  /* #..#.... */
+	/*02fa:*/	0x90,  /* #..#.... */
+	/*02fb:*/	0x90,  /* #..#.... */
+/* --- new character i (105) starting at offset 0x02fc --- */
+	/*02fc:*/	2, 1, 7, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0301:*/	0x80,  /* #....... */
+	/*0302:*/	0x00,  /* ........ */
+	/*0303:*/	0x80,  /* #....... */
+	/*0304:*/	0x80,  /* #....... */
+	/*0305:*/	0x80,  /* #....... */
+	/*0306:*/	0x80,  /* #....... */
+	/*0307:*/	0x80,  /* #....... */
+/* --- new character j (106) starting at offset 0x0308 --- */
+	/*0308:*/	2, 2, 9, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*030d:*/	0x40,  /* .#...... */
+	/*030e:*/	0x00,  /* ........ */
+	/*030f:*/	0x40,  /* .#...... */
+	/*0310:*/	0x40,  /* .#...... */
+	/*0311:*/	0x40,  /* .#...... */
+	/*0312:*/	0x40,  /* .#...... */
+	/*0313:*/	0x40,  /* .#...... */
+	/*0314:*/	0x40,  /* .#...... */
+	/*0315:*/	0x80,  /* #....... */
+/* --- new character k (107) starting at offset 0x0316 --- */
+	/*0316:*/	4, 3, 7, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*031b:*/	0x80,  /* #....... */
+	/*031c:*/	0x80,  /* #....... */
+	/*031d:*/	0xa0,  /* #.#..... */
+	/*031e:*/	0xc0,  /* ##...... */
+	/*031f:*/	0xc0,  /* ##...... */
+	/*0320:*/	0xa0,  /* #.#..... */
+	/*0321:*/	0xa0,  /* #.#..... */
+/* --- new character l (108) starting at offset 0x0322 --- */
+	/*0322:*/	2, 1, 7, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0327:*/	0x80,  /* #....... */
+	/*0328:*/	0x80,  /* #....... */
+	/*0329:*/	0x80,  /* #....... */
+	/*032a:*/	0x80,  /* #....... */
+	/*032b:*/	0x80,  /* #....... */
+	/*032c:*/	0x80,  /* #....... */
+	/*032d:*/	0x80,  /* #....... */
+/* --- new character m (109) starting at offset 0x032e --- */
+	/*032e:*/	6, 5, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0333:*/	0xf0,  /* ####.... */
+	/*0334:*/	0xa8,  /* #.#.#... */
+	/*0335:*/	0xa8,  /* #.#.#... */
+	/*0336:*/	0xa8,  /* #.#.#... */
+	/*0337:*/	0xa8,  /* #.#.#... */
+/* --- new character n (110) starting at offset 0x0338 --- */
+	/*0338:*/	5, 4, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*033d:*/	0xe0,  /* ###..... */
+	/*033e:*/	0x90,  /* #..#.... */
+	/*033f:*/	0x90,  /* #..#.... */
+	/*0340:*/	0x90,  /* #..#.... */
+	/*0341:*/	0x90,  /* #..#.... */
+/* --- new character o (111) starting at offset 0x0342 --- */
+	/*0342:*/	5, 4, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0347:*/	0x60,  /* .##..... */
+	/*0348:*/	0x90,  /* #..#.... */
+	/*0349:*/	0x90,  /* #..#.... */
+	/*034a:*/	0x90,  /* #..#.... */
+	/*034b:*/	0x60,  /* .##..... */
+/* --- new character p (112) starting at offset 0x034c --- */
+	/*034c:*/	5, 4, 6, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*0351:*/	0xe0,  /* ###..... */
+	/*0352:*/	0x90,  /* #..#.... */
+	/*0353:*/	0x90,  /* #..#.... */
+	/*0354:*/	0x90,  /* #..#.... */
+	/*0355:*/	0xe0,  /* ###..... */
+	/*0356:*/	0x80,  /* #....... */
+/* --- new character q (113) starting at offset 0x0357 --- */
+	/*0357:*/	5, 4, 6, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*035c:*/	0x70,  /* .###.... */
+	/*035d:*/	0x90,  /* #..#.... */
+	/*035e:*/	0x90,  /* #..#.... */
+	/*035f:*/	0x90,  /* #..#.... */
+	/*0360:*/	0x70,  /* .###.... */
+	/*0361:*/	0x10,  /* ...#.... */
+/* --- new character r (114) starting at offset 0x0362 --- */
+	/*0362:*/	3, 3, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0367:*/	0xa0,  /* #.#..... */
+	/*0368:*/	0xc0,  /* ##...... */
+	/*0369:*/	0x80,  /* #....... */
+	/*036a:*/	0x80,  /* #....... */
+	/*036b:*/	0x80,  /* #....... */
+/* --- new character s (115) starting at offset 0x036c --- */
+	/*036c:*/	4, 3, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0371:*/	0x60,  /* .##..... */
+	/*0372:*/	0x80,  /* #....... */
+	/*0373:*/	0x60,  /* .##..... */
+	/*0374:*/	0x20,  /* ..#..... */
+	/*0375:*/	0xc0,  /* ##...... */
+/* --- new character t (116) starting at offset 0x0376 --- */
+	/*0376:*/	3, 3, 7, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*037b:*/	0x40,  /* .#...... */
+	/*037c:*/	0x40,  /* .#...... */
+	/*037d:*/	0xe0,  /* ###..... */
+	/*037e:*/	0x40,  /* .#...... */
+	/*037f:*/	0x40,  /* .#...... */
+	/*0380:*/	0x40,  /* .#...... */
+	/*0381:*/	0x40,  /* .#...... */
+/* --- new character u (117) starting at offset 0x0382 --- */
+	/*0382:*/	4, 3, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0387:*/	0xa0,  /* #.#..... */
+	/*0388:*/	0xa0,  /* #.#..... */
+	/*0389:*/	0xa0,  /* #.#..... */
+	/*038a:*/	0xa0,  /* #.#..... */
+	/*038b:*/	0x60,  /* .##..... */
+/* --- new character v (118) starting at offset 0x038c --- */
+	/*038c:*/	5, 4, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0391:*/	0x90,  /* #..#.... */
+	/*0392:*/	0x90,  /* #..#.... */
+	/*0393:*/	0x90,  /* #..#.... */
+	/*0394:*/	0xa0,  /* #.#..... */
+	/*0395:*/	0x40,  /* .#...... */
+/* --- new character w (119) starting at offset 0x0396 --- */
+	/*0396:*/	6, 5, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*039b:*/	0xa8,  /* #.#.#... */
+	/*039c:*/	0xa8,  /* #.#.#... */
+	/*039d:*/	0xa8,  /* #.#.#... */
+	/*039e:*/	0x50,  /* .#.#.... */
+	/*039f:*/	0x50,  /* .#.#.... */
+/* --- new character x (120) starting at offset 0x03a0 --- */
+	/*03a0:*/	5, 4, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*03a5:*/	0x90,  /* #..#.... */
+	/*03a6:*/	0x90,  /* #..#.... */
+	/*03a7:*/	0x60,  /* .##..... */
+	/*03a8:*/	0x90,  /* #..#.... */
+	/*03a9:*/	0x90,  /* #..#.... */
+/* --- new character y (121) starting at offset 0x03aa --- */
+	/*03aa:*/	4, 4, 6, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*03af:*/	0x90,  /* #..#.... */
+	/*03b0:*/	0x90,  /* #..#.... */
+	/*03b1:*/	0x90,  /* #..#.... */
+	/*03b2:*/	0x60,  /* .##..... */
+	/*03b3:*/	0x40,  /* .#...... */
+	/*03b4:*/	0x80,  /* #....... */
+/* --- new character z (122) starting at offset 0x03b5 --- */
+	/*03b5:*/	4, 3, 5, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*03ba:*/	0xe0,  /* ###..... */
+	/*03bb:*/	0x20,  /* ..#..... */
+	/*03bc:*/	0x40,  /* .#...... */
+	/*03bd:*/	0x80,  /* #....... */
+	/*03be:*/	0xe0,  /* ###..... */
+/* --- new character braceleft (123) starting at offset 0x03bf --- */
+	/*03bf:*/	2, 3, 7, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*03c4:*/	0x20,  /* ..#..... */
+	/*03c5:*/	0x40,  /* .#...... */
+	/*03c6:*/	0x40,  /* .#...... */
+	/*03c7:*/	0xc0,  /* ##...... */
+	/*03c8:*/	0x40,  /* .#...... */
+	/*03c9:*/	0x40,  /* .#...... */
+	/*03ca:*/	0x20,  /* ..#..... */
+/* --- new character bar (124) starting at offset 0x03cb --- */
+	/*03cb:*/	2, 1, 7, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*03d0:*/	0x80,  /* #....... */
+	/*03d1:*/	0x80,  /* #....... */
+	/*03d2:*/	0x80,  /* #....... */
+	/*03d3:*/	0x80,  /* #....... */
+	/*03d4:*/	0x80,  /* #....... */
+	/*03d5:*/	0x80,  /* #....... */
+	/*03d6:*/	0x80,  /* #....... */
+/* --- new character braceright (125) starting at offset 0x03d7 --- */
+	/*03d7:*/	2, 3, 7, 0, -1, /* width and bbox (w,h,x,y) */ 
+	/*03dc:*/	0x80,  /* #....... */
+	/*03dd:*/	0x40,  /* .#...... */
+	/*03de:*/	0x40,  /* .#...... */
+	/*03df:*/	0x60,  /* .##..... */
+	/*03e0:*/	0x40,  /* .#...... */
+	/*03e1:*/	0x40,  /* .#...... */
+	/*03e2:*/	0x80,  /* #....... */
+/* --- new character asciitilde (126) starting at offset 0x03e3 --- */
+	/*03e3:*/	6, 5, 2, 1, 2, /* width and bbox (w,h,x,y) */ 
+	/*03e8:*/	0x48,  /* .#..#... */
+	/*03e9:*/	0xb0,  /* #.##.... */
+};
+static const uint16_t font_helvR08_offsets[] = {
+0x0000 /* space */,
+	0x0006 /* exclam */,
+	0x0011 /* quotedbl */,
+	0x0019 /* numbersign */,
+	0x0023 /* dollar */,
+	0x002f /* percent */,
+	0x003a /* ampersand */,
+	0x0045 /* quotesingle */,
+	0x004c /* parenleft */,
+	0x0058 /* parenright */,
+	0x0064 /* asterisk */,
+	0x006c /* plus */,
+	0x0076 /* comma */,
+	0x007e /* hyphen */,
+	0x0084 /* period */,
+	0x008a /* slash */,
+	0x0096 /* zero */,
+	0x00a1 /* one */,
+	0x00ac /* two */,
+	0x00b7 /* three */,
+	0x00c2 /* four */,
+	0x00cd /* five */,
+	0x00d8 /* six */,
+	0x00e3 /* seven */,
+	0x00ee /* eight */,
+	0x00f9 /* nine */,
+	0x0104 /* colon */,
+	0x010d /* semicolon */,
+	0x0118 /* less */,
+	0x0122 /* equal */,
+	0x012a /* greater */,
+	0x0134 /* question */,
+	0x013e /* at */,
+	0x014a /* A */,
+	0x0155 /* B */,
+	0x0160 /* C */,
+	0x016b /* D */,
+	0x0176 /* E */,
+	0x0181 /* F */,
+	0x018c /* G */,
+	0x0197 /* H */,
+	0x01a2 /* I */,
+	0x01ad /* J */,
+	0x01b8 /* K */,
+	0x01c3 /* L */,
+	0x01ce /* M */,
+	0x01d9 /* N */,
+	0x01e4 /* O */,
+	0x01ef /* P */,
+	0x01fa /* Q */,
+	0x0207 /* R */,
+	0x0212 /* S */,
+	0x021d /* T */,
+	0x0228 /* U */,
+	0x0233 /* V */,
+	0x023e /* W */,
+	0x0249 /* X */,
+	0x0254 /* Y */,
+	0x025f /* Z */,
+	0x026a /* bracketleft */,
+	0x0276 /* backslash */,
+	0x0282 /* bracketright */,
+	0x028e /* asciicircum */,
+	0x0296 /* underscore */,
+	0x029c /* grave */,
+	0x02a3 /* a */,
+	0x02ad /* b */,
+	0x02b9 /* c */,
+	0x02c3 /* d */,
+	0x02cf /* e */,
+	0x02d9 /* f */,
+	0x02e5 /* g */,
+	0x02f0 /* h */,
+	0x02fc /* i */,
+	0x0308 /* j */,
+	0x0316 /* k */,
+	0x0322 /* l */,
+	0x032e /* m */,
+	0x0338 /* n */,
+	0x0342 /* o */,
+	0x034c /* p */,
+	0x0357 /* q */,
+	0x0362 /* r */,
+	0x036c /* s */,
+	0x0376 /* t */,
+	0x0382 /* u */,
+	0x038c /* v */,
+	0x0396 /* w */,
+	0x03a0 /* x */,
+	0x03aa /* y */,
+	0x03b5 /* z */,
+	0x03bf /* braceleft */,
+	0x03cb /* bar */,
+	0x03d7 /* braceright */,
+	0x03e3 /* asciitilde */,
+	0xffff /* (no glyph) */
+};
+const struct fb_font font_helvR08 = {
+	.height = 10,
+	.ascent = 8,
+	.firstchar = 32, /* space */
+	.lastchar = 127, /* ? */
+	.chardata = font_helvR08_data,
+	.charoffs = font_helvR08_offsets,
+};
diff --git a/src/target/firmware/fb/helvR14.c b/src/target/firmware/fb/helvR14.c
new file mode 100644
index 00000000..b0281258
--- /dev/null
+++ b/src/target/firmware/fb/helvR14.c
@@ -0,0 +1,1198 @@
+#include <fb/font.h>
+static const uint8_t font_helvR14_data[] = {
+/* --- new character space (32) starting at offset 0x0000 --- */
+	/*0000:*/	4, 1, 1, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0005:*/	0x00,  /* ........ */
+/* --- new character exclam (33) starting at offset 0x0006 --- */
+	/*0006:*/	4, 1, 11, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*000b:*/	0x80,  /* #....... */
+	/*000c:*/	0x80,  /* #....... */
+	/*000d:*/	0x80,  /* #....... */
+	/*000e:*/	0x80,  /* #....... */
+	/*000f:*/	0x80,  /* #....... */
+	/*0010:*/	0x80,  /* #....... */
+	/*0011:*/	0x80,  /* #....... */
+	/*0012:*/	0x80,  /* #....... */
+	/*0013:*/	0x00,  /* ........ */
+	/*0014:*/	0x80,  /* #....... */
+	/*0015:*/	0x80,  /* #....... */
+/* --- new character quotedbl (34) starting at offset 0x0016 --- */
+	/*0016:*/	5, 3, 3, 1, 8, /* width and bbox (w,h,x,y) */ 
+	/*001b:*/	0xa0,  /* #.#..... */
+	/*001c:*/	0xa0,  /* #.#..... */
+	/*001d:*/	0xa0,  /* #.#..... */
+/* --- new character numbersign (35) starting at offset 0x001e --- */
+	/*001e:*/	8, 7, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0023:*/	0x14,  /* ...#.#.. */
+	/*0024:*/	0x14,  /* ...#.#.. */
+	/*0025:*/	0x14,  /* ...#.#.. */
+	/*0026:*/	0x7e,  /* .######. */
+	/*0027:*/	0x28,  /* ..#.#... */
+	/*0028:*/	0x28,  /* ..#.#... */
+	/*0029:*/	0xfc,  /* ######.. */
+	/*002a:*/	0x50,  /* .#.#.... */
+	/*002b:*/	0x50,  /* .#.#.... */
+	/*002c:*/	0x50,  /* .#.#.... */
+/* --- new character dollar (36) starting at offset 0x002d --- */
+	/*002d:*/	8, 7, 14, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*0032:*/	0x10,  /* ...#.... */
+	/*0033:*/	0x10,  /* ...#.... */
+	/*0034:*/	0x7c,  /* .#####.. */
+	/*0035:*/	0x92,  /* #..#..#. */
+	/*0036:*/	0x92,  /* #..#..#. */
+	/*0037:*/	0x50,  /* .#.#.... */
+	/*0038:*/	0x38,  /* ..###... */
+	/*0039:*/	0x14,  /* ...#.#.. */
+	/*003a:*/	0x12,  /* ...#..#. */
+	/*003b:*/	0x92,  /* #..#..#. */
+	/*003c:*/	0x92,  /* #..#..#. */
+	/*003d:*/	0x7c,  /* .#####.. */
+	/*003e:*/	0x10,  /* ...#.... */
+	/*003f:*/	0x10,  /* ...#.... */
+/* --- new character percent (37) starting at offset 0x0040 --- */
+	/*0040:*/	12, 11, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0045:*/	0x70,0x80,  /* .###....#....... */
+	/*0047:*/	0x89,0x00,  /* #...#..#........ */
+	/*0049:*/	0x89,0x00,  /* #...#..#........ */
+	/*004b:*/	0x72,0x00,  /* .###..#......... */
+	/*004d:*/	0x02,0x00,  /* ......#......... */
+	/*004f:*/	0x04,0x00,  /* .....#.......... */
+	/*0051:*/	0x09,0xc0,  /* ....#..###...... */
+	/*0053:*/	0x12,0x20,  /* ...#..#...#..... */
+	/*0055:*/	0x12,0x20,  /* ...#..#...#..... */
+	/*0057:*/	0x21,0xc0,  /* ..#....###...... */
+/* --- new character ampersand (38) starting at offset 0x0059 --- */
+	/*0059:*/	10, 8, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*005e:*/	0x30,  /* ..##.... */
+	/*005f:*/	0x48,  /* .#..#... */
+	/*0060:*/	0x48,  /* .#..#... */
+	/*0061:*/	0x30,  /* ..##.... */
+	/*0062:*/	0x20,  /* ..#..... */
+	/*0063:*/	0x52,  /* .#.#..#. */
+	/*0064:*/	0x8a,  /* #...#.#. */
+	/*0065:*/	0x84,  /* #....#.. */
+	/*0066:*/	0x8a,  /* #...#.#. */
+	/*0067:*/	0x71,  /* .###...# */
+/* --- new character quotesingle (39) starting at offset 0x0068 --- */
+	/*0068:*/	3, 1, 3, 1, 8, /* width and bbox (w,h,x,y) */ 
+	/*006d:*/	0x80,  /* #....... */
+	/*006e:*/	0x80,  /* #....... */
+	/*006f:*/	0x80,  /* #....... */
+/* --- new character parenleft (40) starting at offset 0x0070 --- */
+	/*0070:*/	5, 3, 14, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*0075:*/	0x20,  /* ..#..... */
+	/*0076:*/	0x40,  /* .#...... */
+	/*0077:*/	0x40,  /* .#...... */
+	/*0078:*/	0x80,  /* #....... */
+	/*0079:*/	0x80,  /* #....... */
+	/*007a:*/	0x80,  /* #....... */
+	/*007b:*/	0x80,  /* #....... */
+	/*007c:*/	0x80,  /* #....... */
+	/*007d:*/	0x80,  /* #....... */
+	/*007e:*/	0x80,  /* #....... */
+	/*007f:*/	0x80,  /* #....... */
+	/*0080:*/	0x40,  /* .#...... */
+	/*0081:*/	0x40,  /* .#...... */
+	/*0082:*/	0x20,  /* ..#..... */
+/* --- new character parenright (41) starting at offset 0x0083 --- */
+	/*0083:*/	5, 3, 14, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*0088:*/	0x80,  /* #....... */
+	/*0089:*/	0x40,  /* .#...... */
+	/*008a:*/	0x40,  /* .#...... */
+	/*008b:*/	0x20,  /* ..#..... */
+	/*008c:*/	0x20,  /* ..#..... */
+	/*008d:*/	0x20,  /* ..#..... */
+	/*008e:*/	0x20,  /* ..#..... */
+	/*008f:*/	0x20,  /* ..#..... */
+	/*0090:*/	0x20,  /* ..#..... */
+	/*0091:*/	0x20,  /* ..#..... */
+	/*0092:*/	0x20,  /* ..#..... */
+	/*0093:*/	0x40,  /* .#...... */
+	/*0094:*/	0x40,  /* .#...... */
+	/*0095:*/	0x80,  /* #....... */
+/* --- new character asterisk (42) starting at offset 0x0096 --- */
+	/*0096:*/	7, 5, 4, 1, 6, /* width and bbox (w,h,x,y) */ 
+	/*009b:*/	0x20,  /* ..#..... */
+	/*009c:*/	0xf8,  /* #####... */
+	/*009d:*/	0x20,  /* ..#..... */
+	/*009e:*/	0x50,  /* .#.#.... */
+/* --- new character plus (43) starting at offset 0x009f --- */
+	/*009f:*/	9, 7, 7, 1, 1, /* width and bbox (w,h,x,y) */ 
+	/*00a4:*/	0x10,  /* ...#.... */
+	/*00a5:*/	0x10,  /* ...#.... */
+	/*00a6:*/	0x10,  /* ...#.... */
+	/*00a7:*/	0xfe,  /* #######. */
+	/*00a8:*/	0x10,  /* ...#.... */
+	/*00a9:*/	0x10,  /* ...#.... */
+	/*00aa:*/	0x10,  /* ...#.... */
+/* --- new character comma (44) starting at offset 0x00ab --- */
+	/*00ab:*/	3, 2, 4, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*00b0:*/	0x40,  /* .#...... */
+	/*00b1:*/	0x40,  /* .#...... */
+	/*00b2:*/	0x40,  /* .#...... */
+	/*00b3:*/	0x80,  /* #....... */
+/* --- new character hyphen (45) starting at offset 0x00b4 --- */
+	/*00b4:*/	5, 4, 1, 0, 4, /* width and bbox (w,h,x,y) */ 
+	/*00b9:*/	0xf0,  /* ####.... */
+/* --- new character period (46) starting at offset 0x00ba --- */
+	/*00ba:*/	3, 1, 2, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00bf:*/	0x80,  /* #....... */
+	/*00c0:*/	0x80,  /* #....... */
+/* --- new character slash (47) starting at offset 0x00c1 --- */
+	/*00c1:*/	4, 4, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*00c6:*/	0x10,  /* ...#.... */
+	/*00c7:*/	0x10,  /* ...#.... */
+	/*00c8:*/	0x20,  /* ..#..... */
+	/*00c9:*/	0x20,  /* ..#..... */
+	/*00ca:*/	0x20,  /* ..#..... */
+	/*00cb:*/	0x40,  /* .#...... */
+	/*00cc:*/	0x40,  /* .#...... */
+	/*00cd:*/	0x40,  /* .#...... */
+	/*00ce:*/	0x80,  /* #....... */
+	/*00cf:*/	0x80,  /* #....... */
+	/*00d0:*/	0x80,  /* #....... */
+/* --- new character zero (48) starting at offset 0x00d1 --- */
+	/*00d1:*/	8, 6, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00d6:*/	0x78,  /* .####... */
+	/*00d7:*/	0x84,  /* #....#.. */
+	/*00d8:*/	0x84,  /* #....#.. */
+	/*00d9:*/	0x84,  /* #....#.. */
+	/*00da:*/	0x84,  /* #....#.. */
+	/*00db:*/	0x84,  /* #....#.. */
+	/*00dc:*/	0x84,  /* #....#.. */
+	/*00dd:*/	0x84,  /* #....#.. */
+	/*00de:*/	0x84,  /* #....#.. */
+	/*00df:*/	0x78,  /* .####... */
+/* --- new character one (49) starting at offset 0x00e0 --- */
+	/*00e0:*/	8, 3, 10, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*00e5:*/	0x20,  /* ..#..... */
+	/*00e6:*/	0xe0,  /* ###..... */
+	/*00e7:*/	0x20,  /* ..#..... */
+	/*00e8:*/	0x20,  /* ..#..... */
+	/*00e9:*/	0x20,  /* ..#..... */
+	/*00ea:*/	0x20,  /* ..#..... */
+	/*00eb:*/	0x20,  /* ..#..... */
+	/*00ec:*/	0x20,  /* ..#..... */
+	/*00ed:*/	0x20,  /* ..#..... */
+	/*00ee:*/	0x20,  /* ..#..... */
+/* --- new character two (50) starting at offset 0x00ef --- */
+	/*00ef:*/	8, 6, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00f4:*/	0x78,  /* .####... */
+	/*00f5:*/	0x84,  /* #....#.. */
+	/*00f6:*/	0x84,  /* #....#.. */
+	/*00f7:*/	0x08,  /* ....#... */
+	/*00f8:*/	0x10,  /* ...#.... */
+	/*00f9:*/	0x20,  /* ..#..... */
+	/*00fa:*/	0x40,  /* .#...... */
+	/*00fb:*/	0x80,  /* #....... */
+	/*00fc:*/	0x80,  /* #....... */
+	/*00fd:*/	0xfc,  /* ######.. */
+/* --- new character three (51) starting at offset 0x00fe --- */
+	/*00fe:*/	8, 6, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0103:*/	0x78,  /* .####... */
+	/*0104:*/	0x84,  /* #....#.. */
+	/*0105:*/	0x84,  /* #....#.. */
+	/*0106:*/	0x04,  /* .....#.. */
+	/*0107:*/	0x38,  /* ..###... */
+	/*0108:*/	0x04,  /* .....#.. */
+	/*0109:*/	0x04,  /* .....#.. */
+	/*010a:*/	0x84,  /* #....#.. */
+	/*010b:*/	0x84,  /* #....#.. */
+	/*010c:*/	0x78,  /* .####... */
+/* --- new character four (52) starting at offset 0x010d --- */
+	/*010d:*/	8, 7, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0112:*/	0x0c,  /* ....##.. */
+	/*0113:*/	0x14,  /* ...#.#.. */
+	/*0114:*/	0x24,  /* ..#..#.. */
+	/*0115:*/	0x24,  /* ..#..#.. */
+	/*0116:*/	0x44,  /* .#...#.. */
+	/*0117:*/	0x84,  /* #....#.. */
+	/*0118:*/	0xfe,  /* #######. */
+	/*0119:*/	0x04,  /* .....#.. */
+	/*011a:*/	0x04,  /* .....#.. */
+	/*011b:*/	0x04,  /* .....#.. */
+/* --- new character five (53) starting at offset 0x011c --- */
+	/*011c:*/	8, 6, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0121:*/	0xfc,  /* ######.. */
+	/*0122:*/	0x80,  /* #....... */
+	/*0123:*/	0x80,  /* #....... */
+	/*0124:*/	0x80,  /* #....... */
+	/*0125:*/	0xf8,  /* #####... */
+	/*0126:*/	0x04,  /* .....#.. */
+	/*0127:*/	0x04,  /* .....#.. */
+	/*0128:*/	0x84,  /* #....#.. */
+	/*0129:*/	0x84,  /* #....#.. */
+	/*012a:*/	0x78,  /* .####... */
+/* --- new character six (54) starting at offset 0x012b --- */
+	/*012b:*/	8, 6, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0130:*/	0x78,  /* .####... */
+	/*0131:*/	0x84,  /* #....#.. */
+	/*0132:*/	0x80,  /* #....... */
+	/*0133:*/	0x80,  /* #....... */
+	/*0134:*/	0xb8,  /* #.###... */
+	/*0135:*/	0xc4,  /* ##...#.. */
+	/*0136:*/	0x84,  /* #....#.. */
+	/*0137:*/	0x84,  /* #....#.. */
+	/*0138:*/	0x84,  /* #....#.. */
+	/*0139:*/	0x78,  /* .####... */
+/* --- new character seven (55) starting at offset 0x013a --- */
+	/*013a:*/	8, 6, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*013f:*/	0xfc,  /* ######.. */
+	/*0140:*/	0x04,  /* .....#.. */
+	/*0141:*/	0x08,  /* ....#... */
+	/*0142:*/	0x08,  /* ....#... */
+	/*0143:*/	0x10,  /* ...#.... */
+	/*0144:*/	0x10,  /* ...#.... */
+	/*0145:*/	0x20,  /* ..#..... */
+	/*0146:*/	0x20,  /* ..#..... */
+	/*0147:*/	0x40,  /* .#...... */
+	/*0148:*/	0x40,  /* .#...... */
+/* --- new character eight (56) starting at offset 0x0149 --- */
+	/*0149:*/	8, 6, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*014e:*/	0x78,  /* .####... */
+	/*014f:*/	0x84,  /* #....#.. */
+	/*0150:*/	0x84,  /* #....#.. */
+	/*0151:*/	0x84,  /* #....#.. */
+	/*0152:*/	0x78,  /* .####... */
+	/*0153:*/	0x84,  /* #....#.. */
+	/*0154:*/	0x84,  /* #....#.. */
+	/*0155:*/	0x84,  /* #....#.. */
+	/*0156:*/	0x84,  /* #....#.. */
+	/*0157:*/	0x78,  /* .####... */
+/* --- new character nine (57) starting at offset 0x0158 --- */
+	/*0158:*/	8, 6, 10, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*015d:*/	0x78,  /* .####... */
+	/*015e:*/	0x84,  /* #....#.. */
+	/*015f:*/	0x84,  /* #....#.. */
+	/*0160:*/	0x84,  /* #....#.. */
+	/*0161:*/	0x84,  /* #....#.. */
+	/*0162:*/	0x7c,  /* .#####.. */
+	/*0163:*/	0x04,  /* .....#.. */
+	/*0164:*/	0x84,  /* #....#.. */
+	/*0165:*/	0x84,  /* #....#.. */
+	/*0166:*/	0x78,  /* .####... */
+/* --- new character colon (58) starting at offset 0x0167 --- */
+	/*0167:*/	3, 1, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*016c:*/	0x80,  /* #....... */
+	/*016d:*/	0x80,  /* #....... */
+	/*016e:*/	0x00,  /* ........ */
+	/*016f:*/	0x00,  /* ........ */
+	/*0170:*/	0x00,  /* ........ */
+	/*0171:*/	0x00,  /* ........ */
+	/*0172:*/	0x80,  /* #....... */
+	/*0173:*/	0x80,  /* #....... */
+/* --- new character semicolon (59) starting at offset 0x0174 --- */
+	/*0174:*/	4, 2, 10, 0, -2, /* width and bbox (w,h,x,y) */ 
+	/*0179:*/	0x40,  /* .#...... */
+	/*017a:*/	0x40,  /* .#...... */
+	/*017b:*/	0x00,  /* ........ */
+	/*017c:*/	0x00,  /* ........ */
+	/*017d:*/	0x00,  /* ........ */
+	/*017e:*/	0x00,  /* ........ */
+	/*017f:*/	0x40,  /* .#...... */
+	/*0180:*/	0x40,  /* .#...... */
+	/*0181:*/	0x40,  /* .#...... */
+	/*0182:*/	0x80,  /* #....... */
+/* --- new character less (60) starting at offset 0x0183 --- */
+	/*0183:*/	8, 6, 5, 1, 2, /* width and bbox (w,h,x,y) */ 
+	/*0188:*/	0x0c,  /* ....##.. */
+	/*0189:*/	0x30,  /* ..##.... */
+	/*018a:*/	0xc0,  /* ##...... */
+	/*018b:*/	0x30,  /* ..##.... */
+	/*018c:*/	0x0c,  /* ....##.. */
+/* --- new character equal (61) starting at offset 0x018d --- */
+	/*018d:*/	9, 6, 3, 1, 3, /* width and bbox (w,h,x,y) */ 
+	/*0192:*/	0xfc,  /* ######.. */
+	/*0193:*/	0x00,  /* ........ */
+	/*0194:*/	0xfc,  /* ######.. */
+/* --- new character greater (62) starting at offset 0x0195 --- */
+	/*0195:*/	8, 6, 5, 1, 2, /* width and bbox (w,h,x,y) */ 
+	/*019a:*/	0xc0,  /* ##...... */
+	/*019b:*/	0x30,  /* ..##.... */
+	/*019c:*/	0x0c,  /* ....##.. */
+	/*019d:*/	0x30,  /* ..##.... */
+	/*019e:*/	0xc0,  /* ##...... */
+/* --- new character question (63) starting at offset 0x019f --- */
+	/*019f:*/	8, 6, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01a4:*/	0x30,  /* ..##.... */
+	/*01a5:*/	0xcc,  /* ##..##.. */
+	/*01a6:*/	0x84,  /* #....#.. */
+	/*01a7:*/	0x84,  /* #....#.. */
+	/*01a8:*/	0x04,  /* .....#.. */
+	/*01a9:*/	0x08,  /* ....#... */
+	/*01aa:*/	0x10,  /* ...#.... */
+	/*01ab:*/	0x20,  /* ..#..... */
+	/*01ac:*/	0x00,  /* ........ */
+	/*01ad:*/	0x20,  /* ..#..... */
+	/*01ae:*/	0x20,  /* ..#..... */
+/* --- new character at (64) starting at offset 0x01af --- */
+	/*01af:*/	13, 11, 12, 1, -1, /* width and bbox (w,h,x,y) */ 
+	/*01b4:*/	0x0f,0x00,  /* ....####........ */
+	/*01b6:*/	0x30,0xc0,  /* ..##....##...... */
+	/*01b8:*/	0x40,0x20,  /* .#........#..... */
+	/*01ba:*/	0x46,0xa0,  /* .#...##.#.#..... */
+	/*01bc:*/	0x89,0x20,  /* #...#..#..#..... */
+	/*01be:*/	0x91,0x20,  /* #..#...#..#..... */
+	/*01c0:*/	0x91,0x20,  /* #..#...#..#..... */
+	/*01c2:*/	0x93,0x40,  /* #..#..##.#...... */
+	/*01c4:*/	0x8d,0x80,  /* #...##.##....... */
+	/*01c6:*/	0x40,0x00,  /* .#.............. */
+	/*01c8:*/	0x60,0x80,  /* .##.....#....... */
+	/*01ca:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character A (65) starting at offset 0x01cc --- */
+	/*01cc:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01d1:*/	0x08,0x00,  /* ....#........... */
+	/*01d3:*/	0x08,0x00,  /* ....#........... */
+	/*01d5:*/	0x14,0x00,  /* ...#.#.......... */
+	/*01d7:*/	0x14,0x00,  /* ...#.#.......... */
+	/*01d9:*/	0x22,0x00,  /* ..#...#......... */
+	/*01db:*/	0x22,0x00,  /* ..#...#......... */
+	/*01dd:*/	0x41,0x00,  /* .#.....#........ */
+	/*01df:*/	0x7f,0x00,  /* .#######........ */
+	/*01e1:*/	0x41,0x00,  /* .#.....#........ */
+	/*01e3:*/	0x80,0x80,  /* #.......#....... */
+	/*01e5:*/	0x80,0x80,  /* #.......#....... */
+/* --- new character B (66) starting at offset 0x01e7 --- */
+	/*01e7:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01ec:*/	0xfc,  /* ######.. */
+	/*01ed:*/	0x86,  /* #....##. */
+	/*01ee:*/	0x82,  /* #.....#. */
+	/*01ef:*/	0x82,  /* #.....#. */
+	/*01f0:*/	0x82,  /* #.....#. */
+	/*01f1:*/	0xfc,  /* ######.. */
+	/*01f2:*/	0x82,  /* #.....#. */
+	/*01f3:*/	0x82,  /* #.....#. */
+	/*01f4:*/	0x82,  /* #.....#. */
+	/*01f5:*/	0x82,  /* #.....#. */
+	/*01f6:*/	0xfc,  /* ######.. */
+/* --- new character C (67) starting at offset 0x01f7 --- */
+	/*01f7:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01fc:*/	0x1c,  /* ...###.. */
+	/*01fd:*/	0x63,  /* .##...## */
+	/*01fe:*/	0x41,  /* .#.....# */
+	/*01ff:*/	0x80,  /* #....... */
+	/*0200:*/	0x80,  /* #....... */
+	/*0201:*/	0x80,  /* #....... */
+	/*0202:*/	0x80,  /* #....... */
+	/*0203:*/	0x80,  /* #....... */
+	/*0204:*/	0x41,  /* .#.....# */
+	/*0205:*/	0x63,  /* .##...## */
+	/*0206:*/	0x1c,  /* ...###.. */
+/* --- new character D (68) starting at offset 0x0207 --- */
+	/*0207:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*020c:*/	0xf8,  /* #####... */
+	/*020d:*/	0x86,  /* #....##. */
+	/*020e:*/	0x82,  /* #.....#. */
+	/*020f:*/	0x81,  /* #......# */
+	/*0210:*/	0x81,  /* #......# */
+	/*0211:*/	0x81,  /* #......# */
+	/*0212:*/	0x81,  /* #......# */
+	/*0213:*/	0x81,  /* #......# */
+	/*0214:*/	0x82,  /* #.....#. */
+	/*0215:*/	0x86,  /* #....##. */
+	/*0216:*/	0xf8,  /* #####... */
+/* --- new character E (69) starting at offset 0x0217 --- */
+	/*0217:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*021c:*/	0xfe,  /* #######. */
+	/*021d:*/	0x80,  /* #....... */
+	/*021e:*/	0x80,  /* #....... */
+	/*021f:*/	0x80,  /* #....... */
+	/*0220:*/	0x80,  /* #....... */
+	/*0221:*/	0xfc,  /* ######.. */
+	/*0222:*/	0x80,  /* #....... */
+	/*0223:*/	0x80,  /* #....... */
+	/*0224:*/	0x80,  /* #....... */
+	/*0225:*/	0x80,  /* #....... */
+	/*0226:*/	0xfe,  /* #######. */
+/* --- new character F (70) starting at offset 0x0227 --- */
+	/*0227:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*022c:*/	0xfe,  /* #######. */
+	/*022d:*/	0x80,  /* #....... */
+	/*022e:*/	0x80,  /* #....... */
+	/*022f:*/	0x80,  /* #....... */
+	/*0230:*/	0x80,  /* #....... */
+	/*0231:*/	0xfc,  /* ######.. */
+	/*0232:*/	0x80,  /* #....... */
+	/*0233:*/	0x80,  /* #....... */
+	/*0234:*/	0x80,  /* #....... */
+	/*0235:*/	0x80,  /* #....... */
+	/*0236:*/	0x80,  /* #....... */
+/* --- new character G (71) starting at offset 0x0237 --- */
+	/*0237:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*023c:*/	0x1e,0x00,  /* ...####......... */
+	/*023e:*/	0x61,0x80,  /* .##....##....... */
+	/*0240:*/	0x40,0x80,  /* .#......#....... */
+	/*0242:*/	0x80,0x00,  /* #............... */
+	/*0244:*/	0x80,0x00,  /* #............... */
+	/*0246:*/	0x87,0x80,  /* #....####....... */
+	/*0248:*/	0x80,0x80,  /* #.......#....... */
+	/*024a:*/	0x80,0x80,  /* #.......#....... */
+	/*024c:*/	0x40,0x80,  /* .#......#....... */
+	/*024e:*/	0x63,0x80,  /* .##...###....... */
+	/*0250:*/	0x1c,0x80,  /* ...###..#....... */
+/* --- new character H (72) starting at offset 0x0252 --- */
+	/*0252:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0257:*/	0x81,  /* #......# */
+	/*0258:*/	0x81,  /* #......# */
+	/*0259:*/	0x81,  /* #......# */
+	/*025a:*/	0x81,  /* #......# */
+	/*025b:*/	0x81,  /* #......# */
+	/*025c:*/	0xff,  /* ######## */
+	/*025d:*/	0x81,  /* #......# */
+	/*025e:*/	0x81,  /* #......# */
+	/*025f:*/	0x81,  /* #......# */
+	/*0260:*/	0x81,  /* #......# */
+	/*0261:*/	0x81,  /* #......# */
+/* --- new character I (73) starting at offset 0x0262 --- */
+	/*0262:*/	5, 1, 11, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0267:*/	0x80,  /* #....... */
+	/*0268:*/	0x80,  /* #....... */
+	/*0269:*/	0x80,  /* #....... */
+	/*026a:*/	0x80,  /* #....... */
+	/*026b:*/	0x80,  /* #....... */
+	/*026c:*/	0x80,  /* #....... */
+	/*026d:*/	0x80,  /* #....... */
+	/*026e:*/	0x80,  /* #....... */
+	/*026f:*/	0x80,  /* #....... */
+	/*0270:*/	0x80,  /* #....... */
+	/*0271:*/	0x80,  /* #....... */
+/* --- new character J (74) starting at offset 0x0272 --- */
+	/*0272:*/	8, 6, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0277:*/	0x04,  /* .....#.. */
+	/*0278:*/	0x04,  /* .....#.. */
+	/*0279:*/	0x04,  /* .....#.. */
+	/*027a:*/	0x04,  /* .....#.. */
+	/*027b:*/	0x04,  /* .....#.. */
+	/*027c:*/	0x04,  /* .....#.. */
+	/*027d:*/	0x04,  /* .....#.. */
+	/*027e:*/	0x04,  /* .....#.. */
+	/*027f:*/	0x84,  /* #....#.. */
+	/*0280:*/	0x84,  /* #....#.. */
+	/*0281:*/	0x78,  /* .####... */
+/* --- new character K (75) starting at offset 0x0282 --- */
+	/*0282:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0287:*/	0x82,  /* #.....#. */
+	/*0288:*/	0x84,  /* #....#.. */
+	/*0289:*/	0x88,  /* #...#... */
+	/*028a:*/	0x90,  /* #..#.... */
+	/*028b:*/	0xa0,  /* #.#..... */
+	/*028c:*/	0xe0,  /* ###..... */
+	/*028d:*/	0x90,  /* #..#.... */
+	/*028e:*/	0x88,  /* #...#... */
+	/*028f:*/	0x84,  /* #....#.. */
+	/*0290:*/	0x82,  /* #.....#. */
+	/*0291:*/	0x81,  /* #......# */
+/* --- new character L (76) starting at offset 0x0292 --- */
+	/*0292:*/	8, 6, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0297:*/	0x80,  /* #....... */
+	/*0298:*/	0x80,  /* #....... */
+	/*0299:*/	0x80,  /* #....... */
+	/*029a:*/	0x80,  /* #....... */
+	/*029b:*/	0x80,  /* #....... */
+	/*029c:*/	0x80,  /* #....... */
+	/*029d:*/	0x80,  /* #....... */
+	/*029e:*/	0x80,  /* #....... */
+	/*029f:*/	0x80,  /* #....... */
+	/*02a0:*/	0x80,  /* #....... */
+	/*02a1:*/	0xfc,  /* ######.. */
+/* --- new character M (77) starting at offset 0x02a2 --- */
+	/*02a2:*/	13, 11, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02a7:*/	0x80,0x20,  /* #.........#..... */
+	/*02a9:*/	0x80,0x20,  /* #.........#..... */
+	/*02ab:*/	0xc0,0x60,  /* ##.......##..... */
+	/*02ad:*/	0xa0,0xa0,  /* #.#.....#.#..... */
+	/*02af:*/	0xa0,0xa0,  /* #.#.....#.#..... */
+	/*02b1:*/	0x91,0x20,  /* #..#...#..#..... */
+	/*02b3:*/	0x91,0x20,  /* #..#...#..#..... */
+	/*02b5:*/	0x8a,0x20,  /* #...#.#...#..... */
+	/*02b7:*/	0x8a,0x20,  /* #...#.#...#..... */
+	/*02b9:*/	0x84,0x20,  /* #....#....#..... */
+	/*02bb:*/	0x84,0x20,  /* #....#....#..... */
+/* --- new character N (78) starting at offset 0x02bd --- */
+	/*02bd:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02c2:*/	0xc1,  /* ##.....# */
+	/*02c3:*/	0xc1,  /* ##.....# */
+	/*02c4:*/	0xa1,  /* #.#....# */
+	/*02c5:*/	0x91,  /* #..#...# */
+	/*02c6:*/	0x91,  /* #..#...# */
+	/*02c7:*/	0x89,  /* #...#..# */
+	/*02c8:*/	0x89,  /* #...#..# */
+	/*02c9:*/	0x85,  /* #....#.# */
+	/*02ca:*/	0x85,  /* #....#.# */
+	/*02cb:*/	0x83,  /* #.....## */
+	/*02cc:*/	0x83,  /* #.....## */
+/* --- new character O (79) starting at offset 0x02cd --- */
+	/*02cd:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02d2:*/	0x1c,0x00,  /* ...###.......... */
+	/*02d4:*/	0x63,0x00,  /* .##...##........ */
+	/*02d6:*/	0x41,0x00,  /* .#.....#........ */
+	/*02d8:*/	0x80,0x80,  /* #.......#....... */
+	/*02da:*/	0x80,0x80,  /* #.......#....... */
+	/*02dc:*/	0x80,0x80,  /* #.......#....... */
+	/*02de:*/	0x80,0x80,  /* #.......#....... */
+	/*02e0:*/	0x80,0x80,  /* #.......#....... */
+	/*02e2:*/	0x41,0x00,  /* .#.....#........ */
+	/*02e4:*/	0x63,0x00,  /* .##...##........ */
+	/*02e6:*/	0x1c,0x00,  /* ...###.......... */
+/* --- new character P (80) starting at offset 0x02e8 --- */
+	/*02e8:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02ed:*/	0xfc,  /* ######.. */
+	/*02ee:*/	0x86,  /* #....##. */
+	/*02ef:*/	0x82,  /* #.....#. */
+	/*02f0:*/	0x82,  /* #.....#. */
+	/*02f1:*/	0x86,  /* #....##. */
+	/*02f2:*/	0xfc,  /* ######.. */
+	/*02f3:*/	0x80,  /* #....... */
+	/*02f4:*/	0x80,  /* #....... */
+	/*02f5:*/	0x80,  /* #....... */
+	/*02f6:*/	0x80,  /* #....... */
+	/*02f7:*/	0x80,  /* #....... */
+/* --- new character Q (81) starting at offset 0x02f8 --- */
+	/*02f8:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02fd:*/	0x1c,0x00,  /* ...###.......... */
+	/*02ff:*/	0x63,0x00,  /* .##...##........ */
+	/*0301:*/	0x41,0x00,  /* .#.....#........ */
+	/*0303:*/	0x80,0x80,  /* #.......#....... */
+	/*0305:*/	0x80,0x80,  /* #.......#....... */
+	/*0307:*/	0x80,0x80,  /* #.......#....... */
+	/*0309:*/	0x88,0x80,  /* #...#...#....... */
+	/*030b:*/	0x84,0x80,  /* #....#..#....... */
+	/*030d:*/	0x43,0x00,  /* .#....##........ */
+	/*030f:*/	0x63,0x00,  /* .##...##........ */
+	/*0311:*/	0x1c,0x80,  /* ...###..#....... */
+/* --- new character R (82) starting at offset 0x0313 --- */
+	/*0313:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0318:*/	0xfc,  /* ######.. */
+	/*0319:*/	0x86,  /* #....##. */
+	/*031a:*/	0x82,  /* #.....#. */
+	/*031b:*/	0x82,  /* #.....#. */
+	/*031c:*/	0x84,  /* #....#.. */
+	/*031d:*/	0xf8,  /* #####... */
+	/*031e:*/	0x84,  /* #....#.. */
+	/*031f:*/	0x82,  /* #.....#. */
+	/*0320:*/	0x82,  /* #.....#. */
+	/*0321:*/	0x82,  /* #.....#. */
+	/*0322:*/	0x82,  /* #.....#. */
+/* --- new character S (83) starting at offset 0x0323 --- */
+	/*0323:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0328:*/	0x38,  /* ..###... */
+	/*0329:*/	0xc6,  /* ##...##. */
+	/*032a:*/	0x82,  /* #.....#. */
+	/*032b:*/	0x80,  /* #....... */
+	/*032c:*/	0x60,  /* .##..... */
+	/*032d:*/	0x18,  /* ...##... */
+	/*032e:*/	0x06,  /* .....##. */
+	/*032f:*/	0x02,  /* ......#. */
+	/*0330:*/	0x82,  /* #.....#. */
+	/*0331:*/	0xc6,  /* ##...##. */
+	/*0332:*/	0x38,  /* ..###... */
+/* --- new character T (84) starting at offset 0x0333 --- */
+	/*0333:*/	9, 9, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0338:*/	0xff,0x80,  /* #########....... */
+	/*033a:*/	0x08,0x00,  /* ....#........... */
+	/*033c:*/	0x08,0x00,  /* ....#........... */
+	/*033e:*/	0x08,0x00,  /* ....#........... */
+	/*0340:*/	0x08,0x00,  /* ....#........... */
+	/*0342:*/	0x08,0x00,  /* ....#........... */
+	/*0344:*/	0x08,0x00,  /* ....#........... */
+	/*0346:*/	0x08,0x00,  /* ....#........... */
+	/*0348:*/	0x08,0x00,  /* ....#........... */
+	/*034a:*/	0x08,0x00,  /* ....#........... */
+	/*034c:*/	0x08,0x00,  /* ....#........... */
+/* --- new character U (85) starting at offset 0x034e --- */
+	/*034e:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0353:*/	0x81,  /* #......# */
+	/*0354:*/	0x81,  /* #......# */
+	/*0355:*/	0x81,  /* #......# */
+	/*0356:*/	0x81,  /* #......# */
+	/*0357:*/	0x81,  /* #......# */
+	/*0358:*/	0x81,  /* #......# */
+	/*0359:*/	0x81,  /* #......# */
+	/*035a:*/	0x81,  /* #......# */
+	/*035b:*/	0x81,  /* #......# */
+	/*035c:*/	0x42,  /* .#....#. */
+	/*035d:*/	0x3c,  /* ..####.. */
+/* --- new character V (86) starting at offset 0x035e --- */
+	/*035e:*/	11, 9, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0363:*/	0x80,0x80,  /* #.......#....... */
+	/*0365:*/	0x80,0x80,  /* #.......#....... */
+	/*0367:*/	0x41,0x00,  /* .#.....#........ */
+	/*0369:*/	0x41,0x00,  /* .#.....#........ */
+	/*036b:*/	0x22,0x00,  /* ..#...#......... */
+	/*036d:*/	0x22,0x00,  /* ..#...#......... */
+	/*036f:*/	0x22,0x00,  /* ..#...#......... */
+	/*0371:*/	0x14,0x00,  /* ...#.#.......... */
+	/*0373:*/	0x14,0x00,  /* ...#.#.......... */
+	/*0375:*/	0x08,0x00,  /* ....#........... */
+	/*0377:*/	0x08,0x00,  /* ....#........... */
+/* --- new character W (87) starting at offset 0x0379 --- */
+	/*0379:*/	15, 13, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*037e:*/	0x82,0x08,  /* #.....#.....#... */
+	/*0380:*/	0x82,0x08,  /* #.....#.....#... */
+	/*0382:*/	0x85,0x08,  /* #....#.#....#... */
+	/*0384:*/	0x45,0x10,  /* .#...#.#...#.... */
+	/*0386:*/	0x45,0x10,  /* .#...#.#...#.... */
+	/*0388:*/	0x45,0x10,  /* .#...#.#...#.... */
+	/*038a:*/	0x28,0xa0,  /* ..#.#...#.#..... */
+	/*038c:*/	0x28,0xa0,  /* ..#.#...#.#..... */
+	/*038e:*/	0x28,0xa0,  /* ..#.#...#.#..... */
+	/*0390:*/	0x10,0x40,  /* ...#.....#...... */
+	/*0392:*/	0x10,0x40,  /* ...#.....#...... */
+/* --- new character X (88) starting at offset 0x0394 --- */
+	/*0394:*/	10, 8, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0399:*/	0x81,  /* #......# */
+	/*039a:*/	0x81,  /* #......# */
+	/*039b:*/	0x42,  /* .#....#. */
+	/*039c:*/	0x24,  /* ..#..#.. */
+	/*039d:*/	0x18,  /* ...##... */
+	/*039e:*/	0x18,  /* ...##... */
+	/*039f:*/	0x24,  /* ..#..#.. */
+	/*03a0:*/	0x42,  /* .#....#. */
+	/*03a1:*/	0x42,  /* .#....#. */
+	/*03a2:*/	0x81,  /* #......# */
+	/*03a3:*/	0x81,  /* #......# */
+/* --- new character Y (89) starting at offset 0x03a4 --- */
+	/*03a4:*/	9, 9, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03a9:*/	0x80,0x80,  /* #.......#....... */
+	/*03ab:*/	0x41,0x00,  /* .#.....#........ */
+	/*03ad:*/	0x41,0x00,  /* .#.....#........ */
+	/*03af:*/	0x22,0x00,  /* ..#...#......... */
+	/*03b1:*/	0x22,0x00,  /* ..#...#......... */
+	/*03b3:*/	0x14,0x00,  /* ...#.#.......... */
+	/*03b5:*/	0x08,0x00,  /* ....#........... */
+	/*03b7:*/	0x08,0x00,  /* ....#........... */
+	/*03b9:*/	0x08,0x00,  /* ....#........... */
+	/*03bb:*/	0x08,0x00,  /* ....#........... */
+	/*03bd:*/	0x08,0x00,  /* ....#........... */
+/* --- new character Z (90) starting at offset 0x03bf --- */
+	/*03bf:*/	9, 7, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*03c4:*/	0xfe,  /* #######. */
+	/*03c5:*/	0x02,  /* ......#. */
+	/*03c6:*/	0x04,  /* .....#.. */
+	/*03c7:*/	0x08,  /* ....#... */
+	/*03c8:*/	0x18,  /* ...##... */
+	/*03c9:*/	0x10,  /* ...#.... */
+	/*03ca:*/	0x20,  /* ..#..... */
+	/*03cb:*/	0x60,  /* .##..... */
+	/*03cc:*/	0x40,  /* .#...... */
+	/*03cd:*/	0x80,  /* #....... */
+	/*03ce:*/	0xfe,  /* #######. */
+/* --- new character bracketleft (91) starting at offset 0x03cf --- */
+	/*03cf:*/	4, 3, 14, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*03d4:*/	0xe0,  /* ###..... */
+	/*03d5:*/	0x80,  /* #....... */
+	/*03d6:*/	0x80,  /* #....... */
+	/*03d7:*/	0x80,  /* #....... */
+	/*03d8:*/	0x80,  /* #....... */
+	/*03d9:*/	0x80,  /* #....... */
+	/*03da:*/	0x80,  /* #....... */
+	/*03db:*/	0x80,  /* #....... */
+	/*03dc:*/	0x80,  /* #....... */
+	/*03dd:*/	0x80,  /* #....... */
+	/*03de:*/	0x80,  /* #....... */
+	/*03df:*/	0x80,  /* #....... */
+	/*03e0:*/	0x80,  /* #....... */
+	/*03e1:*/	0xe0,  /* ###..... */
+/* --- new character backslash (92) starting at offset 0x03e2 --- */
+	/*03e2:*/	4, 4, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*03e7:*/	0x80,  /* #....... */
+	/*03e8:*/	0x80,  /* #....... */
+	/*03e9:*/	0x40,  /* .#...... */
+	/*03ea:*/	0x40,  /* .#...... */
+	/*03eb:*/	0x40,  /* .#...... */
+	/*03ec:*/	0x20,  /* ..#..... */
+	/*03ed:*/	0x20,  /* ..#..... */
+	/*03ee:*/	0x20,  /* ..#..... */
+	/*03ef:*/	0x10,  /* ...#.... */
+	/*03f0:*/	0x10,  /* ...#.... */
+	/*03f1:*/	0x10,  /* ...#.... */
+/* --- new character bracketright (93) starting at offset 0x03f2 --- */
+	/*03f2:*/	4, 3, 14, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*03f7:*/	0xe0,  /* ###..... */
+	/*03f8:*/	0x20,  /* ..#..... */
+	/*03f9:*/	0x20,  /* ..#..... */
+	/*03fa:*/	0x20,  /* ..#..... */
+	/*03fb:*/	0x20,  /* ..#..... */
+	/*03fc:*/	0x20,  /* ..#..... */
+	/*03fd:*/	0x20,  /* ..#..... */
+	/*03fe:*/	0x20,  /* ..#..... */
+	/*03ff:*/	0x20,  /* ..#..... */
+	/*0400:*/	0x20,  /* ..#..... */
+	/*0401:*/	0x20,  /* ..#..... */
+	/*0402:*/	0x20,  /* ..#..... */
+	/*0403:*/	0x20,  /* ..#..... */
+	/*0404:*/	0xe0,  /* ###..... */
+/* --- new character asciicircum (94) starting at offset 0x0405 --- */
+	/*0405:*/	7, 7, 4, 0, 6, /* width and bbox (w,h,x,y) */ 
+	/*040a:*/	0x10,  /* ...#.... */
+	/*040b:*/	0x28,  /* ..#.#... */
+	/*040c:*/	0x44,  /* .#...#.. */
+	/*040d:*/	0x82,  /* #.....#. */
+/* --- new character underscore (95) starting at offset 0x040e --- */
+	/*040e:*/	8, 8, 1, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*0413:*/	0xff,  /* ######## */
+/* --- new character grave (96) starting at offset 0x0414 --- */
+	/*0414:*/	5, 2, 2, 1, 9, /* width and bbox (w,h,x,y) */ 
+	/*0419:*/	0x80,  /* #....... */
+	/*041a:*/	0x40,  /* .#...... */
+/* --- new character a (97) starting at offset 0x041b --- */
+	/*041b:*/	8, 7, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0420:*/	0x78,  /* .####... */
+	/*0421:*/	0xcc,  /* ##..##.. */
+	/*0422:*/	0x04,  /* .....#.. */
+	/*0423:*/	0x7c,  /* .#####.. */
+	/*0424:*/	0xc4,  /* ##...#.. */
+	/*0425:*/	0x84,  /* #....#.. */
+	/*0426:*/	0xcc,  /* ##..##.. */
+	/*0427:*/	0x76,  /* .###.##. */
+/* --- new character b (98) starting at offset 0x0428 --- */
+	/*0428:*/	8, 6, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*042d:*/	0x80,  /* #....... */
+	/*042e:*/	0x80,  /* #....... */
+	/*042f:*/	0x80,  /* #....... */
+	/*0430:*/	0xb8,  /* #.###... */
+	/*0431:*/	0xcc,  /* ##..##.. */
+	/*0432:*/	0x84,  /* #....#.. */
+	/*0433:*/	0x84,  /* #....#.. */
+	/*0434:*/	0x84,  /* #....#.. */
+	/*0435:*/	0x84,  /* #....#.. */
+	/*0436:*/	0xcc,  /* ##..##.. */
+	/*0437:*/	0xb8,  /* #.###... */
+/* --- new character c (99) starting at offset 0x0438 --- */
+	/*0438:*/	8, 6, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*043d:*/	0x78,  /* .####... */
+	/*043e:*/	0xcc,  /* ##..##.. */
+	/*043f:*/	0x80,  /* #....... */
+	/*0440:*/	0x80,  /* #....... */
+	/*0441:*/	0x80,  /* #....... */
+	/*0442:*/	0x84,  /* #....#.. */
+	/*0443:*/	0xcc,  /* ##..##.. */
+	/*0444:*/	0x78,  /* .####... */
+/* --- new character d (100) starting at offset 0x0445 --- */
+	/*0445:*/	8, 6, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*044a:*/	0x04,  /* .....#.. */
+	/*044b:*/	0x04,  /* .....#.. */
+	/*044c:*/	0x04,  /* .....#.. */
+	/*044d:*/	0x74,  /* .###.#.. */
+	/*044e:*/	0xcc,  /* ##..##.. */
+	/*044f:*/	0x84,  /* #....#.. */
+	/*0450:*/	0x84,  /* #....#.. */
+	/*0451:*/	0x84,  /* #....#.. */
+	/*0452:*/	0x84,  /* #....#.. */
+	/*0453:*/	0xcc,  /* ##..##.. */
+	/*0454:*/	0x74,  /* .###.#.. */
+/* --- new character e (101) starting at offset 0x0455 --- */
+	/*0455:*/	8, 6, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*045a:*/	0x78,  /* .####... */
+	/*045b:*/	0xcc,  /* ##..##.. */
+	/*045c:*/	0x84,  /* #....#.. */
+	/*045d:*/	0xfc,  /* ######.. */
+	/*045e:*/	0x80,  /* #....... */
+	/*045f:*/	0x80,  /* #....... */
+	/*0460:*/	0xcc,  /* ##..##.. */
+	/*0461:*/	0x78,  /* .####... */
+/* --- new character f (102) starting at offset 0x0462 --- */
+	/*0462:*/	3, 4, 11, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0467:*/	0x30,  /* ..##.... */
+	/*0468:*/	0x40,  /* .#...... */
+	/*0469:*/	0x40,  /* .#...... */
+	/*046a:*/	0xe0,  /* ###..... */
+	/*046b:*/	0x40,  /* .#...... */
+	/*046c:*/	0x40,  /* .#...... */
+	/*046d:*/	0x40,  /* .#...... */
+	/*046e:*/	0x40,  /* .#...... */
+	/*046f:*/	0x40,  /* .#...... */
+	/*0470:*/	0x40,  /* .#...... */
+	/*0471:*/	0x40,  /* .#...... */
+/* --- new character g (103) starting at offset 0x0472 --- */
+	/*0472:*/	8, 6, 11, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*0477:*/	0x74,  /* .###.#.. */
+	/*0478:*/	0xcc,  /* ##..##.. */
+	/*0479:*/	0x84,  /* #....#.. */
+	/*047a:*/	0x84,  /* #....#.. */
+	/*047b:*/	0x84,  /* #....#.. */
+	/*047c:*/	0x84,  /* #....#.. */
+	/*047d:*/	0xcc,  /* ##..##.. */
+	/*047e:*/	0x74,  /* .###.#.. */
+	/*047f:*/	0x04,  /* .....#.. */
+	/*0480:*/	0xcc,  /* ##..##.. */
+	/*0481:*/	0x78,  /* .####... */
+/* --- new character h (104) starting at offset 0x0482 --- */
+	/*0482:*/	8, 6, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0487:*/	0x80,  /* #....... */
+	/*0488:*/	0x80,  /* #....... */
+	/*0489:*/	0x80,  /* #....... */
+	/*048a:*/	0xb8,  /* #.###... */
+	/*048b:*/	0xcc,  /* ##..##.. */
+	/*048c:*/	0x84,  /* #....#.. */
+	/*048d:*/	0x84,  /* #....#.. */
+	/*048e:*/	0x84,  /* #....#.. */
+	/*048f:*/	0x84,  /* #....#.. */
+	/*0490:*/	0x84,  /* #....#.. */
+	/*0491:*/	0x84,  /* #....#.. */
+/* --- new character i (105) starting at offset 0x0492 --- */
+	/*0492:*/	3, 1, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0497:*/	0x80,  /* #....... */
+	/*0498:*/	0x80,  /* #....... */
+	/*0499:*/	0x00,  /* ........ */
+	/*049a:*/	0x80,  /* #....... */
+	/*049b:*/	0x80,  /* #....... */
+	/*049c:*/	0x80,  /* #....... */
+	/*049d:*/	0x80,  /* #....... */
+	/*049e:*/	0x80,  /* #....... */
+	/*049f:*/	0x80,  /* #....... */
+	/*04a0:*/	0x80,  /* #....... */
+	/*04a1:*/	0x80,  /* #....... */
+/* --- new character j (106) starting at offset 0x04a2 --- */
+	/*04a2:*/	3, 3, 14, -1, -3, /* width and bbox (w,h,x,y) */ 
+	/*04a7:*/	0x20,  /* ..#..... */
+	/*04a8:*/	0x20,  /* ..#..... */
+	/*04a9:*/	0x00,  /* ........ */
+	/*04aa:*/	0x20,  /* ..#..... */
+	/*04ab:*/	0x20,  /* ..#..... */
+	/*04ac:*/	0x20,  /* ..#..... */
+	/*04ad:*/	0x20,  /* ..#..... */
+	/*04ae:*/	0x20,  /* ..#..... */
+	/*04af:*/	0x20,  /* ..#..... */
+	/*04b0:*/	0x20,  /* ..#..... */
+	/*04b1:*/	0x20,  /* ..#..... */
+	/*04b2:*/	0x20,  /* ..#..... */
+	/*04b3:*/	0x20,  /* ..#..... */
+	/*04b4:*/	0xc0,  /* ##...... */
+/* --- new character k (107) starting at offset 0x04b5 --- */
+	/*04b5:*/	7, 6, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*04ba:*/	0x80,  /* #....... */
+	/*04bb:*/	0x80,  /* #....... */
+	/*04bc:*/	0x80,  /* #....... */
+	/*04bd:*/	0x88,  /* #...#... */
+	/*04be:*/	0x90,  /* #..#.... */
+	/*04bf:*/	0xa0,  /* #.#..... */
+	/*04c0:*/	0xc0,  /* ##...... */
+	/*04c1:*/	0xa0,  /* #.#..... */
+	/*04c2:*/	0x90,  /* #..#.... */
+	/*04c3:*/	0x88,  /* #...#... */
+	/*04c4:*/	0x84,  /* #....#.. */
+/* --- new character l (108) starting at offset 0x04c5 --- */
+	/*04c5:*/	3, 1, 11, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*04ca:*/	0x80,  /* #....... */
+	/*04cb:*/	0x80,  /* #....... */
+	/*04cc:*/	0x80,  /* #....... */
+	/*04cd:*/	0x80,  /* #....... */
+	/*04ce:*/	0x80,  /* #....... */
+	/*04cf:*/	0x80,  /* #....... */
+	/*04d0:*/	0x80,  /* #....... */
+	/*04d1:*/	0x80,  /* #....... */
+	/*04d2:*/	0x80,  /* #....... */
+	/*04d3:*/	0x80,  /* #....... */
+	/*04d4:*/	0x80,  /* #....... */
+/* --- new character m (109) starting at offset 0x04d5 --- */
+	/*04d5:*/	11, 9, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*04da:*/	0xb3,0x00,  /* #.##..##........ */
+	/*04dc:*/	0xcc,0x80,  /* ##..##..#....... */
+	/*04de:*/	0x88,0x80,  /* #...#...#....... */
+	/*04e0:*/	0x88,0x80,  /* #...#...#....... */
+	/*04e2:*/	0x88,0x80,  /* #...#...#....... */
+	/*04e4:*/	0x88,0x80,  /* #...#...#....... */
+	/*04e6:*/	0x88,0x80,  /* #...#...#....... */
+	/*04e8:*/	0x88,0x80,  /* #...#...#....... */
+/* --- new character n (110) starting at offset 0x04ea --- */
+	/*04ea:*/	8, 6, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*04ef:*/	0xb8,  /* #.###... */
+	/*04f0:*/	0xcc,  /* ##..##.. */
+	/*04f1:*/	0x84,  /* #....#.. */
+	/*04f2:*/	0x84,  /* #....#.. */
+	/*04f3:*/	0x84,  /* #....#.. */
+	/*04f4:*/	0x84,  /* #....#.. */
+	/*04f5:*/	0x84,  /* #....#.. */
+	/*04f6:*/	0x84,  /* #....#.. */
+/* --- new character o (111) starting at offset 0x04f7 --- */
+	/*04f7:*/	8, 6, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*04fc:*/	0x78,  /* .####... */
+	/*04fd:*/	0xcc,  /* ##..##.. */
+	/*04fe:*/	0x84,  /* #....#.. */
+	/*04ff:*/	0x84,  /* #....#.. */
+	/*0500:*/	0x84,  /* #....#.. */
+	/*0501:*/	0x84,  /* #....#.. */
+	/*0502:*/	0xcc,  /* ##..##.. */
+	/*0503:*/	0x78,  /* .####... */
+/* --- new character p (112) starting at offset 0x0504 --- */
+	/*0504:*/	8, 6, 11, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*0509:*/	0xb8,  /* #.###... */
+	/*050a:*/	0xcc,  /* ##..##.. */
+	/*050b:*/	0x84,  /* #....#.. */
+	/*050c:*/	0x84,  /* #....#.. */
+	/*050d:*/	0x84,  /* #....#.. */
+	/*050e:*/	0x84,  /* #....#.. */
+	/*050f:*/	0xcc,  /* ##..##.. */
+	/*0510:*/	0xb8,  /* #.###... */
+	/*0511:*/	0x80,  /* #....... */
+	/*0512:*/	0x80,  /* #....... */
+	/*0513:*/	0x80,  /* #....... */
+/* --- new character q (113) starting at offset 0x0514 --- */
+	/*0514:*/	8, 6, 11, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*0519:*/	0x74,  /* .###.#.. */
+	/*051a:*/	0xcc,  /* ##..##.. */
+	/*051b:*/	0x84,  /* #....#.. */
+	/*051c:*/	0x84,  /* #....#.. */
+	/*051d:*/	0x84,  /* #....#.. */
+	/*051e:*/	0x84,  /* #....#.. */
+	/*051f:*/	0xcc,  /* ##..##.. */
+	/*0520:*/	0x74,  /* .###.#.. */
+	/*0521:*/	0x04,  /* .....#.. */
+	/*0522:*/	0x04,  /* .....#.. */
+	/*0523:*/	0x04,  /* .....#.. */
+/* --- new character r (114) starting at offset 0x0524 --- */
+	/*0524:*/	5, 4, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0529:*/	0xb0,  /* #.##.... */
+	/*052a:*/	0xc0,  /* ##...... */
+	/*052b:*/	0x80,  /* #....... */
+	/*052c:*/	0x80,  /* #....... */
+	/*052d:*/	0x80,  /* #....... */
+	/*052e:*/	0x80,  /* #....... */
+	/*052f:*/	0x80,  /* #....... */
+	/*0530:*/	0x80,  /* #....... */
+/* --- new character s (115) starting at offset 0x0531 --- */
+	/*0531:*/	8, 6, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0536:*/	0x78,  /* .####... */
+	/*0537:*/	0x84,  /* #....#.. */
+	/*0538:*/	0x80,  /* #....... */
+	/*0539:*/	0x78,  /* .####... */
+	/*053a:*/	0x0c,  /* ....##.. */
+	/*053b:*/	0x04,  /* .....#.. */
+	/*053c:*/	0x84,  /* #....#.. */
+	/*053d:*/	0x78,  /* .####... */
+/* --- new character t (116) starting at offset 0x053e --- */
+	/*053e:*/	4, 4, 10, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0543:*/	0x40,  /* .#...... */
+	/*0544:*/	0x40,  /* .#...... */
+	/*0545:*/	0xf0,  /* ####.... */
+	/*0546:*/	0x40,  /* .#...... */
+	/*0547:*/	0x40,  /* .#...... */
+	/*0548:*/	0x40,  /* .#...... */
+	/*0549:*/	0x40,  /* .#...... */
+	/*054a:*/	0x40,  /* .#...... */
+	/*054b:*/	0x40,  /* .#...... */
+	/*054c:*/	0x30,  /* ..##.... */
+/* --- new character u (117) starting at offset 0x054d --- */
+	/*054d:*/	8, 6, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0552:*/	0x84,  /* #....#.. */
+	/*0553:*/	0x84,  /* #....#.. */
+	/*0554:*/	0x84,  /* #....#.. */
+	/*0555:*/	0x84,  /* #....#.. */
+	/*0556:*/	0x84,  /* #....#.. */
+	/*0557:*/	0x84,  /* #....#.. */
+	/*0558:*/	0xcc,  /* ##..##.. */
+	/*0559:*/	0x74,  /* .###.#.. */
+/* --- new character v (118) starting at offset 0x055a --- */
+	/*055a:*/	8, 6, 8, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*055f:*/	0x84,  /* #....#.. */
+	/*0560:*/	0x84,  /* #....#.. */
+	/*0561:*/	0x84,  /* #....#.. */
+	/*0562:*/	0x48,  /* .#..#... */
+	/*0563:*/	0x48,  /* .#..#... */
+	/*0564:*/	0x48,  /* .#..#... */
+	/*0565:*/	0x30,  /* ..##.... */
+	/*0566:*/	0x30,  /* ..##.... */
+/* --- new character w (119) starting at offset 0x0567 --- */
+	/*0567:*/	10, 9, 8, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*056c:*/	0x88,0x80,  /* #...#...#....... */
+	/*056e:*/	0x88,0x80,  /* #...#...#....... */
+	/*0570:*/	0x88,0x80,  /* #...#...#....... */
+	/*0572:*/	0x49,0x00,  /* .#..#..#........ */
+	/*0574:*/	0x49,0x00,  /* .#..#..#........ */
+	/*0576:*/	0x55,0x00,  /* .#.#.#.#........ */
+	/*0578:*/	0x22,0x00,  /* ..#...#......... */
+	/*057a:*/	0x22,0x00,  /* ..#...#......... */
+/* --- new character x (120) starting at offset 0x057c --- */
+	/*057c:*/	7, 7, 8, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0581:*/	0xc6,  /* ##...##. */
+	/*0582:*/	0x44,  /* .#...#.. */
+	/*0583:*/	0x28,  /* ..#.#... */
+	/*0584:*/	0x10,  /* ...#.... */
+	/*0585:*/	0x10,  /* ...#.... */
+	/*0586:*/	0x28,  /* ..#.#... */
+	/*0587:*/	0x44,  /* .#...#.. */
+	/*0588:*/	0xc6,  /* ##...##. */
+/* --- new character y (121) starting at offset 0x0589 --- */
+	/*0589:*/	7, 7, 11, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*058e:*/	0x82,  /* #.....#. */
+	/*058f:*/	0x82,  /* #.....#. */
+	/*0590:*/	0x44,  /* .#...#.. */
+	/*0591:*/	0x44,  /* .#...#.. */
+	/*0592:*/	0x24,  /* ..#..#.. */
+	/*0593:*/	0x28,  /* ..#.#... */
+	/*0594:*/	0x18,  /* ...##... */
+	/*0595:*/	0x10,  /* ...#.... */
+	/*0596:*/	0x10,  /* ...#.... */
+	/*0597:*/	0x30,  /* ..##.... */
+	/*0598:*/	0x60,  /* .##..... */
+/* --- new character z (122) starting at offset 0x0599 --- */
+	/*0599:*/	7, 6, 8, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*059e:*/	0xfc,  /* ######.. */
+	/*059f:*/	0x04,  /* .....#.. */
+	/*05a0:*/	0x08,  /* ....#... */
+	/*05a1:*/	0x10,  /* ...#.... */
+	/*05a2:*/	0x20,  /* ..#..... */
+	/*05a3:*/	0x40,  /* .#...... */
+	/*05a4:*/	0x80,  /* #....... */
+	/*05a5:*/	0xfc,  /* ######.. */
+/* --- new character braceleft (123) starting at offset 0x05a6 --- */
+	/*05a6:*/	5, 5, 14, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*05ab:*/	0x18,  /* ...##... */
+	/*05ac:*/	0x20,  /* ..#..... */
+	/*05ad:*/	0x20,  /* ..#..... */
+	/*05ae:*/	0x20,  /* ..#..... */
+	/*05af:*/	0x20,  /* ..#..... */
+	/*05b0:*/	0x40,  /* .#...... */
+	/*05b1:*/	0x80,  /* #....... */
+	/*05b2:*/	0x40,  /* .#...... */
+	/*05b3:*/	0x20,  /* ..#..... */
+	/*05b4:*/	0x20,  /* ..#..... */
+	/*05b5:*/	0x20,  /* ..#..... */
+	/*05b6:*/	0x20,  /* ..#..... */
+	/*05b7:*/	0x20,  /* ..#..... */
+	/*05b8:*/	0x18,  /* ...##... */
+/* --- new character bar (124) starting at offset 0x05b9 --- */
+	/*05b9:*/	3, 1, 14, 1, -3, /* width and bbox (w,h,x,y) */ 
+	/*05be:*/	0x80,  /* #....... */
+	/*05bf:*/	0x80,  /* #....... */
+	/*05c0:*/	0x80,  /* #....... */
+	/*05c1:*/	0x80,  /* #....... */
+	/*05c2:*/	0x80,  /* #....... */
+	/*05c3:*/	0x80,  /* #....... */
+	/*05c4:*/	0x80,  /* #....... */
+	/*05c5:*/	0x80,  /* #....... */
+	/*05c6:*/	0x80,  /* #....... */
+	/*05c7:*/	0x80,  /* #....... */
+	/*05c8:*/	0x80,  /* #....... */
+	/*05c9:*/	0x80,  /* #....... */
+	/*05ca:*/	0x80,  /* #....... */
+	/*05cb:*/	0x80,  /* #....... */
+/* --- new character braceright (125) starting at offset 0x05cc --- */
+	/*05cc:*/	5, 5, 14, 0, -3, /* width and bbox (w,h,x,y) */ 
+	/*05d1:*/	0xc0,  /* ##...... */
+	/*05d2:*/	0x20,  /* ..#..... */
+	/*05d3:*/	0x20,  /* ..#..... */
+	/*05d4:*/	0x20,  /* ..#..... */
+	/*05d5:*/	0x20,  /* ..#..... */
+	/*05d6:*/	0x10,  /* ...#.... */
+	/*05d7:*/	0x08,  /* ....#... */
+	/*05d8:*/	0x10,  /* ...#.... */
+	/*05d9:*/	0x20,  /* ..#..... */
+	/*05da:*/	0x20,  /* ..#..... */
+	/*05db:*/	0x20,  /* ..#..... */
+	/*05dc:*/	0x20,  /* ..#..... */
+	/*05dd:*/	0x20,  /* ..#..... */
+	/*05de:*/	0xc0,  /* ##...... */
+/* --- new character asciitilde (126) starting at offset 0x05df --- */
+	/*05df:*/	8, 6, 3, 1, 3, /* width and bbox (w,h,x,y) */ 
+	/*05e4:*/	0x64,  /* .##..#.. */
+	/*05e5:*/	0xb4,  /* #.##.#.. */
+	/*05e6:*/	0x98,  /* #..##... */
+};
+static const uint16_t font_helvR14_offsets[] = {
+0x0000 /* space */,
+	0x0006 /* exclam */,
+	0x0016 /* quotedbl */,
+	0x001e /* numbersign */,
+	0x002d /* dollar */,
+	0x0040 /* percent */,
+	0x0059 /* ampersand */,
+	0x0068 /* quotesingle */,
+	0x0070 /* parenleft */,
+	0x0083 /* parenright */,
+	0x0096 /* asterisk */,
+	0x009f /* plus */,
+	0x00ab /* comma */,
+	0x00b4 /* hyphen */,
+	0x00ba /* period */,
+	0x00c1 /* slash */,
+	0x00d1 /* zero */,
+	0x00e0 /* one */,
+	0x00ef /* two */,
+	0x00fe /* three */,
+	0x010d /* four */,
+	0x011c /* five */,
+	0x012b /* six */,
+	0x013a /* seven */,
+	0x0149 /* eight */,
+	0x0158 /* nine */,
+	0x0167 /* colon */,
+	0x0174 /* semicolon */,
+	0x0183 /* less */,
+	0x018d /* equal */,
+	0x0195 /* greater */,
+	0x019f /* question */,
+	0x01af /* at */,
+	0x01cc /* A */,
+	0x01e7 /* B */,
+	0x01f7 /* C */,
+	0x0207 /* D */,
+	0x0217 /* E */,
+	0x0227 /* F */,
+	0x0237 /* G */,
+	0x0252 /* H */,
+	0x0262 /* I */,
+	0x0272 /* J */,
+	0x0282 /* K */,
+	0x0292 /* L */,
+	0x02a2 /* M */,
+	0x02bd /* N */,
+	0x02cd /* O */,
+	0x02e8 /* P */,
+	0x02f8 /* Q */,
+	0x0313 /* R */,
+	0x0323 /* S */,
+	0x0333 /* T */,
+	0x034e /* U */,
+	0x035e /* V */,
+	0x0379 /* W */,
+	0x0394 /* X */,
+	0x03a4 /* Y */,
+	0x03bf /* Z */,
+	0x03cf /* bracketleft */,
+	0x03e2 /* backslash */,
+	0x03f2 /* bracketright */,
+	0x0405 /* asciicircum */,
+	0x040e /* underscore */,
+	0x0414 /* grave */,
+	0x041b /* a */,
+	0x0428 /* b */,
+	0x0438 /* c */,
+	0x0445 /* d */,
+	0x0455 /* e */,
+	0x0462 /* f */,
+	0x0472 /* g */,
+	0x0482 /* h */,
+	0x0492 /* i */,
+	0x04a2 /* j */,
+	0x04b5 /* k */,
+	0x04c5 /* l */,
+	0x04d5 /* m */,
+	0x04ea /* n */,
+	0x04f7 /* o */,
+	0x0504 /* p */,
+	0x0514 /* q */,
+	0x0524 /* r */,
+	0x0531 /* s */,
+	0x053e /* t */,
+	0x054d /* u */,
+	0x055a /* v */,
+	0x0567 /* w */,
+	0x057c /* x */,
+	0x0589 /* y */,
+	0x0599 /* z */,
+	0x05a6 /* braceleft */,
+	0x05b9 /* bar */,
+	0x05cc /* braceright */,
+	0x05df /* asciitilde */,
+	0xffff /* (no glyph) */
+};
+const struct fb_font font_helvR14 = {
+	.height = 16,
+	.ascent = 13,
+	.firstchar = 32, /* space */
+	.lastchar = 127, /* ? */
+	.chardata = font_helvR14_data,
+	.charoffs = font_helvR14_offsets,
+};
diff --git a/src/target/firmware/fb/helvR24.c b/src/target/firmware/fb/helvR24.c
new file mode 100644
index 00000000..18ff0c40
--- /dev/null
+++ b/src/target/firmware/fb/helvR24.c
@@ -0,0 +1,1870 @@
+#include <fb/font.h>
+static const uint8_t font_helvR24_data[] = {
+/* --- new character space (32) starting at offset 0x0000 --- */
+	/*0000:*/	6, 1, 1, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0005:*/	0x00,  /* ........ */
+/* --- new character exclam (33) starting at offset 0x0006 --- */
+	/*0006:*/	6, 2, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*000b:*/	0xc0,  /* ##...... */
+	/*000c:*/	0xc0,  /* ##...... */
+	/*000d:*/	0xc0,  /* ##...... */
+	/*000e:*/	0xc0,  /* ##...... */
+	/*000f:*/	0xc0,  /* ##...... */
+	/*0010:*/	0xc0,  /* ##...... */
+	/*0011:*/	0xc0,  /* ##...... */
+	/*0012:*/	0xc0,  /* ##...... */
+	/*0013:*/	0xc0,  /* ##...... */
+	/*0014:*/	0xc0,  /* ##...... */
+	/*0015:*/	0xc0,  /* ##...... */
+	/*0016:*/	0xc0,  /* ##...... */
+	/*0017:*/	0x80,  /* #....... */
+	/*0018:*/	0x80,  /* #....... */
+	/*0019:*/	0x00,  /* ........ */
+	/*001a:*/	0x00,  /* ........ */
+	/*001b:*/	0xc0,  /* ##...... */
+	/*001c:*/	0xc0,  /* ##...... */
+	/*001d:*/	0xc0,  /* ##...... */
+/* --- new character quotedbl (34) starting at offset 0x001e --- */
+	/*001e:*/	8, 6, 6, 1, 13, /* width and bbox (w,h,x,y) */ 
+	/*0023:*/	0xcc,  /* ##..##.. */
+	/*0024:*/	0xcc,  /* ##..##.. */
+	/*0025:*/	0xcc,  /* ##..##.. */
+	/*0026:*/	0xcc,  /* ##..##.. */
+	/*0027:*/	0xcc,  /* ##..##.. */
+	/*0028:*/	0x44,  /* .#...#.. */
+/* --- new character numbersign (35) starting at offset 0x0029 --- */
+	/*0029:*/	14, 11, 17, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*002e:*/	0x0c,0xc0,  /* ....##..##...... */
+	/*0030:*/	0x0c,0xc0,  /* ....##..##...... */
+	/*0032:*/	0x0c,0xc0,  /* ....##..##...... */
+	/*0034:*/	0x19,0x80,  /* ...##..##....... */
+	/*0036:*/	0xff,0xe0,  /* ###########..... */
+	/*0038:*/	0xff,0xe0,  /* ###########..... */
+	/*003a:*/	0x19,0x80,  /* ...##..##....... */
+	/*003c:*/	0x19,0x80,  /* ...##..##....... */
+	/*003e:*/	0x33,0x00,  /* ..##..##........ */
+	/*0040:*/	0x33,0x00,  /* ..##..##........ */
+	/*0042:*/	0xff,0xe0,  /* ###########..... */
+	/*0044:*/	0xff,0xe0,  /* ###########..... */
+	/*0046:*/	0x33,0x00,  /* ..##..##........ */
+	/*0048:*/	0x33,0x00,  /* ..##..##........ */
+	/*004a:*/	0x66,0x00,  /* .##..##......... */
+	/*004c:*/	0x66,0x00,  /* .##..##......... */
+	/*004e:*/	0x66,0x00,  /* .##..##......... */
+/* --- new character dollar (36) starting at offset 0x0050 --- */
+	/*0050:*/	13, 11, 21, 1, -2, /* width and bbox (w,h,x,y) */ 
+	/*0055:*/	0x06,0x00,  /* .....##......... */
+	/*0057:*/	0x06,0x00,  /* .....##......... */
+	/*0059:*/	0x3f,0x80,  /* ..#######....... */
+	/*005b:*/	0x7f,0xc0,  /* .#########...... */
+	/*005d:*/	0xe6,0xe0,  /* ###..##.###..... */
+	/*005f:*/	0xc6,0x60,  /* ##...##..##..... */
+	/*0061:*/	0xc6,0x00,  /* ##...##......... */
+	/*0063:*/	0xe6,0x00,  /* ###..##......... */
+	/*0065:*/	0x76,0x00,  /* .###.##......... */
+	/*0067:*/	0x3e,0x00,  /* ..#####......... */
+	/*0069:*/	0x0f,0x80,  /* ....#####....... */
+	/*006b:*/	0x07,0xc0,  /* .....#####...... */
+	/*006d:*/	0x06,0xe0,  /* .....##.###..... */
+	/*006f:*/	0x06,0x60,  /* .....##..##..... */
+	/*0071:*/	0xc6,0x60,  /* ##...##..##..... */
+	/*0073:*/	0xc6,0x60,  /* ##...##..##..... */
+	/*0075:*/	0xe6,0xe0,  /* ###..##.###..... */
+	/*0077:*/	0x7f,0xc0,  /* .#########...... */
+	/*0079:*/	0x3f,0x80,  /* ..#######....... */
+	/*007b:*/	0x06,0x00,  /* .....##......... */
+	/*007d:*/	0x06,0x00,  /* .....##......... */
+/* --- new character percent (37) starting at offset 0x007f --- */
+	/*007f:*/	22, 19, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0084:*/	0x00,0x06,0x00,  /* .............##......... */
+	/*0087:*/	0x3c,0x0c,0x00,  /* ..####......##.......... */
+	/*008a:*/	0x7e,0x0c,0x00,  /* .######.....##.......... */
+	/*008d:*/	0xc3,0x18,0x00,  /* ##....##...##........... */
+	/*0090:*/	0xc3,0x18,0x00,  /* ##....##...##........... */
+	/*0093:*/	0xc3,0x30,0x00,  /* ##....##..##............ */
+	/*0096:*/	0xc3,0x30,0x00,  /* ##....##..##............ */
+	/*0099:*/	0x7e,0x60,0x00,  /* .######..##............. */
+	/*009c:*/	0x3c,0x60,0x00,  /* ..####...##............. */
+	/*009f:*/	0x00,0xc0,0x00,  /* ........##.............. */
+	/*00a2:*/	0x00,0xc7,0x80,  /* ........##...####....... */
+	/*00a5:*/	0x01,0x8f,0xc0,  /* .......##...######...... */
+	/*00a8:*/	0x01,0x98,0x60,  /* .......##..##....##..... */
+	/*00ab:*/	0x03,0x18,0x60,  /* ......##...##....##..... */
+	/*00ae:*/	0x03,0x18,0x60,  /* ......##...##....##..... */
+	/*00b1:*/	0x06,0x18,0x60,  /* .....##....##....##..... */
+	/*00b4:*/	0x06,0x0f,0xc0,  /* .....##.....######...... */
+	/*00b7:*/	0x04,0x07,0x80,  /* .....#.......####....... */
+/* --- new character ampersand (38) starting at offset 0x00ba --- */
+	/*00ba:*/	17, 14, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*00bf:*/	0x0f,0x00,  /* ....####........ */
+	/*00c1:*/	0x1f,0x80,  /* ...######....... */
+	/*00c3:*/	0x39,0xc0,  /* ..###..###...... */
+	/*00c5:*/	0x30,0xc0,  /* ..##....##...... */
+	/*00c7:*/	0x30,0xc0,  /* ..##....##...... */
+	/*00c9:*/	0x30,0xc0,  /* ..##....##...... */
+	/*00cb:*/	0x19,0x80,  /* ...##..##....... */
+	/*00cd:*/	0x0f,0x00,  /* ....####........ */
+	/*00cf:*/	0x1e,0x00,  /* ...####......... */
+	/*00d1:*/	0x3f,0x18,  /* ..######...##... */
+	/*00d3:*/	0x73,0x98,  /* .###..###..##... */
+	/*00d5:*/	0x61,0xd8,  /* .##....###.##... */
+	/*00d7:*/	0xc0,0xf0,  /* ##......####.... */
+	/*00d9:*/	0xc0,0x60,  /* ##.......##..... */
+	/*00db:*/	0xc0,0xf0,  /* ##......####.... */
+	/*00dd:*/	0xe1,0xd8,  /* ###....###.##... */
+	/*00df:*/	0x7f,0x9c,  /* .########..###.. */
+	/*00e1:*/	0x1e,0x00,  /* ...####......... */
+/* --- new character quotesingle (39) starting at offset 0x00e3 --- */
+	/*00e3:*/	6, 2, 6, 2, 13, /* width and bbox (w,h,x,y) */ 
+	/*00e8:*/	0xc0,  /* ##...... */
+	/*00e9:*/	0xc0,  /* ##...... */
+	/*00ea:*/	0xc0,  /* ##...... */
+	/*00eb:*/	0xc0,  /* ##...... */
+	/*00ec:*/	0xc0,  /* ##...... */
+	/*00ed:*/	0x40,  /* .#...... */
+/* --- new character parenleft (40) starting at offset 0x00ee --- */
+	/*00ee:*/	8, 5, 24, 2, -5, /* width and bbox (w,h,x,y) */ 
+	/*00f3:*/	0x18,  /* ...##... */
+	/*00f4:*/	0x18,  /* ...##... */
+	/*00f5:*/	0x30,  /* ..##.... */
+	/*00f6:*/	0x30,  /* ..##.... */
+	/*00f7:*/	0x60,  /* .##..... */
+	/*00f8:*/	0x60,  /* .##..... */
+	/*00f9:*/	0x60,  /* .##..... */
+	/*00fa:*/	0xc0,  /* ##...... */
+	/*00fb:*/	0xc0,  /* ##...... */
+	/*00fc:*/	0xc0,  /* ##...... */
+	/*00fd:*/	0xc0,  /* ##...... */
+	/*00fe:*/	0xc0,  /* ##...... */
+	/*00ff:*/	0xc0,  /* ##...... */
+	/*0100:*/	0xc0,  /* ##...... */
+	/*0101:*/	0xc0,  /* ##...... */
+	/*0102:*/	0xc0,  /* ##...... */
+	/*0103:*/	0xc0,  /* ##...... */
+	/*0104:*/	0x60,  /* .##..... */
+	/*0105:*/	0x60,  /* .##..... */
+	/*0106:*/	0x60,  /* .##..... */
+	/*0107:*/	0x30,  /* ..##.... */
+	/*0108:*/	0x30,  /* ..##.... */
+	/*0109:*/	0x18,  /* ...##... */
+	/*010a:*/	0x18,  /* ...##... */
+/* --- new character parenright (41) starting at offset 0x010b --- */
+	/*010b:*/	8, 5, 24, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*0110:*/	0xc0,  /* ##...... */
+	/*0111:*/	0xc0,  /* ##...... */
+	/*0112:*/	0x60,  /* .##..... */
+	/*0113:*/	0x60,  /* .##..... */
+	/*0114:*/	0x30,  /* ..##.... */
+	/*0115:*/	0x30,  /* ..##.... */
+	/*0116:*/	0x30,  /* ..##.... */
+	/*0117:*/	0x18,  /* ...##... */
+	/*0118:*/	0x18,  /* ...##... */
+	/*0119:*/	0x18,  /* ...##... */
+	/*011a:*/	0x18,  /* ...##... */
+	/*011b:*/	0x18,  /* ...##... */
+	/*011c:*/	0x18,  /* ...##... */
+	/*011d:*/	0x18,  /* ...##... */
+	/*011e:*/	0x18,  /* ...##... */
+	/*011f:*/	0x18,  /* ...##... */
+	/*0120:*/	0x18,  /* ...##... */
+	/*0121:*/	0x30,  /* ..##.... */
+	/*0122:*/	0x30,  /* ..##.... */
+	/*0123:*/	0x30,  /* ..##.... */
+	/*0124:*/	0x60,  /* .##..... */
+	/*0125:*/	0x60,  /* .##..... */
+	/*0126:*/	0xc0,  /* ##...... */
+	/*0127:*/	0xc0,  /* ##...... */
+/* --- new character asterisk (42) starting at offset 0x0128 --- */
+	/*0128:*/	10, 7, 7, 1, 12, /* width and bbox (w,h,x,y) */ 
+	/*012d:*/	0x10,  /* ...#.... */
+	/*012e:*/	0x10,  /* ...#.... */
+	/*012f:*/	0xd6,  /* ##.#.##. */
+	/*0130:*/	0x7c,  /* .#####.. */
+	/*0131:*/	0x38,  /* ..###... */
+	/*0132:*/	0x6c,  /* .##.##.. */
+	/*0133:*/	0x44,  /* .#...#.. */
+/* --- new character plus (43) starting at offset 0x0134 --- */
+	/*0134:*/	14, 12, 12, 1, 1, /* width and bbox (w,h,x,y) */ 
+	/*0139:*/	0x06,0x00,  /* .....##......... */
+	/*013b:*/	0x06,0x00,  /* .....##......... */
+	/*013d:*/	0x06,0x00,  /* .....##......... */
+	/*013f:*/	0x06,0x00,  /* .....##......... */
+	/*0141:*/	0x06,0x00,  /* .....##......... */
+	/*0143:*/	0xff,0xf0,  /* ############.... */
+	/*0145:*/	0xff,0xf0,  /* ############.... */
+	/*0147:*/	0x06,0x00,  /* .....##......... */
+	/*0149:*/	0x06,0x00,  /* .....##......... */
+	/*014b:*/	0x06,0x00,  /* .....##......... */
+	/*014d:*/	0x06,0x00,  /* .....##......... */
+	/*014f:*/	0x06,0x00,  /* .....##......... */
+/* --- new character comma (44) starting at offset 0x0151 --- */
+	/*0151:*/	6, 2, 6, 2, -3, /* width and bbox (w,h,x,y) */ 
+	/*0156:*/	0xc0,  /* ##...... */
+	/*0157:*/	0xc0,  /* ##...... */
+	/*0158:*/	0xc0,  /* ##...... */
+	/*0159:*/	0x40,  /* .#...... */
+	/*015a:*/	0x40,  /* .#...... */
+	/*015b:*/	0x80,  /* #....... */
+/* --- new character hyphen (45) starting at offset 0x015c --- */
+	/*015c:*/	8, 6, 2, 1, 6, /* width and bbox (w,h,x,y) */ 
+	/*0161:*/	0xfc,  /* ######.. */
+	/*0162:*/	0xfc,  /* ######.. */
+/* --- new character period (46) starting at offset 0x0163 --- */
+	/*0163:*/	6, 2, 3, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0168:*/	0xc0,  /* ##...... */
+	/*0169:*/	0xc0,  /* ##...... */
+	/*016a:*/	0xc0,  /* ##...... */
+/* --- new character slash (47) starting at offset 0x016b --- */
+	/*016b:*/	7, 7, 19, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0170:*/	0x06,  /* .....##. */
+	/*0171:*/	0x06,  /* .....##. */
+	/*0172:*/	0x06,  /* .....##. */
+	/*0173:*/	0x0c,  /* ....##.. */
+	/*0174:*/	0x0c,  /* ....##.. */
+	/*0175:*/	0x0c,  /* ....##.. */
+	/*0176:*/	0x18,  /* ...##... */
+	/*0177:*/	0x18,  /* ...##... */
+	/*0178:*/	0x18,  /* ...##... */
+	/*0179:*/	0x18,  /* ...##... */
+	/*017a:*/	0x30,  /* ..##.... */
+	/*017b:*/	0x30,  /* ..##.... */
+	/*017c:*/	0x30,  /* ..##.... */
+	/*017d:*/	0x60,  /* .##..... */
+	/*017e:*/	0x60,  /* .##..... */
+	/*017f:*/	0x60,  /* .##..... */
+	/*0180:*/	0xc0,  /* ##...... */
+	/*0181:*/	0xc0,  /* ##...... */
+	/*0182:*/	0xc0,  /* ##...... */
+/* --- new character zero (48) starting at offset 0x0183 --- */
+	/*0183:*/	13, 11, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0188:*/	0x1f,0x00,  /* ...#####........ */
+	/*018a:*/	0x3f,0x80,  /* ..#######....... */
+	/*018c:*/	0x71,0xc0,  /* .###...###...... */
+	/*018e:*/	0x60,0xc0,  /* .##.....##...... */
+	/*0190:*/	0x60,0xc0,  /* .##.....##...... */
+	/*0192:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0194:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0196:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0198:*/	0xc0,0x60,  /* ##.......##..... */
+	/*019a:*/	0xc0,0x60,  /* ##.......##..... */
+	/*019c:*/	0xc0,0x60,  /* ##.......##..... */
+	/*019e:*/	0xc0,0x60,  /* ##.......##..... */
+	/*01a0:*/	0xc0,0x60,  /* ##.......##..... */
+	/*01a2:*/	0x60,0xc0,  /* .##.....##...... */
+	/*01a4:*/	0x60,0xc0,  /* .##.....##...... */
+	/*01a6:*/	0x71,0xc0,  /* .###...###...... */
+	/*01a8:*/	0x3f,0x80,  /* ..#######....... */
+	/*01aa:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character one (49) starting at offset 0x01ac --- */
+	/*01ac:*/	13, 6, 18, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*01b1:*/	0x0c,  /* ....##.. */
+	/*01b2:*/	0x0c,  /* ....##.. */
+	/*01b3:*/	0x1c,  /* ...###.. */
+	/*01b4:*/	0xfc,  /* ######.. */
+	/*01b5:*/	0xfc,  /* ######.. */
+	/*01b6:*/	0x0c,  /* ....##.. */
+	/*01b7:*/	0x0c,  /* ....##.. */
+	/*01b8:*/	0x0c,  /* ....##.. */
+	/*01b9:*/	0x0c,  /* ....##.. */
+	/*01ba:*/	0x0c,  /* ....##.. */
+	/*01bb:*/	0x0c,  /* ....##.. */
+	/*01bc:*/	0x0c,  /* ....##.. */
+	/*01bd:*/	0x0c,  /* ....##.. */
+	/*01be:*/	0x0c,  /* ....##.. */
+	/*01bf:*/	0x0c,  /* ....##.. */
+	/*01c0:*/	0x0c,  /* ....##.. */
+	/*01c1:*/	0x0c,  /* ....##.. */
+	/*01c2:*/	0x0c,  /* ....##.. */
+/* --- new character two (50) starting at offset 0x01c3 --- */
+	/*01c3:*/	13, 11, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01c8:*/	0x1e,0x00,  /* ...####......... */
+	/*01ca:*/	0x7f,0x80,  /* .########....... */
+	/*01cc:*/	0x61,0xc0,  /* .##....###...... */
+	/*01ce:*/	0xc0,0xc0,  /* ##......##...... */
+	/*01d0:*/	0xc0,0x60,  /* ##.......##..... */
+	/*01d2:*/	0xc0,0x60,  /* ##.......##..... */
+	/*01d4:*/	0x00,0x60,  /* .........##..... */
+	/*01d6:*/	0x00,0xc0,  /* ........##...... */
+	/*01d8:*/	0x01,0xc0,  /* .......###...... */
+	/*01da:*/	0x03,0x80,  /* ......###....... */
+	/*01dc:*/	0x0f,0x00,  /* ....####........ */
+	/*01de:*/	0x1c,0x00,  /* ...###.......... */
+	/*01e0:*/	0x38,0x00,  /* ..###........... */
+	/*01e2:*/	0x70,0x00,  /* .###............ */
+	/*01e4:*/	0xe0,0x00,  /* ###............. */
+	/*01e6:*/	0xc0,0x00,  /* ##.............. */
+	/*01e8:*/	0xff,0xe0,  /* ###########..... */
+	/*01ea:*/	0xff,0xe0,  /* ###########..... */
+/* --- new character three (51) starting at offset 0x01ec --- */
+	/*01ec:*/	13, 11, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*01f1:*/	0x1f,0x00,  /* ...#####........ */
+	/*01f3:*/	0x7f,0x80,  /* .########....... */
+	/*01f5:*/	0x61,0x80,  /* .##....##....... */
+	/*01f7:*/	0xc0,0xc0,  /* ##......##...... */
+	/*01f9:*/	0xc0,0xc0,  /* ##......##...... */
+	/*01fb:*/	0xc0,0xc0,  /* ##......##...... */
+	/*01fd:*/	0x00,0xc0,  /* ........##...... */
+	/*01ff:*/	0x01,0x80,  /* .......##....... */
+	/*0201:*/	0x0f,0x00,  /* ....####........ */
+	/*0203:*/	0x0f,0xc0,  /* ....######...... */
+	/*0205:*/	0x00,0xc0,  /* ........##...... */
+	/*0207:*/	0x00,0x60,  /* .........##..... */
+	/*0209:*/	0x00,0x60,  /* .........##..... */
+	/*020b:*/	0xc0,0x60,  /* ##.......##..... */
+	/*020d:*/	0xc0,0xc0,  /* ##......##...... */
+	/*020f:*/	0x61,0xc0,  /* .##....###...... */
+	/*0211:*/	0x7f,0x80,  /* .########....... */
+	/*0213:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character four (52) starting at offset 0x0215 --- */
+	/*0215:*/	13, 11, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*021a:*/	0x01,0x80,  /* .......##....... */
+	/*021c:*/	0x03,0x80,  /* ......###....... */
+	/*021e:*/	0x03,0x80,  /* ......###....... */
+	/*0220:*/	0x07,0x80,  /* .....####....... */
+	/*0222:*/	0x0f,0x80,  /* ....#####....... */
+	/*0224:*/	0x0d,0x80,  /* ....##.##....... */
+	/*0226:*/	0x19,0x80,  /* ...##..##....... */
+	/*0228:*/	0x39,0x80,  /* ..###..##....... */
+	/*022a:*/	0x31,0x80,  /* ..##...##....... */
+	/*022c:*/	0x61,0x80,  /* .##....##....... */
+	/*022e:*/	0xe1,0x80,  /* ###....##....... */
+	/*0230:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0232:*/	0xff,0xe0,  /* ###########..... */
+	/*0234:*/	0xff,0xe0,  /* ###########..... */
+	/*0236:*/	0x01,0x80,  /* .......##....... */
+	/*0238:*/	0x01,0x80,  /* .......##....... */
+	/*023a:*/	0x01,0x80,  /* .......##....... */
+	/*023c:*/	0x01,0x80,  /* .......##....... */
+/* --- new character five (53) starting at offset 0x023e --- */
+	/*023e:*/	13, 11, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0243:*/	0x7f,0xc0,  /* .#########...... */
+	/*0245:*/	0x7f,0xc0,  /* .#########...... */
+	/*0247:*/	0x60,0x00,  /* .##............. */
+	/*0249:*/	0x60,0x00,  /* .##............. */
+	/*024b:*/	0x60,0x00,  /* .##............. */
+	/*024d:*/	0x60,0x00,  /* .##............. */
+	/*024f:*/	0x6e,0x00,  /* .##.###......... */
+	/*0251:*/	0x7f,0x80,  /* .########....... */
+	/*0253:*/	0x71,0xc0,  /* .###...###...... */
+	/*0255:*/	0x00,0xc0,  /* ........##...... */
+	/*0257:*/	0x00,0x60,  /* .........##..... */
+	/*0259:*/	0x00,0x60,  /* .........##..... */
+	/*025b:*/	0x00,0x60,  /* .........##..... */
+	/*025d:*/	0xc0,0x60,  /* ##.......##..... */
+	/*025f:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0261:*/	0xe1,0xc0,  /* ###....###...... */
+	/*0263:*/	0x7f,0x80,  /* .########....... */
+	/*0265:*/	0x1e,0x00,  /* ...####......... */
+/* --- new character six (54) starting at offset 0x0267 --- */
+	/*0267:*/	13, 11, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*026c:*/	0x0f,0x00,  /* ....####........ */
+	/*026e:*/	0x3f,0xc0,  /* ..########...... */
+	/*0270:*/	0x70,0xc0,  /* .###....##...... */
+	/*0272:*/	0x60,0x60,  /* .##......##..... */
+	/*0274:*/	0xe0,0x60,  /* ###......##..... */
+	/*0276:*/	0xc0,0x00,  /* ##.............. */
+	/*0278:*/	0xc0,0x00,  /* ##.............. */
+	/*027a:*/	0xcf,0x00,  /* ##..####........ */
+	/*027c:*/	0xdf,0x80,  /* ##.######....... */
+	/*027e:*/	0xf1,0xc0,  /* ####...###...... */
+	/*0280:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*0282:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0284:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0286:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0288:*/	0xe0,0x60,  /* ###......##..... */
+	/*028a:*/	0x60,0xc0,  /* .##.....##...... */
+	/*028c:*/	0x7f,0xc0,  /* .#########...... */
+	/*028e:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character seven (55) starting at offset 0x0290 --- */
+	/*0290:*/	13, 11, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0295:*/	0xff,0xe0,  /* ###########..... */
+	/*0297:*/	0xff,0xe0,  /* ###########..... */
+	/*0299:*/	0x00,0xe0,  /* ........###..... */
+	/*029b:*/	0x00,0xc0,  /* ........##...... */
+	/*029d:*/	0x01,0x80,  /* .......##....... */
+	/*029f:*/	0x01,0x80,  /* .......##....... */
+	/*02a1:*/	0x03,0x00,  /* ......##........ */
+	/*02a3:*/	0x03,0x00,  /* ......##........ */
+	/*02a5:*/	0x06,0x00,  /* .....##......... */
+	/*02a7:*/	0x06,0x00,  /* .....##......... */
+	/*02a9:*/	0x0c,0x00,  /* ....##.......... */
+	/*02ab:*/	0x0c,0x00,  /* ....##.......... */
+	/*02ad:*/	0x1c,0x00,  /* ...###.......... */
+	/*02af:*/	0x18,0x00,  /* ...##........... */
+	/*02b1:*/	0x18,0x00,  /* ...##........... */
+	/*02b3:*/	0x38,0x00,  /* ..###........... */
+	/*02b5:*/	0x30,0x00,  /* ..##............ */
+	/*02b7:*/	0x30,0x00,  /* ..##............ */
+/* --- new character eight (56) starting at offset 0x02b9 --- */
+	/*02b9:*/	13, 11, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02be:*/	0x0e,0x00,  /* ....###......... */
+	/*02c0:*/	0x3f,0x80,  /* ..#######....... */
+	/*02c2:*/	0x31,0x80,  /* ..##...##....... */
+	/*02c4:*/	0x60,0xc0,  /* .##.....##...... */
+	/*02c6:*/	0x60,0xc0,  /* .##.....##...... */
+	/*02c8:*/	0x60,0xc0,  /* .##.....##...... */
+	/*02ca:*/	0x60,0xc0,  /* .##.....##...... */
+	/*02cc:*/	0x31,0x80,  /* ..##...##....... */
+	/*02ce:*/	0x1f,0x00,  /* ...#####........ */
+	/*02d0:*/	0x3f,0x80,  /* ..#######....... */
+	/*02d2:*/	0x60,0xc0,  /* .##.....##...... */
+	/*02d4:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*02d6:*/	0xc0,0x60,  /* ##.......##..... */
+	/*02d8:*/	0xc0,0x60,  /* ##.......##..... */
+	/*02da:*/	0xc0,0x60,  /* ##.......##..... */
+	/*02dc:*/	0x71,0xc0,  /* .###...###...... */
+	/*02de:*/	0x7f,0xc0,  /* .#########...... */
+	/*02e0:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character nine (57) starting at offset 0x02e2 --- */
+	/*02e2:*/	13, 11, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*02e7:*/	0x1f,0x00,  /* ...#####........ */
+	/*02e9:*/	0x7f,0xc0,  /* .#########...... */
+	/*02eb:*/	0x71,0xc0,  /* .###...###...... */
+	/*02ed:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*02ef:*/	0xc0,0x60,  /* ##.......##..... */
+	/*02f1:*/	0xc0,0x60,  /* ##.......##..... */
+	/*02f3:*/	0xc0,0x60,  /* ##.......##..... */
+	/*02f5:*/	0xc0,0x60,  /* ##.......##..... */
+	/*02f7:*/	0xe0,0xe0,  /* ###.....###..... */
+	/*02f9:*/	0x71,0xe0,  /* .###...####..... */
+	/*02fb:*/	0x7f,0x60,  /* .#######.##..... */
+	/*02fd:*/	0x1e,0x60,  /* ...####..##..... */
+	/*02ff:*/	0x00,0x60,  /* .........##..... */
+	/*0301:*/	0x00,0xe0,  /* ........###..... */
+	/*0303:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0305:*/	0xe1,0xc0,  /* ###....###...... */
+	/*0307:*/	0x7f,0x80,  /* .########....... */
+	/*0309:*/	0x1e,0x00,  /* ...####......... */
+/* --- new character colon (58) starting at offset 0x030b --- */
+	/*030b:*/	6, 2, 14, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0310:*/	0xc0,  /* ##...... */
+	/*0311:*/	0xc0,  /* ##...... */
+	/*0312:*/	0xc0,  /* ##...... */
+	/*0313:*/	0x00,  /* ........ */
+	/*0314:*/	0x00,  /* ........ */
+	/*0315:*/	0x00,  /* ........ */
+	/*0316:*/	0x00,  /* ........ */
+	/*0317:*/	0x00,  /* ........ */
+	/*0318:*/	0x00,  /* ........ */
+	/*0319:*/	0x00,  /* ........ */
+	/*031a:*/	0x00,  /* ........ */
+	/*031b:*/	0xc0,  /* ##...... */
+	/*031c:*/	0xc0,  /* ##...... */
+	/*031d:*/	0xc0,  /* ##...... */
+/* --- new character semicolon (59) starting at offset 0x031e --- */
+	/*031e:*/	6, 2, 17, 2, -3, /* width and bbox (w,h,x,y) */ 
+	/*0323:*/	0xc0,  /* ##...... */
+	/*0324:*/	0xc0,  /* ##...... */
+	/*0325:*/	0xc0,  /* ##...... */
+	/*0326:*/	0x00,  /* ........ */
+	/*0327:*/	0x00,  /* ........ */
+	/*0328:*/	0x00,  /* ........ */
+	/*0329:*/	0x00,  /* ........ */
+	/*032a:*/	0x00,  /* ........ */
+	/*032b:*/	0x00,  /* ........ */
+	/*032c:*/	0x00,  /* ........ */
+	/*032d:*/	0x00,  /* ........ */
+	/*032e:*/	0xc0,  /* ##...... */
+	/*032f:*/	0xc0,  /* ##...... */
+	/*0330:*/	0xc0,  /* ##...... */
+	/*0331:*/	0x40,  /* .#...... */
+	/*0332:*/	0x40,  /* .#...... */
+	/*0333:*/	0x80,  /* #....... */
+/* --- new character less (60) starting at offset 0x0334 --- */
+	/*0334:*/	15, 12, 12, 1, 1, /* width and bbox (w,h,x,y) */ 
+	/*0339:*/	0x00,0x30,  /* ..........##.... */
+	/*033b:*/	0x00,0xf0,  /* ........####.... */
+	/*033d:*/	0x03,0xc0,  /* ......####...... */
+	/*033f:*/	0x0f,0x00,  /* ....####........ */
+	/*0341:*/	0x3c,0x00,  /* ..####.......... */
+	/*0343:*/	0xe0,0x00,  /* ###............. */
+	/*0345:*/	0xe0,0x00,  /* ###............. */
+	/*0347:*/	0x3c,0x00,  /* ..####.......... */
+	/*0349:*/	0x0f,0x00,  /* ....####........ */
+	/*034b:*/	0x03,0xc0,  /* ......####...... */
+	/*034d:*/	0x00,0xf0,  /* ........####.... */
+	/*034f:*/	0x00,0x30,  /* ..........##.... */
+/* --- new character equal (61) starting at offset 0x0351 --- */
+	/*0351:*/	15, 10, 6, 2, 5, /* width and bbox (w,h,x,y) */ 
+	/*0356:*/	0xff,0xc0,  /* ##########...... */
+	/*0358:*/	0xff,0xc0,  /* ##########...... */
+	/*035a:*/	0x00,0x00,  /* ................ */
+	/*035c:*/	0x00,0x00,  /* ................ */
+	/*035e:*/	0xff,0xc0,  /* ##########...... */
+	/*0360:*/	0xff,0xc0,  /* ##########...... */
+/* --- new character greater (62) starting at offset 0x0362 --- */
+	/*0362:*/	15, 12, 12, 1, 1, /* width and bbox (w,h,x,y) */ 
+	/*0367:*/	0xc0,0x00,  /* ##.............. */
+	/*0369:*/	0xf0,0x00,  /* ####............ */
+	/*036b:*/	0x3c,0x00,  /* ..####.......... */
+	/*036d:*/	0x0f,0x00,  /* ....####........ */
+	/*036f:*/	0x03,0xc0,  /* ......####...... */
+	/*0371:*/	0x00,0x70,  /* .........###.... */
+	/*0373:*/	0x00,0x70,  /* .........###.... */
+	/*0375:*/	0x03,0xc0,  /* ......####...... */
+	/*0377:*/	0x0f,0x00,  /* ....####........ */
+	/*0379:*/	0x3c,0x00,  /* ..####.......... */
+	/*037b:*/	0xf0,0x00,  /* ####............ */
+	/*037d:*/	0xc0,0x00,  /* ##.............. */
+/* --- new character question (63) starting at offset 0x037f --- */
+	/*037f:*/	12, 10, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0384:*/	0x1f,0x00,  /* ...#####........ */
+	/*0386:*/	0x7f,0x80,  /* .########....... */
+	/*0388:*/	0x71,0xc0,  /* .###...###...... */
+	/*038a:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*038c:*/	0xc0,0xc0,  /* ##......##...... */
+	/*038e:*/	0xc1,0xc0,  /* ##.....###...... */
+	/*0390:*/	0x01,0x80,  /* .......##....... */
+	/*0392:*/	0x03,0x80,  /* ......###....... */
+	/*0394:*/	0x07,0x00,  /* .....###........ */
+	/*0396:*/	0x06,0x00,  /* .....##......... */
+	/*0398:*/	0x0c,0x00,  /* ....##.......... */
+	/*039a:*/	0x0c,0x00,  /* ....##.......... */
+	/*039c:*/	0x0c,0x00,  /* ....##.......... */
+	/*039e:*/	0x0c,0x00,  /* ....##.......... */
+	/*03a0:*/	0x00,0x00,  /* ................ */
+	/*03a2:*/	0x00,0x00,  /* ................ */
+	/*03a4:*/	0x0c,0x00,  /* ....##.......... */
+	/*03a6:*/	0x0c,0x00,  /* ....##.......... */
+	/*03a8:*/	0x0c,0x00,  /* ....##.......... */
+/* --- new character at (64) starting at offset 0x03aa --- */
+	/*03aa:*/	25, 22, 23, 2, -4, /* width and bbox (w,h,x,y) */ 
+	/*03af:*/	0x00,0xff,0x00,  /* ........########........ */
+	/*03b2:*/	0x03,0xff,0xc0,  /* ......############...... */
+	/*03b5:*/	0x0f,0x01,0xe0,  /* ....####.......####..... */
+	/*03b8:*/	0x1c,0x00,0x70,  /* ...###...........###.... */
+	/*03bb:*/	0x38,0x00,0x18,  /* ..###..............##... */
+	/*03be:*/	0x30,0x00,0x18,  /* ..##...............##... */
+	/*03c1:*/	0x60,0x73,0x0c,  /* .##......###..##....##.. */
+	/*03c4:*/	0x60,0xfb,0x0c,  /* .##.....#####.##....##.. */
+	/*03c7:*/	0xc1,0xc7,0x0c,  /* ##.....###...###....##.. */
+	/*03ca:*/	0xc3,0x86,0x0c,  /* ##....###....##.....##.. */
+	/*03cd:*/	0xc3,0x06,0x0c,  /* ##....##.....##.....##.. */
+	/*03d0:*/	0xc6,0x06,0x0c,  /* ##...##......##.....##.. */
+	/*03d3:*/	0xc6,0x0c,0x1c,  /* ##...##.....##.....###.. */
+	/*03d6:*/	0xc6,0x0c,0x18,  /* ##...##.....##.....##... */
+	/*03d9:*/	0xc6,0x0c,0x38,  /* ##...##.....##....###... */
+	/*03dc:*/	0xe7,0x1c,0x70,  /* ###..###...###...###.... */
+	/*03df:*/	0x63,0xf7,0xe0,  /* .##...######.######..... */
+	/*03e2:*/	0x71,0xe3,0x80,  /* .###...####...###....... */
+	/*03e5:*/	0x38,0x00,0x00,  /* ..###................... */
+	/*03e8:*/	0x1c,0x00,0x00,  /* ...###.................. */
+	/*03eb:*/	0x0f,0x03,0x00,  /* ....####......##........ */
+	/*03ee:*/	0x07,0xff,0x00,  /* .....###########........ */
+	/*03f1:*/	0x00,0xfc,0x00,  /* ........######.......... */
+/* --- new character A (65) starting at offset 0x03f4 --- */
+	/*03f4:*/	17, 15, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*03f9:*/	0x03,0x80,  /* ......###....... */
+	/*03fb:*/	0x03,0x80,  /* ......###....... */
+	/*03fd:*/	0x06,0xc0,  /* .....##.##...... */
+	/*03ff:*/	0x06,0xc0,  /* .....##.##...... */
+	/*0401:*/	0x0c,0x40,  /* ....##...#...... */
+	/*0403:*/	0x0c,0x60,  /* ....##...##..... */
+	/*0405:*/	0x0c,0x60,  /* ....##...##..... */
+	/*0407:*/	0x18,0x30,  /* ...##.....##.... */
+	/*0409:*/	0x18,0x30,  /* ...##.....##.... */
+	/*040b:*/	0x18,0x30,  /* ...##.....##.... */
+	/*040d:*/	0x30,0x18,  /* ..##.......##... */
+	/*040f:*/	0x3f,0xf8,  /* ..###########... */
+	/*0411:*/	0x3f,0xf8,  /* ..###########... */
+	/*0413:*/	0x60,0x0c,  /* .##.........##.. */
+	/*0415:*/	0x60,0x0c,  /* .##.........##.. */
+	/*0417:*/	0x60,0x0c,  /* .##.........##.. */
+	/*0419:*/	0xc0,0x06,  /* ##...........##. */
+	/*041b:*/	0xc0,0x06,  /* ##...........##. */
+	/*041d:*/	0xc0,0x06,  /* ##...........##. */
+/* --- new character B (66) starting at offset 0x041f --- */
+	/*041f:*/	17, 14, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0424:*/	0xff,0xc0,  /* ##########...... */
+	/*0426:*/	0xff,0xf0,  /* ############.... */
+	/*0428:*/	0xc0,0x70,  /* ##.......###.... */
+	/*042a:*/	0xc0,0x18,  /* ##.........##... */
+	/*042c:*/	0xc0,0x18,  /* ##.........##... */
+	/*042e:*/	0xc0,0x18,  /* ##.........##... */
+	/*0430:*/	0xc0,0x18,  /* ##.........##... */
+	/*0432:*/	0xc0,0x30,  /* ##........##.... */
+	/*0434:*/	0xff,0xe0,  /* ###########..... */
+	/*0436:*/	0xff,0xf0,  /* ############.... */
+	/*0438:*/	0xc0,0x18,  /* ##.........##... */
+	/*043a:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*043c:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*043e:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0440:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0442:*/	0xc0,0x1c,  /* ##.........###.. */
+	/*0444:*/	0xc0,0x38,  /* ##........###... */
+	/*0446:*/	0xff,0xf0,  /* ############.... */
+	/*0448:*/	0xff,0xc0,  /* ##########...... */
+/* --- new character C (67) starting at offset 0x044a --- */
+	/*044a:*/	18, 16, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*044f:*/	0x07,0xe0,  /* .....######..... */
+	/*0451:*/	0x1f,0xf8,  /* ...##########... */
+	/*0453:*/	0x3c,0x3c,  /* ..####....####.. */
+	/*0455:*/	0x70,0x0e,  /* .###........###. */
+	/*0457:*/	0x60,0x06,  /* .##..........##. */
+	/*0459:*/	0xe0,0x06,  /* ###..........##. */
+	/*045b:*/	0xc0,0x00,  /* ##.............. */
+	/*045d:*/	0xc0,0x00,  /* ##.............. */
+	/*045f:*/	0xc0,0x00,  /* ##.............. */
+	/*0461:*/	0xc0,0x00,  /* ##.............. */
+	/*0463:*/	0xc0,0x00,  /* ##.............. */
+	/*0465:*/	0xc0,0x00,  /* ##.............. */
+	/*0467:*/	0xc0,0x03,  /* ##............## */
+	/*0469:*/	0xe0,0x03,  /* ###...........## */
+	/*046b:*/	0x60,0x06,  /* .##..........##. */
+	/*046d:*/	0x70,0x0e,  /* .###........###. */
+	/*046f:*/	0x3c,0x3c,  /* ..####....####.. */
+	/*0471:*/	0x1f,0xf8,  /* ...##########... */
+	/*0473:*/	0x07,0xe0,  /* .....######..... */
+/* --- new character D (68) starting at offset 0x0475 --- */
+	/*0475:*/	18, 15, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*047a:*/	0xff,0xc0,  /* ##########...... */
+	/*047c:*/	0xff,0xf0,  /* ############.... */
+	/*047e:*/	0xc0,0x78,  /* ##.......####... */
+	/*0480:*/	0xc0,0x1c,  /* ##.........###.. */
+	/*0482:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0484:*/	0xc0,0x0e,  /* ##..........###. */
+	/*0486:*/	0xc0,0x06,  /* ##...........##. */
+	/*0488:*/	0xc0,0x06,  /* ##...........##. */
+	/*048a:*/	0xc0,0x06,  /* ##...........##. */
+	/*048c:*/	0xc0,0x06,  /* ##...........##. */
+	/*048e:*/	0xc0,0x06,  /* ##...........##. */
+	/*0490:*/	0xc0,0x06,  /* ##...........##. */
+	/*0492:*/	0xc0,0x06,  /* ##...........##. */
+	/*0494:*/	0xc0,0x0e,  /* ##..........###. */
+	/*0496:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0498:*/	0xc0,0x1c,  /* ##.........###.. */
+	/*049a:*/	0xc0,0x78,  /* ##.......####... */
+	/*049c:*/	0xff,0xf0,  /* ############.... */
+	/*049e:*/	0xff,0xc0,  /* ##########...... */
+/* --- new character E (69) starting at offset 0x04a0 --- */
+	/*04a0:*/	16, 12, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*04a5:*/	0xff,0xf0,  /* ############.... */
+	/*04a7:*/	0xff,0xf0,  /* ############.... */
+	/*04a9:*/	0xc0,0x00,  /* ##.............. */
+	/*04ab:*/	0xc0,0x00,  /* ##.............. */
+	/*04ad:*/	0xc0,0x00,  /* ##.............. */
+	/*04af:*/	0xc0,0x00,  /* ##.............. */
+	/*04b1:*/	0xc0,0x00,  /* ##.............. */
+	/*04b3:*/	0xc0,0x00,  /* ##.............. */
+	/*04b5:*/	0xff,0xe0,  /* ###########..... */
+	/*04b7:*/	0xff,0xe0,  /* ###########..... */
+	/*04b9:*/	0xc0,0x00,  /* ##.............. */
+	/*04bb:*/	0xc0,0x00,  /* ##.............. */
+	/*04bd:*/	0xc0,0x00,  /* ##.............. */
+	/*04bf:*/	0xc0,0x00,  /* ##.............. */
+	/*04c1:*/	0xc0,0x00,  /* ##.............. */
+	/*04c3:*/	0xc0,0x00,  /* ##.............. */
+	/*04c5:*/	0xc0,0x00,  /* ##.............. */
+	/*04c7:*/	0xff,0xf0,  /* ############.... */
+	/*04c9:*/	0xff,0xf0,  /* ############.... */
+/* --- new character F (70) starting at offset 0x04cb --- */
+	/*04cb:*/	14, 11, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*04d0:*/	0xff,0xe0,  /* ###########..... */
+	/*04d2:*/	0xff,0xe0,  /* ###########..... */
+	/*04d4:*/	0xc0,0x00,  /* ##.............. */
+	/*04d6:*/	0xc0,0x00,  /* ##.............. */
+	/*04d8:*/	0xc0,0x00,  /* ##.............. */
+	/*04da:*/	0xc0,0x00,  /* ##.............. */
+	/*04dc:*/	0xc0,0x00,  /* ##.............. */
+	/*04de:*/	0xc0,0x00,  /* ##.............. */
+	/*04e0:*/	0xc0,0x00,  /* ##.............. */
+	/*04e2:*/	0xff,0xc0,  /* ##########...... */
+	/*04e4:*/	0xff,0xc0,  /* ##########...... */
+	/*04e6:*/	0xc0,0x00,  /* ##.............. */
+	/*04e8:*/	0xc0,0x00,  /* ##.............. */
+	/*04ea:*/	0xc0,0x00,  /* ##.............. */
+	/*04ec:*/	0xc0,0x00,  /* ##.............. */
+	/*04ee:*/	0xc0,0x00,  /* ##.............. */
+	/*04f0:*/	0xc0,0x00,  /* ##.............. */
+	/*04f2:*/	0xc0,0x00,  /* ##.............. */
+	/*04f4:*/	0xc0,0x00,  /* ##.............. */
+/* --- new character G (71) starting at offset 0x04f6 --- */
+	/*04f6:*/	19, 16, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*04fb:*/	0x07,0xe0,  /* .....######..... */
+	/*04fd:*/	0x1f,0xf8,  /* ...##########... */
+	/*04ff:*/	0x3c,0x3c,  /* ..####....####.. */
+	/*0501:*/	0x70,0x0e,  /* .###........###. */
+	/*0503:*/	0x60,0x06,  /* .##..........##. */
+	/*0505:*/	0xe0,0x06,  /* ###..........##. */
+	/*0507:*/	0xc0,0x00,  /* ##.............. */
+	/*0509:*/	0xc0,0x00,  /* ##.............. */
+	/*050b:*/	0xc0,0x00,  /* ##.............. */
+	/*050d:*/	0xc0,0x7f,  /* ##.......####### */
+	/*050f:*/	0xc0,0x7f,  /* ##.......####### */
+	/*0511:*/	0xc0,0x03,  /* ##............## */
+	/*0513:*/	0xc0,0x03,  /* ##............## */
+	/*0515:*/	0xe0,0x03,  /* ###...........## */
+	/*0517:*/	0x60,0x07,  /* .##..........### */
+	/*0519:*/	0x70,0x0f,  /* .###........#### */
+	/*051b:*/	0x3c,0x3f,  /* ..####....###### */
+	/*051d:*/	0x1f,0xfb,  /* ...##########.## */
+	/*051f:*/	0x07,0xe3,  /* .....######...## */
+/* --- new character H (72) starting at offset 0x0521 --- */
+	/*0521:*/	18, 14, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0526:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0528:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*052a:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*052c:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*052e:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0530:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0532:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0534:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0536:*/	0xff,0xfc,  /* ##############.. */
+	/*0538:*/	0xff,0xfc,  /* ##############.. */
+	/*053a:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*053c:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*053e:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0540:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0542:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0544:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0546:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0548:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*054a:*/	0xc0,0x0c,  /* ##..........##.. */
+/* --- new character I (73) starting at offset 0x054c --- */
+	/*054c:*/	8, 2, 19, 3, 0, /* width and bbox (w,h,x,y) */ 
+	/*0551:*/	0xc0,  /* ##...... */
+	/*0552:*/	0xc0,  /* ##...... */
+	/*0553:*/	0xc0,  /* ##...... */
+	/*0554:*/	0xc0,  /* ##...... */
+	/*0555:*/	0xc0,  /* ##...... */
+	/*0556:*/	0xc0,  /* ##...... */
+	/*0557:*/	0xc0,  /* ##...... */
+	/*0558:*/	0xc0,  /* ##...... */
+	/*0559:*/	0xc0,  /* ##...... */
+	/*055a:*/	0xc0,  /* ##...... */
+	/*055b:*/	0xc0,  /* ##...... */
+	/*055c:*/	0xc0,  /* ##...... */
+	/*055d:*/	0xc0,  /* ##...... */
+	/*055e:*/	0xc0,  /* ##...... */
+	/*055f:*/	0xc0,  /* ##...... */
+	/*0560:*/	0xc0,  /* ##...... */
+	/*0561:*/	0xc0,  /* ##...... */
+	/*0562:*/	0xc0,  /* ##...... */
+	/*0563:*/	0xc0,  /* ##...... */
+/* --- new character J (74) starting at offset 0x0564 --- */
+	/*0564:*/	13, 10, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0569:*/	0x00,0xc0,  /* ........##...... */
+	/*056b:*/	0x00,0xc0,  /* ........##...... */
+	/*056d:*/	0x00,0xc0,  /* ........##...... */
+	/*056f:*/	0x00,0xc0,  /* ........##...... */
+	/*0571:*/	0x00,0xc0,  /* ........##...... */
+	/*0573:*/	0x00,0xc0,  /* ........##...... */
+	/*0575:*/	0x00,0xc0,  /* ........##...... */
+	/*0577:*/	0x00,0xc0,  /* ........##...... */
+	/*0579:*/	0x00,0xc0,  /* ........##...... */
+	/*057b:*/	0x00,0xc0,  /* ........##...... */
+	/*057d:*/	0x00,0xc0,  /* ........##...... */
+	/*057f:*/	0x00,0xc0,  /* ........##...... */
+	/*0581:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0583:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0585:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0587:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0589:*/	0x61,0x80,  /* .##....##....... */
+	/*058b:*/	0x7f,0x80,  /* .########....... */
+	/*058d:*/	0x3f,0x00,  /* ..######........ */
+/* --- new character K (75) starting at offset 0x058f --- */
+	/*058f:*/	18, 15, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0594:*/	0xc0,0x38,  /* ##........###... */
+	/*0596:*/	0xc0,0x70,  /* ##.......###.... */
+	/*0598:*/	0xc0,0xe0,  /* ##......###..... */
+	/*059a:*/	0xc1,0xc0,  /* ##.....###...... */
+	/*059c:*/	0xc3,0x80,  /* ##....###....... */
+	/*059e:*/	0xc7,0x00,  /* ##...###........ */
+	/*05a0:*/	0xce,0x00,  /* ##..###......... */
+	/*05a2:*/	0xdc,0x00,  /* ##.###.......... */
+	/*05a4:*/	0xfc,0x00,  /* ######.......... */
+	/*05a6:*/	0xfe,0x00,  /* #######......... */
+	/*05a8:*/	0xe7,0x00,  /* ###..###........ */
+	/*05aa:*/	0xc3,0x80,  /* ##....###....... */
+	/*05ac:*/	0xc1,0xc0,  /* ##.....###...... */
+	/*05ae:*/	0xc0,0xe0,  /* ##......###..... */
+	/*05b0:*/	0xc0,0x70,  /* ##.......###.... */
+	/*05b2:*/	0xc0,0x38,  /* ##........###... */
+	/*05b4:*/	0xc0,0x1c,  /* ##.........###.. */
+	/*05b6:*/	0xc0,0x0e,  /* ##..........###. */
+	/*05b8:*/	0xc0,0x06,  /* ##...........##. */
+/* --- new character L (76) starting at offset 0x05ba --- */
+	/*05ba:*/	14, 11, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*05bf:*/	0xc0,0x00,  /* ##.............. */
+	/*05c1:*/	0xc0,0x00,  /* ##.............. */
+	/*05c3:*/	0xc0,0x00,  /* ##.............. */
+	/*05c5:*/	0xc0,0x00,  /* ##.............. */
+	/*05c7:*/	0xc0,0x00,  /* ##.............. */
+	/*05c9:*/	0xc0,0x00,  /* ##.............. */
+	/*05cb:*/	0xc0,0x00,  /* ##.............. */
+	/*05cd:*/	0xc0,0x00,  /* ##.............. */
+	/*05cf:*/	0xc0,0x00,  /* ##.............. */
+	/*05d1:*/	0xc0,0x00,  /* ##.............. */
+	/*05d3:*/	0xc0,0x00,  /* ##.............. */
+	/*05d5:*/	0xc0,0x00,  /* ##.............. */
+	/*05d7:*/	0xc0,0x00,  /* ##.............. */
+	/*05d9:*/	0xc0,0x00,  /* ##.............. */
+	/*05db:*/	0xc0,0x00,  /* ##.............. */
+	/*05dd:*/	0xc0,0x00,  /* ##.............. */
+	/*05df:*/	0xc0,0x00,  /* ##.............. */
+	/*05e1:*/	0xff,0xe0,  /* ###########..... */
+	/*05e3:*/	0xff,0xe0,  /* ###########..... */
+/* --- new character M (77) starting at offset 0x05e5 --- */
+	/*05e5:*/	21, 17, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*05ea:*/	0xc0,0x01,0x80,  /* ##.............##....... */
+	/*05ed:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*05f0:*/	0xe0,0x03,0x80,  /* ###...........###....... */
+	/*05f3:*/	0xf0,0x07,0x80,  /* ####.........####....... */
+	/*05f6:*/	0xf0,0x07,0x80,  /* ####.........####....... */
+	/*05f9:*/	0xd8,0x0d,0x80,  /* ##.##.......##.##....... */
+	/*05fc:*/	0xd8,0x0d,0x80,  /* ##.##.......##.##....... */
+	/*05ff:*/	0xd8,0x0d,0x80,  /* ##.##.......##.##....... */
+	/*0602:*/	0xcc,0x19,0x80,  /* ##..##.....##..##....... */
+	/*0605:*/	0xcc,0x19,0x80,  /* ##..##.....##..##....... */
+	/*0608:*/	0xcc,0x19,0x80,  /* ##..##.....##..##....... */
+	/*060b:*/	0xc6,0x31,0x80,  /* ##...##...##...##....... */
+	/*060e:*/	0xc6,0x31,0x80,  /* ##...##...##...##....... */
+	/*0611:*/	0xc6,0x31,0x80,  /* ##...##...##...##....... */
+	/*0614:*/	0xc3,0x61,0x80,  /* ##....##.##....##....... */
+	/*0617:*/	0xc3,0x61,0x80,  /* ##....##.##....##....... */
+	/*061a:*/	0xc3,0x61,0x80,  /* ##....##.##....##....... */
+	/*061d:*/	0xc1,0xc1,0x80,  /* ##.....###.....##....... */
+	/*0620:*/	0xc1,0xc1,0x80,  /* ##.....###.....##....... */
+/* --- new character N (78) starting at offset 0x0623 --- */
+	/*0623:*/	18, 14, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0628:*/	0xe0,0x0c,  /* ###.........##.. */
+	/*062a:*/	0xf0,0x0c,  /* ####........##.. */
+	/*062c:*/	0xf0,0x0c,  /* ####........##.. */
+	/*062e:*/	0xd8,0x0c,  /* ##.##.......##.. */
+	/*0630:*/	0xdc,0x0c,  /* ##.###......##.. */
+	/*0632:*/	0xcc,0x0c,  /* ##..##......##.. */
+	/*0634:*/	0xce,0x0c,  /* ##..###.....##.. */
+	/*0636:*/	0xc6,0x0c,  /* ##...##.....##.. */
+	/*0638:*/	0xc7,0x0c,  /* ##...###....##.. */
+	/*063a:*/	0xc3,0x0c,  /* ##....##....##.. */
+	/*063c:*/	0xc3,0x8c,  /* ##....###...##.. */
+	/*063e:*/	0xc1,0x8c,  /* ##.....##...##.. */
+	/*0640:*/	0xc1,0xcc,  /* ##.....###..##.. */
+	/*0642:*/	0xc0,0xcc,  /* ##......##..##.. */
+	/*0644:*/	0xc0,0xec,  /* ##......###.##.. */
+	/*0646:*/	0xc0,0x6c,  /* ##.......##.##.. */
+	/*0648:*/	0xc0,0x3c,  /* ##........####.. */
+	/*064a:*/	0xc0,0x3c,  /* ##........####.. */
+	/*064c:*/	0xc0,0x1c,  /* ##.........###.. */
+/* --- new character O (79) starting at offset 0x064e --- */
+	/*064e:*/	18, 16, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0653:*/	0x07,0xe0,  /* .....######..... */
+	/*0655:*/	0x1f,0xf8,  /* ...##########... */
+	/*0657:*/	0x3c,0x3c,  /* ..####....####.. */
+	/*0659:*/	0x70,0x0e,  /* .###........###. */
+	/*065b:*/	0x60,0x06,  /* .##..........##. */
+	/*065d:*/	0xe0,0x07,  /* ###..........### */
+	/*065f:*/	0xc0,0x03,  /* ##............## */
+	/*0661:*/	0xc0,0x03,  /* ##............## */
+	/*0663:*/	0xc0,0x03,  /* ##............## */
+	/*0665:*/	0xc0,0x03,  /* ##............## */
+	/*0667:*/	0xc0,0x03,  /* ##............## */
+	/*0669:*/	0xc0,0x03,  /* ##............## */
+	/*066b:*/	0xc0,0x03,  /* ##............## */
+	/*066d:*/	0xe0,0x07,  /* ###..........### */
+	/*066f:*/	0x60,0x06,  /* .##..........##. */
+	/*0671:*/	0x70,0x0e,  /* .###........###. */
+	/*0673:*/	0x3c,0x3c,  /* ..####....####.. */
+	/*0675:*/	0x1f,0xf8,  /* ...##########... */
+	/*0677:*/	0x07,0xe0,  /* .....######..... */
+/* --- new character P (80) starting at offset 0x0679 --- */
+	/*0679:*/	16, 13, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*067e:*/	0xff,0xe0,  /* ###########..... */
+	/*0680:*/	0xff,0xf0,  /* ############.... */
+	/*0682:*/	0xc0,0x30,  /* ##........##.... */
+	/*0684:*/	0xc0,0x18,  /* ##.........##... */
+	/*0686:*/	0xc0,0x18,  /* ##.........##... */
+	/*0688:*/	0xc0,0x18,  /* ##.........##... */
+	/*068a:*/	0xc0,0x18,  /* ##.........##... */
+	/*068c:*/	0xc0,0x30,  /* ##........##.... */
+	/*068e:*/	0xff,0xf0,  /* ############.... */
+	/*0690:*/	0xff,0xe0,  /* ###########..... */
+	/*0692:*/	0xc0,0x00,  /* ##.............. */
+	/*0694:*/	0xc0,0x00,  /* ##.............. */
+	/*0696:*/	0xc0,0x00,  /* ##.............. */
+	/*0698:*/	0xc0,0x00,  /* ##.............. */
+	/*069a:*/	0xc0,0x00,  /* ##.............. */
+	/*069c:*/	0xc0,0x00,  /* ##.............. */
+	/*069e:*/	0xc0,0x00,  /* ##.............. */
+	/*06a0:*/	0xc0,0x00,  /* ##.............. */
+	/*06a2:*/	0xc0,0x00,  /* ##.............. */
+/* --- new character Q (81) starting at offset 0x06a4 --- */
+	/*06a4:*/	18, 16, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*06a9:*/	0x07,0xe0,  /* .....######..... */
+	/*06ab:*/	0x1f,0xf8,  /* ...##########... */
+	/*06ad:*/	0x3c,0x3c,  /* ..####....####.. */
+	/*06af:*/	0x70,0x0e,  /* .###........###. */
+	/*06b1:*/	0x60,0x06,  /* .##..........##. */
+	/*06b3:*/	0xe0,0x07,  /* ###..........### */
+	/*06b5:*/	0xc0,0x03,  /* ##............## */
+	/*06b7:*/	0xc0,0x03,  /* ##............## */
+	/*06b9:*/	0xc0,0x03,  /* ##............## */
+	/*06bb:*/	0xc0,0x03,  /* ##............## */
+	/*06bd:*/	0xc0,0x03,  /* ##............## */
+	/*06bf:*/	0xc0,0x03,  /* ##............## */
+	/*06c1:*/	0xc0,0x03,  /* ##............## */
+	/*06c3:*/	0xe0,0x07,  /* ###..........### */
+	/*06c5:*/	0x60,0xe6,  /* .##.....###..##. */
+	/*06c7:*/	0x70,0x7e,  /* .###.....######. */
+	/*06c9:*/	0x3c,0x1c,  /* ..####.....###.. */
+	/*06cb:*/	0x1f,0xfe,  /* ...############. */
+	/*06cd:*/	0x07,0xe7,  /* .....######..### */
+/* --- new character R (82) starting at offset 0x06cf --- */
+	/*06cf:*/	17, 13, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*06d4:*/	0xff,0xe0,  /* ###########..... */
+	/*06d6:*/	0xff,0xf0,  /* ############.... */
+	/*06d8:*/	0xc0,0x30,  /* ##........##.... */
+	/*06da:*/	0xc0,0x18,  /* ##.........##... */
+	/*06dc:*/	0xc0,0x18,  /* ##.........##... */
+	/*06de:*/	0xc0,0x18,  /* ##.........##... */
+	/*06e0:*/	0xc0,0x18,  /* ##.........##... */
+	/*06e2:*/	0xc0,0x30,  /* ##........##.... */
+	/*06e4:*/	0xff,0xf0,  /* ############.... */
+	/*06e6:*/	0xff,0xe0,  /* ###########..... */
+	/*06e8:*/	0xc0,0x70,  /* ##.......###.... */
+	/*06ea:*/	0xc0,0x30,  /* ##........##.... */
+	/*06ec:*/	0xc0,0x18,  /* ##.........##... */
+	/*06ee:*/	0xc0,0x18,  /* ##.........##... */
+	/*06f0:*/	0xc0,0x18,  /* ##.........##... */
+	/*06f2:*/	0xc0,0x18,  /* ##.........##... */
+	/*06f4:*/	0xc0,0x18,  /* ##.........##... */
+	/*06f6:*/	0xc0,0x18,  /* ##.........##... */
+	/*06f8:*/	0xc0,0x18,  /* ##.........##... */
+/* --- new character S (83) starting at offset 0x06fa --- */
+	/*06fa:*/	16, 14, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*06ff:*/	0x07,0xc0,  /* .....#####...... */
+	/*0701:*/	0x1f,0xf0,  /* ...#########.... */
+	/*0703:*/	0x38,0x38,  /* ..###.....###... */
+	/*0705:*/	0x70,0x18,  /* .###.......##... */
+	/*0707:*/	0x60,0x18,  /* .##........##... */
+	/*0709:*/	0x60,0x00,  /* .##............. */
+	/*070b:*/	0x70,0x00,  /* .###............ */
+	/*070d:*/	0x3e,0x00,  /* ..#####......... */
+	/*070f:*/	0x0f,0xc0,  /* ....######...... */
+	/*0711:*/	0x01,0xf0,  /* .......#####.... */
+	/*0713:*/	0x00,0x78,  /* .........####... */
+	/*0715:*/	0x00,0x1c,  /* ...........###.. */
+	/*0717:*/	0x00,0x0c,  /* ............##.. */
+	/*0719:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*071b:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*071d:*/	0xe0,0x1c,  /* ###........###.. */
+	/*071f:*/	0x78,0x38,  /* .####.....###... */
+	/*0721:*/	0x3f,0xf0,  /* ..##########.... */
+	/*0723:*/	0x0f,0xc0,  /* ....######...... */
+/* --- new character T (84) starting at offset 0x0725 --- */
+	/*0725:*/	16, 14, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*072a:*/	0xff,0xfc,  /* ##############.. */
+	/*072c:*/	0xff,0xfc,  /* ##############.. */
+	/*072e:*/	0x03,0x00,  /* ......##........ */
+	/*0730:*/	0x03,0x00,  /* ......##........ */
+	/*0732:*/	0x03,0x00,  /* ......##........ */
+	/*0734:*/	0x03,0x00,  /* ......##........ */
+	/*0736:*/	0x03,0x00,  /* ......##........ */
+	/*0738:*/	0x03,0x00,  /* ......##........ */
+	/*073a:*/	0x03,0x00,  /* ......##........ */
+	/*073c:*/	0x03,0x00,  /* ......##........ */
+	/*073e:*/	0x03,0x00,  /* ......##........ */
+	/*0740:*/	0x03,0x00,  /* ......##........ */
+	/*0742:*/	0x03,0x00,  /* ......##........ */
+	/*0744:*/	0x03,0x00,  /* ......##........ */
+	/*0746:*/	0x03,0x00,  /* ......##........ */
+	/*0748:*/	0x03,0x00,  /* ......##........ */
+	/*074a:*/	0x03,0x00,  /* ......##........ */
+	/*074c:*/	0x03,0x00,  /* ......##........ */
+	/*074e:*/	0x03,0x00,  /* ......##........ */
+/* --- new character U (85) starting at offset 0x0750 --- */
+	/*0750:*/	18, 14, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0755:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0757:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0759:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*075b:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*075d:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*075f:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0761:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0763:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0765:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0767:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0769:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*076b:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*076d:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*076f:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0771:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0773:*/	0x60,0x18,  /* .##........##... */
+	/*0775:*/	0x70,0x38,  /* .###......###... */
+	/*0777:*/	0x3f,0xf0,  /* ..##########.... */
+	/*0779:*/	0x0f,0xc0,  /* ....######...... */
+/* --- new character V (86) starting at offset 0x077b --- */
+	/*077b:*/	17, 15, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0780:*/	0xc0,0x06,  /* ##...........##. */
+	/*0782:*/	0xc0,0x06,  /* ##...........##. */
+	/*0784:*/	0xe0,0x0e,  /* ###.........###. */
+	/*0786:*/	0x60,0x0c,  /* .##.........##.. */
+	/*0788:*/	0x70,0x1c,  /* .###.......###.. */
+	/*078a:*/	0x30,0x18,  /* ..##.......##... */
+	/*078c:*/	0x30,0x18,  /* ..##.......##... */
+	/*078e:*/	0x38,0x38,  /* ..###.....###... */
+	/*0790:*/	0x18,0x30,  /* ...##.....##.... */
+	/*0792:*/	0x18,0x30,  /* ...##.....##.... */
+	/*0794:*/	0x1c,0x70,  /* ...###...###.... */
+	/*0796:*/	0x0c,0x60,  /* ....##...##..... */
+	/*0798:*/	0x0c,0x60,  /* ....##...##..... */
+	/*079a:*/	0x0e,0xe0,  /* ....###.###..... */
+	/*079c:*/	0x06,0xc0,  /* .....##.##...... */
+	/*079e:*/	0x06,0xc0,  /* .....##.##...... */
+	/*07a0:*/	0x03,0x80,  /* ......###....... */
+	/*07a2:*/	0x03,0x80,  /* ......###....... */
+	/*07a4:*/	0x03,0x80,  /* ......###....... */
+/* --- new character W (87) starting at offset 0x07a6 --- */
+	/*07a6:*/	22, 20, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*07ab:*/	0xc0,0x60,0x30,  /* ##.......##.......##.... */
+	/*07ae:*/	0xc0,0x60,0x30,  /* ##.......##.......##.... */
+	/*07b1:*/	0xc0,0x60,0x30,  /* ##.......##.......##.... */
+	/*07b4:*/	0xc0,0xf0,0x30,  /* ##......####......##.... */
+	/*07b7:*/	0x60,0xf0,0x60,  /* .##.....####.....##..... */
+	/*07ba:*/	0x61,0x98,0x60,  /* .##....##..##....##..... */
+	/*07bd:*/	0x61,0x98,0x60,  /* .##....##..##....##..... */
+	/*07c0:*/	0x61,0x98,0x60,  /* .##....##..##....##..... */
+	/*07c3:*/	0x61,0x98,0x60,  /* .##....##..##....##..... */
+	/*07c6:*/	0x31,0x98,0xc0,  /* ..##...##..##...##...... */
+	/*07c9:*/	0x33,0x0c,0xc0,  /* ..##..##....##..##...... */
+	/*07cc:*/	0x33,0x0c,0xc0,  /* ..##..##....##..##...... */
+	/*07cf:*/	0x33,0x0c,0xc0,  /* ..##..##....##..##...... */
+	/*07d2:*/	0x1b,0x0d,0x80,  /* ...##.##....##.##....... */
+	/*07d5:*/	0x1b,0x0d,0x80,  /* ...##.##....##.##....... */
+	/*07d8:*/	0x1e,0x07,0x80,  /* ...####......####....... */
+	/*07db:*/	0x0e,0x07,0x00,  /* ....###......###........ */
+	/*07de:*/	0x0c,0x03,0x00,  /* ....##........##........ */
+	/*07e1:*/	0x0c,0x03,0x00,  /* ....##........##........ */
+/* --- new character X (88) starting at offset 0x07e4 --- */
+	/*07e4:*/	17, 15, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*07e9:*/	0xc0,0x06,  /* ##...........##. */
+	/*07eb:*/	0xe0,0x0e,  /* ###.........###. */
+	/*07ed:*/	0x70,0x1c,  /* .###.......###.. */
+	/*07ef:*/	0x30,0x18,  /* ..##.......##... */
+	/*07f1:*/	0x18,0x30,  /* ...##.....##.... */
+	/*07f3:*/	0x1c,0x70,  /* ...###...###.... */
+	/*07f5:*/	0x0e,0xe0,  /* ....###.###..... */
+	/*07f7:*/	0x07,0xc0,  /* .....#####...... */
+	/*07f9:*/	0x03,0x80,  /* ......###....... */
+	/*07fb:*/	0x03,0x80,  /* ......###....... */
+	/*07fd:*/	0x07,0xc0,  /* .....#####...... */
+	/*07ff:*/	0x0e,0xe0,  /* ....###.###..... */
+	/*0801:*/	0x0c,0x60,  /* ....##...##..... */
+	/*0803:*/	0x1c,0x70,  /* ...###...###.... */
+	/*0805:*/	0x38,0x38,  /* ..###.....###... */
+	/*0807:*/	0x30,0x18,  /* ..##.......##... */
+	/*0809:*/	0x60,0x0c,  /* .##.........##.. */
+	/*080b:*/	0xe0,0x0e,  /* ###.........###. */
+	/*080d:*/	0xc0,0x06,  /* ##...........##. */
+/* --- new character Y (89) starting at offset 0x080f --- */
+	/*080f:*/	16, 14, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0814:*/	0xc0,0x0c,  /* ##..........##.. */
+	/*0816:*/	0xe0,0x1c,  /* ###........###.. */
+	/*0818:*/	0x60,0x18,  /* .##........##... */
+	/*081a:*/	0x70,0x38,  /* .###......###... */
+	/*081c:*/	0x30,0x30,  /* ..##......##.... */
+	/*081e:*/	0x38,0x70,  /* ..###....###.... */
+	/*0820:*/	0x18,0x60,  /* ...##....##..... */
+	/*0822:*/	0x1c,0xe0,  /* ...###..###..... */
+	/*0824:*/	0x0c,0xc0,  /* ....##..##...... */
+	/*0826:*/	0x0f,0xc0,  /* ....######...... */
+	/*0828:*/	0x07,0x80,  /* .....####....... */
+	/*082a:*/	0x07,0x80,  /* .....####....... */
+	/*082c:*/	0x03,0x00,  /* ......##........ */
+	/*082e:*/	0x03,0x00,  /* ......##........ */
+	/*0830:*/	0x03,0x00,  /* ......##........ */
+	/*0832:*/	0x03,0x00,  /* ......##........ */
+	/*0834:*/	0x03,0x00,  /* ......##........ */
+	/*0836:*/	0x03,0x00,  /* ......##........ */
+	/*0838:*/	0x03,0x00,  /* ......##........ */
+/* --- new character Z (90) starting at offset 0x083a --- */
+	/*083a:*/	15, 13, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*083f:*/	0xff,0xf8,  /* #############... */
+	/*0841:*/	0xff,0xf8,  /* #############... */
+	/*0843:*/	0x00,0x38,  /* ..........###... */
+	/*0845:*/	0x00,0x70,  /* .........###.... */
+	/*0847:*/	0x00,0xe0,  /* ........###..... */
+	/*0849:*/	0x01,0xc0,  /* .......###...... */
+	/*084b:*/	0x01,0xc0,  /* .......###...... */
+	/*084d:*/	0x03,0x80,  /* ......###....... */
+	/*084f:*/	0x07,0x00,  /* .....###........ */
+	/*0851:*/	0x07,0x00,  /* .....###........ */
+	/*0853:*/	0x0e,0x00,  /* ....###......... */
+	/*0855:*/	0x1c,0x00,  /* ...###.......... */
+	/*0857:*/	0x1c,0x00,  /* ...###.......... */
+	/*0859:*/	0x38,0x00,  /* ..###........... */
+	/*085b:*/	0x70,0x00,  /* .###............ */
+	/*085d:*/	0x70,0x00,  /* .###............ */
+	/*085f:*/	0xe0,0x00,  /* ###............. */
+	/*0861:*/	0xff,0xf8,  /* #############... */
+	/*0863:*/	0xff,0xf8,  /* #############... */
+/* --- new character bracketleft (91) starting at offset 0x0865 --- */
+	/*0865:*/	7, 4, 24, 2, -5, /* width and bbox (w,h,x,y) */ 
+	/*086a:*/	0xf0,  /* ####.... */
+	/*086b:*/	0xf0,  /* ####.... */
+	/*086c:*/	0xc0,  /* ##...... */
+	/*086d:*/	0xc0,  /* ##...... */
+	/*086e:*/	0xc0,  /* ##...... */
+	/*086f:*/	0xc0,  /* ##...... */
+	/*0870:*/	0xc0,  /* ##...... */
+	/*0871:*/	0xc0,  /* ##...... */
+	/*0872:*/	0xc0,  /* ##...... */
+	/*0873:*/	0xc0,  /* ##...... */
+	/*0874:*/	0xc0,  /* ##...... */
+	/*0875:*/	0xc0,  /* ##...... */
+	/*0876:*/	0xc0,  /* ##...... */
+	/*0877:*/	0xc0,  /* ##...... */
+	/*0878:*/	0xc0,  /* ##...... */
+	/*0879:*/	0xc0,  /* ##...... */
+	/*087a:*/	0xc0,  /* ##...... */
+	/*087b:*/	0xc0,  /* ##...... */
+	/*087c:*/	0xc0,  /* ##...... */
+	/*087d:*/	0xc0,  /* ##...... */
+	/*087e:*/	0xc0,  /* ##...... */
+	/*087f:*/	0xc0,  /* ##...... */
+	/*0880:*/	0xf0,  /* ####.... */
+	/*0881:*/	0xf0,  /* ####.... */
+/* --- new character backslash (92) starting at offset 0x0882 --- */
+	/*0882:*/	7, 7, 19, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0887:*/	0xc0,  /* ##...... */
+	/*0888:*/	0xc0,  /* ##...... */
+	/*0889:*/	0xc0,  /* ##...... */
+	/*088a:*/	0x60,  /* .##..... */
+	/*088b:*/	0x60,  /* .##..... */
+	/*088c:*/	0x60,  /* .##..... */
+	/*088d:*/	0x30,  /* ..##.... */
+	/*088e:*/	0x30,  /* ..##.... */
+	/*088f:*/	0x30,  /* ..##.... */
+	/*0890:*/	0x30,  /* ..##.... */
+	/*0891:*/	0x18,  /* ...##... */
+	/*0892:*/	0x18,  /* ...##... */
+	/*0893:*/	0x18,  /* ...##... */
+	/*0894:*/	0x0c,  /* ....##.. */
+	/*0895:*/	0x0c,  /* ....##.. */
+	/*0896:*/	0x0c,  /* ....##.. */
+	/*0897:*/	0x06,  /* .....##. */
+	/*0898:*/	0x06,  /* .....##. */
+	/*0899:*/	0x06,  /* .....##. */
+/* --- new character bracketright (93) starting at offset 0x089a --- */
+	/*089a:*/	7, 4, 24, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*089f:*/	0xf0,  /* ####.... */
+	/*08a0:*/	0xf0,  /* ####.... */
+	/*08a1:*/	0x30,  /* ..##.... */
+	/*08a2:*/	0x30,  /* ..##.... */
+	/*08a3:*/	0x30,  /* ..##.... */
+	/*08a4:*/	0x30,  /* ..##.... */
+	/*08a5:*/	0x30,  /* ..##.... */
+	/*08a6:*/	0x30,  /* ..##.... */
+	/*08a7:*/	0x30,  /* ..##.... */
+	/*08a8:*/	0x30,  /* ..##.... */
+	/*08a9:*/	0x30,  /* ..##.... */
+	/*08aa:*/	0x30,  /* ..##.... */
+	/*08ab:*/	0x30,  /* ..##.... */
+	/*08ac:*/	0x30,  /* ..##.... */
+	/*08ad:*/	0x30,  /* ..##.... */
+	/*08ae:*/	0x30,  /* ..##.... */
+	/*08af:*/	0x30,  /* ..##.... */
+	/*08b0:*/	0x30,  /* ..##.... */
+	/*08b1:*/	0x30,  /* ..##.... */
+	/*08b2:*/	0x30,  /* ..##.... */
+	/*08b3:*/	0x30,  /* ..##.... */
+	/*08b4:*/	0x30,  /* ..##.... */
+	/*08b5:*/	0xf0,  /* ####.... */
+	/*08b6:*/	0xf0,  /* ####.... */
+/* --- new character asciicircum (94) starting at offset 0x08b7 --- */
+	/*08b7:*/	12, 10, 9, 1, 10, /* width and bbox (w,h,x,y) */ 
+	/*08bc:*/	0x0c,0x00,  /* ....##.......... */
+	/*08be:*/	0x0c,0x00,  /* ....##.......... */
+	/*08c0:*/	0x1e,0x00,  /* ...####......... */
+	/*08c2:*/	0x12,0x00,  /* ...#..#......... */
+	/*08c4:*/	0x33,0x00,  /* ..##..##........ */
+	/*08c6:*/	0x61,0x80,  /* .##....##....... */
+	/*08c8:*/	0x61,0x80,  /* .##....##....... */
+	/*08ca:*/	0xc0,0xc0,  /* ##......##...... */
+	/*08cc:*/	0xc0,0xc0,  /* ##......##...... */
+/* --- new character underscore (95) starting at offset 0x08ce --- */
+	/*08ce:*/	14, 14, 2, 0, -5, /* width and bbox (w,h,x,y) */ 
+	/*08d3:*/	0xff,0xfc,  /* ##############.. */
+	/*08d5:*/	0xff,0xfc,  /* ##############.. */
+/* --- new character grave (96) starting at offset 0x08d7 --- */
+	/*08d7:*/	7, 5, 4, 1, 15, /* width and bbox (w,h,x,y) */ 
+	/*08dc:*/	0xc0,  /* ##...... */
+	/*08dd:*/	0x60,  /* .##..... */
+	/*08de:*/	0x30,  /* ..##.... */
+	/*08df:*/	0x18,  /* ...##... */
+/* --- new character a (97) starting at offset 0x08e0 --- */
+	/*08e0:*/	13, 11, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*08e5:*/	0x1f,0x00,  /* ...#####........ */
+	/*08e7:*/	0x3f,0x80,  /* ..#######....... */
+	/*08e9:*/	0x61,0xc0,  /* .##....###...... */
+	/*08eb:*/	0x60,0xc0,  /* .##.....##...... */
+	/*08ed:*/	0x00,0xc0,  /* ........##...... */
+	/*08ef:*/	0x07,0xc0,  /* .....#####...... */
+	/*08f1:*/	0x3f,0xc0,  /* ..########...... */
+	/*08f3:*/	0x78,0xc0,  /* .####...##...... */
+	/*08f5:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*08f7:*/	0xc0,0xc0,  /* ##......##...... */
+	/*08f9:*/	0xc1,0xc0,  /* ##.....###...... */
+	/*08fb:*/	0xe3,0xc0,  /* ###...####...... */
+	/*08fd:*/	0x7e,0xe0,  /* .######.###..... */
+	/*08ff:*/	0x3c,0x60,  /* ..####...##..... */
+/* --- new character b (98) starting at offset 0x0901 --- */
+	/*0901:*/	14, 11, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0906:*/	0xc0,0x00,  /* ##.............. */
+	/*0908:*/	0xc0,0x00,  /* ##.............. */
+	/*090a:*/	0xc0,0x00,  /* ##.............. */
+	/*090c:*/	0xc0,0x00,  /* ##.............. */
+	/*090e:*/	0xc0,0x00,  /* ##.............. */
+	/*0910:*/	0xcf,0x00,  /* ##..####........ */
+	/*0912:*/	0xdf,0x80,  /* ##.######....... */
+	/*0914:*/	0xf1,0xc0,  /* ####...###...... */
+	/*0916:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*0918:*/	0xc0,0x60,  /* ##.......##..... */
+	/*091a:*/	0xc0,0x60,  /* ##.......##..... */
+	/*091c:*/	0xc0,0x60,  /* ##.......##..... */
+	/*091e:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0920:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0922:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0924:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*0926:*/	0xf1,0xc0,  /* ####...###...... */
+	/*0928:*/	0xdf,0x80,  /* ##.######....... */
+	/*092a:*/	0xcf,0x00,  /* ##..####........ */
+/* --- new character c (99) starting at offset 0x092c --- */
+	/*092c:*/	12, 10, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0931:*/	0x1f,0x00,  /* ...#####........ */
+	/*0933:*/	0x3f,0x80,  /* ..#######....... */
+	/*0935:*/	0x71,0xc0,  /* .###...###...... */
+	/*0937:*/	0x60,0xc0,  /* .##.....##...... */
+	/*0939:*/	0xc0,0x00,  /* ##.............. */
+	/*093b:*/	0xc0,0x00,  /* ##.............. */
+	/*093d:*/	0xc0,0x00,  /* ##.............. */
+	/*093f:*/	0xc0,0x00,  /* ##.............. */
+	/*0941:*/	0xc0,0x00,  /* ##.............. */
+	/*0943:*/	0xc0,0x00,  /* ##.............. */
+	/*0945:*/	0x60,0xc0,  /* .##.....##...... */
+	/*0947:*/	0x71,0xc0,  /* .###...###...... */
+	/*0949:*/	0x3f,0x80,  /* ..#######....... */
+	/*094b:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character d (100) starting at offset 0x094d --- */
+	/*094d:*/	14, 11, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0952:*/	0x00,0x60,  /* .........##..... */
+	/*0954:*/	0x00,0x60,  /* .........##..... */
+	/*0956:*/	0x00,0x60,  /* .........##..... */
+	/*0958:*/	0x00,0x60,  /* .........##..... */
+	/*095a:*/	0x00,0x60,  /* .........##..... */
+	/*095c:*/	0x1e,0x60,  /* ...####..##..... */
+	/*095e:*/	0x3f,0x60,  /* ..######.##..... */
+	/*0960:*/	0x71,0xe0,  /* .###...####..... */
+	/*0962:*/	0x60,0xe0,  /* .##.....###..... */
+	/*0964:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0966:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0968:*/	0xc0,0x60,  /* ##.......##..... */
+	/*096a:*/	0xc0,0x60,  /* ##.......##..... */
+	/*096c:*/	0xc0,0x60,  /* ##.......##..... */
+	/*096e:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0970:*/	0x60,0xe0,  /* .##.....###..... */
+	/*0972:*/	0x71,0xe0,  /* .###...####..... */
+	/*0974:*/	0x3f,0x60,  /* ..######.##..... */
+	/*0976:*/	0x1e,0x60,  /* ...####..##..... */
+/* --- new character e (101) starting at offset 0x0978 --- */
+	/*0978:*/	13, 11, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*097d:*/	0x0e,0x00,  /* ....###......... */
+	/*097f:*/	0x3f,0x80,  /* ..#######....... */
+	/*0981:*/	0x71,0xc0,  /* .###...###...... */
+	/*0983:*/	0x60,0xc0,  /* .##.....##...... */
+	/*0985:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0987:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0989:*/	0xff,0xe0,  /* ###########..... */
+	/*098b:*/	0xff,0xe0,  /* ###########..... */
+	/*098d:*/	0xc0,0x00,  /* ##.............. */
+	/*098f:*/	0xc0,0x00,  /* ##.............. */
+	/*0991:*/	0x60,0x60,  /* .##......##..... */
+	/*0993:*/	0x70,0xe0,  /* .###....###..... */
+	/*0995:*/	0x3f,0xc0,  /* ..########...... */
+	/*0997:*/	0x0f,0x00,  /* ....####........ */
+/* --- new character f (102) starting at offset 0x0999 --- */
+	/*0999:*/	8, 6, 19, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*099e:*/	0x1c,  /* ...###.. */
+	/*099f:*/	0x3c,  /* ..####.. */
+	/*09a0:*/	0x30,  /* ..##.... */
+	/*09a1:*/	0x30,  /* ..##.... */
+	/*09a2:*/	0x30,  /* ..##.... */
+	/*09a3:*/	0xfc,  /* ######.. */
+	/*09a4:*/	0xfc,  /* ######.. */
+	/*09a5:*/	0x30,  /* ..##.... */
+	/*09a6:*/	0x30,  /* ..##.... */
+	/*09a7:*/	0x30,  /* ..##.... */
+	/*09a8:*/	0x30,  /* ..##.... */
+	/*09a9:*/	0x30,  /* ..##.... */
+	/*09aa:*/	0x30,  /* ..##.... */
+	/*09ab:*/	0x30,  /* ..##.... */
+	/*09ac:*/	0x30,  /* ..##.... */
+	/*09ad:*/	0x30,  /* ..##.... */
+	/*09ae:*/	0x30,  /* ..##.... */
+	/*09af:*/	0x30,  /* ..##.... */
+	/*09b0:*/	0x30,  /* ..##.... */
+/* --- new character g (103) starting at offset 0x09b1 --- */
+	/*09b1:*/	14, 11, 19, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*09b6:*/	0x1e,0x60,  /* ...####..##..... */
+	/*09b8:*/	0x3f,0x60,  /* ..######.##..... */
+	/*09ba:*/	0x71,0xe0,  /* .###...####..... */
+	/*09bc:*/	0x60,0xe0,  /* .##.....###..... */
+	/*09be:*/	0xc0,0x60,  /* ##.......##..... */
+	/*09c0:*/	0xc0,0x60,  /* ##.......##..... */
+	/*09c2:*/	0xc0,0x60,  /* ##.......##..... */
+	/*09c4:*/	0xc0,0x60,  /* ##.......##..... */
+	/*09c6:*/	0xc0,0x60,  /* ##.......##..... */
+	/*09c8:*/	0xc0,0x60,  /* ##.......##..... */
+	/*09ca:*/	0x60,0xe0,  /* .##.....###..... */
+	/*09cc:*/	0x71,0xe0,  /* .###...####..... */
+	/*09ce:*/	0x3f,0x60,  /* ..######.##..... */
+	/*09d0:*/	0x1e,0x60,  /* ...####..##..... */
+	/*09d2:*/	0x00,0x60,  /* .........##..... */
+	/*09d4:*/	0xc0,0x60,  /* ##.......##..... */
+	/*09d6:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*09d8:*/	0x7f,0xc0,  /* .#########...... */
+	/*09da:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character h (104) starting at offset 0x09dc --- */
+	/*09dc:*/	13, 10, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*09e1:*/	0xc0,0x00,  /* ##.............. */
+	/*09e3:*/	0xc0,0x00,  /* ##.............. */
+	/*09e5:*/	0xc0,0x00,  /* ##.............. */
+	/*09e7:*/	0xc0,0x00,  /* ##.............. */
+	/*09e9:*/	0xc0,0x00,  /* ##.............. */
+	/*09eb:*/	0xce,0x00,  /* ##..###......... */
+	/*09ed:*/	0xdf,0x80,  /* ##.######....... */
+	/*09ef:*/	0xf1,0x80,  /* ####...##....... */
+	/*09f1:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*09f3:*/	0xc0,0xc0,  /* ##......##...... */
+	/*09f5:*/	0xc0,0xc0,  /* ##......##...... */
+	/*09f7:*/	0xc0,0xc0,  /* ##......##...... */
+	/*09f9:*/	0xc0,0xc0,  /* ##......##...... */
+	/*09fb:*/	0xc0,0xc0,  /* ##......##...... */
+	/*09fd:*/	0xc0,0xc0,  /* ##......##...... */
+	/*09ff:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0a01:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0a03:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0a05:*/	0xc0,0xc0,  /* ##......##...... */
+/* --- new character i (105) starting at offset 0x0a07 --- */
+	/*0a07:*/	6, 2, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0a0c:*/	0xc0,  /* ##...... */
+	/*0a0d:*/	0xc0,  /* ##...... */
+	/*0a0e:*/	0xc0,  /* ##...... */
+	/*0a0f:*/	0x00,  /* ........ */
+	/*0a10:*/	0x00,  /* ........ */
+	/*0a11:*/	0xc0,  /* ##...... */
+	/*0a12:*/	0xc0,  /* ##...... */
+	/*0a13:*/	0xc0,  /* ##...... */
+	/*0a14:*/	0xc0,  /* ##...... */
+	/*0a15:*/	0xc0,  /* ##...... */
+	/*0a16:*/	0xc0,  /* ##...... */
+	/*0a17:*/	0xc0,  /* ##...... */
+	/*0a18:*/	0xc0,  /* ##...... */
+	/*0a19:*/	0xc0,  /* ##...... */
+	/*0a1a:*/	0xc0,  /* ##...... */
+	/*0a1b:*/	0xc0,  /* ##...... */
+	/*0a1c:*/	0xc0,  /* ##...... */
+	/*0a1d:*/	0xc0,  /* ##...... */
+	/*0a1e:*/	0xc0,  /* ##...... */
+/* --- new character j (106) starting at offset 0x0a1f --- */
+	/*0a1f:*/	6, 4, 24, 0, -5, /* width and bbox (w,h,x,y) */ 
+	/*0a24:*/	0x30,  /* ..##.... */
+	/*0a25:*/	0x30,  /* ..##.... */
+	/*0a26:*/	0x30,  /* ..##.... */
+	/*0a27:*/	0x00,  /* ........ */
+	/*0a28:*/	0x00,  /* ........ */
+	/*0a29:*/	0x30,  /* ..##.... */
+	/*0a2a:*/	0x30,  /* ..##.... */
+	/*0a2b:*/	0x30,  /* ..##.... */
+	/*0a2c:*/	0x30,  /* ..##.... */
+	/*0a2d:*/	0x30,  /* ..##.... */
+	/*0a2e:*/	0x30,  /* ..##.... */
+	/*0a2f:*/	0x30,  /* ..##.... */
+	/*0a30:*/	0x30,  /* ..##.... */
+	/*0a31:*/	0x30,  /* ..##.... */
+	/*0a32:*/	0x30,  /* ..##.... */
+	/*0a33:*/	0x30,  /* ..##.... */
+	/*0a34:*/	0x30,  /* ..##.... */
+	/*0a35:*/	0x30,  /* ..##.... */
+	/*0a36:*/	0x30,  /* ..##.... */
+	/*0a37:*/	0x30,  /* ..##.... */
+	/*0a38:*/	0x30,  /* ..##.... */
+	/*0a39:*/	0x30,  /* ..##.... */
+	/*0a3a:*/	0xf0,  /* ####.... */
+	/*0a3b:*/	0xe0,  /* ###..... */
+/* --- new character k (107) starting at offset 0x0a3c --- */
+	/*0a3c:*/	12, 10, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0a41:*/	0xc0,0x00,  /* ##.............. */
+	/*0a43:*/	0xc0,0x00,  /* ##.............. */
+	/*0a45:*/	0xc0,0x00,  /* ##.............. */
+	/*0a47:*/	0xc0,0x00,  /* ##.............. */
+	/*0a49:*/	0xc0,0x00,  /* ##.............. */
+	/*0a4b:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0a4d:*/	0xc3,0x80,  /* ##....###....... */
+	/*0a4f:*/	0xc7,0x00,  /* ##...###........ */
+	/*0a51:*/	0xce,0x00,  /* ##..###......... */
+	/*0a53:*/	0xdc,0x00,  /* ##.###.......... */
+	/*0a55:*/	0xf8,0x00,  /* #####........... */
+	/*0a57:*/	0xfc,0x00,  /* ######.......... */
+	/*0a59:*/	0xce,0x00,  /* ##..###......... */
+	/*0a5b:*/	0xc6,0x00,  /* ##...##......... */
+	/*0a5d:*/	0xc7,0x00,  /* ##...###........ */
+	/*0a5f:*/	0xc3,0x80,  /* ##....###....... */
+	/*0a61:*/	0xc1,0x80,  /* ##.....##....... */
+	/*0a63:*/	0xc1,0xc0,  /* ##.....###...... */
+	/*0a65:*/	0xc0,0xc0,  /* ##......##...... */
+/* --- new character l (108) starting at offset 0x0a67 --- */
+	/*0a67:*/	6, 2, 19, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0a6c:*/	0xc0,  /* ##...... */
+	/*0a6d:*/	0xc0,  /* ##...... */
+	/*0a6e:*/	0xc0,  /* ##...... */
+	/*0a6f:*/	0xc0,  /* ##...... */
+	/*0a70:*/	0xc0,  /* ##...... */
+	/*0a71:*/	0xc0,  /* ##...... */
+	/*0a72:*/	0xc0,  /* ##...... */
+	/*0a73:*/	0xc0,  /* ##...... */
+	/*0a74:*/	0xc0,  /* ##...... */
+	/*0a75:*/	0xc0,  /* ##...... */
+	/*0a76:*/	0xc0,  /* ##...... */
+	/*0a77:*/	0xc0,  /* ##...... */
+	/*0a78:*/	0xc0,  /* ##...... */
+	/*0a79:*/	0xc0,  /* ##...... */
+	/*0a7a:*/	0xc0,  /* ##...... */
+	/*0a7b:*/	0xc0,  /* ##...... */
+	/*0a7c:*/	0xc0,  /* ##...... */
+	/*0a7d:*/	0xc0,  /* ##...... */
+	/*0a7e:*/	0xc0,  /* ##...... */
+/* --- new character m (109) starting at offset 0x0a7f --- */
+	/*0a7f:*/	20, 16, 14, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0a84:*/	0xce,0x3c,  /* ##..###...####.. */
+	/*0a86:*/	0xff,0x7e,  /* ########.######. */
+	/*0a88:*/	0xe3,0xc7,  /* ###...####...### */
+	/*0a8a:*/	0xc1,0x83,  /* ##.....##.....## */
+	/*0a8c:*/	0xc1,0x83,  /* ##.....##.....## */
+	/*0a8e:*/	0xc1,0x83,  /* ##.....##.....## */
+	/*0a90:*/	0xc1,0x83,  /* ##.....##.....## */
+	/*0a92:*/	0xc1,0x83,  /* ##.....##.....## */
+	/*0a94:*/	0xc1,0x83,  /* ##.....##.....## */
+	/*0a96:*/	0xc1,0x83,  /* ##.....##.....## */
+	/*0a98:*/	0xc1,0x83,  /* ##.....##.....## */
+	/*0a9a:*/	0xc1,0x83,  /* ##.....##.....## */
+	/*0a9c:*/	0xc1,0x83,  /* ##.....##.....## */
+	/*0a9e:*/	0xc1,0x83,  /* ##.....##.....## */
+/* --- new character n (110) starting at offset 0x0aa0 --- */
+	/*0aa0:*/	14, 10, 14, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0aa5:*/	0xce,0x00,  /* ##..###......... */
+	/*0aa7:*/	0xdf,0x80,  /* ##.######....... */
+	/*0aa9:*/	0xf1,0x80,  /* ####...##....... */
+	/*0aab:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*0aad:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0aaf:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0ab1:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0ab3:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0ab5:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0ab7:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0ab9:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0abb:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0abd:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0abf:*/	0xc0,0xc0,  /* ##......##...... */
+/* --- new character o (111) starting at offset 0x0ac1 --- */
+	/*0ac1:*/	13, 11, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0ac6:*/	0x1f,0x00,  /* ...#####........ */
+	/*0ac8:*/	0x3f,0x80,  /* ..#######....... */
+	/*0aca:*/	0x71,0xc0,  /* .###...###...... */
+	/*0acc:*/	0x60,0xc0,  /* .##.....##...... */
+	/*0ace:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0ad0:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0ad2:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0ad4:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0ad6:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0ad8:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0ada:*/	0x60,0xc0,  /* .##.....##...... */
+	/*0adc:*/	0x71,0xc0,  /* .###...###...... */
+	/*0ade:*/	0x3f,0x80,  /* ..#######....... */
+	/*0ae0:*/	0x1f,0x00,  /* ...#####........ */
+/* --- new character p (112) starting at offset 0x0ae2 --- */
+	/*0ae2:*/	14, 11, 19, 2, -5, /* width and bbox (w,h,x,y) */ 
+	/*0ae7:*/	0xcf,0x00,  /* ##..####........ */
+	/*0ae9:*/	0xdf,0x80,  /* ##.######....... */
+	/*0aeb:*/	0xf1,0xc0,  /* ####...###...... */
+	/*0aed:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*0aef:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0af1:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0af3:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0af5:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0af7:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0af9:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0afb:*/	0xe0,0xc0,  /* ###.....##...... */
+	/*0afd:*/	0xf1,0xc0,  /* ####...###...... */
+	/*0aff:*/	0xdf,0x80,  /* ##.######....... */
+	/*0b01:*/	0xcf,0x00,  /* ##..####........ */
+	/*0b03:*/	0xc0,0x00,  /* ##.............. */
+	/*0b05:*/	0xc0,0x00,  /* ##.............. */
+	/*0b07:*/	0xc0,0x00,  /* ##.............. */
+	/*0b09:*/	0xc0,0x00,  /* ##.............. */
+	/*0b0b:*/	0xc0,0x00,  /* ##.............. */
+/* --- new character q (113) starting at offset 0x0b0d --- */
+	/*0b0d:*/	14, 11, 19, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*0b12:*/	0x1e,0x60,  /* ...####..##..... */
+	/*0b14:*/	0x3f,0x60,  /* ..######.##..... */
+	/*0b16:*/	0x71,0xe0,  /* .###...####..... */
+	/*0b18:*/	0x60,0xe0,  /* .##.....###..... */
+	/*0b1a:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0b1c:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0b1e:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0b20:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0b22:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0b24:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0b26:*/	0x60,0xe0,  /* .##.....###..... */
+	/*0b28:*/	0x71,0xe0,  /* .###...####..... */
+	/*0b2a:*/	0x3f,0x60,  /* ..######.##..... */
+	/*0b2c:*/	0x1e,0x60,  /* ...####..##..... */
+	/*0b2e:*/	0x00,0x60,  /* .........##..... */
+	/*0b30:*/	0x00,0x60,  /* .........##..... */
+	/*0b32:*/	0x00,0x60,  /* .........##..... */
+	/*0b34:*/	0x00,0x60,  /* .........##..... */
+	/*0b36:*/	0x00,0x60,  /* .........##..... */
+/* --- new character r (114) starting at offset 0x0b38 --- */
+	/*0b38:*/	9, 6, 14, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0b3d:*/	0xcc,  /* ##..##.. */
+	/*0b3e:*/	0xdc,  /* ##.###.. */
+	/*0b3f:*/	0xfc,  /* ######.. */
+	/*0b40:*/	0xe0,  /* ###..... */
+	/*0b41:*/	0xc0,  /* ##...... */
+	/*0b42:*/	0xc0,  /* ##...... */
+	/*0b43:*/	0xc0,  /* ##...... */
+	/*0b44:*/	0xc0,  /* ##...... */
+	/*0b45:*/	0xc0,  /* ##...... */
+	/*0b46:*/	0xc0,  /* ##...... */
+	/*0b47:*/	0xc0,  /* ##...... */
+	/*0b48:*/	0xc0,  /* ##...... */
+	/*0b49:*/	0xc0,  /* ##...... */
+	/*0b4a:*/	0xc0,  /* ##...... */
+/* --- new character s (115) starting at offset 0x0b4b --- */
+	/*0b4b:*/	12, 10, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0b50:*/	0x3e,0x00,  /* ..#####......... */
+	/*0b52:*/	0x7f,0x80,  /* .########....... */
+	/*0b54:*/	0xe1,0xc0,  /* ###....###...... */
+	/*0b56:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b58:*/	0xc0,0x00,  /* ##.............. */
+	/*0b5a:*/	0xf8,0x00,  /* #####........... */
+	/*0b5c:*/	0x7f,0x00,  /* .#######........ */
+	/*0b5e:*/	0x0f,0x80,  /* ....#####....... */
+	/*0b60:*/	0x01,0xc0,  /* .......###...... */
+	/*0b62:*/	0x00,0xc0,  /* ........##...... */
+	/*0b64:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b66:*/	0xc1,0xc0,  /* ##.....###...... */
+	/*0b68:*/	0xff,0x80,  /* #########....... */
+	/*0b6a:*/	0x3f,0x00,  /* ..######........ */
+/* --- new character t (116) starting at offset 0x0b6c --- */
+	/*0b6c:*/	8, 6, 18, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0b71:*/	0x30,  /* ..##.... */
+	/*0b72:*/	0x30,  /* ..##.... */
+	/*0b73:*/	0x30,  /* ..##.... */
+	/*0b74:*/	0x30,  /* ..##.... */
+	/*0b75:*/	0xfc,  /* ######.. */
+	/*0b76:*/	0xfc,  /* ######.. */
+	/*0b77:*/	0x30,  /* ..##.... */
+	/*0b78:*/	0x30,  /* ..##.... */
+	/*0b79:*/	0x30,  /* ..##.... */
+	/*0b7a:*/	0x30,  /* ..##.... */
+	/*0b7b:*/	0x30,  /* ..##.... */
+	/*0b7c:*/	0x30,  /* ..##.... */
+	/*0b7d:*/	0x30,  /* ..##.... */
+	/*0b7e:*/	0x30,  /* ..##.... */
+	/*0b7f:*/	0x30,  /* ..##.... */
+	/*0b80:*/	0x30,  /* ..##.... */
+	/*0b81:*/	0x3c,  /* ..####.. */
+	/*0b82:*/	0x1c,  /* ...###.. */
+/* --- new character u (117) starting at offset 0x0b83 --- */
+	/*0b83:*/	14, 10, 14, 2, 0, /* width and bbox (w,h,x,y) */ 
+	/*0b88:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b8a:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b8c:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b8e:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b90:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b92:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b94:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b96:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b98:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b9a:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0b9c:*/	0xc1,0xc0,  /* ##.....###...... */
+	/*0b9e:*/	0x63,0xc0,  /* .##...####...... */
+	/*0ba0:*/	0x7e,0xc0,  /* .######.##...... */
+	/*0ba2:*/	0x1c,0xc0,  /* ...###..##...... */
+/* --- new character v (118) starting at offset 0x0ba4 --- */
+	/*0ba4:*/	13, 11, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0ba9:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0bab:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0bad:*/	0xc0,0x60,  /* ##.......##..... */
+	/*0baf:*/	0x60,0xc0,  /* .##.....##...... */
+	/*0bb1:*/	0x60,0xc0,  /* .##.....##...... */
+	/*0bb3:*/	0x71,0xc0,  /* .###...###...... */
+	/*0bb5:*/	0x31,0x80,  /* ..##...##....... */
+	/*0bb7:*/	0x31,0x80,  /* ..##...##....... */
+	/*0bb9:*/	0x1b,0x00,  /* ...##.##........ */
+	/*0bbb:*/	0x1b,0x00,  /* ...##.##........ */
+	/*0bbd:*/	0x1b,0x00,  /* ...##.##........ */
+	/*0bbf:*/	0x0e,0x00,  /* ....###......... */
+	/*0bc1:*/	0x0e,0x00,  /* ....###......... */
+	/*0bc3:*/	0x0e,0x00,  /* ....###......... */
+/* --- new character w (119) starting at offset 0x0bc5 --- */
+	/*0bc5:*/	18, 18, 14, 0, 0, /* width and bbox (w,h,x,y) */ 
+	/*0bca:*/	0xc0,0xc0,0xc0,  /* ##......##......##...... */
+	/*0bcd:*/	0xc0,0xc0,0xc0,  /* ##......##......##...... */
+	/*0bd0:*/	0x61,0xe1,0x80,  /* .##....####....##....... */
+	/*0bd3:*/	0x61,0xe1,0x80,  /* .##....####....##....... */
+	/*0bd6:*/	0x61,0xe1,0x80,  /* .##....####....##....... */
+	/*0bd9:*/	0x31,0x23,0x00,  /* ..##...#..#...##........ */
+	/*0bdc:*/	0x33,0x33,0x00,  /* ..##..##..##..##........ */
+	/*0bdf:*/	0x33,0x33,0x00,  /* ..##..##..##..##........ */
+	/*0be2:*/	0x1b,0x36,0x00,  /* ...##.##..##.##......... */
+	/*0be5:*/	0x1a,0x16,0x00,  /* ...##.#....#.##......... */
+	/*0be8:*/	0x1e,0x1e,0x00,  /* ...####....####......... */
+	/*0beb:*/	0x0e,0x1c,0x00,  /* ....###....###.......... */
+	/*0bee:*/	0x0c,0x0c,0x00,  /* ....##......##.......... */
+	/*0bf1:*/	0x0c,0x0c,0x00,  /* ....##......##.......... */
+/* --- new character x (120) starting at offset 0x0bf4 --- */
+	/*0bf4:*/	12, 10, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0bf9:*/	0xc0,0xc0,  /* ##......##...... */
+	/*0bfb:*/	0xe1,0xc0,  /* ###....###...... */
+	/*0bfd:*/	0x61,0x80,  /* .##....##....... */
+	/*0bff:*/	0x33,0x00,  /* ..##..##........ */
+	/*0c01:*/	0x3f,0x00,  /* ..######........ */
+	/*0c03:*/	0x1e,0x00,  /* ...####......... */
+	/*0c05:*/	0x0c,0x00,  /* ....##.......... */
+	/*0c07:*/	0x1e,0x00,  /* ...####......... */
+	/*0c09:*/	0x1e,0x00,  /* ...####......... */
+	/*0c0b:*/	0x33,0x00,  /* ..##..##........ */
+	/*0c0d:*/	0x73,0x80,  /* .###..###....... */
+	/*0c0f:*/	0x61,0x80,  /* .##....##....... */
+	/*0c11:*/	0xe1,0xc0,  /* ###....###...... */
+	/*0c13:*/	0xc0,0xc0,  /* ##......##...... */
+/* --- new character y (121) starting at offset 0x0c15 --- */
+	/*0c15:*/	13, 12, 19, 0, -5, /* width and bbox (w,h,x,y) */ 
+	/*0c1a:*/	0xc0,0x30,  /* ##........##.... */
+	/*0c1c:*/	0xc0,0x30,  /* ##........##.... */
+	/*0c1e:*/	0x60,0x30,  /* .##.......##.... */
+	/*0c20:*/	0x70,0x60,  /* .###.....##..... */
+	/*0c22:*/	0x30,0x60,  /* ..##.....##..... */
+	/*0c24:*/	0x38,0xe0,  /* ..###...###..... */
+	/*0c26:*/	0x18,0xc0,  /* ...##...##...... */
+	/*0c28:*/	0x18,0xc0,  /* ...##...##...... */
+	/*0c2a:*/	0x0d,0x80,  /* ....##.##....... */
+	/*0c2c:*/	0x0d,0x80,  /* ....##.##....... */
+	/*0c2e:*/	0x07,0x80,  /* .....####....... */
+	/*0c30:*/	0x07,0x00,  /* .....###........ */
+	/*0c32:*/	0x03,0x00,  /* ......##........ */
+	/*0c34:*/	0x03,0x00,  /* ......##........ */
+	/*0c36:*/	0x06,0x00,  /* .....##......... */
+	/*0c38:*/	0x06,0x00,  /* .....##......... */
+	/*0c3a:*/	0x0c,0x00,  /* ....##.......... */
+	/*0c3c:*/	0x3c,0x00,  /* ..####.......... */
+	/*0c3e:*/	0x38,0x00,  /* ..###........... */
+/* --- new character z (122) starting at offset 0x0c40 --- */
+	/*0c40:*/	12, 10, 14, 1, 0, /* width and bbox (w,h,x,y) */ 
+	/*0c45:*/	0xff,0xc0,  /* ##########...... */
+	/*0c47:*/	0xff,0xc0,  /* ##########...... */
+	/*0c49:*/	0x01,0x80,  /* .......##....... */
+	/*0c4b:*/	0x03,0x00,  /* ......##........ */
+	/*0c4d:*/	0x07,0x00,  /* .....###........ */
+	/*0c4f:*/	0x0e,0x00,  /* ....###......... */
+	/*0c51:*/	0x0c,0x00,  /* ....##.......... */
+	/*0c53:*/	0x1c,0x00,  /* ...###.......... */
+	/*0c55:*/	0x38,0x00,  /* ..###........... */
+	/*0c57:*/	0x30,0x00,  /* ..##............ */
+	/*0c59:*/	0x60,0x00,  /* .##............. */
+	/*0c5b:*/	0xe0,0x00,  /* ###............. */
+	/*0c5d:*/	0xff,0xc0,  /* ##########...... */
+	/*0c5f:*/	0xff,0xc0,  /* ##########...... */
+/* --- new character braceleft (123) starting at offset 0x0c61 --- */
+	/*0c61:*/	8, 6, 24, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*0c66:*/	0x0c,  /* ....##.. */
+	/*0c67:*/	0x18,  /* ...##... */
+	/*0c68:*/	0x30,  /* ..##.... */
+	/*0c69:*/	0x30,  /* ..##.... */
+	/*0c6a:*/	0x30,  /* ..##.... */
+	/*0c6b:*/	0x30,  /* ..##.... */
+	/*0c6c:*/	0x30,  /* ..##.... */
+	/*0c6d:*/	0x30,  /* ..##.... */
+	/*0c6e:*/	0x30,  /* ..##.... */
+	/*0c6f:*/	0x30,  /* ..##.... */
+	/*0c70:*/	0x60,  /* .##..... */
+	/*0c71:*/	0xc0,  /* ##...... */
+	/*0c72:*/	0xc0,  /* ##...... */
+	/*0c73:*/	0x60,  /* .##..... */
+	/*0c74:*/	0x30,  /* ..##.... */
+	/*0c75:*/	0x30,  /* ..##.... */
+	/*0c76:*/	0x30,  /* ..##.... */
+	/*0c77:*/	0x30,  /* ..##.... */
+	/*0c78:*/	0x30,  /* ..##.... */
+	/*0c79:*/	0x30,  /* ..##.... */
+	/*0c7a:*/	0x30,  /* ..##.... */
+	/*0c7b:*/	0x30,  /* ..##.... */
+	/*0c7c:*/	0x18,  /* ...##... */
+	/*0c7d:*/	0x0c,  /* ....##.. */
+/* --- new character bar (124) starting at offset 0x0c7e --- */
+	/*0c7e:*/	6, 2, 24, 2, -5, /* width and bbox (w,h,x,y) */ 
+	/*0c83:*/	0xc0,  /* ##...... */
+	/*0c84:*/	0xc0,  /* ##...... */
+	/*0c85:*/	0xc0,  /* ##...... */
+	/*0c86:*/	0xc0,  /* ##...... */
+	/*0c87:*/	0xc0,  /* ##...... */
+	/*0c88:*/	0xc0,  /* ##...... */
+	/*0c89:*/	0xc0,  /* ##...... */
+	/*0c8a:*/	0xc0,  /* ##...... */
+	/*0c8b:*/	0xc0,  /* ##...... */
+	/*0c8c:*/	0xc0,  /* ##...... */
+	/*0c8d:*/	0xc0,  /* ##...... */
+	/*0c8e:*/	0xc0,  /* ##...... */
+	/*0c8f:*/	0xc0,  /* ##...... */
+	/*0c90:*/	0xc0,  /* ##...... */
+	/*0c91:*/	0xc0,  /* ##...... */
+	/*0c92:*/	0xc0,  /* ##...... */
+	/*0c93:*/	0xc0,  /* ##...... */
+	/*0c94:*/	0xc0,  /* ##...... */
+	/*0c95:*/	0xc0,  /* ##...... */
+	/*0c96:*/	0xc0,  /* ##...... */
+	/*0c97:*/	0xc0,  /* ##...... */
+	/*0c98:*/	0xc0,  /* ##...... */
+	/*0c99:*/	0xc0,  /* ##...... */
+	/*0c9a:*/	0xc0,  /* ##...... */
+/* --- new character braceright (125) starting at offset 0x0c9b --- */
+	/*0c9b:*/	8, 6, 24, 1, -5, /* width and bbox (w,h,x,y) */ 
+	/*0ca0:*/	0xc0,  /* ##...... */
+	/*0ca1:*/	0x60,  /* .##..... */
+	/*0ca2:*/	0x30,  /* ..##.... */
+	/*0ca3:*/	0x30,  /* ..##.... */
+	/*0ca4:*/	0x30,  /* ..##.... */
+	/*0ca5:*/	0x30,  /* ..##.... */
+	/*0ca6:*/	0x30,  /* ..##.... */
+	/*0ca7:*/	0x30,  /* ..##.... */
+	/*0ca8:*/	0x30,  /* ..##.... */
+	/*0ca9:*/	0x30,  /* ..##.... */
+	/*0caa:*/	0x18,  /* ...##... */
+	/*0cab:*/	0x0c,  /* ....##.. */
+	/*0cac:*/	0x0c,  /* ....##.. */
+	/*0cad:*/	0x18,  /* ...##... */
+	/*0cae:*/	0x30,  /* ..##.... */
+	/*0caf:*/	0x30,  /* ..##.... */
+	/*0cb0:*/	0x30,  /* ..##.... */
+	/*0cb1:*/	0x30,  /* ..##.... */
+	/*0cb2:*/	0x30,  /* ..##.... */
+	/*0cb3:*/	0x30,  /* ..##.... */
+	/*0cb4:*/	0x30,  /* ..##.... */
+	/*0cb5:*/	0x30,  /* ..##.... */
+	/*0cb6:*/	0x60,  /* .##..... */
+	/*0cb7:*/	0xc0,  /* ##...... */
+/* --- new character asciitilde (126) starting at offset 0x0cb8 --- */
+	/*0cb8:*/	14, 10, 4, 2, 5, /* width and bbox (w,h,x,y) */ 
+	/*0cbd:*/	0x70,0xc0,  /* .###....##...... */
+	/*0cbf:*/	0xfc,0xc0,  /* ######..##...... */
+	/*0cc1:*/	0xcf,0xc0,  /* ##..######...... */
+	/*0cc3:*/	0xc3,0x80,  /* ##....###....... */
+};
+static const uint16_t font_helvR24_offsets[] = {
+0x0000 /* space */,
+	0x0006 /* exclam */,
+	0x001e /* quotedbl */,
+	0x0029 /* numbersign */,
+	0x0050 /* dollar */,
+	0x007f /* percent */,
+	0x00ba /* ampersand */,
+	0x00e3 /* quotesingle */,
+	0x00ee /* parenleft */,
+	0x010b /* parenright */,
+	0x0128 /* asterisk */,
+	0x0134 /* plus */,
+	0x0151 /* comma */,
+	0x015c /* hyphen */,
+	0x0163 /* period */,
+	0x016b /* slash */,
+	0x0183 /* zero */,
+	0x01ac /* one */,
+	0x01c3 /* two */,
+	0x01ec /* three */,
+	0x0215 /* four */,
+	0x023e /* five */,
+	0x0267 /* six */,
+	0x0290 /* seven */,
+	0x02b9 /* eight */,
+	0x02e2 /* nine */,
+	0x030b /* colon */,
+	0x031e /* semicolon */,
+	0x0334 /* less */,
+	0x0351 /* equal */,
+	0x0362 /* greater */,
+	0x037f /* question */,
+	0x03aa /* at */,
+	0x03f4 /* A */,
+	0x041f /* B */,
+	0x044a /* C */,
+	0x0475 /* D */,
+	0x04a0 /* E */,
+	0x04cb /* F */,
+	0x04f6 /* G */,
+	0x0521 /* H */,
+	0x054c /* I */,
+	0x0564 /* J */,
+	0x058f /* K */,
+	0x05ba /* L */,
+	0x05e5 /* M */,
+	0x0623 /* N */,
+	0x064e /* O */,
+	0x0679 /* P */,
+	0x06a4 /* Q */,
+	0x06cf /* R */,
+	0x06fa /* S */,
+	0x0725 /* T */,
+	0x0750 /* U */,
+	0x077b /* V */,
+	0x07a6 /* W */,
+	0x07e4 /* X */,
+	0x080f /* Y */,
+	0x083a /* Z */,
+	0x0865 /* bracketleft */,
+	0x0882 /* backslash */,
+	0x089a /* bracketright */,
+	0x08b7 /* asciicircum */,
+	0x08ce /* underscore */,
+	0x08d7 /* grave */,
+	0x08e0 /* a */,
+	0x0901 /* b */,
+	0x092c /* c */,
+	0x094d /* d */,
+	0x0978 /* e */,
+	0x0999 /* f */,
+	0x09b1 /* g */,
+	0x09dc /* h */,
+	0x0a07 /* i */,
+	0x0a1f /* j */,
+	0x0a3c /* k */,
+	0x0a67 /* l */,
+	0x0a7f /* m */,
+	0x0aa0 /* n */,
+	0x0ac1 /* o */,
+	0x0ae2 /* p */,
+	0x0b0d /* q */,
+	0x0b38 /* r */,
+	0x0b4b /* s */,
+	0x0b6c /* t */,
+	0x0b83 /* u */,
+	0x0ba4 /* v */,
+	0x0bc5 /* w */,
+	0x0bf4 /* x */,
+	0x0c15 /* y */,
+	0x0c40 /* z */,
+	0x0c61 /* braceleft */,
+	0x0c7e /* bar */,
+	0x0c9b /* braceright */,
+	0x0cb8 /* asciitilde */,
+	0xffff /* (no glyph) */
+};
+const struct fb_font font_helvR24 = {
+	.height = 27,
+	.ascent = 22,
+	.firstchar = 32, /* space */
+	.lastchar = 127, /* ? */
+	.chardata = font_helvR24_data,
+	.charoffs = font_helvR24_offsets,
+};
diff --git a/src/target/firmware/fb/symbols.c b/src/target/firmware/fb/symbols.c
new file mode 100644
index 00000000..e9eab82a
--- /dev/null
+++ b/src/target/firmware/fb/symbols.c
@@ -0,0 +1,113 @@
+#include <fb/font.h>
+static const uint8_t font_symbols_data[] = {
+/* @ battery - */
+	/*0000:*/	3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0005:*/	0x60,	/* .##..... */
+	/*0006:*/	0x40,	/* .#...... */
+	/*0007:*/	0x40,	/* .#...... */
+	/*0008:*/	0x40,	/* .#...... */
+	/*0009:*/	0x40,	/* .#...... */
+	/*000a:*/	0x40,	/* .#...... */
+	/*000b:*/	0x40,	/* .#...... */
+	/*000c:*/	0x60,	/* .##..... */
+/* A battery empty */
+	/*000d:*/	3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0012:*/	0xe0,	/* ###..... */
+	/*0013:*/	0x00,	/* ........ */
+	/*0014:*/	0x00,	/* ........ */
+	/*0015:*/	0x00,	/* ........ */
+	/*0016:*/	0x00,	/* ........ */
+	/*0017:*/	0x00,	/* ........ */
+	/*0018:*/	0x00,	/* ........ */
+	/*0019:*/	0xe0,	/* ###..... */
+/* B battery full */
+	/*001a:*/	3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*001f:*/	0xe0,	/* ###..... */
+	/*0020:*/	0x00,	/* ........ */
+	/*0021:*/	0xc0,	/* ##...... */
+	/*0022:*/	0xc0,	/* ##...... */
+	/*0023:*/	0xc0,	/* ##...... */
+	/*0024:*/	0xc0,	/* ##...... */
+	/*0025:*/	0x00,	/* ........ */
+	/*0026:*/	0xe0,	/* ###..... */
+/* C battery + */
+	/*0027:*/	3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*002c:*/	0x80,	/* #....... */
+	/*002d:*/	0x80,	/* #....... */
+	/*002e:*/	0xc0,	/* ##...... */
+	/*002f:*/	0xc0,	/* ##...... */
+	/*0030:*/	0xc0,	/* ##...... */
+	/*0031:*/	0xc0,	/* ##...... */
+	/*0032:*/	0x80,	/* #....... */
+	/*0033:*/	0x80,	/* #....... */
+/* D radiation left */
+	/*0034:*/	3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0039:*/	0x20,	/* ..#..... */
+	/*003a:*/	0x40,	/* .#...... */
+	/*003b:*/	0x20,	/* ..#..... */
+	/*003c:*/	0x00,	/* ........ */
+	/*003d:*/	0x00,	/* ........ */
+	/*003e:*/	0x00,	/* ........ */
+	/*003f:*/	0x00,	/* ........ */
+	/*0040:*/	0x00,	/* ........ */
+/* E tower */
+	/*0041:*/	5, 5, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0046:*/	0x20,	/* ..#..... */
+	/*0047:*/	0x50,	/* .#.#.... */
+	/*0048:*/	0x20,	/* ..#..... */
+	/*0049:*/	0x20,	/* ..#..... */
+	/*004a:*/	0x50,	/* .#.#.... */
+	/*004b:*/	0x50,	/* .#.#.... */
+	/*004c:*/	0x88,	/* #...#... */
+	/*004d:*/	0xf8,	/* #####... */
+/* F radiation right */
+	/*004e:*/	3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0053:*/	0x80,	/* #....... */
+	/*0054:*/	0x40,	/* .#...... */
+	/*0055:*/	0x80,	/* #....... */
+	/*0056:*/	0x00,	/* ........ */
+	/*0057:*/	0x00,	/* ........ */
+	/*0058:*/	0x00,	/* ........ */
+	/*0059:*/	0x00,	/* ........ */
+	/*005a:*/	0x00,	/* ........ */
+/* G no radiation */
+	/*005b:*/	3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*0060:*/	0x00,	/* ........ */
+	/*0061:*/	0x00,	/* ........ */
+	/*0062:*/	0x00,	/* ........ */
+	/*0063:*/	0x00,	/* ........ */
+	/*0064:*/	0x00,	/* ........ */
+	/*0065:*/	0x00,	/* ........ */
+	/*0066:*/	0x00,	/* ........ */
+	/*0067:*/	0x00,	/* ........ */
+/* H battery loaded */
+	/*0068:*/	3, 3, 8, 0, 0, /* width and bbox (w,h,x,y) */
+	/*006d:*/	0xe0,	/* ###..... */
+	/*006e:*/	0x00,	/* ........ */
+	/*006f:*/	0xe0,	/* ###..... */
+	/*0070:*/	0xe0,	/* ###..... */
+	/*0071:*/	0xe0,	/* ###..... */
+	/*0072:*/	0xe0,	/* ###..... */
+	/*0073:*/	0x00,	/* ........ */
+	/*0074:*/	0xe0,	/* ###..... */
+};
+static const uint16_t font_symbols_offsets[] = {
+	0x0000 /* '@' */,
+	0x000d /* 'A' */,
+	0x001a /* 'B' */,
+	0x0027 /* 'C' */,
+	0x0034 /* 'D' */,
+	0x0041 /* 'E' */,
+	0x004e /* 'F' */,
+	0x005b /* 'G' */,
+	0x0068 /* 'H' */,
+};
+const struct fb_font font_symbols = {
+	.height = 8,
+	.ascent = 8,
+	.firstchar = 64, /* '@' */
+	.lastchar = 72,
+	.chardata = font_symbols_data,
+	.charoffs = font_symbols_offsets,
+};
+
diff --git a/src/target/firmware/flash/cfi_flash.c b/src/target/firmware/flash/cfi_flash.c
new file mode 100644
index 00000000..974165d1
--- /dev/null
+++ b/src/target/firmware/flash/cfi_flash.c
@@ -0,0 +1,574 @@
+/* NOR Flash Driver for Intel 28F160C3 NOR flash */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <debug.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <errno.h>
+#include <memory.h>
+#include <defines.h>
+#include <flash/cfi_flash.h>
+
+/* XXX: strings must always be in ram */
+#if 0
+#define puts(...)
+#define printf(...)
+#endif
+
+/* global definitions */
+#define CFI_FLASH_MAX_ERASE_REGIONS 4
+
+/* structure of erase region descriptor */
+struct cfi_region {
+	uint16_t b_count;
+	uint16_t b_size;
+} __attribute__ ((packed));
+
+/* structure of cfi query response */
+struct cfi_query {
+	uint8_t qry[3];
+	uint16_t p_id;
+	uint16_t p_adr;
+	uint16_t a_id;
+	uint16_t a_adr;
+	uint8_t vcc_min;
+	uint8_t vcc_max;
+	uint8_t vpp_min;
+	uint8_t vpp_max;
+	uint8_t word_write_timeout_typ;
+	uint8_t buf_write_timeout_typ;
+	uint8_t block_erase_timeout_typ;
+	uint8_t chip_erase_timeout_typ;
+	uint8_t word_write_timeout_max;
+	uint8_t buf_write_timeout_max;
+	uint8_t block_erase_timeout_max;
+	uint8_t chip_erase_timeout_max;
+	uint8_t dev_size;
+	uint16_t interface_desc;
+	uint16_t max_buf_write_size;
+	uint8_t num_erase_regions;
+	struct cfi_region erase_regions[CFI_FLASH_MAX_ERASE_REGIONS];
+} __attribute__ ((packed));
+
+/* manufacturer ids */
+enum cfi_manuf {
+	CFI_MANUF_ST    = 0x0020,
+	CFI_MANUF_INTEL = 0x0089,
+};
+
+/* algorithm ids */
+enum cfi_algo {
+	CFI_ALGO_INTEL_3 = 0x03
+};
+
+/* various command bytes */
+enum cfi_flash_cmd {
+	CFI_CMD_RESET = 0xff,
+	CFI_CMD_READ_ID = 0x90,
+	CFI_CMD_CFI = 0x98,
+	CFI_CMD_READ_STATUS = 0x70,
+	CFI_CMD_CLEAR_STATUS = 0x50,
+	CFI_CMD_WRITE = 0x40,
+	CFI_CMD_BLOCK_ERASE = 0x20,
+	CFI_CMD_ERASE_CONFIRM = 0xD0,
+	CFI_CMD_PROTECT = 0x60,
+};
+
+/* protection commands */
+enum flash_prot_cmd {
+	CFI_PROT_LOCK = 0x01,
+	CFI_PROT_UNLOCK = 0xD0,
+	CFI_PROT_LOCKDOWN = 0x2F
+};
+
+/* offsets from base */
+enum flash_offset {
+	CFI_OFFSET_MANUFACTURER_ID = 0x00,
+	CFI_OFFSET_DEVICE_ID = 0x01,
+	CFI_OFFSET_INTEL_PROTECTION = 0x81,
+	CFI_OFFSET_CFI_RESP = 0x10
+};
+
+/* offsets from block base */
+enum flash_block_offset {
+	CFI_OFFSET_BLOCK_LOCKSTATE = 0x02
+};
+
+/* status masks */
+enum flash_status {
+	CFI_STATUS_READY = 0x80,
+	CFI_STATUS_ERASE_SUSPENDED = 0x40,
+	CFI_STATUS_ERASE_ERROR = 0x20,
+	CFI_STATUS_PROGRAM_ERROR = 0x10,
+	CFI_STATUS_VPP_LOW = 0x08,
+	CFI_STATUS_PROGRAM_SUSPENDED = 0x04,
+	CFI_STATUS_LOCKED_ERROR = 0x02,
+	CFI_STATUS_RESERVED = 0x01
+};
+
+__ramtext
+static inline void flash_write_cmd(const void *base_addr, uint16_t cmd)
+{
+	writew(cmd, base_addr);
+}
+
+__ramtext
+static inline uint16_t flash_read16(const void *base_addr, uint32_t offset)
+{
+	return readw(base_addr + (offset << 1));
+}
+
+__ramtext
+static char flash_protected(uint32_t block_offset)
+{
+#ifdef CONFIG_FLASH_WRITE
+#  ifdef CONFIG_FLASH_WRITE_LOADER
+	return 0;
+#  else
+	return block_offset <= 0xFFFF;
+#  endif
+#else
+	return 1;
+#endif
+}
+
+__ramtext
+flash_lock_t flash_block_getlock(flash_t * flash, uint32_t block_offset)
+{
+	const void *base_addr = flash->f_base;
+
+	uint8_t lockstate;
+	flash_write_cmd(base_addr, CFI_CMD_READ_ID);
+	lockstate =
+		flash_read16(base_addr,
+			     (block_offset >> 1) + CFI_OFFSET_BLOCK_LOCKSTATE);
+	flash_write_cmd(base_addr, CFI_CMD_RESET);
+
+	if (lockstate & 0x2) {
+		return FLASH_LOCKED_DOWN;
+	} else if (lockstate & 0x01) {
+		return FLASH_LOCKED;
+	} else {
+		return FLASH_UNLOCKED;
+	}
+}
+
+__ramtext
+int flash_block_unlock(flash_t * flash, uint32_t block_offset)
+{
+	const void *base_addr = flash->f_base;
+
+	if (block_offset >= flash->f_size) {
+		return -EINVAL;
+	}
+
+	if (flash_protected(block_offset)) {
+		return -EPERM;
+	}
+
+	printf("Unlocking block at 0x%08lx, meaning %p\n",
+		   block_offset, base_addr + block_offset);
+
+	flash_write_cmd(base_addr, CFI_CMD_PROTECT);
+	flash_write_cmd(base_addr + block_offset, CFI_PROT_UNLOCK);
+	flash_write_cmd(base_addr, CFI_CMD_RESET);
+
+	return 0;
+}
+
+__ramtext
+int flash_block_lock(flash_t * flash, uint32_t block_offset)
+{
+	const void *base_addr = flash->f_base;
+
+	if (block_offset >= flash->f_size) {
+		return -EINVAL;
+	}
+
+	printf("Locking block at 0x%08lx\n", block_offset);
+
+	flash_write_cmd(base_addr, CFI_CMD_PROTECT);
+	flash_write_cmd(base_addr + block_offset, CFI_PROT_LOCK);
+	flash_write_cmd(base_addr, CFI_CMD_RESET);
+
+	return 0;
+}
+
+__ramtext
+int flash_block_lockdown(flash_t * flash, uint32_t block_offset)
+{
+	const void *base_addr = flash->f_base;
+
+	if (block_offset >= flash->f_size) {
+		return -EINVAL;
+	}
+
+	printf("Locking down block at 0x%08lx\n", block_offset);
+
+	flash_write_cmd(base_addr, CFI_CMD_PROTECT);
+	flash_write_cmd(base_addr + block_offset, CFI_PROT_LOCKDOWN);
+	flash_write_cmd(base_addr, CFI_CMD_RESET);
+
+	return 0;
+}
+
+__ramtext
+int flash_block_erase(flash_t * flash, uint32_t block_offset)
+{
+	const void *base_addr = flash->f_base;
+
+	if (block_offset >= flash->f_size) {
+		return -EINVAL;
+	}
+
+	if (flash_protected(block_offset)) {
+		return -EPERM;
+	}
+
+	printf("Erasing block 0x%08lx...", block_offset);
+
+	void *block_addr = ((uint8_t *) base_addr) + block_offset;
+
+	flash_write_cmd(base_addr, CFI_CMD_CLEAR_STATUS);
+
+	flash_write_cmd(block_addr, CFI_CMD_BLOCK_ERASE);
+	flash_write_cmd(block_addr, CFI_CMD_ERASE_CONFIRM);
+
+	flash_write_cmd(base_addr, CFI_CMD_READ_STATUS);
+	uint16_t status;
+	do {
+		status = flash_read16(base_addr, 0);
+	} while (!(status & CFI_STATUS_READY));
+
+	int res = 0;
+	if (status & CFI_STATUS_ERASE_ERROR) {
+		puts("error: ");
+		if (status & CFI_STATUS_VPP_LOW) {
+			puts("vpp insufficient\n");
+			res = -EFAULT;
+		} else if (status & CFI_STATUS_LOCKED_ERROR) {
+			puts("block is lock-protected\n");
+			res = -EPERM;
+		} else {
+			puts("unknown fault\n");
+			res = -EFAULT;
+		}
+	} else {
+		puts("done\n");
+	}
+
+	flash_write_cmd(base_addr, CFI_CMD_RESET);
+
+	return res;
+
+}
+
+__ramtext
+int flash_program(flash_t * flash, uint32_t dst, void *src, uint32_t nbytes)
+{
+	const void *base_addr = flash->f_base;
+	int res = 0;
+	uint32_t i;
+
+	/* check destination bounds */
+	if (dst >= flash->f_size) {
+		return -EINVAL;
+	}
+	if (dst + nbytes > flash->f_size) {
+		return -EINVAL;
+	}
+
+	/* check alignments */
+	if (((uint32_t) src) % 2) {
+		return -EINVAL;
+	}
+	if (dst % 2) {
+		return -EINVAL;
+	}
+	if (nbytes % 2) {
+		return -EINVAL;
+	}
+
+	/* check permissions */
+	if (flash_protected(dst)) {
+		return -EPERM;
+	}
+
+	/* say something */
+	printf("Programming %lu bytes to 0x%08lx from 0x%p...", nbytes, dst, src);
+
+	/* clear status register */
+	flash_write_cmd(base_addr, CFI_CMD_CLEAR_STATUS);
+
+	/* write the words */
+	puts("writing...");
+	for (i = 0; i < nbytes; i += 2) {
+		uint16_t *src_addr = (uint16_t *) (src + i);
+		uint16_t *dst_addr = (uint16_t *) (base_addr + dst + i);
+
+		uint16_t data = *src_addr;
+
+		flash_write_cmd(dst_addr, CFI_CMD_WRITE);
+		flash_write_cmd(dst_addr, data);
+
+		flash_write_cmd(base_addr, CFI_CMD_READ_STATUS);
+		uint16_t status;
+		do {
+			status = flash_read16(base_addr, 0);
+		} while (!(status & CFI_STATUS_READY));
+
+		if (status & CFI_STATUS_PROGRAM_ERROR) {
+			puts("error: ");
+			if (status & CFI_STATUS_VPP_LOW) {
+				puts("vpp insufficient");
+				res = -EFAULT;
+			} else if (status & CFI_STATUS_LOCKED_ERROR) {
+				puts("block is lock-protected");
+				res = -EPERM;
+			} else {
+				puts("unknown fault");
+				res = -EFAULT;
+			}
+			goto err_reset;
+		}
+	}
+
+	flash_write_cmd(base_addr, CFI_CMD_RESET);
+
+	/* verify the result */
+	puts("verifying...");
+	for (i = 0; i < nbytes; i += 2) {
+		uint16_t *src_addr = (uint16_t *) (src + i);
+		uint16_t *dst_addr = (uint16_t *) (base_addr + dst + i);
+		if (*src_addr != *dst_addr) {
+			puts("error: verification failed");
+			res = -EFAULT;
+			goto err;
+		}
+	}
+
+	puts("done\n");
+
+	return res;
+
+ err_reset:
+	flash_write_cmd(base_addr, CFI_CMD_RESET);
+
+ err:
+	printf(" at offset 0x%lx\n", i);
+
+	return res;
+}
+
+/* Internal: retrieve manufacturer and device id from id space */
+__ramtext
+static int get_id(void *base_addr,
+		  uint16_t * manufacturer_id, uint16_t * device_id)
+{
+	flash_write_cmd(base_addr, CFI_CMD_READ_ID);
+
+	*manufacturer_id = flash_read16(base_addr, CFI_OFFSET_MANUFACTURER_ID);
+	*device_id = flash_read16(base_addr, CFI_OFFSET_DEVICE_ID);
+
+	flash_write_cmd(base_addr, CFI_CMD_RESET);
+
+	return 0;
+}
+
+/* Internal: retrieve cfi query response data */
+__ramtext
+static int get_query(void *base_addr, struct cfi_query *query)
+{
+	int res = 0;
+	unsigned int i;
+
+	flash_write_cmd(base_addr, CFI_CMD_CFI);
+
+	for (i = 0; i < sizeof(struct cfi_query); i++) {
+		uint16_t byte =
+			flash_read16(base_addr, CFI_OFFSET_CFI_RESP + i);
+		*(((volatile unsigned char *)query) + i) = byte;
+	}
+
+	if (query->qry[0] != 'Q' || query->qry[1] != 'R' || query->qry[2] != 'Y') {
+		res = -ENOENT;
+	}
+
+	flash_write_cmd(base_addr, CFI_CMD_RESET);
+
+	return res;
+}
+
+#if 0
+
+/* Internal: retrieve intel protection data */
+__ramtext
+static int get_intel_protection(void *base_addr,
+				uint16_t * lockp, uint8_t protp[8])
+{
+	int i;
+
+	/* check args */
+	if (!lockp) {
+		return -EINVAL;
+	}
+	if (!protp) {
+		return -EINVAL;
+	}
+
+	/* enter read id mode */
+	flash_write_cmd(base_addr, CFI_CMD_READ_ID);
+
+	/* get lock */
+	*lockp = flash_read16(base_addr, CFI_OFFSET_INTEL_PROTECTION);
+
+	/* get data */
+	for (i = 0; i < 8; i++) {
+		protp[i] = flash_read16(base_addr, CFI_OFFSET_INTEL_PROTECTION + 1 + i);
+	}
+
+	/* leave read id mode */
+	flash_write_cmd(base_addr, CFI_CMD_RESET);
+
+	return 0;
+}
+
+static void dump_intel_protection(uint16_t lock, uint8_t data[8])
+{
+	printf
+		("  protection lock 0x%4.4x data 0x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
+		 lock, data[0], data[1], data[2], data[3], data[4], data[5], data[6], data[7]);
+}
+
+static void dump_query_algorithms(struct cfi_query *qry)
+{
+	printf("  primary algorithm 0x%4.4x\n", qry->p_id);
+	printf("  primary extended query 0x%4.4x\n", qry->p_adr);
+	printf("  alternate algorithm 0x%4.4x\n", qry->a_id);
+	printf("  alternate extended query 0x%4.4x\n", qry->a_adr);
+}
+
+static void dump_query_timing(struct cfi_query *qry)
+{
+	uint32_t block_erase_typ = 1 << qry->block_erase_timeout_typ;
+	uint32_t block_erase_max =
+		(1 << qry->block_erase_timeout_max) * block_erase_typ;
+	uint32_t word_program_typ = 1 << qry->word_write_timeout_typ;
+	uint32_t word_program_max =
+		(1 << qry->word_write_timeout_max) * word_program_typ;
+	printf("  block erase typ %u ms\n", block_erase_typ);
+	printf("  block erase max %u ms\n", block_erase_max);
+	printf("  word program typ %u us\n", word_program_typ);
+	printf("  word program max %u us\n", word_program_max);
+}
+
+void flash_dump_info(flash_t * flash)
+{
+	int i;
+	printf("flash at 0x%p of %d bytes with %d regions\n",
+		   flash->f_base, flash->f_size, flash->f_nregions);
+
+	uint16_t m_id, d_id;
+	if (get_id(flash->f_base, &m_id, &d_id)) {
+		puts("  failed to get id\n");
+	} else {
+		printf("  manufacturer 0x%4.4x device 0x%4.4x\n", m_id, d_id);
+	}
+
+	uint16_t plock;
+	uint8_t pdata[8];
+	if (get_intel_protection(flash->f_base, &plock, pdata)) {
+		puts("  failed to get protection data\n");
+	} else {
+		dump_intel_protection(plock, pdata);
+	}
+
+	struct cfi_query qry;
+	if (get_query(flash->f_base, &qry)) {
+		puts("  failed to get cfi query response\n");
+	} else {
+		dump_query_algorithms(&qry);
+		dump_query_timing(&qry);
+	}
+
+	for (i = 0; i < flash->f_nregions; i++) {
+		flash_region_t *fr = &flash->f_regions[i];
+		printf("  region %d: %d blocks of %d bytes at 0x%p\n",
+			   i, fr->fr_bnum, fr->fr_bsize, fr->fr_base);
+	}
+}
+
+#endif
+
+__ramtext
+int flash_init(flash_t * flash, void *base_addr)
+{
+	int res;
+	unsigned u;
+	uint16_t m_id, d_id;
+	uint32_t base;
+	struct cfi_query qry;
+
+	/* retrieve and check manufacturer and device id */
+	res = get_id(base_addr, &m_id, &d_id);
+	if (res) {
+		return res;
+	}
+	if (m_id != CFI_MANUF_INTEL && m_id != CFI_MANUF_ST) {
+		return -ENOTSUP;
+	}
+
+	/* retrieve and check query response */
+	res = get_query(base_addr, &qry);
+	if (res) {
+		return res;
+	}
+	if (qry.p_id != CFI_ALGO_INTEL_3) {
+		/* we only support algo 3 */
+		return -ENOTSUP;
+	}
+	if (qry.num_erase_regions > FLASH_MAX_REGIONS) {
+		/* we have a hard limit on the number of regions */
+		return -ENOTSUP;
+	}
+
+	/* fill in basic information */
+	flash->f_base = base_addr;
+	flash->f_size = 1 << qry.dev_size;
+
+	/* determine number of erase regions */
+	flash->f_nregions = qry.num_erase_regions;
+
+	/* compute actual erase region info from cfi junk */
+	base = 0;
+	for (u = 0; u < flash->f_nregions; u++) {
+		flash_region_t *fr = &flash->f_regions[u];
+
+		fr->fr_base = (void *)base;
+		fr->fr_bnum = qry.erase_regions[u].b_count + 1;
+		fr->fr_bsize = qry.erase_regions[u].b_size * 256;
+
+		base += fr->fr_bnum * fr->fr_bsize;
+	}
+
+	return 0;
+}
diff --git a/src/target/firmware/include/abb/twl3025.h b/src/target/firmware/include/abb/twl3025.h
new file mode 100755
index 00000000..36406449
--- /dev/null
+++ b/src/target/firmware/include/abb/twl3025.h
@@ -0,0 +1,186 @@
+#ifndef _TWL3025_H
+#define _TWL3025_H
+
+#define PAGE(n)		(n << 7)
+enum twl3025_reg {
+	VRPCCFG		= PAGE(1) | 30,
+	VRPCDEV		= PAGE(0) | 30,
+	VRPCMSK		= PAGE(1) | 31,
+	VRPCMSKABB	= PAGE(1) | 29,
+	VRPCSTS		= PAGE(0) | 31,
+	/* Monitoring ADC Registers */
+	MADCTRL		= PAGE(0) | 13,
+	MADCSTAT	= PAGE(0) | 24,
+	VBATREG		= PAGE(0) | 15,
+	VCHGREG		= PAGE(0) | 16,
+	ICHGREG		= PAGE(0) | 17,
+	VBKPREG		= PAGE(0) | 18,
+	ADIN1REG	= PAGE(0) | 19,
+	ADIN2REG	= PAGE(0) | 20,
+	ADIN3REG	= PAGE(0) | 21,
+	ADIN4REG	= PAGE(0) | 22,
+	/* Clock Generator Registers */
+	TOGBR1		= PAGE(0) | 4,
+	TOGBR2		= PAGE(0) | 5,
+	PWDNRG		= PAGE(1) | 9,
+	TAPCTRL		= PAGE(1) | 19,
+	TAPREG		= PAGE(1) | 20,
+	/* Automatic Frequency Control (AFC) Registers */
+	AUXAFC1		= PAGE(0) | 7,
+	AUXAFC2		= PAGE(0) | 8,
+	AFCCTLADD	= PAGE(1) | 21,
+	AFCOUT		= PAGE(1) | 22,
+	/* Automatic Power Control (APC) Registers */
+	APCDEL1		= PAGE(0) | 2,
+	APCDEL2		= PAGE(1) | 26,
+	AUXAPC		= PAGE(0) | 9,
+	APCRAM		= PAGE(0) | 10,
+	APCOFF		= PAGE(0) | 11,
+	APCOUT		= PAGE(1) | 12,
+	/* Auxiliary DAC Control Register */
+	AUXDAC		= PAGE(0) | 12,
+	/* SimCard Control Register */
+	VRPCSIM		= PAGE(1) | 23,
+	/* LED Driver Register */
+	AUXLED		= PAGE(1) | 24,
+	/* Battery Charger Interface (BCI) Registers */
+	CHGREG		= PAGE(0) | 25,
+	BCICTL1		= PAGE(0) | 28,
+	BCICTL2		= PAGE(0) | 29,
+	BCICONF		= PAGE(1) | 13,
+	/* Interrupt and Bus Control (IBIC) Registers */
+	ITMASK		= PAGE(0) | 28,
+	ITSTATREG	= PAGE(0) | 27,	/* both pages! */
+	PAGEREG		= PAGE(0) | 1, 	/* both pages! */
+	/* Baseband Codec (BBC) Registers */
+	BULIOFF		= PAGE(1) | 2,
+	BULQOFF		= PAGE(1) | 3,
+	BULIDAC		= PAGE(1) | 5,
+	BULQDAC		= PAGE(1) | 4,
+	BULGCAL		= PAGE(1) | 14,
+	BULDATA1	= PAGE(0) | 3,	/* 16 words */
+	BBCTRL		= PAGE(1) | 6,
+	/* Voiceband Codec (VBC) Registers */
+	VBCTRL1		= PAGE(1) | 8,
+	VBCTRL2		= PAGE(1) | 11,
+	VBPOP		= PAGE(1) | 10,
+	VBUCTRL		= PAGE(1) | 7,
+	VBDCTRL		= PAGE(0) | 6,
+};
+#define BULDATA2	BULDATA1
+
+/* available ADC inputs on IOTA */
+enum twl3025_dac_inputs {/* === Signal ============================= */
+	MADC_VBAT=0,	/* battery voltage / 4                      */
+	MADC_VCHG=1,	/* charger voltage / 5                      */
+	MADC_ICHG=2,	/* I-sense amp or CHGREG DAC output         */
+	MADC_VBKP=3,	/* backup battery voltage / 4               */
+	MADC_ADIN1=4,	/* VADCID, sense battery type, not used     */
+	MADC_ADIN2=5,	/* Temperature sensor in Battery            */
+	MADC_ADIN3=6,	/* Mode_detect: sense 2.5mm jack insertion  */
+	MADC_ADIN4=7,	/* RITA: TEMP_SEN                           */
+	MADC_NUM_CHANNELS=8
+};
+
+enum madcstat_reg_bits { /* monitoring ADC status register */
+	ADCBUSY = 0x01  /* if set, a conversion is currently going on */
+};
+
+/* BCICTL1 register bits */
+enum bcictl1_reg_bits {
+	MESBAT	= 1<<0,	/* connect resistive divider for bat voltage */
+	DACNBUF	= 1<<1,	/* bypass DAC buffer */
+	THSENS0	= 1<<3,	/* thermal sensor bias current (ADIN2), bit 0 */
+	THSENS1	= 1<<4,	/* "" bit 1 */
+	THSENS2	= 1<<5,	/* "" bit 2 */
+	THEN	= 1<<6,	/* enable thermal sensor bias current (ADIN1) */ 
+	TYPEN	= 1<<7	/* enable bias current for battery type reading */
+};
+
+/* BCICTL1 register bits */
+enum bcictl2_reg_bits {
+	CHEN	= 1<<0,	/* enable charger */
+	CHIV	= 1<<1,	/* 1=constant current, 0=constant voltage */
+	CHBPASSPA=1<<2,	/* full charging of the battery during pulse radio */
+	CLIB	= 1<<3,	/* calibrate I-to-V amp (short input pins) */
+	CHDISPA	= 1<<4,	/* disabel charging during pulse radio (???) */
+	LEDC	= 1<<5,	/* enable LED during charge */
+	CGAIN4	= 1<<6,	/* if set, I-to-V amp gain is reduced from 10 to 4 */
+	PREOFF	= 1<<7	/* disable battery precharge */
+};
+
+enum vrpcsts_reg_bits {
+	ONBSTS = 1<<0,	/* button push switched on the mobile */
+	ONRSTS = 1<<1,	/* RPWON terminal switched on the mobile */
+	ITWSTS = 1<<2,	/* ITWAKEUP terminal switched on the mobile */
+	CHGSTS = 1<<3,	/* plugging in charger has switched on the mobile */
+	ONREFLT= 1<<4,	/* state of PWON terminal after debouncing */
+	ONMRFLT= 1<<5,	/* state of RPWON terminal after debouncing */
+	CHGPRES= 1<<6	/* charger is connected */
+};
+
+enum togbr2_bits {
+	TOGBR2_KEEPR	= (1 << 0),	/* Clear KEEPON bit */
+	TOGBR2_KEEPS	= (1 << 1),	/* Set KEEPON bit */
+	TOGBR2_ACTR	= (1 << 2),	/* Dectivate MCLK */
+	TOGBR2_ACTS	= (1 << 3),	/* Activate MCLK */
+	TOGBR2_IBUFPTR1	= (1 << 4),	/* Initialize pointer of burst buffer 1 */
+	TOGBR2_IBUFPTR2	= (1 << 5),	/* Initialize pointer of burst buffer 2 */
+	TOGBR2_IAPCPTR	= (1 << 6),	/* Initialize pointer of APC RAM */
+};
+
+/* How a RAMP value is encoded */
+#define ABB_RAMP_VAL(up, down)	( ((down & 0x1F) << 5) | (up & 0x1F) )
+
+enum twl3025_unit {
+	TWL3025_UNIT_AFC,
+	TWL3025_UNIT_MAD,
+	TWL3025_UNIT_ADA,
+	TWL3025_UNIT_VDL,
+	TWL3025_UNIT_VUL,
+};
+
+void twl3025_init(void);
+void twl3025_reg_write(uint8_t reg, uint16_t data);
+uint16_t twl3025_reg_read(uint8_t reg);
+
+void twl3025_power_off(void);
+
+void twl3025_clk13m(int enable);
+
+void twl3025_unit_enable(enum twl3025_unit unit, int on);
+
+enum twl3025_tsp_bits {
+	BULON		= 0x80,
+	BULCAL		= 0x40,
+	BULENA		= 0x20,
+	BDLON		= 0x10,
+	BDLCAL		= 0x08,
+	BDLENA		= 0x04,
+	STARTADC	= 0x02,
+};
+
+extern const uint16_t twl3025_default_ramp[16];
+
+/* Enqueue a TSP signal change via the TPU */
+void twl3025_tsp_write(uint8_t data);
+
+/* Enqueue a series of TSP commands in the TPU to (de)activate the downlink path */
+void twl3025_downlink(int on, int16_t at);
+
+/* Enqueue a series of TSP commands in the TPU to (de)activate the uplink path */
+void twl3025_uplink(int on, int16_t at);
+
+/* Update the AFC DAC value */
+void twl3025_afc_set(int16_t val);
+
+/* Get the AFC DAC value */
+int16_t twl3025_afc_get(void);
+
+/* Get the AFC DAC output value */
+uint8_t twl3025_afcout_get(void);
+
+/* Force a certain static AFC DAC output value */
+void twl3025_afcout_set(uint8_t val);
+
+#endif
diff --git a/src/target/firmware/include/arm.h b/src/target/firmware/include/arm.h
new file mode 100644
index 00000000..272c9c39
--- /dev/null
+++ b/src/target/firmware/include/arm.h
@@ -0,0 +1,7 @@
+#ifndef _ARM_H
+#define _ARM_H
+
+void arm_enable_interrupts(void);
+int arm_disable_interrupts(void);
+
+#endif
diff --git a/src/target/firmware/include/arpa/inet.h b/src/target/firmware/include/arpa/inet.h
new file mode 100644
index 00000000..9a4dd5c9
--- /dev/null
+++ b/src/target/firmware/include/arpa/inet.h
@@ -0,0 +1,2 @@
+/* we have this to make sure libosmocore uses our version of ntohl/htons */
+#include <byteorder.h>
diff --git a/src/target/firmware/include/asm/assembler.h b/src/target/firmware/include/asm/assembler.h
new file mode 100644
index 00000000..cd03e98d
--- /dev/null
+++ b/src/target/firmware/include/asm/assembler.h
@@ -0,0 +1,113 @@
+/*
+ *  linux/include/asm-arm/assembler.h
+ *
+ *  Copyright (C) 1996-2000 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ *  This file contains arm architecture specific defines
+ *  for the different processors.
+ *
+ *  Do not include any C declarations in this file - it is included by
+ *  assembler source.
+ */
+#ifndef __ASSEMBLY__
+#error "Only include this from assembly code"
+#endif
+
+#include <asm/ptrace.h>
+
+/*
+ * Endian independent macros for shifting bytes within registers.
+ */
+#ifndef __ARMEB__
+#define pull            lsr
+#define push            lsl
+#define get_byte_0      lsl #0
+#define get_byte_1	lsr #8
+#define get_byte_2	lsr #16
+#define get_byte_3	lsr #24
+#define put_byte_0      lsl #0
+#define put_byte_1	lsl #8
+#define put_byte_2	lsl #16
+#define put_byte_3	lsl #24
+#else
+#define pull            lsl
+#define push            lsr
+#define get_byte_0	lsr #24
+#define get_byte_1	lsr #16
+#define get_byte_2	lsr #8
+#define get_byte_3      lsl #0
+#define put_byte_0	lsl #24
+#define put_byte_1	lsl #16
+#define put_byte_2	lsl #8
+#define put_byte_3      lsl #0
+#endif
+
+#define PLD(code...)
+
+#define MODE_USR	USR_MODE
+#define MODE_FIQ	FIQ_MODE
+#define MODE_IRQ	IRQ_MODE
+#define MODE_SVC	SVC_MODE
+
+#define DEFAULT_FIQ	MODE_FIQ
+
+/*
+ * LOADREGS - ldm with PC in register list (eg, ldmfd sp!, {pc})
+ */
+#ifdef __STDC__
+#define LOADREGS(cond, base, reglist...)\
+	ldm##cond	base,reglist
+#else
+#define LOADREGS(cond, base, reglist...)\
+	ldm/**/cond	base,reglist
+#endif
+
+/*
+ * Build a return instruction for this processor type.
+ */
+#define RETINSTR(instr, regs...)\
+	instr	regs
+
+/*
+ * Enable and disable interrupts
+ */
+	.macro	disable_irq
+	msr	cpsr_c, #PSR_I_BIT | SVC_MODE
+	.endm
+
+	.macro	enable_irq
+	msr	cpsr_c, #SVC_MODE
+	.endm
+
+/*
+ * Save the current IRQ state and disable IRQs.  Note that this macro
+ * assumes FIQs are enabled, and that the processor is in SVC mode.
+ */
+	.macro	save_and_disable_irqs, oldcpsr
+	mrs	\oldcpsr, cpsr
+	disable_irq
+	.endm
+
+/*
+ * Restore interrupt state previously stored in a register.  We don't
+ * guarantee that this will preserve the flags.
+ */
+	.macro	restore_irqs, oldcpsr
+	msr	cpsr_c, \oldcpsr
+	.endm
+
+/*
+ * These two are used to save LR/restore PC over a user-based access.
+ * The old 26-bit architecture requires that we do.  On 32-bit
+ * architecture, we can safely ignore this requirement.
+ */
+	.macro	save_lr
+	.endm
+
+	.macro	restore_pc
+	mov	pc, lr
+	.endm
diff --git a/src/target/firmware/include/asm/atomic.h b/src/target/firmware/include/asm/atomic.h
new file mode 100644
index 00000000..19e8ce6f
--- /dev/null
+++ b/src/target/firmware/include/asm/atomic.h
@@ -0,0 +1,106 @@
+/*
+ *  linux/include/asm-arm/atomic.h
+ *
+ *  Copyright (C) 1996 Russell King.
+ *  Copyright (C) 2002 Deep Blue Solutions Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef __ASM_ARM_ATOMIC_H
+#define __ASM_ARM_ATOMIC_H
+
+typedef struct { volatile int counter; } atomic_t;
+
+#define ATOMIC_INIT(i)	{ (i) }
+
+#define atomic_read(v)	((v)->counter)
+
+#include <asm/system.h>
+#include <asm/compiler.h>
+
+#define atomic_set(v,i)	(((v)->counter) = (i))
+
+static inline int atomic_add_return(int i, atomic_t *v)
+{
+	unsigned long flags;
+	int val;
+
+	local_irq_save(flags);
+	val = v->counter;
+	v->counter = val += i;
+	local_irq_restore(flags);
+
+	return val;
+}
+
+static inline int atomic_sub_return(int i, atomic_t *v)
+{
+	unsigned long flags;
+	int val;
+
+	local_irq_save(flags);
+	val = v->counter;
+	v->counter = val -= i;
+	local_irq_restore(flags);
+
+	return val;
+}
+
+static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
+{
+	int ret;
+	unsigned long flags;
+
+	local_irq_save(flags);
+	ret = v->counter;
+	if (likely(ret == old))
+		v->counter = new;
+	local_irq_restore(flags);
+
+	return ret;
+}
+
+static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	*addr &= ~mask;
+	local_irq_restore(flags);
+}
+
+#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
+
+static inline int atomic_add_unless(atomic_t *v, int a, int u)
+{
+	int c, old;
+
+	c = atomic_read(v);
+	while (c != u && (old = atomic_cmpxchg((v), c, c + a)) != c)
+		c = old;
+	return c != u;
+}
+#define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
+
+#define atomic_add(i, v)	(void) atomic_add_return(i, v)
+#define atomic_inc(v)		(void) atomic_add_return(1, v)
+#define atomic_sub(i, v)	(void) atomic_sub_return(i, v)
+#define atomic_dec(v)		(void) atomic_sub_return(1, v)
+
+#define atomic_inc_and_test(v)	(atomic_add_return(1, v) == 0)
+#define atomic_dec_and_test(v)	(atomic_sub_return(1, v) == 0)
+#define atomic_inc_return(v)    (atomic_add_return(1, v))
+#define atomic_dec_return(v)    (atomic_sub_return(1, v))
+#define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
+
+#define atomic_add_negative(i,v) (atomic_add_return(i, v) < 0)
+
+/* Atomic operations are already serializing on ARM */
+#define smp_mb__before_atomic_dec()	barrier()
+#define smp_mb__after_atomic_dec()	barrier()
+#define smp_mb__before_atomic_inc()	barrier()
+#define smp_mb__after_atomic_inc()	barrier()
+
+#endif
diff --git a/src/target/firmware/include/asm/bitops.h b/src/target/firmware/include/asm/bitops.h
new file mode 100644
index 00000000..337d800d
--- /dev/null
+++ b/src/target/firmware/include/asm/bitops.h
@@ -0,0 +1,225 @@
+/*
+ * Copyright 1995, Russell King.
+ * Various bits and pieces copyrights include:
+ *  Linus Torvalds (test_bit).
+ * Big endian support: Copyright 2001, Nicolas Pitre
+ *  reworked by rmk.
+ *
+ * bit 0 is the LSB of an "unsigned long" quantity.
+ *
+ * Please note that the code in this file should never be included
+ * from user space.  Many of these are not implemented in assembler
+ * since they would be too costly.  Also, they require privileged
+ * instructions (which are not available from user mode) to ensure
+ * that they are atomic.
+ */
+
+#ifndef __ASM_ARM_BITOPS_H
+#define __ASM_ARM_BITOPS_H
+
+#include <asm/system.h>
+
+#define smp_mb__before_clear_bit()	mb()
+#define smp_mb__after_clear_bit()	mb()
+
+/*
+ * These functions are the basis of our bit ops.
+ *
+ * First, the atomic bitops. These use native endian.
+ */
+static inline void ____atomic_set_bit(unsigned int bit, volatile unsigned long *p)
+{
+	unsigned long flags;
+	unsigned long mask = 1UL << (bit & 31);
+
+	p += bit >> 5;
+
+	local_irq_save(flags);
+	*p |= mask;
+	local_irq_restore(flags);
+}
+
+static inline void ____atomic_clear_bit(unsigned int bit, volatile unsigned long *p)
+{
+	unsigned long flags;
+	unsigned long mask = 1UL << (bit & 31);
+
+	p += bit >> 5;
+
+	local_irq_save(flags);
+	*p &= ~mask;
+	local_irq_restore(flags);
+}
+
+static inline void ____atomic_change_bit(unsigned int bit, volatile unsigned long *p)
+{
+	unsigned long flags;
+	unsigned long mask = 1UL << (bit & 31);
+
+	p += bit >> 5;
+
+	local_irq_save(flags);
+	*p ^= mask;
+	local_irq_restore(flags);
+}
+
+static inline int
+____atomic_test_and_set_bit(unsigned int bit, volatile unsigned long *p)
+{
+	unsigned long flags;
+	unsigned int res;
+	unsigned long mask = 1UL << (bit & 31);
+
+	p += bit >> 5;
+
+	local_irq_save(flags);
+	res = *p;
+	*p = res | mask;
+	local_irq_restore(flags);
+
+	return res & mask;
+}
+
+static inline int
+____atomic_test_and_clear_bit(unsigned int bit, volatile unsigned long *p)
+{
+	unsigned long flags;
+	unsigned int res;
+	unsigned long mask = 1UL << (bit & 31);
+
+	p += bit >> 5;
+
+	local_irq_save(flags);
+	res = *p;
+	*p = res & ~mask;
+	local_irq_restore(flags);
+
+	return res & mask;
+}
+
+static inline int
+____atomic_test_and_change_bit(unsigned int bit, volatile unsigned long *p)
+{
+	unsigned long flags;
+	unsigned int res;
+	unsigned long mask = 1UL << (bit & 31);
+
+	p += bit >> 5;
+
+	local_irq_save(flags);
+	res = *p;
+	*p = res ^ mask;
+	local_irq_restore(flags);
+
+	return res & mask;
+}
+
+//#include <asm-generic/bitops/non-atomic.h>
+
+/*
+ *  A note about Endian-ness.
+ *  -------------------------
+ *
+ * When the ARM is put into big endian mode via CR15, the processor
+ * merely swaps the order of bytes within words, thus:
+ *
+ *          ------------ physical data bus bits -----------
+ *          D31 ... D24  D23 ... D16  D15 ... D8  D7 ... D0
+ * little     byte 3       byte 2       byte 1      byte 0
+ * big        byte 0       byte 1       byte 2      byte 3
+ *
+ * This means that reading a 32-bit word at address 0 returns the same
+ * value irrespective of the endian mode bit.
+ *
+ * Peripheral devices should be connected with the data bus reversed in
+ * "Big Endian" mode.  ARM Application Note 61 is applicable, and is
+ * available from http://www.arm.com/.
+ *
+ * The following assumes that the data bus connectivity for big endian
+ * mode has been followed.
+ *
+ * Note that bit 0 is defined to be 32-bit word bit 0, not byte 0 bit 0.
+ */
+
+/*
+ * Little endian assembly bitops.  nr = 0 -> byte 0 bit 0.
+ */
+extern void _set_bit_le(int nr, volatile unsigned long * p);
+extern void _clear_bit_le(int nr, volatile unsigned long * p);
+extern void _change_bit_le(int nr, volatile unsigned long * p);
+extern int _test_and_set_bit_le(int nr, volatile unsigned long * p);
+extern int _test_and_clear_bit_le(int nr, volatile unsigned long * p);
+extern int _test_and_change_bit_le(int nr, volatile unsigned long * p);
+extern int _find_first_zero_bit_le(const void * p, unsigned size);
+extern int _find_next_zero_bit_le(const void * p, int size, int offset);
+extern int _find_first_bit_le(const unsigned long *p, unsigned size);
+extern int _find_next_bit_le(const unsigned long *p, int size, int offset);
+
+/*
+ * Big endian assembly bitops.  nr = 0 -> byte 3 bit 0.
+ */
+extern void _set_bit_be(int nr, volatile unsigned long * p);
+extern void _clear_bit_be(int nr, volatile unsigned long * p);
+extern void _change_bit_be(int nr, volatile unsigned long * p);
+extern int _test_and_set_bit_be(int nr, volatile unsigned long * p);
+extern int _test_and_clear_bit_be(int nr, volatile unsigned long * p);
+extern int _test_and_change_bit_be(int nr, volatile unsigned long * p);
+extern int _find_first_zero_bit_be(const void * p, unsigned size);
+extern int _find_next_zero_bit_be(const void * p, int size, int offset);
+extern int _find_first_bit_be(const unsigned long *p, unsigned size);
+extern int _find_next_bit_be(const unsigned long *p, int size, int offset);
+
+/*
+ * The __* form of bitops are non-atomic and may be reordered.
+ */
+#define	ATOMIC_BITOP_LE(name,nr,p)		\
+	(__builtin_constant_p(nr) ?		\
+	 ____atomic_##name(nr, p) :		\
+	 _##name##_le(nr,p))
+
+#define	ATOMIC_BITOP_BE(name,nr,p)		\
+	(__builtin_constant_p(nr) ?		\
+	 ____atomic_##name(nr, p) :		\
+	 _##name##_be(nr,p))
+
+#define NONATOMIC_BITOP(name,nr,p)		\
+	(____nonatomic_##name(nr, p))
+
+/*
+ * These are the little endian, atomic definitions.
+ */
+#define set_bit(nr,p)			ATOMIC_BITOP_LE(set_bit,nr,p)
+#define clear_bit(nr,p)			ATOMIC_BITOP_LE(clear_bit,nr,p)
+#define change_bit(nr,p)		ATOMIC_BITOP_LE(change_bit,nr,p)
+#define test_and_set_bit(nr,p)		ATOMIC_BITOP_LE(test_and_set_bit,nr,p)
+#define test_and_clear_bit(nr,p)	ATOMIC_BITOP_LE(test_and_clear_bit,nr,p)
+#define test_and_change_bit(nr,p)	ATOMIC_BITOP_LE(test_and_change_bit,nr,p)
+#define find_first_zero_bit(p,sz)	_find_first_zero_bit_le(p,sz)
+#define find_next_zero_bit(p,sz,off)	_find_next_zero_bit_le(p,sz,off)
+#define find_first_bit(p,sz)		_find_first_bit_le(p,sz)
+#define find_next_bit(p,sz,off)		_find_next_bit_le(p,sz,off)
+
+#define WORD_BITOFF_TO_LE(x)		((x))
+
+#if 0
+#include <asm-generic/bitops/ffz.h>
+#include <asm-generic/bitops/__ffs.h>
+#include <asm-generic/bitops/fls.h>
+#include <asm-generic/bitops/ffs.h>
+
+#include <asm-generic/bitops/fls64.h>
+
+#include <asm-generic/bitops/sched.h>
+#include <asm-generic/bitops/hweight.h>
+#endif
+
+#define BITS_PER_LONG		32
+#define BITOP_MASK(nr)          (1UL << ((nr) % BITS_PER_LONG))
+#define BITOP_WORD(nr)          ((nr) / BITS_PER_LONG)
+
+static inline int test_bit(int nr, const volatile unsigned long *addr)
+{
+	return 1UL & (addr[BITOP_WORD(nr)] >> (nr & (BITS_PER_LONG-1)));
+}
+
+#endif /* _ARM_BITOPS_H */
diff --git a/src/target/firmware/include/asm/div64.h b/src/target/firmware/include/asm/div64.h
new file mode 100644
index 00000000..36826168
--- /dev/null
+++ b/src/target/firmware/include/asm/div64.h
@@ -0,0 +1,48 @@
+#ifndef __ASM_ARM_DIV64
+#define __ASM_ARM_DIV64
+
+#include <asm/system.h>
+
+/*
+ * The semantics of do_div() are:
+ *
+ * uint32_t do_div(uint64_t *n, uint32_t base)
+ * {
+ * 	uint32_t remainder = *n % base;
+ * 	*n = *n / base;
+ * 	return remainder;
+ * }
+ *
+ * In other words, a 64-bit dividend with a 32-bit divisor producing
+ * a 64-bit result and a 32-bit remainder.  To accomplish this optimally
+ * we call a special __do_div64 helper with completely non standard
+ * calling convention for arguments and results (beware).
+ */
+
+#ifdef __ARMEB__
+#define __xh "r0"
+#define __xl "r1"
+#else
+#define __xl "r0"
+#define __xh "r1"
+#endif
+
+#define do_div(n,base)						\
+({								\
+	register unsigned int __base      asm("r4") = base;	\
+	register unsigned long long __n   asm("r0") = n;	\
+	register unsigned long long __res asm("r2");		\
+	register unsigned int __rem       asm(__xh);		\
+	asm(	__asmeq("%0", __xh)				\
+		__asmeq("%1", "r2")				\
+		__asmeq("%2", "r0")				\
+		__asmeq("%3", "r4")				\
+		"bl	__do_div64"				\
+		: "=r" (__rem), "=r" (__res)			\
+		: "r" (__n), "r" (__base)			\
+		: "ip", "lr", "cc");				\
+	n = __res;						\
+	__rem;							\
+})
+
+#endif
diff --git a/src/target/firmware/include/asm/linkage.h b/src/target/firmware/include/asm/linkage.h
new file mode 100644
index 00000000..ac1c900f
--- /dev/null
+++ b/src/target/firmware/include/asm/linkage.h
@@ -0,0 +1,18 @@
+#ifndef __ASM_LINKAGE_H
+#define __ASM_LINKAGE_H
+
+/* asm-arm/linkage.h */
+
+#define __ALIGN .align 0
+#define __ALIGN_STR ".align 0"
+
+/* linux/linkage.h */
+
+#define ALIGN __ALIGN
+
+#define ENTRY(name) \
+  .globl name; \
+  ALIGN; \
+  name:
+
+#endif
diff --git a/src/target/firmware/include/asm/ptrace.h b/src/target/firmware/include/asm/ptrace.h
new file mode 100644
index 00000000..f3a654e3
--- /dev/null
+++ b/src/target/firmware/include/asm/ptrace.h
@@ -0,0 +1,128 @@
+/*
+ *  linux/include/asm-arm/ptrace.h
+ *
+ *  Copyright (C) 1996-2003 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef __ASM_ARM_PTRACE_H
+#define __ASM_ARM_PTRACE_H
+
+/*
+ * PSR bits
+ */
+#define USR26_MODE	0x00000000
+#define FIQ26_MODE	0x00000001
+#define IRQ26_MODE	0x00000002
+#define SVC26_MODE	0x00000003
+#define USR_MODE	0x00000010
+#define FIQ_MODE	0x00000011
+#define IRQ_MODE	0x00000012
+#define SVC_MODE	0x00000013
+#define ABT_MODE	0x00000017
+#define UND_MODE	0x0000001b
+#define SYSTEM_MODE	0x0000001f
+#define MODE32_BIT	0x00000010
+#define MODE_MASK	0x0000001f
+#define PSR_T_BIT	0x00000020
+#define PSR_F_BIT	0x00000040
+#define PSR_I_BIT	0x00000080
+#define PSR_J_BIT	0x01000000
+#define PSR_Q_BIT	0x08000000
+#define PSR_V_BIT	0x10000000
+#define PSR_C_BIT	0x20000000
+#define PSR_Z_BIT	0x40000000
+#define PSR_N_BIT	0x80000000
+#define PCMASK		0
+
+/*
+ * Groups of PSR bits
+ */
+#define PSR_f		0xff000000	/* Flags		*/
+#define PSR_s		0x00ff0000	/* Status		*/
+#define PSR_x		0x0000ff00	/* Extension		*/
+#define PSR_c		0x000000ff	/* Control		*/
+
+#ifndef __ASSEMBLY__
+
+/*
+ * This struct defines the way the registers are stored on the
+ * stack during a system call.  Note that sizeof(struct pt_regs)
+ * has to be a multiple of 8.
+ */
+struct pt_regs {
+	long uregs[18];
+};
+
+#define ARM_cpsr	uregs[16]
+#define ARM_pc		uregs[15]
+#define ARM_lr		uregs[14]
+#define ARM_sp		uregs[13]
+#define ARM_ip		uregs[12]
+#define ARM_fp		uregs[11]
+#define ARM_r10		uregs[10]
+#define ARM_r9		uregs[9]
+#define ARM_r8		uregs[8]
+#define ARM_r7		uregs[7]
+#define ARM_r6		uregs[6]
+#define ARM_r5		uregs[5]
+#define ARM_r4		uregs[4]
+#define ARM_r3		uregs[3]
+#define ARM_r2		uregs[2]
+#define ARM_r1		uregs[1]
+#define ARM_r0		uregs[0]
+#define ARM_ORIG_r0	uregs[17]
+
+#define user_mode(regs)	\
+	(((regs)->ARM_cpsr & 0xf) == 0)
+
+#ifdef CONFIG_ARM_THUMB
+#define thumb_mode(regs) \
+	(((regs)->ARM_cpsr & PSR_T_BIT))
+#else
+#define thumb_mode(regs) (0)
+#endif
+
+#define processor_mode(regs) \
+	((regs)->ARM_cpsr & MODE_MASK)
+
+#define interrupts_enabled(regs) \
+	(!((regs)->ARM_cpsr & PSR_I_BIT))
+
+#define fast_interrupts_enabled(regs) \
+	(!((regs)->ARM_cpsr & PSR_F_BIT))
+
+#define condition_codes(regs) \
+	((regs)->ARM_cpsr & (PSR_V_BIT|PSR_C_BIT|PSR_Z_BIT|PSR_N_BIT))
+	
+/* Are the current registers suitable for user mode?
+ * (used to maintain security in signal handlers)
+ */
+static inline int valid_user_regs(struct pt_regs *regs)
+{
+	if (user_mode(regs) &&
+	    (regs->ARM_cpsr & (PSR_F_BIT|PSR_I_BIT)) == 0)
+		return 1;
+
+	/*
+	 * Force CPSR to something logical...
+	 */
+	regs->ARM_cpsr &= PSR_f | PSR_s | PSR_x | PSR_T_BIT | MODE32_BIT;
+
+	return 0;
+}
+
+#define pc_pointer(v) \
+	((v) & ~PCMASK)
+
+#define instruction_pointer(regs) \
+	(pc_pointer((regs)->ARM_pc))
+
+#define profile_pc(regs) instruction_pointer(regs)
+
+#endif /* __ASSEMBLY__ */
+
+#endif
+
diff --git a/src/target/firmware/include/asm/swab.h b/src/target/firmware/include/asm/swab.h
new file mode 100644
index 00000000..4640e271
--- /dev/null
+++ b/src/target/firmware/include/asm/swab.h
@@ -0,0 +1,45 @@
+/*
+ *  arch/arm/include/asm/byteorder.h
+ *
+ * ARM Endian-ness.  In little endian mode, the data bus is connected such
+ * that byte accesses appear as:
+ *  0 = d0...d7, 1 = d8...d15, 2 = d16...d23, 3 = d24...d31
+ * and word accesses (data or instruction) appear as:
+ *  d0...d31
+ *
+ * When in big endian mode, byte accesses appear as:
+ *  0 = d24...d31, 1 = d16...d23, 2 = d8...d15, 3 = d0...d7
+ * and word accesses (data or instruction) appear as:
+ *  d0...d31
+ */
+#ifndef __ASM_ARM_SWAB_H
+#define __ASM_ARM_SWAB_H
+
+#include <stdint.h>
+#include <defines.h>
+
+static inline uint32_t __arch_swab32(uint32_t x)
+{
+	uint32_t t;
+
+#ifndef __thumb__
+	if (!__builtin_constant_p(x)) {
+		/*
+		 * The compiler needs a bit of a hint here to always do the
+		 * right thing and not screw it up to different degrees
+		 * depending on the gcc version.
+		 */
+		asm ("eor\t%0, %1, %1, ror #16" : "=r" (t) : "r" (x));
+	} else
+#endif
+		t = x ^ ((x << 16) | (x >> 16)); /* eor r1,r0,r0,ror #16 */
+
+	x = (x << 24) | (x >> 8);		/* mov r0,r0,ror #8      */
+	t &= ~0x00FF0000;			/* bic r1,r1,#0x00FF0000 */
+	x ^= (t >> 8);				/* eor r0,r0,r1,lsr #8   */
+
+	return x;
+}
+#define __arch_swab32 __arch_swab32
+
+#endif
diff --git a/src/target/firmware/include/asm/system.h b/src/target/firmware/include/asm/system.h
new file mode 100644
index 00000000..3db0dc7a
--- /dev/null
+++ b/src/target/firmware/include/asm/system.h
@@ -0,0 +1,123 @@
+#ifndef __ASM_ARM_SYSTEM_H
+#define __ASM_ARM_SYSTEM_H
+
+/* Generic ARM7TDMI (ARMv4T) synchronisation primitives, mostly
+ * taken from Linux kernel source, licensed under GPL */
+
+#define local_irq_save(x)					\
+	({							\
+		unsigned long temp;				\
+		(void) (&temp == &x);				\
+	__asm__ __volatile__(					\
+	"mrs	%0, cpsr		@ local_irq_save\n"	\
+"	orr	%1, %0, #128\n"					\
+"	msr	cpsr_c, %1"					\
+	: "=r" (x), "=r" (temp)					\
+	:							\
+	: "memory", "cc");					\
+	})
+	
+/* Save IRQ flags and disable FIQ + IRQ */
+#define local_firq_save(x)					\
+	({							\
+		unsigned long temp;				\
+		(void) (&temp == &x);				\
+	__asm__ __volatile__(					\
+	"mrs	%0, cpsr		@ local_firq_save\n"	\
+"	orr	%1, %0, #0xC0\n"				\
+"	msr	cpsr_c, %1"					\
+	: "=r" (x), "=r" (temp)					\
+	:							\
+	: "memory", "cc");					\
+	})
+
+/*
+ * Enable IRQs
+ */
+#define local_irq_enable()					\
+	({							\
+		unsigned long temp;				\
+	__asm__ __volatile__(					\
+	"mrs	%0, cpsr		@ local_irq_enable\n"	\
+"	bic	%0, %0, #128\n"					\
+"	msr	cpsr_c, %0"					\
+	: "=r" (temp)						\
+	:							\
+	: "memory", "cc");					\
+	})
+
+/*
+ * Disable IRQs
+ */
+#define local_irq_disable()					\
+	({							\
+		unsigned long temp;				\
+	__asm__ __volatile__(					\
+	"mrs	%0, cpsr		@ local_irq_disable\n"	\
+"	orr	%0, %0, #128\n"					\
+"	msr	cpsr_c, %0"					\
+	: "=r" (temp)						\
+	:							\
+	: "memory", "cc");					\
+	})
+
+/*
+ * Enable FIQs
+ */
+#define local_fiq_enable()					\
+	({							\
+		unsigned long temp;				\
+	__asm__ __volatile__(					\
+	"mrs	%0, cpsr		@ stf\n"		\
+"	bic	%0, %0, #64\n"					\
+"	msr	cpsr_c, %0"					\
+	: "=r" (temp)						\
+	:							\
+	: "memory", "cc");					\
+	})
+
+/*
+ * Disable FIQs
+ */
+#define local_fiq_disable()					\
+	({							\
+		unsigned long temp;				\
+	__asm__ __volatile__(					\
+	"mrs	%0, cpsr		@ clf\n"		\
+"	orr	%0, %0, #64\n"					\
+"	msr	cpsr_c, %0"					\
+	: "=r" (temp)						\
+	:							\
+	: "memory", "cc");					\
+	})
+
+/*
+ * Save the current interrupt enable state.
+ */
+#define local_save_flags(x)					\
+	({							\
+	__asm__ __volatile__(					\
+	"mrs	%0, cpsr		@ local_save_flags"	\
+	: "=r" (x) : : "memory", "cc");				\
+	})
+
+/*
+ * restore saved IRQ & FIQ state
+ */
+#define local_irq_restore(x)					\
+	__asm__ __volatile__(					\
+	"msr	cpsr_c, %0		@ local_irq_restore\n"	\
+	:							\
+	: "r" (x)						\
+	: "memory", "cc")
+
+#define irqs_disabled()			\
+({					\
+	unsigned long flags;		\
+	local_save_flags(flags);	\
+	(int)(flags & PSR_I_BIT);	\
+})
+
+#define __asmeq(x, y)  ".ifnc " x "," y " ; .err ; .endif\n\t"
+
+#endif
diff --git a/src/target/firmware/include/battery/battery.h b/src/target/firmware/include/battery/battery.h
new file mode 100755
index 00000000..4270d7c6
--- /dev/null
+++ b/src/target/firmware/include/battery/battery.h
@@ -0,0 +1,37 @@
+#ifndef _BATTERY_BATTERY_H
+#define _BATTERY_BATTERY_H
+
+/* User-visible state of the battery charger.
+ *
+ * If CHG_CONNECTED, power is externally supplied to the mobile.
+ *
+ * If CHG_ENABLED, the charger will try to provide charge
+ * to the battery if needed, but this state might be switchable?
+ *
+ * BATTERY_CHARGING: Battery is not full, so a significant charging
+ * current (not trickle charge) is supplied.
+ *
+ * BATTERY_FAILURE: Overtemperature, overvoltage, ... if this bit
+ * is set, charging should be inhibited.
+ */
+
+
+enum battery_flags {
+	BATTERY_CHG_CONNECTED = 1 << 0,  /* AC adapter is connected */
+	BATTERY_CHG_ENABLED   = 1 << 1,  /* if needed charger could charge */
+	BATTERY_CHARGING      = 1 << 2,  /* charger is actively charging */
+	BATTERY_FAILURE       = 1 << 3,  /* problem exists preventing charge */
+};
+
+struct battery_info {
+	enum battery_flags flags;
+	int charger_volt_mV; /* charger connection voltage */
+	int bat_volt_mV;     /* battery terminal voltage */
+	int bat_chg_curr_mA; /* battery charging current */
+	int battery_percent; /* 0(empty) .. 100(full) */
+};
+
+extern struct battery_info
+battery_info;
+
+#endif
diff --git a/src/target/firmware/include/battery/compal_e88.h b/src/target/firmware/include/battery/compal_e88.h
new file mode 100644
index 00000000..c6c96f39
--- /dev/null
+++ b/src/target/firmware/include/battery/compal_e88.h
@@ -0,0 +1,15 @@
+#ifndef _BATTERY_COMPAL_E88_H
+#define _BATTERY_COMPAL_E88_H
+
+#include <stdint.h>
+#include <abb/twl3025.h>
+
+/* initialize the charger control loop on C123 */
+
+extern void
+battery_compal_e88_init();
+
+extern uint16_t
+compal_e88_madc[MADC_NUM_CHANNELS];
+
+#endif
diff --git a/src/target/firmware/include/board.h b/src/target/firmware/include/board.h
new file mode 100644
index 00000000..4a9657f4
--- /dev/null
+++ b/src/target/firmware/include/board.h
@@ -0,0 +1,8 @@
+#ifndef _BOARD_H
+#define _BOARD_H
+
+extern const char *target_board;
+
+void board_init(int with_irq);
+
+#endif /* _BOARD_H */
diff --git a/src/target/firmware/include/byteorder.h b/src/target/firmware/include/byteorder.h
new file mode 100644
index 00000000..41edb93d
--- /dev/null
+++ b/src/target/firmware/include/byteorder.h
@@ -0,0 +1,79 @@
+#ifndef _LINUX_BYTEORDER_LITTLE_ENDIAN_H
+#define _LINUX_BYTEORDER_LITTLE_ENDIAN_H
+
+#ifndef __LITTLE_ENDIAN
+#define __LITTLE_ENDIAN 1234
+#endif
+#ifndef __LITTLE_ENDIAN_BITFIELD
+#define __LITTLE_ENDIAN_BITFIELD
+#endif
+
+#include <stdint.h>
+#include <swab.h>
+
+#define __constant_htonl(x) ___constant_swab32(x)
+#define __constant_ntohl(x) ___constant_swab32(x)
+#define __constant_htons(x) ___constant_swab16(x)
+#define __constant_ntohs(x) ___constant_swab16(x)
+#define __constant_cpu_to_le64(x) (x)
+#define __constant_le64_to_cpu(x) (x)
+#define __constant_cpu_to_le32(x) (x)
+#define __constant_le32_to_cpu(x) (x)
+#define __constant_cpu_to_le16(x) (x)
+#define __constant_le16_to_cpu(x) (x)
+#define __constant_cpu_to_be64(x) ___constant_swab64(x)
+#define __constant_be64_to_cpu(x) ___constant_swab64(x)
+#define __constant_cpu_to_be32(x) ___constant_swab32(x)
+#define __constant_be32_to_cpu(x) ___constant_swab32(x)
+#define __constant_cpu_to_be16(x) ___constant_swab16(x)
+#define __constant_be16_to_cpu(x) ___constant_swab16(x)
+#define __cpu_to_le64(x) (x)
+#define __le64_to_cpu(x) (x)
+#define __cpu_to_le32(x) (x)
+#define __le32_to_cpu(x) (x)
+#define __cpu_to_le16(x) (x)
+#define __le16_to_cpu(x) (x)
+#define __cpu_to_be64(x) __swab64(x)
+#define __be64_to_cpu(x) __swab64(x)
+#define __cpu_to_be32(x) __swab32(x)
+#define __be32_to_cpu(x) __swab32(x)
+#define __cpu_to_be16(x) __swab16(x)
+#define __be16_to_cpu(x) __swab16(x)
+
+/* from include/linux/byteorder/generic.h */
+#define cpu_to_le64 __cpu_to_le64
+#define le64_to_cpu __le64_to_cpu
+#define cpu_to_le32 __cpu_to_le32
+#define le32_to_cpu __le32_to_cpu
+#define cpu_to_le16 __cpu_to_le16
+#define le16_to_cpu __le16_to_cpu
+#define cpu_to_be64 __cpu_to_be64
+#define be64_to_cpu __be64_to_cpu
+#define cpu_to_be32 __cpu_to_be32
+#define be32_to_cpu __be32_to_cpu
+#define cpu_to_be16 __cpu_to_be16
+#define be16_to_cpu __be16_to_cpu
+
+/*
+ * They have to be macros in order to do the constant folding
+ * correctly - if the argument passed into a inline function
+ * it is no longer constant according to gcc..
+ */
+
+#undef ntohl
+#undef ntohs
+#undef htonl
+#undef htons
+
+#define ___htonl(x) __cpu_to_be32(x)
+#define ___htons(x) __cpu_to_be16(x)
+#define ___ntohl(x) __be32_to_cpu(x)
+#define ___ntohs(x) __be16_to_cpu(x)
+
+#define htonl(x) ___htonl(x)
+#define ntohl(x) ___ntohl(x)
+#define htons(x) ___htons(x)
+#define ntohs(x) ___ntohs(x)
+
+
+#endif /* _LINUX_BYTEORDER_LITTLE_ENDIAN_H */
diff --git a/src/target/firmware/include/calypso/backlight.h b/src/target/firmware/include/calypso/backlight.h
new file mode 100644
index 00000000..3a6abd55
--- /dev/null
+++ b/src/target/firmware/include/calypso/backlight.h
@@ -0,0 +1,10 @@
+#ifndef _CAL_BACKLIGHT_H
+#define _CAL_BACKLIGHT_H
+
+/* Switch backlight to PWL mode (or back) */
+void bl_mode_pwl(int on);
+
+/* Set the backlight level */
+void bl_level(uint8_t level);
+
+#endif /* CAL_BACKLIGHT_H */
diff --git a/src/target/firmware/include/calypso/buzzer.h b/src/target/firmware/include/calypso/buzzer.h
new file mode 100644
index 00000000..dcfd3a30
--- /dev/null
+++ b/src/target/firmware/include/calypso/buzzer.h
@@ -0,0 +1,34 @@
+#ifndef _CAL_BUZZER_H
+#define _CAL_BUZZER_H
+
+#define NOTE(n,oct) (n<<2 | (oct & 0x03))
+
+#define NOTE_E 0x00
+#define NOTE_DIS 0x01
+#define NOTE_D 0x02
+#define NOTE_CIS 0x03
+#define NOTE_C 0x04
+#define NOTE_H 0x05
+#define NOTE_AIS 0x06
+#define NOTE_A 0x07
+#define NOTE_GIS 0x08
+#define NOTE_G 0x09
+#define NOTE_FIS 0x0A
+#define NOTE_F 0x0B
+
+#define OCTAVE_5 OCTAVE(0x00)
+#define OCTAVE_4 OCTAVE(0x01)
+#define OCTAVE_3 OCTAVE(0x02)
+#define OCTAVE_2 OCTAVE(0x03)
+#define OCTAVE_1 OCTAVE(0x04)
+
+#define OCTAVE(m) (m>NOTE_C?m+1:m)
+
+/* Switch buzzer to PWT mode (or back) */
+void buzzer_mode_pwt(int on);
+/* Set the buzzer level */
+void buzzer_volume(uint8_t level);
+/* Set the buzzer note */
+void buzzer_note(uint8_t note);
+
+#endif /* _CAL_BUZZER_H */
diff --git a/src/target/firmware/include/calypso/clock.h b/src/target/firmware/include/calypso/clock.h
new file mode 100644
index 00000000..abcfde1d
--- /dev/null
+++ b/src/target/firmware/include/calypso/clock.h
@@ -0,0 +1,67 @@
+#ifndef _CALYPSO_CLK_H
+#define _CALYPSO_CLK_H
+
+#include <stdint.h>
+
+#define CALYPSO_PLL26_52_MHZ	((2 << 8) | 0)
+#define CALYPSO_PLL26_86_7_MHZ	((10 << 8) | 2)
+#define CALYPSO_PLL26_87_MHZ	((3 << 8) | 0)
+#define CALYPSO_PLL13_104_MHZ	((8 << 8) | 0)
+
+enum mclk_div {
+	_ARM_MCLK_DIV_1		= 0,
+	ARM_MCLK_DIV_1		= 1,
+	ARM_MCLK_DIV_2		= 2,
+	ARM_MCLK_DIV_3		= 3,
+	ARM_MCLK_DIV_4		= 4,
+	ARM_MCLK_DIV_5		= 5,
+	ARM_MCLK_DIV_6		= 6,
+	ARM_MCLK_DIV_7		= 7,
+	ARM_MCLK_DIV_1_5	= 0x80 | 1,
+	ARM_MCLK_DIV_2_5	= 0x80 | 2,
+};
+
+void calypso_clock_set(uint8_t vtcxo_div2, uint16_t inp, enum mclk_div mclk_div);
+void calypso_pll_set(uint16_t inp);
+void calypso_clk_dump(void);
+
+/* CNTL_RST */
+enum calypso_rst {
+	RESET_DSP	= (1 << 1),
+	RESET_EXT	= (1 << 2),
+	RESET_WDOG	= (1 << 3),
+};
+
+void calypso_reset_set(enum calypso_rst calypso_rst, int active);
+int calypso_reset_get(enum calypso_rst);
+
+enum calypso_bank {
+	CALYPSO_nCS0	= 0,
+	CALYPSO_nCS1	= 2,
+	CALYPSO_nCS2	= 4,
+	CALYPSO_nCS3	= 6,
+	CALYPSO_nCS7	= 8,
+	CALYPSO_CS4	= 0xa,
+	CALYPSO_nCS6	= 0xc,
+};
+
+enum calypso_mem_width {
+	CALYPSO_MEM_8bit	= 0,
+	CALYPSO_MEM_16bit	= 1,
+	CALYPSO_MEM_32bit	= 2,
+};
+
+void calypso_mem_cfg(enum calypso_bank bank, uint8_t ws,
+		     enum calypso_mem_width width, int we);
+
+/* Enable or disable the internal bootrom mapped to 0x0000'0000 */
+void calypso_bootrom(int enable);
+
+/* Enable or disable the debug unit */
+void calypso_debugunit(int enable);
+
+/* configure the RHEA bus bridge[s] */
+void calypso_rhea_cfg(uint8_t fac0, uint8_t fac1, uint8_t timeout,
+		      uint8_t ws_h, uint8_t ws_l, uint8_t w_en0, uint8_t w_en1);
+
+#endif /* _CALYPSO_CLK_H */
diff --git a/src/target/firmware/include/calypso/dma.h b/src/target/firmware/include/calypso/dma.h
new file mode 100644
index 00000000..00b9bde7
--- /dev/null
+++ b/src/target/firmware/include/calypso/dma.h
@@ -0,0 +1,6 @@
+#ifndef _CALYPSO_DMA_H
+#define _CALYPSO_DMA_H
+
+void dma_init(void);
+
+#endif /* _CALYPSO_DMA_H */
diff --git a/src/target/firmware/include/calypso/dsp.h b/src/target/firmware/include/calypso/dsp.h
new file mode 100644
index 00000000..4f391a7a
--- /dev/null
+++ b/src/target/firmware/include/calypso/dsp.h
@@ -0,0 +1,50 @@
+#ifndef _CALYPSO_DSP_H
+#define _CALYPSO_DSP_H
+
+#include <calypso/dsp_api.h>
+#include <rffe.h>
+
+#define CAL_DSP_TGT_BB_LVL	80
+
+struct gsm_time;
+
+struct dsp_api {
+	T_NDB_MCU_DSP *ndb;
+	T_DB_DSP_TO_MCU *db_r;
+	T_DB_MCU_TO_DSP *db_w;
+	T_PARAM_MCU_DSP *param;
+	int r_page;
+	int w_page;
+	int r_page_used;
+	int frame_ctr;
+};
+
+extern struct dsp_api dsp_api;
+
+void dsp_power_on(void);
+void dsp_dump_version(void);
+void dsp_dump(void);
+void dsp_checksum_task(void);
+void dsp_api_memset(uint16_t *ptr, int octets);
+void dsp_memcpy_to_api(volatile uint16_t *dsp_buf, const uint8_t *mcu_buf, int n, int be);
+void dsp_memcpy_from_api(uint8_t *mcu_buf, const volatile uint16_t *dsp_buf, int n, int be);
+void dsp_load_afc_dac(uint16_t afc);
+void dsp_load_apc_dac(uint16_t apc);
+void dsp_load_tch_param(struct gsm_time *next_time,
+                        uint8_t chan_mode, uint8_t chan_type, uint8_t chan_sub,
+                        uint8_t tch_loop, uint8_t sync_tch, uint8_t tn);
+void dsp_load_ciph_param(int mode, uint8_t *key);
+void dsp_end_scenario(void);
+
+void dsp_load_rx_task(uint16_t task, uint8_t burst_id, uint8_t tsc);
+void dsp_load_tx_task(uint16_t task, uint8_t burst_id, uint8_t tsc);
+
+static inline uint16_t
+dsp_task_iq_swap(uint16_t dsp_task, uint16_t band_arfcn, int tx)
+{
+	if (rffe_iq_swapped(band_arfcn, tx))
+		dsp_task |= 0x8000;
+	return dsp_task;
+}
+
+#endif
diff --git a/src/target/firmware/include/calypso/dsp_api.h b/src/target/firmware/include/calypso/dsp_api.h
new file mode 100644
index 00000000..f9751f37
--- /dev/null
+++ b/src/target/firmware/include/calypso/dsp_api.h
@@ -0,0 +1,1560 @@
+#ifndef _CAL_DSP_API_H
+#define _CAL_DSP_API_H
+
+/* This is a header file with structures imported from the TSM30 source code (l1_defty.h)
+ *
+ * As this header file only is a list of definitions and data structures, it is
+ * not ocnsidered to be a copyrightable work itself.
+ *
+ * Nonetheless, it might be good to rewrite it (without ugly typedefs!) */
+
+#if(L1_DYN_DSP_DWNLD == 1)
+  #include "l1_dyn_dwl_defty.h"
+#endif
+
+/* Include a header file that defines everything this l1_defty.h needs */
+#include "l1_environment.h"
+
+#define BASE_API_NDB		0xFFD001A8L	/* 268 words */
+#define BASE_API_PARAM		0xFFD00862L	/* 57 words */
+#define BASE_API_R_PAGE_0	0xFFD00050L	/* 20 words */
+#define BASE_API_R_PAGE_1	0xFFD00078L	/* 20 words */
+#define BASE_API_W_PAGE_0	0xFFD00000L	/* 20 words */
+#define BASE_API_W_PAGE_1	0xFFD00028L	/* 20 words */
+
+
+/***********************************************************/
+/*                                                         */
+/*  Data structure for global info components.             */
+/*                                                         */
+/***********************************************************/
+
+typedef struct
+{
+  API d_task_d;           // (0) Downlink task command.
+  API d_burst_d;          // (1) Downlink burst identifier.
+  API d_task_u;           // (2) Uplink task command.
+  API d_burst_u;          // (3) Uplink burst identifier.
+  API d_task_md;          // (4) Downlink Monitoring (FB/SB) command.
+#if (DSP == 33) || (DSP == 34) || (DSP == 35) || (DSP == 36)
+  API d_background;       // (5) Background tasks
+#else
+  API d_reserved;         // (5) Reserved
+#endif
+  API d_debug;            // (6) Debug/Acknowledge/general purpose word.
+  API d_task_ra;          // (7) RA task command.
+  API d_fn;               // (8)  FN, in Rep. period and FN%104, used for TRAFFIC/TCH only.
+                             //        bit [0..7]  -> b_fn_report, FN in the normalized reporting period.
+                             //        bit [8..15] -> b_fn_sid,    FN % 104, used for SID positionning.
+  API d_ctrl_tch;         // (9)  Tch channel description.
+                             //        bit [0..3]  -> b_chan_mode,    channel  mode.
+                             //        bit [4..5]  -> b_chan_type,    channel type.
+                             //        bit [6]     -> reset SACCH
+                             //        bit [7]     -> vocoder ON
+                             //        bit [8]     -> b_sync_tch_ul,  synchro. TCH/UL.
+                             //        bit [9]     -> b_sync_tch_dl,  synchro. TCH/DL.
+                             //        bit [10]    -> b_stop_tch_ul,  stop TCH/UL.
+                             //        bit [11]    -> b_stop_tch_dl,  stop TCH/DL.
+                             //        bit [12.13] -> b_tch_loop,     tch loops A/B/C.
+  API hole;               // (10) unused hole.
+
+#if ((ANLG_FAM == 1) || (ANLG_FAM == 2) || (ANLG_FAM == 3))
+  API d_ctrl_abb;         // (11) Bit field indicating the analog baseband register to send.
+                             //        bit [0]     -> b_ramp: the ramp information(a_ramp[]) is located in NDB
+                             //        bit [1.2]   -> unused
+                             //        bit [3]     -> b_apcdel: delays-register in NDB
+                             //        bit [4]     -> b_afc: freq control register in DB
+                             //        bit [5..15] -> unused
+#endif
+  API a_a5fn[2];          // (12..13) Encryption Frame number.
+                             //        word 0, bit [0..4]  -> T2.
+                             //        word 0, bit [5..10] -> T3.
+                             //        word 1, bit [0..11] -> T1.
+  API d_power_ctl;        // (14) Power level control.
+  API d_afc;              // (15) AFC value (enabled by "b_afc" in "d_ctrl_TCM4400 or in d_ctrl_abb").
+  API d_ctrl_system;      // (16) Controle Register for RESET/RESUME.
+                             //        bit [0..2] -> b_tsq,           training sequence.
+                             //        bit [3]    -> b_bcch_freq_ind, BCCH frequency indication.
+                             //        bit [15]   -> b_task_abort,    DSP task abort command.
+}
+T_DB_MCU_TO_DSP;
+
+typedef struct
+{
+  API d_task_d;           // (0) Downlink task command.
+  API d_burst_d;          // (1) Downlink burst identifier.
+  API d_task_u;           // (2) Uplink task command.
+  API d_burst_u;          // (3) Uplink burst identifier.
+  API d_task_md;          // (4) Downlink Monitoring (FB/SB) task command.
+#if (DSP == 33) || (DSP == 34) || (DSP == 35) || (DSP == 36)
+  API d_background;       // (5) Background tasks
+#else
+  API d_reserved;         // (5) Reserved
+#endif
+  API d_debug;            // (6) Debug/Acknowledge/general purpose word.
+  API d_task_ra;          // (7) RA task command.
+
+#if (DSP == 33) || (DSP == 34) || (DSP == 35) || (DSP == 36)
+  API a_serv_demod[4];    // ( 8..11) Serv. cell demod. result, array of 4 words (D_TOA,D_PM,D_ANGLE,D_SNR).
+  API a_pm[3];            // (12..14) Power measurement results, array of 3 words.
+  API a_sch[5];           // (15..19) Header + SB information, array of  5 words.
+#else
+  API a_pm[3];            // ( 8..10) Power measurement results, array of 3 words.
+  API a_serv_demod[4];    // (11..14) Serv. cell demod. result, array of 4 words (D_TOA,D_PM,D_ANGLE,D_SNR).
+  API a_sch[5];           // (15..19) Header + SB information, array of  5 words.
+#endif
+}
+T_DB_DSP_TO_MCU;
+
+#if (DSP == 34) || (DSP == 35) || (DSP == 36) // NDB GSM
+  typedef struct
+  {
+    // MISC Tasks
+    API d_dsp_page;
+
+    // DSP status returned (DSP --> MCU).
+    API d_error_status;
+
+    // RIF control (MCU -> DSP).
+    API d_spcx_rif;
+
+    API d_tch_mode;  // TCH mode register.
+                     // bit [0..1]  -> b_dai_mode.
+                     // bit [2]     -> b_dtx.
+
+    API d_debug1;                // bit 0 at 1 enable dsp f_tx delay for Omega
+
+    API d_dsp_test;
+
+    // Words dedicated to Software version (DSP code + Patch)
+    API d_version_number1;
+    API d_version_number2;
+
+    API d_debug_ptr;
+    API d_debug_bk;
+
+    API d_pll_config;
+
+    // GSM/GPRS DSP Debug trace support
+    API p_debug_buffer;
+    API d_debug_buffer_size;
+    API d_debug_trace_type;
+
+    #if (W_A_DSP_IDLE3 == 1)
+      // DSP report its state: 0 run, 1 Idle1, 2 Idle2, 3 Idle3.
+      API d_dsp_state;
+      // 5 words are reserved for any possible mapping modification
+      API d_hole1_ndb[2];
+    #else
+      // 6 words are reserved for any possible mapping modification
+      API d_hole1_ndb[3];
+    #endif
+
+    #if (AMR == 1)
+      API p_debug_amr;
+    #else
+      API d_hole_debug_amr;
+    #endif
+
+    #if (CHIPSET == 12)
+      #if (DSP == 35) || (DSP == 36)
+        API d_hole2_ndb[1];
+        API d_mcsi_select;
+      #else
+        API d_hole2_ndb[2];
+      #endif
+    #else
+      API d_hole2_ndb[2];
+    #endif
+
+    // New words APCDEL1 and APCDEL2 for 2TX: TX/PRACH combinations
+    API d_apcdel1_bis;
+    API d_apcdel2_bis;
+
+
+    // New registers due to IOTA analog base band
+    API d_apcdel2;
+    API d_vbctrl2;
+    API d_bulgcal;
+
+    // Analog Based Band
+    API d_afcctladd;
+
+    API d_vbuctrl;
+    API d_vbdctrl;
+    API d_apcdel1;
+    API d_apcoff;
+    API d_bulioff;
+    API d_bulqoff;
+    API d_dai_onoff;
+    API d_auxdac;
+
+  #if (ANLG_FAM == 1)
+    API d_vbctrl;
+  #elif ((ANLG_FAM == 2) || (ANLG_FAM == 3))
+    API d_vbctrl1;
+  #endif
+  
+    API d_bbctrl;
+
+    // Monitoring tasks control (MCU <- DSP)
+    // FB task
+    API d_fb_det;           // FB detection result. (1 for FOUND).
+    API d_fb_mode;          // Mode for FB detection algorithm.
+    API a_sync_demod[4];    // FB/SB demod. result, (D_TOA,D_PM,D_ANGLE,D_SNR).
+
+    // SB Task
+    API a_sch26[5];         // Header + SB information, array of  5 words.
+
+    API d_audio_gain_ul;
+    API d_audio_gain_dl;
+
+    // Controller of the melody E2 audio compressor
+    API d_audio_compressor_ctrl;
+
+    // AUDIO module
+    API d_audio_init;
+    API d_audio_status;
+
+    // Audio tasks
+    // TONES (MCU -> DSP)
+    API d_toneskb_init;
+    API d_toneskb_status;
+    API d_k_x1_t0;
+    API d_k_x1_t1;
+    API d_k_x1_t2;
+    API d_pe_rep;
+    API d_pe_off;
+    API d_se_off;
+    API d_bu_off;
+    API d_t0_on;
+    API d_t0_off;
+    API d_t1_on;
+    API d_t1_off;
+    API d_t2_on;
+    API d_t2_off;
+    API d_k_x1_kt0;
+    API d_k_x1_kt1;
+    API d_dur_kb;
+    API d_shiftdl;
+    API d_shiftul;
+
+    API d_aec_ctrl;
+
+    API d_es_level_api;
+    API d_mu_api;
+
+    // Melody Ringer module
+    API d_melo_osc_used;
+    API d_melo_osc_active;
+    API a_melo_note0[4];
+    API a_melo_note1[4];
+    API a_melo_note2[4];
+    API a_melo_note3[4];
+    API a_melo_note4[4];
+    API a_melo_note5[4];
+    API a_melo_note6[4];
+    API a_melo_note7[4];
+
+    // selection of the melody format
+    API d_melody_selection;
+
+    // Holes due to the format melody E1
+    API a_melo_holes[3];
+
+    // Speech Recognition module
+    API d_sr_status;          // status of the DSP speech reco task
+    API d_sr_param;           // paramters for the DSP speech reco task: OOV threshold.
+    API d_sr_bit_exact_test;  // bit exact test
+    API d_sr_nb_words;        // number of words used in the speech recognition task
+    API d_sr_db_level;        // estimate voice level in dB
+    API d_sr_db_noise;        // estimate noise in dB
+    API d_sr_mod_size;        // size of the model
+    API a_n_best_words[4];  // array of the 4 best words
+    API a_n_best_score[8];  // array of the 4 best scores (each score is 32 bits length)
+
+    // Audio buffer
+    API a_dd_1[22];         // Header + DATA traffic downlink information, sub. chan. 1.
+    API a_du_1[22];         // Header + DATA traffic uplink information, sub. chan. 1.
+
+    // V42bis module
+    API d_v42b_nego0;
+    API d_v42b_nego1;
+    API d_v42b_control;
+    API d_v42b_ratio_ind;
+    API d_mcu_control;
+    API d_mcu_control_sema;
+
+    // Background tasks
+    API d_background_enable;
+    API d_background_abort;
+    API d_background_state;
+    API d_max_background;
+    API a_background_tasks[16];
+    API a_back_task_io[16];
+
+    // GEA module defined in l1p_deft.h (the following section is overlaid with GPRS NDB memory)
+    API d_gea_mode_ovly;
+    API a_gea_kc_ovly[4];
+
+#if (ANLG_FAM == 3)
+    // SYREN specific registers
+    API d_vbpop;
+    API d_vau_delay_init;
+    API d_vaud_cfg;
+    API d_vauo_onoff;
+    API d_vaus_vol;
+    API d_vaud_pll;
+    API d_hole3_ndb[1];
+#elif ((ANLG_FAM == 1) || (ANLG_FAM == 2))
+
+    API d_hole3_ndb[7];
+
+#endif
+
+    // word used for the init of USF threshold
+    API d_thr_usf_detect;
+
+    // Encryption module
+    API d_a5mode;           // Encryption Mode.
+
+    API d_sched_mode_gprs_ovly;
+
+    // 7 words are reserved for any possible mapping modification
+    API d_hole4_ndb[5];
+
+    // Ramp definition for Omega device
+    API a_ramp[16];
+
+    // CCCH/SACCH downlink information...(!!)
+    API a_cd[15];           // Header + CCCH/SACCH downlink information.
+
+    // FACCH downlink information........(!!)
+    API a_fd[15];           // Header + FACCH downlink information.
+
+    // Traffic downlink data frames......(!!)
+    API a_dd_0[22];         // Header + DATA traffic downlink information, sub. chan. 0.
+
+    // CCCH/SACCH uplink information.....(!!)
+    API a_cu[15];           // Header + CCCH/SACCH uplink information.
+
+    // FACCH downlink information........(!!)
+    API a_fu[15];           // Header + FACCH uplink information
+
+    // Traffic downlink data frames......(!!)
+    API a_du_0[22];         // Header + DATA traffic uplink information, sub. chan. 0.
+
+    // Random access.....................(MCU -> DSP).
+    API d_rach;             // RACH information.
+
+    //...................................(MCU -> DSP).
+    API a_kc[4];            // Encryption Key Code.
+
+    // Integrated Data Services module
+    API d_ra_conf;
+    API d_ra_act;
+    API d_ra_test;
+    API d_ra_statu;
+    API d_ra_statd;
+    API d_fax;
+    API a_data_buf_ul[21];
+    API a_data_buf_dl[37];
+
+  // GTT API mapping for DSP code 34 (for test only)
+  #if (L1_GTT == 1)
+    API d_tty_status;
+    API d_tty_detect_thres;
+    API d_ctm_detect_shift;
+    API d_tty_fa_thres;
+    API d_tty_mod_norm;
+    API d_tty_reset_buffer_ul;
+    API d_tty_loop_ctrl;
+    API p_tty_loop_buffer;
+  #else
+    API a_tty_holes[8];
+  #endif
+
+    API a_sr_holes0[414];
+
+  #if (L1_NEW_AEC)
+    // new AEC
+    API d_cont_filter;
+    API d_granularity_att;
+    API d_coef_smooth;
+    API d_es_level_max;
+    API d_fact_vad;
+    API d_thrs_abs;
+    API d_fact_asd_fil;
+    API d_fact_asd_mut;
+    API d_far_end_pow_h;
+    API d_far_end_pow_l;
+    API d_far_end_noise_h;
+    API d_far_end_noise_l;
+  #else
+    API a_new_aec_holes[12];
+  #endif // L1_NEW_AEC
+
+    // Speech recognition model
+    API a_sr_holes1[145];
+    API d_cport_init;
+    API d_cport_ctrl;
+    API a_cport_cfr[2];
+    API d_cport_tcl_tadt;
+    API d_cport_tdat;
+    API d_cport_tvs;
+    API d_cport_status;
+    API d_cport_reg_value;
+
+    API a_cport_holes[1011];
+
+    API a_model[1041];
+
+    // EOTD buffer
+#if (L1_EOTD==1)
+    API d_eotd_first;
+    API d_eotd_max;
+    API d_eotd_nrj_high;
+    API d_eotd_nrj_low;
+    API a_eotd_crosscor[18];
+#else
+    API a_eotd_holes[22];
+#endif
+    // AMR ver 1.0 buffers
+    API a_amr_config[4];
+    API a_ratscch_ul[6];
+    API a_ratscch_dl[6];
+    API d_amr_snr_est; // estimation of the SNR of the AMR speech block
+  #if (L1_VOICE_MEMO_AMR)
+    API d_amms_ul_voc;
+  #else
+    API a_voice_memo_amr_holes[1];
+  #endif
+    API d_thr_onset_afs;     // thresh detection ONSET AFS
+    API d_thr_sid_first_afs; // thresh detection SID_FIRST AFS
+    API d_thr_ratscch_afs;   // thresh detection RATSCCH AFS
+    API d_thr_update_afs;    // thresh detection SID_UPDATE AFS
+    API d_thr_onset_ahs;     // thresh detection ONSET AHS
+    API d_thr_sid_ahs;       // thresh detection SID frames AHS
+    API d_thr_ratscch_marker;// thresh detection RATSCCH MARKER
+    API d_thr_sp_dgr;   // thresh detection SPEECH DEGRADED/NO_DATA
+    API d_thr_soft_bits;   
+    #if (MELODY_E2)
+      API d_melody_e2_osc_stop;
+      API d_melody_e2_osc_active;
+      API d_melody_e2_semaphore;
+      API a_melody_e2_osc[16][3];
+      API d_melody_e2_globaltimefactor;
+      API a_melody_e2_instrument_ptr[8];
+      API d_melody_e2_deltatime;
+
+      #if (AMR_THRESHOLDS_WORKAROUND)
+        API a_d_macc_thr_afs[8];
+        API a_d_macc_thr_ahs[6];
+      #else
+        API a_melody_e2_holes0[14];
+      #endif
+
+      API a_melody_e2_holes1[693];
+      API a_dsp_trace[SC_AUDIO_MELODY_E2_MAX_SIZE_OF_DSP_TRACE];
+      API a_melody_e2_instrument_wave[SC_AUDIO_MELODY_E2_MAX_SIZE_OF_INSTRUMENT];
+    #else
+      API d_holes[61];
+      #if (AMR_THRESHOLDS_WORKAROUND)
+        API a_d_macc_thr_afs[8];
+        API a_d_macc_thr_ahs[6];
+      #endif
+    #endif
+
+  }
+  T_NDB_MCU_DSP;
+#elif (DSP == 33) // NDB GSM
+  typedef struct
+  {
+    // MISC Tasks
+    API d_dsp_page;
+
+    // DSP status returned (DSP --> MCU).
+    API d_error_status;
+
+    // RIF control (MCU -> DSP).
+    API d_spcx_rif;
+
+    API d_tch_mode;  // TCH mode register.
+                     // bit [0..1]  -> b_dai_mode.
+                     // bit [2]     -> b_dtx.
+
+    API d_debug1;                // bit 0 at 1 enable dsp f_tx delay for Omega
+
+    API d_dsp_test;
+
+    // Words dedicated to Software version (DSP code + Patch)
+    API d_version_number1;
+    API d_version_number2;
+
+    API d_debug_ptr;
+    API d_debug_bk;
+
+    API d_pll_config;
+
+    // GSM/GPRS DSP Debug trace support
+    API p_debug_buffer;
+    API d_debug_buffer_size;
+    API d_debug_trace_type;
+
+    #if (W_A_DSP_IDLE3 == 1)
+      // DSP report its state: 0 run, 1 Idle1, 2 Idle2, 3 Idle3.
+      API d_dsp_state;
+      // 10 words are reserved for any possible mapping modification
+      API d_hole1_ndb[5];
+    #else
+      // 11 words are reserved for any possible mapping modification
+      API d_hole1_ndb[6];
+    #endif
+
+    // New words APCDEL1 and APCDEL2 for 2TX: TX/PRACH combinations
+    API d_apcdel1_bis;
+    API d_apcdel2_bis;
+
+
+    // New registers due to IOTA analog base band
+    API d_apcdel2;
+    API d_vbctrl2;
+    API d_bulgcal;
+
+    // Analog Based Band
+    API d_afcctladd;
+
+    API d_vbuctrl;
+    API d_vbdctrl;
+    API d_apcdel1;
+    API d_apcoff;
+    API d_bulioff;
+    API d_bulqoff;
+    API d_dai_onoff;
+    API d_auxdac;
+
+  #if (ANLG_FAM == 1)
+    API d_vbctrl;
+  #elif ((ANLG_FAM == 2) || (ANLG_FAM == 3))
+    API d_vbctrl1;
+  #endif
+
+    API d_bbctrl;
+
+    // Monitoring tasks control (MCU <- DSP)
+    // FB task
+    API d_fb_det;           // FB detection result. (1 for FOUND).
+    API d_fb_mode;          // Mode for FB detection algorithm.
+    API a_sync_demod[4];    // FB/SB demod. result, (D_TOA,D_PM,D_ANGLE,D_SNR).
+
+    // SB Task
+    API a_sch26[5];         // Header + SB information, array of  5 words.
+
+    API d_audio_gain_ul;
+    API d_audio_gain_dl;
+
+    // Controller of the melody E2 audio compressor
+    API d_audio_compressor_ctrl;
+
+    // AUDIO module
+    API d_audio_init;
+    API d_audio_status;
+
+    // Audio tasks
+    // TONES (MCU -> DSP)
+    API d_toneskb_init;
+    API d_toneskb_status;
+    API d_k_x1_t0;
+    API d_k_x1_t1;
+    API d_k_x1_t2;
+    API d_pe_rep;
+    API d_pe_off;
+    API d_se_off;
+    API d_bu_off;
+    API d_t0_on;
+    API d_t0_off;
+    API d_t1_on;
+    API d_t1_off;
+    API d_t2_on;
+    API d_t2_off;
+    API d_k_x1_kt0;
+    API d_k_x1_kt1;
+    API d_dur_kb;
+    API d_shiftdl;
+    API d_shiftul;
+
+    API d_aec_ctrl;
+
+    API d_es_level_api;
+    API d_mu_api;
+
+    // Melody Ringer module
+    API d_melo_osc_used;
+    API d_melo_osc_active;
+    API a_melo_note0[4];
+    API a_melo_note1[4];
+    API a_melo_note2[4];
+    API a_melo_note3[4];
+    API a_melo_note4[4];
+    API a_melo_note5[4];
+    API a_melo_note6[4];
+    API a_melo_note7[4];
+
+    // selection of the melody format
+    API d_melody_selection;
+
+    // Holes due to the format melody E1
+    API a_melo_holes[3];
+
+    // Speech Recognition module
+    API d_sr_status;          // status of the DSP speech reco task
+    API d_sr_param;           // paramters for the DSP speech reco task: OOV threshold.
+    API d_sr_bit_exact_test;  // bit exact test
+    API d_sr_nb_words;        // number of words used in the speech recognition task
+    API d_sr_db_level;        // estimate voice level in dB
+    API d_sr_db_noise;        // estimate noise in dB
+    API d_sr_mod_size;        // size of the model
+    API a_n_best_words[4];  // array of the 4 best words
+    API a_n_best_score[8];  // array of the 4 best scores (each score is 32 bits length)
+
+    // Audio buffer
+    API a_dd_1[22];         // Header + DATA traffic downlink information, sub. chan. 1.
+    API a_du_1[22];         // Header + DATA traffic uplink information, sub. chan. 1.
+
+    // V42bis module
+    API d_v42b_nego0;
+    API d_v42b_nego1;
+    API d_v42b_control;
+    API d_v42b_ratio_ind;
+    API d_mcu_control;
+    API d_mcu_control_sema;
+
+    // Background tasks
+    API d_background_enable;
+    API d_background_abort;
+    API d_background_state;
+    API d_max_background;
+    API a_background_tasks[16];
+    API a_back_task_io[16];
+
+    // GEA module defined in l1p_deft.h (the following section is overlaid with GPRS NDB memory)
+    API d_gea_mode_ovly;
+    API a_gea_kc_ovly[4];
+
+    API d_hole3_ndb[8];
+
+    // Encryption module
+    API d_a5mode;           // Encryption Mode.
+
+    API d_sched_mode_gprs_ovly;
+
+    // 7 words are reserved for any possible mapping modification
+    API d_hole4_ndb[5];
+
+    // Ramp definition for Omega device
+    API a_ramp[16];
+
+    // CCCH/SACCH downlink information...(!!)
+    API a_cd[15];           // Header + CCCH/SACCH downlink information.
+
+    // FACCH downlink information........(!!)
+    API a_fd[15];           // Header + FACCH downlink information.
+
+    // Traffic downlink data frames......(!!)
+    API a_dd_0[22];         // Header + DATA traffic downlink information, sub. chan. 0.
+
+    // CCCH/SACCH uplink information.....(!!)
+    API a_cu[15];           // Header + CCCH/SACCH uplink information.
+
+    // FACCH downlink information........(!!)
+    API a_fu[15];           // Header + FACCH uplink information
+
+    // Traffic downlink data frames......(!!)
+    API a_du_0[22];         // Header + DATA traffic uplink information, sub. chan. 0.
+
+    // Random access.....................(MCU -> DSP).
+    API d_rach;             // RACH information.
+
+    //...................................(MCU -> DSP).
+    API a_kc[4];            // Encryption Key Code.
+
+    // Integrated Data Services module
+    API d_ra_conf;
+    API d_ra_act;
+    API d_ra_test;
+    API d_ra_statu;
+    API d_ra_statd;
+    API d_fax;
+    API a_data_buf_ul[21];
+    API a_data_buf_dl[37];
+
+  #if (L1_NEW_AEC)
+    // new AEC
+    API a_new_aec_holes[422];
+    API d_cont_filter;
+    API d_granularity_att;
+    API d_coef_smooth;
+    API d_es_level_max;
+    API d_fact_vad;
+    API d_thrs_abs;
+    API d_fact_asd_fil;
+    API d_fact_asd_mut;
+    API d_far_end_pow_h;
+    API d_far_end_pow_l;
+    API d_far_end_noise_h;
+    API d_far_end_noise_l;
+  #endif
+
+  // Speech recognition model
+  #if (L1_NEW_AEC)
+    API a_sr_holes[1165];
+  #else
+    API a_sr_holes[1599];
+  #endif // L1_NEW_AEC
+    API a_model[1041];
+
+    // EOTD buffer
+    #if (L1_EOTD==1)
+      API d_eotd_first;
+      API d_eotd_max;
+      API d_eotd_nrj_high;
+      API d_eotd_nrj_low;
+      API a_eotd_crosscor[18];
+    #else
+      API a_eotd_holes[22];
+    #endif
+
+    #if (MELODY_E2)
+      API a_melody_e2_holes0[27];
+      API d_melody_e2_osc_used;
+      API d_melody_e2_osc_active;
+      API d_melody_e2_semaphore;
+      API a_melody_e2_osc[16][3];
+      API d_melody_e2_globaltimefactor;
+      API a_melody_e2_instrument_ptr[8];
+      API a_melody_e2_holes1[708];
+      API a_dsp_trace[SC_AUDIO_MELODY_E2_MAX_SIZE_OF_DSP_TRACE];
+      API a_melody_e2_instrument_wave[SC_AUDIO_MELODY_E2_MAX_SIZE_OF_INSTRUMENT];
+    #endif
+  }
+  T_NDB_MCU_DSP;
+
+#elif ((DSP == 32) || (DSP == 31))
+  typedef struct
+  {
+    // Monitoring tasks control..........(MCU <- DSP)
+    API d_fb_det;           // FB detection result. (1 for FOUND).
+    API d_fb_mode;          // Mode for FB detection algorithm.
+    API a_sync_demod[4];    // FB/SB demod. result, (D_TOA,D_PM,D_ANGLE,D_SNR).
+
+    // CCCH/SACCH downlink information...(!!)
+    API a_cd[15];           // Header + CCCH/SACCH downlink information.
+
+    // FACCH downlink information........(!!)
+    API a_fd[15];           // Header + FACCH downlink information.
+
+    // Traffic downlink data frames......(!!)
+    API a_dd_0[22];         // Header + DATA traffic downlink information, sub. chan. 0.
+    API a_dd_1[22];         // Header + DATA traffic downlink information, sub. chan. 1.
+
+    // CCCH/SACCH uplink information.....(!!)
+    API a_cu[15];           // Header + CCCH/SACCH uplink information.
+
+    #if (SPEECH_RECO)
+      // FACCH downlink information........(!!)
+      API a_fu[3];              // Header + FACCH uplink information
+                                // The size of this buffer is 15 word but some speech reco words
+                                // are overlayer with this buffer. This is the reason why the size is 3 instead of 15.
+      API d_sr_status;          // status of the DSP speech reco task
+      API d_sr_param;           // paramters for the DSP speech reco task: OOV threshold.
+      API sr_hole1;             // hole
+      API d_sr_bit_exact_test;  // bit exact test
+      API d_sr_nb_words;        // number of words used in the speech recognition task
+      API d_sr_db_level;        // estimate voice level in dB
+      API d_sr_db_noise;        // estimate noise in dB
+      API d_sr_mod_size;        // size of the model
+      API sr_holes_1[4];        // hole
+    #else
+      // FACCH downlink information........(!!)
+      API a_fu[15];           // Header + FACCH uplink information
+    #endif
+
+    // Traffic uplink data frames........(!!)
+    API a_du_0[22];         // Header + DATA traffic uplink information, sub. chan. 0.
+    API a_du_1[22];         // Header + DATA traffic uplink information, sub. chan. 1.
+
+    // Random access.....................(MCU -> DSP).
+    API d_rach;             // RACH information.
+
+    //...................................(MCU -> DSP).
+    API d_a5mode;           // Encryption Mode.
+    API a_kc[4];            // Encryption Key Code.
+    API d_tch_mode;         // TCH mode register.
+                            //   bit [0..1]  -> b_dai_mode.
+                            //   bit [2]     -> b_dtx.
+
+  // OMEGA...........................(MCU -> DSP).
+  #if ((ANLG_FAM == 1) || (ANLG_FAM == 2))
+    API a_ramp[16];
+    #if (MELODY_E1)
+      API d_melo_osc_used;
+      API d_melo_osc_active;
+      API a_melo_note0[4];
+      API a_melo_note1[4];
+      API a_melo_note2[4];
+      API a_melo_note3[4];
+      API a_melo_note4[4];
+      API a_melo_note5[4];
+      API a_melo_note6[4];
+      API a_melo_note7[4];
+      #if (DSP==31)
+        // selection of the melody format
+        API d_melody_selection;
+        API holes[9];
+      #else // DSP==32
+        API d_dco_type;               // Tide
+        API p_start_IQ;
+        API d_level_off;
+        API d_dco_dbg;
+        API d_tide_resa;
+        API d_asynch_margin;          // Perseus Asynch Audio Workaround
+        API hole[4];
+      #endif // DSP 32
+
+    #else // NO MELODY E1
+      #if (DSP==31)
+      // selection of the melody format
+      API d_melody_selection;
+      API holes[43];               // 43 unused holes.
+      #else // DSP==32
+        API holes[34];               // 34 unused holes.
+        API d_dco_type;               // Tide
+        API p_start_IQ;
+        API d_level_off;
+        API d_dco_dbg;
+        API d_tide_resa;
+        API d_asynch_margin;          // Perseus Asynch Audio Workaround
+        API hole[4];
+      #endif //DSP == 32
+    #endif // NO MELODY E1
+
+    API d_debug3;
+    API d_debug2;
+    API d_debug1;                // bit 0 at 1 enable dsp f_tx delay for Omega
+    API d_afcctladd;
+    API d_vbuctrl;
+    API d_vbdctrl;
+    API d_apcdel1;
+    API d_aec_ctrl;
+    API d_apcoff;
+    API d_bulioff;
+    API d_bulqoff;
+    API d_dai_onoff;
+    API d_auxdac;
+
+    #if (ANLG_FAM == 1)
+      API d_vbctrl;
+    #elif (ANLG_FAM == 2)
+      API d_vbctrl1;
+    #endif
+
+    API d_bbctrl;
+  #else 
+    #error DSPCODE not supported with given ANALOG
+  #endif //(ANALOG)1, 2
+    //...................................(MCU -> DSP).
+    API a_sch26[5];         // Header + SB information, array of  5 words.
+
+    // TONES.............................(MCU -> DSP)
+    API d_toneskb_init;
+    API d_toneskb_status;
+    API d_k_x1_t0;
+    API d_k_x1_t1;
+    API d_k_x1_t2;
+    API d_pe_rep;
+    API d_pe_off;
+    API d_se_off;
+    API d_bu_off;
+    API d_t0_on;
+    API d_t0_off;
+    API d_t1_on;
+    API d_t1_off;
+    API d_t2_on;
+    API d_t2_off;
+    API d_k_x1_kt0;
+    API d_k_x1_kt1;
+    API d_dur_kb;
+
+    // PLL...............................(MCU -> DSP).
+    API d_pll_clkmod1;
+    API d_pll_clkmod2;
+
+    // DSP status returned..........(DSP --> MCU).
+    API d_error_status;
+
+    // RIF control.......................(MCU -> DSP).
+    API d_spcx_rif;
+
+    API d_shiftdl;
+    API d_shiftul;
+
+    API p_saec_prog;
+    API p_aec_prog;
+    API p_spenh_prog;
+
+    API a_ovly[75];
+    API d_ra_conf;
+    API d_ra_act;
+    API d_ra_test;
+    API d_ra_statu;
+    API d_ra_statd;
+    API d_fax;
+    #if (SPEECH_RECO)
+      API a_data_buf_ul[3];
+      API a_n_best_words[4];  // array of the 4 best words
+      API a_n_best_score[8];  // array of the 4 best scores (each score is 32 bits length)
+      API sr_holes_2[6];
+      API a_data_buf_dl[37];
+
+      API a_hole[24];
+
+      API d_sched_mode_gprs_ovly;
+
+      API fir_holes1[384];
+      API a_fir31_uplink[31];
+      API a_fir31_downlink[31];
+      API d_audio_init;
+      API d_audio_status;
+
+      API a_model[1041];  // array of the speech reco model
+    #else
+      API a_data_buf_ul[21];
+      API a_data_buf_dl[37];
+
+      API a_hole[24];
+
+      API d_sched_mode_gprs_ovly;
+
+      API fir_holes1[384];
+      API a_fir31_uplink[31];
+      API a_fir31_downlink[31];
+      API d_audio_init;
+      API d_audio_status;
+
+#if (L1_EOTD ==1)
+      API a_eotd_hole[369];
+
+      API d_eotd_first;
+      API d_eotd_max;
+      API d_eotd_nrj_high;
+      API d_eotd_nrj_low;
+      API a_eotd_crosscor[18];
+#endif
+    #endif
+  }
+  T_NDB_MCU_DSP;
+
+
+#else // OTHER DSP CODE like 17
+
+typedef struct
+{
+  // Monitoring tasks control..........(MCU <- DSP)
+  API d_fb_det;           // FB detection result. (1 for FOUND).
+  API d_fb_mode;          // Mode for FB detection algorithm.
+  API a_sync_demod[4];    // FB/SB demod. result, (D_TOA,D_PM,D_ANGLE,D_SNR).
+
+  // CCCH/SACCH downlink information...(!!)
+  API a_cd[15];           // Header + CCCH/SACCH downlink information.
+
+  // FACCH downlink information........(!!)
+  API a_fd[15];           // Header + FACCH downlink information.
+
+  // Traffic downlink data frames......(!!)
+  #if (DATA14_4 == 0)
+    API a_dd_0[20];         // Header + DATA traffic downlink information, sub. chan. 0.
+    API a_dd_1[20];         // Header + DATA traffic downlink information, sub. chan. 1.
+  #endif
+  #if (DATA14_4 == 1)
+    API a_dd_0[22];         // Header + DATA traffic downlink information, sub. chan. 0.
+    API a_dd_1[22];         // Header + DATA traffic downlink information, sub. chan. 1.
+  #endif
+
+  // CCCH/SACCH uplink information.....(!!)
+  API a_cu[15];           // Header + CCCH/SACCH uplink information.
+
+  #if (SPEECH_RECO)
+    // FACCH downlink information........(!!)
+    API a_fu[3];              // Header + FACCH uplink information
+                              // The size of this buffer is 15 word but some speech reco words
+                              // are overlayer with this buffer. This is the reason why the size is 3 instead of 15.
+    API d_sr_status;          // status of the DSP speech reco task
+    API d_sr_param;           // paramters for the DSP speech reco task: OOV threshold.
+    API sr_hole1;             // hole
+    API d_sr_bit_exact_test;  // bit exact test
+    API d_sr_nb_words;        // number of words used in the speech recognition task
+    API d_sr_db_level;        // estimate voice level in dB
+    API d_sr_db_noise;        // estimate noise in dB
+    API d_sr_mod_size;        // size of the model
+    API sr_holes_1[4];        // hole
+  #else
+    // FACCH downlink information........(!!)
+    API a_fu[15];           // Header + FACCH uplink information
+  #endif
+
+  // Traffic uplink data frames........(!!)
+  #if (DATA14_4 == 0)
+    API a_du_0[20];         // Header + DATA traffic uplink information, sub. chan. 0.
+    API a_du_1[20];         // Header + DATA traffic uplink information, sub. chan. 1.
+  #endif
+  #if (DATA14_4 == 1)
+    API a_du_0[22];         // Header + DATA traffic uplink information, sub. chan. 0.
+    API a_du_1[22];         // Header + DATA traffic uplink information, sub. chan. 1.
+  #endif
+
+  // Random access.....................(MCU -> DSP).
+  API d_rach;             // RACH information.
+
+  //...................................(MCU -> DSP).
+  API d_a5mode;           // Encryption Mode.
+  API a_kc[4];            // Encryption Key Code.
+  API d_tch_mode;         // TCH mode register.
+                               //        bit [0..1]  -> b_dai_mode.
+                               //        bit [2]     -> b_dtx.
+
+  // OMEGA...........................(MCU -> DSP).
+
+#if ((ANLG_FAM == 1) || (ANLG_FAM == 2))
+  API a_ramp[16];
+  #if (MELODY_E1)
+    API d_melo_osc_used;
+    API d_melo_osc_active;
+    API a_melo_note0[4];
+    API a_melo_note1[4];
+    API a_melo_note2[4];
+    API a_melo_note3[4];
+    API a_melo_note4[4];
+    API a_melo_note5[4];
+    API a_melo_note6[4];
+    API a_melo_note7[4];
+    #if (DSP == 17)
+    // selection of the melody format
+      API d_dco_type;               // Tide
+      API p_start_IQ;
+      API d_level_off;
+      API d_dco_dbg;
+      API d_tide_resa;
+      API d_asynch_margin;          // Perseus Asynch Audio Workaround
+      API hole[4];
+    #else
+      API d_melody_selection;
+      API holes[9];
+    #endif
+  #else // NO MELODY E1
+    // selection of the melody format
+    #if (DSP == 17)
+      API holes[34];               // 34 unused holes.
+      API d_dco_type;               // Tide
+      API p_start_IQ;
+      API d_level_off;
+      API d_dco_dbg;
+      API d_tide_resa;
+      API d_asynch_margin;          // Perseus Asynch Audio Workaround
+      API hole[4]
+    #else
+      // selection of the melody format
+      API d_melody_selection;
+      API holes[43];               // 43 unused holes.
+    #endif
+  #endif
+  API d_debug3;
+  API d_debug2;
+  API d_debug1;                // bit 0 at 1 enable dsp f_tx delay for Omega
+  API d_afcctladd;
+  API d_vbuctrl;
+  API d_vbdctrl;
+  API d_apcdel1;
+  API d_aec_ctrl;
+  API d_apcoff;
+  API d_bulioff;
+  API d_bulqoff;
+  API d_dai_onoff;
+  API d_auxdac;
+  #if (ANLG_FAM == 1)
+    API d_vbctrl;
+  #elif (ANLG_FAM == 2)
+    API d_vbctrl1;
+  #endif
+  API d_bbctrl;
+
+  #else 
+    #error DSPCODE not supported with given ANALOG
+  #endif //(ANALOG)1, 2
+  //...................................(MCU -> DSP).
+  API a_sch26[5];         // Header + SB information, array of  5 words.
+
+  // TONES.............................(MCU -> DSP)
+  API d_toneskb_init;
+  API d_toneskb_status;
+  API d_k_x1_t0;
+  API d_k_x1_t1;
+  API d_k_x1_t2;
+  API d_pe_rep;
+  API d_pe_off;
+  API d_se_off;
+  API d_bu_off;
+  API d_t0_on;
+  API d_t0_off;
+  API d_t1_on;
+  API d_t1_off;
+  API d_t2_on;
+  API d_t2_off;
+  API d_k_x1_kt0;
+  API d_k_x1_kt1;
+  API d_dur_kb;
+
+  // PLL...............................(MCU -> DSP).
+  API d_pll_clkmod1;
+  API d_pll_clkmod2;
+
+  // DSP status returned..........(DSP --> MCU).
+  API d_error_status;
+
+  // RIF control.......................(MCU -> DSP).
+  API d_spcx_rif;
+
+  API d_shiftdl;
+  API d_shiftul;
+
+  #if (AEC == 1)
+    // AEC control.......................(MCU -> DSP).
+    #if (VOC == FR_EFR)
+      API p_aec_init;
+      API p_aec_prog;
+      API p_spenh_init;
+      API p_spenh_prog;
+    #endif
+
+    #if (VOC == FR_HR_EFR)
+      API p_saec_prog;
+      API p_aec_prog;
+      API p_spenh_prog;
+    #endif
+  #endif
+
+    API a_ovly[75];
+    API d_ra_conf;
+    API d_ra_act;
+    API d_ra_test;
+    API d_ra_statu;
+    API d_ra_statd;
+    API d_fax;
+    #if (SPEECH_RECO)
+      API a_data_buf_ul[3];
+      API a_n_best_words[4];  // array of the 4 best words
+      API a_n_best_score[8];  // array of the 4 best scores (each score is 32 bits length)
+      API sr_holes_2[6];
+      API a_data_buf_dl[37];
+
+      API fir_holes1[409];
+      API a_fir31_uplink[31];
+      API a_fir31_downlink[31];
+      API d_audio_init;
+      API d_audio_status;
+      API a_model[1041];  // array of the speech reco model
+    #else
+      API a_data_buf_ul[21];
+      API a_data_buf_dl[37];
+
+      API fir_holes1[409];
+      API a_fir31_uplink[31];
+      API a_fir31_downlink[31];
+      API d_audio_init;
+      API d_audio_status;
+    #endif
+}
+T_NDB_MCU_DSP;
+#endif
+
+#if (DSP == 34) || (DSP == 35) || (DSP == 36)
+typedef struct
+{
+  API_SIGNED d_transfer_rate;
+
+  // Common GSM/GPRS
+  // These words specified the latencies to applies on some peripherics
+  API_SIGNED d_lat_mcu_bridge;
+  API_SIGNED d_lat_mcu_hom2sam;
+  API_SIGNED d_lat_mcu_bef_fast_access;
+  API_SIGNED d_lat_dsp_after_sam;
+
+  // DSP Start address
+  API_SIGNED d_gprs_install_address;
+
+  API_SIGNED d_misc_config;
+
+  API_SIGNED d_cn_sw_workaround;
+
+  API_SIGNED d_hole2_param[4];
+
+    //...................................Frequency Burst.
+  API_SIGNED d_fb_margin_beg;
+  API_SIGNED d_fb_margin_end;
+  API_SIGNED d_nsubb_idle;
+  API_SIGNED d_nsubb_dedic;
+  API_SIGNED d_fb_thr_det_iacq;
+  API_SIGNED d_fb_thr_det_track;
+    //...................................Demodulation.
+  API_SIGNED d_dc_off_thres;
+  API_SIGNED d_dummy_thres;
+  API_SIGNED d_dem_pond_gewl;
+  API_SIGNED d_dem_pond_red;
+
+    //...................................TCH Full Speech.
+  API_SIGNED d_maccthresh1;
+  API_SIGNED d_mldt;
+  API_SIGNED d_maccthresh;
+  API_SIGNED d_gu;
+  API_SIGNED d_go;
+  API_SIGNED d_attmax;
+  API_SIGNED d_sm;
+  API_SIGNED d_b;
+
+  // V42Bis module
+  API_SIGNED d_v42b_switch_hyst;
+  API_SIGNED d_v42b_switch_min;
+  API_SIGNED d_v42b_switch_max;
+  API_SIGNED d_v42b_reset_delay;
+
+  //...................................TCH Half Speech.
+  API_SIGNED d_ldT_hr;
+  API_SIGNED d_maccthresh_hr;
+  API_SIGNED d_maccthresh1_hr;
+  API_SIGNED d_gu_hr;
+  API_SIGNED d_go_hr;
+  API_SIGNED d_b_hr;
+  API_SIGNED d_sm_hr;
+  API_SIGNED d_attmax_hr;
+
+  //...................................TCH Enhanced FR Speech.
+  API_SIGNED c_mldt_efr;
+  API_SIGNED c_maccthresh_efr;
+  API_SIGNED c_maccthresh1_efr;
+  API_SIGNED c_gu_efr;
+  API_SIGNED c_go_efr;
+  API_SIGNED c_b_efr;
+  API_SIGNED c_sm_efr;
+  API_SIGNED c_attmax_efr;
+
+  //...................................CHED
+  API_SIGNED d_sd_min_thr_tchfs;
+  API_SIGNED d_ma_min_thr_tchfs;
+  API_SIGNED d_md_max_thr_tchfs;
+  API_SIGNED d_md1_max_thr_tchfs;
+
+  API_SIGNED d_sd_min_thr_tchhs;
+  API_SIGNED d_ma_min_thr_tchhs;
+  API_SIGNED d_sd_av_thr_tchhs;
+  API_SIGNED d_md_max_thr_tchhs;
+  API_SIGNED d_md1_max_thr_tchhs;
+
+  API_SIGNED d_sd_min_thr_tchefs;
+  API_SIGNED d_ma_min_thr_tchefs;
+  API_SIGNED d_md_max_thr_tchefs;
+  API_SIGNED d_md1_max_thr_tchefs;
+
+  API_SIGNED d_wed_fil_ini;
+  API_SIGNED d_wed_fil_tc;
+  API_SIGNED d_x_min;
+  API_SIGNED d_x_max;
+  API_SIGNED d_slope;
+  API_SIGNED d_y_min;
+  API_SIGNED d_y_max;
+  API_SIGNED d_wed_diff_threshold;
+  API_SIGNED d_mabfi_min_thr_tchhs;
+
+  // FACCH module
+  API_SIGNED d_facch_thr;
+
+  // IDS module
+  API_SIGNED d_max_ovsp_ul;
+  API_SIGNED d_sync_thres;
+  API_SIGNED d_idle_thres;
+  API_SIGNED d_m1_thres;
+  API_SIGNED d_max_ovsp_dl;
+  API_SIGNED d_gsm_bgd_mgt;
+
+  // FIR coefficients
+  API a_fir_holes[4];
+  API a_fir31_uplink[31];
+  API a_fir31_downlink[31];
+}
+T_PARAM_MCU_DSP;
+#elif (DSP == 33)
+typedef struct
+{
+  API_SIGNED d_transfer_rate;
+
+  // Common GSM/GPRS
+  // These words specified the latencies to applies on some peripherics
+  API_SIGNED d_lat_mcu_bridge;
+  API_SIGNED d_lat_mcu_hom2sam;
+  API_SIGNED d_lat_mcu_bef_fast_access;
+  API_SIGNED d_lat_dsp_after_sam;
+
+  // DSP Start address
+  API_SIGNED d_gprs_install_address;
+
+  API_SIGNED d_misc_config;
+
+  API_SIGNED d_cn_sw_workaround;
+
+  #if DCO_ALGO
+    API_SIGNED d_cn_dco_param;
+
+    API_SIGNED d_hole2_param[3];
+  #else
+    API_SIGNED d_hole2_param[4];
+  #endif
+
+    //...................................Frequency Burst.
+  API_SIGNED d_fb_margin_beg;
+  API_SIGNED d_fb_margin_end;
+  API_SIGNED d_nsubb_idle;
+  API_SIGNED d_nsubb_dedic;
+  API_SIGNED d_fb_thr_det_iacq;
+  API_SIGNED d_fb_thr_det_track;
+    //...................................Demodulation.
+  API_SIGNED d_dc_off_thres;
+  API_SIGNED d_dummy_thres;
+  API_SIGNED d_dem_pond_gewl;
+  API_SIGNED d_dem_pond_red;
+
+    //...................................TCH Full Speech.
+  API_SIGNED d_maccthresh1;
+  API_SIGNED d_mldt;
+  API_SIGNED d_maccthresh;
+  API_SIGNED d_gu;
+  API_SIGNED d_go;
+  API_SIGNED d_attmax;
+  API_SIGNED d_sm;
+  API_SIGNED d_b;
+
+  // V42Bis module
+  API_SIGNED d_v42b_switch_hyst;
+  API_SIGNED d_v42b_switch_min;
+  API_SIGNED d_v42b_switch_max;
+  API_SIGNED d_v42b_reset_delay;
+
+  //...................................TCH Half Speech.
+  API_SIGNED d_ldT_hr;
+  API_SIGNED d_maccthresh_hr;
+  API_SIGNED d_maccthresh1_hr;
+  API_SIGNED d_gu_hr;
+  API_SIGNED d_go_hr;
+  API_SIGNED d_b_hr;
+  API_SIGNED d_sm_hr;
+  API_SIGNED d_attmax_hr;
+
+  //...................................TCH Enhanced FR Speech.
+  API_SIGNED c_mldt_efr;
+  API_SIGNED c_maccthresh_efr;
+  API_SIGNED c_maccthresh1_efr;
+  API_SIGNED c_gu_efr;
+  API_SIGNED c_go_efr;
+  API_SIGNED c_b_efr;
+  API_SIGNED c_sm_efr;
+  API_SIGNED c_attmax_efr;
+
+  //...................................CHED
+  API_SIGNED d_sd_min_thr_tchfs;
+  API_SIGNED d_ma_min_thr_tchfs;
+  API_SIGNED d_md_max_thr_tchfs;
+  API_SIGNED d_md1_max_thr_tchfs;
+
+  API_SIGNED d_sd_min_thr_tchhs;
+  API_SIGNED d_ma_min_thr_tchhs;
+  API_SIGNED d_sd_av_thr_tchhs;
+  API_SIGNED d_md_max_thr_tchhs;
+  API_SIGNED d_md1_max_thr_tchhs;
+
+  API_SIGNED d_sd_min_thr_tchefs;
+  API_SIGNED d_ma_min_thr_tchefs;
+  API_SIGNED d_md_max_thr_tchefs;
+  API_SIGNED d_md1_max_thr_tchefs;
+
+  API_SIGNED d_wed_fil_ini;
+  API_SIGNED d_wed_fil_tc;
+  API_SIGNED d_x_min;
+  API_SIGNED d_x_max;
+  API_SIGNED d_slope;
+  API_SIGNED d_y_min;
+  API_SIGNED d_y_max;
+  API_SIGNED d_wed_diff_threshold;
+  API_SIGNED d_mabfi_min_thr_tchhs;
+
+  // FACCH module
+  API_SIGNED d_facch_thr;
+
+  // IDS module
+  API_SIGNED d_max_ovsp_ul;
+  API_SIGNED d_sync_thres;
+  API_SIGNED d_idle_thres;
+  API_SIGNED d_m1_thres;
+  API_SIGNED d_max_ovsp_dl;
+  API_SIGNED d_gsm_bgd_mgt;
+
+  // FIR coefficients
+  API a_fir_holes[4];
+  API a_fir31_uplink[31];
+  API a_fir31_downlink[31];
+}
+T_PARAM_MCU_DSP;
+
+#else
+
+typedef struct
+{
+    //...................................Frequency Burst.
+  API_SIGNED d_nsubb_idle;
+  API_SIGNED d_nsubb_dedic;
+  API_SIGNED d_fb_thr_det_iacq;
+  API_SIGNED d_fb_thr_det_track;
+    //...................................Demodulation.
+  API_SIGNED d_dc_off_thres;
+  API_SIGNED d_dummy_thres;
+  API_SIGNED d_dem_pond_gewl;
+  API_SIGNED d_dem_pond_red;
+  API_SIGNED hole[1];
+  API_SIGNED d_transfer_rate;
+    //...................................TCH Full Speech.
+  API_SIGNED d_maccthresh1;
+  API_SIGNED d_mldt;
+  API_SIGNED d_maccthresh;
+  API_SIGNED d_gu;
+  API_SIGNED d_go;
+  API_SIGNED d_attmax;
+  API_SIGNED d_sm;
+  API_SIGNED d_b;
+
+  #if (VOC == FR_HR) || (VOC == FR_HR_EFR)
+      //...................................TCH Half Speech.
+    API_SIGNED d_ldT_hr;
+    API_SIGNED d_maccthresh_hr;
+    API_SIGNED d_maccthresh1_hr;
+    API_SIGNED d_gu_hr;
+    API_SIGNED d_go_hr;
+    API_SIGNED d_b_hr;
+    API_SIGNED d_sm_hr;
+    API_SIGNED d_attmax_hr;
+  #endif
+
+  #if (VOC == FR_EFR) || (VOC == FR_HR_EFR)
+      //...................................TCH Enhanced FR Speech.
+    API_SIGNED c_mldt_efr;
+    API_SIGNED c_maccthresh_efr;
+    API_SIGNED c_maccthresh1_efr;
+    API_SIGNED c_gu_efr;
+    API_SIGNED c_go_efr;
+    API_SIGNED c_b_efr;
+    API_SIGNED c_sm_efr;
+    API_SIGNED c_attmax_efr;
+  #endif
+
+    //...................................TCH Full Speech.
+  API_SIGNED d_sd_min_thr_tchfs;
+  API_SIGNED d_ma_min_thr_tchfs;
+  API_SIGNED d_md_max_thr_tchfs;
+  API_SIGNED d_md1_max_thr_tchfs;
+
+  #if (VOC == FR) || (VOC == FR_HR) || (VOC == FR_HR_EFR)
+      //...................................TCH Half Speech.
+    API_SIGNED d_sd_min_thr_tchhs;
+    API_SIGNED d_ma_min_thr_tchhs;
+    API_SIGNED d_sd_av_thr_tchhs;
+    API_SIGNED d_md_max_thr_tchhs;
+    API_SIGNED d_md1_max_thr_tchhs;
+  #endif
+
+  #if (VOC == FR_EFR) || (VOC == FR_HR_EFR)
+      //...................................TCH Enhanced FR Speech.
+    API_SIGNED d_sd_min_thr_tchefs;                       //(24L   *C_POND_RED)
+    API_SIGNED d_ma_min_thr_tchefs;                       //(1200L *C_POND_RED)
+    API_SIGNED d_md_max_thr_tchefs;                       //(2000L *C_POND_RED)
+    API_SIGNED d_md1_max_thr_tchefs;                      //(160L  *C_POND_RED)
+    API_SIGNED d_hole1;
+  #endif
+
+  API_SIGNED d_wed_fil_ini;
+  API_SIGNED d_wed_fil_tc;
+  API_SIGNED d_x_min;
+  API_SIGNED d_x_max;
+  API_SIGNED d_slope;
+  API_SIGNED d_y_min;
+  API_SIGNED d_y_max;
+  API_SIGNED d_wed_diff_threshold;
+  API_SIGNED d_mabfi_min_thr_tchhs;
+  API_SIGNED d_facch_thr;
+  API_SIGNED d_dsp_test;
+
+
+  #if (DATA14_4 == 0 ) || (VOC == FR_HR_EFR)
+    API_SIGNED d_patch_addr1;
+    API_SIGNED d_patch_data1;
+    API_SIGNED d_patch_addr2;
+    API_SIGNED d_patch_data2;
+    API_SIGNED d_patch_addr3;
+    API_SIGNED d_patch_data3;
+    API_SIGNED d_patch_addr4;
+    API_SIGNED d_patch_data4;
+  #endif
+
+    //...................................
+  API_SIGNED d_version_number;    // DSP patch version
+  API_SIGNED d_ti_version;        // customer number. No more used since 1.5
+
+  API_SIGNED d_dsp_page;
+
+  #if IDS
+  API_SIGNED d_max_ovsp_ul;
+  API_SIGNED d_sync_thres;
+  API_SIGNED d_idle_thres;
+  API_SIGNED d_m1_thres;
+  API_SIGNED d_max_ovsp_dl;
+  #endif
+
+
+}
+T_PARAM_MCU_DSP;
+#endif
+
+#if (DSP_DEBUG_TRACE_ENABLE == 1)
+typedef struct
+{
+  API d_debug_ptr_begin;
+  API d_debug_ptr_end;
+}
+T_DB2_DSP_TO_MCU;
+#endif
+
+/* DSP error as per ndb->d_error_status */
+enum dsp_error {
+	DSP_ERR_RHEA		= 0x0001,
+	DSP_ERR_IQ_SAMPLES	= 0x0004,
+	DSP_ERR_DMA_PROG	= 0x0008,
+	DSP_ERR_DMA_TASK	= 0x0010,
+	DSP_ERR_DMA_PEND	= 0x0020,
+	DSP_ERR_VM		= 0x0080,
+	DSP_ERR_DMA_UL_TASK	= 0x0100,
+	DSP_ERR_DMA_UL_PROG	= 0x0200,
+	DSP_ERR_DMA_UL_PEND	= 0x0400,
+	DSP_ERR_STACK_OV	= 0x0800,
+};
+
+/* How an ABB register + value is expressed in the API RAM */
+#define ABB_VAL(reg, val) ( (((reg) & 0x1F) << 1) | (((val) & 0x3FF) << 6) )
+
+/* How an ABB register + value | TRUE is expressed in the API RAM */
+#define ABB_VAL_T(reg, val)	(ABB_VAL(reg, val) | 1)
+
+#endif /* _CAL_DSP_API_H */
diff --git a/src/target/firmware/include/calypso/du.h b/src/target/firmware/include/calypso/du.h
new file mode 100644
index 00000000..f2eae091
--- /dev/null
+++ b/src/target/firmware/include/calypso/du.h
@@ -0,0 +1,32 @@
+/* Calypso DU (Debug Unit) Driver */
+
+/* (C) 2010 by Ingo Albrecht <prom@berlin.ccc.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef _CALYPSO_DU_H
+#define _CALYPSO_DU_H
+
+#include <calypso/clock.h>
+
+void calypso_du_init();
+void calypso_du_stop();
+void calypsu_du_dump();
+
+#endif /* _CALYPSO_DU_H */
diff --git a/src/target/firmware/include/calypso/irq.h b/src/target/firmware/include/calypso/irq.h
new file mode 100644
index 00000000..5ea59797
--- /dev/null
+++ b/src/target/firmware/include/calypso/irq.h
@@ -0,0 +1,49 @@
+#ifndef _CALYPSO_IRQ_H
+#define _CALYPSO_IRQ_H
+
+enum irq_nr {
+	IRQ_WATCHDOG		= 0,
+	IRQ_TIMER1		= 1,
+	IRQ_TIMER2		= 2,
+	IRQ_TSP_RX		= 3,
+	IRQ_TPU_FRAME		= 4,
+	IRQ_TPU_PAGE		= 5,
+	IRQ_SIMCARD		= 6,
+	IRQ_UART_MODEM		= 7,
+	IRQ_KEYPAD_GPIO		= 8,
+	IRQ_RTC_TIMER		= 9,
+	IRQ_RTC_ALARM_I2C	= 10,
+	IRQ_ULPD_GAUGING	= 11,
+	IRQ_EXTERNAL		= 12,
+	IRQ_SPI			= 13,
+	IRQ_DMA			= 14,
+	IRQ_API			= 15,
+	IRQ_SIM_DETECT		= 16,
+	IRQ_EXTERNAL_FIQ	= 17,
+	IRQ_UART_IRDA		= 18,
+	IRQ_ULPD_GSM_TIMER	= 19,
+	IRQ_GEA			= 20,
+	_NR_IRQ
+};
+
+typedef void irq_handler(enum irq_nr nr);
+
+/* initialize IRQ driver and enable interrupts */
+void irq_init(void);
+
+/* enable a certain interrupt */
+void irq_enable(enum irq_nr nr);
+
+/* disable a certain interrupt */
+void irq_disable(enum irq_nr nr);
+
+/* configure a certain interrupt */
+void irq_config(enum irq_nr nr, int fiq, int edge, int8_t prio);
+
+/* register an interrupt handler */
+void irq_register_handler(enum irq_nr nr, irq_handler *handler);
+
+/* Install the exception handlers to where the ROM loader jumps */
+void calypso_exceptions_install(void);
+
+#endif /* _CALYPSO_IRQ_H */
diff --git a/src/target/firmware/include/calypso/l1_environment.h b/src/target/firmware/include/calypso/l1_environment.h
new file mode 100644
index 00000000..d4d442cc
--- /dev/null
+++ b/src/target/firmware/include/calypso/l1_environment.h
@@ -0,0 +1,385 @@
+#include <stdint.h>
+
+typedef unsigned short API;
+typedef signed short API_SIGNED;
+
+#define FAR
+
+#define CHIPSET		12
+#define DSP		36
+#define ANLG_FAM	2	/* Iota */
+
+/* MFTAB */
+#define L1_MAX_FCT	5	/* Max number of fctions in a frame */
+#define MFTAB_SIZE	20
+
+#define NBMAX_CARRIER	174+374	/* Number of carriers (GSM-Ext + DCS */
+
+#define DPAGC_FIFO_LEN	4
+
+#define SIZE_HIST	10
+
+#if !L1_GPRS
+# define NBR_DL_L1S_TASKS 32
+#else
+# define NBR_DL_L1S_TASKS 45
+#endif
+
+#define NBR_L1A_PROCESSES	46
+
+#define W_A_DSP_IDLE3	1
+
+
+
+// Identifier for all DSP tasks.
+// ...RX & TX tasks identifiers.
+#define NO_DSP_TASK        0  // No task.
+#define NP_DSP_TASK       21  // Normal Paging reading task.
+#define EP_DSP_TASK       22  // Extended Paging reading task.
+#define NBS_DSP_TASK      19  // Normal BCCH serving reading task.
+#define EBS_DSP_TASK      20  // Extended BCCH serving reading task.
+#define NBN_DSP_TASK      17  // Normal BCCH neighbour reading task.
+#define EBN_DSP_TASK      18  // Extended BCCH neighbour reading task.
+#define ALLC_DSP_TASK     24  // CCCH reading task while performing FULL BCCH/CCCH reading task.
+#define CB_DSP_TASK       25  // CBCH reading task.
+#define DDL_DSP_TASK      26  // SDCCH/D (data) reading task.
+#define ADL_DSP_TASK      27  // SDCCH/A (SACCH) reading task.
+#define DUL_DSP_TASK      12  // SDCCH/D (data) transmit task.
+#define AUL_DSP_TASK      11  // SDCCH/A (SACCH) transmit task.
+#define RACH_DSP_TASK     10  // RACH transmit task.
+#define TCHT_DSP_TASK     13  // TCH Traffic data DSP task id (RX or TX)
+#define TCHA_DSP_TASK     14  // TCH SACCH   data DSP task id (RX or TX)
+#define TCHD_DSP_TASK     28  // TCH Traffic data DSP task id (RX or TX)
+
+#define TCH_DTX_UL        15  // Replace UL task in DSP->MCU com. to say "burst not transmitted".
+
+#if (L1_GPRS)
+  // Identifier for DSP tasks Packet dedicated.
+  // ...RX & TX tasks identifiers.
+  //------------------------------------------------------------------------
+  // WARNING ... Need to aligned following macro with MCU/DSP GPRS Interface
+  //------------------------------------------------------------------------
+  #define PNP_DSP_TASK      30
+  #define PEP_DSP_TASK      31
+  #define PALLC_DSP_TASK    32
+  #define PBS_DSP_TASK      33
+
+  #define PTCCH_DSP_TASK    33
+
+#endif
+
+// Identifier for measurement, FB / SB search tasks.
+// Values 1,2,3 reserved for "number of measurements".
+#define FB_DSP_TASK        5  // Freq. Burst reading task in Idle mode.
+#define SB_DSP_TASK        6  // Sync. Burst reading task in Idle mode.
+#define TCH_FB_DSP_TASK    8  // Freq. Burst reading task in Dedicated mode.
+#define TCH_SB_DSP_TASK    9  // Sync. Burst reading task in Dedicated mode.
+#define IDLE1              1
+
+// Debug tasks
+#define CHECKSUM_DSP_TASK 33
+#define TST_NDB           35  //  Checksum DSP->MCU
+#define TST_DB            36  //  DB communication check
+#define INIT_VEGA         37
+#define DSP_LOOP_C        38
+
+// Identifier for measurement, FB / SB search tasks.
+// Values 1,2,3 reserved for "number of measurements".
+#define TCH_LOOP_A        31
+#define TCH_LOOP_B        32
+
+// bits in d_gsm_bgd_mgt - background task management
+#define B_DSPBGD_RECO           1       // start of reco in dsp background
+#define B_DSPBGD_UPD            2       // start of alignement update in dsp background
+#define B_DSPBGD_STOP_RECO      256     // stop of reco in dsp background
+#define B_DSPBGD_STOP_UPD       512     // stop of alignement update in dsp background
+
+// bit in d_pll_config
+#define B_32KHZ_CALIB      (1 << 14) // force DSP in Idle1 during 32 khz calibration
+// ****************************************************************
+// NDB AREA (PARAM) MCU<->DSP COMMUNICATION DEFINITIONS
+// ****************************************************************
+// bits in d_tch_mode
+#define B_EOTD            (1 << 0) // EOTD mode
+#define B_PLAY_UL         (1 << 3) // Play UL
+#define B_DCO_ON          (1 << 4) // DCO ON/OFF
+#define B_AUDIO_ASYNC     (1 << 1) // WCP reserved
+
+// ****************************************************************
+// PARAMETER AREA (PARAM) MCU<->DSP COMMUNICATION DEFINITIONS
+// ****************************************************************
+#define C_POND_RED              1L
+// below values are defined in the file l1_time.h
+//#define D_NSUBB_IDLE            296L
+//#define D_NSUBB_DEDIC           30L
+#define D_FB_THR_DET_IACQ       0x3333L
+#define D_FB_THR_DET_TRACK      0x28f6L
+#define D_DC_OFF_THRES          0x7fffL
+#define D_DUMMY_THRES           17408L
+#define D_DEM_POND_GEWL         26624L
+#define D_DEM_POND_RED          20152L
+#define D_HOLE                  0L
+#define D_TRANSFER_RATE         0x6666L
+
+// Full Rate vocoder definitions.
+#define D_MACCTHRESH1           7872L
+#define D_MLDT                  -4L
+#define D_MACCTHRESH            7872L
+#define D_GU                    5772L
+#define D_GO                    7872L
+#define D_ATTMAX                53L
+#define D_SM                    -892L
+#define D_B                     208L
+#define D_SD_MIN_THR_TCHFS      15L                   //(24L   *C_POND_RED)
+#define D_MA_MIN_THR_TCHFS      738L                  //(1200L *C_POND_RED)
+#define D_MD_MAX_THR_TCHFS      1700L                 //(2000L *C_POND_RED)
+#define D_MD1_MAX_THR_TCHFS     99L                   //(160L  *C_POND_RED)
+
+#if (DSP == 33) || (DSP == 34) || (DSP == 35) || (DSP == 36)
+  // Frequency burst definitions
+  #define D_FB_MARGIN_BEG         24
+  #define D_FB_MARGIN_END         22
+
+  // V42bis definitions
+  #define D_V42B_SWITCH_HYST      16L
+  #define D_V42B_SWITCH_MIN       64L
+  #define D_V42B_SWITCH_MAX       250L
+  #define D_V42B_RESET_DELAY      10L
+
+  // Latencies definitions
+  #if (DSP == 33) || (DSP == 34) || (DSP == 35) || (DSP == 36)
+    // C.f. BUG1404
+    #define D_LAT_MCU_BRIDGE        0x000FL
+  #else
+  #define D_LAT_MCU_BRIDGE        0x0009L
+  #endif
+
+  #define D_LAT_MCU_HOM2SAM       0x000CL
+
+  #define D_LAT_MCU_BEF_FAST_ACCESS 0x0005L
+  #define D_LAT_DSP_AFTER_SAM     0x0004L
+
+  // Background Task in GSM mode: Initialization.
+  #define D_GSM_BGD_MGT           0L
+
+#if (CHIPSET == 4)
+  #define D_MISC_CONFIG           0L
+#elif (CHIPSET == 7)  || (CHIPSET == 8) || (CHIPSET == 10) || (CHIPSET == 11) || (CHIPSET == 12)
+  #define D_MISC_CONFIG           1L
+#else
+  #define D_MISC_CONFIG           0L
+#endif
+
+#endif
+
+// Hall Rate vocoder and ched definitions.
+
+#define D_SD_MIN_THR_TCHHS      37L
+#define D_MA_MIN_THR_TCHHS      344L
+#define D_MD_MAX_THR_TCHHS      2175L
+#define D_MD1_MAX_THR_TCHHS     138L
+#define D_SD_AV_THR_TCHHS       1845L
+#define D_WED_FIL_TC            0x7c00L
+#define D_WED_FIL_INI           4650L
+#define D_X_MIN                 15L
+#define D_X_MAX                 23L
+#define D_Y_MIN                 703L
+#define D_Y_MAX                 2460L
+#define D_SLOPE                 135L
+#define D_WED_DIFF_THRESHOLD    406L
+#define D_MABFI_MIN_THR_TCHHS   5320L
+#define D_LDT_HR                -5
+#define D_MACCTRESH_HR          6500
+#define D_MACCTRESH1_HR         6500
+#define D_GU_HR                 2620
+#define D_GO_HR                 3700
+#define D_B_HR                  182
+#define D_SM_HR                 -1608
+#define D_ATTMAX_HR             53
+
+// Enhanced Full Rate vocoder and ched definitions.
+
+#define C_MLDT_EFR              -4
+#define C_MACCTHRESH_EFR        8000
+#define C_MACCTHRESH1_EFR       8000
+#define C_GU_EFR                4522
+#define C_GO_EFR                6500
+#define C_B_EFR                 174
+#define C_SM_EFR                -878
+#define C_ATTMAX_EFR            53
+#define D_SD_MIN_THR_TCHEFS     15L                   //(24L   *C_POND_RED)
+#define D_MA_MIN_THR_TCHEFS     738L                  //(1200L *C_POND_RED)
+#define D_MD_MAX_THR_TCHEFS     1230L                 //(2000L *C_POND_RED)
+#define D_MD1_MAX_THR_TCHEFS    99L                   //(160L  *C_POND_RED)
+
+
+// Integrated Data Services definitions.
+#define D_MAX_OVSPD_UL          8
+// Detect frames containing 90% of 1s as synchro frames
+#define D_SYNC_THRES            0x3f50
+// IDLE frames are only frames with 100 % of 1s
+#define D_IDLE_THRES            0x4000
+#define D_M1_THRES              5
+#define D_MAX_OVSP_DL           8
+
+// d_ra_act: bit field definition
+#define B_F48BLK                5
+
+// Mask for b_itc information (d_ra_conf)
+#define CE_MASK                 0x04
+
+#define D_FACCH_THR             0
+#define D_DSP_TEST              0
+#define D_VERSION_NUMBER        0
+#define D_TI_VERSION            0
+
+
+/*------------------------------------------------------------------------------*/
+/*                                                                              */
+/*                 DEFINITIONS FOR DSP <-> MCU COMMUNICATION.                   */
+/*                 ++++++++++++++++++++++++++++++++++++++++++                   */
+/*                                                                              */
+/*------------------------------------------------------------------------------*/
+// COMMUNICATION Interrupt definition
+//------------------------------------
+#define ALL_16BIT          0xffffL
+#define B_GSM_PAGE         (1 << 0)
+#define B_GSM_TASK         (1 << 1)
+#define B_MISC_PAGE        (1 << 2)
+#define B_MISC_TASK        (1 << 3)
+
+#define B_GSM_PAGE_MASK    (ALL_16BIT ^ B_GSM_PAGE)
+#define B_GSM_TASK_MASK    (ALL_16BIT ^ B_GSM_TASK)
+#define B_MISC_PAGE_MASK   (ALL_16BIT ^ B_MISC_PAGE)
+#define B_MISC_TASK_MASK   (ALL_16BIT ^ B_MISC_TASK)
+
+// Common definition
+//----------------------------------
+// Index to *_DEMOD* arrays.
+#define D_TOA                    0  // Time Of Arrival.
+#define D_PM                     1  // Power Measurement.
+#define D_ANGLE                  2  // Angle (AFC correction)
+#define D_SNR                    3  // Signal / Noise Ratio.
+
+// Bit name/position definitions.
+#define B_FIRE0                  5  // Fire result bit 0. (00 -> NO ERROR) (01 -> ERROR CORRECTED)
+#define B_FIRE1                  6  // Fire result bit 1. (10 -> ERROR)    (11 -> unused)
+#define B_SCH_CRC                8  // CRC result for SB decoding. (1 for ERROR).
+#define B_BLUD                  15  // Uplink,Downlink data block Present. (1 for PRESENT).
+#define B_AF                    14  // Activity bit: 1 if data block is valid.
+#define B_BFI                    2  // Bad Frame Indicator
+#define B_UFI                    0  // UNRELIABLE FRAME Indicator
+#define B_ECRC                   9  // Enhanced full rate CRC bit
+#define B_EMPTY_BLOCK           10  // for voice memo purpose, this bit is used to determine
+
+#if (DEBUG_DEDIC_TCH_BLOCK_STAT == 1)
+  #define FACCH_GOOD 10
+  #define FACCH_BAD  11
+#endif
+
+#if (AMR == 1)
+  // Place of the RX type in the AMR block header
+  #define RX_TYPE_SHIFT           3
+  #define RX_TYPE_MASK            0x0038
+
+  // Place of the vocoder type in the AMR block header
+  #define VOCODER_TYPE_SHIFT      0
+  #define VOCODER_TYPE_MASK       0x0007
+
+  // List of the possible RX types in a_dd block
+  #define SPEECH_GOOD             0
+  #define SPEECH_DEGRADED         1
+  #define ONSET                   2
+  #define SPEECH_BAD              3
+  #define SID_FIRST               4
+  #define SID_UPDATE              5
+  #define SID_BAD                 6
+  #define AMR_NO_DATA             7
+  #define AMR_INHIBIT             8
+
+  // List of possible RX types in RATSCCH block
+  #define C_RATSCCH_GOOD          5
+
+  // List of the possible AMR channel rate
+  #define AMR_CHANNEL_4_75        0
+  #define AMR_CHANNEL_5_15        1
+  #define AMR_CHANNEL_5_9         2
+  #define AMR_CHANNEL_6_7         3
+  #define AMR_CHANNEL_7_4         4
+  #define AMR_CHANNEL_7_95        5
+  #define AMR_CHANNEL_10_2        6
+  #define AMR_CHANNEL_12_2        7
+
+  // Types of RATSCCH blocks
+  #define C_RATSCCH_UNKNOWN                   0
+  #define C_RATSCCH_CMI_PHASE_REQ             1
+  #define C_RATSCCH_AMR_CONFIG_REQ_MAIN       2
+  #define C_RATSCCH_AMR_CONFIG_REQ_ALT        3
+  #define C_RATSCCH_AMR_CONFIG_REQ_ALT_IGNORE 4    // Alternative AMR_CONFIG_REQ with updates coming in the next THRES_REQ block
+  #define C_RATSCCH_THRES_REQ                 5
+
+  // These flags define a bitmap that indicates which AMR parameters are being modified by a RATSCCH
+  #define C_AMR_CHANGE_CMIP  0
+  #define C_AMR_CHANGE_ACS   1
+  #define C_AMR_CHANGE_ICM   2
+  #define C_AMR_CHANGE_THR1  3
+  #define C_AMR_CHANGE_THR2  4
+  #define C_AMR_CHANGE_THR3  5
+  #define C_AMR_CHANGE_HYST1 6
+  #define C_AMR_CHANGE_HYST2 7
+  #define C_AMR_CHANGE_HYST3 8
+
+  // CMIP default value
+  #define C_AMR_CMIP_DEFAULT 1  // According to ETSI specification 05.09, cmip is always 1 by default (new channel, handover...)
+
+#endif
+// "d_ctrl_tch" bits positions for TCH configuration.
+#define B_CHAN_MODE              0
+#define B_CHAN_TYPE              4
+#define B_RESET_SACCH            6
+#define B_VOCODER_ON             7
+#define B_SYNC_TCH_UL            8
+#if (AMR == 1)
+  #define B_SYNC_AMR               9
+#else
+#define B_SYNC_TCH_DL            9
+#endif
+#define B_STOP_TCH_UL           10
+#define B_STOP_TCH_DL           11
+#define B_TCH_LOOP              12
+#define B_SUBCHANNEL            15
+
+// "d_ctrl_abb" bits positions for conditionnal loading of abb registers.
+#define B_RAMP                   0
+#if ((ANLG_FAM == 1) || (ANLG_FAM == 2) || (ANLG_FAM == 3))
+  #define B_BULRAMPDEL             3 // Note: this name is changed
+  #define B_BULRAMPDEL2            2 // Note: this name is changed
+  #define B_BULRAMPDEL_BIS         9
+  #define B_BULRAMPDEL2_BIS       10
+#endif
+#define B_AFC                    4
+
+// "d_ctrl_system" bits positions.
+#define B_TSQ                    0
+#define B_BCCH_FREQ_IND          3
+#define B_TASK_ABORT            15  // Abort RF tasks for DSP.
+
+/* Channel type definitions for DEDICATED mode */
+#define INVALID_CHANNEL    0
+#define TCH_F              1
+#define TCH_H              2
+#define SDCCH_4            3
+#define SDCCH_8            4
+
+/* Channel mode definitions for DEDICATED mode */
+#define SIG_ONLY_MODE      0    // signalling only
+#define TCH_FS_MODE        1    // speech full rate
+#define TCH_HS_MODE        2    // speech half rate
+#define TCH_96_MODE        3    // data 9,6 kb/s
+#define TCH_48F_MODE       4    // data 4,8 kb/s full rate
+#define TCH_48H_MODE       5    // data 4,8 kb/s half rate
+#define TCH_24F_MODE       6    // data 2,4 kb/s full rate
+#define TCH_24H_MODE       7    // data 2,4 kb/s half rate
+#define TCH_EFR_MODE       8    // enhanced full rate
+#define TCH_144_MODE       9    // data 14,4 kb/s half rate
+
diff --git a/src/target/firmware/include/calypso/misc.h b/src/target/firmware/include/calypso/misc.h
new file mode 100644
index 00000000..4e480938
--- /dev/null
+++ b/src/target/firmware/include/calypso/misc.h
@@ -0,0 +1,8 @@
+#ifndef _CAL_MISC_H
+#define _CAL_MISC_H
+
+void memdump_range(unsigned int *ptr, unsigned int len);
+void dump_mem(void);
+void dump_dev_id(void);
+
+#endif /* _CAL_MISC_H */
diff --git a/src/target/firmware/include/calypso/rtc.h b/src/target/firmware/include/calypso/rtc.h
new file mode 100644
index 00000000..17528d00
--- /dev/null
+++ b/src/target/firmware/include/calypso/rtc.h
@@ -0,0 +1,6 @@
+#ifndef _CALYPSO_RTC_H
+#define _CALYPSO_RTC_H
+
+void rtc_init(void);
+
+#endif /* _CALYPSO_RTC_H */
diff --git a/src/target/firmware/include/calypso/sim.h b/src/target/firmware/include/calypso/sim.h
new file mode 100755
index 00000000..5e33bdbd
--- /dev/null
+++ b/src/target/firmware/include/calypso/sim.h
@@ -0,0 +1,179 @@
+/* Driver for Simcard Controller inside TI Calypso/Iota */
+
+/* (C) 2010 by Philipp Fabian Benedikt Maier <philipp-maier@runningserver.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef _CALYPSO_SIM_H
+#define _CALYPSO_SIM_H
+
+/* == REGISTERS IN THE IOTA BASEBAND == */
+
+/* SimCard Control Register */
+#define VRPCSIM_SIMLEN (1 << 3)		/* Enable level shifter */
+#define VRPCSIM_SIMRSU (1 << 2)		/* voltage regulator output status */
+#define VRPCSIM_RSIMEN (1 << 1)		/* Voltage regulator enable */
+#define VRPCSIM_SIMSEL 1		/* Select the VRSIM output voltage 1=2.9V, 0=1.8V */
+
+
+
+/* == REGISTERS IN THE CALYPSO CPU == */
+
+/* Reg_sim_cmd register (R/W) - FFFE:0000 */
+#define REG_SIM_CMD			0xFFFE0000	/* register address */
+#define REG_SIM_CMD_CMDCARDRST		1		/* SIM card reset sequence */
+#define REG_SIM_CMD_CMDIFRST 		(1 << 1)	/* SIM interface software reset */
+#define REG_SIM_CMD_CMDSTOP		(1 << 2)	/* SIM card stop procedure */
+#define REG_SIM_CMD_CMDSTART		(1 << 3)	/* SIM card start procedure */
+#define REG_SIM_CMD_MODULE_CLK_EN	(1 << 4)	/* Clock of the module */
+
+/* Reg_sim_stat register (R) - FFFE:0002 */
+#define REG_SIM_STAT			0xFFFE0002	/* register address */
+#define REG_SIM_STAT_STATNOCARD		1		/* card presence, 0 = no card, 1 = card detected */
+#define REG_SIM_STAT_STATTXPAR		(1 << 1)	/* parity check for transmit byte, 0 = parity error, 1 = parity OK */
+#define REG_SIM_STAT_STATFIFOFULL	(1 << 2)	/* FIFO content, 1 = FIFO full */ 
+#define REG_SIM_STAT_STATFIFOEMPTY	(1 << 3)	/* FIFO content, 1 = FIFO empty */
+
+/* Reg_sim_conf1 register (R/W) - FFFE:0004 */
+#define REG_SIM_CONF1			0xFFFE0004	/* register address */
+#define REG_SIM_CONF1_CONFCHKPAR	1		/* enable parity check on reception */
+#define REG_SIM_CONF1_CONFCODCONV	(1 << 1)	/* coding convention: (TS character) */
+#define REG_SIM_CONF1_CONFTXRX		(1 << 2)	/* SIO line direction */
+#define REG_SIM_CONF1_CONFSCLKEN	(1 << 3)	/* SIM clock */
+#define REG_SIM_CONF1_reserved		(1 << 4)	/* ETU period */
+#define REG_SIM_CONF1_CONFSCLKDIV	(1 << 5)	/* SIM clock frequency */
+#define REG_SIM_CONF1_CONFSCLKLEV	(1 << 6)	/* SIM clock idle level */
+#define REG_SIM_CONF1_CONFETUPERIOD	(1 << 7)	/* ETU period */
+#define REG_SIM_CONF1_CONFBYPASS	(1 << 8)	/* bypass hardware timers and start and stop sequences */
+#define REG_SIM_CONF1_CONFSVCCLEV	(1 << 9)	/* logic level on SVCC (used if CONFBYPASS = 1) */
+#define REG_SIM_CONF1_CONFSRSTLEV	(1 << 10)	/* logic level on SRST (used if CONFBYPASS = 1) */
+#define REG_SIM_CONF1_CONFTRIG		11		/* FIFO trigger level */
+#define REG_SIM_CONF1_CONFTRIG_0	(1 << 11)	
+#define REG_SIM_CONF1_CONFTRIG_1	(1 << 12)	
+#define REG_SIM_CONF1_CONFTRIG_2	(1 << 13)
+#define REG_SIM_CONF1_CONFTRIG_3	(1 << 14)
+#define REG_SIM_CONF1_CONFTRIG_MASK	0xF
+#define REG_SIM_CONF1_CONFSIOLOW	(1 << 15)	/* SIO - 0 = no effect, 1 = force low */
+
+/* Reg_sim_conf2 register (R/W) - FFFE:0006 */
+#define REG_SIM_CONF2			0xFFFE0006	/* register address */
+#define REG_SIM_CONF2_CONFTFSIM		0		/* time delay for filtering of SIM_CD */
+#define REG_SIM_CONF2_CONFTFSIM_0	1		/* time-unit = 1024 * TCK13M (card extraction) */
+#define REG_SIM_CONF2_CONFTFSIM_1	(1 << 1)	/* or */
+#define REG_SIM_CONF2_CONFTFSIM_2	(1 << 2)	/* time-unit = 8192 * TCK13M (card insertion) */
+#define REG_SIM_CONF2_CONFTFSIM_3	(1 << 3)
+#define REG_SIM_CONF2_CONFTFSIM_MASK	0xF
+#define REG_SIM_CONF2_CONFTDSIM		4		/* time delay for contact activation/deactivation */
+#define REG_SIM_CONF2_CONFTDSIM_0	(1 << 4)	/* time unit = 8 * TCKETU */
+#define REG_SIM_CONF2_CONFTDSIM_1	(1 << 5)
+#define REG_SIM_CONF2_CONFTDSIM_2	(1 << 6)
+#define REG_SIM_CONF2_CONFTDSIM_3	(1 << 7)
+#define REG_SIM_CONF2_CONFTDSIM_MASK 	0xF
+#define REG_SIM_CONF2_CONFWAITI		8		/* CONFWAITI overflow wait time between two received */
+#define REG_SIM_CONF2_CONFWAITI_0	(1 << 8)	/* character time unit = 960 *D * TCKETU */
+#define REG_SIM_CONF2_CONFWAITI_1	(1 << 9)	/* with D parameter = 1 or 8 (TA1 character) */
+#define REG_SIM_CONF2_CONFWAITI_2	(1 << 10)
+#define REG_SIM_CONF2_CONFWAITI_3	(1 << 11)
+#define REG_SIM_CONF2_CONFWAITI_4	(1 << 12)
+#define REG_SIM_CONF2_CONFWAITI_5	(1 << 13)
+#define REG_SIM_CONF2_CONFWAITI_6	(1 << 14)
+#define REG_SIM_CONF2_CONFWAITI_7	(1 << 15) 
+#define REG_SIM_CONF2_CONFWAITI_MASK 	0xFF
+
+/* Reg_sim_it register (R) - FFFE:0008 */
+#define REG_SIM_IT			0xFFFE0008	/* register address */
+#define REG_SIM_IT_SIM_NATR		1		/* 0 = on read access to REG_SIM_IT, 1 = no answer to reset */
+#define REG_SIM_IT_SIM_WT		(1 << 1)	/* 0 = on read access to REG_SIM_IT, 1 = character underflow */
+#define REG_SIM_IT_SIM_OV		(1 << 2)	/* 0 = on read access to REG_SIM_IT, 1 = receive overflow */
+#define REG_SIM_IT_SIM_TX		(1 << 3)	/* 0 = on write access to REG_SIM_DTX or */
+							/* on switching from transmit to receive, mode (CONFTXRX bit) */
+							/* 1 = waiting for character to transmit */
+#define REG_SIM_IT_SIM_RX		(1 << 4)	/* 0 = on read access to REG_SIM_DRX */
+							/* 1 = waiting characters to be read */
+
+/* Reg_sim_drx register (R) - FFFE:000A */
+#define REG_SIM_DRX			0xFFFE000A 	/* register address */
+#define REG_SIM_DRX_SIM_DRX		0		/* next data byte in FIFO available for reading */
+#define REG_SIM_DRX_SIM_DRX_0		1
+#define REG_SIM_DRX_SIM_DRX_1		(1 << 1)	
+#define REG_SIM_DRX_SIM_DRX_2		(1 << 2)
+#define REG_SIM_DRX_SIM_DRX_3		(1 << 3)
+#define REG_SIM_DRX_SIM_DRX_4		(1 << 4)
+#define REG_SIM_DRX_SIM_DRX_5		(1 << 5)
+#define REG_SIM_DRX_SIM_DRX_6		(1 << 6)
+#define REG_SIM_DRX_SIM_DRX_7		(1 << 7)
+#define REG_SIM_DRX_SIM_DRX_MASK	0xFF
+#define REG_SIM_DRX_STATRXPAR		(1 << 8)	/* parity-check for received byte */
+
+/* Reg_sim_dtx register (R/W) - FFFE:000C */
+#define REG_SIM_DTX 			0xFFFE000C	/* register address */
+#define REG_SIM_DTX_SIM_DTX_0				/* next data byte to be transmitted */
+#define REG_SIM_DTX_SIM_DTX_1
+#define REG_SIM_DTX_SIM_DTX_2
+#define REG_SIM_DTX_SIM_DTX_3
+#define REG_SIM_DTX_SIM_DTX_4
+#define REG_SIM_DTX_SIM_DTX_5
+#define REG_SIM_DTX_SIM_DTX_6
+#define REG_SIM_DTX_SIM_DTX_7
+
+/* Reg_sim_maskit register (R/W) - FFFE:000E */
+#define REG_SIM_MASKIT			0xFFFE000E 	/* register address */
+#define REG_SIM_MASKIT_MASK_SIM_NATR	1		/* No-answer-to-reset interrupt */
+#define REG_SIM_MASKIT_MASK_SIM_WT 	(1 << 1)	/* Character wait-time overflow interrupt */
+#define REG_SIM_MASKIT_MASK_SIM_OV 	(1 << 2)	/* Receive overflow interrupt */
+#define REG_SIM_MASKIT_MASK_SIM_TX 	(1 << 3)	/* Waiting character to transmit interrupt */
+#define REG_SIM_MASKIT_MASK_SIM_RX 	(1 << 4)	/* Waiting characters to be read interrupt */
+#define REG_SIM_MASKIT_MASK_SIM_CD 	(1 << 5)	/* SIM card insertion/extraction interrupt */
+
+/* Reg_sim_it_cd register (R) - FFFE:0010 */
+#define REG_SIM_IT_CD			0xFFFE0010	/* register address */
+#define REG_SIM_IT_CD_IT_CD		1		/* 0 = on read access to REG_SIM_IT_CD, */ 
+							/* 1 = SIM card insertion/extraction */
+
+
+#define SIM_OPERATION_DELAY 100				/* Time between operations like reset, vcc apply ect... */ 
+
+
+void calypso_sim_regdump(void);				/* Display Register dump */
+
+int calypso_sim_powerup(uint8_t *atr);			/* Apply power to the simcard (see note 1) */
+int calypso_sim_reset(uint8_t *atr);			/* reset the simcard (see note 1) */
+
+
+void calypso_sim_powerdown(void);			/* Powerdown simcard */
+
+/* APDU transmission modes */
+#define SIM_APDU_PUT 0		/* Transmit a data body to the card */
+#define SIM_APDU_GET 1		/* Fetch data from the card eg. GET RESOPNSE */
+
+
+void calypso_sim_init(void);				/* Initialize simcard interface */
+
+/* handling sim events */
+void sim_handler(void);
+
+/* simm command from layer 23 */
+void sim_apdu(uint16_t len, uint8_t *data);
+
+
+/* Known Bugs:
+   1.) After powering down the simcard communication stops working
+*/
+
+#endif /* _CALYPSO_SIM_H */
diff --git a/src/target/firmware/include/calypso/timer.h b/src/target/firmware/include/calypso/timer.h
new file mode 100644
index 00000000..694e4ebc
--- /dev/null
+++ b/src/target/firmware/include/calypso/timer.h
@@ -0,0 +1,25 @@
+#ifndef _CAL_TIMER_H
+#define _CAL_TIMER_H
+
+/* Enable or Disable a timer */
+void hwtimer_enable(int num, int on);
+
+/* Configure pre-scaler and if timer is auto-reload */
+void hwtimer_config(int num, uint8_t pre_scale, int auto_reload);
+
+/* Load a timer with the given value */
+void hwtimer_load(int num, uint16_t val);
+
+/* Read the current timer value */
+uint16_t hwtimer_read(int num);
+
+/* Enable or disable the watchdog */
+void wdog_enable(int on);
+
+/* Reset cpu using watchdog */
+void wdog_reset(void);
+
+/* power up the timers */
+void hwtimer_init(void);
+
+#endif /* _CAL_TIMER_H */
diff --git a/src/target/firmware/include/calypso/tpu.h b/src/target/firmware/include/calypso/tpu.h
new file mode 100644
index 00000000..3b1b6007
--- /dev/null
+++ b/src/target/firmware/include/calypso/tpu.h
@@ -0,0 +1,122 @@
+#ifndef _CALYPSO_TPU_H
+#define _CALYPSO_TPU_H
+
+#define BITS_PER_TDMA		1250
+#define QBITS_PER_TDMA		(BITS_PER_TDMA * 4)	/* 5000 */
+#define TPU_RANGE		QBITS_PER_TDMA
+#define	SWITCH_TIME		(TPU_RANGE-10)
+
+/* Assert or de-assert TPU reset */
+void tpu_reset(int active);
+/* Enable or Disable a new scenario loaded into the TPU */
+void tpu_enable(int active);
+/* Enable or Disable the clock of the TPU Module */
+void tpu_clk_enable(int active);
+/* Enable Frame Interrupt generation on next frame.  DSP will reset it */
+void tpu_dsp_frameirq_enable(void);
+/* Is a Frame interrupt still pending for the DSP ? */
+int tpu_dsp_fameirq_pending(void);
+/* Rewind the TPU, i.e. restart enqueueing instructions at the base addr */
+void tpu_rewind(void);
+/* Enqueue a raw TPU instruction */
+void tpu_enqueue(uint16_t instr);
+/* Initialize TPU and TPU driver */
+void tpu_init(void);
+/* (Busy)Wait until TPU is idle */
+void tpu_wait_idle(void);
+/* Enable FRAME interrupt generation */
+void tpu_frame_irq_en(int mcu, int dsp);
+/* Force the generation of a DSP interrupt */
+void tpu_force_dsp_frame_irq(void);
+
+/* Get the current TPU SYNCHRO register */
+uint16_t tpu_get_synchro(void);
+/* Get the current TPU OFFSET register */
+uint16_t tpu_get_offset(void);
+
+enum tpu_instr {
+	TPU_INSTR_AT		= (1 << 13),
+	TPU_INSTR_OFFSET	= (2 << 13),
+	TPU_INSTR_SYNCHRO	= (3 << 13),	/* Loading delta synchro value in TPU synchro register */
+	TPU_INSTR_WAIT		= (5 << 13),	/* Wait a certain period (in GSM qbits) */
+	TPU_INSTR_SLEEP		= (0 << 13),	/* Stop the sequencer by disabling TPU ENABLE bit in ctrl reg */
+	/* data processing */
+	TPU_INSTR_MOVE		= (4 << 13),
+};
+
+/* Addresses internal to the TPU, only accessible via MOVE */
+enum tpu_reg_int {
+	TPUI_TSP_CTRL1	= 0x00,
+	TPUI_TSP_CTRL2	= 0x01,
+	TPUI_TX_1	= 0x04,
+	TPUI_TX_2	= 0x03,
+	TPUI_TX_3	= 0x02,
+	TPUI_TX_4	= 0x05,
+	TPUI_TSP_ACT_L	= 0x06,
+	TPUI_TSP_ACT_U	= 0x07,
+	TPUI_TSP_SET1	= 0x09,
+	TPUI_TSP_SET2	= 0x0a,
+	TPUI_TSP_SET3	= 0x0b,
+	TPUI_DSP_INT_PG	= 0x10,
+	TPUI_GAUGING_EN = 0x11,
+};
+
+enum tpui_ctrl2_bits {
+	TPUI_CTRL2_RD		= (1 << 0),
+	TPUI_CTRL2_WR		= (1 << 1),
+};
+
+static inline uint16_t tpu_mod5000(int16_t time)
+{
+	if (time < 0)
+		return time + 5000;
+	if (time >= 5000)
+		return time - 5000;
+	return time;
+}
+
+/* Enqueue a SLEEP operation (stop sequencer by disabling TPU ENABLE bit) */
+static inline void tpu_enq_sleep(void)
+{
+	tpu_enqueue(TPU_INSTR_SLEEP);
+}
+
+/* Enqueue a MOVE operation */
+static inline void tpu_enq_move(uint8_t addr, uint8_t data)
+{
+	tpu_enqueue(TPU_INSTR_MOVE | (data << 5) | (addr & 0x1f));
+}
+
+/* Enqueue an AT operation */
+static inline void tpu_enq_at(int16_t time)
+{
+	tpu_enqueue(TPU_INSTR_AT | tpu_mod5000(time));
+}
+
+/* Enqueue a SYNC operation */
+static inline void tpu_enq_sync(int16_t time)
+{
+	tpu_enqueue(TPU_INSTR_SYNCHRO | time);
+}
+
+/* Enqueue a WAIT operation */
+static inline void tpu_enq_wait(int16_t time)
+{
+	tpu_enqueue(TPU_INSTR_WAIT | time);
+}
+
+/* Enqueue an OFFSET operation */
+static inline void tpu_enq_offset(int16_t time)
+{
+	tpu_enqueue(TPU_INSTR_OFFSET | time);
+}
+
+static inline void tpu_enq_dsp_irq(void)
+{
+	tpu_enq_move(TPUI_DSP_INT_PG, 0x0001);
+}
+
+/* add two numbers, modulo 5000, and ensure the result is positive */
+uint16_t add_mod5000(int16_t a, int16_t b);
+
+#endif /* _CALYPSO_TPU_H */
diff --git a/src/target/firmware/include/calypso/tsp.h b/src/target/firmware/include/calypso/tsp.h
new file mode 100644
index 00000000..d58a562a
--- /dev/null
+++ b/src/target/firmware/include/calypso/tsp.h
@@ -0,0 +1,31 @@
+#ifndef _CALYPSO_TSP_H
+#define _CALYPSO_TSP_H
+
+#define TSPACT(x)	(1 << x)
+#define TSPEN(x)	(x)
+
+/* initiate a TSP write through the TPU */
+void tsp_write(uint8_t dev_idx, uint8_t bitlen, uint32_t dout);
+
+/* Configure clock edge and chip enable polarity for a device */
+void tsp_setup(uint8_t dev_idx, int clk_rising, int en_positive, int en_edge);
+
+/* Obtain the current tspact state */
+uint16_t tsp_act_state(void);
+
+/* Update the TSPACT state, including enable and disable */
+void tsp_act_update(uint16_t new_act);
+
+/* Enable one or multiple TSPACT signals */
+void tsp_act_enable(uint16_t bitmask);
+
+/* Disable one or multiple TSPACT signals */
+void tsp_act_disable(uint16_t bitmask);
+
+/* Toggle one or multiple TSPACT signals */
+void tsp_act_toggle(uint16_t bitmask);
+
+/* Initialize TSP driver */
+void tsp_init(void);
+
+#endif /* _CALYPSO_TSP_H */
diff --git a/src/target/firmware/include/comm/sercomm.h b/src/target/firmware/include/comm/sercomm.h
new file mode 100644
index 00000000..a474c61a
--- /dev/null
+++ b/src/target/firmware/include/comm/sercomm.h
@@ -0,0 +1,59 @@
+#ifndef _SERCOMM_H
+#define _SERCOMM_H
+
+#include <osmocom/core/msgb.h>
+
+#define HDLC_FLAG	0x7E
+#define HDLC_ESCAPE	0x7D
+
+#define HDLC_C_UI	0x03
+#define HDLC_C_P_BIT	(1 << 4)
+#define HDLC_C_F_BIT	(1 << 4)
+
+/* a low sercomm_dlci means high priority.  A high DLCI means low priority */
+enum sercomm_dlci {
+	SC_DLCI_HIGHEST = 0,
+	SC_DLCI_DEBUG   = 4,
+	SC_DLCI_L1A_L23 = 5,
+	SC_DLCI_LOADER  = 9,
+	SC_DLCI_CONSOLE = 10,
+	SC_DLCI_ECHO    = 128,
+	_SC_DLCI_MAX
+};
+
+#ifndef HOST_BUILD
+/* helper functions for target */
+void sercomm_bind_uart(int uart);
+int sercomm_get_uart(void);
+#endif
+
+void sercomm_init(void);
+int sercomm_initialized(void);
+
+/* User Interface: Tx */
+
+/* user interface for transmitting messages for a given DLCI */
+void sercomm_sendmsg(uint8_t dlci, struct msgb *msg);
+/* how deep is the Tx queue for a given DLCI */
+unsigned int sercomm_tx_queue_depth(uint8_t dlci);
+
+/* User Interface: Rx */
+
+/* receiving messages for a given DLCI */
+typedef void (*dlci_cb_t)(uint8_t dlci, struct msgb *msg);
+int sercomm_register_rx_cb(uint8_t dlci, dlci_cb_t cb);
+
+/* Driver Interface */
+
+/* fetch one octet of to-be-transmitted serial data. returns 0 if no more data */
+int sercomm_drv_pull(uint8_t *ch);
+/* the driver has received one byte, pass it into sercomm layer.
+   returns 1 in case of success, 0 in case of unrecognized char */
+int sercomm_drv_rx_char(uint8_t ch);
+
+static inline struct msgb *sercomm_alloc_msgb(unsigned int len)
+{
+	return msgb_alloc_headroom(len+4, 4, "sercomm_tx");
+}
+
+#endif /* _SERCOMM_H */
diff --git a/src/target/firmware/include/comm/sercomm_cons.h b/src/target/firmware/include/comm/sercomm_cons.h
new file mode 100644
index 00000000..11f66545
--- /dev/null
+++ b/src/target/firmware/include/comm/sercomm_cons.h
@@ -0,0 +1,10 @@
+#ifndef _SERCOMM_CONS_H
+#define _SERCOMM_CONS_H
+
+/* how large buffers do we allocate? */
+#define SERCOMM_CONS_ALLOC	256
+
+int sercomm_puts(const char *s);
+int sercomm_putchar(int c);
+
+#endif /* _SERCOMM_CONS_H */
diff --git a/src/target/firmware/include/comm/timer.h b/src/target/firmware/include/comm/timer.h
new file mode 100644
index 00000000..1996f666
--- /dev/null
+++ b/src/target/firmware/include/comm/timer.h
@@ -0,0 +1,77 @@
+/*
+ * (C) 2008, 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef TIMER_H
+#define TIMER_H
+
+#include <sys/time.h>
+
+#include <osmocom/core/linuxlist.h>
+
+#define HZ 100
+
+/**
+ * Timer management:
+ *      - Create a struct osmo_timer_list
+ *      - Fill out timeout and use osmo_timer_add or
+ *        use osmo_timer_schedule to schedule a timer in
+ *        x seconds and microseconds from now...
+ *      - Use osmo_timer_del to remove the timer
+ *
+ *  Internally:
+ *      - We hook into select.c to give a timeval of the
+ *        nearest timer. On already passed timers we give
+ *        it a 0 to immediately fire after the select
+ *      - osmo_timers_update will call the callbacks and remove
+ *        the timers.
+ *
+ */
+struct osmo_timer_list {
+	struct llist_head entry;
+	unsigned long expires;
+
+	unsigned int active  : 1;
+	unsigned int handled : 1;
+	unsigned int in_list : 1;
+
+	void (*cb)(void*);
+	void *data;
+};
+
+extern unsigned long volatile jiffies;
+
+/**
+ * timer management
+ */
+void osmo_timer_add(struct osmo_timer_list *timer);
+void osmo_timer_schedule(struct osmo_timer_list *timer, int miliseconds);
+void osmo_timer_del(struct osmo_timer_list *timer);
+int osmo_timer_pending(struct osmo_timer_list *timer);
+
+
+/**
+ * internal timer list management
+ */
+int osmo_timers_update(void);
+int osmo_timers_check(void);
+
+void timer_init(void);
+
+#endif
diff --git a/src/target/firmware/include/console.h b/src/target/firmware/include/console.h
new file mode 100644
index 00000000..cd27155e
--- /dev/null
+++ b/src/target/firmware/include/console.h
@@ -0,0 +1,19 @@
+#ifndef _CONSOLE_H
+#define _CONSOLE_H
+
+/* This is the direct (IRQ driven) UART console, bypassing the HDLC layer.
+ * You should not need to call those functions unless you've decided to
+ * not use the HLDC layer or have a device with two UARTs */
+
+int cons_rb_append(const char *data, int len);
+int cons_puts(const char *s);
+int cons_putchar(char c);
+int cons_rb_flush(void);
+void cons_init(void);
+void cons_bind_uart(int uart);
+int cons_get_uart(void);
+
+/* Size of the static ring-buffer that we keep for console print messages */
+#define CONS_RB_SIZE	4096
+
+#endif /* _CONSOLE_H */
diff --git a/src/target/firmware/include/ctors.h b/src/target/firmware/include/ctors.h
new file mode 100644
index 00000000..ee4c7b3e
--- /dev/null
+++ b/src/target/firmware/include/ctors.h
@@ -0,0 +1,16 @@
+#ifndef _CTORS_H
+#define _CTORS_H
+
+#if 0
+/* only supported by gcc 3.4 or later */
+#define __ctor_data	__attribute__ ((constructor) (100))
+#define __ctor_board	__attribute__ ((constructor) (200))
+#else
+#define __ctor_data	__attribute__ ((constructor))
+#define __ctor_board	__attribute__ ((constructor))
+#endif
+
+/* iterate over list of constructor functions and call each element */
+void do_global_ctors(const char *ctors_start, const char *ctors_end);
+
+#endif
diff --git a/src/target/firmware/include/ctype.h b/src/target/firmware/include/ctype.h
new file mode 100644
index 00000000..afa36392
--- /dev/null
+++ b/src/target/firmware/include/ctype.h
@@ -0,0 +1,54 @@
+#ifndef _LINUX_CTYPE_H
+#define _LINUX_CTYPE_H
+
+/*
+ * NOTE! This ctype does not handle EOF like the standard C
+ * library is required to.
+ */
+
+#define _U	0x01	/* upper */
+#define _L	0x02	/* lower */
+#define _D	0x04	/* digit */
+#define _C	0x08	/* cntrl */
+#define _P	0x10	/* punct */
+#define _S	0x20	/* white space (space/lf/tab) */
+#define _X	0x40	/* hex digit */
+#define _SP	0x80	/* hard space (0x20) */
+
+extern unsigned char _ctype[];
+
+#define __ismask(x) (_ctype[(int)(unsigned char)(x)])
+
+#define isalnum(c)	((__ismask(c)&(_U|_L|_D)) != 0)
+#define isalpha(c)	((__ismask(c)&(_U|_L)) != 0)
+#define iscntrl(c)	((__ismask(c)&(_C)) != 0)
+#define isdigit(c)	((__ismask(c)&(_D)) != 0)
+#define isgraph(c)	((__ismask(c)&(_P|_U|_L|_D)) != 0)
+#define islower(c)	((__ismask(c)&(_L)) != 0)
+#define isprint(c)	((__ismask(c)&(_P|_U|_L|_D|_SP)) != 0)
+#define ispunct(c)	((__ismask(c)&(_P)) != 0)
+#define isspace(c)	((__ismask(c)&(_S)) != 0)
+#define isupper(c)	((__ismask(c)&(_U)) != 0)
+#define isxdigit(c)	((__ismask(c)&(_D|_X)) != 0)
+
+#define isascii(c) (((unsigned char)(c))<=0x7f)
+#define toascii(c) (((unsigned char)(c))&0x7f)
+
+static inline unsigned char __tolower(unsigned char c)
+{
+	if (isupper(c))
+		c -= 'A'-'a';
+	return c;
+}
+
+static inline unsigned char __toupper(unsigned char c)
+{
+	if (islower(c))
+		c -= 'a'-'A';
+	return c;
+}
+
+#define tolower(c) __tolower(c)
+#define toupper(c) __toupper(c)
+
+#endif
diff --git a/src/target/firmware/include/debug.h b/src/target/firmware/include/debug.h
new file mode 100644
index 00000000..27c4185d
--- /dev/null
+++ b/src/target/firmware/include/debug.h
@@ -0,0 +1,31 @@
+#ifndef _DEBUG_H
+#define _DEBUG_H
+
+#ifndef ARRAY_SIZE
+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#endif
+
+/*
+ * Check at compile time that something is of a particular type.
+ * Always evaluates to 1 so you may use it easily in comparisons.
+ */
+#define typecheck(type,x) \
+({	type __dummy; \
+	typeof(x) __dummy2; \
+	(void)(&__dummy == &__dummy2); \
+	1; \
+})
+
+#ifdef DEBUG
+#define dputchar(x) putchar(x)
+#define dputs(x) puts(x)
+#define dphex(x,y) phex(x,y)
+#define printd(x, args ...) printf(x, ## args)
+#else
+#define dputchar(x)
+#define dputs(x)
+#define dphex(x,y)
+#define printd(x, args ...)
+#endif
+
+#endif /* _DEBUG_H */
diff --git a/src/target/firmware/include/defines.h b/src/target/firmware/include/defines.h
new file mode 100644
index 00000000..e5d5436d
--- /dev/null
+++ b/src/target/firmware/include/defines.h
@@ -0,0 +1,28 @@
+
+#ifndef _DEFINES_H
+#define _DEFINES_H
+
+#define __attribute_const__	__attribute__((__const__))
+
+/* type properties */
+#ifndef __packed
+#define __packed		__attribute__((packed))
+#endif
+
+#ifndef __aligned
+#define __aligned(alignment)	__attribute__((aligned(alignment)))
+#endif
+
+#ifndef __unused
+#define __unused		__attribute__((unused))
+#endif
+
+/* linkage */
+#ifndef __section
+#define __section(name) __attribute__((section(name)))
+#endif
+
+/* force placement in zero-waitstate memory */
+#define __ramtext __section(".ramtext")
+
+#endif /* !_DEFINES_H */
diff --git a/src/target/firmware/include/delay.h b/src/target/firmware/include/delay.h
new file mode 100644
index 00000000..0d6f3efd
--- /dev/null
+++ b/src/target/firmware/include/delay.h
@@ -0,0 +1,7 @@
+#ifndef delay_h
+#define delay_h
+
+void delay_ms(unsigned int ms);
+void delay_us(unsigned int us);
+
+#endif
diff --git a/src/target/firmware/include/endian.h b/src/target/firmware/include/endian.h
new file mode 100644
index 00000000..3abcb327
--- /dev/null
+++ b/src/target/firmware/include/endian.h
@@ -0,0 +1,12 @@
+#ifndef __ENDIAN_H
+#define	__ENDIAN_H
+
+#include <sys/cdefs.h>
+#include <sys/_types.h>
+#include <machine/_endian.h>
+
+#define __BYTE_ORDER	__LITTLE_ENDIaN
+#define	_QUAD_HIGHWORD	1
+#define	_QUAD_LOWWORD	0
+
+#endif /* __ENDIAN_H__ */
diff --git a/src/target/firmware/include/fb/fb_bw8.h b/src/target/firmware/include/fb/fb_bw8.h
new file mode 100644
index 00000000..c77fa71f
--- /dev/null
+++ b/src/target/firmware/include/fb/fb_bw8.h
@@ -0,0 +1,51 @@
+#ifndef FB_BW8_H
+#define FB_BW8_H
+
+/* 8bit monochrome framebuffer, organized with 8 stacked pixels
+   per byte, backed by local memory. fb_bw8.c lists functions that
+   are common to simmilar organized displays. */
+
+/*
+	Sketch of Memory Layout 
+	Left Upper Corner of Display
+     
+			col0  col2
+			   col1
+		      +-------------
+	1st row:      | A0 B0 C0
+	2nd row:      | A1 B1 C1
+			...
+	7th row:      | A6 B6 C6
+	8th row:      | A7 B7 C7
+	9th row:      | Q0 R0 S0
+	10th row:     | Q1 R1 S1 ...
+			...
+
+	Backing store (and internal display memory?) looks like...
+	
+	uint8_t mem[] = { A, B, C, .... Q, R, S, ... }
+
+   We work on a in-memory copy of the framebuffer and only
+   update the physical display on demand. The damage window
+   has two corners, left upper inclusive x1,y1 and right
+   lower x2,y2 exclusive. So dirty pixels are defined to
+   be  x1 <= x_pixel < x2 and y1 <= y_pixel < y2.
+*/
+
+/* data specific to a bw8-type framebuffer as described above */
+
+struct fb_bw8 {
+	uint8_t *mem;			/* set to backingstore memory */
+	uint16_t damage_x1,damage_y1;	/* current damage window, ul */
+	uint16_t damage_x2,damage_y2;	/* current damage window, lr */
+};
+
+extern struct fb_bw8 *fb_bw8; /* symbol defined by the specific LCD driver */
+
+extern void fb_bw8_clear();
+extern void fb_bw8_boxto(uint16_t x,uint16_t y); /* draw a box from cursor to x,y */
+extern void fb_bw8_lineto(uint16_t x,uint16_t y); /* draw a line from cursor to x,y */
+
+extern int fb_bw8_putstr(char *str,int maxwidth);
+
+#endif
diff --git a/src/target/firmware/include/fb/fb_rgb332.h b/src/target/firmware/include/fb/fb_rgb332.h
new file mode 100644
index 00000000..4df44e4e
--- /dev/null
+++ b/src/target/firmware/include/fb/fb_rgb332.h
@@ -0,0 +1,47 @@
+#ifndef FB_RGB332_H
+#define FB_RGB332_H
+
+/* RGB framebuffer with 1 byte per pixel, bits mapped as RRRGGGBB */
+
+struct fb_rgb332 {
+	uint8_t *mem;			/* set to backingstore memory */
+	uint16_t damage_x1,damage_y1;	/* current damage window, ul (incl) */
+	uint16_t damage_x2,damage_y2;	/* current damage window, lr (excl) */
+};
+
+extern void fb_rgb332_clear();
+
+/* draw a box from cursor to x,y */
+extern void fb_rgb332_boxto(uint16_t x,uint16_t y);
+/* draw a line from cursor to x,y */
+extern void fb_rgb332_lineto(uint16_t x,uint16_t y);
+
+/* put string str onto framebuffer with line (bottom
+   left pixel of, e.g. "m") starting at cursor.
+   Maximum width consumed is maxwidth, actual width
+   needed is returned */
+extern int fb_rgb332_putstr(char *str,int maxwidth);
+
+extern struct fb_rgb332 *fb_rgb332;
+
+/* this convenience function can be used if you choose to
+ * back a RGB565 display with a RGB332 framebuffer to conserve
+ * ARM memory. It converts a rgb332 value to rgb565 as indicated
+ * in the comments. */
+
+static inline uint16_t
+rgb332_to_565(uint8_t rgb332){
+
+	uint8_t red   =  (rgb332 & 0xe0) >> 5 ; // rrr. .... -> .... .rrr
+	uint8_t green = ((rgb332 & 0x1c) >> 2); // ...g gg.. -> .... .ggg
+	uint8_t blue  =   rgb332 & 0x03;        // .... ..bb -> .... ..bb
+
+	red   = (red   << 2) | (red >> 1);                /* .....210 -> ...21021 */
+	green = (green << 3) | (green);                   /* .....210 -> ..210210 */
+	blue  = (blue  << 3) | (blue << 1) | (blue >> 1); /* ......10 -> ...10101 */
+
+	/* rrrrrggg gggbbbbb */
+	return (red << 11) | (green << 5) | blue;
+}
+
+#endif
diff --git a/src/target/firmware/include/fb/font.h b/src/target/firmware/include/fb/font.h
new file mode 100644
index 00000000..9dee8ffb
--- /dev/null
+++ b/src/target/firmware/include/fb/font.h
@@ -0,0 +1,82 @@
+#ifndef _FB_FONT_H
+#define _FB_FONT_H
+
+#include <stdint.h>
+#include <unistd.h>
+
+/*
+	Example:
+		Font Helvetica 14
+		
+
+	Character W ('X' and '.' is the character font data)
+
+	    X.....X......&...
+	    X.....X......X...
+	    X....X.X.....X...
+	    .X...X.X....X....
+	    .X...X.X....X....
+	    .X...X.X....X....
+	    ..X.X....X.X.....
+	    ..X.X....X.X.....
+	    ..X.X....X.X.....
+	    ...X......X......
+	   @%..X......X...$..
+	   <---dwidth---->
+
+	   @ is the cursor position (origin) for this character
+	   $ is the cursor position (origin) for the next character
+	   % is the character boundingbox origin,
+	   & is the character boundingbox top right corner
+	     
+ */
+
+/* data for char c is found by getting the index into the
+   chardata array from the charoffs array.
+   
+   if charoffs[c] == FB_FONT_NOCHAR, then this glyph does
+   not exist! Better use the convenience function fb_font_get_char below! */
+
+#define FB_FONT_NOCHAR 0xffff
+
+struct fb_font {
+	int8_t height;  /* total height of font */
+	int8_t ascent;  /* topmost pixel is "ascend" above
+			   current cursor position y */
+	uint8_t firstchar,lastchar; /* range of characters in font (iso8859-1) */
+	uint8_t const *chardata;
+	uint16_t const *charoffs;		/* byte offsets relative to chardata */
+	uint8_t  const *widths;		/* widths for characters */
+};
+
+struct fb_char {
+	int8_t width;
+	int8_t bbox_w,bbox_h,bbox_x,bbox_y;
+	uint8_t data[0];
+};
+
+/* there are currently 6 fonts available, Helvetica 8, 14, 24 point
+   in bold and regular shapes. The following enum has to match the
+   order of the array fb_fonts in framebuffer.c!
+*/
+
+enum fb_font_id {
+//	FB_FONT_4X6,
+//	FB_FONT_5X8,
+	FB_FONT_HELVR08,
+//	FB_FONT_HELVR14
+//	FB_FONT_HELVR24,
+//	FB_FONT_HELVB08,
+	FB_FONT_HELVB14,
+//	FB_FONT_HELVB24,
+	FB_FONT_C64,
+	FB_FONT_SYMBOLS,
+};
+
+extern const struct fb_font *fb_fonts[]; // note: has to match fb_font_id enum!
+
+extern const struct fb_char *
+fb_font_get_char(const struct fb_font *fnt,unsigned char c);
+
+#endif
+
diff --git a/src/target/firmware/include/fb/framebuffer.h b/src/target/firmware/include/fb/framebuffer.h
new file mode 100644
index 00000000..e765b36d
--- /dev/null
+++ b/src/target/firmware/include/fb/framebuffer.h
@@ -0,0 +1,128 @@
+#ifndef _FB_FRAMEBUFFER_H
+#define _FB_FRAMEBUFFER_H
+
+#include <fb/font.h>
+#include <stdint.h>
+
+/* color is encoded as <special><red><green><blue> */
+/* if a color is "special", then the RGB components most likely
+   don't make sense. Use "special" colours when you have to
+   mask out bits with transparency or you have to encode
+   colours in a fixed color palette... */
+
+#define FB_COLOR_WHITE		0x00ffffffU
+#define FB_COLOR_BLACK		0x00000000U
+#define FB_COLOR_TRANSP		0x01ffffffU
+
+#define FB_COLOR_RGB(r,g,b) ((((r) & 0xff)<<16)|(((g)&0xff)<<8)|((b)&0xff))
+#define FB_COLOR_RED		FB_COLOR_RGB(0xff,0x00,0x00)
+#define FB_COLOR_GREEN		FB_COLOR_RGB(0x00,0xff,0x00)
+#define FB_COLOR_BLUE		FB_COLOR_RGB(0x00,0x00,0xff)
+
+/* encode */
+
+/* decode */
+#define FB_COLOR_IS_SPECIAL(v)     (!!((v) & 0xff000000U))
+#define FB_COLOR_TO_R(v)		(((v)>>16) & 0xff)
+#define FB_COLOR_TO_G(v)		(((v)>> 8) & 0xff)
+#define FB_COLOR_TO_B(v)		( (v)      & 0xff)
+
+struct framebuffer {
+	char name[8];				// keep it short!
+	void (*init)();				// (re)initialize
+	void (*clear)();			// clear display
+	void (*boxto)(uint16_t x,uint16_t y);	// draw box to xy
+	void (*lineto)(uint16_t x,uint16_t y);	// draw line to xy
+	int (*putstr)(char *c,int maxwidth);	// put text in current font to fb
+	void (*flush)();			// flush changes
+
+	uint16_t width,height;			// width/height of fb
+	uint16_t cursor_x,cursor_y;		// current cursor
+	uint32_t fg_color,bg_color;		// current fg/bg color
+	enum fb_font_id font;			// current font
+};
+
+/* there is a single framebuffer, the specific driver defines
+   the "framebuffer" symbol */
+extern struct framebuffer *framebuffer;
+
+static inline void
+fb_init(){
+	framebuffer->init();
+}
+
+static inline void
+fb_clear(){
+	framebuffer->clear();
+}
+
+static inline void
+fb_boxto(uint16_t x,uint16_t y){
+	framebuffer->boxto(x,y);
+}
+
+static inline void
+fb_lineto(uint16_t x,uint16_t y){
+	framebuffer->lineto(x,y);
+}
+
+static inline int
+fb_putstr(char *str,int maxwidth){
+	return framebuffer->putstr(str,maxwidth);
+}
+
+static inline void
+fb_flush(){
+	framebuffer->flush();
+}
+
+static inline void
+fb_gotoxy(uint16_t x,uint16_t y){
+	framebuffer->cursor_x = x;
+	framebuffer->cursor_y = y;
+}
+
+static inline void
+fb_setfg(uint32_t color){
+	framebuffer->fg_color = color;
+}
+
+static inline void
+fb_setbg(uint32_t color){
+	framebuffer->bg_color = color;
+}
+
+static inline void
+fb_setfont(enum fb_font_id fid){
+	framebuffer->font = fid;
+}
+
+/* utility function: limit coordinates to area of framebuffer */
+static inline void
+fb_limit_fb_range(uint16_t *x,uint16_t *y){
+	if(*x >= framebuffer->width)
+		*x = framebuffer->width - 1;
+	if(*y >= framebuffer->height)
+		*y = framebuffer->height - 1;
+}
+
+/* utility function: limit box coordinates to area of framebuffer
+   and make sure that x1y1 is left upper edge, x2y2 is right lower */
+static inline void
+fb_sanitize_box(uint16_t *x1,uint16_t *y1,uint16_t *x2,uint16_t *y2){
+	fb_limit_fb_range(x1,y1);
+	fb_limit_fb_range(x2,y2);
+	if(*x1 > *x2){
+		uint16_t tmp = *x1;
+		*x1 = *x2;
+		*x2 = tmp;
+	}
+	if(*y1 > *y2){
+		uint16_t tmp = *y1;
+		*y1 = *y2;
+		*y2 = tmp;
+	}
+}
+
+#endif
+
diff --git a/src/target/firmware/include/flash/cfi_flash.h b/src/target/firmware/include/flash/cfi_flash.h
new file mode 100644
index 00000000..9d8b33ae
--- /dev/null
+++ b/src/target/firmware/include/flash/cfi_flash.h
@@ -0,0 +1,41 @@
+
+#ifndef _CFI_FLASH_H
+#define _CFI_FLASH_H
+
+#include <stdint.h>
+
+#define FLASH_MAX_REGIONS 4
+
+typedef struct {
+	void  *fr_base;
+	size_t fr_bnum;
+	size_t fr_bsize;
+} flash_region_t;
+
+typedef struct {
+	void  *f_base;
+	size_t f_size;
+
+	size_t f_nregions;
+	flash_region_t f_regions[FLASH_MAX_REGIONS];
+} flash_t;
+
+typedef enum {
+	FLASH_UNLOCKED = 0,
+	FLASH_LOCKED,
+	FLASH_LOCKED_DOWN
+} flash_lock_t;
+
+int flash_init(flash_t *flash, void *base_addr);
+
+flash_lock_t flash_block_getlock(flash_t *flash, uint32_t block_offset);
+
+int flash_block_unlock(flash_t *flash, uint32_t block_offset);
+int flash_block_lock(flash_t *flash, uint32_t block_offset);
+int flash_block_lockdown(flash_t *flash, uint32_t block_offset);
+
+int flash_block_erase(flash_t *flash, uint32_t block_offset);
+
+int flash_program(flash_t *flash, uint32_t dst_offset, void *src, uint32_t nbytes);
+
+#endif
diff --git a/src/target/firmware/include/i2c.h b/src/target/firmware/include/i2c.h
new file mode 100644
index 00000000..37097a85
--- /dev/null
+++ b/src/target/firmware/include/i2c.h
@@ -0,0 +1,7 @@
+#ifndef _I2C_H
+#define _I2C_H
+
+int i2c_write(uint8_t chip, uint32_t addr, int alen, const uint8_t *buffer, int len);
+void i2c_init(int speed, int slaveadd);
+
+#endif /* I2C_H */
diff --git a/src/target/firmware/include/keypad.h b/src/target/firmware/include/keypad.h
new file mode 100644
index 00000000..9e9acfe9
--- /dev/null
+++ b/src/target/firmware/include/keypad.h
@@ -0,0 +1,46 @@
+#ifndef _KEYPAD_H
+#define _KEYPAD_H
+
+enum key_codes {
+	KEY_0	= 0,
+	KEY_1,
+	KEY_2,
+	KEY_3,
+	KEY_4,
+	KEY_5,
+	KEY_6,
+	KEY_7,
+	KEY_8,
+	KEY_9,
+	KEY_STAR,	//*
+	KEY_HASH,	//#
+	KEY_MENU,	//center of directional keys
+	KEY_LEFT_SB,	//softbutton
+	KEY_RIGHT_SB,	//softbutton
+	KEY_UP,
+	KEY_DOWN,
+	KEY_LEFT,
+	KEY_RIGHT,
+	KEY_OK,		//green off-hook
+	KEY_POWER,	//red on-hook
+	KEY_MINUS,
+	KEY_PLUS,
+	KEY_INV = 0xFF
+};
+
+#define BUTTON_CNT	23
+
+enum key_states {
+	PRESSED,
+	RELEASED,
+};
+
+void keypad_init(const uint8_t *keymap, uint8_t interrupts);
+
+void keypad_poll();
+
+typedef void (*key_handler_t)(enum key_codes code, enum key_states state);
+
+void keypad_set_handler(key_handler_t handler);
+
+#endif /* KEYPAD_H */
diff --git a/src/target/firmware/include/layer1/afc.h b/src/target/firmware/include/layer1/afc.h
new file mode 100644
index 00000000..8b43f8aa
--- /dev/null
+++ b/src/target/firmware/include/layer1/afc.h
@@ -0,0 +1,18 @@
+#ifndef _L1_AFC_H
+#define _L1_AFC_H
+
+#define AFC_SNR_THRESHOLD	2560	/* 2.5 dB in fx6.10 */
+
+/* Input a frequency error sample into the AFC averaging */
+void afc_input(int32_t freq_error, uint16_t arfcn, int valid);
+
+/* Update the AFC with a frequency error, bypassing averaging */
+void afc_correct(int16_t freq_error, uint16_t arfcn);
+
+/* Update DSP with new AFC DAC value to be used for next TDMA frame */
+void afc_load_dsp(void);
+
+/* Reset the AFC to its initial DAC value */
+void afc_reset(void);
+
+#endif
diff --git a/src/target/firmware/include/layer1/agc.h b/src/target/firmware/include/layer1/agc.h
new file mode 100644
index 00000000..2b7e46e9
--- /dev/null
+++ b/src/target/firmware/include/layer1/agc.h
@@ -0,0 +1,7 @@
+#ifndef _L1_AGC_H
+#define _L1_AGC_H
+
+#define to_dbm8(x)	((x)*8)
+int16_t agc_inp_dbm8_by_pm(int16_t pm);
+
+#endif /* _L1_AGC_H */
diff --git a/src/target/firmware/include/layer1/apc.h b/src/target/firmware/include/layer1/apc.h
new file mode 100644
index 00000000..3d73c23e
--- /dev/null
+++ b/src/target/firmware/include/layer1/apc.h
@@ -0,0 +1,10 @@
+#ifndef _L1_APC_H
+#define _L1_APC_H
+
+/* determine the AUXAPC value by the Tx Power Level */
+int16_t apc_tx_dbm2auxapc(enum gsm_band band, int8_t dbm);
+
+/* determine the AUXAPC value by the Tx Power Level */
+int16_t apc_tx_pwrlvl2auxapc(enum gsm_band band, uint8_t lvl);
+
+#endif
diff --git a/src/target/firmware/include/layer1/async.h b/src/target/firmware/include/layer1/async.h
new file mode 100644
index 00000000..de996a67
--- /dev/null
+++ b/src/target/firmware/include/layer1/async.h
@@ -0,0 +1,62 @@
+#ifndef _L1_ASYNC_H
+#define _L1_ASYNC_H
+
+#include <osmocom/core/msgb.h>
+
+#include <layer1/mframe_sched.h>
+
+#if 0
+NOTE: Re-enabling interrupts causes an IRQ while processing the same IRQ.
+      Use local_firq_save and local_irq_restore instead!
+
+/* When altering data structures used by L1 Sync part, we need to
+ * make sure to temporarily disable IRQ/FIQ to keep data consistent */
+static inline void l1a_lock_sync(void)
+{
+	arm_disable_interrupts();
+}
+
+static inline void l1a_unlock_sync(void)
+{
+	arm_enable_interrupts();
+}
+#endif
+
+/* safely enable a message into the L1S TX queue */
+void l1a_txq_msgb_enq(struct llist_head *queue, struct msgb *msg);
+void l1a_meas_msgb_set(struct msgb *msg);
+
+/* safely count messages in the L1S TX queue */
+int l1a_txq_msgb_count(struct llist_head *queue);
+
+/* flush all pending msgb */
+void l1a_txq_msgb_flush(struct llist_head *queue);
+
+/* request a RACH */
+void l1a_rach_req(uint16_t offset, uint8_t combined, uint8_t ra);
+
+/* schedule frequency change */
+void l1a_freq_req(uint32_t fn_sched);
+
+/* Enable a repeating multiframe task */
+void l1a_mftask_enable(enum mframe_task task);
+
+/* Disable a repeating multiframe task */
+void l1a_mftask_disable(enum mframe_task task);
+
+/* Set the mask for repeating multiframe tasks */
+void l1a_mftask_set(uint32_t tasks);
+
+/* Set TCH mode */
+uint8_t l1a_tch_mode_set(uint8_t mode);
+
+/* Set Audio routing mode */
+uint8_t l1a_audio_mode_set(uint8_t mode);
+
+/* Execute pending L1A completions */
+void l1a_compl_execute(void);
+
+/* Initialize asynchronous part of Layer1 */
+void l1a_init(void);
+
+#endif
diff --git a/src/target/firmware/include/layer1/avg.h b/src/target/firmware/include/layer1/avg.h
new file mode 100644
index 00000000..6c5de172
--- /dev/null
+++ b/src/target/firmware/include/layer1/avg.h
@@ -0,0 +1,23 @@
+#ifndef _L1_AVG_H
+#define _L1_AVG_H
+
+struct running_avg {
+	/* configuration */
+	uint16_t	period;			/* over how many samples to average */
+	uint16_t	min_valid;
+
+	int32_t		acc_val;
+	uint16_t	num_samples;		/* how often did we try to sample? */
+	uint16_t	num_samples_valid;	/* how often did we receive valid samples? */
+
+	void		(*outfn)(struct running_avg *, int32_t avg);
+	void		*priv;
+};
+
+/* input a new sample into the averaging process */
+void runavg_input(struct running_avg *ravg, int32_t val, int valid);
+
+/* check if sufficient samples have been obtained, and call outfn() */
+int runavg_check_output(struct running_avg *ravg);
+
+#endif /* _AVG_H */
diff --git a/src/target/firmware/include/layer1/l23_api.h b/src/target/firmware/include/layer1/l23_api.h
new file mode 100644
index 00000000..e4a3fd0a
--- /dev/null
+++ b/src/target/firmware/include/layer1/l23_api.h
@@ -0,0 +1,18 @@
+#ifndef _L1_L23_API_H
+#define _L1_L23_API_H
+
+#include <stdint.h>
+#include <osmocom/core/msgb.h>
+#include <l1ctl_proto.h>
+
+void l1a_l23api_init(void);
+void l1a_l23_handler(void);
+void l1_queue_for_l2(struct msgb *msg);
+struct msgb *l1ctl_msgb_alloc(uint8_t msg_type);
+struct msgb *l1_create_l2_msg(int msg_type, uint32_t fn, uint16_t snr, uint16_t arfcn);
+extern void (*l1a_l23_tx_cb)(struct msgb *msg);
+void l1a_l23_rx(uint8_t dlci, struct msgb *msg);
+
+void l1ctl_tx_reset(uint8_t msg_type, uint8_t reset_type);
+
+#endif /* _L1_L23_API_H */
diff --git a/src/target/firmware/include/layer1/mframe_sched.h b/src/target/firmware/include/layer1/mframe_sched.h
new file mode 100644
index 00000000..74e2d271
--- /dev/null
+++ b/src/target/firmware/include/layer1/mframe_sched.h
@@ -0,0 +1,71 @@
+#ifndef _L1_MFRAME_SCHED_H
+#define _L1_MFRAME_SCHED_H
+
+#include <stdint.h>
+
+enum mframe_task {
+	MF_TASK_BCCH_NORM,
+	MF_TASK_BCCH_EXT,
+	MF_TASK_CCCH,
+	MF_TASK_CCCH_COMB,
+
+	MF_TASK_SDCCH4_0,
+	MF_TASK_SDCCH4_1,
+	MF_TASK_SDCCH4_2,
+	MF_TASK_SDCCH4_3,
+
+	MF_TASK_SDCCH8_0,
+	MF_TASK_SDCCH8_1,
+	MF_TASK_SDCCH8_2,
+	MF_TASK_SDCCH8_3,
+	MF_TASK_SDCCH8_4,
+	MF_TASK_SDCCH8_5,
+	MF_TASK_SDCCH8_6,
+	MF_TASK_SDCCH8_7,
+
+	MF_TASK_SDCCH4_CBCH,
+	MF_TASK_SDCCH8_CBCH,
+
+	MF_TASK_TCH_F_EVEN,
+	MF_TASK_TCH_F_ODD,
+	MF_TASK_TCH_H_0,
+	MF_TASK_TCH_H_1,
+
+	MF_TASK_NEIGH_PM51_C0T0,
+	MF_TASK_NEIGH_PM51,
+	MF_TASK_NEIGH_PM26E,
+	MF_TASK_NEIGH_PM26O,
+
+	/* Test task: send Normal Burst in all timeslots */
+	MF_TASK_UL_ALL_NB,
+};
+
+enum mf_sched_item_flag {
+	MF_F_SACCH	= (1 << 0),
+};
+
+/* The scheduler itself */
+struct mframe_scheduler {
+	uint32_t tasks;
+	uint32_t tasks_tgt;
+	uint32_t safe_fn;
+};
+
+uint8_t mframe_task2chan_nr(enum mframe_task mft, uint8_t ts);
+
+/* Enable a specific task */
+void mframe_enable(enum mframe_task task_id);
+
+/* Disable a specific task */
+void mframe_disable(enum mframe_task task_id);
+
+/* Replace the current active set by the new one */
+void mframe_set(uint32_t tasks);
+
+/* Schedule mframe_sched_items according to current MF TASK list */
+void mframe_schedule(void);
+
+/* reset the scheduler, disabling all tasks */
+void mframe_reset(void);
+
+#endif /* _MFRAME_SCHED_H */
diff --git a/src/target/firmware/include/layer1/prim.h b/src/target/firmware/include/layer1/prim.h
new file mode 100644
index 00000000..30c51ae6
--- /dev/null
+++ b/src/target/firmware/include/layer1/prim.h
@@ -0,0 +1,34 @@
+#ifndef _L1_PRIM_H
+#define _L1_PRIM_H
+
+#include <stdint.h>
+
+#include <layer1/tdma_sched.h>
+
+struct l1ctl_fbsb_req;
+
+/* Utils */
+const uint8_t *pu_get_idle_frame(void);
+void pu_update_rx_level(uint8_t rx_level);
+const uint8_t *pu_get_meas_frame(void);
+
+/* Primitives tests/requests */
+void l1s_fb_test(uint8_t base_fn, uint8_t fb_mode);
+void l1s_sb_test(uint8_t base_fn);
+void l1s_pm_test(uint8_t base_fn, uint16_t arfcn);
+void l1s_nb_test(uint8_t base_fn);
+
+void l1s_fbsb_req(uint8_t base_fn, struct l1ctl_fbsb_req *req);
+void l1a_freq_req(uint32_t fn_sched);
+void l1a_rach_req(uint16_t offset, uint8_t combined, uint8_t ra);
+
+/* Primitives raw scheduling sets */
+extern const struct tdma_sched_item nb_sched_set[];
+extern const struct tdma_sched_item nb_sched_set_ul[];
+
+extern const struct tdma_sched_item tch_sched_set[];
+extern const struct tdma_sched_item tch_a_sched_set[];
+extern const struct tdma_sched_item tch_d_sched_set[];
+extern const struct tdma_sched_item neigh_pm_sched_set[];
+
+#endif /* _L1_PRIM_H */
diff --git a/src/target/firmware/include/layer1/rfch.h b/src/target/firmware/include/layer1/rfch.h
new file mode 100644
index 00000000..344523c3
--- /dev/null
+++ b/src/target/firmware/include/layer1/rfch.h
@@ -0,0 +1,9 @@
+#ifndef _L1_RFCH_H
+#define _L1_RFCH_H
+
+struct gsm_time;
+
+void rfch_get_params(struct gsm_time *t,
+                     uint16_t *arfcn_p, uint8_t *tsc_p, uint8_t *tn_p);
+
+#endif /* _L1_RFCH_H */
diff --git a/src/target/firmware/include/layer1/sched_gsmtime.h b/src/target/firmware/include/layer1/sched_gsmtime.h
new file mode 100644
index 00000000..c40359ea
--- /dev/null
+++ b/src/target/firmware/include/layer1/sched_gsmtime.h
@@ -0,0 +1,24 @@
+#ifndef _L1_SCHED_GSMTIME_H
+#define _L1_SCHED_GSMTIME_H
+
+#include <stdint.h>
+#include <osmocom/core/linuxlist.h>
+
+struct sched_gsmtime_event {
+	struct llist_head list;
+	const struct tdma_sched_item *si;
+	uint32_t fn;
+	uint16_t p3;	/* parameter for TDMA scheduler */
+};
+
+/* initialize the GSMTIME scheduler */
+void sched_gsmtime_init(void);
+
+/* Scheduling of a single event at a givnen GSM time */
+int sched_gsmtime(const struct tdma_sched_item *si, uint32_t fn, uint16_t p3);
+
+/* execute all GSMTIME one-shot events pending for 'current_fn' */
+int sched_gsmtime_execute(uint32_t current_fn);
+
+void sched_gsmtime_reset(void);
+#endif
diff --git a/src/target/firmware/include/layer1/sync.h b/src/target/firmware/include/layer1/sync.h
new file mode 100644
index 00000000..3565ee20
--- /dev/null
+++ b/src/target/firmware/include/layer1/sync.h
@@ -0,0 +1,206 @@
+#ifndef _L1_SYNC_H
+#define _L1_SYNC_H
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <layer1/tdma_sched.h>
+#include <layer1/mframe_sched.h>
+#include <l1ctl_proto.h>
+
+/* structure representing L1 sync information about a cell */
+struct l1_cell_info {
+	/* on which ARFCN (+band) is the cell? */
+	uint16_t	arfcn;
+	/* what's the BSIC of the cell (from SCH burst decoding) */
+	uint8_t		bsic;
+	/* Combined or non-combined CCCH */
+	uint8_t		ccch_mode; /* enum ccch_mode */
+	/* whats the delta of the cells current GSM frame number
+	 * compared to our current local frame number */
+	int32_t		fn_offset;
+	/* how much does the TPU need adjustment (delta) to synchronize
+	 * with the cells burst */
+	uint32_t	time_alignment;
+	/* FIXME: should we also store the AFC value? */
+};
+
+enum l1s_chan {
+	L1S_CHAN_MAIN,
+	L1S_CHAN_SACCH,
+	L1S_CHAN_TRAFFIC,
+	_NUM_L1S_CHAN
+};
+
+enum l1_compl {
+	L1_COMPL_FB,
+	L1_COMPL_RACH,
+	L1_COMPL_TX_NB,
+	L1_COMPL_TX_TCH,
+};
+
+typedef void l1_compl_cb(enum l1_compl c);
+
+#define L1S_NUM_COMPL		32
+#define L1S_NUM_NEIGH_CELL	6
+
+struct l1s_h0 {
+	uint16_t arfcn;
+};
+
+struct l1s_h1 {
+	uint8_t hsn;
+	uint8_t maio;
+	uint8_t n;
+	uint16_t ma[64];
+};
+
+struct l1s_state {
+	struct gsm_time	current_time;	/* current GSM time */
+	struct gsm_time	next_time;	/* GSM time at next TMDMA irq */
+
+	/* the cell on which we are camping right now */
+	struct l1_cell_info serving_cell;
+
+	/* neighbor cell sync info */
+	struct l1_cell_info neigh_cell[L1S_NUM_NEIGH_CELL];
+
+	/* TDMA scheduler */
+	struct tdma_scheduler tdma_sched;
+
+	/* Multiframe scheduler */
+	struct mframe_scheduler mframe_sched;
+
+	/* The current TPU offset register */
+	uint32_t	tpu_offset;
+	int32_t		tpu_offset_correction;
+
+	/* TX parameters */
+	int8_t		ta;
+	uint8_t		tx_power;
+
+	/* TCH */
+	uint8_t		tch_mode;
+	uint8_t		tch_sync;
+	uint8_t		audio_mode;
+
+	/* Transmit queues of pending packets for main DCCH and ACCH */
+	struct llist_head tx_queue[_NUM_L1S_CHAN];
+	struct msgb *tx_meas;
+
+	/* Which L1A completions are scheduled right now */
+	uint32_t scheduled_compl;
+	/* callbacks for each of the completions */
+	l1_compl_cb *completion[L1S_NUM_COMPL];
+
+	/* Structures below are for L1-task specific parameters, used
+	 * to communicate between l1-sync and l1-async (l23_api) */
+	struct {
+		uint8_t mode;	/* FB_MODE 0/1 */
+	} fb;
+
+	struct {
+		/* power measurement l1 task */
+		unsigned int mode;
+		union {
+			struct {
+				uint16_t arfcn_start;
+				uint16_t arfcn_next;
+				uint16_t arfcn_end;
+			} range;
+		};
+		struct msgb *msg;
+	} pm;
+
+	struct {
+		uint8_t		ra;
+	} rach;
+
+	struct {
+		enum {
+			GSM_DCHAN_NONE = 0,
+			GSM_DCHAN_SDCCH_4,
+			GSM_DCHAN_SDCCH_4_CBCH,
+			GSM_DCHAN_SDCCH_8,
+			GSM_DCHAN_SDCCH_8_CBCH,
+			GSM_DCHAN_TCH_H,
+			GSM_DCHAN_TCH_F,
+			GSM_DCHAN_UNKNOWN,
+		} type;
+
+		uint8_t scn;
+		uint8_t tsc;
+		uint8_t tn;
+		uint8_t h;
+
+		union {
+			struct l1s_h0 h0;
+			struct l1s_h1 h1;
+		};
+
+		uint8_t st_tsc;
+		uint8_t st_tn;
+		uint8_t st_h;
+
+		union {
+			struct l1s_h0 st_h0;
+			struct l1s_h1 st_h1;
+		};
+	} dedicated;
+
+	/* neighbour cell power measurement process */
+	struct {
+		uint8_t n, second;
+		uint8_t pos;
+		uint8_t running;
+		uint16_t band_arfcn[64];
+		uint8_t tn[64];
+		uint8_t	level[64];
+	} neigh_pm;
+};
+
+extern struct l1s_state l1s;
+
+struct l1s_meas_hdr {
+	uint16_t snr;		/* signal/noise ratio */
+	int16_t toa_qbit;	/* time of arrival (qbits) */
+	int16_t pm_dbm8;	/* power level in dbm/8 */
+	int16_t freq_err; 	/* Frequency error in Hz */
+};
+
+int16_t l1s_snr_int(uint16_t snr);
+uint16_t l1s_snr_fract(uint16_t snr);
+
+void l1s_dsp_abort(void);
+
+void l1s_tx_apc_helper(uint16_t arfcn);
+
+/* schedule a completion */
+void l1s_compl_sched(enum l1_compl c);
+
+void l1s_init(void);
+
+/* reset the layer1 as part of synchronizing to a new cell */
+void l1s_reset(void);
+
+/* init.c */
+void layer1_init(void);
+
+/* A debug macro to print every TDMA frame */
+#ifdef DEBUG_EVERY_TDMA
+#define putchart(x) putchar(x)
+#else
+#define putchart(x)
+#endif
+
+/* Convert an angle in fx1.15 notatinon into Hz */
+#define BITFREQ_DIV_2PI		43104	/* 270kHz / 2 * pi */
+#define BITFREQ_DIV_PI		86208	/* 270kHz / pi */
+#define ANG2FREQ_SCALING	(2<<15)	/* 2^15 scaling factor for fx1.15 */
+#define ANGLE_TO_FREQ(angle)	((int16_t)angle * BITFREQ_DIV_PI / ANG2FREQ_SCALING)
+
+void l1s_reset_hw(void);
+void synchronize_tdma(struct l1_cell_info *cinfo);
+void l1s_time_inc(struct gsm_time *time, uint32_t delta_fn);
+void l1s_time_dump(const struct gsm_time *time);
+
+#endif /* _L1_SYNC_H */
diff --git a/src/target/firmware/include/layer1/tdma_sched.h b/src/target/firmware/include/layer1/tdma_sched.h
new file mode 100644
index 00000000..f58d59bb
--- /dev/null
+++ b/src/target/firmware/include/layer1/tdma_sched.h
@@ -0,0 +1,73 @@
+#ifndef _L1_TDMA_SCHED_H
+#define _L1_TDMA_SCHED_H
+
+#include <stdint.h>
+
+/* TDMA scheduler */
+
+/* The idea of this scheduler is that we have a circular buffer of buckets,
+ * where each bucket corresponds to one future TDMA frame [interrupt]. Each
+ * bucket contains of a list of callbacks which are executed when the bucket
+ * index reaches that particular bucket. */
+
+#define TDMASCHED_NUM_FRAMES	25
+#define TDMASCHED_NUM_CB	8
+
+#define TDMA_IFLG_TPU		(1<<0)
+#define TDMA_IFLG_DSP		(1<<1)
+
+typedef int tdma_sched_cb(uint8_t p1, uint8_t p2, uint16_t p3);
+
+/* A single item in a TDMA scheduler bucket */
+struct tdma_sched_item {
+	tdma_sched_cb *cb;
+	uint8_t p1;
+	uint8_t p2;
+	uint16_t p3;
+	int16_t prio;
+	uint16_t flags;		/* TDMA_IFLG_xxx */
+};
+
+/* A bucket inside the TDMA scheduler */
+struct tdma_sched_bucket {
+	struct tdma_sched_item item[TDMASCHED_NUM_CB];
+	uint8_t num_items;
+};
+
+/* The scheduler itself, consisting of buckets and a current index */
+struct tdma_scheduler {
+	struct tdma_sched_bucket bucket[TDMASCHED_NUM_FRAMES];
+	uint8_t cur_bucket;
+};
+
+/* Schedule an item at 'frame_offset' TDMA frames in the future */
+int tdma_schedule(uint8_t frame_offset, tdma_sched_cb *cb,
+                  uint8_t p1, uint8_t p2, uint16_t p3, int16_t prio);
+
+/* Schedule a set of items starting from 'frame_offset' TDMA frames in the future */
+int tdma_schedule_set(uint8_t frame_offset, const struct tdma_sched_item *item_set, uint16_t p3);
+
+/* Scan current frame scheduled items for flags */
+uint16_t tdma_sched_flag_scan(void);
+
+/* Execute pre-scheduled events for current frame */
+int tdma_sched_execute(void);
+
+/* Advance TDMA scheduler to the next bucket */
+void tdma_sched_advance(void);
+
+/* reset the scheduler; erase all scheduled items */
+void tdma_sched_reset(void);
+
+/* debug function: print number of entries of all TDMA buckets */
+void tdma_sched_dump(void);
+
+
+extern int tdma_end_set(uint8_t p1, uint8_t p2, uint16_t p3);
+#define SCHED_ITEM(x, p, y, z)		{ .cb = x, .p1 = y, .p2 = z, .prio = p, .flags = 0 }
+#define SCHED_ITEM_DT(x, p, y, z)	{ .cb = x, .p1 = y, .p2 = z, .prio = p, \
+					  .flags = TDMA_IFLG_TPU | TDMA_IFLG_DSP }
+#define SCHED_END_FRAME()		{ .cb = NULL, .p1 = 0, .p2 = 0 }
+#define SCHED_END_SET()			{ .cb = &tdma_end_set, .p1 = 0, .p2 = 0 }
+
+#endif /* _L1_TDMA_SCHED_H */
diff --git a/src/target/firmware/include/layer1/toa.h b/src/target/firmware/include/layer1/toa.h
new file mode 100644
index 00000000..dea9dd96
--- /dev/null
+++ b/src/target/firmware/include/layer1/toa.h
@@ -0,0 +1,10 @@
+#ifndef _L1_TOA_H
+#define _L1_TOA_H
+
+/* Input a qbits error sample into the TOA averaging */
+void toa_input(int32_t offset, uint32_t snr);
+
+/* Reset the TOA counters */
+void toa_reset(void);
+
+#endif
diff --git a/src/target/firmware/include/layer1/tpu_window.h b/src/target/firmware/include/layer1/tpu_window.h
new file mode 100644
index 00000000..7b146f12
--- /dev/null
+++ b/src/target/firmware/include/layer1/tpu_window.h
@@ -0,0 +1,24 @@
+#ifndef _L1_TPU_CTRL_H
+#define _L1_TPU_CTRL_H
+
+enum l1_rxwin_type {
+	L1_RXWIN_PW,	/* power measurement */
+	L1_RXWIN_FB,	/* FCCH burst detection */
+	L1_RXWIN_SB,	/* SCH burst detection */
+	L1_RXWIN_NB,	/* Normal burst decoding */
+	_NUM_L1_RXWIN
+};
+
+enum l1_txwin_type {
+	L1_TXWIN_NB,	/* Normal burst sending */
+	L1_TXWIN_AB,	/* RACH burst sending */
+	_NUM_L1_TXWIN
+};
+
+void l1s_win_init(void);
+void l1s_rx_win_ctrl(uint16_t arfcn, enum l1_rxwin_type wtype, uint8_t tn_ofs);
+void l1s_tx_win_ctrl(uint16_t arfcn, enum l1_txwin_type wtype, uint8_t pwr, uint8_t tn_ofs);
+
+void tpu_end_scenario(void);
+
+#endif /* _L1_TPU_CTRL_H */
diff --git a/src/target/firmware/include/manifest.h b/src/target/firmware/include/manifest.h
new file mode 100644
index 00000000..6c1b2026
--- /dev/null
+++ b/src/target/firmware/include/manifest.h
@@ -0,0 +1,10 @@
+
+#ifndef _MANIFEST_H
+#define _MANIFEST_H
+
+extern const char *manifest_application;
+extern const char *manifest_revision;
+extern const char *manifest_board;
+extern const char *manifest_environment;
+
+#endif /* !_MANIFEST_H */
diff --git a/src/target/firmware/include/memory.h b/src/target/firmware/include/memory.h
new file mode 100644
index 00000000..b0a0490c
--- /dev/null
+++ b/src/target/firmware/include/memory.h
@@ -0,0 +1,28 @@
+#ifndef _MEMORY_H
+#define _MEMORY_H
+
+#define __arch_getb(a)			(*(volatile unsigned char *)(a))
+#define __arch_getw(a)			(*(volatile unsigned short *)(a))
+#define __arch_getl(a)			(*(volatile unsigned int *)(a))
+
+#define __arch_putb(v,a)		(*(volatile unsigned char *)(a) = (v))
+#define __arch_putw(v,a)		(*(volatile unsigned short *)(a) = (v))
+#define __arch_putl(v,a)		(*(volatile unsigned int *)(a) = (v))
+
+#define __raw_writeb(v,a)		__arch_putb(v,a)
+#define __raw_writew(v,a)		__arch_putw(v,a)
+#define __raw_writel(v,a)		__arch_putl(v,a)
+
+#define __raw_readb(a)			__arch_getb(a)
+#define __raw_readw(a)			__arch_getw(a)
+#define __raw_readl(a)			__arch_getl(a)
+
+#define writeb(v,a)			__arch_putb(v,a)
+#define writew(v,a)			__arch_putw(v,a)
+#define writel(v,a)			__arch_putl(v,a)
+
+#define readb(a)			__arch_getb(a)
+#define readw(a)			__arch_getw(a)
+#define readl(a)			__arch_getl(a)
+
+#endif /* _MEMORY_H */
diff --git a/src/target/firmware/include/mtk/bfe.h b/src/target/firmware/include/mtk/bfe.h
new file mode 100644
index 00000000..b07f620d
--- /dev/null
+++ b/src/target/firmware/include/mtk/bfe.h
@@ -0,0 +1,107 @@
+#ifndef _MTK_BFE_H
+#define _MTK_BFE_H
+
+/* MTK Baseband Frontend */
+
+/* MT6235 Chapter 10 */
+
+enum mtk_bfe_reg {
+	BFE_CON			= 0x0000,
+	BFE_STA			= 0x0004,
+	/* Rx Configuration Register */
+	RX_CFG			= 0x0010,
+	/* Rx Control Register */
+	RX_CON			= 0x0014,
+	/* RX Interference Detection Power Measurement Control Register */
+	RX_PM_CON		= 0x0018,
+	/* RX FIR Coefficient Set ID Control Register */
+	RX_FIR_CSID_CON		= 0x001c,
+	/* RX Ram0 Coefficient Set 0 Register */
+	RX_RAM0_CS0		= 0x0070,
+	/* RX Ram1 Coefficient Set 0 Register */
+	RX_RAM1_CS0		= 0x0020,
+	/* Rx Interference Detection HPF Power Register */
+	RX_HPWR_STS		= 0x00b0,		
+	/* Rx Interference Detection BPF Power Register */
+	RX_BPWR_STS		= 0x00b4,
+
+	TX_CFG			= 0x0060,
+	TX_CON			= 0x0064,
+	TX_OFF			= 0x0068,
+};
+
+#define RX_RAM0_CS(n)	(RX_RAM0_CS0 + (n)*4)
+#define RX_RAM1_CS(n)	(RX_RAM0_CS1 + (n)*4)
+
+/* SWAP I/Q before input to baesband frontend */
+#define RX_CFG_SWAP_IQ		0x0001
+/* Bypass RX FIR filter control */
+#define RX_CFG_BYPFLTR		0x0002
+/* Number of RX FIR filter taps */
+#define RX_CFG_FIRTPNO(n)	(((n) & 0x3f) << 4)
+
+#define RX_CON_BLPEN_NORMAL	(0 << 0)
+#define RX_CON_BLPEN_LOOPB	(1 << 0)
+#define RX_CON_BLPEN_LOOPB_FILT	(2 << 0)
+
+/* Phase de-rotation in wide FIR data path */
+#define RX_CON_PH_ROEN_W	(1 << 2)
+/* Phase de-rotation in narrow FIR data path */
+#define RX_CON_PH_ROEN_N	(1 << 3)
+/* RX I-data gain compenstation select (+/- 1.5dB */
+#define RX_CON_IGAINSEL_00dB	(0 << 4)
+#define RX_CON_IGAINSEL_03dB	(1 << 4)
+#define RX_CON_IGAINSEL_06dB	(2 << 4)
+#define RX_CON_IGAINSEL_09dB	(3 << 4)
+#define RX_CON_IGAINSEL_12dB	(4 << 4)
+#define RX_CON_IGAINSEL_15dB	(5 << 4)
+#define RX_CON_IGAINSEL_n03dB	(9 << 4)
+#define RX_CON_IGAINSEL_n06dB	(10 << 4)
+#define RX_CON_IGAINSEL_n09dB	(11 << 4)
+#define RX_CON_IGAINSEL_n12dB	(12 << 4)
+#define RX_CON_IGAINSEL_n15dB	(13 << 4)
+
+/* TX_CFG */
+/* Appending Bits enable */
+#define TX_CFG_APNDEN		(1 << 0)
+/* Ramp Profile Select for 8PSK */
+#define TX_CFG_RPSEL_I		(0 << 1)	/* 50 kHz sine tone */
+#define TX_CFG_RPSEL_II		(1 << 1)	/* null DC I/Q */
+#define TX_CFG_RPSEL_III	(3 << 1)
+#define TX_CFG_INTEN		(1 << 3)	/* Interpolate between bursts */
+#define TX_CFG_MDBYP		(1 << 4)	/* Modulator Bypass */
+#define TX_CFG_SGEN		(1 << 5)	/* 540 kHz sine tone */
+#define TX_CFG_ALL_10GEN_ZERO	(1 << 6)
+#define TX_CFG_ALL_10GEN_ONE	(2 << 6)
+#define TX_CFG_SW_QBCNT(n)	(((n) & 0x1f) << 8)
+#define TX_CFG_GMSK_DTAP_SYM_1	(0 << 13)
+#define TX_CFG_GMSK_DTAP_SYM_0	(1 << 13)
+#define TX_CFG_GMSK_DTAP_SYM_2	(2 << 13)
+
+#define TX_CON_IQSWP		(1 << 0)	/* Swap I/Q */
+/* GMSK or 8PSK modulation for 1st through 4th burst */
+#define TX_CON_MDSEL1_8PSK	(1 << 2)
+#define TX_CON_MDSEL2_8PSK	(1 << 3)
+#define TX_CON_MDSEL3_8PSK	(1 << 4)
+#define TX_CON_MDSEL4_8PSK	(1 << 5)
+/* Quadratur phase compensation select */
+#define TX_CON_PHSEL_0deg	(0 << 8)
+#define TX_CON_PHSEL_1deg	(1 << 8)
+#define TX_CON_PHSEL_2deg	(2 << 8)
+#define TX_CON_PHSEL_3deg	(3 << 8)
+#define TX_CON_PHSEL_4deg	(4 << 8)
+#define TX_CON_PHSEL_5deg	(5 << 8)
+#define TX_CON_PHSEL_n5deg	(10 << 8)
+#define TX_CON_PHSEL_n4deg	(11 << 8)
+#define TX_CON_PHSEL_n3deg	(12 << 8)
+#define TX_CON_PHSEL_n2deg	(13 << 8)
+#define TX_CON_PHSEL_n1deg	(14 << 8)
+/* GMSK modulator output latenct */
+#define TX_CON_GMSK_DTAP_QB(n)	(((n) & 3) << 12)
+
+#define TX_OFF_I(n)		(((n) & 0x3f) << 0)
+#define TX_OFF_Q(n)		(((n) & 0x3f) << 8)
+/* Double Buffering */
+#define TX_OFF_TYP_DB		0x8000
+
+#endif /* _MTK_BFE_H */
diff --git a/src/target/firmware/include/mtk/bpi.h b/src/target/firmware/include/mtk/bpi.h
new file mode 100644
index 00000000..8aa8ee54
--- /dev/null
+++ b/src/target/firmware/include/mtk/bpi.h
@@ -0,0 +1,20 @@
+#ifndef _MTK_BPI_H
+#define _MTK_BPI_H
+
+/* MTK Baseband Parallel Interface */
+
+/* Chapter 9.2 of MT6235 Data Sheet */
+
+#define BPI_BUF(n)	(BPI_BUF0 + ((n) * 4))
+
+#define MTK_BPI(n)	(n)
+
+enum mtk_bpi_reg {
+	BPI_CON		= 0x0000,
+	BPI_BUF0	= 0x0004,
+	BPI_ENA0	= 0x00b0,
+	BPI_ENA1	= 0x00b4,
+	BPI_ENA2	= 0x00b8,
+};
+
+#endif /* _MTK_BPI_H */
diff --git a/src/target/firmware/include/mtk/bsi.h b/src/target/firmware/include/mtk/bsi.h
new file mode 100644
index 00000000..6f381ce3
--- /dev/null
+++ b/src/target/firmware/include/mtk/bsi.h
@@ -0,0 +1,41 @@
+#ifndef _MTK_BSI_H
+#define _MTK_BSI_H
+
+/* MTK Baseband Serial Interface */
+
+enum bsi_reg {
+	BSI_CON		= 0x0000,
+	BSI_D0_CON	= 0x0004,
+	BSI_D0_DAT	= 0x0008,
+
+	BSI_ENA_0	= 0x0190,
+	BSI_ENA_1	= 0x0194,
+	BSI_IO_CON	= 0x0198,
+	BSI_DOUT	= 0x019c,
+	BSI_DIN		= 0x01a0,
+	BSI_PAIR_NUM	= 0x01a4,
+	
+};
+
+/* Compute offset of BSI_D0_CON / BSI_D0_DAT registers */
+#define BSI_Dn_CON(x)	(BSI_D0_CON + (x * 8))
+#define BSI_Dn_CON(x)	(BSI_D0_DAT + (x * 8))
+
+/* MT6235 Section 9.1.1 */
+#define BSI_CON_CLK_POL_INV	(1 << 0)
+#define BSI_CON_CLK_SPD_52_2	(0 << 1)	/* 26 MHz */
+#define BSI_CON_CLK_SPD_52_4	(1 << 1)	/* 13 MHz */
+#define BSI_CON_CLK_SPD_52_6	(2 << 1)	/* 8.67 MHz */
+#define BSI_CON_CLK_SPD_52_8	(3 << 1)	/* 6.50 MHz */
+#define BSI_CON_IMOD		(1 << 3)
+#define BSI_CON_EN0_LEN_SHORT	(1 << 4)
+#define BSI_CON_EN0_POL_INV	(1 << 5)
+#define BSI_CON_EN0_LEN_SHORT	(1 << 6)
+#define BSI_CON_EN0_POL_INV	(1 << 7)
+#define BSI_CON_SETENV		(1 << 8)
+
+/* how the length is encoded in BSI_Dx_CON */
+#define BSI_Dx_LEN(n)		((n & 0x7f) << 8)
+#define BSI_Dx_ISB		0x8000		/* select device 1 */
+
+#endif /* _MTK_BSI_H */
diff --git a/src/target/firmware/include/mtk/emi.h b/src/target/firmware/include/mtk/emi.h
new file mode 100644
index 00000000..18184992
--- /dev/null
+++ b/src/target/firmware/include/mtk/emi.h
@@ -0,0 +1,42 @@
+/*
+ * (C) 2010 by Tieto <www.tieto.com>
+ *	Marcin Mielczarczyk <marcin.mielczarczyk@tieto.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef __MTK_EMI_H_
+#define __MTK_EMI_H_
+
+/* External Memory Interface register definitions */
+#define MTK_EMI_CONA		(MTK_EMI_BASE + 0x00)
+#define MTK_EMI_CONB		(MTK_EMI_BASE + 0x08)
+#define MTK_EMI_CONC		(MTK_EMI_BASE + 0x10)
+#define MTK_EMI_COND		(MTK_EMI_BASE + 0x18)
+#define MTK_EMI_CONI		(MTK_EMI_BASE + 0x40)
+#define MTK_EMI_CONJ		(MTK_EMI_BASE + 0x48)
+#define MTK_EMI_CONK		(MTK_EMI_BASE + 0x50)
+#define MTK_EMI_CONL		(MTK_EMI_BASE + 0x58)
+#define MTK_EMI_CONM		(MTK_EMI_BASE + 0x60)
+#define MTK_EMI_CONN		(MTK_EMI_BASE + 0x68)
+#define MTK_EMI_GENA		(MTK_EMI_BASE + 0x70)
+#define MTK_EMI_GENB		(MTK_EMI_BASE + 0x78)
+#define MTK_EMI_GENC		(MTK_EMI_BASE + 0x80)
+#define MTK_EMI_GEND		(MTK_EMI_BASE + 0x88)
+
+#endif
diff --git a/src/target/firmware/include/mtk/mt6139.h b/src/target/firmware/include/mtk/mt6139.h
new file mode 100644
index 00000000..35458b5d
--- /dev/null
+++ b/src/target/firmware/include/mtk/mt6139.h
@@ -0,0 +1,60 @@
+#ifndef _MTK_MT6139_H
+#define _MTK_MT6139_H
+
+enum mt6139_band {
+	MTRF_BAND_GSM850	= 0,
+	MTRF_BAND_GSM900	= 1,
+	MTRF_BAND_GSM1800	= 2,
+	MTRF_BAND_GSM1900	= 3,
+};
+
+#define MT6139_CW0_SYNCP_SHIFT	0
+#define MT6139_CW0_SYNCPW	(1 << 2)
+#define MT6139_CW0_DIEN		(1 << 3)
+#define MT6139_CW0_FLT		(1 << 4)
+#define MT6139_CW0_AFC_SHIFT	5
+#define MT6139_CW0_VCO_SEL	(1 << 11)
+#define MT6139_CW0_GPO		(1 << 12)
+#define MT6139_CW0_POR		(1 << 13)
+
+#define MT6139_CW1_NFRACT_SHIFT	0
+#define MT6139_CW1_NINT_SHIFT 	8
+#define MT6139_CW1_BAND_SHIFT 	16
+#define MT6139_CW1_TRX_850	(1 << 18)
+
+#define MT6139_CW2_GAINTBL_SHIFT 0
+#define MT6139_CW2_MODE_SHIFT	6
+#define MT6139_CW2_AUTO_CAL	(1 << 9)
+#define MT6139_CW2_DCD_AQ_SHIFT	10
+#define MT6139_CW2_DCD_AI_SHIFT	16
+
+#define MT6139_CW9_DCD_CQ_SHIFT	0
+#define MT6139_CW9_DCD_BQ_SHIFT	7
+#define MT6139_CW9_PWR_DAC_C	(1 << 14)
+#define MT6139_CW9_PWR_DAC_B	(1 << 15)
+#define MT6139_CW9_PWR_DAC_A	(1 << 16)
+#define MT6139_CW9_AM_ENABLE	(1 << 17)
+
+enum mt6139_cw2_mode {
+	MODE_SLEEP	= 0x0,
+	MODE_WARM_UP	= 0x1,
+	MODE_RECEIVE	= 0x3,
+	MODE_TRANSMIT	= 0x4,
+};
+
+#define MT6139_CW11_TX_CTL	(1 << 0)
+#define MT6139_CW11_TXG_IQM	(1 << 1)
+#define MT6139_CW11_TXD_IQM	(1 << 2)
+#define MT6139_CW11_TX_DIV2	(1 << 3)
+#define MT6139_CW11_TX_DIV4	(1 << 4)
+#define MT6139_CW11_TXG_BUF	(1 << 5)
+#define MT6139_CW11_TXD_BUF	(1 << 6)
+#define MT6139_CW11_TXMODGAIN_SHIFT	7
+#define MT6139_CW11_TX_FLT_SHIFT	10
+#define MT6139_CW11_TXAPC_SHIFT		14
+#define MT6139_CW11_TXPW_SHIFT		16
+#define MT6139_CW11_TXBIAST_SHIFT	18
+#define MT6139_CW11_TXDIV_GC0	(1 << 20)
+#define MT6139_CW11_TXDIV_GC1	(1 << 21)
+
+#endif /* _MTK_MT6139_H */
diff --git a/src/target/firmware/include/mtk/mt6235.h b/src/target/firmware/include/mtk/mt6235.h
new file mode 100644
index 00000000..fb9d368e
--- /dev/null
+++ b/src/target/firmware/include/mtk/mt6235.h
@@ -0,0 +1,74 @@
+/*
+ * (C) 2010 by Tieto <www.tieto.com>
+ *	Marcin Mielczarczyk <marcin.mielczarczyk@tieto.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef __MT6235_H
+#define __MT6235_H
+
+/* Peripheral base addresses */
+#define MTK_EFUSE_BASE		0x80000000
+#define MTK_CONFG_BASE		0x80010000
+#define MTK_GPIO_BASE		0x80020000
+#define MTK_RGU_BASE		0x80030000
+#define MTK_EMI_BASE		0x81000000
+#define MTK_CIRQ_BASE		0x81010000
+#define MTK_DMA_BASE		0x81020000
+#define MTK_UART1_BASE		0x81030000
+#define MTK_UART2_BASE		0x81040000
+#define MTK_UART3_BASE		0x81050000
+#define MTK_GPT_BASE		0x81060000
+#define MTK_KP_BASE		0x81080000
+#define MTK_PWM_BASE		0x81090000
+#define MTK_SIM_BASE		0x810A0000
+#define MTK_RTC_BASE		0x810C0000
+#define MTK_SEJ_BASE		0x810D0000
+#define MTK_BM_BASE		0x810E0000
+#define MTK_IRDA_BASE		0x810F0000
+#define MTK_I2C_BASE		0x81100000
+#define MTK_MSDC_BASE		0x81110000
+#define MTK_NFI_BASE		0x81120000
+#define MTK_MSSDC2_BASE		0x81140000
+#define MTK_TDMA_BASE		0x82000000
+#define MTK_BSI_BASE		0x82010000
+#define MTK_BPI_BASE		0x82020000
+#define MTK_AFC_BASE		0x82030000
+#define MTK_APC_BASE		0x82040000
+#define MTK_AUXADC_BASE		0x82050000
+#define MTK_DIVIDER_BASE	0x82060000
+#define MTK_FSC_BASE		0x82070000
+#define MTK_GCU_BASE		0x82080000
+#define MTK_CSD_ACC_BASE	0x82090000
+#define MTK_SHARE1_BASE		0x820A0000
+#define MTK_IRDBG1_BASE		0x820B0000
+#define MTK_SHARE2_BASE		0x820C0000
+#define MTK_IRDBG2_BASE		0x820D0000
+#define MTK_PATCH_BASE		0x820E0000
+#define MTK_AFE_BASE		0x820F0000
+#define MTK_BFE_BASE		0x82100000
+#define MTK_PLL_BASE		0x83000000
+#define MTK_ACIF_BASE		0x83010000
+#define MTK_GMC_BASE		0x84000000
+#define MTK_G2D_BASE		0x84010000
+#define MTK_GCMQ_BASE		0x84020000
+#define MTK_CAM_BASE		0x840B0000
+#define MTK_CRZ_BASE		0x840E0000
+
+#endif
diff --git a/src/target/firmware/include/mtk/mt6235_sciphone_g2.h b/src/target/firmware/include/mtk/mt6235_sciphone_g2.h
new file mode 100644
index 00000000..74d9e7b8
--- /dev/null
+++ b/src/target/firmware/include/mtk/mt6235_sciphone_g2.h
@@ -0,0 +1,38 @@
+#ifndef _SCIPHONE_G2_H
+#define _SCIPHONE_G2_H
+/* Bluelans Sciphone G2 support */
+
+/* Use of the Baseband Parallel Interface by the G2 board */
+#define HB_TX		MTK_BPI(0)
+#define PCS_RX		MTK_BPI(1)
+#define LB_TX		MTK_BPI(2)
+#define PA_EN		MTK_BPI(4)
+#define BAND_SW		MTK_BPI(5)
+#define MODE_PA		MTK_BPI(7)
+#define RF_VCO_EN	MTK_BPI(9)
+
+#define GPIO_GPS_PWR_EN	MTK_GPIO(19)
+#define GPIO_WIFI_EN	MTK_GPIO(20)
+#define GPIO_OP1_EN	MTK_GPIO(22)
+#define GPIO_BT_PWR_EN	MTK_GPIO(39)
+#define GPIO_BT_RST	MTK_GPIO(62)
+#define GPIO_USB_CHR_ID	MTK_GPIO(73)
+#define GPIO_FM_SCL	MTK_GPIO(46)
+#define GPIO_FM_SDA	MTK_GPIO(47)
+#define GPIO_GS_SCL	MTK_GPIO(48)
+#define GPIO_GS_SDA	MTK_GPIO(58)
+#define GPIO_GS_EN	MTK_GPIO(26)
+
+#define GPIO_GPS_EINT	MTK_GPIO(42)
+
+#define EINT_HEADSET	MTK_EINT(0)
+#define EINT_BT		MTK_EINT(1)
+#define EINT_GPS2GSM	MTK_EINT(2)
+#define EINT_WIFI	MTK_EINT(3)
+
+#define CLKM_BT_32k	MTK_CLKM(2)
+#define CLKM_WIFI_32k	MTK_CLKM(3)
+#define CLKM_FM_32k	MTK_CLKM(4)
+
+
+#endif /* _SCIPHONE_G2_H */
diff --git a/src/target/firmware/include/mtk/system.h b/src/target/firmware/include/mtk/system.h
new file mode 100644
index 00000000..45430291
--- /dev/null
+++ b/src/target/firmware/include/mtk/system.h
@@ -0,0 +1,195 @@
+/*
+ * (C) 2010 by Tieto <www.tieto.com>
+ *	Marcin Mielczarczyk <marcin.mielczarczyk@tieto.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#ifndef __MTK_SYSTEM_H_
+#define __MTK_SYSTEM_H_
+
+/*
+ * Configuration block section (Clock, Power Down, Version and Reset
+ */
+
+/* Register definitions */
+#define MTK_CONFG_HW_VERSION	(MTK_CONFG_BASE + 0x000)
+#define MTK_CONFG_FW_VERSION	(MTK_CONFG_BASE + 0x004)
+#define MTK_CONFG_HW_CODE	(MTK_CONFG_BASE + 0x008)
+#define MTK_CONFG_SLEEP_CON	(MTK_CONFG_BASE + 0x114)
+#define MTK_CONFG_MCUCLK_CON	(MTK_CONFG_BASE + 0x118)
+#define MTK_CONFG_DSPCLK_CON	(MTK_CONFG_BASE + 0x11C)
+#define MTK_CONFG_IDN_SEL	(MTK_CONFG_BASE + 0x200)
+#define MTK_CONFG_PDN_CON0	(MTK_CONFG_BASE + 0x300)
+#define MTK_CONFG_PDN_CON1	(MTK_CONFG_BASE + 0x304)
+#define MTK_CONFG_PDN_CON2	(MTK_CONFG_BASE + 0x308)
+#define MTK_CONFG_PDN_CON3	(MTK_CONFG_BASE + 0x30C)
+#define MTK_CONFG_PDN_SET0	(MTK_CONFG_BASE + 0x310)
+#define MTK_CONFG_PDN_SET1	(MTK_CONFG_BASE + 0x314)
+#define MTK_CONFG_PDN_SET2	(MTK_CONFG_BASE + 0x318)
+#define MTK_CONFG_PDN_SET3	(MTK_CONFG_BASE + 0x31C)
+#define MTK_CONFG_PDN_CLR0	(MTK_CONFG_BASE + 0x320)
+#define MTK_CONFG_PDN_CLR1	(MTK_CONFG_BASE + 0x324)
+#define MTK_CONFG_PDN_CLR2	(MTK_CONFG_BASE + 0x328)
+#define MTK_CONFG_PDN_CLR3	(MTK_CONFG_BASE + 0x32C)
+
+/* CONFG_MCUCLK_CON bit fields definitions */
+#define MCUCLK_CON_AHBX8CLK_SHIFT	(0)
+#define MCUCLK_CON_AHBX4CLK_SHIFT	(4)
+#define MCUCLK_CON_ARMCLK_SHIFT		(8)
+#define MCUCLK_CON_EMICLK_SHIFT		(12)
+
+/* PDN_CON0 bit fields definitions */
+#define PDN_CON0_CON0_DMA	(1 << 0)
+#define PDN_CON0_USB		(1 << 1)
+#define PDN_CON0_GCU		(1 << 2)
+#define PDN_CON0_WAVE		(1 << 3)
+#define PDN_CON0_SEJ		(1 << 4)
+#define PDN_CON0_IR		(1 << 6)
+#define PDN_CON0_PWM3		(1 << 7)
+#define PDN_CON0_PWM		(1 << 8)
+#define PDN_CON0_SIM2		(1 << 10)
+#define PDN_CON0_IRDBG1		(1 << 12)
+#define PDN_CON0_IRDBG2		(1 << 13)
+
+/* PDN_CON1 bit fields definitions */
+#define PDN_CON1_GPT		(1 << 0)
+#define PDN_CON1_KP		(1 << 1)
+#define PDN_CON1_GPIO		(1 << 2)
+#define PDN_CON1_UART1		(1 << 3)
+#define PDN_CON1_SIM		(1 << 4)
+#define PDN_CON1_PWM1		(1 << 5)
+#define PDN_CON1_LCD		(1 << 7)
+#define PDN_CON1_UART2		(1 << 8)
+#define PDN_CON1_MSDC		(1 << 9)
+#define PDN_CON1_TP		(1 << 10)
+#define PDN_CON1_PWM2		(1 << 11)
+#define PDN_CON1_NFI		(1 << 12)
+#define PDN_CON1_UART3		(1 << 14)
+#define PDN_CON1_IRDA		(1 << 15)
+
+/* PDN_CON2 bit fields definitions */
+#define PDN_CON2_TDMA		(1 << 0)
+#define PDN_CON2_RTC		(1 << 1)
+#define PDN_CON2_BSI		(1 << 2)
+#define PDN_CON2_BPI		(1 << 3)
+#define PDN_CON2_AFC		(1 << 4)
+#define PDN_CON2_APC		(1 << 5)
+
+/*
+ * Reset Generation Unit block section
+ */
+#define MTK_RGU_WDT_MODE	(MTK_RGU_BASE + 0x00)
+#define MTK_RGU_WDT_LENGTH	(MTK_RGU_BASE + 0x04)
+#define MTK_RGU_WDT_RESTART	(MTK_RGU_BASE + 0x08)
+#define MTK_RGU_WDT_STA		(MTK_RGU_BASE + 0x0C)
+#define MTK_RGU_SW_PERIPH_RSTN	(MTK_RGU_BASE + 0x10)
+#define MTK_RGU_SW_DSP_RSTN	(MTK_RGU_BASE + 0x14)
+#define MTK_RGU_WDT_RSTINTERVAL	(MTK_RGU_BASE + 0x18)
+#define MTK_RGU_WDT_SWRST	(MTK_RGU_BASE + 0x1C)
+
+#define WDT_MODE_KEY		0x2200
+#define WDT_LENGTH_KEY		0x0008
+#define WDT_RESTART_KEY		0x1971
+#define SW_PERIPH_RSTN_KEY	0x0037
+#define WDT_SWRST_KEY		0x1209
+
+/*
+ * RTC block section
+ */
+
+/* RTC registers definition */
+#define MTK_RTC_BBPU		(MTK_RTC_BASE + 0x00)
+#define MTK_RTC_IRQ_STA		(MTK_RTC_BASE + 0x04)
+#define MTK_RTC_IRQ_EN		(MTK_RTC_BASE + 0x08)
+#define MTK_RTC_CII_EN		(MTK_RTC_BASE + 0x0C)
+#define MTK_RTC_AL_MASK		(MTK_RTC_BASE + 0x10)
+#define MTK_RTC_TC_SEC		(MTK_RTC_BASE + 0x14)
+#define MTK_RTC_TC_MIN		(MTK_RTC_BASE + 0x18)
+#define MTK_RTC_TC_HOU		(MTK_RTC_BASE + 0x1C)
+#define MTK_RTC_TC_DOM		(MTK_RTC_BASE + 0x20)
+#define MTK_RTC_TC_DOW		(MTK_RTC_BASE + 0x24)
+#define MTK_RTC_TC_MTH		(MTK_RTC_BASE + 0x28)
+#define MTK_RTC_TC_YEA		(MTK_RTC_BASE + 0x2C)
+#define MTK_RTC_AL_SEC		(MTK_RTC_BASE + 0x30)
+#define MTK_RTC_AL_MIN		(MTK_RTC_BASE + 0x34)
+#define MTK_RTC_AL_HOU		(MTK_RTC_BASE + 0x38)
+#define MTK_RTC_AL_DOM		(MTK_RTC_BASE + 0x3C)
+#define MTK_RTC_AL_DOW		(MTK_RTC_BASE + 0x40)
+#define MTK_RTC_AL_MTH		(MTK_RTC_BASE + 0x44)
+#define MTK_RTC_AL_YEA		(MTK_RTC_BASE + 0x48)
+#define MTK_RTC_XOSCCALI	(MTK_RTC_BASE + 0x4C)
+#define MTK_RTC_POWERKEY1	(MTK_RTC_BASE + 0x50)
+#define MTK_RTC_POWERKEY2	(MTK_RTC_BASE + 0x54)
+#define MTK_RTC_PDN1		(MTK_RTC_BASE + 0x58)
+#define MTK_RTC_PDN2		(MTK_RTC_BASE + 0x5C)
+#define MTK_RTC_SPAR1		(MTK_RTC_BASE + 0x64)
+#define MTK_RTC_DIFF		(MTK_RTC_BASE + 0x6C)
+#define MTK_RTC_CALI		(MTK_RTC_BASE + 0x70)
+#define MTK_RTC_WRTGR		(MTK_RTC_BASE + 0x74)
+
+#define POWERKEY1_MAGIC		0xA357
+#define POWERKEY2_MAGIC		0x67D2
+
+/* RTC_BBPU bit fields definitions */
+#define RTC_BBPU_PWREN		(1 << 0)
+#define RTC_BBPU_WRITE_EN	(1 << 1)
+#define RTC_BBPU_BBPU		(1 << 2)
+#define RTC_BBPU_AUTO		(1 << 3)
+#define RTC_BBPU_CLRPKY		(1 << 4)
+#define RTC_BBPU_RELOAD		(1 << 5)
+#define RTC_BBPU_CBUSY		(1 << 6)
+#define RTC_BBPU_DBING		(1 << 7)
+#define RTC_BBPU_KEY_BBPU	(1 << 8)
+
+/* RTC_BBPU write is only acceptable when KEY_BBPU=0x43 */
+#define BBPU_MAGIC		0x4300
+
+/*
+ * PLL block section
+ */
+
+/* PLL registers definition */
+#define MTK_PLL_PLL		(MTK_PLL_BASE + 0x00)
+#define MTK_PLL_PLL2		(MTK_PLL_BASE + 0x04)
+#define MTK_PLL_CLK_CON		(MTK_PLL_BASE + 0x18)
+#define MTK_PLL_PDN_CON		(MTK_PLL_BASE + 0x1C)
+
+/* MTK_PLL_PLL bit fields definitions */
+#define PLL_PLLVCOSEL		(0 << 0)
+#define PLL_MPLLSEL_SYSCLK	(1 << 3)
+#define PLL_MPLLSEL_PLL		(2 << 3)
+#define PLL_DPLLSEL		(1 << 5)
+#define PLL_UPLLSEL		(1 << 6)
+#define PLL_RST			(1 << 7)
+#define PLL_CALI		(1 << 8)
+
+/* MTK_PLL_CLK_CON bit fields definitions */
+#define PLL_CLKSQ_DIV2_DSP	(1 << 0)
+#define PLL_CLKSQ_DIV2_MCU	(1 << 1)
+#define PLL_CLKSQ_PLD		(1 << 2)
+#define PLL_SRCCLK		(1 << 7)
+#define PLL_CLKSQ_TEST		(1 << 15)
+
+/* MTK_PLL_PDN_CON bit fields definitions */
+#define PLL_PDN_CON_CLKSQ	(1 << 11)
+#define PLL_PDN_CON_MCU_DIV2	(1 << 12)
+#define PLL_PDN_CON_PLL		(1 << 13)
+#define PLL_PDN_CON_DSP_DIV2	(1 << 15)
+
+#endif
diff --git a/src/target/firmware/include/mtk/tdma_timer.h b/src/target/firmware/include/mtk/tdma_timer.h
new file mode 100644
index 00000000..dec0a8a4
--- /dev/null
+++ b/src/target/firmware/include/mtk/tdma_timer.h
@@ -0,0 +1,60 @@
+#ifndef _MTK_TDMA_H
+#define _MTK_TDMA_H
+
+/* MTK TDMA Timer */
+
+/* MT6235 Section 11 */
+
+enum mtk_tdma_reg {
+	/* Read current quarter bit count */
+	TDMA_TQCNT		= 0x0000,
+	/* Latched Qbit counter reset position */
+	TDMA_WRAP		= 0x0004,
+	/* Direct Qbit counter reset position */
+	TDMA_WRAPIMD		= 0x0008,
+	/* Event latch position */
+	TDMA_EVTVAL		= 0x000c,
+	/* DSP software control */
+	TDMA_DTIRQ		= 0x0010,
+	/* MCU software control */
+	TDMA_CTIRQ1		= 0x0014,
+	TDMA_CTIRQ2	 	= 0x0018,
+	/* AFC control */
+	TDMA_AFC0		= 0x0020,
+	TDMA_AFC1		= 0x0024,
+	TDMA_AFC2		= 0x0028,
+	TDMA_AFC3		= 0x002c,
+
+	/* BSI event */
+	TDMA_BSI0		= 0x00b0,
+	/* BPI event */
+	TDMA_BPI0		= 0x0100,
+	/* Auxiliary ADC event */
+	TDMA_AUXEV0		= 0x0400,
+	TDMA_AUXEV1		= 0x0404,
+	/* Event Control */
+	TDMA_EVTENA0		= 0x0150,
+	TDMA_EVTENA1		= 0x0154,
+	TDMA_EVTENA2		= 0x0158,
+	TDMA_EVTENA3		= 0x015c,
+	TDMA_EVTENA4		= 0x0160,
+	TDMA_EVTENA5		= 0x0164,
+	TDMA_EVTENA6		= 0x0168,
+	TDMA_EVTENA6		= 0x016c,
+	TDMA_WRAPOFS		= 0x0170,
+	TDMA_REGBIAS		= 0x0174,
+	TDMA_DTXCON		= 0x0180,
+	TDMA_RXCON		= 0x0184,
+	TDMA_BDLCON		= 0x0188,
+	TDMA_BULCON1		= 0x018c,
+	TDMA_BULCON2		= 0x0190,
+	TDMA_FB_FLAG		= 0x0194,
+	TDMA_FB_CLRI		= 0x0198,
+};
+
+#define TDMA_BSI(n)	(TDMA_BSI0 + (n)*4)
+#define TDMA_BPI(n)	(TDMA_BPI0 + (n)*4)
+	
+	
+
+#endif /* _MTK_TDMA_H */
diff --git a/src/target/firmware/include/rf/trf6151.h b/src/target/firmware/include/rf/trf6151.h
new file mode 100644
index 00000000..6a23d8ac
--- /dev/null
+++ b/src/target/firmware/include/rf/trf6151.h
@@ -0,0 +1,54 @@
+#ifndef _TRF6151_H
+#define _TRF6151_H
+
+#include <osmocom/gsm/gsm_utils.h>
+
+/* initialize (reset + power up) */
+void trf6151_init(uint8_t tsp_uid, uint16_t tsp_reset_id);
+
+/* switch power off or on */
+void trf6151_power(int on);
+
+/* obtain the current total gain of the TRF6151 */
+uint8_t trf6151_get_gain_reg(void);
+
+/* put current set (or computed) gain to register */
+int trf6151_set_gain_reg(uint8_t dbm, int high);
+
+/* set the global gain to use */
+int trf6151_set_gain(uint8_t dbm);
+
+/* obtain the global gain set */
+uint8_t trf6151_get_gain(void);
+
+/* Request the PLL to be tuned to the given frequency */
+/*  arfcn must have ARFCN_UPLINK flag set if you want uplink ! */
+/*  tx selects the TX path only and doesn't set UL band ! */
+void trf6151_set_arfcn(uint16_t arfcn, int tx);
+
+enum trf6151_mode {
+	TRF6151_IDLE,
+	TRF6151_RX,
+	TRF6151_TX,
+};
+
+/* Set the operational mode of the TRF6151 chip */
+void trf6151_set_mode(enum trf6151_mode mode);
+
+void trf6151_test(uint16_t arfcn);
+void trf6151_tx_test(uint16_t arfcn);
+
+/* prepare a Rx window with the TRF6151 finished at time 'start' (in qbits) */
+void trf6151_rx_window(int16_t start_qbits, uint16_t arfcn);
+
+/* prepare a Tx window with the TRF6151 finished at time 'start' (in qbits) */
+void trf6151_tx_window(int16_t start_qbits, uint16_t arfcn);
+
+/* Given the expected input level of exp_inp dBm and the target of target_bb
+ * dBm, configure the RF Frontend with the respective gain */
+void trf6151_compute_gain(int16_t exp_inp, int16_t target_bb);
+
+/* Need for IQ swap */
+int trf6151_iq_swapped(uint16_t band_arfcn, int tx);
+
+#endif /* TRF6151_H */
diff --git a/src/target/firmware/include/rffe.h b/src/target/firmware/include/rffe.h
new file mode 100644
index 00000000..02fc1fda
--- /dev/null
+++ b/src/target/firmware/include/rffe.h
@@ -0,0 +1,38 @@
+#ifndef _RFFE_H
+#define _RFFE_H
+
+#include <osmocom/gsm/gsm_utils.h>
+
+extern const uint8_t system_inherent_gain;
+
+/* initialize RF Frontend */
+void rffe_init(void);
+
+/* switch RF Frontend Mode */
+void rffe_mode(enum gsm_band band, int tx);
+
+/* query RF wiring */
+enum rffe_port
+{
+	PORT_LO		= 0,	/* Combined 850/900 port */
+	PORT_HI		= 1,	/* Combined 1800/1900 port */
+	PORT_GSM850	= 2,
+	PORT_GSM900	= 3,
+	PORT_DCS1800	= 4,
+	PORT_PCS1900	= 5,
+};
+
+uint32_t rffe_get_rx_ports(void);
+uint32_t rffe_get_tx_ports(void);
+
+/* IQ swap requirements */
+int rffe_iq_swapped(uint16_t band_arfcn, int tx);
+
+/* get current gain of RF frontend (anything between antenna and baseband in dBm */
+uint8_t rffe_get_gain(void);
+
+void rffe_set_gain(uint8_t dbm);
+
+void rffe_compute_gain(int16_t exp_inp, int16_t target_bb);
+
+#endif
diff --git a/src/target/firmware/include/spi.h b/src/target/firmware/include/spi.h
new file mode 100644
index 00000000..0925a9a3
--- /dev/null
+++ b/src/target/firmware/include/spi.h
@@ -0,0 +1,7 @@
+#ifndef _SPI_H
+#define _SPI_H
+
+void spi_init(void);
+int spi_xfer(uint8_t dev_idx, uint8_t bitlen, const void *dout, void *din);
+
+#endif /* _SPI_H */
diff --git a/src/target/firmware/include/stdint.h b/src/target/firmware/include/stdint.h
new file mode 100644
index 00000000..627403f9
--- /dev/null
+++ b/src/target/firmware/include/stdint.h
@@ -0,0 +1,36 @@
+#ifndef OSMO_STDINT_H
+#define OSMO_STDINT_H
+
+/* some older toolchains (like gnuarm-3.x) don't provide a C99
+   compliant stdint.h yet, so we define our own here */
+
+/* to make matters worse newer gcc with glibc headers have
+   a incompatible definition of these types. We will use the
+   gcc'ism of #include_next to include the compiler's libc
+   header file and then check if it has defined int8_t and
+   if not we will use our own typedefs */
+
+/* another bad criteria. We can not detect __NEWLIB_H__ or
+   _NEWLIB_VERSION. Assume that older GCCs have a older C library
+   that did not include a stdint.h yet. This is for gnuarm-3.x
+   one of the compilers producing working code right now. */
+
+#if __GNUC__ > 3
+#include_next <stdint.h>
+#endif
+
+#ifndef __int8_t_defined
+typedef signed char int8_t;
+typedef unsigned char uint8_t;
+
+typedef signed short int16_t;
+typedef unsigned short uint16_t;
+
+typedef signed int int32_t;
+typedef unsigned int uint32_t;
+
+typedef long long int int64_t;
+typedef unsigned long long int uint64_t;
+#endif
+
+#endif
diff --git a/src/target/firmware/include/stdio.h b/src/target/firmware/include/stdio.h
new file mode 100644
index 00000000..86f9333d
--- /dev/null
+++ b/src/target/firmware/include/stdio.h
@@ -0,0 +1,53 @@
+#ifndef _STDIO_H
+#define _STDIO_H
+
+#ifndef NULL
+#define NULL	0
+#endif /* NULL */
+
+#include <sys/types.h>
+
+int printf(const char *format, ...);
+int sprintf(char *str, const char *format, ...);
+int snprintf(char *str, size_t size, const char *format, ...);
+#define fprintf(fd, fmt, args...) printf(fmt, ## args)
+
+#include <stdarg.h>
+
+int vprintf(const char *format, va_list ap);
+int vsprintf(char *str, const char *format, va_list ap);
+int vsnprintf(char *str, size_t size, const char *format, va_list ap);
+int puts(const char *s);
+
+#if 0
+/* start.S based uart console */
+#include <calypso/uart.h>
+#define putchar(c)	uart_putchar_wait(1, c)
+int puts(const char *s);
+#endif
+
+#if 0
+/* regular UART console */
+#include <console.h>
+#define putchar(c)	cons_putchar(c)
+#define _puts(s)	cons_puts(s)
+#define ARCH_HAS_CONSOLE
+#endif
+
+#if 1
+/* sercomm based console */
+#include <comm/sercomm_cons.h>
+#define putchar(c)	sercomm_putchar(c)
+#define _puts(s)	sercomm_puts(s)
+#define ARCH_HAS_CONSOLE
+#endif
+
+struct __file {
+};
+
+typedef struct __file FILE;
+
+/* non-standard */
+extern void phex(unsigned int c, unsigned int len);
+
+#endif /* _STDIO_H */
diff --git a/src/target/firmware/include/string.h b/src/target/firmware/include/string.h
new file mode 100644
index 00000000..f060659a
--- /dev/null
+++ b/src/target/firmware/include/string.h
@@ -0,0 +1,12 @@
+#ifndef _STRING_H
+#define _STRING_H
+
+#include <sys/types.h>
+
+size_t strnlen(const char *s, size_t count);
+size_t strlen(const char *s);
+
+void *memset(void *s, int c, size_t n);
+void *memcpy(void *dest, const void *src, size_t n);
+
+#endif
diff --git a/src/target/firmware/include/swab.h b/src/target/firmware/include/swab.h
new file mode 100644
index 00000000..61be900d
--- /dev/null
+++ b/src/target/firmware/include/swab.h
@@ -0,0 +1,297 @@
+#ifndef _LINUX_SWAB_H
+#define _LINUX_SWAB_H
+
+#include <stdint.h>
+#include <defines.h>
+#include <asm/swab.h>
+
+/*
+ * casts are necessary for constants, because we never know how for sure
+ * how U/UL/ULL map to uint16_t, uint32_t, uint64_t. At least not in a portable way.
+ */
+#define ___constant_swab16(x) ((uint16_t)(				\
+	(((uint16_t)(x) & (uint16_t)0x00ffU) << 8) |			\
+	(((uint16_t)(x) & (uint16_t)0xff00U) >> 8)))
+
+#define ___constant_swab32(x) ((uint32_t)(				\
+	(((uint32_t)(x) & (uint32_t)0x000000ffUL) << 24) |		\
+	(((uint32_t)(x) & (uint32_t)0x0000ff00UL) <<  8) |		\
+	(((uint32_t)(x) & (uint32_t)0x00ff0000UL) >>  8) |		\
+	(((uint32_t)(x) & (uint32_t)0xff000000UL) >> 24)))
+
+#define ___constant_swab64(x) ((uint64_t)(				\
+	(((uint64_t)(x) & (uint64_t)0x00000000000000ffULL) << 56) |	\
+	(((uint64_t)(x) & (uint64_t)0x000000000000ff00ULL) << 40) |	\
+	(((uint64_t)(x) & (uint64_t)0x0000000000ff0000ULL) << 24) |	\
+	(((uint64_t)(x) & (uint64_t)0x00000000ff000000ULL) <<  8) |	\
+	(((uint64_t)(x) & (uint64_t)0x000000ff00000000ULL) >>  8) |	\
+	(((uint64_t)(x) & (uint64_t)0x0000ff0000000000ULL) >> 24) |	\
+	(((uint64_t)(x) & (uint64_t)0x00ff000000000000ULL) >> 40) |	\
+	(((uint64_t)(x) & (uint64_t)0xff00000000000000ULL) >> 56)))
+
+#define ___constant_swahw32(x) ((uint32_t)(			\
+	(((uint32_t)(x) & (uint32_t)0x0000ffffUL) << 16) |		\
+	(((uint32_t)(x) & (uint32_t)0xffff0000UL) >> 16)))
+
+#define ___constant_swahb32(x) ((uint32_t)(			\
+	(((uint32_t)(x) & (uint32_t)0x00ff00ffUL) << 8) |		\
+	(((uint32_t)(x) & (uint32_t)0xff00ff00UL) >> 8)))
+
+/*
+ * Implement the following as inlines, but define the interface using
+ * macros to allow constant folding when possible:
+ * ___swab16, ___swab32, ___swab64, ___swahw32, ___swahb32
+ */
+
+static inline __attribute_const__ uint16_t __fswab16(uint16_t val)
+{
+#ifdef __arch_swab16
+	return __arch_swab16(val);
+#else
+	return ___constant_swab16(val);
+#endif
+}
+
+static inline __attribute_const__ uint32_t __fswab32(uint32_t val)
+{
+#ifdef __arch_swab32
+	return __arch_swab32(val);
+#else
+	return ___constant_swab32(val);
+#endif
+}
+
+static inline __attribute_const__ uint64_t __fswab64(uint64_t val)
+{
+#ifdef __arch_swab64
+	return __arch_swab64(val);
+#elif defined(__SWAB_64_THRU_32__)
+	uint32_t h = val >> 32;
+	uint32_t l = val & ((1ULL << 32) - 1);
+	return (((uint64_t)__fswab32(l)) << 32) | ((uint64_t)(__fswab32(h)));
+#else
+	return ___constant_swab64(val);
+#endif
+}
+
+static inline __attribute_const__ uint32_t __fswahw32(uint32_t val)
+{
+#ifdef __arch_swahw32
+	return __arch_swahw32(val);
+#else
+	return ___constant_swahw32(val);
+#endif
+}
+
+static inline __attribute_const__ uint32_t __fswahb32(uint32_t val)
+{
+#ifdef __arch_swahb32
+	return __arch_swahb32(val);
+#else
+	return ___constant_swahb32(val);
+#endif
+}
+
+/**
+ * __swab16 - return a byteswapped 16-bit value
+ * @x: value to byteswap
+ */
+#define __swab16(x)				\
+	(__builtin_constant_p((uint16_t)(x)) ?	\
+	___constant_swab16(x) :			\
+	__fswab16(x))
+
+/**
+ * __swab32 - return a byteswapped 32-bit value
+ * @x: value to byteswap
+ */
+#define __swab32(x)				\
+	(__builtin_constant_p((uint32_t)(x)) ?	\
+	___constant_swab32(x) :			\
+	__fswab32(x))
+
+/**
+ * __swab64 - return a byteswapped 64-bit value
+ * @x: value to byteswap
+ */
+#define __swab64(x)				\
+	(__builtin_constant_p((uint64_t)(x)) ?	\
+	___constant_swab64(x) :			\
+	__fswab64(x))
+
+/**
+ * __swahw32 - return a word-swapped 32-bit value
+ * @x: value to wordswap
+ *
+ * __swahw32(0x12340000) is 0x00001234
+ */
+#define __swahw32(x)				\
+	(__builtin_constant_p((uint32_t)(x)) ?	\
+	___constant_swahw32(x) :		\
+	__fswahw32(x))
+
+/**
+ * __swahb32 - return a high and low byte-swapped 32-bit value
+ * @x: value to byteswap
+ *
+ * __swahb32(0x12345678) is 0x34127856
+ */
+#define __swahb32(x)				\
+	(__builtin_constant_p((uint32_t)(x)) ?	\
+	___constant_swahb32(x) :		\
+	__fswahb32(x))
+
+/**
+ * __swab16p - return a byteswapped 16-bit value from a pointer
+ * @p: pointer to a naturally-aligned 16-bit value
+ */
+static inline uint16_t __swab16p(const uint16_t *p)
+{
+#ifdef __arch_swab16p
+	return __arch_swab16p(p);
+#else
+	return __swab16(*p);
+#endif
+}
+
+/**
+ * __swab32p - return a byteswapped 32-bit value from a pointer
+ * @p: pointer to a naturally-aligned 32-bit value
+ */
+static inline uint32_t __swab32p(const uint32_t *p)
+{
+#ifdef __arch_swab32p
+	return __arch_swab32p(p);
+#else
+	return __swab32(*p);
+#endif
+}
+
+/**
+ * __swab64p - return a byteswapped 64-bit value from a pointer
+ * @p: pointer to a naturally-aligned 64-bit value
+ */
+static inline uint64_t __swab64p(const uint64_t *p)
+{
+#ifdef __arch_swab64p
+	return __arch_swab64p(p);
+#else
+	return __swab64(*p);
+#endif
+}
+
+/**
+ * __swahw32p - return a wordswapped 32-bit value from a pointer
+ * @p: pointer to a naturally-aligned 32-bit value
+ *
+ * See __swahw32() for details of wordswapping.
+ */
+static inline uint32_t __swahw32p(const uint32_t *p)
+{
+#ifdef __arch_swahw32p
+	return __arch_swahw32p(p);
+#else
+	return __swahw32(*p);
+#endif
+}
+
+/**
+ * __swahb32p - return a high and low byteswapped 32-bit value from a pointer
+ * @p: pointer to a naturally-aligned 32-bit value
+ *
+ * See __swahb32() for details of high/low byteswapping.
+ */
+static inline uint32_t __swahb32p(const uint32_t *p)
+{
+#ifdef __arch_swahb32p
+	return __arch_swahb32p(p);
+#else
+	return __swahb32(*p);
+#endif
+}
+
+/**
+ * __swab16s - byteswap a 16-bit value in-place
+ * @p: pointer to a naturally-aligned 16-bit value
+ */
+static inline void __swab16s(uint16_t *p)
+{
+#ifdef __arch_swab16s
+	__arch_swab16s(p);
+#else
+	*p = __swab16p(p);
+#endif
+}
+/**
+ * __swab32s - byteswap a 32-bit value in-place
+ * @p: pointer to a naturally-aligned 32-bit value
+ */
+static inline void __swab32s(uint32_t *p)
+{
+#ifdef __arch_swab32s
+	__arch_swab32s(p);
+#else
+	*p = __swab32p(p);
+#endif
+}
+
+/**
+ * __swab64s - byteswap a 64-bit value in-place
+ * @p: pointer to a naturally-aligned 64-bit value
+ */
+static inline void __swab64s(uint64_t *p)
+{
+#ifdef __arch_swab64s
+	__arch_swab64s(p);
+#else
+	*p = __swab64p(p);
+#endif
+}
+
+/**
+ * __swahw32s - wordswap a 32-bit value in-place
+ * @p: pointer to a naturally-aligned 32-bit value
+ *
+ * See __swahw32() for details of wordswapping
+ */
+static inline void __swahw32s(uint32_t *p)
+{
+#ifdef __arch_swahw32s
+	__arch_swahw32s(p);
+#else
+	*p = __swahw32p(p);
+#endif
+}
+
+/**
+ * __swahb32s - high and low byteswap a 32-bit value in-place
+ * @p: pointer to a naturally-aligned 32-bit value
+ *
+ * See __swahb32() for details of high and low byte swapping
+ */
+static inline void __swahb32s(uint32_t *p)
+{
+#ifdef __arch_swahb32s
+	__arch_swahb32s(p);
+#else
+	*p = __swahb32p(p);
+#endif
+}
+
+# define swab16 __swab16
+# define swab32 __swab32
+# define swab64 __swab64
+# define swahw32 __swahw32
+# define swahb32 __swahb32
+# define swab16p __swab16p
+# define swab32p __swab32p
+# define swab64p __swab64p
+# define swahw32p __swahw32p
+# define swahb32p __swahb32p
+# define swab16s __swab16s
+# define swab32s __swab32s
+# define swab64s __swab64s
+# define swahw32s __swahw32s
+# define swahb32s __swahb32s
+
+#endif /* _LINUX_SWAB_H */
diff --git a/src/target/firmware/include/uart.h b/src/target/firmware/include/uart.h
new file mode 100644
index 00000000..870a0968
--- /dev/null
+++ b/src/target/firmware/include/uart.h
@@ -0,0 +1,37 @@
+#ifndef _UART_H
+#define _UART_H
+
+#include <stdint.h>
+
+enum uart_baudrate {
+	UART_38400,
+	UART_57600,
+	UART_115200,
+	UART_230400,
+	UART_460800,
+	UART_614400,
+	UART_921600,
+};
+
+enum uart_id {
+	UART_IRDA,
+	UART_MODEM,
+};
+
+void uart_init(uint8_t uart, uint8_t interrupts);
+void uart_putchar_wait(uint8_t uart, int c);
+int uart_putchar_nb(uint8_t uart, int c);
+int uart_getchar_nb(uint8_t uart, uint8_t *ch);
+int uart_tx_busy(uint8_t uart);
+int uart_baudrate(uint8_t uart, enum uart_baudrate bdrt);
+
+enum uart_irq {
+	UART_IRQ_TX_EMPTY,
+	UART_IRQ_RX_CHAR,
+};
+
+void uart_irq_enable(uint8_t uart, enum uart_irq irq, int on);
+
+void uart_poll(uint8_t uart);
+
+#endif /* _UART_H */
diff --git a/src/target/firmware/include/uwire.h b/src/target/firmware/include/uwire.h
new file mode 100644
index 00000000..6d345534
--- /dev/null
+++ b/src/target/firmware/include/uwire.h
@@ -0,0 +1,7 @@
+#ifndef _UWIRE_H
+#define _UWIRE_H
+
+void uwire_init(void);
+int uwire_xfer(int cs, int bitlen, const void *dout, void *din);
+
+#endif /* _UWIRE_H */
diff --git a/src/target/firmware/layer1/Makefile b/src/target/firmware/layer1/Makefile
new file mode 100644
index 00000000..0c710a5d
--- /dev/null
+++ b/src/target/firmware/layer1/Makefile
@@ -0,0 +1,9 @@
+
+LIBRARIES+=layer1
+LIB_layer1_DIR=layer1
+LIB_layer1_SRCS=avg.c agc.c afc.c toa.c sync.c tdma_sched.c tpu_window.c init.c \
+		l23_api.c mframe_sched.c sched_gsmtime.c async.c rfch.c apc.c
+
+LIB_layer1_SRCS += prim_pm.c prim_rach.c prim_tx_nb.c prim_rx_nb.c prim_fbsb.c \
+		   prim_freq.c prim_utils.c prim_tch.c
+
diff --git a/src/target/firmware/layer1/afc.c b/src/target/firmware/layer1/afc.c
new file mode 100644
index 00000000..a51a1071
--- /dev/null
+++ b/src/target/firmware/layer1/afc.c
@@ -0,0 +1,130 @@
+/* AFC (Automatic Frequency Correction) Implementation */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <layer1/afc.h>
+#include <layer1/avg.h>
+#include <calypso/dsp.h>
+
+#define AFC_INITIAL_DAC_VALUE	-700
+
+/* Over how many TDMA frames do we want to average? (this may change in dedicated mode) */
+#define AFC_PERIOD		40
+/* How many of our measurements have to be valid? */
+#define AFC_MIN_MUN_VALID	8
+
+/* The actual AFC code */
+
+struct afc_state {
+	struct running_avg ravg;		/* running average */
+	int16_t		dac_value;		/* current DAC output value */
+	uint16_t	arfcn;
+};
+
+static void afc_ravg_output(struct running_avg *ravg, int32_t avg);
+
+static struct afc_state afc_state = {
+	.ravg = {
+		.outfn = &afc_ravg_output,
+		.period = AFC_PERIOD,
+		.min_valid = AFC_MIN_MUN_VALID,
+	},
+	.dac_value = AFC_INITIAL_DAC_VALUE,
+};
+
+/* The AFC DAC in the ABB has to be configured as follows:
+ * DAC = 1MHz / 947MHz * FreqErr(Hz) / AFCslop(ppm/LSB)
+ * where:
+ *	947 MHz is the center of EGSM
+ *	AFCslope is coded F1.15, thus a normalization factor of 2^15 applies
+ */
+
+#define AFC_NORM_FACTOR_GSM	((1<<15) / 947)
+#define AFC_NORM_FACTOR_DCS	((1<<15) / 1894)
+
+/* we assume 8.769ppb per LSB, equals 0.008769 * 32768 == 287 */
+//#define AFC_SLOPE		320
+#define AFC_SLOPE		287
+
+/* The DSP can measure the frequency error in the following ranges:
+ * 	FB_MODE0:	+/- 20 kHz
+ *	FB_MODE1:	+/-  4 kHz
+ *	Sync Burst:	+/-  1 kHz
+ *	Normal Burst:	+/- 400 Hz
+ */
+
+/* Update the AFC with a frequency error, bypassing averaging */
+void afc_correct(int16_t freq_error, uint16_t arfcn)
+{
+	int32_t afc_norm_factor;
+	int16_t delta;
+
+	switch (gsm_arfcn2band(arfcn)) {
+	case GSM_BAND_900:
+	case GSM_BAND_850:
+		afc_norm_factor = AFC_NORM_FACTOR_GSM;
+		break;
+	default:
+		afc_norm_factor = AFC_NORM_FACTOR_DCS;
+	}
+
+	delta = (int16_t) ((afc_norm_factor * (int32_t)freq_error) / AFC_SLOPE);
+	printd("afc_correct(error=%dHz, arfcn=%u): delta=%d, afc_dac(old=%d,new=%d)\n",
+		freq_error, arfcn, delta, afc_state.dac_value, afc_state.dac_value+delta);
+	afc_state.dac_value += delta;
+
+	/* The AFC DAC has only 13 bits */
+	if (afc_state.dac_value > 4095)
+		afc_state.dac_value = 4095;
+	else if (afc_state.dac_value < -4096)
+		afc_state.dac_value = -4096;
+}
+
+void afc_reset(void)
+{
+	afc_state.dac_value = AFC_INITIAL_DAC_VALUE;
+}
+
+void afc_input(int32_t freq_error, uint16_t arfcn, int valid)
+{
+	afc_state.arfcn = arfcn;
+	runavg_input(&afc_state.ravg, freq_error, valid);
+	runavg_check_output(&afc_state.ravg);
+}
+
+/* callback function for runavg */
+static void afc_ravg_output(struct running_avg *ravg, int32_t avg)
+{
+	afc_correct(avg, afc_state.arfcn);
+}
+
+/* Update DSP with new AFC DAC value to be used for next TDMA frame */
+void afc_load_dsp(void)
+{
+	dsp_api.db_w->d_afc = afc_state.dac_value;
+	dsp_api.db_w->d_ctrl_abb |= (1 << B_AFC);
+}
diff --git a/src/target/firmware/layer1/agc.c b/src/target/firmware/layer1/agc.c
new file mode 100644
index 00000000..b72a6e74
--- /dev/null
+++ b/src/target/firmware/layer1/agc.c
@@ -0,0 +1,62 @@
+/* AFC (Automatic Gain Control) Implementation */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+#include <debug.h>
+#include <rffe.h>
+
+#include <layer1/agc.h>
+#include <calypso/dsp.h>
+
+/* compute the input level present at the antenna based on a baseband
+ * power measurement of the DSP at baseband */
+int16_t agc_inp_dbm8_by_pm(int16_t pm)
+{
+	/* pm is in 1/8 dBm at baseband */
+	int16_t total_gain_dbm8;
+
+	/* compute total current gain */
+	total_gain_dbm8 = (system_inherent_gain + rffe_get_gain()) * 8;
+
+	/* subtract gain from power measurement at baseband level */
+	return pm - total_gain_dbm8;
+}
+
+uint8_t agc_il_by_dbm8(int16_t dbm8)
+{
+	uint16_t il;
+
+	/* convert from 1/8 dBm to l1c format: [220..0] in -1/2dBm unit */
+	if (dbm8 >= 0)
+		il = 0;
+	else
+		il = -dbm8;
+
+	/* saturate */
+	if (il > 4 * 255)
+		il = 4 * 255;
+
+	return (uint8_t)(il >> 2);
+}
diff --git a/src/target/firmware/layer1/apc.c b/src/target/firmware/layer1/apc.c
new file mode 100644
index 00000000..480c7607
--- /dev/null
+++ b/src/target/firmware/layer1/apc.c
@@ -0,0 +1,57 @@
+/* APC (Automatic Power Control) Implementation */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <layer1/apc.h>
+
+/* calibration table defined in board file */
+extern const int16_t dbm2apc_gsm900[];
+extern const int dbm2apc_gsm900_max;
+
+
+/* determine the AUXAPC value by the Tx Power Level */
+int16_t apc_tx_dbm2auxapc(enum gsm_band band, int8_t dbm)
+{
+	if (dbm < 0)
+		return -ERANGE;
+
+	/* FIXME: offsets for different bands! */
+	if (dbm > dbm2apc_gsm900_max)
+		dbm = dbm2apc_gsm900_max;
+
+	return dbm2apc_gsm900[dbm];
+}
+
+/* determine the AUXAPC value by the Tx Power Level */
+int16_t apc_tx_pwrlvl2auxapc(enum gsm_band band, uint8_t lvl)
+{
+	/* convert tx power level to dBm */
+	int dbm = ms_pwr_dbm(band, lvl);
+	if (dbm < 0)
+		return dbm;
+
+	return apc_tx_dbm2auxapc(band, dbm);
+}
diff --git a/src/target/firmware/layer1/async.c b/src/target/firmware/layer1/async.c
new file mode 100644
index 00000000..cb2a2a8c
--- /dev/null
+++ b/src/target/firmware/layer1/async.c
@@ -0,0 +1,159 @@
+/* Asynchronous part of GSM Layer 1 */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+#include <debug.h>
+#include <arm.h>
+#include <asm/system.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+#include <layer1/sync.h>
+#include <layer1/async.h>
+#include <layer1/mframe_sched.h>
+#include <layer1/sched_gsmtime.h>
+#include <layer1/l23_api.h>
+#include <calypso/l1_environment.h>
+
+extern const struct tdma_sched_item rach_sched_set_ul[];
+
+/* safely enable a message into the L1S TX queue */
+void l1a_txq_msgb_enq(struct llist_head *queue, struct msgb *msg)
+{
+	unsigned long flags;
+
+	local_firq_save(flags);
+	msgb_enqueue(queue, msg);
+	local_irq_restore(flags);
+}
+
+void l1a_meas_msgb_set(struct msgb *msg)
+{
+	unsigned long flags;
+
+	local_firq_save(flags);
+	if (l1s.tx_meas)
+		msgb_free(l1s.tx_meas);
+	l1s.tx_meas = msg;
+	local_irq_restore(flags);
+}
+
+/* safely count messages in the L1S TX queue */
+int l1a_txq_msgb_count(struct llist_head *queue)
+{
+	unsigned long flags;
+	int num = 0;
+	struct llist_head *le;
+
+	local_firq_save(flags);
+	llist_for_each(le, queue)
+		num++;
+	local_irq_restore(flags);
+
+	return num;
+}
+
+/* safely flush all pending msgb */
+void l1a_txq_msgb_flush(struct llist_head *queue)
+{
+	struct msgb *msg;
+	unsigned long flags;
+
+	local_firq_save(flags);
+	while ((msg = msgb_dequeue(queue)))
+		msgb_free(msg);
+	local_irq_restore(flags);
+}
+
+/* Enable a repeating multiframe task */
+void l1a_mftask_enable(enum mframe_task task)
+{
+	/* we don't need locking here as L1S only reads mframe.tasks */
+	mframe_enable(task);
+}
+
+/* Disable a repeating multiframe task */
+void l1a_mftask_disable(enum mframe_task task)
+{
+	/* we don't need locking here as L1S only reads mframe.tasks */
+	mframe_disable(task);
+}
+
+/* Set the mask for repeating multiframe tasks */
+void l1a_mftask_set(uint32_t tasks)
+{
+	/* we don't need locking here as L1S only reads mframe.tasks */
+	mframe_set(tasks);
+}
+
+/* Set TCH mode */
+uint8_t l1a_tch_mode_set(uint8_t mode)
+{
+	switch (mode) {
+	case GSM48_CMODE_SPEECH_V1:
+	case GSM48_CMODE_SPEECH_EFR:
+		l1s.tch_mode = mode;
+		break;
+	default:
+		l1s.tch_mode = GSM48_CMODE_SIGN;
+	}
+
+	return l1s.tch_mode;
+}
+
+/* Set Audio routing mode */
+uint8_t l1a_audio_mode_set(uint8_t mode)
+{
+	l1s.audio_mode = mode;
+	return mode;
+}
+
+/* Initialize asynchronous part of Layer1 */
+void l1a_init(void)
+{
+	l1a_l23api_init();
+}
+
+/* Execute pending L1A completions */
+void l1a_compl_execute(void)
+{
+	unsigned long flags;
+	unsigned int scheduled;
+	unsigned int i;
+
+	/* get and reset the currently scheduled tasks */
+	local_firq_save(flags);
+	scheduled = l1s.scheduled_compl;
+	l1s.scheduled_compl = 0;
+	local_irq_restore(flags);
+
+	/* Iterate over list of scheduled completions, call their
+	 * respective completion handler */
+	for (i = 0; i < 32; i++) {
+		if (!(scheduled & (1 << i)))
+			continue;
+		/* call completion function */
+		l1s.completion[i](i);
+	}
+}
diff --git a/src/target/firmware/layer1/avg.c b/src/target/firmware/layer1/avg.c
new file mode 100644
index 00000000..a4bf565b
--- /dev/null
+++ b/src/target/firmware/layer1/avg.c
@@ -0,0 +1,57 @@
+/* Averaging Implementation */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+#include <layer1/avg.h>
+
+/* input a new sample into the averaging process */
+void runavg_input(struct running_avg *ravg, int32_t val, int valid)
+{
+	ravg->num_samples++;
+	if (valid) {
+		ravg->acc_val += val;
+		ravg->num_samples_valid++;
+	}
+}
+
+/* check if sufficient samples have been obtained, and call outfn() */
+int runavg_check_output(struct running_avg *ravg)
+{
+	if (ravg->num_samples < ravg->period)
+		return 0;
+
+	if (ravg->num_samples_valid >= ravg->min_valid) {
+		int32_t avg = ravg->acc_val / ravg->num_samples_valid;
+
+		ravg->outfn(ravg, avg);
+
+		ravg->num_samples = ravg->num_samples_valid = 0;
+		ravg->acc_val = 0;
+
+		return 1;
+	}
+
+	return 0;
+}
+
+
diff --git a/src/target/firmware/layer1/init.c b/src/target/firmware/layer1/init.c
new file mode 100644
index 00000000..e7fde232
--- /dev/null
+++ b/src/target/firmware/layer1/init.c
@@ -0,0 +1,73 @@
+/* OsmocomBB Layer1 initialization */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <rffe.h>
+#include <rf/trf6151.h>
+#include <abb/twl3025.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/irq.h>
+
+#include <layer1/sync.h>
+#include <layer1/async.h>
+#include <layer1/l23_api.h>
+
+void layer1_init(void)
+{
+#ifndef CONFIG_TX_ENABLE
+	printf("\n\nTHIS FIRMWARE WAS COMPILED WITHOUT TX SUPPORT!!!\n\n");
+#endif
+
+	/* initialize asynchronous part of L1 */
+	l1a_init();
+	/* initialize TDMA Frame IRQ driven synchronous L1 */
+	l1s_init();
+	/* power up the DSP */
+	dsp_power_on();
+
+	/* Initialize TPU, TSP and TRF drivers */
+	tpu_init();
+	tsp_init();
+
+	rffe_init();
+
+#if 0 /* only if RX TPU window is disabled! */
+	/* Put TWL3025 in downlink mode (includes calibration) */
+	twl3025_downlink(1, 1000);
+#endif
+
+	/* issue the TRF and TWL initialization sequence */
+	tpu_enq_sleep();
+	tpu_enable(1);
+	tpu_wait_idle();
+
+	/* Disable RTC interrupt as it causes lost TDMA frames */
+	irq_disable(IRQ_RTC_TIMER);
+
+	/* inform l2 and upwards that we are ready for orders */
+	l1ctl_tx_reset(L1CTL_RESET_IND, L1CTL_RES_T_BOOT);
+}
diff --git a/src/target/firmware/layer1/l23_api.c b/src/target/firmware/layer1/l23_api.c
new file mode 100644
index 00000000..daffaf8b
--- /dev/null
+++ b/src/target/firmware/layer1/l23_api.c
@@ -0,0 +1,703 @@
+/* Synchronous part of GSM Layer 1: API to Layer2+ */
+
+/* (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#define DEBUG
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <debug.h>
+#include <byteorder.h>
+
+#include <asm/system.h>
+
+#include <osmocom/core/msgb.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <comm/sercomm.h>
+
+#include <layer1/sync.h>
+#include <layer1/async.h>
+#include <layer1/mframe_sched.h>
+#include <layer1/prim.h>
+#include <layer1/tpu_window.h>
+#include <layer1/sched_gsmtime.h>
+
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+#include <calypso/sim.h>
+#include <calypso/dsp.h>
+
+#include <l1ctl_proto.h>
+
+/* the size we will allocate struct msgb* for HDLC */
+#define L3_MSG_HEAD 4
+#define L3_MSG_DATA 200
+#define L3_MSG_SIZE (L3_MSG_HEAD + sizeof(struct l1ctl_hdr) + L3_MSG_DATA)
+
+void (*l1a_l23_tx_cb)(struct msgb *msg) = NULL;
+
+void l1_queue_for_l2(struct msgb *msg)
+{
+	if (l1a_l23_tx_cb) {
+		l1a_l23_tx_cb(msg);
+		return;
+	}
+	/* forward via serial for now */
+	sercomm_sendmsg(SC_DLCI_L1A_L23, msg);
+}
+
+enum mf_type {
+	MFNONE,
+	MF51,
+	MF26ODD,
+	MF26EVEN
+};
+static uint32_t chan_nr2mf_task_mask(uint8_t chan_nr, uint8_t neigh_mode)
+{
+	uint8_t cbits = chan_nr >> 3;
+	uint8_t tn = chan_nr & 0x7;
+	uint8_t lch_idx;
+	enum mframe_task master_task = 0;
+	uint32_t neigh_task = 0;
+	enum mf_type multiframe = 0;
+
+	if (cbits == 0x01) {
+		lch_idx = 0;
+		master_task = (tn & 1) ? MF_TASK_TCH_F_ODD : MF_TASK_TCH_F_EVEN;
+		multiframe = (tn & 1) ? MF26ODD : MF26EVEN;
+	} else if ((cbits & 0x1e) == 0x02) {
+		lch_idx = cbits & 0x1;
+		master_task = MF_TASK_TCH_H_0 + lch_idx;
+		multiframe = (lch_idx & 1) ? MF26ODD : MF26EVEN;
+	} else if ((cbits & 0x1c) == 0x04) {
+		lch_idx = cbits & 0x3;
+		master_task = MF_TASK_SDCCH4_0 + lch_idx;
+		multiframe = MF51;
+	} else if ((cbits & 0x18) == 0x08) {
+		lch_idx = cbits & 0x7;
+		master_task = MF_TASK_SDCCH8_0 + lch_idx;
+		multiframe = MF51;
+	} else if ((cbits & 0x1e) == 0x18) {
+		/* Osmocom specific extension for CBCH */
+		master_task = (cbits & 0x01) ? /* 0b1100T */
+			MF_TASK_SDCCH4_CBCH : MF_TASK_SDCCH8_CBCH;
+		multiframe = MF51;
+#if 0
+	} else if (cbits == 0x10) {
+		/* FIXME: when to do extended BCCH? */
+		master_task = MF_TASK_BCCH_NORM;
+	} else if (cbits == 0x11 || cbits == 0x12) {
+		/* FIXME: how to decide CCCH norm/extd? */
+		master_task = MF_TASK_BCCH_CCCH;
+#endif
+	}
+	switch (neigh_mode) {
+	case NEIGH_MODE_PM:
+		switch (multiframe) {
+		case MF51:
+			neigh_task = (1 << MF_TASK_NEIGH_PM51);
+			break;
+		case MF26EVEN:
+			neigh_task = (1 << MF_TASK_NEIGH_PM26E);
+			break;
+		case MF26ODD:
+			neigh_task = (1 << MF_TASK_NEIGH_PM26O);
+			break;
+		}
+		break;
+	}
+	return (1 << master_task) | neigh_task;
+}
+
+static int  chan_nr2dchan_type(uint8_t chan_nr)
+{
+	uint8_t cbits = chan_nr >> 3;
+
+	if (cbits == 0x01) {
+		return GSM_DCHAN_TCH_F;
+	} else if ((cbits & 0x1e) == 0x02) {
+		return GSM_DCHAN_TCH_H;
+	} else if ((cbits & 0x1c) == 0x04) {
+		return GSM_DCHAN_SDCCH_4;
+	} else if ((cbits & 0x18) == 0x08) {
+		return GSM_DCHAN_SDCCH_8;
+	} else if ((cbits & 0x1e) == 0x18) {
+		/* Osmocom-specific extension for CBCH */
+		return (cbits & 0x01) ? /* 0b1100T */
+			GSM_DCHAN_SDCCH_8_CBCH : GSM_DCHAN_SDCCH_4_CBCH;
+	}
+
+	return GSM_DCHAN_UNKNOWN;
+}
+
+static int chan_nr_is_tch(uint8_t chan_nr)
+{
+	return ((chan_nr >> 3) == 0x01 ||		/* TCH/F */
+		((chan_nr >> 3) & 0x1e) == 0x02);	/* TCH/H */
+}
+
+static void audio_set_enabled(uint8_t tch_mode, uint8_t audio_mode)
+{
+	if (tch_mode == GSM48_CMODE_SIGN) {
+		twl3025_unit_enable(TWL3025_UNIT_VUL, 0);
+		twl3025_unit_enable(TWL3025_UNIT_VDL, 0);
+	} else {
+		twl3025_unit_enable(TWL3025_UNIT_VUL,
+		                    !!(audio_mode & AUDIO_TX_MICROPHONE));
+		twl3025_unit_enable(TWL3025_UNIT_VDL,
+		                    !!(audio_mode & AUDIO_RX_SPEAKER));
+	}
+}
+
+struct msgb *l1ctl_msgb_alloc(uint8_t msg_type)
+{
+	struct msgb *msg;
+	struct l1ctl_hdr *l1h;
+
+	msg = msgb_alloc_headroom(L3_MSG_SIZE, L3_MSG_HEAD, "l1ctl");
+	if (!msg) {
+		while (1) {
+			puts("OOPS. Out of buffers...\n");
+		}
+
+		return NULL;
+	}
+	l1h = (struct l1ctl_hdr *) msgb_put(msg, sizeof(*l1h));
+	l1h->msg_type = msg_type;
+	l1h->flags = 0;
+
+	msg->l1h = (uint8_t *)l1h;
+
+	return msg;
+}
+
+struct msgb *l1_create_l2_msg(int msg_type, uint32_t fn, uint16_t snr,
+			      uint16_t arfcn)
+{
+	struct l1ctl_info_dl *dl;
+	struct msgb *msg = l1ctl_msgb_alloc(msg_type);
+
+	dl = (struct l1ctl_info_dl *) msgb_put(msg, sizeof(*dl));
+	dl->frame_nr = htonl(fn);
+	dl->snr = snr;
+	dl->band_arfcn = htons(arfcn);
+
+	return msg;
+}
+
+/* receive a L1CTL_FBSB_REQ from L23 */
+static void l1ctl_rx_fbsb_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_fbsb_req *sync_req = (struct l1ctl_fbsb_req *) l1h->data;
+
+	if (sizeof(*sync_req) > msg->len) {
+		printf("Short sync msg. %u\n", msg->len);
+		return;
+	}
+
+	printd("L1CTL_FBSB_REQ (arfcn=%u, flags=0x%x)\n",
+		ntohs(sync_req->band_arfcn), sync_req->flags);
+
+	/* reset scheduler and hardware */
+	l1s_reset();
+
+	/* pre-set the CCCH mode */
+	l1s.serving_cell.ccch_mode = sync_req->ccch_mode;
+
+	printd("Starting FCCH Recognition\n");
+	l1s_fbsb_req(1, sync_req);
+}
+
+/* receive a L1CTL_DM_EST_REQ from L23 */
+static void l1ctl_rx_dm_est_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_dm_est_req *est_req = (struct l1ctl_dm_est_req *) ul->payload;
+
+	printd("L1CTL_DM_EST_REQ (arfcn=%u, chan_nr=0x%02x, tsc=%u)\n",
+		ntohs(est_req->h0.band_arfcn), ul->chan_nr, est_req->tsc);
+
+	/* disable neighbour cell measurement of C0 TS 0 */
+	mframe_disable(MF_TASK_NEIGH_PM51_C0T0);
+
+	/* configure dedicated channel state */
+	l1s.dedicated.type = chan_nr2dchan_type(ul->chan_nr);
+	l1s.dedicated.tsc  = est_req->tsc;
+	l1s.dedicated.tn   = ul->chan_nr & 0x7;
+	l1s.dedicated.h    = est_req->h;
+
+	if (est_req->h) {
+		int i;
+		l1s.dedicated.h1.hsn  = est_req->h1.hsn;
+		l1s.dedicated.h1.maio = est_req->h1.maio;
+		l1s.dedicated.h1.n    = est_req->h1.n;
+		for (i=0; i<est_req->h1.n; i++)
+			l1s.dedicated.h1.ma[i] = ntohs(est_req->h1.ma[i]);
+	} else {
+		l1s.dedicated.h0.arfcn = ntohs(est_req->h0.band_arfcn);
+	}
+
+	/* TCH config */
+	if (chan_nr_is_tch(ul->chan_nr)) {
+		/* Mode */
+		l1a_tch_mode_set(est_req->tch_mode);
+		l1a_audio_mode_set(est_req->audio_mode);
+
+		/* Sync */
+		l1s.tch_sync = 1;	/* can be set without locking */
+
+		/* Audio path */
+		audio_set_enabled(est_req->tch_mode, est_req->audio_mode);
+	}
+
+	/* figure out which MF tasks to enable */
+	l1a_mftask_set(chan_nr2mf_task_mask(ul->chan_nr, NEIGH_MODE_PM));
+}
+
+/* receive a L1CTL_DM_FREQ_REQ from L23 */
+static void l1ctl_rx_dm_freq_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_dm_freq_req *freq_req =
+			(struct l1ctl_dm_freq_req *) ul->payload;
+
+	printd("L1CTL_DM_FREQ_REQ (arfcn=%u, tsc=%u)\n",
+		ntohs(freq_req->h0.band_arfcn), freq_req->tsc);
+
+	/* configure dedicated channel state */
+	l1s.dedicated.st_tsc  = freq_req->tsc;
+	l1s.dedicated.st_h    = freq_req->h;
+
+	if (freq_req->h) {
+		int i;
+		l1s.dedicated.st_h1.hsn  = freq_req->h1.hsn;
+		l1s.dedicated.st_h1.maio = freq_req->h1.maio;
+		l1s.dedicated.st_h1.n    = freq_req->h1.n;
+		for (i=0; i<freq_req->h1.n; i++)
+			l1s.dedicated.st_h1.ma[i] = ntohs(freq_req->h1.ma[i]);
+	} else {
+		l1s.dedicated.st_h0.arfcn = ntohs(freq_req->h0.band_arfcn);
+	}
+
+	l1a_freq_req(ntohs(freq_req->fn));
+}
+
+/* receive a L1CTL_CRYPTO_REQ from L23 */
+static void l1ctl_rx_crypto_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_crypto_req *cr = (struct l1ctl_crypto_req *) ul->payload;
+
+	printd("L1CTL_CRYPTO_REQ (algo=A5/%u, len=%u)\n", cr->algo, cr->key_len);
+
+	if (cr->algo && cr->key_len != 8) {
+		printd("L1CTL_CRYPTO_REQ -> Invalid key\n");
+		return;
+	}
+
+	dsp_load_ciph_param(cr->algo, cr->key);
+}
+
+/* receive a L1CTL_DM_REL_REQ from L23 */
+static void l1ctl_rx_dm_rel_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+
+	printd("L1CTL_DM_REL_REQ\n");
+	l1a_mftask_set(0);
+	l1s.dedicated.type = GSM_DCHAN_NONE;
+	l1a_txq_msgb_flush(&l1s.tx_queue[L1S_CHAN_MAIN]);
+	l1a_txq_msgb_flush(&l1s.tx_queue[L1S_CHAN_SACCH]);
+	l1a_txq_msgb_flush(&l1s.tx_queue[L1S_CHAN_TRAFFIC]);
+	l1a_meas_msgb_set(NULL);
+	dsp_load_ciph_param(0, NULL);
+	l1a_tch_mode_set(GSM48_CMODE_SIGN);
+	audio_set_enabled(GSM48_CMODE_SIGN, 0);
+	l1s.neigh_pm.n = 0;
+}
+
+/* receive a L1CTL_PARAM_REQ from L23 */
+static void l1ctl_rx_param_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_par_req *par_req = (struct l1ctl_par_req *) ul->payload;
+
+	printd("L1CTL_PARAM_REQ (ta=%d, tx_power=%u)\n", par_req->ta,
+		par_req->tx_power);
+
+	l1s.ta = par_req->ta;
+	l1s.tx_power = par_req->tx_power;
+}
+
+/* receive a L1CTL_RACH_REQ from L23 */
+static void l1ctl_rx_rach_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_rach_req *rach_req = (struct l1ctl_rach_req *) ul->payload;
+
+	printd("L1CTL_RACH_REQ (ra=0x%02x, offset=%d combined=%d)\n",
+		rach_req->ra, ntohs(rach_req->offset), rach_req->combined);
+
+	l1a_rach_req(ntohs(rach_req->offset), rach_req->combined,
+		rach_req->ra);
+}
+
+/* receive a L1CTL_DATA_REQ from L23 */
+static void l1ctl_rx_data_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_data_ind *data_ind = (struct l1ctl_data_ind *) ul->payload;
+	struct llist_head *tx_queue;
+
+	printd("L1CTL_DATA_REQ (link_id=0x%02x)\n", ul->link_id);
+
+	msg->l3h = data_ind->data;
+	if (ul->link_id & 0x40) {
+		struct gsm48_hdr *gh = (struct gsm48_hdr *)(data_ind->data + 5);
+		if (gh->proto_discr == GSM48_PDISC_RR
+		 && gh->msg_type == GSM48_MT_RR_MEAS_REP) {
+			printd("updating measurement report\n");
+			l1a_meas_msgb_set(msg);
+			return;
+		}
+		tx_queue = &l1s.tx_queue[L1S_CHAN_SACCH];
+	} else
+		tx_queue = &l1s.tx_queue[L1S_CHAN_MAIN];
+
+	printd("ul=%p, ul->payload=%p, data_ind=%p, data_ind->data=%p l3h=%p\n",
+		ul, ul->payload, data_ind, data_ind->data, msg->l3h);
+
+	l1a_txq_msgb_enq(tx_queue, msg);
+}
+
+/* receive a L1CTL_PM_REQ from L23 */
+static void l1ctl_rx_pm_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_pm_req *pm_req = (struct l1ctl_pm_req *) l1h->data;
+
+	switch (pm_req->type) {
+	case 1:
+		l1s.pm.mode = 1;
+		l1s.pm.range.arfcn_start =
+				ntohs(pm_req->range.band_arfcn_from);
+		l1s.pm.range.arfcn_next =
+				ntohs(pm_req->range.band_arfcn_from);
+		l1s.pm.range.arfcn_end =
+				ntohs(pm_req->range.band_arfcn_to);
+		printf("L1CTL_PM_REQ start=%u end=%u\n",
+			l1s.pm.range.arfcn_start, l1s.pm.range.arfcn_end);
+		break;
+	}
+	l1s_reset_hw(); /* must reset, otherwise measurement results are delayed */
+	l1s_pm_test(1, l1s.pm.range.arfcn_next);
+}
+
+/* Transmit a L1CTL_RESET_IND or L1CTL_RESET_CONF */
+void l1ctl_tx_reset(uint8_t msg_type, uint8_t reset_type)
+{
+	struct msgb *msg = l1ctl_msgb_alloc(msg_type);
+	struct l1ctl_reset *reset_resp;
+	reset_resp = (struct l1ctl_reset *)
+				msgb_put(msg, sizeof(*reset_resp));
+	reset_resp->type = reset_type;
+
+	l1_queue_for_l2(msg);
+}
+
+/* receive a L1CTL_RESET_REQ from L23 */
+static void l1ctl_rx_reset_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_reset *reset_req =
+				(struct l1ctl_reset *) l1h->data;
+
+	switch (reset_req->type) {
+	case L1CTL_RES_T_FULL:
+		printf("L1CTL_RESET_REQ: FULL!\n");
+		l1s_reset();
+		l1s_reset_hw();
+		audio_set_enabled(GSM48_CMODE_SIGN, 0);
+		l1ctl_tx_reset(L1CTL_RESET_CONF, reset_req->type);
+		break;
+	case L1CTL_RES_T_SCHED:
+		printf("L1CTL_RESET_REQ: SCHED!\n");
+		l1ctl_tx_reset(L1CTL_RESET_CONF, reset_req->type);
+		sched_gsmtime_reset();
+		break;
+	default:
+		printf("unknown L1CTL_RESET_REQ type\n");
+		break;
+	}
+}
+
+/* Transmit a L1CTL_CCCH_MODE_CONF */
+static void l1ctl_tx_ccch_mode_conf(uint8_t ccch_mode)
+{
+	struct msgb *msg = l1ctl_msgb_alloc(L1CTL_CCCH_MODE_CONF);
+	struct l1ctl_ccch_mode_conf *mode_conf;
+	mode_conf = (struct l1ctl_ccch_mode_conf *)
+				msgb_put(msg, sizeof(*mode_conf));
+	mode_conf->ccch_mode = ccch_mode;
+
+	l1_queue_for_l2(msg);
+}
+
+/* receive a L1CTL_CCCH_MODE_REQ from L23 */
+static void l1ctl_rx_ccch_mode_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_ccch_mode_req *ccch_mode_req =
+		(struct l1ctl_ccch_mode_req *) l1h->data;
+	uint8_t ccch_mode = ccch_mode_req->ccch_mode;
+
+	/* pre-set the CCCH mode */
+	l1s.serving_cell.ccch_mode = ccch_mode;
+
+	/* Update task */
+	mframe_disable(MF_TASK_CCCH_COMB);
+	mframe_disable(MF_TASK_CCCH);
+
+	if (ccch_mode == CCCH_MODE_COMBINED)
+		mframe_enable(MF_TASK_CCCH_COMB);
+	else if (ccch_mode == CCCH_MODE_NON_COMBINED)
+		mframe_enable(MF_TASK_CCCH);
+	else if (ccch_mode == CCCH_MODE_COMBINED_CBCH) {
+		mframe_enable(MF_TASK_CCCH_COMB);
+		mframe_enable(MF_TASK_SDCCH4_CBCH);
+	}
+
+	l1ctl_tx_ccch_mode_conf(ccch_mode);
+}
+
+/* Transmit a L1CTL_TCH_MODE_CONF */
+static void l1ctl_tx_tch_mode_conf(uint8_t tch_mode, uint8_t audio_mode)
+{
+	struct msgb *msg = l1ctl_msgb_alloc(L1CTL_TCH_MODE_CONF);
+	struct l1ctl_tch_mode_conf *mode_conf;
+	mode_conf = (struct l1ctl_tch_mode_conf *)
+				msgb_put(msg, sizeof(*mode_conf));
+	mode_conf->tch_mode = tch_mode;
+	mode_conf->audio_mode = audio_mode;
+
+	l1_queue_for_l2(msg);
+}
+
+/* receive a L1CTL_TCH_MODE_REQ from L23 */
+static void l1ctl_rx_tch_mode_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_tch_mode_req *tch_mode_req =
+		(struct l1ctl_tch_mode_req *) l1h->data;
+	uint8_t tch_mode = tch_mode_req->tch_mode;
+	uint8_t audio_mode = tch_mode_req->audio_mode;
+
+	printd("L1CTL_TCH_MODE_REQ (tch_mode=0x%02x audio_mode=0x%02x)\n",
+		tch_mode, audio_mode);
+	tch_mode = l1a_tch_mode_set(tch_mode);
+	audio_mode = l1a_audio_mode_set(audio_mode);
+
+	audio_set_enabled(tch_mode, audio_mode);
+
+	l1s.tch_sync = 1; /* Needed for audio to work */
+
+	l1ctl_tx_tch_mode_conf(tch_mode, audio_mode);
+}
+
+/* receive a L1CTL_NEIGH_PM_REQ from L23 */
+static void l1ctl_rx_neigh_pm_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_neigh_pm_req *pm_req =
+		(struct l1ctl_neigh_pm_req *) l1h->data;
+	int i;
+
+	/* reset list in order to prevent race condition */
+	l1s.neigh_pm.n = 0; /* atomic */
+	l1s.neigh_pm.second = 0;
+	/* now reset pointer and fill list */
+	l1s.neigh_pm.pos = 0;
+	l1s.neigh_pm.running = 0;
+	for (i = 0; i < pm_req->n; i++) {
+		l1s.neigh_pm.band_arfcn[i] = ntohs(pm_req->band_arfcn[i]);
+		l1s.neigh_pm.tn[i] = pm_req->tn[i];
+	}
+	printf("L1CTL_NEIGH_PM_REQ new list with %u entries\n", pm_req->n);
+	l1s.neigh_pm.n = pm_req->n; /* atomic */
+
+	/* on C0 enable PM on frame 51 */
+	if (l1s.dedicated.type == GSM_DCHAN_NONE)
+		mframe_enable(MF_TASK_NEIGH_PM51_C0T0);
+}
+
+/* receive a L1CTL_TRAFFIC_REQ from L23 */
+static void l1ctl_rx_traffic_req(struct msgb *msg)
+{
+	struct l1ctl_hdr *l1h = (struct l1ctl_hdr *) msg->data;
+	struct l1ctl_info_ul *ul = (struct l1ctl_info_ul *) l1h->data;
+	struct l1ctl_traffic_req *tr = (struct l1ctl_traffic_req *) ul->payload;
+	int num = 0;
+
+	/* printd("L1CTL_TRAFFIC_REQ\n"); */ /* Very verbose, can overwelm serial */
+
+	msg->l2h = tr->data;
+
+	num = l1a_txq_msgb_count(&l1s.tx_queue[L1S_CHAN_TRAFFIC]);
+	if (num >= 4) {
+		printd("dropping traffic frame\n");
+		msgb_free(msg);
+		return;
+	}
+
+	l1a_txq_msgb_enq(&l1s.tx_queue[L1S_CHAN_TRAFFIC], msg);
+}
+
+static void l1ctl_sim_req(struct msgb *msg)
+{
+	uint16_t len = msg->len - sizeof(struct l1ctl_hdr);
+	uint8_t *data = msg->data + sizeof(struct l1ctl_hdr);
+
+#if 1 /* for debugging only */
+	{
+		int i;
+		printf("SIM Request (%u): ", len);
+		for (i = 0; i < len; i++)
+			printf("%02x ", data[i]);
+		puts("\n");
+	}
+#endif
+
+   sim_apdu(len, data);
+}
+
+static struct llist_head l23_rx_queue = LLIST_HEAD_INIT(l23_rx_queue);
+
+/* callback from SERCOMM when L2 sends a message to L1 */
+void l1a_l23_rx(uint8_t dlci, struct msgb *msg)
+{
+	unsigned long flags;
+
+	local_firq_save(flags);
+	msgb_enqueue(&l23_rx_queue, msg);
+	local_irq_restore(flags);
+}
+
+void l1a_l23_handler(void)
+{
+	struct msgb *msg;
+	struct l1ctl_hdr *l1h;
+	unsigned long flags;
+
+	local_firq_save(flags);
+	msg = msgb_dequeue(&l23_rx_queue);
+	local_irq_restore(flags);
+	if (!msg)
+		return;
+
+	l1h = (struct l1ctl_hdr *) msg->data;
+
+#if 0
+	{
+		int i;
+		printf("l1a_l23_rx_cb (%u): ", msg->len);
+		for (i = 0; i < msg->len; i++)
+			printf("%02x ", msg->data[i]);
+		puts("\n");
+	}
+#endif
+
+	msg->l1h = msg->data;
+
+	if (sizeof(*l1h) > msg->len) {
+		printf("l1a_l23_cb: Short message. %u\n", msg->len);
+		goto exit_msgbfree;
+	}
+
+	switch (l1h->msg_type) {
+	case L1CTL_FBSB_REQ:
+		l1ctl_rx_fbsb_req(msg);
+		break;
+	case L1CTL_DM_EST_REQ:
+		l1ctl_rx_dm_est_req(msg);
+		break;
+	case L1CTL_DM_REL_REQ:
+		l1ctl_rx_dm_rel_req(msg);
+		break;
+	case L1CTL_PARAM_REQ:
+		l1ctl_rx_param_req(msg);
+		break;
+	case L1CTL_DM_FREQ_REQ:
+		l1ctl_rx_dm_freq_req(msg);
+		break;
+	case L1CTL_CRYPTO_REQ:
+		l1ctl_rx_crypto_req(msg);
+		break;
+	case L1CTL_RACH_REQ:
+		l1ctl_rx_rach_req(msg);
+		break;
+	case L1CTL_DATA_REQ:
+		l1ctl_rx_data_req(msg);
+		/* we have to keep the msgb, not free it! */
+		goto exit_nofree;
+	case L1CTL_PM_REQ:
+		l1ctl_rx_pm_req(msg);
+		break;
+	case L1CTL_RESET_REQ:
+		l1ctl_rx_reset_req(msg);
+		break;
+	case L1CTL_CCCH_MODE_REQ:
+		l1ctl_rx_ccch_mode_req(msg);
+		break;
+	case L1CTL_TCH_MODE_REQ:
+		l1ctl_rx_tch_mode_req(msg);
+		break;
+	case L1CTL_NEIGH_PM_REQ:
+		l1ctl_rx_neigh_pm_req(msg);
+		break;
+	case L1CTL_TRAFFIC_REQ:
+		l1ctl_rx_traffic_req(msg);
+		/* we have to keep the msgb, not free it! */
+		goto exit_nofree;
+	case L1CTL_SIM_REQ:
+		l1ctl_sim_req(msg);
+		break;
+	}
+
+exit_msgbfree:
+	msgb_free(msg);
+exit_nofree:
+	return;
+}
+
+void l1a_l23api_init(void)
+{
+	sercomm_register_rx_cb(SC_DLCI_L1A_L23, l1a_l23_rx);
+}
+
diff --git a/src/target/firmware/layer1/mframe_sched.c b/src/target/firmware/layer1/mframe_sched.c
new file mode 100644
index 00000000..7fa38c13
--- /dev/null
+++ b/src/target/firmware/layer1/mframe_sched.c
@@ -0,0 +1,517 @@
+/* GSM Multiframe Scheduler Implementation (on top of TDMA sched) */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <debug.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <layer1/prim.h>
+#include <layer1/sync.h>
+#include <layer1/tdma_sched.h>
+#include <layer1/mframe_sched.h>
+
+/* A multiframe operation which can be scheduled for a multiframe */
+struct mframe_sched_item {
+	/* The TDMA scheduler item that shall be scheduled */
+	const struct tdma_sched_item *sched_set;
+	/* Which modulo shall be used on the frame number */
+	uint16_t modulo;
+	/* At which number inside the modulo shall we be scheduled */
+	uint16_t frame_nr;
+	/* bit-mask of flags */
+	uint16_t flags;
+};
+
+/* FIXME: properly clean this up */
+#define NB_QUAD_DL	nb_sched_set
+#define NB_QUAD_FH_DL	NB_QUAD_DL
+#define NB_QUAD_UL	nb_sched_set_ul
+#define NB_QUAD_FH_UL	NB_QUAD_UL
+#define NEIGH_PM	neigh_pm_sched_set
+
+/* BCCH Normal */
+static const struct mframe_sched_item mf_bcch_norm[] = {
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 2 },
+	{ .sched_set = NULL }
+};
+
+/* BCCH Extended */
+static const struct mframe_sched_item mf_bcch_ext[] = {
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 6 },
+	{ .sched_set = NULL }
+};
+
+/* Full CCCH in a pure BCCH + CCCH C0T0 */
+static const struct mframe_sched_item mf_ccch[] = {
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 6 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 12 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 16 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 22 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 26 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 32 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 36 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 42 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 46 },
+	{ .sched_set = NULL }
+};
+
+/* Full CCCH in a combined CCCH on C0T0 */
+static const struct mframe_sched_item mf_ccch_comb[] = {
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 6 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 12 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 16 },
+	{ .sched_set = NULL }
+};
+
+/* SDCCH/4 in a combined CCCH on C0T0, cannot be FH */
+static const struct mframe_sched_item mf_sdcch4_0[] = {
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 22 },
+	{ .sched_set = NB_QUAD_UL, .modulo = 51, .frame_nr = 22+15 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 2*51, .frame_nr = 42,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_UL, .modulo = 2*51, .frame_nr = 42+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch4_1[] = {
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 26 },
+	{ .sched_set = NB_QUAD_UL, .modulo = 51, .frame_nr = 26+15 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 2*51, .frame_nr = 46,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_UL, .modulo = 2*51, .frame_nr = 46+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch4_2[] = {
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 32 },
+	{ .sched_set = NB_QUAD_UL, .modulo = 51, .frame_nr = 32+15 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 2*51, .frame_nr = 51+42,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_UL, .modulo = 2*51, .frame_nr = 51+42+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch4_3[] = {
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 36 },
+	{ .sched_set = NB_QUAD_UL, .modulo = 51, .frame_nr = 36+15 },
+	{ .sched_set = NB_QUAD_DL, .modulo = 2*51, .frame_nr = 51+46,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_UL, .modulo = 2*51, .frame_nr = 51+46+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+
+/* SDCCH/8, can be frequency hopping (FH) */
+static const struct mframe_sched_item mf_sdcch8_0[] = {
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 51, .frame_nr = 0 },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 51, .frame_nr = 0+15 },
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 2*51, .frame_nr = 32,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 2*51, .frame_nr = 32+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch8_1[] = {
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 51, .frame_nr = 4 },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 51, .frame_nr = 4+15 },
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 2*51, .frame_nr = 36,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 2*51, .frame_nr = 36+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch8_2[] = {
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 51, .frame_nr = 8 },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 51, .frame_nr = 8+15 },
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 2*51, .frame_nr = 40,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 2*51, .frame_nr = 40+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch8_3[] = {
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 51, .frame_nr = 12 },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 51, .frame_nr = 12+15 },
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 2*51, .frame_nr = 44,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 2*51, .frame_nr = 44+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch8_4[] = {
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 51, .frame_nr = 16 },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 51, .frame_nr = 16+15 },
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 2*51, .frame_nr = 51+32,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 2*51, .frame_nr = 51+32+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch8_5[] = {
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 51, .frame_nr = 20 },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 51, .frame_nr = 20+15 },
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 2*51, .frame_nr = 51+36,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 2*51, .frame_nr = 51+36+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch8_6[] = {
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 51, .frame_nr = 24 },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 51, .frame_nr = 24+15 },
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 2*51, .frame_nr = 51+40,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 2*51, .frame_nr = 51+40+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch8_7[] = {
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 51, .frame_nr = 28 },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 51, .frame_nr = 28+15 },
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 2*51, .frame_nr = 51+44,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 2*51, .frame_nr = 51+44+15,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+
+/* CBCH replaces sub-slot 2 of SDCCH, see GSM 05.02, section 6.4 */
+static const struct mframe_sched_item mf_sdcch8_cbch[] = {
+	{ .sched_set = NB_QUAD_FH_DL, .modulo = 51, .frame_nr = 8 },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_sdcch4_cbch[] = {
+	{ .sched_set = NB_QUAD_DL, .modulo = 51, .frame_nr = 32 },
+	{ .sched_set = NULL }
+};
+
+/* Measurement for MF 51 C0 */
+static const struct mframe_sched_item mf_neigh_pm51_c0t0[] = {
+	{ .sched_set = NEIGH_PM   , .modulo = 51, .frame_nr = 0 },
+	{ .sched_set = NEIGH_PM   , .modulo = 51, .frame_nr = 10 },
+	{ .sched_set = NEIGH_PM   , .modulo = 51, .frame_nr = 20 },
+	{ .sched_set = NEIGH_PM   , .modulo = 51, .frame_nr = 30 },
+	{ .sched_set = NEIGH_PM   , .modulo = 51, .frame_nr = 40 },
+	{ .sched_set = NULL }
+};
+
+/* Measurement for MF 51 */
+static const struct mframe_sched_item mf_neigh_pm51[] = {
+	{ .sched_set = NEIGH_PM   , .modulo = 51, .frame_nr = 50 },
+	{ .sched_set = NULL }
+};
+
+/* TCH */
+#define TCH	tch_sched_set
+#define TCH_A	tch_a_sched_set
+#define TCH_D	tch_d_sched_set
+
+static const struct mframe_sched_item mf_tch_f_even[] = {
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  0 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  1 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  2 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  3 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  4 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  5 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  6 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  7 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  8 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  9 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr = 10 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr = 11 },
+	{ .sched_set = TCH_A, .modulo = 26, .frame_nr = 12,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+
+static const struct mframe_sched_item mf_tch_f_odd[] = {
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  0 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  1 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  2 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  3 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  4 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  5 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  6 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  7 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  8 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  9 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr = 10 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr = 11 },
+	{ .sched_set = TCH_A, .modulo = 26, .frame_nr = 25,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+
+static const struct mframe_sched_item mf_tch_h_0[] = {
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  0 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr =  1 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  2 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr =  3 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  4 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr =  5 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  6 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr =  7 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  8 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr =  9 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr = 10 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr = 11 },
+	{ .sched_set = TCH_A, .modulo = 26, .frame_nr = 12,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+
+static const struct mframe_sched_item mf_tch_h_1[] = {
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr =  0 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  1 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr =  2 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  3 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr =  4 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  5 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr =  6 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  7 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr =  8 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr =  9 },
+	{ .sched_set = TCH_D, .modulo = 13, .frame_nr = 10 },
+	{ .sched_set = TCH,   .modulo = 13, .frame_nr = 11 },
+	{ .sched_set = TCH_A, .modulo = 26, .frame_nr = 25,
+	  .flags = MF_F_SACCH },
+	{ .sched_set = NULL }
+};
+
+/* Measurement for MF 26 */
+static const struct mframe_sched_item mf_neigh_pm26_even[] = {
+	{ .sched_set = NEIGH_PM   , .modulo = 26, .frame_nr = 25 },
+	{ .sched_set = NULL }
+};
+static const struct mframe_sched_item mf_neigh_pm26_odd[] = {
+	{ .sched_set = NEIGH_PM   , .modulo = 26, .frame_nr = 12 },
+	{ .sched_set = NULL }
+};
+
+/* Test TX */
+static const struct mframe_sched_item mf_tx_all_nb[] = {
+	{ .sched_set = NB_QUAD_FH_UL, .modulo = 4, .frame_nr = 0 },
+	{ .sched_set = NULL }
+};
+
+static const struct mframe_sched_item *sched_set_for_task[32] = {
+	[MF_TASK_BCCH_NORM] = mf_bcch_norm,
+	[MF_TASK_BCCH_EXT] = mf_bcch_ext,
+	[MF_TASK_CCCH] = mf_ccch,
+	[MF_TASK_CCCH_COMB] = mf_ccch_comb,
+
+	[MF_TASK_SDCCH4_0] = mf_sdcch4_0,
+	[MF_TASK_SDCCH4_1] = mf_sdcch4_1,
+	[MF_TASK_SDCCH4_2] = mf_sdcch4_2,
+	[MF_TASK_SDCCH4_3] = mf_sdcch4_3,
+
+	[MF_TASK_SDCCH8_0] = mf_sdcch8_0,
+	[MF_TASK_SDCCH8_1] = mf_sdcch8_1,
+	[MF_TASK_SDCCH8_2] = mf_sdcch8_2,
+	[MF_TASK_SDCCH8_3] = mf_sdcch8_3,
+	[MF_TASK_SDCCH8_4] = mf_sdcch8_4,
+	[MF_TASK_SDCCH8_5] = mf_sdcch8_5,
+	[MF_TASK_SDCCH8_6] = mf_sdcch8_6,
+	[MF_TASK_SDCCH8_7] = mf_sdcch8_7,
+
+	[MF_TASK_SDCCH4_CBCH] = mf_sdcch4_cbch,
+	[MF_TASK_SDCCH8_CBCH] = mf_sdcch8_cbch,
+
+	[MF_TASK_TCH_F_EVEN] = mf_tch_f_even,
+	[MF_TASK_TCH_F_ODD]  = mf_tch_f_odd,
+	[MF_TASK_TCH_H_0]    = mf_tch_h_0,
+	[MF_TASK_TCH_H_1]    = mf_tch_h_1,
+
+	[MF_TASK_NEIGH_PM51_C0T0] = mf_neigh_pm51_c0t0,
+	[MF_TASK_NEIGH_PM51] = mf_neigh_pm51,
+	[MF_TASK_NEIGH_PM26E] = mf_neigh_pm26_even,
+	[MF_TASK_NEIGH_PM26O] = mf_neigh_pm26_odd,
+
+	[MF_TASK_UL_ALL_NB] = mf_tx_all_nb,
+};
+
+/* encodes a channel number according to 08.58 Chapter 9.3.1 */
+uint8_t mframe_task2chan_nr(enum mframe_task mft, uint8_t ts)
+{
+	uint8_t cbits;
+
+	switch (mft) {
+	case MF_TASK_BCCH_NORM:
+	case MF_TASK_BCCH_EXT:
+		cbits = 0x10;
+		break;
+	case MF_TASK_CCCH:
+	case MF_TASK_CCCH_COMB:
+		cbits = 0x12;
+		break;
+	case MF_TASK_SDCCH4_0:
+		cbits = 0x04 + 0;
+		break;
+	case MF_TASK_SDCCH4_1:
+		cbits = 0x04 + 1;
+		break;
+	case MF_TASK_SDCCH4_2:
+		cbits = 0x04 + 2;
+		break;
+	case MF_TASK_SDCCH4_3:
+		cbits = 0x04 + 3;
+		break;
+	case MF_TASK_SDCCH8_0:
+		cbits = 0x08 + 0;
+		break;
+	case MF_TASK_SDCCH8_1:
+		cbits = 0x08 + 1;
+		break;
+	case MF_TASK_SDCCH8_2:
+		cbits = 0x08 + 2;
+		break;
+	case MF_TASK_SDCCH8_3:
+		cbits = 0x08 + 3;
+		break;
+	case MF_TASK_SDCCH8_4:
+		cbits = 0x08 + 4;
+		break;
+	case MF_TASK_SDCCH8_5:
+		cbits = 0x08 + 5;
+		break;
+	case MF_TASK_SDCCH8_6:
+		cbits = 0x08 + 6;
+		break;
+	case MF_TASK_SDCCH8_7:
+		cbits = 0x08 + 7;
+		break;
+	case MF_TASK_TCH_F_EVEN:
+	case MF_TASK_TCH_F_ODD:
+		cbits = 0x01;
+		break;
+	case MF_TASK_TCH_H_0:
+		cbits = 0x02 + 0;
+		break;
+	case MF_TASK_TCH_H_1:
+		cbits = 0x02 + 1;
+		break;
+
+	/* Osmocom specific extensions */
+	case MF_TASK_SDCCH4_CBCH:
+		cbits = 0x18;
+		break;
+	case MF_TASK_SDCCH8_CBCH:
+		cbits = 0x19;
+		break;
+
+	case MF_TASK_UL_ALL_NB:
+	default:
+		printd("ERROR: cannot express mf_task=%d as "
+			"channel number, using 0x00\n", mft);
+		cbits = 0x00;
+	}
+
+	return (cbits << 3) | (ts & 0x7);
+}
+
+/* how many TDMA frame ticks should we schedule events ahead? */
+#define SCHEDULE_AHEAD	2
+
+/* how long do we need to tell the DSP in advance what we want to do? */
+#define SCHEDULE_LATENCY	1
+
+/* (test and) schedule one particular sched_item_set by means of the TDMA scheduler */
+static void mframe_schedule_set(enum mframe_task task_id)
+{
+	const struct mframe_sched_item *set = sched_set_for_task[task_id];
+	const struct mframe_sched_item *si;
+
+	for (si = set; si->sched_set != NULL; si++) {
+		unsigned int trigger = si->frame_nr % si->modulo;
+		unsigned int current = (l1s.current_time.fn + SCHEDULE_AHEAD) % si->modulo;
+		if (current == trigger) {
+			uint32_t fn;
+			int rv;
+
+			/* Schedule the set */
+			/* FIXME: what to do with SACCH Flag etc? */
+			rv = tdma_schedule_set(SCHEDULE_AHEAD-SCHEDULE_LATENCY,
+					  si->sched_set, task_id | (si->flags<<8));
+
+			/* Compute the next safe time to queue a DSP command */
+			fn = l1s.current_time.fn;
+			ADD_MODULO(fn, rv - 2, GSM_MAX_FN); /* -2 = worst case last dsp command */
+			if ((fn > l1s.mframe_sched.safe_fn) ||
+			    (l1s.mframe_sched.safe_fn >= GSM_MAX_FN))
+				l1s.mframe_sched.safe_fn = fn;
+		}
+	}
+}
+
+/* Enable a specific task */
+void mframe_enable(enum mframe_task task_id)
+{
+	l1s.mframe_sched.tasks_tgt |= (1 << task_id);
+}
+
+/* Disable a specific task */
+void mframe_disable(enum mframe_task task_id)
+{
+	l1s.mframe_sched.tasks_tgt &= ~(1 << task_id);
+}
+
+/* Replace the current active set by the new one */
+void mframe_set(uint32_t tasks)
+{
+	l1s.mframe_sched.tasks_tgt = tasks;
+}
+
+/* Schedule mframe_sched_items according to current MF TASK list */
+void mframe_schedule(void)
+{
+	unsigned int i;
+	int fn_diff;
+
+	/* Try to enable/disable task to meet target bitmap */
+	fn_diff = l1s.mframe_sched.safe_fn - l1s.current_time.fn;
+	if ((fn_diff <= 0) || (fn_diff >= (GSM_MAX_FN>>1)) ||
+	    (l1s.mframe_sched.safe_fn >= GSM_MAX_FN))
+		/* If nothing is in the way, enable new tasks */
+		l1s.mframe_sched.tasks = l1s.mframe_sched.tasks_tgt;
+	else
+		/* Else, Disable only */
+		l1s.mframe_sched.tasks &= l1s.mframe_sched.tasks_tgt;
+
+	/* Schedule any active pending set */
+	for (i = 0; i < 32; i++) {
+		if (l1s.mframe_sched.tasks & (1 << i))
+			mframe_schedule_set(i);
+	}
+}
+
+/* reset the scheduler, disabling all tasks */
+void mframe_reset(void)
+{
+	l1s.mframe_sched.tasks = 0;
+	l1s.mframe_sched.tasks_tgt = 0;
+	l1s.mframe_sched.safe_fn = -1UL;	/* Force safe */
+}
+
diff --git a/src/target/firmware/layer1/prim_fbsb.c b/src/target/firmware/layer1/prim_fbsb.c
new file mode 100644
index 00000000..50acefcc
--- /dev/null
+++ b/src/target/firmware/layer1/prim_fbsb.c
@@ -0,0 +1,577 @@
+/* Layer 1 - FCCH and SCH burst handling */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <inttypes.h>
+#include <defines.h>
+#include <debug.h>
+#include <memory.h>
+#include <byteorder.h>
+#include <rffe.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/msgb.h>
+#include <calypso/dsp_api.h>
+#include <calypso/irq.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/timer.h>
+#include <comm/sercomm.h>
+
+#include <layer1/sync.h>
+#include <layer1/afc.h>
+#include <layer1/toa.h>
+#include <layer1/tdma_sched.h>
+#include <layer1/mframe_sched.h>
+#include <layer1/tpu_window.h>
+#include <layer1/l23_api.h>
+#include <layer1/agc.h>
+
+#include <l1ctl_proto.h>
+
+#define FB0_RETRY_COUNT		3
+#define AFC_RETRY_COUNT		30
+
+extern uint16_t rf_arfcn; // TODO
+
+struct mon_state {
+	uint32_t fnr_report;	/* frame number when DSP reported it */
+	int attempt;		/* which attempt was this ? */
+
+	int16_t toa;
+	uint16_t pm;
+	uint16_t angle;
+	uint16_t snr;
+
+	/* computed values */
+	int16_t freq_diff;
+
+	/* Sync Burst (SB) */
+	uint8_t bsic;
+	struct gsm_time time;
+};
+
+struct l1a_fb_state {
+	struct mon_state mon;
+	struct l1ctl_fbsb_req req;
+	int16_t initial_freq_err;
+	uint8_t fb_retries;
+	uint8_t afc_retries;
+};
+
+static struct l1a_fb_state fbs;
+static struct mon_state *last_fb = &fbs.mon;
+
+static void dump_mon_state(struct mon_state *fb)
+{
+#if 0
+	printf("(%"PRIu32":%u): TOA=%5u, Power=%4ddBm, Angle=%5dHz, "
+		"SNR=%04x(%d.%u) OFFSET=%u SYNCHRO=%u\n",
+		fb->fnr_report, fb->attempt, fb->toa,
+		agc_inp_dbm8_by_pm(fb->pm)/8, ANGLE_TO_FREQ(fb->angle),
+		fb->snr, l1s_snr_int(fb->snr), l1s_snr_fract(fb->snr),
+		tpu_get_offset(), tpu_get_synchro());
+#else
+	printf("(%"PRIu32":%u): TOA=%5u, Power=%4ddBm, Angle=%5dHz\n",
+		fb->fnr_report, fb->attempt, fb->toa,
+		agc_inp_dbm8_by_pm(fb->pm)/8, ANGLE_TO_FREQ(fb->angle));
+#endif
+}
+
+static int l1ctl_fbsb_resp(uint8_t res)
+{
+	struct msgb *msg;
+	struct l1ctl_fbsb_conf *resp;
+
+	msg = l1_create_l2_msg(L1CTL_FBSB_CONF, fbs.mon.time.fn,
+				l1s_snr_int(fbs.mon.snr),
+				fbs.req.band_arfcn);
+	if (!msg)
+		return -ENOMEM;
+
+	resp = (struct l1ctl_fbsb_conf *) msgb_put(msg, sizeof(*resp));
+	resp->initial_freq_err = htons(fbs.initial_freq_err);
+	resp->result = res;
+	resp->bsic = fbs.mon.bsic;
+
+	/* no need to set BSIC, as it is never used here */
+	l1_queue_for_l2(msg);
+
+	return 0;
+}
+
+/* SCH Burst Detection ********************************************************/
+
+/* determine the GSM time and BSIC from a Sync Burst */
+static uint8_t l1s_decode_sb(struct gsm_time *time, uint32_t sb)
+{
+	uint8_t bsic = (sb >> 2) & 0x3f;
+	uint8_t t3p;
+
+	memset(time, 0, sizeof(*time));
+
+	/* TS 05.02 Chapter 3.3.2.2.1 SCH Frame Numbers */
+	time->t1 = ((sb >> 23) & 1) | ((sb >> 7) & 0x1fe) | ((sb << 9) & 0x600);
+	time->t2 = (sb >> 18) & 0x1f;
+	t3p = ((sb >> 24) & 1) | ((sb >> 15) & 6);
+	time->t3 = t3p*10 + 1;
+
+	/* TS 05.02 Chapter 4.3.3 TDMA frame number */
+	time->fn = gsm_gsmtime2fn(time);
+
+	time->tc = (time->fn / 51) % 8;
+
+	return bsic;
+}
+
+static void read_sb_result(struct mon_state *st, int attempt)
+{
+	st->toa = dsp_api.db_r->a_serv_demod[D_TOA];
+	st->pm = dsp_api.db_r->a_serv_demod[D_PM]>>3;
+	st->angle = dsp_api.db_r->a_serv_demod[D_ANGLE];
+	st->snr = dsp_api.db_r->a_serv_demod[D_SNR];
+
+	st->freq_diff = ANGLE_TO_FREQ(st->angle);
+	st->fnr_report = l1s.current_time.fn;
+	st->attempt = attempt;
+
+	dump_mon_state(st);
+
+	if (st->snr > AFC_SNR_THRESHOLD)
+		afc_input(st->freq_diff, rf_arfcn, 1);
+	else
+		afc_input(st->freq_diff, rf_arfcn, 0);
+
+	dsp_api.r_page_used = 1;
+}
+
+/* Note: When we get the SB response, it is 2 TDMA frames after the SB
+ * actually happened, as it is a "C W W R" task */
+#define SB2_LATENCY	2
+
+static int l1s_sbdet_resp(__unused uint8_t p1, uint8_t attempt,
+			  __unused uint16_t p3)
+{
+	uint32_t sb;
+	int qbits, fn_offset;
+	struct l1_cell_info *cinfo = &l1s.serving_cell;
+	int fnr_delta, bits_delta;
+
+	putchart('s');
+
+	if (dsp_api.db_r->a_sch[0] & (1<<B_SCH_CRC)) {
+		/* mark READ page as being used */
+		dsp_api.r_page_used = 1;
+
+		/* after 2nd attempt, we failed */
+		if (attempt == 2) {
+			last_fb->attempt = 13;
+			l1s_compl_sched(L1_COMPL_FB);
+		}
+
+		/* after 1st attempt, we simply wait for 2nd */
+		return 0;
+	}
+
+	printf("SB%d ", attempt);
+	read_sb_result(last_fb, attempt);
+
+	sb = dsp_api.db_r->a_sch[3] | dsp_api.db_r->a_sch[4] << 16;
+	fbs.mon.bsic = l1s_decode_sb(&fbs.mon.time, sb);
+	printf("=> SB 0x%08"PRIx32": BSIC=%u ", sb, fbs.mon.bsic);
+	l1s_time_dump(&fbs.mon.time);
+
+	l1s.serving_cell.bsic = fbs.mon.bsic;
+
+	/* calculate synchronisation value (TODO: only complete for qbits) */
+	last_fb->toa -= 23;
+	qbits = last_fb->toa * 4;
+	fn_offset = l1s.current_time.fn; // TODO
+
+	if (qbits > QBITS_PER_TDMA) {
+		qbits -= QBITS_PER_TDMA;
+		fn_offset -= 1;
+	} else if (qbits < 0)  {
+		qbits += QBITS_PER_TDMA;
+		fn_offset += 1;
+	}
+
+	fnr_delta = last_fb->fnr_report - attempt;
+	bits_delta = fnr_delta * BITS_PER_TDMA;
+
+	cinfo->fn_offset = fnr_delta;
+	cinfo->time_alignment = qbits;
+	cinfo->arfcn = rf_arfcn;
+
+	if (last_fb->toa > bits_delta)
+		printf("=> DSP reports SB in bit that is %d bits in the "
+			"future?!?\n", last_fb->toa - bits_delta);
+	else
+		printf(" qbits=%u\n", qbits);
+
+	synchronize_tdma(&l1s.serving_cell);
+
+	/* if we have recived a SYNC burst, update our local GSM time */
+	gsm_fn2gsmtime(&l1s.current_time, fbs.mon.time.fn + SB2_LATENCY);
+	/* compute next time from new current time */
+	l1s.next_time = l1s.current_time;
+	l1s_time_inc(&l1s.next_time, 1);
+
+	/* If we call tdma_sched_reset(), which is only needed if there
+	 * are further l1s_sbdet_resp() scheduled, we will bring
+	 * dsp_api.db_r and dsp_api.db_w out of sync because we changed
+	 * dsp_api.db_w for l1s_sbdet_cmd() and canceled
+	 * l1s_sbdet_resp() which would change dsp_api.db_r. The DSP
+	 * however expects dsp_api.db_w and dsp_api.db_r to be in sync
+	 * (either "0 - 0" or "1 - 1"). So we have to bring dsp_api.db_w
+	 * and dsp_api.db_r into sync again, otherwise NB reading will
+	 * complain. We probably don't need the Abort command and could
+	 * just bring dsp_api.db_w and dsp_api.db_r into sync.  */
+	if (attempt != 2) {
+		tdma_sched_reset();
+		l1s_dsp_abort();
+	}
+
+	l1s_reset_hw();
+	/* enable the MF Task for BCCH reading */
+	mframe_enable(MF_TASK_BCCH_NORM);
+	if (l1s.serving_cell.ccch_mode == CCCH_MODE_COMBINED)
+		mframe_enable(MF_TASK_CCCH_COMB);
+	else if (l1s.serving_cell.ccch_mode == CCCH_MODE_NON_COMBINED)
+		mframe_enable(MF_TASK_CCCH);
+	else if (l1s.serving_cell.ccch_mode == CCCH_MODE_COMBINED_CBCH) {
+		mframe_enable(MF_TASK_CCCH_COMB);
+		mframe_enable(MF_TASK_SDCCH4_CBCH);
+	}
+
+	l1s_compl_sched(L1_COMPL_FB);
+
+	return 0;
+}
+
+static int l1s_sbdet_cmd(__unused uint8_t p1, __unused uint8_t p2,
+			 __unused uint16_t p3)
+{
+	putchart('S');
+
+	fbs.mon.bsic = 0;
+	fbs.mon.time.fn = 0;
+
+	dsp_api.db_w->d_task_md = SB_DSP_TASK;
+	dsp_api.ndb->d_fb_mode = 0; /* wideband search */
+
+	/* Program TPU */
+	l1s_rx_win_ctrl(rf_arfcn, L1_RXWIN_SB, 0);
+
+	return 0;
+}
+
+/* This is how it is done by the TSM30 */
+static const struct tdma_sched_item sb_sched_set[] = {
+	SCHED_ITEM_DT(l1s_sbdet_cmd, 0, 0, 1),	SCHED_END_FRAME(),
+	SCHED_ITEM_DT(l1s_sbdet_cmd, 0, 0, 2),	SCHED_END_FRAME(),
+						SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_sbdet_resp, -4, 0, 1),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_sbdet_resp, -4, 0, 2),	SCHED_END_FRAME(),
+	SCHED_END_SET()
+};
+
+void l1s_sb_test(uint8_t base_fn)
+{
+	tdma_schedule_set(base_fn, sb_sched_set, 0);
+}
+/* FCCH Burst *****************************************************************/
+
+static int read_fb_result(struct mon_state *st, int attempt)
+{
+	st->toa = dsp_api.ndb->a_sync_demod[D_TOA];
+	st->pm = dsp_api.ndb->a_sync_demod[D_PM]>>3;
+	st->angle = dsp_api.ndb->a_sync_demod[D_ANGLE];
+	st->snr = dsp_api.ndb->a_sync_demod[D_SNR];
+
+	//last_fb->angle = clip_int16(last_fb->angle, AFC_MAX_ANGLE);
+	st->freq_diff = ANGLE_TO_FREQ(last_fb->angle);
+	st->fnr_report = l1s.current_time.fn;
+	st->attempt = attempt;
+
+	dump_mon_state(st);
+
+	dsp_api.ndb->d_fb_det = 0;
+	dsp_api.ndb->a_sync_demod[D_TOA] = 0; /* TSM30 does it (really needed ?) */
+
+	/* Update AFC with current frequency offset */
+	afc_correct(st->freq_diff, rf_arfcn);
+
+	//tpu_dsp_frameirq_enable();
+	return 1;
+}
+
+static void fbinfo2cellinfo(struct l1_cell_info *cinfo,
+			    const struct mon_state *mon)
+{
+	int ntdma, qbits, fn_offset, fnr_delta, bits_delta;
+
+	/* FIXME: where did this magic 23 come from? */
+	last_fb->toa -= 23;
+
+	if (last_fb->toa < 0) {
+		qbits = (last_fb->toa + BITS_PER_TDMA) * 4;
+		ntdma = -1;
+	} else {
+		ntdma = (last_fb->toa) / BITS_PER_TDMA;
+		qbits = (last_fb->toa - ntdma * BITS_PER_TDMA) * 4;
+	}
+
+	fn_offset = l1s.current_time.fn - last_fb->attempt + ntdma;
+	fnr_delta = last_fb->fnr_report - last_fb->attempt;
+	bits_delta = fnr_delta * BITS_PER_TDMA;
+
+	cinfo->fn_offset = fnr_delta;
+	cinfo->time_alignment = qbits;
+	cinfo->arfcn = rf_arfcn;
+
+	if (last_fb->toa > bits_delta)
+		printf("=> DSP reports FB in bit that is %d bits in "
+			"the future?!?\n", last_fb->toa - bits_delta);
+	else {
+		int fb_fnr = (last_fb->fnr_report - last_fb->attempt)
+				+ last_fb->toa/BITS_PER_TDMA;
+		printf("=>FB @ FNR %u fn_offset=%d qbits=%u\n",
+			fb_fnr, fn_offset, qbits);
+	}
+}
+
+/* scheduler callback to issue a FB detection task to the DSP */
+static int l1s_fbdet_cmd(__unused uint8_t p1, __unused uint8_t p2,
+			 uint16_t fb_mode)
+{
+	if (fb_mode == 0) {
+		putchart('F');
+	} else {
+		putchart('V');
+	}
+
+	l1s.fb.mode = fb_mode;
+
+	/* Tell the RF frontend to set the gain appropriately */
+	rffe_compute_gain(rxlev2dbm(fbs.req.rxlev_exp), CAL_DSP_TGT_BB_LVL);
+
+	/* Program DSP */
+	dsp_api.db_w->d_task_md = FB_DSP_TASK;	/* maybe with I/Q swap? */
+	dsp_api.ndb->d_fb_mode = fb_mode;
+
+	/* Program TPU */
+	l1s_rx_win_ctrl(fbs.req.band_arfcn, L1_RXWIN_FB, 0);
+
+	return 0;
+}
+
+#if 0
+#define FB0_SNR_THRESH	2000
+#define FB1_SNR_THRESH	3000
+#else
+#define FB0_SNR_THRESH	0
+#define FB1_SNR_THRESH	0
+#endif
+
+static const struct tdma_sched_item fb_sched_set[];
+
+/* scheduler callback to check for a FB detection response */
+static int l1s_fbdet_resp(__unused uint8_t p1, uint8_t attempt,
+			  uint16_t fb_mode)
+{
+	putchart('f');
+
+	if (!dsp_api.ndb->d_fb_det) {
+		/* we did not detect a FB */
+
+		/* attempt < 12, do nothing */
+		if (attempt < 12)
+			return 0;
+
+		/* attempt >= 12, we simply don't find one */
+
+		/* If we don't reset here, we get DSP DMA errors */
+		tdma_sched_reset();
+
+		if (fbs.fb_retries < FB0_RETRY_COUNT) {
+			/* retry once more */
+			tdma_schedule_set(1, fb_sched_set, 0);
+			fbs.fb_retries++;
+		} else {
+			last_fb->attempt = 13;
+			l1s_compl_sched(L1_COMPL_FB);
+		}
+
+		return 0;
+	}
+
+	/* We found a frequency burst, reset everything */
+	l1s_reset_hw();
+
+	printf("FB%u ", dsp_api.ndb->d_fb_mode);
+	read_fb_result(last_fb, attempt);
+
+	/* if this is the first success, save freq err */
+	if (!fbs.initial_freq_err)
+		fbs.initial_freq_err = last_fb->freq_diff;
+
+	/* If we don't reset here, we get DSP DMA errors */
+	tdma_sched_reset();
+
+	/* Immediately schedule further TDMA tasklets, if requested. Doing
+	 * this directly from L1S means we can do this quickly without any
+	 * additional delays */
+	if (fb_mode == 0) {
+		if (fbs.req.flags & L1CTL_FBSB_F_FB1) {
+			/* If we don't reset here, we get DSP DMA errors */
+			tdma_sched_reset();
+			/* FIXME: don't only use the last but an average */
+			if (abs(last_fb->freq_diff) < fbs.req.freq_err_thresh1 &&
+			    last_fb->snr > FB0_SNR_THRESH) {
+				/* continue with FB1 task in DSP */
+				tdma_schedule_set(1, fb_sched_set, 1);
+			} else {
+				if (fbs.afc_retries < AFC_RETRY_COUNT) {
+					tdma_schedule_set(1, fb_sched_set, 0);
+					fbs.afc_retries++;
+				} else {
+					/* Abort */
+					last_fb->attempt = 13;
+					l1s_compl_sched(L1_COMPL_FB);
+				}
+			}
+		} else
+			l1s_compl_sched(L1_COMPL_FB);
+	} else if (fb_mode == 1) {
+		if (fbs.req.flags & L1CTL_FBSB_F_SB) {
+
+	int ntdma, qbits;
+	/* FIXME: where did this magic 23 come from? */
+	last_fb->toa -= 23;
+
+	if (last_fb->toa < 0) {
+		qbits = (last_fb->toa + BITS_PER_TDMA) * 4;
+		ntdma = -1;
+	} else {
+		ntdma = (last_fb->toa) / BITS_PER_TDMA;
+		qbits = (last_fb->toa - ntdma * BITS_PER_TDMA) * 4;
+	}
+
+
+			int fn_offset = l1s.current_time.fn - last_fb->attempt + ntdma;
+			int delay = fn_offset + 11 - l1s.current_time.fn - 1;
+			printf("  fn_offset=%d (fn=%"PRIu32" + attempt=%u + ntdma = %d)\n",
+				fn_offset, l1s.current_time.fn, last_fb->attempt, ntdma);
+			printf("  delay=%d (fn_offset=%d + 11 - fn=%"PRIu32" - 1\n", delay,
+				fn_offset, l1s.current_time.fn);
+			printf("  scheduling next FB/SB detection task with delay %u\n", delay);
+			if (abs(last_fb->freq_diff) < fbs.req.freq_err_thresh2 &&
+			    last_fb->snr > FB1_SNR_THRESH) {
+				/* synchronize before reading SB */
+				fbinfo2cellinfo(&l1s.serving_cell, last_fb);
+				synchronize_tdma(&l1s.serving_cell);
+				tdma_schedule_set(delay, sb_sched_set, 0);
+			} else
+				tdma_schedule_set(delay, fb_sched_set, 1);
+		} else
+			l1s_compl_sched(L1_COMPL_FB);
+	}
+
+	return 0;
+}
+
+/* FB detection */
+static const struct tdma_sched_item fb_sched_set[] = {
+	SCHED_ITEM_DT(l1s_fbdet_cmd, 0, 0, 0),	SCHED_END_FRAME(),
+						SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 1),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 2),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 3),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 4),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 5),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 6),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 7),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 8),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 9),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 10),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 11),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_fbdet_resp, -4, 0, 12),	SCHED_END_FRAME(),
+	SCHED_END_SET()
+};
+
+/* Asynchronous completion handler for FB detection */
+static void l1a_fb_compl(__unused enum l1_compl c)
+{
+	if (last_fb->attempt >= 13) {
+		/* FB detection failed, signal this via L1CTL */
+		l1ctl_fbsb_resp(255);
+		return;
+	}
+
+	/* FIME: use l1s.neigh_cell[fbs.cinfo_idx] */
+	fbinfo2cellinfo(&l1s.serving_cell, last_fb);
+
+	/* send FBSB_CONF success message via L1CTL */
+	l1ctl_fbsb_resp(0);
+}
+
+void l1s_fbsb_req(uint8_t base_fn, struct l1ctl_fbsb_req *req)
+{
+	/* copy + endian convert request data */
+	fbs.req.band_arfcn = ntohs(req->band_arfcn);
+	fbs.req.timeout = ntohs(req->timeout);
+	fbs.req.freq_err_thresh1 = ntohs(req->freq_err_thresh1);
+	fbs.req.freq_err_thresh2 = ntohs(req->freq_err_thresh2);
+	fbs.req.num_freqerr_avg = req->num_freqerr_avg;
+	fbs.req.flags = req->flags;
+	fbs.req.sync_info_idx = req->sync_info_idx;
+	fbs.req.rxlev_exp = req->rxlev_exp;
+
+	/* clear initial frequency error */
+	fbs.initial_freq_err = 0;
+	fbs.fb_retries = 0;
+	fbs.afc_retries = 0;
+
+	/* Make sure we start at a 'center' AFCDAC output value */
+	afc_reset();
+
+	/* Reset the TOA loop counters */
+	toa_reset();
+
+	if (fbs.req.flags & L1CTL_FBSB_F_FB0)
+		tdma_schedule_set(base_fn, fb_sched_set, 0);
+	else if (fbs.req.flags & L1CTL_FBSB_F_FB1)
+		tdma_schedule_set(base_fn, fb_sched_set, 0);
+	else if (fbs.req.flags & L1CTL_FBSB_F_SB)
+		tdma_schedule_set(base_fn, sb_sched_set, 0);
+
+}
+
+static __attribute__ ((constructor)) void l1s_prim_fbsb_init(void)
+{
+	l1s.completion[L1_COMPL_FB] = &l1a_fb_compl;
+}
diff --git a/src/target/firmware/layer1/prim_freq.c b/src/target/firmware/layer1/prim_freq.c
new file mode 100644
index 00000000..01f39d48
--- /dev/null
+++ b/src/target/firmware/layer1/prim_freq.c
@@ -0,0 +1,113 @@
+/* Layer 1 Frequency redefinition at "starting time" */
+
+/* (C) 2010 by Andreas Eversverg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <inttypes.h>
+#include <defines.h>
+#include <debug.h>
+#include <memory.h>
+#include <byteorder.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/msgb.h>
+#include <calypso/dsp_api.h>
+#include <calypso/irq.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/timer.h>
+#include <comm/sercomm.h>
+#include <asm/system.h>
+
+#include <layer1/sync.h>
+#include <layer1/async.h>
+#include <layer1/tdma_sched.h>
+#include <layer1/tpu_window.h>
+#include <layer1/l23_api.h>
+#include <layer1/sched_gsmtime.h>
+
+#include <l1ctl_proto.h>
+
+struct {
+	uint32_t fn;
+	uint16_t band_arfcn;
+} last_rach;
+
+/* if the "starting time" is reached, use frequencies "after time" */
+static int l1s_freq_cmd(__unused uint8_t p1, __unused uint8_t p2, __unused uint16_t p3)
+{
+	putchart('F');
+
+	printf("Reached starting time, altering frequency set\n");
+
+	l1s.dedicated.tsc = l1s.dedicated.st_tsc;
+	l1s.dedicated.h = l1s.dedicated.st_h;
+	if (l1s.dedicated.h)
+		memcpy(&l1s.dedicated.h1, &l1s.dedicated.st_h1,
+			sizeof(l1s.dedicated.h1));
+	else
+		memcpy(&l1s.dedicated.h0, &l1s.dedicated.st_h0,
+			sizeof(l1s.dedicated.h0));
+
+	return 0;
+}
+
+/* sched set for frequency change */
+const struct tdma_sched_item freq_sched_set[] = {
+	SCHED_ITEM(l1s_freq_cmd, -3, 1, 0),
+	SCHED_END_SET()
+};
+
+/* request a frequency change at the given frame number
+ * Note: The fn_sched parameter must be in range 0..42431. */
+void l1a_freq_req(uint32_t fn_sched)
+{
+	int32_t diff;
+	unsigned long flags;
+
+	/* We must check here, if the time already elapsed.
+	 * This is required, because we may have an undefined delay between
+	 * layer 1 and layer 3.
+	 */
+	diff = fn_sched - (l1s.current_time.fn % 42432);
+	if (diff < 0)
+		diff += 42432;
+	/* note: 5 is used to give scheduler some time */
+	if (diff == 5 || diff >= 32024) {
+		l1s_freq_cmd(0, 0, 0);
+		return;
+	}
+
+	/* calculate (full range) frame number */
+	fn_sched = l1s.current_time.fn + diff;
+	if (fn_sched >= GSM_MAX_FN)
+		fn_sched -= GSM_MAX_FN;
+	printf("Scheduling frequency change at fn=%"PRIu32", currently fn=%"PRIu32"\n",
+		fn_sched, l1s.current_time.fn);
+
+	local_firq_save(flags);
+	sched_gsmtime(freq_sched_set, fn_sched, 0);
+	local_irq_restore(flags);
+}
+
diff --git a/src/target/firmware/layer1/prim_pm.c b/src/target/firmware/layer1/prim_pm.c
new file mode 100644
index 00000000..5c8c4914
--- /dev/null
+++ b/src/target/firmware/layer1/prim_pm.c
@@ -0,0 +1,242 @@
+/* Layer 1 Power Measurement */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <defines.h>
+#include <debug.h>
+#include <memory.h>
+#include <byteorder.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/msgb.h>
+#include <calypso/dsp_api.h>
+#include <calypso/irq.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/timer.h>
+#include <comm/sercomm.h>
+#include <asm/system.h>
+
+#include <layer1/sync.h>
+#include <layer1/agc.h>
+#include <layer1/tdma_sched.h>
+#include <layer1/tpu_window.h>
+#include <layer1/l23_api.h>
+#include <layer1/prim.h>
+#include <rffe.h>
+
+#include <l1ctl_proto.h>
+
+static void l1ddsp_meas_read(uint8_t nbmeas, uint16_t *pm)
+{
+	uint8_t i;
+
+	for (i = 0; i < nbmeas; i++)
+		pm[i] = (uint16_t) ((dsp_api.db_r->a_pm[i] & 0xffff) >> 3);
+	dsp_api.r_page_used = 1;
+}
+
+/* scheduler callback to issue a power measurement task to the DSP */
+static int l1s_pm_cmd(uint8_t num_meas,
+		      __unused uint8_t p2, uint16_t arfcn)
+{
+	putchart('P');
+
+	dsp_api.db_w->d_task_md = num_meas; /* number of measurements */
+	dsp_api.ndb->d_fb_mode = 0; /* wideband search */
+
+	/* Tell the RF frontend to set the gain appropriately */
+	rffe_compute_gain(-85, CAL_DSP_TGT_BB_LVL);
+
+	/* Program TPU */
+	/* FIXME: RXWIN_PW needs to set up multiple times in case
+	 * num_meas > 1 */
+	l1s_rx_win_ctrl(arfcn, L1_RXWIN_PW, 0);
+	//l1s_rx_win_ctrl(arfcn, L1_RXWIN_NB);
+
+	return 0;
+}
+
+/* scheduler callback to read power measurement resposnse from the DSP */
+static int l1s_pm_resp(uint8_t num_meas, __unused uint8_t p2,
+		       uint16_t arfcn)
+{
+	struct l1ctl_pm_conf *pmr;
+	uint16_t pm_level[2];
+
+	putchart('p');
+
+	l1ddsp_meas_read(num_meas, pm_level);
+
+	printf("PM MEAS: ARFCN=%u, %-4d dBm at baseband, %-4d dBm at RF\n",
+		arfcn, pm_level[0]/8, agc_inp_dbm8_by_pm(pm_level[0])/8);
+
+	printd("PM MEAS: %-4d dBm, %-4d dBm ARFCN=%u\n",
+		agc_inp_dbm8_by_pm(pm_level[0])/8,
+		agc_inp_dbm8_by_pm(pm_level[1])/8, arfcn);
+
+	if (!l1s.pm.msg)
+		l1s.pm.msg = l1ctl_msgb_alloc(L1CTL_PM_CONF);
+
+	if (msgb_tailroom(l1s.pm.msg) < sizeof(*pmr)) {
+		/* flush current msgb */
+		l1_queue_for_l2(l1s.pm.msg);
+		/* allocate a new msgb and initialize header */
+		l1s.pm.msg = l1ctl_msgb_alloc(L1CTL_PM_CONF);
+	}
+
+	pmr = (struct l1ctl_pm_conf *) msgb_put(l1s.pm.msg, sizeof(*pmr));
+	pmr->band_arfcn = htons(arfcn);
+	/* FIXME: do this as RxLev rather than DBM8 ? */
+	pmr->pm[0] = dbm2rxlev(agc_inp_dbm8_by_pm(pm_level[0])/8);
+	if (num_meas > 1)
+		pmr->pm[1] = dbm2rxlev(agc_inp_dbm8_by_pm(pm_level[1])/8);
+	else
+		pmr->pm[1] = 0;
+
+	if (l1s.pm.mode == 1) {
+		if (l1s.pm.range.arfcn_next != l1s.pm.range.arfcn_end) {
+			/* schedule PM for next ARFCN in range */
+			l1s.pm.range.arfcn_next =
+				(l1s.pm.range.arfcn_next+1) & 0xfbff;
+			l1s_pm_test(1, l1s.pm.range.arfcn_next);
+		} else {
+			/* we have finished, flush the msgb to L2 */
+			struct l1ctl_hdr *l1h;
+			l1h = (struct l1ctl_hdr *) l1s.pm.msg->l1h;
+			l1h->flags |= L1CTL_F_DONE;
+			l1_queue_for_l2(l1s.pm.msg);
+			l1s.pm.msg = NULL;
+		}
+	}
+
+	return 0;
+}
+
+static const struct tdma_sched_item pm_sched_set[] = {
+	SCHED_ITEM_DT(l1s_pm_cmd, 0, 1, 0),	SCHED_END_FRAME(),
+						SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_pm_resp, -4, 1, 0),	SCHED_END_FRAME(),
+	SCHED_END_SET()
+};
+
+/* Schedule a power measurement test */
+void l1s_pm_test(uint8_t base_fn, uint16_t arfcn)
+{
+	unsigned long flags;
+
+	printd("l1s_pm_test(%u, %u)\n", base_fn, arfcn);
+
+	local_firq_save(flags);
+	tdma_schedule_set(base_fn, pm_sched_set, arfcn);
+	local_irq_restore(flags);
+}
+
+/*
+ * perform measurements of neighbour cells
+ */
+
+/* scheduler callback to issue a power measurement task to the DSP */
+static int l1s_neigh_pm_cmd(uint8_t num_meas,
+		      __unused uint8_t p2, __unused uint16_t p3)
+{
+	uint8_t last_gain = rffe_get_gain();
+
+	dsp_api.db_w->d_task_md = num_meas; /* number of measurements */
+//	dsp_api.ndb->d_fb_mode = 0; /* wideband search */
+
+	/* Tell the RF frontend to set the gain appropriately (keep last) */
+	rffe_compute_gain(-85, CAL_DSP_TGT_BB_LVL);
+
+	/* Program TPU */
+	/* FIXME: RXWIN_PW needs to set up multiple times in case
+	 * num_meas > 1 */
+	/* do measurement dummy, in case l1s.neigh_pm.n == 0 */
+	l1s_rx_win_ctrl((l1s.neigh_pm.n) ?
+			l1s.neigh_pm.band_arfcn[l1s.neigh_pm.pos] : 0,
+		L1_RXWIN_PW, l1s.neigh_pm.tn[l1s.neigh_pm.pos]);
+
+	/* restore last gain */
+	rffe_set_gain(last_gain);
+
+	l1s.neigh_pm.running = 1;
+
+	return 0;
+}
+
+/* scheduler callback to read power measurement resposnse from the DSP */
+static int l1s_neigh_pm_resp(__unused uint8_t p1, __unused uint8_t p2,
+		       __unused uint16_t p3)
+{
+	uint16_t dbm;
+	uint8_t level;
+
+	dsp_api.r_page_used = 1;
+
+	if (l1s.neigh_pm.n == 0 || !l1s.neigh_pm.running)
+		goto out;
+
+	dbm = (uint16_t) ((dsp_api.db_r->a_pm[0] & 0xffff) >> 3);
+	level = dbm2rxlev(agc_inp_dbm8_by_pm(dbm)/8);
+
+	l1s.neigh_pm.level[l1s.neigh_pm.pos] = level;
+
+	if (++l1s.neigh_pm.pos >= l1s.neigh_pm.n) {
+		struct msgb *msg;
+		struct l1ctl_neigh_pm_ind *mi;
+		int i;
+
+		l1s.neigh_pm.pos = 0;
+		/* return result */
+		msg = l1ctl_msgb_alloc(L1CTL_NEIGH_PM_IND);
+		for (i = 0; i < l1s.neigh_pm.n; i++) {
+			if (msgb_tailroom(msg) < (int) sizeof(*mi)) {
+				l1_queue_for_l2(msg);
+				msg = l1ctl_msgb_alloc(L1CTL_NEIGH_PM_IND);
+			}
+			mi = (struct l1ctl_neigh_pm_ind *)
+				msgb_put(msg, sizeof(*mi));
+			mi->band_arfcn = htons(l1s.neigh_pm.band_arfcn[i]);
+			mi->tn = l1s.neigh_pm.tn[i];
+			mi->pm[0] = l1s.neigh_pm.level[i];
+			mi->pm[1] = 0;
+		}
+		l1_queue_for_l2(msg);
+	}
+
+out:
+	l1s.neigh_pm.running = 0;
+
+	return 0;
+}
+
+const struct tdma_sched_item neigh_pm_sched_set[] = {
+	SCHED_ITEM_DT(l1s_neigh_pm_cmd, 0, 1, 0),	SCHED_END_FRAME(),
+							SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_neigh_pm_resp, -4, 1, 0),	SCHED_END_FRAME(),
+	SCHED_END_SET()
+};
+
diff --git a/src/target/firmware/layer1/prim_rach.c b/src/target/firmware/layer1/prim_rach.c
new file mode 100644
index 00000000..e6ea6568
--- /dev/null
+++ b/src/target/firmware/layer1/prim_rach.c
@@ -0,0 +1,162 @@
+/* Layer 1 Random Access Channel Burst */
+
+/* (C) 2010 by Dieter Spaar <spaar@mirider.augusta.de>
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <defines.h>
+#include <debug.h>
+#include <memory.h>
+#include <byteorder.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/msgb.h>
+#include <calypso/dsp_api.h>
+#include <calypso/irq.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/timer.h>
+#include <comm/sercomm.h>
+#include <asm/system.h>
+
+#include <layer1/sync.h>
+#include <layer1/async.h>
+#include <layer1/tdma_sched.h>
+#include <layer1/tpu_window.h>
+#include <layer1/l23_api.h>
+#include <layer1/sched_gsmtime.h>
+
+#include <l1ctl_proto.h>
+
+struct {
+	uint32_t fn;
+	uint16_t band_arfcn;
+} last_rach;
+
+/* p1: type of operation (0: one NB, 1: one RACH burst, 2: four NB */
+static int l1s_tx_rach_cmd(__unused uint8_t p1, __unused uint8_t p2, __unused uint16_t p3)
+{
+	uint16_t  *info_ptr;
+	uint16_t arfcn;
+	uint8_t data[2];
+
+	putchart('T');
+
+	l1s_tx_apc_helper(l1s.serving_cell.arfcn);
+
+	data[0] = l1s.serving_cell.bsic << 2;
+	data[1] = l1s.rach.ra;
+
+	info_ptr = &dsp_api.ndb->d_rach;
+	info_ptr[0] = ((uint16_t)(data[0])) | ((uint16_t)(data[1])<<8);
+
+	arfcn = l1s.serving_cell.arfcn;
+
+	dsp_api.db_w->d_task_ra = dsp_task_iq_swap(RACH_DSP_TASK, arfcn, 1);
+
+	l1s_tx_win_ctrl(arfcn | ARFCN_UPLINK, L1_TXWIN_AB, 0, 3);
+
+	return 0;
+}
+
+/* p1: type of operation (0: one NB, 1: one RACH burst, 2: four NB */
+static int l1s_tx_rach_resp(__unused uint8_t p1, __unused uint8_t burst_id,
+			    __unused uint16_t p3)
+{
+	putchart('t');
+
+	dsp_api.r_page_used = 1;
+
+	/* schedule a confirmation back indicating the GSM time at which
+	 * the RACH burst was transmitted to the BTS */
+	last_rach.fn = l1s.current_time.fn - 1;
+	last_rach.band_arfcn = l1s.serving_cell.arfcn;
+	l1s_compl_sched(L1_COMPL_RACH);
+
+	return 0;
+}
+
+/* sched sets for uplink */
+const struct tdma_sched_item rach_sched_set_ul[] = {
+	SCHED_ITEM_DT(l1s_tx_rach_cmd, 3, 1, 0),	SCHED_END_FRAME(),
+							SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_tx_rach_resp, -4, 1, 0),		SCHED_END_FRAME(),
+	SCHED_END_SET()
+};
+
+/* Asynchronous completion handler for FB detection */
+static void l1a_rach_compl(__unused enum l1_compl c)
+{
+	struct msgb *msg;
+
+	msg = l1_create_l2_msg(L1CTL_RACH_CONF, last_rach.fn, 0,
+				last_rach.band_arfcn);
+	l1_queue_for_l2(msg);
+}
+
+static uint8_t t3_to_rach_comb[51] = {
+	 0,  0,  0,  0,
+	 0,  1,
+	 2,  2,  2,  2,  2,  2,  2,  2,
+	 2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12,
+	13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24,
+	25, 25, 25, 25, 25, 25, 25, 25,
+	25, 26,
+	27, 27, 27, 27};
+static uint8_t rach_to_t3_comb[27] = {
+	 4,  5,
+	14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24,
+	25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36,
+	45, 46};
+
+/* request a RACH request at the next multiframe T3 = fn51 */
+void l1a_rach_req(uint16_t offset, uint8_t combined, uint8_t ra)
+{
+	uint32_t fn_sched;
+	unsigned long flags;
+
+	offset += 3;
+
+	local_firq_save(flags);
+	if (combined) {
+		/* add elapsed RACH slots to offset */
+		offset += t3_to_rach_comb[l1s.current_time.t3];
+		/* offset is the number of RACH slots in the future */
+		fn_sched = l1s.current_time.fn - l1s.current_time.t3;
+		fn_sched += offset / 27 * 51;
+		fn_sched += rach_to_t3_comb[offset % 27];
+	} else
+		fn_sched = l1s.current_time.fn + offset;
+	l1s.rach.ra = ra;
+	sched_gsmtime(rach_sched_set_ul, fn_sched, 0);
+	local_irq_restore(flags);
+
+	memset(&last_rach, 0, sizeof(last_rach));
+}
+
+static __attribute__ ((constructor)) void prim_rach_init(void)
+{
+	l1s.completion[L1_COMPL_RACH] = &l1a_rach_compl;
+}
diff --git a/src/target/firmware/layer1/prim_rx_nb.c b/src/target/firmware/layer1/prim_rx_nb.c
new file mode 100644
index 00000000..38c7b53b
--- /dev/null
+++ b/src/target/firmware/layer1/prim_rx_nb.c
@@ -0,0 +1,220 @@
+/* Layer 1 - Receiving Normal Bursts */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <defines.h>
+#include <debug.h>
+#include <memory.h>
+#include <byteorder.h>
+#include <rffe.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/msgb.h>
+#include <calypso/dsp_api.h>
+#include <calypso/irq.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/timer.h>
+#include <comm/sercomm.h>
+
+#include <layer1/sync.h>
+#include <layer1/afc.h>
+#include <layer1/toa.h>
+#include <layer1/tdma_sched.h>
+#include <layer1/mframe_sched.h>
+#include <layer1/tpu_window.h>
+#include <layer1/l23_api.h>
+#include <layer1/rfch.h>
+#include <layer1/prim.h>
+#include <layer1/agc.h>
+
+#include <l1ctl_proto.h>
+
+struct l1s_rxnb_state {
+	struct l1s_meas_hdr meas[4];
+
+	struct msgb *msg;
+	struct l1ctl_info_dl *dl;
+	struct l1ctl_data_ind *di;
+};
+
+static struct l1s_rxnb_state rxnb;
+
+static int l1s_nb_resp(__unused uint8_t p1, uint8_t burst_id, uint16_t p3)
+{
+	struct gsm_time rx_time;
+	uint8_t mf_task_id = p3 & 0xff;
+	uint8_t mf_task_flags = p3 >> 8;
+	uint16_t rf_arfcn;
+	uint8_t tsc, tn;
+
+	putchart('n');
+
+	/* just for debugging, d_task_d should not be 0 */
+	if (dsp_api.db_r->d_task_d == 0) {
+		puts("EMPTY\n");
+		return 0;
+	}
+
+	/* DSP burst ID needs to correspond with what we expect */
+	if (dsp_api.db_r->d_burst_d != burst_id) {
+		printf("BURST ID %u!=%u\n", dsp_api.db_r->d_burst_d, burst_id);
+		return 0;
+	}
+
+	/* get radio parameters for _this_ burst */
+	gsm_fn2gsmtime(&rx_time, l1s.current_time.fn - 1);
+	rfch_get_params(&rx_time, &rf_arfcn, &tsc, &tn);
+
+	/* collect measurements */
+	rxnb.meas[burst_id].toa_qbit = dsp_api.db_r->a_serv_demod[D_TOA];
+	rxnb.meas[burst_id].pm_dbm8 =
+		agc_inp_dbm8_by_pm(dsp_api.db_r->a_serv_demod[D_PM] >> 3);
+	rxnb.meas[burst_id].freq_err =
+			ANGLE_TO_FREQ(dsp_api.db_r->a_serv_demod[D_ANGLE]);
+	rxnb.meas[burst_id].snr = dsp_api.db_r->a_serv_demod[D_SNR];
+
+	/* feed computed frequency error into AFC loop */
+	if (rxnb.meas[burst_id].snr > AFC_SNR_THRESHOLD)
+		afc_input(rxnb.meas[burst_id].freq_err, rf_arfcn, 1);
+	else
+		afc_input(rxnb.meas[burst_id].freq_err, rf_arfcn, 0);
+
+	/* feed computed TOA into TA loop */
+	toa_input(rxnb.meas[burst_id].toa_qbit << 2, rxnb.meas[burst_id].snr);
+
+	/* Tell the RF frontend to set the gain appropriately */
+	rffe_compute_gain(rxnb.meas[burst_id].pm_dbm8/8, CAL_DSP_TGT_BB_LVL);
+
+	/* 4th burst, get frame data */
+	if (dsp_api.db_r->d_burst_d == 3) {
+		uint8_t i;
+		uint16_t num_biterr;
+		uint32_t avg_snr = 0;
+		int32_t avg_dbm8 = 0;
+
+		/* Get radio parameters for the first burst */
+		gsm_fn2gsmtime(&rx_time, l1s.current_time.fn - 4);
+		rfch_get_params(&rx_time, &rf_arfcn, &tsc, &tn);
+
+		/* Set Channel Number depending on MFrame Task ID */
+		rxnb.dl->chan_nr = mframe_task2chan_nr(mf_task_id, tn);
+
+		/* Set SACCH indication in Link IDentifier */
+		if (mf_task_flags & MF_F_SACCH)
+			rxnb.dl->link_id = 0x40;
+		else
+			rxnb.dl->link_id = 0x00;
+
+		rxnb.dl->band_arfcn = htons(rf_arfcn);
+
+		rxnb.dl->frame_nr = htonl(rx_time.fn);
+
+		/* compute average snr and rx level */
+		for (i = 0; i < 4; ++i) {
+			avg_snr += rxnb.meas[i].snr;
+			avg_dbm8 += rxnb.meas[i].pm_dbm8;
+		}
+		rxnb.dl->snr = avg_snr / 4;
+		rxnb.dl->rx_level = dbm2rxlev(avg_dbm8 / (8*4));
+
+		num_biterr = dsp_api.ndb->a_cd[2] & 0xffff;
+		if (num_biterr > 0xff)
+			rxnb.dl->num_biterr = 0xff;
+		else
+			rxnb.dl->num_biterr = num_biterr;
+
+		rxnb.dl->fire_crc = ((dsp_api.ndb->a_cd[0] & 0xffff) & ((1 << B_FIRE1) | (1 << B_FIRE0))) >> B_FIRE0;
+
+		/* update rx level for pm report */
+		pu_update_rx_level(rxnb.dl->rx_level);
+
+		/* copy actual data, skipping the information block [0,1,2] */
+		dsp_memcpy_from_api(rxnb.di->data, &dsp_api.ndb->a_cd[3], 23, 0);
+
+		l1_queue_for_l2(rxnb.msg);
+		rxnb.msg = NULL; rxnb.dl = NULL; rxnb.di = NULL;
+
+		/* clear downlink task */
+		dsp_api.db_w->d_task_d = 0;
+	}
+
+	/* mark READ page as being used */
+	dsp_api.r_page_used = 1;
+
+	return 0;
+}
+
+static int l1s_nb_cmd(__unused uint8_t p1, uint8_t burst_id,
+		      __unused uint16_t p3)
+{
+	uint16_t arfcn;
+	uint8_t tsc, tn;
+
+	putchart('N');
+
+	if (burst_id == 1) {
+		/* allocate message only at 2nd burst in case of
+		 * consecutive/overlapping normal burst RX tasks */
+		/* FIXME: we actually want all allocation out of L1S! */
+		if (rxnb.msg) {
+			/* Can happen when resetting ... */
+			printf("nb_cmd(0) and rxnb.msg != NULL\n");
+			msgb_free(rxnb.msg);
+		}
+		/* allocate msgb as needed. FIXME: from L1A ?? */
+		rxnb.msg = l1ctl_msgb_alloc(L1CTL_DATA_IND);
+		if (!rxnb.msg)
+			printf("nb_cmd(0): unable to allocate msgb\n");
+		rxnb.dl = (struct l1ctl_info_dl *) msgb_put(rxnb.msg, sizeof(*rxnb.dl));
+		rxnb.di = (struct l1ctl_data_ind *) msgb_put(rxnb.msg, sizeof(*rxnb.di));
+	}
+
+	rfch_get_params(&l1s.next_time, &arfcn, &tsc, &tn);
+
+	/* DDL_DSP_TASK, four normal bursts */
+	dsp_load_tch_param(&l1s.next_time,
+	                   SIG_ONLY_MODE, SDCCH_4, 0, 0, 0, tn);
+
+	dsp_load_rx_task(
+		dsp_task_iq_swap(ALLC_DSP_TASK, arfcn, 0),
+		burst_id, tsc
+	);
+
+	l1s_rx_win_ctrl(arfcn, L1_RXWIN_NB, 0);
+
+	return 0;
+}
+
+const struct tdma_sched_item nb_sched_set[] = {
+	SCHED_ITEM_DT(l1s_nb_cmd, 0, 0, 0),						SCHED_END_FRAME(),
+	SCHED_ITEM_DT(l1s_nb_cmd, 0, 0, 1),						SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_nb_resp, -4, 0, 0),	SCHED_ITEM_DT(l1s_nb_cmd, 0, 0, 2),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_nb_resp, -4, 0, 1),	SCHED_ITEM_DT(l1s_nb_cmd, 0, 0, 3),	SCHED_END_FRAME(),
+						SCHED_ITEM(l1s_nb_resp, -4, 0, 2),	SCHED_END_FRAME(),
+						SCHED_ITEM(l1s_nb_resp, -4, 0, 3),	SCHED_END_FRAME(),
+	SCHED_END_SET()
+};
diff --git a/src/target/firmware/layer1/prim_tch.c b/src/target/firmware/layer1/prim_tch.c
new file mode 100644
index 00000000..a8036d2f
--- /dev/null
+++ b/src/target/firmware/layer1/prim_tch.c
@@ -0,0 +1,818 @@
+/* Layer 1 - TCH */
+
+/* (C) 2010 by Dieter Spaar <spaar@mirider.augusta.de>
+ * (C) 2010 by Sylvain Munaut <tnt@246tnt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <defines.h>
+#include <debug.h>
+#include <memory.h>
+#include <byteorder.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+#include <osmocom/codec/codec.h>
+#include <osmocom/core/msgb.h>
+#include <calypso/dsp_api.h>
+#include <calypso/irq.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/timer.h>
+#include <comm/sercomm.h>
+
+#include <rffe.h>
+#include <layer1/sync.h>
+#include <layer1/afc.h>
+#include <layer1/agc.h>
+#include <layer1/toa.h>
+#include <layer1/tdma_sched.h>
+#include <layer1/mframe_sched.h>
+#include <layer1/tpu_window.h>
+#include <layer1/l23_api.h>
+#include <layer1/rfch.h>
+#include <layer1/prim.h>
+
+#include <l1ctl_proto.h>
+
+static inline int msb_get_bit(uint8_t *buf, int bn)
+{
+	int pos_byte = bn >> 3;
+	int pos_bit  = 7 - (bn & 7);
+
+	return (buf[pos_byte] >> pos_bit) & 1;
+}
+
+static inline void msb_set_bit(uint8_t *buf, int bn, int bit)
+{
+	int pos_byte = bn >> 3;
+	int pos_bit  = 7 - (bn & 7);
+
+	buf[pos_byte] |=  (bit << pos_bit);
+}
+
+static void tch_fr_bit_magic(uint8_t *frame, int dl)
+{
+	uint8_t fr[33];
+	int i, di, si;
+
+	memset(fr, 0x00, 33);
+
+	if (dl)
+		fr[0] = 0xd0;
+
+	for (i = 0; i < 260; i++) {
+		di = gsm610_bitorder[i];
+		si = (i > 181) ? i + 4 : i;
+
+		if (dl)
+			msb_set_bit(fr, 4 + di, msb_get_bit(frame, si));
+		else
+			msb_set_bit(fr, si, msb_get_bit(frame, 4 + di));
+	}
+
+	memcpy(frame, fr, 33);
+}
+
+/* This computes various parameters both for the DSP and for
+ * our logic. Not all are used all the time, but it's easier
+ * to build all in one place */
+static void tch_get_params(struct gsm_time *time, uint8_t chan_nr,
+                           uint32_t *fn_report, uint8_t *tch_f_hn,
+                           uint8_t *tch_sub, uint8_t *tch_mode)
+{
+	uint8_t tn = chan_nr & 0x07;
+	uint8_t cbits = chan_nr >> 3;
+
+	*tch_f_hn = (cbits & 2) ? 0 : 1;
+
+	if (*tch_f_hn) {
+		*fn_report = (time->fn - (tn * 13) + 104) % 104;
+		*tch_sub = 0;
+	} else {
+		uint8_t chan_sub = cbits & 1;
+		uint8_t tn_report = (tn & ~1) | chan_sub;
+		*fn_report = (time->fn - (tn_report * 13) + 104) % 104;
+		*tch_sub = chan_sub;
+	}
+
+	if (tch_mode) {
+		switch (l1s.tch_mode) {
+		case GSM48_CMODE_SPEECH_V1:
+			*tch_mode = *tch_f_hn ? TCH_FS_MODE : TCH_HS_MODE;
+			break;
+		case GSM48_CMODE_SPEECH_EFR:
+			*tch_mode = *tch_f_hn ? TCH_EFR_MODE : SIG_ONLY_MODE;
+			break;
+		default:
+			*tch_mode = SIG_ONLY_MODE;
+		}
+	}
+}
+
+
+/* -------------------------------------------------------------------------
+ * Shared completion handler
+ * ------------------------------------------------------------------------- */
+
+/*
+ * FIXME We really need a better way to handle completion, where we can
+ *       pass arguments and such ...
+ *
+ *       Right now, we just 'hope' it gets processed before the next one ...
+ */
+
+#define TX_TYPE_SACCH	(1<<0)
+#define TX_TYPE_FACCH	(1<<1)
+#define TX_TYPE_TRAFFIC	(1<<2)
+
+static uint16_t last_tx_tch_fn;
+static uint16_t last_tx_tch_type;
+
+static void l1a_tx_tch_compl(__unused enum l1_compl c)
+{
+	struct msgb *msg;
+
+	if (last_tx_tch_type & (TX_TYPE_SACCH | TX_TYPE_FACCH)) {
+		msg = l1_create_l2_msg(L1CTL_DATA_CONF, last_tx_tch_fn, 0, 0);
+		l1_queue_for_l2(msg);
+	}
+
+	if (last_tx_tch_type & TX_TYPE_TRAFFIC) {
+		msg = l1_create_l2_msg(L1CTL_TRAFFIC_CONF, last_tx_tch_fn, 0, 0);
+		l1_queue_for_l2(msg);
+	}
+
+	last_tx_tch_type = 0;
+}
+
+static __attribute__ ((constructor)) void prim_tch_init(void)
+{
+	l1s.completion[L1_COMPL_TX_TCH]  = &l1a_tx_tch_compl;
+}
+
+
+/* -------------------------------------------------------------------------
+ * TCH: Voice & FACCH
+ * ------------------------------------------------------------------------- */
+
+/*
+ * Voice and FACCH data are spread in various ways depending on a lot of
+ * factors. Trying to handle that with the mframe scheduler is just a mess,
+ * so we schedule it burst by burst and handle the complex logic inside the
+ * primitive task code itself.
+ */
+
+
+#define FACCH_MEAS_HIST	8	/* Up to 8 bursts history */
+struct l1s_rx_tch_state {
+	struct l1s_meas_hdr meas[FACCH_MEAS_HIST];
+};
+
+static struct l1s_rx_tch_state rx_tch;
+
+
+static int l1s_tch_resp(__unused uint8_t p1, __unused uint8_t p2, uint16_t p3)
+{
+	static uint8_t meas_id = 0;
+	uint8_t mf_task_id = p3 & 0xff;
+	struct gsm_time rx_time;
+	uint8_t chan_nr;
+	uint16_t arfcn;
+	uint8_t tsc, tn;
+	uint8_t tch_f_hn, tch_sub;
+	uint32_t fn_report;
+	int facch_rx_now, traffic_rx_now;
+
+	/* Get/compute various parameters */
+	gsm_fn2gsmtime(&rx_time, (l1s.current_time.fn - 1 + GSM_MAX_FN) % GSM_MAX_FN);
+	rfch_get_params(&rx_time, &arfcn, &tsc, &tn);
+	chan_nr = mframe_task2chan_nr(mf_task_id, tn);
+	tch_get_params(&rx_time, chan_nr, &fn_report, &tch_f_hn, &tch_sub, NULL);
+
+	meas_id = (meas_id + 1) % FACCH_MEAS_HIST; /* absolute value doesn't matter */
+
+	/* Collect measurements */
+	rx_tch.meas[meas_id].toa_qbit = dsp_api.db_r->a_serv_demod[D_TOA];
+	rx_tch.meas[meas_id].pm_dbm8 =
+		agc_inp_dbm8_by_pm(dsp_api.db_r->a_serv_demod[D_PM] >> 3);
+	rx_tch.meas[meas_id].freq_err =
+		ANGLE_TO_FREQ(dsp_api.db_r->a_serv_demod[D_ANGLE]);
+	rx_tch.meas[meas_id].snr = dsp_api.db_r->a_serv_demod[D_SNR];
+
+	/* feed computed frequency error into AFC loop */
+	if (rx_tch.meas[meas_id].snr > AFC_SNR_THRESHOLD)
+		afc_input(rx_tch.meas[meas_id].freq_err, arfcn, 1);
+	else
+		afc_input(rx_tch.meas[meas_id].freq_err, arfcn, 0);
+
+	/* feed computed TOA into TA loop */
+	toa_input(rx_tch.meas[meas_id].toa_qbit << 2, rx_tch.meas[meas_id].snr);
+
+	/* Tell the RF frontend to set the gain appropriately */
+	rffe_compute_gain(rx_tch.meas[meas_id].pm_dbm8 / 8,
+		CAL_DSP_TGT_BB_LVL);
+
+	/* FACCH Block end ? */
+	if (tch_f_hn) {
+		/* FACCH/F: B0(0...7),B1(4...11),B2(8...11,0...3) (mod 13) */
+		facch_rx_now = ((rx_time.fn % 13) % 4) == 3;
+	} else {
+		/* FAACH/H: See GSM 05.02 Clause 7 Table 1of9 */
+		uint8_t t2_norm = rx_time.t2 - tch_sub;
+		facch_rx_now = (t2_norm == 15) ||
+		               (t2_norm == 23) ||
+		               (t2_norm ==  6);
+	}
+
+	if (facch_rx_now && (dsp_api.ndb->a_fd[0] & (1<<B_BLUD))) {
+		struct msgb *msg;
+		struct l1ctl_info_dl *dl;
+		struct l1ctl_data_ind *di;
+		uint16_t num_biterr;
+		uint32_t avg_snr = 0;
+		int32_t avg_dbm8 = 0;
+		int i, n;
+
+		/* Allocate msgb */
+			/* FIXME: we actually want all allocation out of L1S! */
+		msg = l1ctl_msgb_alloc(L1CTL_DATA_IND);
+		if(!msg) {
+			printf("TCH FACCH: unable to allocate msgb\n");
+			goto skip_rx_facch;
+		}
+
+		dl = (struct l1ctl_info_dl *) msgb_put(msg, sizeof(*dl));
+		di = (struct l1ctl_data_ind *) msgb_put(msg, sizeof(*di));
+
+		/* Fill DL header (should be about the first burst ... here is the last) */
+		dl->chan_nr = chan_nr;
+		dl->link_id = 0x00;	/* FACCH */
+		dl->band_arfcn = htons(arfcn);
+		dl->frame_nr = htonl(rx_time.fn);
+
+		/* Average SNR & RX level */
+		n = tch_f_hn ? 8 : 6;
+		for (i=0; i<n; i++) {
+			int j = (meas_id + FACCH_MEAS_HIST - i) % FACCH_MEAS_HIST;
+			avg_snr += rx_tch.meas[j].snr;
+			avg_dbm8 += rx_tch.meas[j].pm_dbm8;
+		}
+
+		dl->snr = avg_snr / n;
+		dl->rx_level = dbm2rxlev(avg_dbm8 / (8*n));
+
+		/* Errors & CRC status */
+		num_biterr = dsp_api.ndb->a_fd[2] & 0xffff;
+		if (num_biterr > 0xff)
+			dl->num_biterr = 0xff;
+		else
+			dl->num_biterr = num_biterr;
+
+		dl->fire_crc = ((dsp_api.ndb->a_fd[0] & 0xffff) & ((1 << B_FIRE1) | (1 << B_FIRE0))) >> B_FIRE0;
+
+		/* Update rx level for pm report */
+		pu_update_rx_level(dl->rx_level);
+
+		/* Copy actual data, skipping the information block [0,1,2] */
+		dsp_memcpy_from_api(di->data, &dsp_api.ndb->a_fd[3], 23, 0);
+
+		/* Give message to up layer */
+		l1_queue_for_l2(msg);
+
+	skip_rx_facch:
+		/* Reset A_FD header (needed by DSP) */
+		/* B_FIRE1 =1, B_FIRE0 =0 , BLUD =0 */
+		dsp_api.ndb->a_fd[0] = (1<<B_FIRE1);
+		dsp_api.ndb->a_fd[2] = 0xffff;
+
+		/* Reset A_DD_0 header in NDB (needed by DSP) */
+		dsp_api.ndb->a_dd_0[0] = 0;
+		dsp_api.ndb->a_dd_0[2] = 0xffff;
+
+		/* Reset A_DD_1 header in NDB (needed by DSP) */
+		dsp_api.ndb->a_dd_1[0] = 0;
+		dsp_api.ndb->a_dd_1[2] = 0xffff;
+	}
+
+	/* Traffic now ? */
+	if (tch_f_hn) {
+		/* TCH/F: B0(0...7),B1(4...11),B2(8...11,0...3) (mod 13)*/
+		traffic_rx_now = ((rx_time.fn % 13) % 4) == 3;
+	} else {
+		/* TCH/H0: B0(0,2,4,6),B1(4,6,8,10),B2(8,10,0,2) (mod 13) */
+		/*     H1: B0(1,3,5,7),B1(5,7,9,11),B2(9,11,1,3) (mod 13) */
+		traffic_rx_now = (((rx_time.fn - tch_sub + 13) % 13) % 4) == 2;
+	}
+
+	if (traffic_rx_now) {
+		volatile uint16_t *traffic_buf;
+
+		traffic_buf = tch_sub ? dsp_api.ndb->a_dd_1 : dsp_api.ndb->a_dd_0;
+
+		if (traffic_buf[0] & (1<<B_BLUD)) {
+			/* Send the data to upper layers (if interested and good frame) */
+			if ((l1s.audio_mode & AUDIO_RX_TRAFFIC_IND) &&
+			    !(dsp_api.ndb->a_dd_0[0] & (1<<B_BFI))) {
+				struct msgb *msg;
+				struct l1ctl_info_dl *dl;
+				struct l1ctl_traffic_ind *ti;
+				uint8_t *payload;
+
+				/* Allocate msgb */
+				/* FIXME: we actually want all allocation out of L1S! */
+				msg = l1ctl_msgb_alloc(L1CTL_TRAFFIC_IND);
+				if(!msg) {
+					printf("TCH traffic: unable to allocate msgb\n");
+					goto skip_rx_traffic;
+				}
+
+				dl = (struct l1ctl_info_dl *) msgb_put(msg, sizeof(*dl));
+				ti = (struct l1ctl_traffic_ind *) msgb_put(msg, sizeof(*ti));
+				payload = (uint8_t *) msgb_put(msg, 33);
+
+				/* Copy actual data, skipping the information block [0,1,2] */
+				dsp_memcpy_from_api(payload, &traffic_buf[3], 33, 1);
+
+				/**
+				 * Perform some bit conversations
+				 * FIXME: what about other (than FR) codecs?
+				 */
+				tch_fr_bit_magic(payload, 1);
+
+				/* Give message to up layer */
+				l1_queue_for_l2(msg);
+			}
+
+	skip_rx_traffic:
+			/* Reset traffic buffer header in NDB (needed by DSP) */
+			traffic_buf[0] = 0;
+			traffic_buf[2] = 0xffff;
+		}
+	}
+
+	/* mark READ page as being used */
+	dsp_api.r_page_used = 1;
+
+	return 0;
+}
+
+static int l1s_tch_cmd(__unused uint8_t p1, __unused uint8_t p2, uint16_t p3)
+{
+	uint8_t mf_task_id = p3 & 0xff;
+	uint8_t chan_nr;
+	uint16_t arfcn;
+	uint8_t tsc, tn;
+	uint8_t tch_f_hn, tch_sub, tch_mode;
+	uint32_t fn_report;
+	uint8_t sync = 0;
+	static int icnt;
+	int facch_tx_now, traffic_tx_now;
+
+	/* Get/compute various parameters */
+	rfch_get_params(&l1s.next_time, &arfcn, &tsc, &tn);
+	chan_nr = mframe_task2chan_nr(mf_task_id, tn);
+	tch_get_params(&l1s.next_time, chan_nr, &fn_report, &tch_f_hn, &tch_sub, &tch_mode);
+
+	/* Sync & FACCH delay */
+	if (l1s.tch_sync) {
+		l1s.tch_sync = 0;
+		sync = 1;
+		icnt = 0;
+	} else if (icnt <= 26)
+		icnt++;
+
+	/* Load FACCH data if we start a new burst */
+	/* (the DSP wants the data on the CMD of the burst _preceding_ the
+	 * first burst) */
+	if (tch_f_hn) {
+		/* FACCH/F: B0(0...7),B1(4...11),B2(8...11,0...3) */
+		facch_tx_now = ((l1s.next_time.fn % 13) % 4) == 3;
+	} else {
+		/* FAACH/H: See GSM 05.02 Clause 7 Table 1of9 */
+		uint8_t t2_norm = l1s.next_time.t2 - tch_sub;
+		facch_tx_now = (t2_norm == 23) ||
+		               (t2_norm ==  6) ||
+		               (t2_norm == 15);
+	}
+
+	if (facch_tx_now) {
+		uint16_t *info_ptr = dsp_api.ndb->a_fu;
+		struct msgb *msg;
+		const uint8_t *data;
+
+		/* Pull FACCH data (if ready) */
+		if (icnt > 26)
+			msg = msgb_dequeue(&l1s.tx_queue[L1S_CHAN_MAIN]);
+		else
+			msg = NULL;
+
+		/* If TX is empty and we're signalling only, use dummy frame */
+		if (msg)
+			data = msg->l3h;
+		else if (tch_mode == SIG_ONLY_MODE)
+			data = pu_get_idle_frame();
+		else
+			data = NULL;
+
+		/* Do we really send something ? */
+		if (data) {
+			/* Fill data block header */
+			info_ptr[0] = (1 << B_BLUD);	/* 1st word: Set B_BLU bit. */
+			info_ptr[1] = 0;		/* 2nd word: cleared. */
+			info_ptr[2] = 0;		/* 3nd word: cleared. */
+
+			/* Copy the actual data after the header */
+			dsp_memcpy_to_api(&info_ptr[3], data, 23, 0);
+		}
+
+		/* Indicate completion (FIXME: early but easier this way for now) */
+		if (msg) {
+			last_tx_tch_fn = l1s.next_time.fn;
+			last_tx_tch_type |= TX_TYPE_FACCH;
+			l1s_compl_sched(L1_COMPL_TX_TCH);
+		}
+
+		/* Free msg now that we're done with it */
+		if (msg)
+			msgb_free(msg);
+	}
+
+	/* Traffic now ? */
+	if (tch_f_hn) {
+		/* TCH/F: B0(0...7),B1(4...11),B2(8...11,0...3) (mod 13)*/
+		traffic_tx_now = ((l1s.next_time.fn % 13) % 4) == 3;
+	} else {
+		/* TCH/H0: B0(0,2,4,6),B1(4,6,8,10),B2(8,10,0,2) (mod 13) */
+		/*     H1: B0(1,3,5,7),B1(5,7,9,11),B2(9,11,1,3) (mod 13) */
+		traffic_tx_now = (((l1s.next_time.fn - tch_sub + 13) % 13) % 4) == 2;
+	}
+
+	if (traffic_tx_now) {
+		volatile uint16_t *traffic_buf;
+		struct msgb *msg;
+		const uint8_t *data;
+
+		/* Reset play mode */
+		dsp_api.ndb->d_tch_mode &= ~B_PLAY_UL;
+
+		/* Check l1s audio mode */
+		if (!(l1s.audio_mode & AUDIO_TX_TRAFFIC_REQ))
+			goto skip_tx_traffic;
+
+		/* Traffic buffer = !tch_sub */
+		traffic_buf = tch_sub ? dsp_api.ndb->a_du_0 : dsp_api.ndb->a_du_1;
+
+		/* Pull Traffic data (if any) */
+		msg = msgb_dequeue(&l1s.tx_queue[L1S_CHAN_TRAFFIC]);
+
+		/**
+		 * Perform some bit conversations
+		 * FIXME: what about other (than FR) codecs?
+		 */
+		if (msg)
+			tch_fr_bit_magic(msg->l2h, 0);
+
+		/* Copy actual data, skipping the information block [0,1,2] */
+		if (msg) {
+			data = msg->l2h;
+			dsp_memcpy_to_api(&traffic_buf[3], data, 33, 1);
+
+			traffic_buf[0] = (1 << B_BLUD);	/* 1st word: Set B_BLU bit. */
+			traffic_buf[1] = 0;		/* 2nd word: cleared. */
+			traffic_buf[2] = 0;		/* 3nd word: cleared. */
+		}
+
+		if (msg)
+			dsp_api.ndb->d_tch_mode |= B_PLAY_UL;
+
+		/* Indicate completion (FIXME: early but easier this way for now) */
+		if (msg) {
+			last_tx_tch_fn = l1s.next_time.fn;
+			last_tx_tch_type |= TX_TYPE_TRAFFIC;
+			l1s_compl_sched(L1_COMPL_TX_TCH);
+		}
+
+		/* Free msg now that we're done with it */
+		if (msg)
+			msgb_free(msg);
+	}
+skip_tx_traffic:
+
+	/* Configure DSP for TX/RX */
+	l1s_tx_apc_helper(arfcn);
+
+	dsp_load_tch_param(
+		&l1s.next_time,
+		tch_mode, tch_f_hn ? TCH_F : TCH_H, tch_sub,
+		0, sync, tn
+	);
+
+	dsp_load_rx_task(
+		dsp_task_iq_swap(TCHT_DSP_TASK, arfcn, 0),
+		0, tsc		/* burst_id unused for TCH */
+	);
+	l1s_rx_win_ctrl(arfcn, L1_RXWIN_NB, 0);
+
+	dsp_load_tx_task(
+		dsp_task_iq_swap(TCHT_DSP_TASK, arfcn, 1),
+		0, tsc		/* burst_id unused for TCH */
+	);
+	l1s_tx_win_ctrl(arfcn | ARFCN_UPLINK, L1_TXWIN_NB, 0, 3);
+
+	return 0;
+}
+
+
+const struct tdma_sched_item tch_sched_set[] = {
+	SCHED_ITEM_DT(l1s_tch_cmd, 0, 0, 0),	SCHED_END_FRAME(),
+						SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_tch_resp, 0, 0, -4),	SCHED_END_FRAME(),
+	SCHED_END_SET()
+};
+
+
+/* -------------------------------------------------------------------------
+ * TCH/H: Dummy
+ * ------------------------------------------------------------------------- */
+
+/* This task is needed to perform some operation in the DSP when there is
+ * no data to be exchanged */
+
+static int l1s_tch_d_resp(__unused uint8_t p1, __unused uint8_t p2, uint16_t p3)
+{
+	/* mark READ page as being used */
+	dsp_api.r_page_used = 1;
+
+	return 0;
+}
+
+static int l1s_tch_d_cmd(__unused uint8_t p1, __unused uint8_t p2, uint16_t p3)
+{
+	uint8_t mf_task_id = p3 & 0xff;
+	uint8_t chan_nr;
+	uint8_t tsc, tn;
+	uint8_t tch_f_hn, tch_sub, tch_mode;
+	uint32_t fn_report;
+
+	/* Get/compute various parameters */
+	rfch_get_params(&l1s.next_time, NULL, &tsc, &tn);
+	chan_nr = mframe_task2chan_nr(mf_task_id, tn);
+	tch_get_params(&l1s.next_time, chan_nr, &fn_report, &tch_f_hn, &tch_sub, &tch_mode);
+
+	/* Configure DSP */
+	dsp_load_tch_param(
+		&l1s.next_time,
+		tch_mode, tch_f_hn ? TCH_F : TCH_H, tch_sub,
+		0, 0, tn
+	);
+
+	dsp_load_rx_task(TCHD_DSP_TASK, 0, tsc); /* burst_id unused for TCH */
+	dsp_load_tx_task(TCHD_DSP_TASK, 0, tsc); /* burst_id unused for TCH */
+
+	return 0;
+}
+
+const struct tdma_sched_item tch_d_sched_set[] = {
+	SCHED_ITEM_DT(l1s_tch_d_cmd, 0, 0, 0),	SCHED_END_FRAME(),
+						SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_tch_d_resp, 0, 0, -4),	SCHED_END_FRAME(),
+	SCHED_END_SET()
+};
+
+
+/* -------------------------------------------------------------------------
+ * TCH: SACCH
+ * ------------------------------------------------------------------------- */
+
+/*
+ * SACCH data are spread over 4 bursts, however they are so far appart that
+ * we can't use the normal scheduler to schedule all them at once in a single
+ * set.
+ * Therefore, the task code itself decides in which burst it is, if it's the
+ * start/end, and act appropriately.
+ */
+
+
+struct l1s_rx_tch_a_state {
+	struct l1s_meas_hdr meas[4];
+
+	struct msgb *msg;
+	struct l1ctl_info_dl *dl;
+	struct l1ctl_data_ind *di;
+};
+
+static struct l1s_rx_tch_a_state rx_tch_a;
+
+
+static int l1s_tch_a_resp(__unused uint8_t p1, __unused uint8_t p2, uint16_t p3)
+{
+	uint8_t mf_task_id = p3 & 0xff;
+	struct gsm_time rx_time;
+	uint8_t chan_nr;
+	uint16_t arfcn;
+	uint8_t tsc, tn;
+	uint8_t tch_f_hn, tch_sub;
+	uint32_t fn_report;
+	uint8_t burst_id;
+
+	/* It may happen we've never gone through cmd(0) yet, skip until then */
+	if (!rx_tch_a.msg)
+		goto skip;
+
+	/* Get/compute various parameters */
+	gsm_fn2gsmtime(&rx_time, (l1s.current_time.fn - 1 + GSM_MAX_FN) % GSM_MAX_FN);
+	rfch_get_params(&rx_time, &arfcn, &tsc, &tn);
+	chan_nr = mframe_task2chan_nr(mf_task_id, tn);
+	tch_get_params(&rx_time, chan_nr, &fn_report, &tch_f_hn, &tch_sub, NULL);
+	burst_id = (fn_report - 12) / 26;
+
+	/* Collect measurements */
+	rx_tch_a.meas[burst_id].toa_qbit = dsp_api.db_r->a_serv_demod[D_TOA];
+	rx_tch_a.meas[burst_id].pm_dbm8 =
+		agc_inp_dbm8_by_pm(dsp_api.db_r->a_serv_demod[D_PM] >> 3);
+	rx_tch_a.meas[burst_id].freq_err =
+		ANGLE_TO_FREQ(dsp_api.db_r->a_serv_demod[D_ANGLE]);
+	rx_tch_a.meas[burst_id].snr = dsp_api.db_r->a_serv_demod[D_SNR];
+
+	/* feed computed frequency error into AFC loop */
+	if (rx_tch_a.meas[burst_id].snr > AFC_SNR_THRESHOLD)
+		afc_input(rx_tch_a.meas[burst_id].freq_err, arfcn, 1);
+	else
+		afc_input(rx_tch_a.meas[burst_id].freq_err, arfcn, 0);
+
+	/* feed computed TOA into TA loop */
+	toa_input(rx_tch_a.meas[burst_id].toa_qbit << 2, rx_tch_a.meas[burst_id].snr);
+
+	/* Tell the RF frontend to set the gain appropriately */
+	rffe_compute_gain(rx_tch_a.meas[burst_id].pm_dbm8 / 8,
+		CAL_DSP_TGT_BB_LVL);
+
+	/* Last burst, read data & send to the up layer */
+	if ((burst_id == 3) && (dsp_api.ndb->a_cd[0] & (1<<B_BLUD))) {
+		unsigned int i;
+		uint16_t num_biterr;
+		uint32_t avg_snr = 0;
+		int32_t avg_dbm8 = 0;
+
+		/* Average SNR & RX level + error & crc status */
+		for (i=0; i<4; i++) {
+			avg_snr += rx_tch_a.meas[i].snr;
+			avg_dbm8 += rx_tch_a.meas[i].pm_dbm8;
+		}
+		rx_tch_a.dl->snr = avg_snr / 4;
+		rx_tch_a.dl->rx_level = dbm2rxlev(avg_dbm8 / (8*4));
+
+		num_biterr = dsp_api.ndb->a_cd[2];
+		if (num_biterr > 0xff)
+			rx_tch_a.dl->num_biterr = 0xff;
+		else
+			rx_tch_a.dl->num_biterr = num_biterr;
+
+		rx_tch_a.dl->fire_crc = ((dsp_api.ndb->a_cd[0] & 0xffff) & ((1 << B_FIRE1) | (1 << B_FIRE0))) >> B_FIRE0;
+
+		/* Update rx level for pm report */
+		pu_update_rx_level(rx_tch_a.dl->rx_level);
+
+		/* Copy actual data, skipping the information block [0,1,2] */
+		dsp_memcpy_from_api(rx_tch_a.di->data, &dsp_api.ndb->a_cd[3], 23, 0);
+
+		/* Give message to up layer */
+		l1_queue_for_l2(rx_tch_a.msg);
+		rx_tch_a.msg = NULL; rx_tch_a.dl = NULL; rx_tch_a.di = NULL;
+
+		/* Reset header */
+		dsp_api.ndb->a_cd[0] = (1<<B_FIRE1);
+		dsp_api.ndb->a_cd[2] = 0xffff;
+	}
+
+skip:
+	/* mark READ page as being used */
+	dsp_api.r_page_used = 1;
+
+	return 0;
+}
+
+static int l1s_tch_a_cmd(__unused uint8_t p1, __unused uint8_t p2, uint16_t p3)
+{
+	uint8_t mf_task_id = p3 & 0xff;
+	uint8_t chan_nr;
+	uint16_t arfcn;
+	uint8_t tsc, tn;
+	uint8_t tch_f_hn, tch_sub, tch_mode;
+	uint32_t fn_report;
+	uint8_t burst_id;
+
+	/* Get/compute various parameters */
+	rfch_get_params(&l1s.next_time, &arfcn, &tsc, &tn);
+	chan_nr = mframe_task2chan_nr(mf_task_id, tn);
+	tch_get_params(&l1s.next_time, chan_nr, &fn_report, &tch_f_hn, &tch_sub, &tch_mode);
+	burst_id = (fn_report - 12) / 26;
+
+	/* Load SACCH data if we start a new burst */
+	if (burst_id == 0) {
+		uint16_t *info_ptr = dsp_api.ndb->a_cu;
+		struct msgb *msg;
+		const uint8_t *data;
+
+		/* If the TX queue is empty, send dummy measurement */
+		msg = msgb_dequeue(&l1s.tx_queue[L1S_CHAN_SACCH]);
+		data = msg ? msg->l3h : pu_get_meas_frame();
+
+		/* Fill data block header */
+		info_ptr[0] = (1 << B_BLUD);	/* 1st word: Set B_BLU bit. */
+		info_ptr[1] = 0;		/* 2nd word: cleared. */
+		info_ptr[2] = 0;		/* 3nd word: cleared. */
+
+		/* Copy the actual data after the header */
+		dsp_memcpy_to_api(&info_ptr[3], data, 23, 0);
+
+		/* Indicate completion (FIXME: early but easier this way for now) */
+		if (msg) {
+			last_tx_tch_fn = l1s.next_time.fn;
+			last_tx_tch_type |= TX_TYPE_SACCH;
+			l1s_compl_sched(L1_COMPL_TX_TCH);
+		}
+
+		/* Free msg now that we're done with it */
+		if (msg)
+			msgb_free(msg);
+	}
+
+	/* Allocate RX burst */
+	if (burst_id == 0) {
+		/* Clear 'dangling' msgb */
+		if (rx_tch_a.msg) {
+			/* Can happen if the task was shutdown in the middle of
+			 * 4 bursts ... */
+			msgb_free(rx_tch_a.msg);
+		}
+
+		/* Allocate burst */
+			/* FIXME: we actually want all allocation out of L1S! */
+		rx_tch_a.msg = l1ctl_msgb_alloc(L1CTL_DATA_IND);
+		if (!rx_tch_a.msg)
+			printf("tch_a_cmd(0): unable to allocate msgb\n");
+
+		rx_tch_a.dl = (struct l1ctl_info_dl *) msgb_put(rx_tch_a.msg, sizeof(*rx_tch_a.dl));
+		rx_tch_a.di = (struct l1ctl_data_ind *) msgb_put(rx_tch_a.msg, sizeof(*rx_tch_a.di));
+
+		/* Pre-fill DL header with some info about burst(0) */
+		rx_tch_a.dl->chan_nr = chan_nr;
+		rx_tch_a.dl->link_id = 0x40;	/* SACCH */
+		rx_tch_a.dl->band_arfcn = htons(arfcn);
+		rx_tch_a.dl->frame_nr = htonl(l1s.next_time.fn);
+	}
+
+	/* Configure DSP for TX/RX */
+	l1s_tx_apc_helper(arfcn);
+
+	dsp_load_tch_param(
+		&l1s.next_time,
+		tch_mode, tch_f_hn ? TCH_F : TCH_H, tch_sub,
+		0, 0, tn
+	);
+
+	dsp_load_rx_task(
+		dsp_task_iq_swap(TCHA_DSP_TASK, arfcn, 0),
+		0, tsc		/* burst_id unused for TCHA */
+	);
+	l1s_rx_win_ctrl(arfcn, L1_RXWIN_NB, 0);
+
+	dsp_load_tx_task(
+		dsp_task_iq_swap(TCHA_DSP_TASK, arfcn, 1),
+		0, tsc		/* burst_id unused for TCHA */
+	);
+	l1s_tx_win_ctrl(arfcn | ARFCN_UPLINK, L1_TXWIN_NB, 0, 3);
+
+	return 0;
+}
+
+
+const struct tdma_sched_item tch_a_sched_set[] = {
+	SCHED_ITEM_DT(l1s_tch_a_cmd, 0, 0, 0),	SCHED_END_FRAME(),
+						SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_tch_a_resp, 0, 0, -4),	SCHED_END_FRAME(),
+	SCHED_END_SET()
+};
diff --git a/src/target/firmware/layer1/prim_tx_nb.c b/src/target/firmware/layer1/prim_tx_nb.c
new file mode 100644
index 00000000..86e8224c
--- /dev/null
+++ b/src/target/firmware/layer1/prim_tx_nb.c
@@ -0,0 +1,175 @@
+/* Layer 1 - Transmit Normal Burst */
+
+/* (C) 2010 by Dieter Spaar <spaar@mirider.augusta.de>
+ * (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <defines.h>
+#include <debug.h>
+#include <memory.h>
+#include <byteorder.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/msgb.h>
+#include <calypso/dsp_api.h>
+#include <calypso/irq.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/timer.h>
+#include <comm/sercomm.h>
+
+#include <layer1/sync.h>
+#include <layer1/agc.h>
+#include <layer1/tdma_sched.h>
+#include <layer1/mframe_sched.h>
+#include <layer1/tpu_window.h>
+#include <layer1/l23_api.h>
+#include <layer1/rfch.h>
+#include <layer1/prim.h>
+
+#include <l1ctl_proto.h>
+
+
+static uint32_t last_txnb_fn;
+
+/* p1: type of operation (0: one NB, 1: one RACH burst, 2: four NB) */
+static int l1s_tx_resp(__unused uint8_t p1, __unused uint8_t burst_id,
+		       __unused uint16_t p3)
+{
+	putchart('t');
+
+	dsp_api.r_page_used = 1;
+
+	if (burst_id == 3) {
+		last_txnb_fn = l1s.current_time.fn - 4;
+		l1s_compl_sched(L1_COMPL_TX_NB);
+	}
+
+	return 0;
+}
+
+/* p1: type of operation (0: one NB, 1: one RACH burst, 2: four NB) */
+static int l1s_tx_cmd(uint8_t p1, uint8_t burst_id, uint16_t p3)
+{
+	uint16_t arfcn;
+	uint8_t tsc, tn;
+	uint8_t mf_task_flags = p3 >> 8;
+
+	putchart('T');
+
+	/* before sending first of the four bursts, copy data to API ram */
+	if (burst_id == 0) {
+		uint16_t *info_ptr = dsp_api.ndb->a_cu;
+		struct msgb *msg;
+		const uint8_t *data;
+
+		/* distinguish between DCCH and ACCH */
+		if (mf_task_flags & MF_F_SACCH) {
+			msg = msgb_dequeue(&l1s.tx_queue[L1S_CHAN_SACCH]);
+			data = msg ? msg->l3h : pu_get_meas_frame();
+		} else {
+			msg = msgb_dequeue(&l1s.tx_queue[L1S_CHAN_MAIN]);
+			data = msg ? msg->l3h : pu_get_idle_frame();
+		}
+
+		/* Fill data block Header */
+		info_ptr[0] = (1 << B_BLUD);     // 1st word: Set B_BLU bit.
+		info_ptr[1] = 0;                 // 2nd word: cleared.
+		info_ptr[2] = 0;                 // 3rd word: cleared.
+
+		/* Copy the actual data after the header */
+		dsp_memcpy_to_api(&info_ptr[3], data, 23, 0);
+
+		if (msg)
+			msgb_free(msg);
+	}
+
+	rfch_get_params(&l1s.next_time, &arfcn, &tsc, &tn);
+
+	l1s_tx_apc_helper(arfcn);
+
+	if (p1 == 0)
+		/* DUL_DSP_TASK, one normal burst */
+		dsp_load_tch_param(&l1s.next_time,
+		                   SIG_ONLY_MODE, INVALID_CHANNEL, 0, 0, 0, tn);
+
+	else if (p1 == 2)
+		/* DUL_DSP_TASK, four normal bursts */
+		dsp_load_tch_param(&l1s.next_time,
+		                   SIG_ONLY_MODE, SDCCH_4, 0, 0, 0, tn);
+
+	dsp_load_tx_task(
+		dsp_task_iq_swap(DUL_DSP_TASK, arfcn, 1),
+		burst_id, tsc
+	);
+
+	l1s_tx_win_ctrl(arfcn | ARFCN_UPLINK, L1_TXWIN_NB, 0, 3);
+
+	return 0;
+}
+
+/* Asynchronous completion handler for NB transmit */
+static void l1a_tx_nb_compl(__unused enum l1_compl c)
+{
+	struct msgb *msg;
+
+	msg = l1_create_l2_msg(L1CTL_DATA_CONF, last_txnb_fn, 0, 0);
+	l1_queue_for_l2(msg);
+}
+
+void l1s_tx_test(uint8_t base_fn, uint8_t type)
+{
+	printf("Starting TX %d\n", type);
+
+	if (type == 0) {// one normal burst
+		tdma_schedule(base_fn, &l1s_tx_cmd, 0, 0, 0, 3);
+		tdma_schedule(base_fn + 2, &l1s_tx_resp, 0, 0, 0, 3);
+	} else if (type == 2) { // four normal bursts
+		tdma_schedule(base_fn, &l1s_tx_cmd, 2, 0, 0, 3);
+		tdma_schedule(base_fn + 1, &l1s_tx_cmd, 2, 1, 0, 3);
+		tdma_schedule(base_fn + 2, &l1s_tx_resp, 2, 0, 0, 3);
+		tdma_schedule(base_fn + 2, &l1s_tx_cmd, 2, 2, 0, 3);
+		tdma_schedule(base_fn + 3, &l1s_tx_resp, 2, 1, 0, 3);
+		tdma_schedule(base_fn + 3, &l1s_tx_cmd, 2, 3, 0, 3);
+		tdma_schedule(base_fn + 4, &l1s_tx_resp, 2, 2, 0, 3);
+		tdma_schedule(base_fn + 5, &l1s_tx_resp, 2, 3, 0, 3);
+	}
+}
+
+/* sched sets for uplink */
+const struct tdma_sched_item nb_sched_set_ul[] = {
+	SCHED_ITEM_DT(l1s_tx_cmd, 3, 2, 0),						SCHED_END_FRAME(),
+	SCHED_ITEM_DT(l1s_tx_cmd, 3, 2, 1),						SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_tx_resp, -4, 2, 0),	SCHED_ITEM_DT(l1s_tx_cmd, 3, 2, 2),	SCHED_END_FRAME(),
+	SCHED_ITEM(l1s_tx_resp, -4, 2, 1),	SCHED_ITEM_DT(l1s_tx_cmd, 3, 2, 3),	SCHED_END_FRAME(),
+						SCHED_ITEM(l1s_tx_resp, -4, 2, 2),	SCHED_END_FRAME(),
+						SCHED_ITEM(l1s_tx_resp, -4, 2, 3),	SCHED_END_FRAME(),
+	SCHED_END_SET()
+};
+
+static __attribute__ ((constructor)) void prim_tx_nb_init(void)
+{
+	l1s.completion[L1_COMPL_TX_NB] = &l1a_tx_nb_compl;
+}
diff --git a/src/target/firmware/layer1/prim_utils.c b/src/target/firmware/layer1/prim_utils.c
new file mode 100644
index 00000000..c85da717
--- /dev/null
+++ b/src/target/firmware/layer1/prim_utils.c
@@ -0,0 +1,74 @@
+/* Layer 1 Various primitive utilities */
+
+/* (C) 2010 by Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+#include <osmocom/core/msgb.h>
+#include <layer1/sync.h>
+
+
+static const uint8_t ubUui[23] = {
+	/* dummy lapdm header */
+	0x01, 0x03, 0x01,
+
+	/* fill bytes */
+	0x2b, 0x2b, 0x2b, 0x2b, 0x2b, 0x2b, 0x2b, 0x2b,
+	0x2b, 0x2b, 0x2b, 0x2b, 0x2b, 0x2b, 0x2b, 0x2b,
+	0x2b, 0x2b, 0x2b, 0x2b
+};
+
+static uint8_t ubMeas[23] = {
+	/* L1 SAACH pseudo-header */
+	0x0f, 0x00,
+
+	/* lapdm header */
+	0x01, 0x03, 0x49,
+
+	/* Measurement report */
+	0x06, 0x15, 0x36, 0x36, 0x01, 0xC0, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00
+};
+
+
+const uint8_t *pu_get_idle_frame(void)
+{
+	return ubUui;
+}
+
+void pu_update_rx_level(uint8_t rx_level)
+{
+	ubMeas[7] = ubMeas[8] = rx_level;
+}
+
+const uint8_t *pu_get_meas_frame(void)
+{
+	if (l1s.tx_meas) {
+		return l1s.tx_meas->l3h;
+	} else {
+		/* Update L1 SAACH pseudo-header */
+		ubMeas[0] = l1s.tx_power;
+		ubMeas[1] = l1s.ta;
+
+		return ubMeas;
+	}
+}
diff --git a/src/target/firmware/layer1/rfch.c b/src/target/firmware/layer1/rfch.c
new file mode 100644
index 00000000..d0818d04
--- /dev/null
+++ b/src/target/firmware/layer1/rfch.c
@@ -0,0 +1,152 @@
+/* RF Channel utilities */
+
+/* (C) 2010 by Sylvain Munaut <tnt@246tNt.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <layer1/sync.h>
+
+
+/*
+ * Hopping sequence generation
+ *
+ * The algorithm is explained in GSM 05.02 Section 6.2.3
+ *
+ *	if HSN = 0 (cyclic hopping) then:
+ *		MAI, integer (0 .. N-1) :
+ *			MAI = (FN + MAIO) modulo N
+ *
+ *	else:
+ *		M, integer (0 .. 152) :
+ *			M = T2 + RNTABLE((HSN xor T1R) + T3)
+ *
+ *		S, integer (0 .. N-1) :
+ *			M' = M modulo (2 ^ NBIN)
+ *			T' = T3 modulo (2 ^ NBIN)
+ *
+ *			if M' < N then:
+ *				S = M'
+ *			else:
+ *				S = (M'+T') modulo N
+ *
+ *		MAI, integer (0 .. N-1) :
+ *			MAI = (S + MAIO) modulo N
+ */
+
+static uint8_t rn_table[114] = {
+	 48,  98,  63,   1,  36,  95,  78, 102,  94,  73,
+	  0,  64,  25,  81,  76,  59, 124,  23, 104, 100,
+	101,  47, 118,  85,  18,  56,  96,  86,  54,   2,
+	 80,  34, 127,  13,   6,  89,  57, 103,  12,  74,
+	 55, 111,  75,  38, 109,  71, 112,  29,  11,  88,
+	 87,  19,   3,  68, 110,  26,  33,  31,   8,  45,
+	 82,  58,  40, 107,  32,   5, 106,  92,  62,  67,
+	 77, 108, 122,  37,  60,  66, 121,  42,  51, 126,
+	117, 114,   4,  90,  43,  52,  53, 113, 120,  72,
+	 16,  49,   7,  79, 119,  61,  22,  84,   9,  97,
+	 91,  15,  21,  24,  46,  39,  93, 105,  65,  70,
+	125,  99,  17, 123,
+};
+
+
+static int pow_nbin_mask(int n)
+{
+	int x;
+	x =	(n     ) |
+		(n >> 1) |
+		(n >> 2) |
+		(n >> 3) |
+		(n >> 4) |
+		(n >> 5) |
+		(n >> 6);
+	return x;
+}
+
+static int16_t rfch_hop_seq_gen(struct gsm_time *t,
+                                uint8_t hsn, uint8_t maio,
+                                uint8_t n, uint16_t *arfcn_tbl)
+{
+	int mai;
+
+	if (!hsn) {
+		/* cyclic hopping */
+		mai = (t->fn + maio) % n;
+	} else {
+		/* pseudo random hopping */
+		int m, mp, tp, s, pnm;
+
+		pnm = pow_nbin_mask(n);
+
+		m = t->t2 + rn_table[(hsn ^ (t->t1 & 63)) + t->t3];
+		mp = m & pnm;
+
+		if (mp < n)
+			s = mp;
+		else {
+			tp = t->t3 & pnm;
+			s = (mp + tp) % n;
+		}
+
+		mai = (s + maio) % n;
+	}
+
+	return arfcn_tbl ? arfcn_tbl[mai] : mai;
+}
+
+
+/* RF Channel parameters */
+void rfch_get_params(struct gsm_time *t,
+                     uint16_t *arfcn_p, uint8_t *tsc_p, uint8_t *tn_p)
+{
+	if (l1s.dedicated.type == GSM_DCHAN_NONE) {
+		/* Serving cell only */
+		if (arfcn_p)
+			*arfcn_p = l1s.serving_cell.arfcn;
+
+		if (tsc_p)
+			*tsc_p = l1s.serving_cell.bsic & 0x7;
+
+		if (tn_p)
+			*tn_p = 0;
+	} else {
+		/* Dedicated channel */
+		if (arfcn_p) {
+			if (l1s.dedicated.h) {
+				*arfcn_p = rfch_hop_seq_gen(t,
+						l1s.dedicated.h1.hsn,
+						l1s.dedicated.h1.maio,
+						l1s.dedicated.h1.n,
+						l1s.dedicated.h1.ma);
+			} else {
+				*arfcn_p = l1s.dedicated.h0.arfcn;
+			}
+		}
+
+		if (tsc_p)
+			*tsc_p = l1s.dedicated.tsc;
+
+		if (tn_p)
+			*tn_p = l1s.dedicated.tn;
+	}
+}
+
diff --git a/src/target/firmware/layer1/sched_gsmtime.c b/src/target/firmware/layer1/sched_gsmtime.c
new file mode 100644
index 00000000..01e22ca3
--- /dev/null
+++ b/src/target/firmware/layer1/sched_gsmtime.c
@@ -0,0 +1,119 @@
+/* GSM-Time One-shot Event Scheduler Implementation (on top of TDMA sched) */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <errno.h>
+
+#include <debug.h>
+#include <osmocom/core/linuxlist.h>
+
+#include <layer1/tdma_sched.h>
+#include <layer1/sched_gsmtime.h>
+
+static struct sched_gsmtime_event sched_gsmtime_events[16];
+static LLIST_HEAD(active_evts);
+static LLIST_HEAD(inactive_evts);
+
+/* Scheduling of a tdma_sched_item list one-shot at a given GSM time */
+int sched_gsmtime(const struct tdma_sched_item *si, uint32_t fn, uint16_t p3)
+{
+	struct llist_head *lh;
+	struct sched_gsmtime_event *evt, *cur;
+
+	printd("sched_gsmtime(si=%p, fn=%u)\n", si, fn);
+
+	/* obtain a free/inactive event structure */
+	if (llist_empty(&inactive_evts))
+		return -EBUSY;
+	lh = inactive_evts.next;
+	llist_del(lh);
+	evt = llist_entry(lh, struct sched_gsmtime_event, list);
+
+	evt->fn = fn;
+	evt->si = si;
+	evt->p3 = p3;
+
+	/* do a sorted insert into the list, i.e. insert the new
+	 * event _before_ the first entry that has a higher fn */
+	llist_for_each_entry(cur, &active_evts, list) {
+		if (cur->fn > evt->fn) {
+			llist_add_tail(lh, &cur->list);
+			return 0;
+		}
+	}
+
+	/* if we reach here, active_evts is empty _OR_ new event
+	 * is after all the other events: append at end of list */
+	llist_add_tail(lh, &active_evts);
+
+	return 0;
+}
+
+/* how many TDMA frame ticks should we schedule events ahead? */
+#define SCHEDULE_AHEAD	2
+
+/* how long do we need to tell the DSP in advance what we want to do? */
+#define SCHEDULE_LATENCY	1
+
+/* execute all GSMTIME one-shot events pending for 'fn' */
+int sched_gsmtime_execute(uint32_t fn)
+{
+	struct sched_gsmtime_event *evt, *evt2;
+	int num = 0;
+
+	llist_for_each_entry_safe(evt, evt2, &active_evts, list) {
+		if (evt->fn == fn + SCHEDULE_AHEAD) {
+			printd("sched_gsmtime_execute(time=%u): fn=%u si=%p\n", fn, evt->fn, evt->si);
+			tdma_schedule_set(SCHEDULE_AHEAD-SCHEDULE_LATENCY,
+					  evt->si, evt->p3);
+			llist_del(&evt->list);
+			/* put event back in list of inactive (free) events */
+			llist_add(&evt->list, &inactive_evts);
+			num++;
+		} if (evt->fn > fn + SCHEDULE_AHEAD) {
+			/* break the loop as our list is ordered */
+			break;
+		}
+	}
+	return num;
+}
+
+void sched_gsmtime_init(void)
+{
+	unsigned int i;
+
+	printd("sched_gsmtime_init()\n");
+
+	for (i = 0; i < ARRAY_SIZE(sched_gsmtime_events); i++)
+		llist_add(&sched_gsmtime_events[i].list, &inactive_evts);
+}
+
+void sched_gsmtime_reset(void)
+{
+	struct sched_gsmtime_event *evt, *evt2;
+
+	llist_for_each_entry_safe(evt, evt2, &active_evts, list) {
+		llist_del(&evt->list);
+		/* put event back in list of inactive (free) events */
+		llist_add(&evt->list, &inactive_evts);
+	}
+}
diff --git a/src/target/firmware/layer1/sync.c b/src/target/firmware/layer1/sync.c
new file mode 100644
index 00000000..36f42975
--- /dev/null
+++ b/src/target/firmware/layer1/sync.c
@@ -0,0 +1,402 @@
+/* Synchronous part of GSM Layer 1 */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Dieter Spaar <spaar@mirider.augusta.de>
+ * (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <defines.h>
+#include <debug.h>
+#include <memory.h>
+#include <byteorder.h>
+#include <asm/system.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/core/msgb.h>
+#include <calypso/dsp_api.h>
+#include <calypso/irq.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <calypso/dsp.h>
+#include <calypso/timer.h>
+#include <comm/sercomm.h>
+
+#include <abb/twl3025.h>
+
+//#define DEBUG_EVERY_TDMA
+
+#include <layer1/sync.h>
+#include <layer1/afc.h>
+#include <layer1/agc.h>
+#include <layer1/apc.h>
+#include <layer1/tdma_sched.h>
+#include <layer1/mframe_sched.h>
+#include <layer1/sched_gsmtime.h>
+#include <layer1/tpu_window.h>
+#include <layer1/l23_api.h>
+
+#include <l1ctl_proto.h>
+
+struct l1s_state l1s;
+
+void l1s_time_inc(struct gsm_time *time, uint32_t delta_fn)
+{
+	ADD_MODULO(time->fn, delta_fn, GSM_MAX_FN);
+
+	if (delta_fn == 1) {
+		ADD_MODULO(time->t2, 1, 26);
+		ADD_MODULO(time->t3, 1, 51);
+
+		/* if the new frame number is a multiple of 51 */
+		if (time->t3 == 0) {
+			ADD_MODULO(time->tc, 1, 8);
+
+			/* if new FN is multiple of 51 and 26 */
+			if (time->t2 == 0)
+				ADD_MODULO(time->t1, 1, 2048);
+		}
+	} else
+		gsm_fn2gsmtime(time, time->fn);
+}
+
+void l1s_time_dump(const struct gsm_time *time)
+{
+	printf("fn=%lu(%u/%2u/%2u)", time->fn, time->t1, time->t2, time->t3);
+}
+
+/* clip a signed 16bit value at a certain limit */
+int16_t clip_int16(int16_t angle, int16_t clip_at)
+{
+	if (angle > clip_at)
+		angle = clip_at;
+	else if (angle < -clip_at)
+		angle = -clip_at;
+
+	return angle;
+}
+
+int16_t l1s_snr_int(uint16_t snr)
+{
+	return snr >> 10;
+}
+
+uint16_t l1s_snr_fract(uint16_t snr)
+{
+	uint32_t fract = snr & 0x3ff;
+	fract = fract * 1000 / (2 << 10);
+
+	return fract & 0xffff;
+}
+
+#define AFC_MAX_ANGLE		328	/* 0.01 radian in fx1.15 */
+
+/* synchronize the L1S to a new timebase (typically a new cell */
+void synchronize_tdma(struct l1_cell_info *cinfo)
+{
+	int32_t fn_offset;
+	uint32_t tpu_shift = cinfo->time_alignment;
+
+	/* NB detection only works if the TOA of the SB
+	 * is within 0...8. We have to add 75 to get an SB TOA of 4. */
+	tpu_shift += 75;
+
+	tpu_shift = (l1s.tpu_offset + tpu_shift) % QBITS_PER_TDMA;
+
+	fn_offset = cinfo->fn_offset - 1;
+
+	/* if we're already very close to the end of the TPU frame, the
+	 * next interrupt will basically occur now and we need to
+	 * compensate */
+	if (tpu_shift < SWITCH_TIME)
+		fn_offset++;
+
+#if 0 /* probably wrong as we already added "offset" and "shift" above */
+	/* increment the TPU quarter-bit offset */
+	l1s.tpu_offset = (l1s.tpu_offset + tpu_shift) % TPU_RANGE;
+#else
+	l1s.tpu_offset = tpu_shift;
+#endif
+
+	puts("Synchronize_TDMA\n");
+	/* request the TPU to adjust the SYNCHRO and OFFSET registers */
+	tpu_enq_at(SWITCH_TIME);
+	tpu_enq_sync(l1s.tpu_offset);
+#if 0
+	/* FIXME: properly end the TPU window at the emd of l1_sync() */
+	tpu_end_scenario();
+#endif
+
+	/* Change the current time to reflect the new value */
+	l1s_time_inc(&l1s.current_time, fn_offset);
+	l1s.next_time = l1s.current_time;
+	l1s_time_inc(&l1s.next_time, 1);
+
+	/* The serving cell now no longer has a frame or bit offset */
+	cinfo->fn_offset = 0;
+	cinfo->time_alignment = 0;
+}
+
+void l1s_reset_hw(void)
+{
+	dsp_api.w_page = 0;
+	dsp_api.r_page = 0;
+	dsp_api.r_page_used = 0;
+	dsp_api.db_w = (T_DB_MCU_TO_DSP *) BASE_API_W_PAGE_0;
+	dsp_api.db_r = (T_DB_DSP_TO_MCU *) BASE_API_R_PAGE_0;
+	dsp_api.ndb->d_dsp_page = 0;
+
+	/* we have to really reset the TPU, otherwise FB detection
+	 * somtimes returns wrong TOA values. */
+	tpu_reset(1);
+	tpu_reset(0);
+	tpu_rewind();
+	tpu_enq_wait(5); /* really needed ? */
+	tpu_enq_sync(l1s.tpu_offset);
+	tpu_end_scenario();
+}
+
+/* Lost TDMA interrupt detection.  This works by starting a hardware timer
+ * that is clocked by the same master clock source (VCTCXO).  We expect
+ * 1875 timer ticks in the duration of a TDMA frame (5000 qbits / 1250 bits) */
+
+/* Timer for detecting lost IRQ */
+#define TIMER_TICKS_PER_TDMA	1875
+#define TIMER_TICK_JITTER	1
+
+static int last_timestamp;
+
+static inline void check_lost_frame(void)
+{
+	int diff, timestamp = hwtimer_read(1);
+
+	if (last_timestamp < timestamp)
+		last_timestamp += (4*TIMER_TICKS_PER_TDMA);
+
+	diff = last_timestamp - timestamp;
+
+	/* allow for a bit of jitter */
+	if (diff < TIMER_TICKS_PER_TDMA - TIMER_TICK_JITTER ||
+	    diff > TIMER_TICKS_PER_TDMA + TIMER_TICK_JITTER)
+		printf("LOST %d!\n", diff);
+
+	last_timestamp = timestamp;
+}
+
+/* schedule a completion */
+void l1s_compl_sched(enum l1_compl c)
+{
+	unsigned long flags;
+
+	local_firq_save(flags);
+	l1s.scheduled_compl |= (1 << c);
+	local_irq_restore(flags);
+}
+
+/* main routine for synchronous part of layer 1, called by frame interrupt
+ * generated by TPU once every TDMA frame */
+static void l1_sync(void)
+{
+	uint16_t sched_flags;
+
+	putchart('+');
+
+	check_lost_frame();
+
+	/* Increment Time */
+	l1s.current_time = l1s.next_time;
+	l1s_time_inc(&l1s.next_time, 1);
+	//l1s_time_dump(&l1s.current_time); putchar(' ');
+
+	dsp_api.frame_ctr++;
+	dsp_api.r_page_used = 0;
+
+	/* Update pointers */
+	if (dsp_api.w_page == 0)
+		dsp_api.db_w = (T_DB_MCU_TO_DSP *) BASE_API_W_PAGE_0;
+	else
+		dsp_api.db_w = (T_DB_MCU_TO_DSP *) BASE_API_W_PAGE_1;
+
+	if (dsp_api.r_page == 0)
+		dsp_api.db_r = (T_DB_DSP_TO_MCU *) BASE_API_R_PAGE_0;
+	else
+		dsp_api.db_r = (T_DB_DSP_TO_MCU *) BASE_API_R_PAGE_1;
+
+	/* Reset MCU->DSP page */
+	dsp_api_memset((uint16_t *) dsp_api.db_w, sizeof(*dsp_api.db_w));
+
+	/* Update AFC */
+	afc_load_dsp();
+
+	if (dsp_api.ndb->d_error_status) {
+		printf("DSP Error Status: %u\n", dsp_api.ndb->d_error_status);
+		dsp_api.ndb->d_error_status = 0;
+	}
+
+	/* execute the sched_items that have been scheduled for this
+	 * TDMA frame (including setup/cleanup steps) */
+	sched_flags = tdma_sched_flag_scan();
+
+	if (sched_flags & TDMA_IFLG_TPU)
+		l1s_win_init();
+
+	tdma_sched_execute();
+
+	if (dsp_api.r_page_used) {
+		/* clear and switch the read page */
+		dsp_api_memset((uint16_t *) dsp_api.db_r,
+				sizeof(*dsp_api.db_r));
+
+		/* TSM30 does it (really needed ?):
+		 * Set crc result as "SB not found". */
+		dsp_api.db_r->a_sch[0] = (1<<B_SCH_CRC);   /* B_SCH_CRC =1, BLUD =0 */
+
+		dsp_api.r_page ^= 1;
+	}
+
+	if (sched_flags & TDMA_IFLG_DSP)
+		dsp_end_scenario();
+
+	if (sched_flags & TDMA_IFLG_TPU)
+		tpu_end_scenario();
+
+	/* schedule new / upcoming TDMA items */
+	mframe_schedule();
+	/* schedule new / upcoming one-shot events */
+	sched_gsmtime_execute(l1s.current_time.fn);
+
+	tdma_sched_advance();
+}
+
+/* ABORT command ********************************************************/
+
+static int l1s_abort_cmd(__unused uint8_t p1, __unused uint8_t p2,
+			 __unused uint16_t p3)
+{
+	putchart('A');
+
+	/* similar to l1s_reset_hw() without touching the TPU */
+
+	dsp_api.w_page = 0;
+	dsp_api.r_page = 0;
+	dsp_api.r_page_used = 0;
+	dsp_api.db_w = (T_DB_MCU_TO_DSP *) BASE_API_W_PAGE_0;
+	dsp_api.db_r = (T_DB_DSP_TO_MCU *) BASE_API_R_PAGE_0;
+
+	/* Reset task commands. */
+	dsp_api.db_w->d_task_d  = NO_DSP_TASK; /* Init. RX task to NO TASK */
+	dsp_api.db_w->d_task_u  = NO_DSP_TASK; /* Init. TX task to NO TASK */
+	dsp_api.db_w->d_task_ra = NO_DSP_TASK; /* Init. RA task to NO TASK */
+	dsp_api.db_w->d_task_md = NO_DSP_TASK; /* Init. MONITORING task to NO TASK */
+	dsp_api.ndb->d_dsp_page = 0;
+
+	/* Set "b_abort" to TRUE, dsp will reset current and pending tasks */
+	dsp_api.db_w->d_ctrl_system |= (1 << B_TASK_ABORT);
+	return 0;
+}
+
+void l1s_dsp_abort(void)
+{
+	/* abort right now */
+	tdma_schedule(0, &l1s_abort_cmd, 0, 0, 0, 10);
+}
+
+void l1s_tx_apc_helper(uint16_t arfcn)
+{
+	int16_t auxapc;
+	enum gsm_band band;
+	int i;
+
+	/* Get DAC setting */
+	band = gsm_arfcn2band(arfcn);
+	auxapc = apc_tx_pwrlvl2auxapc(band, l1s.tx_power);
+
+	/* Load the ApcOffset into the DSP */
+	#define  MY_OFFSET	4
+	dsp_api.ndb->d_apcoff = ABB_VAL(APCOFF, (1 << 6) | MY_OFFSET) | 1; /* 2x slope for the GTA-02 ramp */
+
+	/* Load the TX Power into the DSP */
+	/*
+	   If the power is too low (below 0 dBm) the ramp is not OK,
+	   especially for GSM-1800. However an MS does not send below
+	   0dBm anyway.
+	*/
+	dsp_api.db_w->d_power_ctl = ABB_VAL(AUXAPC, auxapc);
+
+	/* Update the ramp according to the PCL */
+	for (i = 0; i < 16; i++)
+		dsp_api.ndb->a_ramp[i] = ABB_VAL(APCRAM, twl3025_default_ramp[i]);
+
+	/* The Ramp Table is sent to ABB only once after RF init routine called */
+	dsp_api.db_w->d_ctrl_abb |= (1 << B_RAMP) | (1 << B_BULRAMPDEL);
+}
+
+/* Interrupt handler */
+static void frame_irq(__unused enum irq_nr nr)
+{
+	l1_sync();
+}
+
+/* reset the layer1 as part of synchronizing to a new cell */
+void l1s_reset(void)
+{
+	/* Reset state */
+	l1s.fb.mode = 0;
+	l1s.tx_power = 7; /* initial power reset */
+
+	/* Leave dedicated mode */
+	l1s.dedicated.type = GSM_DCHAN_NONE;
+
+	/* reset scheduler and hardware */
+	sched_gsmtime_reset();
+	mframe_reset();
+	tdma_sched_reset();
+	l1s_dsp_abort();
+
+	/* Cipher off */
+	dsp_load_ciph_param(0, NULL);
+}
+
+void l1s_init(void)
+{
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(l1s.tx_queue); i++)
+		INIT_LLIST_HEAD(&l1s.tx_queue[i]);
+	l1s.tx_meas = NULL;
+
+	sched_gsmtime_init();
+
+	/* register FRAME interrupt as FIQ so it can interrupt normal IRQs */
+	irq_register_handler(IRQ_TPU_FRAME, &frame_irq);
+	irq_config(IRQ_TPU_FRAME, 1, 1, 0);
+	irq_enable(IRQ_TPU_FRAME);
+
+	/* configure timer 1 to be auto-reload and have a prescale of 12 (13MHz/12 == qbit clock) */
+	hwtimer_enable(1, 1);
+	hwtimer_load(1, (1875*4)-1);
+	hwtimer_config(1, 0, 1);
+	hwtimer_enable(1, 1);
+}
+
diff --git a/src/target/firmware/layer1/tdma_sched.c b/src/target/firmware/layer1/tdma_sched.c
new file mode 100644
index 00000000..88129922
--- /dev/null
+++ b/src/target/firmware/layer1/tdma_sched.c
@@ -0,0 +1,244 @@
+/* TDMA Scheduler Implementation */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <defines.h>
+#include <debug.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <layer1/tdma_sched.h>
+#include <layer1/sync.h>
+
+#include <calypso/dsp.h>
+
+/* dummy function to mark end of set */
+int tdma_end_set(__unused uint8_t p1, __unused uint8_t p2,
+		 __unused uint16_t p3)
+{
+	return 0;
+}
+
+static uint8_t wrap_bucket(uint8_t offset)
+{
+	uint16_t bucket;
+
+	bucket = (l1s.tdma_sched.cur_bucket + offset)
+					% ARRAY_SIZE(l1s.tdma_sched.bucket);
+
+	return bucket;
+}
+
+/* Schedule an item at 'frame_offset' TDMA frames in the future */
+int tdma_schedule(uint8_t frame_offset, tdma_sched_cb *cb,
+                  uint8_t p1, uint8_t p2, uint16_t p3, int16_t prio)
+{
+	struct tdma_scheduler *sched = &l1s.tdma_sched;
+	uint8_t bucket_nr = wrap_bucket(frame_offset);
+	struct tdma_sched_bucket *bucket = &sched->bucket[bucket_nr];
+	struct tdma_sched_item *sched_item;
+
+	if (bucket->num_items >= ARRAY_SIZE(bucket->item)) {
+		puts("tdma_schedule bucket overflow\n");
+		return -1;
+	}
+
+	sched_item = &bucket->item[bucket->num_items++];
+
+	sched_item->cb = cb;
+	sched_item->p1 = p1;
+	sched_item->p2 = p2;
+	sched_item->p3 = p3;
+	sched_item->prio = prio;
+
+	return 0;
+}
+
+/* Schedule a set of items starting from 'frame_offset' TDMA frames in the future */
+int tdma_schedule_set(uint8_t frame_offset, const struct tdma_sched_item *item_set, uint16_t p3)
+{
+	struct tdma_scheduler *sched = &l1s.tdma_sched;
+	uint8_t bucket_nr = wrap_bucket(frame_offset);
+	int i, j;
+
+	for (i = 0, j = 0; 1; i++) {
+		const struct tdma_sched_item *sched_item = &item_set[i];
+		struct tdma_sched_bucket *bucket = &sched->bucket[bucket_nr];
+
+		if (sched_item->cb == &tdma_end_set) {
+			/* end of scheduler set, return */
+			break;
+		}
+
+		if (sched_item->cb == NULL) {
+			/* advance to next bucket (== TDMA frame) */
+			bucket_nr = wrap_bucket(++frame_offset);
+			j++;
+			continue;
+		}
+		/* check for bucket overflow */
+		if (bucket->num_items >= ARRAY_SIZE(bucket->item)) {
+			puts("tdma_schedule bucket overflow\n");
+			return -1;
+		}
+		/* copy the item from the set into the current bucket item position */
+		memcpy(&bucket->item[bucket->num_items], sched_item, sizeof(*sched_item));
+		bucket->item[bucket->num_items].p3 = p3;
+		bucket->num_items++;
+	}
+
+	return j;
+}
+
+/* Advance TDMA scheduler to the next bucket */
+void tdma_sched_advance(void)
+{
+	struct tdma_scheduler *sched = &l1s.tdma_sched;
+	uint8_t next_bucket;
+
+	/* advance to the next bucket */
+	next_bucket = wrap_bucket(1);
+	sched->cur_bucket = next_bucket;
+}
+
+/* Scan current frame scheduled items for flags */
+uint16_t tdma_sched_flag_scan(void)
+{
+	struct tdma_scheduler *sched = &l1s.tdma_sched;
+	struct tdma_sched_bucket *bucket;
+	int i;
+	uint16_t flags = 0;
+
+	/* determine current bucket */
+	bucket = &sched->bucket[sched->cur_bucket];
+
+	/* iterate over items in this bucket and call callback function */
+	for (i=0; i<bucket->num_items; i++) {
+		struct tdma_sched_item *item = &bucket->item[i];
+		flags |= item->flags;
+	}
+
+	return flags;
+}
+
+/* Sort a bucket entries by priority */
+static void _tdma_sched_bucket_sort(struct tdma_sched_bucket *bucket, int *seq)
+{
+	int i, j, k;
+	struct tdma_sched_item *item_i, *item_j;
+
+	/* initial sequence */
+		/* we need all the items because some call back may schedule
+		 * new call backs 'on the fly' */
+	for (i=0; i<TDMASCHED_NUM_CB; i++)
+		seq[i] = i;
+
+	/* iterate over items in this bucket and sort them */
+	for (i=0; i<bucket->num_items; i++)
+	{
+		item_i = &bucket->item[seq[i]];
+
+		for (j=i+1; j<bucket->num_items; j++)
+		{
+			item_j = &bucket->item[seq[j]];
+
+			if (item_i->prio > item_j->prio)
+			{
+				item_i = item_j;
+				k      = seq[i];
+				seq[i] = seq[j];
+				seq[j] = k;
+			}
+		}
+	}
+}
+
+/* Execute pre-scheduled events for current frame */
+int tdma_sched_execute(void)
+{
+	struct tdma_scheduler *sched = &l1s.tdma_sched;
+	struct tdma_sched_bucket *bucket;
+	int i, num_events = 0;
+	int seq[TDMASCHED_NUM_CB];
+
+	/* determine current bucket */
+	bucket = &sched->bucket[sched->cur_bucket];
+
+	/* get sequence in priority order */
+	_tdma_sched_bucket_sort(bucket, seq);
+
+	/* iterate over items in this bucket and call callback function */
+	for (i = 0; i < bucket->num_items; i++) {
+		struct tdma_sched_item *item = &bucket->item[seq[i]];
+		int rc;
+
+		num_events++;
+
+		rc = item->cb(item->p1, item->p2, item->p3);
+		if (rc < 0) {
+			printf("Error %d during processing of item %u of bucket %u\n",
+				rc, i, sched->cur_bucket);
+			return rc;
+		}
+		/* if the cb() we just called has scheduled more items for the
+		 * current TDMA, bucket->num_items will have increased and we
+		 * will simply continue to execute them as intended. Priorities
+		 * won't work though ! */
+	}
+
+	/* clear/reset the bucket */
+	bucket->num_items = 0;
+
+	/* return number of items that we called */
+	return num_events;
+}
+
+void tdma_sched_reset(void)
+{
+	struct tdma_scheduler *sched = &l1s.tdma_sched;
+	unsigned int bucket_nr;
+
+	for (bucket_nr = 0; bucket_nr < ARRAY_SIZE(sched->bucket); bucket_nr++) {
+		struct tdma_sched_bucket *bucket = &sched->bucket[bucket_nr];
+		/* current bucket will be reset by iteration code above! */
+		if (bucket_nr != sched->cur_bucket)
+			bucket->num_items = 0;
+	}
+
+	/* Don't reset cur_bucket, as it would upset the bucket iteration code
+	 * in tdma_sched_execute() */
+}
+
+void tdma_sched_dump(void)
+{
+	unsigned int i;
+
+	printf("\n(%2u)", l1s.tdma_sched.cur_bucket);
+	for (i = 0; i < ARRAY_SIZE(l1s.tdma_sched.bucket); i++) {
+		int bucket_nr = wrap_bucket(i);
+		struct tdma_sched_bucket *bucket = &l1s.tdma_sched.bucket[bucket_nr];
+		printf("%u:", bucket->num_items);
+	}
+	putchar('\n');
+}
diff --git a/src/target/firmware/layer1/toa.c b/src/target/firmware/layer1/toa.c
new file mode 100644
index 00000000..7d80d952
--- /dev/null
+++ b/src/target/firmware/layer1/toa.c
@@ -0,0 +1,80 @@
+/* AFC (Automatic Frequency Correction) Implementation */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2011 by Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <layer1/toa.h>
+#include <layer1/avg.h>
+#include <layer1/sync.h>
+
+/* Over how many TDMA frames do we want to average? */
+#define TOA_PERIOD		250
+/* How many of our measurements have to be valid? */
+#define TOA_MIN_MUN_VALID	125
+
+// FIXME:
+#define TOA_SNR_THRESHOLD       2560    /* 2.5 dB in fx6.10 */
+
+struct toa_state {
+	struct running_avg ravg;		/* running average */
+};
+
+
+static void toa_ravg_output(struct running_avg *ravg, int32_t avg);
+
+static struct toa_state toa_state = {
+	.ravg = {
+		.outfn = &toa_ravg_output,
+		.period = TOA_PERIOD,
+		.min_valid = TOA_MIN_MUN_VALID,
+	},
+};
+
+void toa_input(int32_t offset, uint32_t snr)
+{
+	int valid = 1;
+
+	if (snr < TOA_SNR_THRESHOLD || offset < 0 || offset >31)
+		valid = 0;
+	runavg_input(&toa_state.ravg, offset, valid);
+	runavg_check_output(&toa_state.ravg);
+}
+
+void toa_reset(void)
+{
+	toa_state.ravg.num_samples = toa_state.ravg.num_samples_valid = 0;
+	toa_state.ravg.acc_val = 0;
+}
+
+/* callback function for runavg */
+static void toa_ravg_output(struct running_avg *ravg, int32_t avg)
+{
+	if (avg != 16) {
+		printf("TOA AVG is not 16 qbits, correcting (got %ld)\n", avg);
+		l1s.tpu_offset_correction = avg - 16;
+	}
+}
diff --git a/src/target/firmware/layer1/tpu_window.c b/src/target/firmware/layer1/tpu_window.c
new file mode 100644
index 00000000..f4e76c16
--- /dev/null
+++ b/src/target/firmware/layer1/tpu_window.c
@@ -0,0 +1,175 @@
+/* TPU window control routines for Layer 1 */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <debug.h>
+#include <defines.h>
+#include <stdio.h>
+
+#include <rffe.h>
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <abb/twl3025.h>
+#include <rf/trf6151.h>
+
+#include <layer1/sync.h>
+#include <layer1/tpu_window.h>
+#include <layer1/rfch.h>
+
+/* all units in GSM quarter-bits (923.1ns) */
+#define L1_TDMA_LENGTH_Q	5000
+#define L1_BURST_LENGTH_Q	625	/* L1_TDMA_LENGTH_Q/8 */
+
+#define L1_NB_MARGIN_Q		(3 * 4)
+#define L1_SB_MARGIN_Q		(23 * 4)
+#define L1_TAIL_DURATION_Q	(3 * 4)
+
+/* Sample length as required by the Calypso DSP */
+#define L1_NB_DURATION_Q	(L1_BURST_LENGTH_Q + 2 * L1_NB_MARGIN_Q - L1_TAIL_DURATION_Q)
+#define L1_SB_DURATION_Q	(L1_BURST_LENGTH_Q + 2 * L1_SB_MARGIN_Q - L1_TAIL_DURATION_Q)
+#define L1_FB_DURATION_Q	(11 * L1_TDMA_LENGTH_Q + 2057)	/* more than 11 full slots */
+#define L1_FB26_DURATION_Q	(L1_TDMA_LENGTH_Q + 798)
+#define	L1_PW_DURATION_Q	289
+
+#define DSP_SETUP_TIME		66
+
+static const uint16_t rx_burst_duration[_NUM_L1_RXWIN] = {
+	[L1_RXWIN_PW]	= L1_PW_DURATION_Q,
+	[L1_RXWIN_FB]	= L1_FB_DURATION_Q,
+	[L1_RXWIN_SB]	= L1_SB_DURATION_Q,
+	[L1_RXWIN_NB]	= L1_NB_DURATION_Q,
+};
+
+#define L1_TX_NB_DURATION_Q	626
+#define L1_TX_AB_DURATION_Q	386
+
+static const uint16_t tx_burst_duration[_NUM_L1_TXWIN] = {
+	[L1_TXWIN_NB]	= L1_TX_NB_DURATION_Q,
+	[L1_TXWIN_AB]	= L1_TX_AB_DURATION_Q,
+};
+
+
+static int _win_setup(__unused uint8_t p1, __unused uint8_t p2, __unused uint16_t p3)
+{
+	uint8_t tn;
+
+	rfch_get_params(&l1s.next_time, NULL, NULL, &tn);
+
+	l1s.tpu_offset = (5000 + l1s.tpu_offset + l1s.tpu_offset_correction) % 5000;
+	l1s.tpu_offset_correction = 0;
+
+	tpu_enq_at(4740);
+	tpu_enq_sync((5000 + l1s.tpu_offset + (L1_BURST_LENGTH_Q * tn)) % 5000);
+
+	return 0;
+}
+
+static int _win_cleanup(__unused uint8_t p1, __unused uint8_t p2, __unused uint16_t p3)
+{
+	uint8_t tn;
+
+	rfch_get_params(&l1s.next_time, NULL, NULL, &tn);
+
+	/* restore offset */
+	tpu_enq_offset((5000 + l1s.tpu_offset + (L1_BURST_LENGTH_Q * tn)) % 5000);
+
+	return 0;
+}
+
+void l1s_win_init(void)
+{
+	tdma_schedule(0, _win_setup,   0, 0, 0, -2);
+	tdma_schedule(0, _win_cleanup, 0, 0, 0,  9);
+}
+
+void l1s_rx_win_ctrl(uint16_t arfcn, enum l1_rxwin_type wtype, uint8_t tn_ofs)
+{
+	int16_t start;
+	int32_t stop;	/* prevent overflow of int16_t in L1_RXWIN_FB */
+
+	/* TN offset & TA adjust */
+	start = DSP_SETUP_TIME;
+	start += L1_BURST_LENGTH_Q * tn_ofs;
+
+	stop = start + rx_burst_duration[wtype] - 1;
+
+	/* window open for TRF6151 */
+	/* FIXME: why do we need the magic value 100 ? */
+	rffe_mode(gsm_arfcn2band(arfcn), 0);
+	trf6151_rx_window(start - 100, arfcn);
+
+	/* Window open for ABB */
+	twl3025_downlink(1, start);
+
+	/* Delay 11 full TDMA frames */
+	if (wtype == L1_RXWIN_FB) {
+		uint8_t i;
+		for (i = 0; i < 11; i++)
+			tpu_enq_at(0);
+
+		stop -= 11 * L1_TDMA_LENGTH_Q;
+	}
+
+	/* Window close for ABB */
+	twl3025_downlink(0, stop & 0xffff);
+
+	/* window close for TRF6151 */
+	trf6151_set_mode(TRF6151_IDLE);
+}
+
+void l1s_tx_win_ctrl(uint16_t arfcn, enum l1_txwin_type wtype, uint8_t pwr, uint8_t tn_ofs)
+{
+	uint16_t offset;
+
+	/* TN offset & TA adjust */
+	offset = 28; /* ("+ 32" gives a TA of 1) */
+	offset += L1_BURST_LENGTH_Q * tn_ofs;
+	offset -= l1s.ta << 2;
+
+#ifdef CONFIG_TX_ENABLE
+	/* window open for TRF6151 */
+	trf6151_tx_window(offset, arfcn);
+#endif
+
+	/* Window open for ABB */
+	twl3025_uplink(1, offset);
+
+#ifdef CONFIG_TX_ENABLE
+	/* Window open for RFFE */
+	rffe_mode(gsm_arfcn2band(arfcn), 1);
+#endif
+
+	/* Window close for ABB */
+	twl3025_uplink(0, tx_burst_duration[wtype] + offset + 2); // TODO: "+ 2"
+
+	/* window close for TRF6151 */
+	trf6151_set_mode(TRF6151_IDLE);
+
+	/* Window close for RFFE */
+	rffe_mode(gsm_arfcn2band(arfcn), 0);
+}
+
+void tpu_end_scenario(void)
+{
+	tpu_enq_sleep();
+	tpu_enable(1);
+}
diff --git a/src/target/firmware/lib/Makefile b/src/target/firmware/lib/Makefile
new file mode 100644
index 00000000..a2a6d457
--- /dev/null
+++ b/src/target/firmware/lib/Makefile
@@ -0,0 +1,7 @@
+
+LIBRARIES+=mini
+LIB_mini_DIR=lib
+LIB_mini_SRCS=vsprintf.c string.c ctype.c printf.c console.c ctors.c \
+		changebit.S clearbit.S delay.c div64.S lib1funcs.S memcpy.S memset.S setbit.S testchangebit.S testclearbit.S testsetbit.S
+
+
diff --git a/src/target/firmware/lib/bitops.h b/src/target/firmware/lib/bitops.h
new file mode 100644
index 00000000..428c9a63
--- /dev/null
+++ b/src/target/firmware/lib/bitops.h
@@ -0,0 +1,33 @@
+	.macro	bitop, instr
+	and	r2, r0, #7
+	mov	r3, #1
+	mov	r3, r3, lsl r2
+	save_and_disable_irqs ip
+	ldrb	r2, [r1, r0, lsr #3]
+	\instr	r2, r2, r3
+	strb	r2, [r1, r0, lsr #3]
+	restore_irqs ip
+	mov	pc, lr
+	.endm
+
+/**
+ * testop - implement a test_and_xxx_bit operation.
+ * @instr: operational instruction
+ * @store: store instruction
+ *
+ * Note: we can trivially conditionalise the store instruction
+ * to avoid dirting the data cache.
+ */
+	.macro	testop, instr, store
+	add	r1, r1, r0, lsr #3
+	and	r3, r0, #7
+	mov	r0, #1
+	save_and_disable_irqs ip
+	ldrb	r2, [r1]
+	tst	r2, r0, lsl r3
+	\instr	r2, r2, r0, lsl r3
+	\store	r2, [r1]
+	restore_irqs ip
+	moveq	r0, #0
+	mov	pc, lr
+	.endm
diff --git a/src/target/firmware/lib/changebit.S b/src/target/firmware/lib/changebit.S
new file mode 100644
index 00000000..7c709fb3
--- /dev/null
+++ b/src/target/firmware/lib/changebit.S
@@ -0,0 +1,21 @@
+/*
+ *  linux/arch/arm/lib/changebit.S
+ *
+ *  Copyright (C) 1995-1996 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <asm/linkage.h>
+#include <asm/assembler.h>
+#include "bitops.h"
+                .text
+
+/* Purpose  : Function to change a bit
+ * Prototype: int change_bit(int bit, void *addr)
+ */
+ENTRY(_change_bit_be)
+		eor	r0, r0, #0x18		@ big endian byte ordering
+ENTRY(_change_bit_le)
+	bitop	eor
diff --git a/src/target/firmware/lib/clearbit.S b/src/target/firmware/lib/clearbit.S
new file mode 100644
index 00000000..cb48f7ac
--- /dev/null
+++ b/src/target/firmware/lib/clearbit.S
@@ -0,0 +1,22 @@
+/*
+ *  linux/arch/arm/lib/clearbit.S
+ *
+ *  Copyright (C) 1995-1996 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <asm/linkage.h>
+#include <asm/assembler.h>
+#include "bitops.h"
+                .text
+
+/*
+ * Purpose  : Function to clear a bit
+ * Prototype: int clear_bit(int bit, void *addr)
+ */
+ENTRY(_clear_bit_be)
+		eor	r0, r0, #0x18		@ big endian byte ordering
+ENTRY(_clear_bit_le)
+	bitop	bic
diff --git a/src/target/firmware/lib/console.c b/src/target/firmware/lib/console.c
new file mode 100644
index 00000000..6bc8fede
--- /dev/null
+++ b/src/target/firmware/lib/console.c
@@ -0,0 +1,201 @@
+/* Ringbuffer based serial console layer, imported from OpenPCD */
+
+/* (C) 2006-2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include <console.h>
+#include <uart.h>
+
+#include <asm/system.h>
+
+struct cons {
+	char buf[CONS_RB_SIZE];
+	char *next_inbyte;
+	char *next_outbyte;
+	int initialized;
+	int uart_id;
+};
+static struct cons cons;
+
+void cons_bind_uart(int uart)
+{
+	cons.uart_id = uart;
+}
+
+int cons_get_uart(void)
+{
+	return cons.uart_id;
+}
+
+void cons_init(void)
+{
+	memset(cons.buf, 0, sizeof(cons.buf));
+	cons.next_inbyte = &cons.buf[0];
+	cons.next_outbyte = &cons.buf[0];
+	cons.initialized = 1;
+}
+
+/* determine how many bytes are left in the ringbuffer without overwriting
+   bytes that haven't been written to the console yet */
+static int __cons_rb_space(void)
+{
+	if (cons.next_inbyte == cons.next_outbyte)
+		return sizeof(cons.buf)-1;
+	else if (cons.next_outbyte > cons.next_inbyte)
+		return (cons.next_outbyte - cons.next_inbyte) -1;
+	else
+		return sizeof(cons.buf) - 1 - (cons.next_inbyte - cons.next_outbyte);
+}
+
+/* pull one char out of debug ring buffer */
+static int cons_rb_pull(char *ret)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+
+	if (cons.next_outbyte == cons.next_inbyte) {
+		local_irq_restore(flags);
+		return -1;
+	}
+
+	*ret = *cons.next_outbyte;
+
+	cons.next_outbyte++;
+	if (cons.next_outbyte >= &cons.buf[0]+sizeof(cons.buf)) {
+		cons.next_outbyte = &cons.buf[0];
+	}
+#if 0
+	 else if (cons.next_outbyte > &cons.buf[0]+sizeof(cons.buf)) {
+		cons.next_outbyte -= sizeof(cons.buf);
+	}
+#endif
+
+	local_irq_restore(flags);
+
+	return 0;
+}
+
+/* returns if everything was flushed (1) or if there's more to flush (0) */
+static void __rb_flush_wait(void)
+{
+	char ch;
+	while (cons_rb_pull(&ch) >= 0)
+		uart_putchar_wait(cons.uart_id, ch);
+}
+
+/* returns if everything was flushed (1) or if there's more to flush (0) */
+static int __rb_flush(void)
+{
+	while (!uart_tx_busy(cons.uart_id)) {
+		char ch;
+		if (cons_rb_pull(&ch) < 0) {
+			/* no more data to write, disable interest in Tx FIFO interrupts */
+			return 1;
+		}
+		uart_putchar_nb(cons.uart_id, ch);
+	}
+
+	/* if we reach here, UART Tx FIFO is busy again */
+	return 0;
+}
+
+/* flush pending data from debug ring buffer to serial port */
+int cons_rb_flush(void)
+{
+	return __rb_flush();
+}
+
+/* Append bytes to ring buffer, not more than we have left! */
+static void __cons_rb_append(const char *data, int len)
+{
+	if (cons.next_inbyte + len >= &cons.buf[0]+sizeof(cons.buf)) {
+		int before_tail = (&cons.buf[0]+sizeof(cons.buf)) - cons.next_inbyte;
+		/* copy the first part before we wrap */
+		memcpy(cons.next_inbyte, data, before_tail);
+		data += before_tail;
+		len -= before_tail;
+		/* reset the buffer */
+		cons.next_inbyte = &cons.buf[0];
+	}
+	memcpy(cons.next_inbyte, data, len);
+	cons.next_inbyte += len;
+}
+
+/* append bytes to the ringbuffer, do one wrap */
+int cons_rb_append(const char *data, int len)
+{
+	unsigned long flags;
+	int bytes_left;
+	const char *data_cur;
+
+	/* we will never be able to write more than the console buffer */
+	if (len > (int) sizeof(cons.buf))
+		len = sizeof(cons.buf);
+
+	local_irq_save(flags);
+
+	bytes_left = __cons_rb_space();
+	data_cur = data;
+
+	if (len > bytes_left) {
+		/* append what we can */
+		__cons_rb_append(data_cur, bytes_left);
+		/* busy-wait for all characters to be transmitted */
+		__rb_flush_wait();
+		/* fill it with the remaining bytes */
+		len -= bytes_left;
+		data_cur += bytes_left;
+	}
+	__cons_rb_append(data_cur, len);
+
+	/* we want to get Tx FIFO interrupts */
+	uart_irq_enable(cons.uart_id, UART_IRQ_TX_EMPTY, 1);
+
+	local_irq_restore(flags);
+
+	return len;
+}
+
+int cons_puts(const char *s)
+{
+	if (cons.initialized) {
+		return cons_rb_append(s, strlen(s));
+	} else {
+		/* if the console is not active yet, we need to fall back */
+		int i = strlen(s);
+		while (i--)
+			uart_putchar_wait(cons.uart_id, *s++);
+		return i;
+	}
+}
+
+int cons_putchar(char c)
+{
+	if (cons.initialized)
+		return cons_rb_append(&c, 1);
+	else {
+		/* if the console is not active yet, we need to fall back */
+		uart_putchar_wait(cons.uart_id, c);
+		return 0;
+	}
+}
diff --git a/src/target/firmware/lib/copy_template.S b/src/target/firmware/lib/copy_template.S
new file mode 100644
index 00000000..cab355c0
--- /dev/null
+++ b/src/target/firmware/lib/copy_template.S
@@ -0,0 +1,255 @@
+/*
+ *  linux/arch/arm/lib/copy_template.s
+ *
+ *  Code template for optimized memory copy functions
+ *
+ *  Author:	Nicolas Pitre
+ *  Created:	Sep 28, 2005
+ *  Copyright:	MontaVista Software, Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ */
+
+/*
+ * This can be used to enable code to cacheline align the source pointer.
+ * Experiments on tested architectures (StrongARM and XScale) didn't show
+ * this a worthwhile thing to do.  That might be different in the future.
+ */
+//#define CALGN(code...)	code
+#define CALGN(code...)
+
+/*
+ * Theory of operation
+ * -------------------
+ *
+ * This file provides the core code for a forward memory copy used in
+ * the implementation of memcopy(), copy_to_user() and copy_from_user().
+ *
+ * The including file must define the following accessor macros
+ * according to the need of the given function:
+ *
+ * ldr1w ptr reg abort
+ *
+ *	This loads one word from 'ptr', stores it in 'reg' and increments
+ *	'ptr' to the next word. The 'abort' argument is used for fixup tables.
+ *
+ * ldr4w ptr reg1 reg2 reg3 reg4 abort
+ * ldr8w ptr, reg1 reg2 reg3 reg4 reg5 reg6 reg7 reg8 abort
+ *
+ *	This loads four or eight words starting from 'ptr', stores them
+ *	in provided registers and increments 'ptr' past those words.
+ *	The'abort' argument is used for fixup tables.
+ *
+ * ldr1b ptr reg cond abort
+ *
+ *	Similar to ldr1w, but it loads a byte and increments 'ptr' one byte.
+ *	It also must apply the condition code if provided, otherwise the
+ *	"al" condition is assumed by default.
+ *
+ * str1w ptr reg abort
+ * str8w ptr reg1 reg2 reg3 reg4 reg5 reg6 reg7 reg8 abort
+ * str1b ptr reg cond abort
+ *
+ *	Same as their ldr* counterparts, but data is stored to 'ptr' location
+ *	rather than being loaded.
+ *
+ * enter reg1 reg2
+ *
+ *	Preserve the provided registers on the stack plus any additional
+ *	data as needed by the implementation including this code. Called
+ *	upon code entry.
+ *
+ * exit reg1 reg2
+ *
+ *	Restore registers with the values previously saved with the
+ *	'preserv' macro. Called upon code termination.
+ */
+
+
+		enter	r4, lr
+
+		subs	r2, r2, #4
+		blt	8f
+		ands	ip, r0, #3
+	PLD(	pld	[r1, #0]		)
+		bne	9f
+		ands	ip, r1, #3
+		bne	10f
+
+1:		subs	r2, r2, #(28)
+		stmfd	sp!, {r5 - r8}
+		blt	5f
+
+	CALGN(	ands	ip, r1, #31		)
+	CALGN(	rsb	r3, ip, #32		)
+	CALGN(	sbcnes	r4, r3, r2		)  @ C is always set here
+	CALGN(	bcs	2f			)
+	CALGN(	adr	r4, 6f			)
+	CALGN(	subs	r2, r2, r3		)  @ C gets set
+	CALGN(	add	pc, r4, ip		)
+
+	PLD(	pld	[r1, #0]		)
+2:	PLD(	subs	r2, r2, #96		)
+	PLD(	pld	[r1, #28]		)
+	PLD(	blt	4f			)
+	PLD(	pld	[r1, #60]		)
+	PLD(	pld	[r1, #92]		)
+
+3:	PLD(	pld	[r1, #124]		)
+4:		ldr8w	r1, r3, r4, r5, r6, r7, r8, ip, lr, abort=20f
+		subs	r2, r2, #32
+		str8w	r0, r3, r4, r5, r6, r7, r8, ip, lr, abort=20f
+		bge	3b
+	PLD(	cmn	r2, #96			)
+	PLD(	bge	4b			)
+
+5:		ands	ip, r2, #28
+		rsb	ip, ip, #32
+		addne	pc, pc, ip		@ C is always clear here
+		b	7f
+6:		nop
+		ldr1w	r1, r3, abort=20f
+		ldr1w	r1, r4, abort=20f
+		ldr1w	r1, r5, abort=20f
+		ldr1w	r1, r6, abort=20f
+		ldr1w	r1, r7, abort=20f
+		ldr1w	r1, r8, abort=20f
+		ldr1w	r1, lr, abort=20f
+
+		add	pc, pc, ip
+		nop
+		nop
+		str1w	r0, r3, abort=20f
+		str1w	r0, r4, abort=20f
+		str1w	r0, r5, abort=20f
+		str1w	r0, r6, abort=20f
+		str1w	r0, r7, abort=20f
+		str1w	r0, r8, abort=20f
+		str1w	r0, lr, abort=20f
+
+	CALGN(	bcs	2b			)
+
+7:		ldmfd	sp!, {r5 - r8}
+
+8:		movs	r2, r2, lsl #31
+		ldr1b	r1, r3, ne, abort=21f
+		ldr1b	r1, r4, cs, abort=21f
+		ldr1b	r1, ip, cs, abort=21f
+		str1b	r0, r3, ne, abort=21f
+		str1b	r0, r4, cs, abort=21f
+		str1b	r0, ip, cs, abort=21f
+
+		exit	r4, pc
+
+9:		rsb	ip, ip, #4
+		cmp	ip, #2
+		ldr1b	r1, r3, gt, abort=21f
+		ldr1b	r1, r4, ge, abort=21f
+		ldr1b	r1, lr, abort=21f
+		str1b	r0, r3, gt, abort=21f
+		str1b	r0, r4, ge, abort=21f
+		subs	r2, r2, ip
+		str1b	r0, lr, abort=21f
+		blt	8b
+		ands	ip, r1, #3
+		beq	1b
+
+10:		bic	r1, r1, #3
+		cmp	ip, #2
+		ldr1w	r1, lr, abort=21f
+		beq	17f
+		bgt	18f
+
+
+		.macro	forward_copy_shift pull push
+
+		subs	r2, r2, #28
+		blt	14f
+
+	CALGN(	ands	ip, r1, #31		)
+	CALGN(	rsb	ip, ip, #32		)
+	CALGN(	sbcnes	r4, ip, r2		)  @ C is always set here
+	CALGN(	subcc	r2, r2, ip		)
+	CALGN(	bcc	15f			)
+
+11:		stmfd	sp!, {r5 - r9}
+
+	PLD(	pld	[r1, #0]		)
+	PLD(	subs	r2, r2, #96		)
+	PLD(	pld	[r1, #28]		)
+	PLD(	blt	13f			)
+	PLD(	pld	[r1, #60]		)
+	PLD(	pld	[r1, #92]		)
+
+12:	PLD(	pld	[r1, #124]		)
+13:		ldr4w	r1, r4, r5, r6, r7, abort=19f
+		mov	r3, lr, pull #\pull
+		subs	r2, r2, #32
+		ldr4w	r1, r8, r9, ip, lr, abort=19f
+		orr	r3, r3, r4, push #\push
+		mov	r4, r4, pull #\pull
+		orr	r4, r4, r5, push #\push
+		mov	r5, r5, pull #\pull
+		orr	r5, r5, r6, push #\push
+		mov	r6, r6, pull #\pull
+		orr	r6, r6, r7, push #\push
+		mov	r7, r7, pull #\pull
+		orr	r7, r7, r8, push #\push
+		mov	r8, r8, pull #\pull
+		orr	r8, r8, r9, push #\push
+		mov	r9, r9, pull #\pull
+		orr	r9, r9, ip, push #\push
+		mov	ip, ip, pull #\pull
+		orr	ip, ip, lr, push #\push
+		str8w	r0, r3, r4, r5, r6, r7, r8, r9, ip, , abort=19f
+		bge	12b
+	PLD(	cmn	r2, #96			)
+	PLD(	bge	13b			)
+
+		ldmfd	sp!, {r5 - r9}
+
+14:		ands	ip, r2, #28
+		beq	16f
+
+15:		mov	r3, lr, pull #\pull
+		ldr1w	r1, lr, abort=21f
+		subs	ip, ip, #4
+		orr	r3, r3, lr, push #\push
+		str1w	r0, r3, abort=21f
+		bgt	15b
+	CALGN(	cmp	r2, #0			)
+	CALGN(	bge	11b			)
+
+16:		sub	r1, r1, #(\push / 8)
+		b	8b
+
+		.endm
+
+
+		forward_copy_shift	pull=8	push=24
+
+17:		forward_copy_shift	pull=16	push=16
+
+18:		forward_copy_shift	pull=24	push=8
+
+
+/*
+ * Abort preamble and completion macros.
+ * If a fixup handler is required then those macros must surround it.
+ * It is assumed that the fixup code will handle the private part of
+ * the exit macro.
+ */
+
+	.macro	copy_abort_preamble
+19:	ldmfd	sp!, {r5 - r9}
+	b	21f
+20:	ldmfd	sp!, {r5 - r8}
+21:
+	.endm
+
+	.macro	copy_abort_end
+	ldmfd	sp!, {r4, pc}
+	.endm
+
diff --git a/src/target/firmware/lib/ctors.c b/src/target/firmware/lib/ctors.c
new file mode 100644
index 00000000..982169df
--- /dev/null
+++ b/src/target/firmware/lib/ctors.c
@@ -0,0 +1,15 @@
+
+/* iterate over list of constructor functions and call each element */
+void do_global_ctors(const char *_ctors_start, const char *ctors_end)
+{
+	typedef void (*func_ptr)(void);
+	func_ptr *func, *ctors_start = (func_ptr *) _ctors_start;
+
+	/* skip the first entry, as it contains the number of
+	 * constructors which we don't use */
+	ctors_start++;
+
+	for (func = ctors_start;
+	     *func && (func != (func_ptr *) ctors_end); func++)
+		(*func)();
+}
diff --git a/src/target/firmware/lib/ctype.c b/src/target/firmware/lib/ctype.c
new file mode 100644
index 00000000..f3732140
--- /dev/null
+++ b/src/target/firmware/lib/ctype.c
@@ -0,0 +1,34 @@
+/*
+ *  linux/lib/ctype.c
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ */
+
+#include <ctype.h>
+
+unsigned char _ctype[] = {
+_C,_C,_C,_C,_C,_C,_C,_C,			/* 0-7 */
+_C,_C|_S,_C|_S,_C|_S,_C|_S,_C|_S,_C,_C,		/* 8-15 */
+_C,_C,_C,_C,_C,_C,_C,_C,			/* 16-23 */
+_C,_C,_C,_C,_C,_C,_C,_C,			/* 24-31 */
+_S|_SP,_P,_P,_P,_P,_P,_P,_P,			/* 32-39 */
+_P,_P,_P,_P,_P,_P,_P,_P,			/* 40-47 */
+_D,_D,_D,_D,_D,_D,_D,_D,			/* 48-55 */
+_D,_D,_P,_P,_P,_P,_P,_P,			/* 56-63 */
+_P,_U|_X,_U|_X,_U|_X,_U|_X,_U|_X,_U|_X,_U,	/* 64-71 */
+_U,_U,_U,_U,_U,_U,_U,_U,			/* 72-79 */
+_U,_U,_U,_U,_U,_U,_U,_U,			/* 80-87 */
+_U,_U,_U,_P,_P,_P,_P,_P,			/* 88-95 */
+_P,_L|_X,_L|_X,_L|_X,_L|_X,_L|_X,_L|_X,_L,	/* 96-103 */
+_L,_L,_L,_L,_L,_L,_L,_L,			/* 104-111 */
+_L,_L,_L,_L,_L,_L,_L,_L,			/* 112-119 */
+_L,_L,_L,_P,_P,_P,_P,_C,			/* 120-127 */
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,		/* 128-143 */
+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,		/* 144-159 */
+_S|_SP,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,   /* 160-175 */
+_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,       /* 176-191 */
+_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,       /* 192-207 */
+_U,_U,_U,_U,_U,_U,_U,_P,_U,_U,_U,_U,_U,_U,_U,_L,       /* 208-223 */
+_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,       /* 224-239 */
+_L,_L,_L,_L,_L,_L,_L,_P,_L,_L,_L,_L,_L,_L,_L,_L};      /* 240-255 */
+
diff --git a/src/target/firmware/lib/delay.c b/src/target/firmware/lib/delay.c
new file mode 100644
index 00000000..443ca827
--- /dev/null
+++ b/src/target/firmware/lib/delay.c
@@ -0,0 +1,16 @@
+#include <delay.h>
+
+/* FIXME: We need properly calibrated delay loops at some point! */
+void delay_us(unsigned int us)
+{
+	volatile unsigned int i;
+
+	for (i= 0; i < us*4; i++) { i; }
+}
+
+void delay_ms(unsigned int ms)
+{
+	volatile unsigned int i;
+
+	for (i= 0; i < ms*1300; i++) { i; }
+}
diff --git a/src/target/firmware/lib/div64.S b/src/target/firmware/lib/div64.S
new file mode 100644
index 00000000..7eeef50c
--- /dev/null
+++ b/src/target/firmware/lib/div64.S
@@ -0,0 +1,200 @@
+/*
+ *  linux/arch/arm/lib/div64.S
+ *
+ *  Optimized computation of 64-bit dividend / 32-bit divisor
+ *
+ *  Author:	Nicolas Pitre
+ *  Created:	Oct 5, 2003
+ *  Copyright:	Monta Vista Software, Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ */
+
+#include <asm/linkage.h>
+
+#ifdef __ARMEB__
+#define xh r0
+#define xl r1
+#define yh r2
+#define yl r3
+#else
+#define xl r0
+#define xh r1
+#define yl r2
+#define yh r3
+#endif
+
+/*
+ * __do_div64: perform a division with 64-bit dividend and 32-bit divisor.
+ *
+ * Note: Calling convention is totally non standard for optimal code.
+ *       This is meant to be used by do_div() from include/asm/div64.h only.
+ *
+ * Input parameters:
+ * 	xh-xl	= dividend (clobbered)
+ * 	r4	= divisor (preserved)
+ *
+ * Output values:
+ * 	yh-yl	= result
+ * 	xh	= remainder
+ *
+ * Clobbered regs: xl, ip
+ */
+
+ENTRY(__do_div64)
+
+	@ Test for easy paths first.
+	subs	ip, r4, #1
+	bls	9f			@ divisor is 0 or 1
+	tst	ip, r4
+	beq	8f			@ divisor is power of 2
+
+	@ See if we need to handle upper 32-bit result.
+	cmp	xh, r4
+	mov	yh, #0
+	blo	3f
+
+	@ Align divisor with upper part of dividend.
+	@ The aligned divisor is stored in yl preserving the original.
+	@ The bit position is stored in ip.
+
+#if __LINUX_ARM_ARCH__ >= 5
+
+	clz	yl, r4
+	clz	ip, xh
+	sub	yl, yl, ip
+	mov	ip, #1
+	mov	ip, ip, lsl yl
+	mov	yl, r4, lsl yl
+
+#else
+
+	mov	yl, r4
+	mov	ip, #1
+1:	cmp	yl, #0x80000000
+	cmpcc	yl, xh
+	movcc	yl, yl, lsl #1
+	movcc	ip, ip, lsl #1
+	bcc	1b
+
+#endif
+
+	@ The division loop for needed upper bit positions.
+ 	@ Break out early if dividend reaches 0.
+2:	cmp	xh, yl
+	orrcs	yh, yh, ip
+	subcss	xh, xh, yl
+	movnes	ip, ip, lsr #1
+	mov	yl, yl, lsr #1
+	bne	2b
+
+	@ See if we need to handle lower 32-bit result.
+3:	cmp	xh, #0
+	mov	yl, #0
+	cmpeq	xl, r4
+	movlo	xh, xl
+	movlo	pc, lr
+
+	@ The division loop for lower bit positions.
+	@ Here we shift remainer bits leftwards rather than moving the
+	@ divisor for comparisons, considering the carry-out bit as well.
+	mov	ip, #0x80000000
+4:	movs	xl, xl, lsl #1
+	adcs	xh, xh, xh
+	beq	6f
+	cmpcc	xh, r4
+5:	orrcs	yl, yl, ip
+	subcs	xh, xh, r4
+	movs	ip, ip, lsr #1
+	bne	4b
+	mov	pc, lr
+
+	@ The top part of remainder became zero.  If carry is set
+	@ (the 33th bit) this is a false positive so resume the loop.
+	@ Otherwise, if lower part is also null then we are done.
+6:	bcs	5b
+	cmp	xl, #0
+	moveq	pc, lr
+
+	@ We still have remainer bits in the low part.  Bring them up.
+
+#if __LINUX_ARM_ARCH__ >= 5
+
+	clz	xh, xl			@ we know xh is zero here so...
+	add	xh, xh, #1
+	mov	xl, xl, lsl xh
+	mov	ip, ip, lsr xh
+
+#else
+
+7:	movs	xl, xl, lsl #1
+	mov	ip, ip, lsr #1
+	bcc	7b
+
+#endif
+
+	@ Current remainder is now 1.  It is worthless to compare with
+	@ divisor at this point since divisor can not be smaller than 3 here.
+	@ If possible, branch for another shift in the division loop.
+	@ If no bit position left then we are done.
+	movs	ip, ip, lsr #1
+	mov	xh, #1
+	bne	4b
+	mov	pc, lr
+
+8:	@ Division by a power of 2: determine what that divisor order is
+	@ then simply shift values around
+
+#if __LINUX_ARM_ARCH__ >= 5
+
+	clz	ip, r4
+	rsb	ip, ip, #31
+
+#else
+
+	mov	yl, r4
+	cmp	r4, #(1 << 16)
+	mov	ip, #0
+	movhs	yl, yl, lsr #16
+	movhs	ip, #16
+
+	cmp	yl, #(1 << 8)
+	movhs	yl, yl, lsr #8
+	addhs	ip, ip, #8
+
+	cmp	yl, #(1 << 4)
+	movhs	yl, yl, lsr #4
+	addhs	ip, ip, #4
+
+	cmp	yl, #(1 << 2)
+	addhi	ip, ip, #3
+	addls	ip, ip, yl, lsr #1
+
+#endif
+
+	mov	yh, xh, lsr ip
+	mov	yl, xl, lsr ip
+	rsb	ip, ip, #32
+	orr	yl, yl, xh, lsl ip
+	mov	xh, xl, lsl ip
+	mov	xh, xh, lsr ip
+	mov	pc, lr
+
+	@ eq -> division by 1: obvious enough...
+9:	moveq	yl, xl
+	moveq	yh, xh
+	moveq	xh, #0
+	moveq	pc, lr
+
+	@ Division by 0:
+	str	lr, [sp, #-8]!
+	bl	__div0
+
+	@ as wrong as it could be...
+	mov	yl, #0
+	mov	yh, #0
+	mov	xh, #0
+	ldr	pc, [sp], #8
+
diff --git a/src/target/firmware/lib/lib1funcs.S b/src/target/firmware/lib/lib1funcs.S
new file mode 100644
index 00000000..b02a85eb
--- /dev/null
+++ b/src/target/firmware/lib/lib1funcs.S
@@ -0,0 +1,334 @@
+/*
+ * linux/arch/arm/lib/lib1funcs.S: Optimized ARM division routines
+ *
+ * Author: Nicolas Pitre <nico@cam.org>
+ *   - contributed to gcc-3.4 on Sep 30, 2003
+ *   - adapted for the Linux kernel on Oct 2, 2003
+ */
+
+/* Copyright 1995, 1996, 1998, 1999, 2000, 2003 Free Software Foundation, Inc.
+
+This file is free software; you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the
+Free Software Foundation; either version 2, or (at your option) any
+later version.
+
+In addition to the permissions in the GNU General Public License, the
+Free Software Foundation gives you unlimited permission to link the
+compiled version of this file into combinations with other programs,
+and to distribute those combinations without any restriction coming
+from the use of this file.  (The General Public License restrictions
+do apply in other respects; for example, they cover modification of
+the file, and distribution when not linked into a combine
+executable.)
+
+This file is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; see the file COPYING.  If not, write to
+the Free Software Foundation, 59 Temple Place - Suite 330,
+Boston, MA 02111-1307, USA.  */
+
+
+#include <asm/linkage.h>
+#include <asm/assembler.h>
+
+
+.macro ARM_DIV_BODY dividend, divisor, result, curbit
+
+#if __LINUX_ARM_ARCH__ >= 5
+
+	clz	\curbit, \divisor
+	clz	\result, \dividend
+	sub	\result, \curbit, \result
+	mov	\curbit, #1
+	mov	\divisor, \divisor, lsl \result
+	mov	\curbit, \curbit, lsl \result
+	mov	\result, #0
+	
+#else
+
+	@ Initially shift the divisor left 3 bits if possible,
+	@ set curbit accordingly.  This allows for curbit to be located
+	@ at the left end of each 4 bit nibbles in the division loop
+	@ to save one loop in most cases.
+	tst	\divisor, #0xe0000000
+	moveq	\divisor, \divisor, lsl #3
+	moveq	\curbit, #8
+	movne	\curbit, #1
+
+	@ Unless the divisor is very big, shift it up in multiples of
+	@ four bits, since this is the amount of unwinding in the main
+	@ division loop.  Continue shifting until the divisor is 
+	@ larger than the dividend.
+1:	cmp	\divisor, #0x10000000
+	cmplo	\divisor, \dividend
+	movlo	\divisor, \divisor, lsl #4
+	movlo	\curbit, \curbit, lsl #4
+	blo	1b
+
+	@ For very big divisors, we must shift it a bit at a time, or
+	@ we will be in danger of overflowing.
+1:	cmp	\divisor, #0x80000000
+	cmplo	\divisor, \dividend
+	movlo	\divisor, \divisor, lsl #1
+	movlo	\curbit, \curbit, lsl #1
+	blo	1b
+
+	mov	\result, #0
+
+#endif
+
+	@ Division loop
+1:	cmp	\dividend, \divisor
+	subhs	\dividend, \dividend, \divisor
+	orrhs	\result,   \result,   \curbit
+	cmp	\dividend, \divisor,  lsr #1
+	subhs	\dividend, \dividend, \divisor, lsr #1
+	orrhs	\result,   \result,   \curbit,  lsr #1
+	cmp	\dividend, \divisor,  lsr #2
+	subhs	\dividend, \dividend, \divisor, lsr #2
+	orrhs	\result,   \result,   \curbit,  lsr #2
+	cmp	\dividend, \divisor,  lsr #3
+	subhs	\dividend, \dividend, \divisor, lsr #3
+	orrhs	\result,   \result,   \curbit,  lsr #3
+	cmp	\dividend, #0			@ Early termination?
+	movnes	\curbit,   \curbit,  lsr #4	@ No, any more bits to do?
+	movne	\divisor,  \divisor, lsr #4
+	bne	1b
+
+.endm
+
+
+.macro ARM_DIV2_ORDER divisor, order
+
+#if __LINUX_ARM_ARCH__ >= 5
+
+	clz	\order, \divisor
+	rsb	\order, \order, #31
+
+#else
+
+	cmp	\divisor, #(1 << 16)
+	movhs	\divisor, \divisor, lsr #16
+	movhs	\order, #16
+	movlo	\order, #0
+
+	cmp	\divisor, #(1 << 8)
+	movhs	\divisor, \divisor, lsr #8
+	addhs	\order, \order, #8
+
+	cmp	\divisor, #(1 << 4)
+	movhs	\divisor, \divisor, lsr #4
+	addhs	\order, \order, #4
+
+	cmp	\divisor, #(1 << 2)
+	addhi	\order, \order, #3
+	addls	\order, \order, \divisor, lsr #1
+
+#endif
+
+.endm
+
+
+.macro ARM_MOD_BODY dividend, divisor, order, spare
+
+#if __LINUX_ARM_ARCH__ >= 5
+
+	clz	\order, \divisor
+	clz	\spare, \dividend
+	sub	\order, \order, \spare
+	mov	\divisor, \divisor, lsl \order
+
+#else
+
+	mov	\order, #0
+
+	@ Unless the divisor is very big, shift it up in multiples of
+	@ four bits, since this is the amount of unwinding in the main
+	@ division loop.  Continue shifting until the divisor is 
+	@ larger than the dividend.
+1:	cmp	\divisor, #0x10000000
+	cmplo	\divisor, \dividend
+	movlo	\divisor, \divisor, lsl #4
+	addlo	\order, \order, #4
+	blo	1b
+
+	@ For very big divisors, we must shift it a bit at a time, or
+	@ we will be in danger of overflowing.
+1:	cmp	\divisor, #0x80000000
+	cmplo	\divisor, \dividend
+	movlo	\divisor, \divisor, lsl #1
+	addlo	\order, \order, #1
+	blo	1b
+
+#endif
+
+	@ Perform all needed substractions to keep only the reminder.
+	@ Do comparisons in batch of 4 first.
+	subs	\order, \order, #3		@ yes, 3 is intended here
+	blt	2f
+
+1:	cmp	\dividend, \divisor
+	subhs	\dividend, \dividend, \divisor
+	cmp	\dividend, \divisor,  lsr #1
+	subhs	\dividend, \dividend, \divisor, lsr #1
+	cmp	\dividend, \divisor,  lsr #2
+	subhs	\dividend, \dividend, \divisor, lsr #2
+	cmp	\dividend, \divisor,  lsr #3
+	subhs	\dividend, \dividend, \divisor, lsr #3
+	cmp	\dividend, #1
+	mov	\divisor, \divisor, lsr #4
+	subges	\order, \order, #4
+	bge	1b
+
+	tst	\order, #3
+	teqne	\dividend, #0
+	beq	5f
+
+	@ Either 1, 2 or 3 comparison/substractions are left.
+2:	cmn	\order, #2
+	blt	4f
+	beq	3f
+	cmp	\dividend, \divisor
+	subhs	\dividend, \dividend, \divisor
+	mov	\divisor,  \divisor,  lsr #1
+3:	cmp	\dividend, \divisor
+	subhs	\dividend, \dividend, \divisor
+	mov	\divisor,  \divisor,  lsr #1
+4:	cmp	\dividend, \divisor
+	subhs	\dividend, \dividend, \divisor
+5:
+.endm
+
+
+ENTRY(__udivsi3)
+ENTRY(__aeabi_uidiv)
+
+	subs	r2, r1, #1
+	moveq	pc, lr
+	bcc	Ldiv0
+	cmp	r0, r1
+	bls	11f
+	tst	r1, r2
+	beq	12f
+
+	ARM_DIV_BODY r0, r1, r2, r3
+
+	mov	r0, r2
+	mov	pc, lr
+
+11:	moveq	r0, #1
+	movne	r0, #0
+	mov	pc, lr
+
+12:	ARM_DIV2_ORDER r1, r2
+
+	mov	r0, r0, lsr r2
+	mov	pc, lr
+
+
+ENTRY(__umodsi3)
+
+	subs	r2, r1, #1			@ compare divisor with 1
+	bcc	Ldiv0
+	cmpne	r0, r1				@ compare dividend with divisor
+	moveq   r0, #0
+	tsthi	r1, r2				@ see if divisor is power of 2
+	andeq	r0, r0, r2
+	movls	pc, lr
+
+	ARM_MOD_BODY r0, r1, r2, r3
+
+	mov	pc, lr
+
+
+ENTRY(__divsi3)
+ENTRY(__aeabi_idiv)
+
+	cmp	r1, #0
+	eor	ip, r0, r1			@ save the sign of the result.
+	beq	Ldiv0
+	rsbmi	r1, r1, #0			@ loops below use unsigned.
+	subs	r2, r1, #1			@ division by 1 or -1 ?
+	beq	10f
+	movs	r3, r0
+	rsbmi	r3, r0, #0			@ positive dividend value
+	cmp	r3, r1
+	bls	11f
+	tst	r1, r2				@ divisor is power of 2 ?
+	beq	12f
+
+	ARM_DIV_BODY r3, r1, r0, r2
+
+	cmp	ip, #0
+	rsbmi	r0, r0, #0
+	mov	pc, lr
+
+10:	teq	ip, r0				@ same sign ?
+	rsbmi	r0, r0, #0
+	mov	pc, lr
+
+11:	movlo	r0, #0
+	moveq	r0, ip, asr #31
+	orreq	r0, r0, #1
+	mov	pc, lr
+
+12:	ARM_DIV2_ORDER r1, r2
+
+	cmp	ip, #0
+	mov	r0, r3, lsr r2
+	rsbmi	r0, r0, #0
+	mov	pc, lr
+
+
+ENTRY(__modsi3)
+
+	cmp	r1, #0
+	beq	Ldiv0
+	rsbmi	r1, r1, #0			@ loops below use unsigned.
+	movs	ip, r0				@ preserve sign of dividend
+	rsbmi	r0, r0, #0			@ if negative make positive
+	subs	r2, r1, #1			@ compare divisor with 1
+	cmpne	r0, r1				@ compare dividend with divisor
+	moveq	r0, #0
+	tsthi	r1, r2				@ see if divisor is power of 2
+	andeq	r0, r0, r2
+	bls	10f
+
+	ARM_MOD_BODY r0, r1, r2, r3
+
+10:	cmp	ip, #0
+	rsbmi	r0, r0, #0
+	mov	pc, lr
+
+ENTRY(__aeabi_uidivmod)
+
+	stmfd	sp!, {r0, r1, ip, lr}
+	bl	__aeabi_uidiv
+	ldmfd	sp!, {r1, r2, ip, lr}
+	mul	r3, r0, r2
+	sub	r1, r1, r3
+	mov	pc, lr
+
+ENTRY(__aeabi_idivmod)
+
+	stmfd	sp!, {r0, r1, ip, lr}
+	bl	__aeabi_idiv
+	ldmfd	sp!, {r1, r2, ip, lr}
+	mul	r3, r0, r2
+	sub	r1, r1, r3
+	mov	pc, lr
+
+Ldiv0:
+
+	str	lr, [sp, #-8]!
+	bl	__div0
+	mov	r0, #0			@ About as wrong as it could be.
+	ldr	pc, [sp], #8
+
+ENTRY(__div0)
+	mov	pc, lr
diff --git a/src/target/firmware/lib/memcpy.S b/src/target/firmware/lib/memcpy.S
new file mode 100644
index 00000000..2bbd5692
--- /dev/null
+++ b/src/target/firmware/lib/memcpy.S
@@ -0,0 +1,59 @@
+/*
+ *  linux/arch/arm/lib/memcpy.S
+ *
+ *  Author:	Nicolas Pitre
+ *  Created:	Sep 28, 2005
+ *  Copyright:	MontaVista Software, Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  published by the Free Software Foundation.
+ */
+
+#include <asm/linkage.h>
+#include <asm/assembler.h>
+
+	.macro ldr1w ptr reg abort
+	ldr \reg, [\ptr], #4
+	.endm
+
+	.macro ldr4w ptr reg1 reg2 reg3 reg4 abort
+	ldmia \ptr!, {\reg1, \reg2, \reg3, \reg4}
+	.endm
+
+	.macro ldr8w ptr reg1 reg2 reg3 reg4 reg5 reg6 reg7 reg8 abort
+	ldmia \ptr!, {\reg1, \reg2, \reg3, \reg4, \reg5, \reg6, \reg7, \reg8}
+	.endm
+
+	.macro ldr1b ptr reg cond=al abort
+	ldr\cond\()b \reg, [\ptr], #1
+	.endm
+
+	.macro str1w ptr reg abort
+	str \reg, [\ptr], #4
+	.endm
+
+	.macro str8w ptr reg1 reg2 reg3 reg4 reg5 reg6 reg7 reg8 abort
+	stmia \ptr!, {\reg1, \reg2, \reg3, \reg4, \reg5, \reg6, \reg7, \reg8}
+	.endm
+
+	.macro str1b ptr reg cond=al abort
+	str\cond\()b \reg, [\ptr], #1
+	.endm
+
+	.macro enter reg1 reg2
+	stmdb sp!, {r0, \reg1, \reg2}
+	.endm
+
+	.macro exit reg1 reg2
+	ldmfd sp!, {r0, \reg1, \reg2}
+	.endm
+
+	.text
+
+/* Prototype: void *memcpy(void *dest, const void *src, size_t n); */
+
+ENTRY(memcpy)
+
+#include "copy_template.S"
+
diff --git a/src/target/firmware/lib/memset.S b/src/target/firmware/lib/memset.S
new file mode 100644
index 00000000..04e254a8
--- /dev/null
+++ b/src/target/firmware/lib/memset.S
@@ -0,0 +1,80 @@
+/*
+ *  linux/arch/arm/lib/memset.S
+ *
+ *  Copyright (C) 1995-2000 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ *  ASM optimised string functions
+ */
+#include <asm/linkage.h>
+#include <asm/assembler.h>
+
+	.text
+	.align	5
+	.word	0
+
+1:	subs	r2, r2, #4		@ 1 do we have enough
+	blt	5f			@ 1 bytes to align with?
+	cmp	r3, #2			@ 1
+	strltb	r1, [r0], #1		@ 1
+	strleb	r1, [r0], #1		@ 1
+	strb	r1, [r0], #1		@ 1
+	add	r2, r2, r3		@ 1 (r2 = r2 - (4 - r3))
+/*
+ * The pointer is now aligned and the length is adjusted.  Try doing the
+ * memzero again.
+ */
+
+ENTRY(memset)
+	ands	r3, r0, #3		@ 1 unaligned?
+	bne	1b			@ 1
+/*
+ * we know that the pointer in r0 is aligned to a word boundary.
+ */
+	orr	r1, r1, r1, lsl #8
+	orr	r1, r1, r1, lsl #16
+	mov	r3, r1
+	cmp	r2, #16
+	blt	4f
+/*
+ * We need an extra register for this loop - save the return address and
+ * use the LR
+ */
+	str	lr, [sp, #-4]!
+	mov	ip, r1
+	mov	lr, r1
+
+2:	subs	r2, r2, #64
+	stmgeia	r0!, {r1, r3, ip, lr}	@ 64 bytes at a time.
+	stmgeia	r0!, {r1, r3, ip, lr}
+	stmgeia	r0!, {r1, r3, ip, lr}
+	stmgeia	r0!, {r1, r3, ip, lr}
+	bgt	2b
+	LOADREGS(eqfd, sp!, {pc})	@ Now <64 bytes to go.
+/*
+ * No need to correct the count; we're only testing bits from now on
+ */
+	tst	r2, #32
+	stmneia	r0!, {r1, r3, ip, lr}
+	stmneia	r0!, {r1, r3, ip, lr}
+	tst	r2, #16
+	stmneia	r0!, {r1, r3, ip, lr}
+	ldr	lr, [sp], #4
+
+4:	tst	r2, #8
+	stmneia	r0!, {r1, r3}
+	tst	r2, #4
+	strne	r1, [r0], #4
+/*
+ * When we get here, we've got less than 4 bytes to zero.  We
+ * may have an unaligned pointer as well.
+ */
+5:	tst	r2, #2
+	strneb	r1, [r0], #1
+	strneb	r1, [r0], #1
+	tst	r2, #1
+	strneb	r1, [r0], #1
+	RETINSTR(mov,pc,lr)
diff --git a/src/target/firmware/lib/printf.c b/src/target/firmware/lib/printf.c
new file mode 100644
index 00000000..a4fc6876
--- /dev/null
+++ b/src/target/firmware/lib/printf.c
@@ -0,0 +1,19 @@
+
+#include <stdio.h>
+#include <stdarg.h>
+
+static char printf_buffer[1024];
+
+int printf(const char *fmt, ...)
+{
+	va_list args;
+	int r;
+
+	va_start(args, fmt);
+	r = vsnprintf(printf_buffer, sizeof(printf_buffer), fmt, args);
+	va_end(args);
+
+	puts(printf_buffer);
+
+	return r;
+}
diff --git a/src/target/firmware/lib/setbit.S b/src/target/firmware/lib/setbit.S
new file mode 100644
index 00000000..9009bc1e
--- /dev/null
+++ b/src/target/firmware/lib/setbit.S
@@ -0,0 +1,22 @@
+/*
+ *  linux/arch/arm/lib/setbit.S
+ *
+ *  Copyright (C) 1995-1996 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <asm/linkage.h>
+#include <asm/assembler.h>
+#include "bitops.h"
+		.text
+
+/*
+ * Purpose  : Function to set a bit
+ * Prototype: int set_bit(int bit, void *addr)
+ */
+ENTRY(_set_bit_be)
+		eor	r0, r0, #0x18		@ big endian byte ordering
+ENTRY(_set_bit_le)
+	bitop	orr
diff --git a/src/target/firmware/lib/string.c b/src/target/firmware/lib/string.c
new file mode 100644
index 00000000..97036528
--- /dev/null
+++ b/src/target/firmware/lib/string.c
@@ -0,0 +1,50 @@
+/*
+ *  linux/lib/string.c
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ */
+
+/*
+ * stupid library routines.. The optimized versions should generally be found
+ * as inline code in <asm-xx/string.h>
+ *
+ * These are buggy as well..
+ *
+ * * Fri Jun 25 1999, Ingo Oeser <ioe@informatik.tu-chemnitz.de>
+ * -  Added strsep() which will replace strtok() soon (because strsep() is
+ *    reentrant and should be faster). Use only strsep() in new code, please.
+ *
+ * * Sat Feb 09 2002, Jason Thomas <jason@topic.com.au>,
+ *                    Matthew Hawkins <matt@mh.dropbear.id.au>
+ * -  Kissed strtok() goodbye
+ */
+
+#include <sys/types.h>
+#include <string.h>
+#include <ctype.h>
+
+
+#ifndef __HAVE_ARCH_STRNLEN
+/**
+ * strnlen - Find the length of a length-limited string
+ * @s: The string to be sized
+ * @count: The maximum number of bytes to search
+ */
+size_t strnlen(const char *s, size_t count)
+{
+	const char *sc;
+
+	for (sc = s; count-- && *sc != '\0'; ++sc)
+		/* nothing */;
+	return sc - s;
+}
+#endif
+
+size_t strlen(const char *s)
+{
+	const char *sc;
+
+	for (sc = s; *sc != '\0'; ++sc)
+		/* nothing */;
+	return sc - s;
+}
diff --git a/src/target/firmware/lib/testchangebit.S b/src/target/firmware/lib/testchangebit.S
new file mode 100644
index 00000000..37c303e3
--- /dev/null
+++ b/src/target/firmware/lib/testchangebit.S
@@ -0,0 +1,18 @@
+/*
+ *  linux/arch/arm/lib/testchangebit.S
+ *
+ *  Copyright (C) 1995-1996 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <asm/linkage.h>
+#include <asm/assembler.h>
+#include "bitops.h"
+                .text
+
+ENTRY(_test_and_change_bit_be)
+		eor	r0, r0, #0x18		@ big endian byte ordering
+ENTRY(_test_and_change_bit_le)
+	testop	eor, strb
diff --git a/src/target/firmware/lib/testclearbit.S b/src/target/firmware/lib/testclearbit.S
new file mode 100644
index 00000000..985c3996
--- /dev/null
+++ b/src/target/firmware/lib/testclearbit.S
@@ -0,0 +1,18 @@
+/*
+ *  linux/arch/arm/lib/testclearbit.S
+ *
+ *  Copyright (C) 1995-1996 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <asm/linkage.h>
+#include <asm/assembler.h>
+#include "bitops.h"
+                .text
+
+ENTRY(_test_and_clear_bit_be)
+		eor	r0, r0, #0x18		@ big endian byte ordering
+ENTRY(_test_and_clear_bit_le)
+	testop	bicne, strneb
diff --git a/src/target/firmware/lib/testsetbit.S b/src/target/firmware/lib/testsetbit.S
new file mode 100644
index 00000000..4a8a164b
--- /dev/null
+++ b/src/target/firmware/lib/testsetbit.S
@@ -0,0 +1,18 @@
+/*
+ *  linux/arch/arm/lib/testsetbit.S
+ *
+ *  Copyright (C) 1995-1996 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <asm/linkage.h>
+#include <asm/assembler.h>
+#include "bitops.h"
+                .text
+
+ENTRY(_test_and_set_bit_be)
+		eor	r0, r0, #0x18		@ big endian byte ordering
+ENTRY(_test_and_set_bit_le)
+	testop	orreq, streqb
diff --git a/src/target/firmware/lib/vsprintf.c b/src/target/firmware/lib/vsprintf.c
new file mode 100644
index 00000000..80e8c1ad
--- /dev/null
+++ b/src/target/firmware/lib/vsprintf.c
@@ -0,0 +1,847 @@
+/*
+ *  linux/lib/vsprintf.c
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ */
+
+/* vsprintf.c -- Lars Wirzenius & Linus Torvalds. */
+/*
+ * Wirzenius wrote this portably, Torvalds fucked it up :-)
+ */
+
+/* 
+ * Fri Jul 13 2001 Crutcher Dunnavant <crutcher+kernel@datastacks.com>
+ * - changed to provide snprintf and vsnprintf functions
+ * So Feb  1 16:51:32 CET 2004 Juergen Quade <quade@hsnr.de>
+ * - scnprintf and vscnprintf
+ */
+
+#include <stdio.h>
+#include <limits.h>
+#include <stdarg.h>
+#include <sys/types.h>
+#include <string.h>
+#include <ctype.h>
+
+#include <asm/div64.h>
+
+/**
+ * strtoul - convert a string to an unsigned long
+ * @cp: The start of the string
+ * @endp: A pointer to the end of the parsed string will be placed here
+ * @base: The number base to use
+ */
+unsigned long strtoul(const char *cp,char **endp,unsigned int base)
+{
+	unsigned long result = 0,value;
+
+	if (!base) {
+		base = 10;
+		if (*cp == '0') {
+			base = 8;
+			cp++;
+			if ((toupper(*cp) == 'X') && isxdigit(cp[1])) {
+				cp++;
+				base = 16;
+			}
+		}
+	} else if (base == 16) {
+		if (cp[0] == '0' && toupper(cp[1]) == 'X')
+			cp += 2;
+	}
+	while (isxdigit(*cp) &&
+	       (value = isdigit(*cp) ? *cp-'0' : toupper(*cp)-'A'+10) < base) {
+		result = result*base + value;
+		cp++;
+	}
+	if (endp)
+		*endp = (char *)cp;
+	return result;
+}
+
+
+/**
+ * strtol - convert a string to a signed long
+ * @cp: The start of the string
+ * @endp: A pointer to the end of the parsed string will be placed here
+ * @base: The number base to use
+ */
+long strtol(const char *cp,char **endp,unsigned int base)
+{
+	if(*cp=='-')
+		return -strtoul(cp+1,endp,base);
+	return strtoul(cp,endp,base);
+}
+
+
+/**
+ * strtoull - convert a string to an unsigned long long
+ * @cp: The start of the string
+ * @endp: A pointer to the end of the parsed string will be placed here
+ * @base: The number base to use
+ */
+unsigned long long strtoull(const char *cp,char **endp,unsigned int base)
+{
+	unsigned long long result = 0,value;
+
+	if (!base) {
+		base = 10;
+		if (*cp == '0') {
+			base = 8;
+			cp++;
+			if ((toupper(*cp) == 'X') && isxdigit(cp[1])) {
+				cp++;
+				base = 16;
+			}
+		}
+	} else if (base == 16) {
+		if (cp[0] == '0' && toupper(cp[1]) == 'X')
+			cp += 2;
+	}
+	while (isxdigit(*cp) && (value = isdigit(*cp) ? *cp-'0' : (islower(*cp)
+	    ? toupper(*cp) : *cp)-'A'+10) < base) {
+		result = result*base + value;
+		cp++;
+	}
+	if (endp)
+		*endp = (char *)cp;
+	return result;
+}
+
+
+/**
+ * strtoll - convert a string to a signed long long
+ * @cp: The start of the string
+ * @endp: A pointer to the end of the parsed string will be placed here
+ * @base: The number base to use
+ */
+long long strtoll(const char *cp,char **endp,unsigned int base)
+{
+	if(*cp=='-')
+		return -strtoull(cp+1,endp,base);
+	return strtoull(cp,endp,base);
+}
+
+static int skip_atoi(const char **s)
+{
+	int i=0;
+
+	while (isdigit(**s))
+		i = i*10 + *((*s)++) - '0';
+	return i;
+}
+
+#define ZEROPAD	1		/* pad with zero */
+#define SIGN	2		/* unsigned/signed long */
+#define PLUS	4		/* show plus */
+#define SPACE	8		/* space if plus */
+#define LEFT	16		/* left justified */
+#define SPECIAL	32		/* 0x */
+#define LARGE	64		/* use 'ABCDEF' instead of 'abcdef' */
+
+static char * number(char * buf, char * end, unsigned long long num, int base, int size, int precision, int type)
+{
+	char c,sign,tmp[66];
+	const char *digits;
+	static const char small_digits[] = "0123456789abcdefghijklmnopqrstuvwxyz";
+	static const char large_digits[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+	int i;
+
+	digits = (type & LARGE) ? large_digits : small_digits;
+	if (type & LEFT)
+		type &= ~ZEROPAD;
+	if (base < 2 || base > 36)
+		return NULL;
+	c = (type & ZEROPAD) ? '0' : ' ';
+	sign = 0;
+	if (type & SIGN) {
+		if ((signed long long) num < 0) {
+			sign = '-';
+			num = - (signed long long) num;
+			size--;
+		} else if (type & PLUS) {
+			sign = '+';
+			size--;
+		} else if (type & SPACE) {
+			sign = ' ';
+			size--;
+		}
+	}
+	if (type & SPECIAL) {
+		if (base == 16)
+			size -= 2;
+		else if (base == 8)
+			size--;
+	}
+	i = 0;
+	if (num == 0)
+		tmp[i++]='0';
+	else while (num != 0)
+		tmp[i++] = digits[do_div(num,base)];
+	if (i > precision)
+		precision = i;
+	size -= precision;
+	if (!(type&(ZEROPAD+LEFT))) {
+		while(size-->0) {
+			if (buf <= end)
+				*buf = ' ';
+			++buf;
+		}
+	}
+	if (sign) {
+		if (buf <= end)
+			*buf = sign;
+		++buf;
+	}
+	if (type & SPECIAL) {
+		if (base==8) {
+			if (buf <= end)
+				*buf = '0';
+			++buf;
+		} else if (base==16) {
+			if (buf <= end)
+				*buf = '0';
+			++buf;
+			if (buf <= end)
+				*buf = digits[33];
+			++buf;
+		}
+	}
+	if (!(type & LEFT)) {
+		while (size-- > 0) {
+			if (buf <= end)
+				*buf = c;
+			++buf;
+		}
+	}
+	while (i < precision--) {
+		if (buf <= end)
+			*buf = '0';
+		++buf;
+	}
+	while (i-- > 0) {
+		if (buf <= end)
+			*buf = tmp[i];
+		++buf;
+	}
+	while (size-- > 0) {
+		if (buf <= end)
+			*buf = ' ';
+		++buf;
+	}
+	return buf;
+}
+
+/**
+ * vsnprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @size: The size of the buffer, including the trailing null space
+ * @fmt: The format string to use
+ * @args: Arguments for the format string
+ *
+ * The return value is the number of characters which would
+ * be generated for the given input, excluding the trailing
+ * '\0', as per ISO C99. If you want to have the exact
+ * number of characters written into @buf as return value
+ * (not including the trailing '\0'), use vscnprintf. If the
+ * return is greater than or equal to @size, the resulting
+ * string is truncated.
+ *
+ * Call this function if you are already dealing with a va_list.
+ * You probably want snprintf instead.
+ */
+int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
+{
+	int len;
+	unsigned long long num;
+	int i, base;
+	char *str, *end, c;
+	const char *s;
+
+	int flags;		/* flags to number() */
+
+	int field_width;	/* width of output field */
+	int precision;		/* min. # of digits for integers; max
+				   number of chars for from string */
+	int qualifier;		/* 'h', 'l', or 'L' for integer fields */
+				/* 'z' support added 23/7/1999 S.H.    */
+				/* 'z' changed to 'Z' --davidm 1/25/99 */
+				/* 't' added for ptrdiff_t */
+
+	/* Reject out-of-range values early */
+	if ((int) size < 0) {
+		return 0;
+	}
+
+	str = buf;
+	end = buf + size - 1;
+
+	if (end < buf - 1) {
+		end = ((void *) -1);
+		size = end - buf + 1;
+	}
+
+	for (; *fmt ; ++fmt) {
+		if (*fmt != '%') {
+			if (str <= end)
+				*str = *fmt;
+			++str;
+			continue;
+		}
+
+		/* process flags */
+		flags = 0;
+		repeat:
+			++fmt;		/* this also skips first '%' */
+			switch (*fmt) {
+				case '-': flags |= LEFT; goto repeat;
+				case '+': flags |= PLUS; goto repeat;
+				case ' ': flags |= SPACE; goto repeat;
+				case '#': flags |= SPECIAL; goto repeat;
+				case '0': flags |= ZEROPAD; goto repeat;
+			}
+
+		/* get field width */
+		field_width = -1;
+		if (isdigit(*fmt))
+			field_width = skip_atoi(&fmt);
+		else if (*fmt == '*') {
+			++fmt;
+			/* it's the next argument */
+			field_width = va_arg(args, int);
+			if (field_width < 0) {
+				field_width = -field_width;
+				flags |= LEFT;
+			}
+		}
+
+		/* get the precision */
+		precision = -1;
+		if (*fmt == '.') {
+			++fmt;	
+			if (isdigit(*fmt))
+				precision = skip_atoi(&fmt);
+			else if (*fmt == '*') {
+				++fmt;
+				/* it's the next argument */
+				precision = va_arg(args, int);
+			}
+			if (precision < 0)
+				precision = 0;
+		}
+
+		/* get the conversion qualifier */
+		qualifier = -1;
+		if (*fmt == 'h' || *fmt == 'l' || *fmt == 'L' ||
+		    *fmt =='Z' || *fmt == 'z' || *fmt == 't') {
+			qualifier = *fmt;
+			++fmt;
+			if (qualifier == 'l' && *fmt == 'l') {
+				qualifier = 'L';
+				++fmt;
+			}
+		}
+
+		/* default base */
+		base = 10;
+
+		switch (*fmt) {
+			case 'c':
+				if (!(flags & LEFT)) {
+					while (--field_width > 0) {
+						if (str <= end)
+							*str = ' ';
+						++str;
+					}
+				}
+				c = (unsigned char) va_arg(args, int);
+				if (str <= end)
+					*str = c;
+				++str;
+				while (--field_width > 0) {
+					if (str <= end)
+						*str = ' ';
+					++str;
+				}
+				continue;
+
+			case 's':
+				s = va_arg(args, char *);
+
+				len = strnlen(s, precision);
+
+				if (!(flags & LEFT)) {
+					while (len < field_width--) {
+						if (str <= end)
+							*str = ' ';
+						++str;
+					}
+				}
+				for (i = 0; i < len; ++i) {
+					if (str <= end)
+						*str = *s;
+					++str; ++s;
+				}
+				while (len < field_width--) {
+					if (str <= end)
+						*str = ' ';
+					++str;
+				}
+				continue;
+
+			case 'p':
+				if (field_width == -1) {
+					field_width = 2*sizeof(void *);
+					flags |= ZEROPAD;
+				}
+				str = number(str, end,
+						(unsigned long) va_arg(args, void *),
+						16, field_width, precision, flags);
+				continue;
+
+
+			case 'n':
+				/* FIXME:
+				* What does C99 say about the overflow case here? */
+				if (qualifier == 'l') {
+					long * ip = va_arg(args, long *);
+					*ip = (str - buf);
+				} else if (qualifier == 'Z' || qualifier == 'z') {
+					size_t * ip = va_arg(args, size_t *);
+					*ip = (str - buf);
+				} else {
+					int * ip = va_arg(args, int *);
+					*ip = (str - buf);
+				}
+				continue;
+
+			case '%':
+				if (str <= end)
+					*str = '%';
+				++str;
+				continue;
+
+				/* integer number formats - set up the flags and "break" */
+			case 'o':
+				base = 8;
+				break;
+
+			case 'X':
+				flags |= LARGE;
+			case 'x':
+				base = 16;
+				break;
+
+			case 'd':
+			case 'i':
+				flags |= SIGN;
+			case 'u':
+				break;
+
+			default:
+				if (str <= end)
+					*str = '%';
+				++str;
+				if (*fmt) {
+					if (str <= end)
+						*str = *fmt;
+					++str;
+				} else {
+					--fmt;
+				}
+				continue;
+		}
+		if (qualifier == 'L')
+			num = va_arg(args, long long);
+		else if (qualifier == 'l') {
+			num = va_arg(args, unsigned long);
+			if (flags & SIGN)
+				num = (signed long) num;
+		} else if (qualifier == 'Z' || qualifier == 'z') {
+			num = va_arg(args, size_t);
+		} else if (qualifier == 't') {
+			num = va_arg(args, long);
+		} else if (qualifier == 'h') {
+			num = (unsigned short) va_arg(args, int);
+			if (flags & SIGN)
+				num = (signed short) num;
+		} else {
+			num = va_arg(args, unsigned int);
+			if (flags & SIGN)
+				num = (signed int) num;
+		}
+		str = number(str, end, num, base,
+				field_width, precision, flags);
+	}
+	if (str <= end)
+		*str = '\0';
+	else if (size > 0)
+		/* don't write out a null byte if the buf size is zero */
+		*end = '\0';
+	/* the trailing null byte doesn't count towards the total
+	* ++str;
+	*/
+	return str-buf;
+}
+
+
+/**
+ * vscnprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @size: The size of the buffer, including the trailing null space
+ * @fmt: The format string to use
+ * @args: Arguments for the format string
+ *
+ * The return value is the number of characters which have been written into
+ * the @buf not including the trailing '\0'. If @size is <= 0 the function
+ * returns 0.
+ *
+ * Call this function if you are already dealing with a va_list.
+ * You probably want scnprintf instead.
+ */
+int vscnprintf(char *buf, size_t size, const char *fmt, va_list args)
+{
+	unsigned int i;
+
+	i=vsnprintf(buf,size,fmt,args);
+	return (i >= size) ? (size - 1) : i;
+}
+
+
+/**
+ * snprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @size: The size of the buffer, including the trailing null space
+ * @fmt: The format string to use
+ * @...: Arguments for the format string
+ *
+ * The return value is the number of characters which would be
+ * generated for the given input, excluding the trailing null,
+ * as per ISO C99.  If the return is greater than or equal to
+ * @size, the resulting string is truncated.
+ */
+int snprintf(char * buf, size_t size, const char *fmt, ...)
+{
+	va_list args;
+	int i;
+
+	va_start(args, fmt);
+	i=vsnprintf(buf,size,fmt,args);
+	va_end(args);
+	return i;
+}
+
+
+/**
+ * scnprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @size: The size of the buffer, including the trailing null space
+ * @fmt: The format string to use
+ * @...: Arguments for the format string
+ *
+ * The return value is the number of characters written into @buf not including
+ * the trailing '\0'. If @size is <= 0 the function returns 0. If the return is
+ * greater than or equal to @size, the resulting string is truncated.
+ */
+
+int scnprintf(char * buf, size_t size, const char *fmt, ...)
+{
+	va_list args;
+	unsigned int i;
+
+	va_start(args, fmt);
+	i = vsnprintf(buf, size, fmt, args);
+	va_end(args);
+	return (i >= size) ? (size - 1) : i;
+}
+
+/**
+ * vsprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @fmt: The format string to use
+ * @args: Arguments for the format string
+ *
+ * The function returns the number of characters written
+ * into @buf. Use vsnprintf or vscnprintf in order to avoid
+ * buffer overflows.
+ *
+ * Call this function if you are already dealing with a va_list.
+ * You probably want sprintf instead.
+ */
+int vsprintf(char *buf, const char *fmt, va_list args)
+{
+	return vsnprintf(buf, INT_MAX, fmt, args);
+}
+
+
+/**
+ * sprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @fmt: The format string to use
+ * @...: Arguments for the format string
+ *
+ * The function returns the number of characters written
+ * into @buf. Use snprintf or scnprintf in order to avoid
+ * buffer overflows.
+ */
+int sprintf(char * buf, const char *fmt, ...)
+{
+	va_list args;
+	int i;
+
+	va_start(args, fmt);
+	i=vsnprintf(buf, INT_MAX, fmt, args);
+	va_end(args);
+	return i;
+}
+
+
+/**
+ * vsscanf - Unformat a buffer into a list of arguments
+ * @buf:	input buffer
+ * @fmt:	format of buffer
+ * @args:	arguments
+ */
+int vsscanf(const char * buf, const char * fmt, va_list args)
+{
+	const char *str = buf;
+	char *next;
+	char digit;
+	int num = 0;
+	int qualifier;
+	int base;
+	int field_width;
+	int is_sign = 0;
+
+	while(*fmt && *str) {
+		/* skip any white space in format */
+		/* white space in format matchs any amount of
+		 * white space, including none, in the input.
+		 */
+		if (isspace(*fmt)) {
+			while (isspace(*fmt))
+				++fmt;
+			while (isspace(*str))
+				++str;
+		}
+
+		/* anything that is not a conversion must match exactly */
+		if (*fmt != '%' && *fmt) {
+			if (*fmt++ != *str++)
+				break;
+			continue;
+		}
+
+		if (!*fmt)
+			break;
+		++fmt;
+		
+		/* skip this conversion.
+		 * advance both strings to next white space
+		 */
+		if (*fmt == '*') {
+			while (!isspace(*fmt) && *fmt)
+				fmt++;
+			while (!isspace(*str) && *str)
+				str++;
+			continue;
+		}
+
+		/* get field width */
+		field_width = -1;
+		if (isdigit(*fmt))
+			field_width = skip_atoi(&fmt);
+
+		/* get conversion qualifier */
+		qualifier = -1;
+		if (*fmt == 'h' || *fmt == 'l' || *fmt == 'L' ||
+		    *fmt == 'Z' || *fmt == 'z') {
+			qualifier = *fmt++;
+			if (qualifier == *fmt) {
+				if (qualifier == 'h') {
+					qualifier = 'H';
+					fmt++;
+				} else if (qualifier == 'l') {
+					qualifier = 'L';
+					fmt++;
+				}
+			}
+		}
+		base = 10;
+		is_sign = 0;
+
+		if (!*fmt || !*str)
+			break;
+
+		switch(*fmt++) {
+		case 'c':
+		{
+			char *s = (char *) va_arg(args,char*);
+			if (field_width == -1)
+				field_width = 1;
+			do {
+				*s++ = *str++;
+			} while (--field_width > 0 && *str);
+			num++;
+		}
+		continue;
+		case 's':
+		{
+			char *s = (char *) va_arg(args, char *);
+			if(field_width == -1)
+				field_width = INT_MAX;
+			/* first, skip leading white space in buffer */
+			while (isspace(*str))
+				str++;
+
+			/* now copy until next white space */
+			while (*str && !isspace(*str) && field_width--) {
+				*s++ = *str++;
+			}
+			*s = '\0';
+			num++;
+		}
+		continue;
+		case 'n':
+			/* return number of characters read so far */
+		{
+			int *i = (int *)va_arg(args,int*);
+			*i = str - buf;
+		}
+		continue;
+		case 'o':
+			base = 8;
+			break;
+		case 'x':
+		case 'X':
+			base = 16;
+			break;
+		case 'i':
+                        base = 0;
+		case 'd':
+			is_sign = 1;
+		case 'u':
+			break;
+		case '%':
+			/* looking for '%' in str */
+			if (*str++ != '%') 
+				return num;
+			continue;
+		default:
+			/* invalid format; stop here */
+			return num;
+		}
+
+		/* have some sort of integer conversion.
+		 * first, skip white space in buffer.
+		 */
+		while (isspace(*str))
+			str++;
+
+		digit = *str;
+		if (is_sign && digit == '-')
+			digit = *(str + 1);
+
+		if (!digit
+                    || (base == 16 && !isxdigit(digit))
+                    || (base == 10 && !isdigit(digit))
+                    || (base == 8 && (!isdigit(digit) || digit > '7'))
+                    || (base == 0 && !isdigit(digit)))
+				break;
+
+		switch(qualifier) {
+		case 'H':	/* that's 'hh' in format */
+			if (is_sign) {
+				signed char *s = (signed char *) va_arg(args,signed char *);
+				*s = (signed char) strtol(str,&next,base);
+			} else {
+				unsigned char *s = (unsigned char *) va_arg(args, unsigned char *);
+				*s = (unsigned char) strtoul(str, &next, base);
+			}
+			break;
+		case 'h':
+			if (is_sign) {
+				short *s = (short *) va_arg(args,short *);
+				*s = (short) strtol(str,&next,base);
+			} else {
+				unsigned short *s = (unsigned short *) va_arg(args, unsigned short *);
+				*s = (unsigned short) strtoul(str, &next, base);
+			}
+			break;
+		case 'l':
+			if (is_sign) {
+				long *l = (long *) va_arg(args,long *);
+				*l = strtol(str,&next,base);
+			} else {
+				unsigned long *l = (unsigned long*) va_arg(args,unsigned long*);
+				*l = strtoul(str,&next,base);
+			}
+			break;
+		case 'L':
+			if (is_sign) {
+				long long *l = (long long*) va_arg(args,long long *);
+				*l = strtoll(str,&next,base);
+			} else {
+				unsigned long long *l = (unsigned long long*) va_arg(args,unsigned long long*);
+				*l = strtoull(str,&next,base);
+			}
+			break;
+		case 'Z':
+		case 'z':
+		{
+			size_t *s = (size_t*) va_arg(args,size_t*);
+			*s = (size_t) strtoul(str,&next,base);
+		}
+		break;
+		default:
+			if (is_sign) {
+				int *i = (int *) va_arg(args, int*);
+				*i = (int) strtol(str,&next,base);
+			} else {
+				unsigned int *i = (unsigned int*) va_arg(args, unsigned int*);
+				*i = (unsigned int) strtoul(str,&next,base);
+			}
+			break;
+		}
+		num++;
+
+		if (!next)
+			break;
+		str = next;
+	}
+	return num;
+}
+
+
+/**
+ * sscanf - Unformat a buffer into a list of arguments
+ * @buf:	input buffer
+ * @fmt:	formatting of buffer
+ * @...:	resulting arguments
+ */
+int sscanf(const char * buf, const char * fmt, ...)
+{
+	va_list args;
+	int i;
+
+	va_start(args,fmt);
+	i = vsscanf(buf,fmt,args);
+	va_end(args);
+	return i;
+}
+
+/* generic puts() implementation independent of who provides putchar() */
+int puts(const char *s)
+{
+#ifdef ARCH_HAS_CONSOLE
+	return _puts(s);
+#else
+	while (1) {
+		char c = *s++;
+		if (c == 0)
+			return;
+		putchar(c);
+	}
+	return 0;
+#endif
+}
diff --git a/src/target/firmware/rf/mt6139.c b/src/target/firmware/rf/mt6139.c
new file mode 100644
index 00000000..d48e6529
--- /dev/null
+++ b/src/target/firmware/rf/mt6139.c
@@ -0,0 +1,205 @@
+/* Driver for RF Transceiver Circuit (MT6139) */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <keypad.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <layer1/agc.h>
+#include <rffe.h>
+
+#include <mtk/mt6139.h>
+
+static void mt6139_compute_pll(uint32_t f_vco_100khz,
+			       uint16_t *nint, uint16_t *nfrac)
+{
+	/* To compute Nint, we assume Nfrac is zero */
+	*nint = (fvco_100khz / (10 * 2 * 26)) - (0 / 130);
+
+	if (*nint > 127)
+		printf("VCO Frequency %u kHz is out of spec\n", f_vco_100khz);
+
+	/* Compute Nfract using the pre-computed Nint */
+	/* Nfrac = ( (Fvco/2*26) - Nint) * 130 */
+	/* Nfrac = ( (Fvco*130)/(2*26) - (Nint * 130) */
+	*nfrac = (f_vco_100khz*130)/(52*10) - (*nint * 130);
+}
+
+/* Set ARFCN.  Takes 2 reg_write, i.e. 8 TPU instructions */
+void mt6139_set_arfcn(uint16_t arfcn, int uplink)
+{
+	uint32_t regval = 0;
+	uint32_t vco_mult;
+	uint32_t freq_khz, f_vco_100khz;
+	uint16_t nint, nfrac;
+
+	freq_khz = gsm_arfcn2freq10(arfcn, uplink) * 100;
+	printd("ARFCN %u -> %u kHz\n", arfcn, freq_khz);
+
+	switch (gsm_arfcn2band(arfcn)) {
+	case GSM_BAND_850:
+		if (uplink)
+			regval |= MT6139_CW1_TRX_850;
+		regval |= (0 << MT6139_CW1_BAND_SHIFT);
+		vco_mult = 4;
+		break;
+	case GSM_BAND_900:
+		regval |= (1 << MT6139_CW1_BAND_SHIFT);
+		vco_mult = 4;
+		break;
+	case GSM_BAND_1800:
+		regval |= (2 << MT6139_CW1_BAND_SHIFT);
+		vco_mult = 2;
+		break;
+	case GSM_BAND_1900:
+		regval |= (3 << MT6139_CW1_BAND_SHIFT);
+		vco_mult = 2;
+		break;
+	default:
+		printf("Unsupported rf_band.\n");
+		break;
+	}
+
+	/* Compute VCO frequency for channel frequency */
+	f_vco_100khz = (freq_khz / 100) * vco_mult;
+
+	/* Compute Nint and Nfract */
+	mt6139_compute_pll(f_vco_100khz, &nint, &nfrac);
+
+	/* mask-in the Nint / Nfrac bits in CW1 */
+	regval |= (nfrac & 0xff) << MT6139_CW1_NFRACT_SHIFT;
+	regval |= (nint & 0x7f) << MT6139_CW1_NINT_SHIFT;
+
+}
+
+void mt6139_init()
+{
+	uint32_t val;
+
+	/* reset and get it out of reset again */
+	val = MT6139_CW0_DIEN | (0x20 << MT6139_CW0_AFC_SHIFT);
+	mt6139_reg_write(0, val | MT6139_CW0_POR);
+	mt6139_reg_write(0, val);
+
+	/* Turn off AM and A loop calibration function (CM9) */
+	val = (0x40 << MT6139_CW9_DCD_CQ_SHIFT) |
+	      (0x40 << MT6139_CW9_DCD_BQ_SHIFT) |
+	      MT6139_CW9_PWR_DAC_C | MT6139_CW9_PWR_DAC_B;
+	mt6139_reg_write(9, val);
+
+	/* Move to SLEEP mode */
+	val = (0x3e << MT6139_CW2_GAINTBL_SHIFT) |
+	      (MODE_SLEEP << MT6139_CW2_MODE_SHIFT) |
+	      MT6139_CW2_AUTO_CAL |
+	      (0x20 << MT6139_CW2_DCD_AQ_SHIFT) |
+	      (0x20 << MT6139_CW2_DCD_AI_SHIFT);
+	mt6139_reg_write(2, val);
+}
+
+void mt6139_rx_burst()
+{
+	uint8_t pga_gain;
+
+	/* Turn on the synthesizer and move into Warm-up mode */
+	val = (0x3e << MT6139_CW2_GAINTBL_SHIFT) |
+	      (MODE_WARM_UP << MT6139_CW2_MODE_SHIFT) |
+	      MT6139_CW2_AUTO_CAL |
+	      (0x20 << MT6139_CW2_DCD_AQ_SHIFT) |
+	      (0x20 << MT6139_CW2_DCD_AI_SHIFT);
+	mt6139_reg_write(2, val);
+
+	/* Program the frequency synthesizer N counter and band selection */
+	/* FIXME: see above for mt6139_set_arfcn() */
+
+	/* Set receive mode, PGA gain */
+	val = (pga_gain << MT6139_CW2_GAINTBL_SHIFT) |
+	      (MODE_RECEIVE << MT6139_CW2_MODE_SHIFT) |
+	      MT6139_CW2_AUTO_CAL |
+	      (0x20 << MT6139_CW2_DCD_AQ_SHIFT) |
+	      (0x20 << MT6139_CW2_DCD_AI_SHIFT);
+	mt6139_reg_write(2, val);
+
+	/* FIXME: Do the actual burst Rx */
+
+	/* Set Sleep mode */
+	val = (0x3e << MT6139_CW2_GAINTBL_SHIFT) |
+	      (MODE_SLEEP << MT6139_CW2_MODE_SHIFT) |
+	      MT6139_CW2_AUTO_CAL |
+	      (0x20 << MT6139_CW2_DCD_AQ_SHIFT) |
+	      (0x20 << MT6139_CW2_DCD_AI_SHIFT);
+	mt6139_reg_write(2, val);
+}
+
+void mt6139_tx_burst()
+{
+	/* Turn on the synthesizer and move into Warm-up mode */
+	val = (0x3e << MT6139_CW2_GAINTBL_SHIFT) |
+	      (MODE_WARM_UP << MT6139_CW2_MODE_SHIFT) |
+	      MT6139_CW2_AUTO_CAL |
+	      (0x20 << MT6139_CW2_DCD_AQ_SHIFT) |
+	      (0x20 << MT6139_CW2_DCD_AI_SHIFT);
+	mt6139_reg_write(2, val);
+
+	/* Program the frequency synthesizer N counter and band selection */
+	/* FIXME: see above for mt6139_set_arfcn() */
+
+	/* Send Tx setting */
+	val = MT6139_CW11_TX_CTL |
+	      MT6139_CW11_TXG_IQM |
+	      MT6139_CW11_TXD_IQM |
+	      MT6139_CW11_TX_DIV2 |
+	      MT6139_CW11_TX_DIV4 |
+	      MT6139_CW11_TXG_BUF |
+	      MT6139_CW11_TXD_BUF |
+	      (3 << MT6139_CW11_TX_FLT_SHIFT) |
+	      (1 << MT6139_CW11_TXAPC_SHIFT) |
+	      (3 << MT6139_CW11_TXPW_SHIFT) |
+	      (2 << MT6139_CW11_TXBIAST_SHIFT) |
+	      MT6139_CW11_TXDIV_GC0;
+	if (1) // low band
+		mt6139_reg_write(11, val | (0 << MT6139_CW11_TXMODGAIN_SHIFT));
+	else
+		mt6139_reg_write(11, val | (4 << MT6139_CW11_TXMODGAIN_SHIFT));
+
+	/* Set Transmit mode */
+	val = (0x3e << MT6139_CW2_GAINTBL_SHIFT) |
+	      (MODE_TRANSMIT << MT6139_CW2_MODE_SHIFT) |
+	      MT6139_CW2_AUTO_CAL |
+	      (0x20 << MT6139_CW2_DCD_AQ_SHIFT) |
+	      (0x20 << MT6139_CW2_DCD_AI_SHIFT);
+	mt6139_reg_write(2, val);
+
+	/* FIXME: Do the actual burst Tx */
+
+	/* Set Sleep mode */
+	val = (0x3e << MT6139_CW2_GAINTBL_SHIFT) |
+	      (MODE_SLEEP << MT6139_CW2_MODE_SHIFT) |
+	      MT6139_CW2_AUTO_CAL |
+	      (0x20 << MT6139_CW2_DCD_AQ_SHIFT) |
+	      (0x20 << MT6139_CW2_DCD_AI_SHIFT);
+	mt6139_reg_write(2, val);
+}
+
diff --git a/src/target/firmware/rf/trf6151.c b/src/target/firmware/rf/trf6151.c
new file mode 100644
index 00000000..9de2cc8e
--- /dev/null
+++ b/src/target/firmware/rf/trf6151.c
@@ -0,0 +1,619 @@
+/* Driver for RF Transceiver Circuit (TRF6151) */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+
+#include <debug.h>
+#include <memory.h>
+#include <keypad.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <calypso/tpu.h>
+#include <calypso/tsp.h>
+#include <layer1/agc.h>
+#include <rffe.h>
+
+#include <rf/trf6151.h>
+
+/* #define WARN_OUT_OF_SPEC 1 */
+
+enum trf6151_reg {
+	REG_RX		= 0,	/* RF general settings */
+	REG_PLL		= 1,	/* PLL settings */
+	REG_PWR		= 2,	/* Power on/off functional blocks */
+	REG_CFG		= 3,	/* Transceiver and PA controller settings */
+	REG_TEST1	= 4,
+	REG_TEST2	= 5,
+	REG_TEST3	= 6,
+	REG_TEST4	= 7,
+	_MAX_REG
+};
+
+/* REG_RX */
+#define RX_READ_EN		(1 << 7)
+#define RX_CAL_MODE		(1 << 8)
+#define RX_RF_GAIN_HIGH		(3 << 9)
+#define RX_VGA_GAIN_SHIFT	11
+
+/* REG_PWR */
+#define PWR_BANDGAP_SHIFT	3
+#define PWR_BANDGAP_OFF		(0 << PWR_BANDGAP_SHIFT)
+#define PWR_BANDGAP_ON_SPEEDUP	(2 << PWR_BANDGAP_SHIFT)
+#define PWR_BANDGAP_ON		(3 << PWR_BANDGAP_SHIFT)
+#define PWR_REGUL_ON		(1 << 5)
+#define PWR_SYNTHE_OFF		(0)
+#define PWR_SYNTHE_RX_ON	(1 << 9)
+#define PWR_SYNTHE_TX_ON	(1 << 10)
+#define PWR_RX_MODE		(1 << 11)
+#define PWR_TX_MODE		(1 << 13)
+#define PWR_PACTRL_APC		(1 << 14)
+#define PWR_PACTRL_APCEN	(1 << 15)
+
+/* REG_CFG */
+#define CFG_TX_LOOP_MANU	(1 << 3)
+#define CFG_PACTLR_IDIOD_30uA	(0 << 4)
+#define CFG_PACTLR_IDIOD_300uA	(1 << 4)
+#define CFG_PACTLR_RES_OPEN	(0 << 10)
+#define CFG_PACTLR_RES_150k	(1 << 10)
+#define CFG_PACTLR_RES_300k	(2 << 10)
+#define CFG_PACTLR_CAP_0pF	(0 << 12)
+#define CFG_PACTLR_CAP_12p5F	(1 << 12)
+#define CFG_PACTLR_CAP_25pF	(3 << 12)
+#define CFG_PACTLR_CAP_50pF	(2 << 12)
+#define CFG_TEMP_SENSOR		(1 << 14)
+#define CFG_ILOGIC_INIT_DIS	(1 << 15)
+
+/* FIXME: This must be defined in the RFFE configuration */
+#define TRF6151_TSP_UID		2
+#define TRF6151_PACTRL_CFG	(CFG_PACTLR_RES_OPEN|CFG_PACTLR_CAP_0pF|CFG_PACTLR_IDIOD_30uA)
+
+#define PLL_VAL(a, b)	((a << 3) | (((b)-64) << 9))
+
+/* All values in qbits unless otherwise specified */
+#define TRF6151_LDO_DELAY_TS	6	/* six TDMA frames (at least 25ms) */
+#define TRF6151_RX_PLL_DELAY	184	/* 170 us */
+#define TRF6151_TX_PLL_DELAY	260	/* 240 us */
+
+
+enum trf6151_pwr_unit {
+	TRF1651_PACTLR_APC,
+	TRF6151_PACTRL_APCEN,
+	TRF6151_TRANSMITTER,
+	TRF6151_REGULATORS,
+};
+
+enum trf6151_gsm_band {
+	GSM900		= 1,
+	GSM1800		= 2,
+	GSM850_LOW	= 4,
+	GSM850_HIGH	= 5,
+	GSM1900		= 6,
+};
+
+
+uint16_t rf_arfcn = 871;	/* TODO: this needs to be private */
+static uint16_t rf_band;
+
+static uint8_t trf6151_tsp_uid;
+static uint8_t trf6151_vga_dbm = 40;
+static int trf6151_gain_high = 1;
+
+static uint16_t trf6151_reg_cache[_MAX_REG] = {
+	[REG_RX] 	= 0x9E00,
+	[REG_PLL]	= 0x0000,
+	[REG_PWR]	= 0x0000,
+	[REG_CFG]	= 0x2980,
+};
+
+/* Write to a TRF6151 register (4 TPU instructions) */
+static void trf6151_reg_write(uint16_t reg, uint16_t val)
+{
+	printd("trf6151_reg_write(reg=%u, val=0x%04x)\n", reg, val);
+	/* each TSP write takes 4 TPU instructions */
+	tsp_write(trf6151_tsp_uid, 16, (reg | val));
+	trf6151_reg_cache[reg] = val;
+}
+
+/* Frontend gain can be switched high or low (dB) */
+#define TRF6151_FE_GAIN_LOW	7
+#define TRF6151_FE_GAIN_HIGH	27
+
+/* VGA at baseband can be adjusted in this range (dB) */
+#define TRF6151_VGA_GAIN_MIN	14
+#define TRF6151_VGA_GAIN_MAX	40
+
+/* put current set (or computed) gain to register */
+int trf6151_set_gain_reg(uint8_t dbm, int high)
+{
+	uint16_t reg = trf6151_reg_cache[REG_RX] & 0x07ff;
+	printd("trf6151_set_gain_reg(%u, %d)\n", dbm, high);
+
+	if (dbm < TRF6151_VGA_GAIN_MIN || dbm > TRF6151_VGA_GAIN_MAX)
+		return -1;
+
+	/* clear the gain bits first */
+	reg &= ~((0x1F) << RX_VGA_GAIN_SHIFT);
+	/* OR-in the new gain value */
+	reg |= (6 + (dbm-TRF6151_VGA_GAIN_MIN)/2) << RX_VGA_GAIN_SHIFT;
+
+	if (high)
+		reg |= RX_RF_GAIN_HIGH;
+	else
+		reg &= ~RX_RF_GAIN_HIGH;
+
+	trf6151_reg_write(REG_RX, reg);
+
+	return 0;
+}
+
+int trf6151_set_gain(uint8_t dbm)
+{
+	int high = 0;
+
+	printd("trf6151_set_gain(%u, %d)\n", dbm);
+	/* If this is negative or less than TRF6151_GAIN_MIN, we are pretty
+	 * much lost as we cannot reduce the system inherent gain.  If it is
+	 * positive, it corresponds to the gain that we need to configure */
+	if (dbm < TRF6151_FE_GAIN_LOW + TRF6151_VGA_GAIN_MIN) {
+		printd("AGC Input level overflow\n");
+		trf6151_vga_dbm = TRF6151_VGA_GAIN_MIN;
+		trf6151_gain_high = 0;
+		return 0;
+	} else if (dbm >= TRF6151_FE_GAIN_HIGH + TRF6151_VGA_GAIN_MIN) {
+		high = 1;
+		dbm -= TRF6151_FE_GAIN_HIGH;
+	} else
+		dbm -= TRF6151_FE_GAIN_LOW;
+	if (dbm > TRF6151_VGA_GAIN_MAX)
+		dbm = TRF6151_VGA_GAIN_MAX;
+
+	/* update the static global variables which are used when programming
+	 * the window */
+	trf6151_vga_dbm = dbm;
+	trf6151_gain_high = high;
+
+	return 0;
+}
+
+#define SCALE_100KHZ	100
+
+/* Compute TRF6151 PLL valuese */
+static void trf6151_pll_rx(uint32_t freq_khz,
+                           uint16_t *pll_config, enum trf6151_gsm_band *band)
+{
+	const uint32_t p=64, r=65;
+	uint32_t freq_100khz, vco_freq_100khz;
+	uint32_t l, n;
+	uint32_t a, b;
+
+	/* Scale into 100kHz unit (avoid overflow in intermediates) */
+	freq_100khz = freq_khz / SCALE_100KHZ;
+
+	/* L selects hi/lo band */
+	l = (freq_khz > 1350000) ? 2 : 4; /* cut at mid point :) */
+
+	/* VCO frequency */
+	vco_freq_100khz = freq_100khz * l;
+
+	/* vco_freq = 26MHz / R * N  with R=65 and N=B*P+A */
+	n = (vco_freq_100khz * r) / 260;
+	a = n % p;
+	b = n / p;
+
+	*pll_config = PLL_VAL(a, b);
+
+	/* Out-of-spec tuning warning */
+#ifdef WARN_OUT_OF_SPEC
+	if ((l == 4 && (b < 135 || b > 150)) ||
+	    (l == 2 && (b < 141 || b > 155)))
+		printf("Frequency %u kHz is out of spec\n", (unsigned int)freq_khz);
+#endif
+
+	/* Select band */
+	if (l==4) {
+		/* If in the low band, same port for both GSM850/GSM900, so we
+		 * choose the best VCO (VCOMAIN1=3.37GHz, VCOMAIN2=3.8GHz) */
+		if (vco_freq_100khz < 35850) /* midpoint */
+			*band = GSM850_LOW;
+		else
+			*band = GSM900;
+
+		/* Out-of-spec freq check */
+#ifdef WARN_OUT_OF_SPEC
+		if (!(freq_khz >= 869000 && freq_khz <= 894000) &&
+		    !(freq_khz >= 921000 && freq_khz <= 960000)) /* include GSM-R */
+			printf("Frequency %u outside normal filter range for selected port\n", (unsigned int)freq_khz);
+#endif
+	} else {
+		/* In the high band, different ports for DCS/PCS, so
+		 * take what's best and available */
+		/* We're stuck to VCOMAIN2=3.8GHz though ... */
+		uint32_t rx_ports = rffe_get_rx_ports();
+		uint32_t port;
+
+		/* Select port */
+		port = (freq_khz < 1905000) ? (1 << PORT_DCS1800) : (1 << PORT_PCS1900);
+		port = (port & rx_ports) ? port : rx_ports;
+
+		/* Select band */
+		*band = (port & (1 << PORT_DCS1800)) ? GSM1800 : GSM1900;
+
+		/* Out-of-spec freq check */
+#ifdef WARN_OUT_OF_SPEC
+		if ((*band == GSM1800 && (freq_khz < 1805000 || freq_khz > 1880000)) ||
+		    (*band == GSM1900 && (freq_khz < 1930000 || freq_khz > 1990000)))
+			printf("Frequency %u outside normal filter range for selected port\n", (unsigned int)freq_khz);
+#endif
+	}
+
+	/* Debug */
+	printd("RX Freq %u kHz => A = %u, B = %u, band = %d, vco_freq = %u kHz\n", freq_khz, a, b, *band, vco_freq_100khz*100);
+
+	/* All done */
+	return;
+}
+
+/* Compute TRF6151 PLL TX values */
+static void trf6151_pll_tx(uint32_t freq_khz,
+                           uint16_t *pll_config, enum trf6151_gsm_band *band)
+{
+	const uint32_t p=64;
+	uint32_t r, l, m, m_op_l; /* m_op_l = m +/- l depending on mode */
+	uint32_t freq_100khz;
+	uint32_t n, a, b, b_min, b_max;
+
+	/* Scale into 100kHz unit (avoid overflow in intermediates) */
+	freq_100khz = freq_khz / SCALE_100KHZ;
+
+	/* Select band (and PLL mode) */
+	if (freq_khz > 1350000) {
+		/* High band, so only 1 real PLL mode. band doesn't matter
+		 * that much (or at all) but we still do it :p */
+		*band = (freq_khz < 1817500) ? GSM1800 : GSM1900;
+		r = 70;
+		l = 2;
+		m = 26;
+		m_op_l = m + l;
+		b_min = 133;
+		b_max = 149;
+	} else {
+		/* Low band. We have 3 possible PLL modes that output on
+		 * the right port: GSM900, GSM850_HIGH, GSM850_LOW.
+		 *
+		 * The transistion points have been chosen looking at the VCO
+		 * and IF frequencies for various frequencies for theses modes
+		 */
+		if (freq_khz < 837100) {
+			/* GSM850_LOW */
+			*band = GSM850_LOW;
+			r = 55;
+			l = 4;
+			m = 26;
+			m_op_l = m - l;
+			b_min = 128;
+			b_max = 130;
+		} else if (freq_khz < 850000) {
+			/* GSM850_HIGH */
+			*band = GSM850_HIGH;
+			r = 30;
+			l = 4;
+			m = 52;
+			m_op_l = m - l;
+			b_min = 65;
+			b_max = 66;
+		} else {
+			/* GSM900 */
+			*band = GSM900;
+			r = 35;
+			l = 4;
+			m = 52;
+			m_op_l = m + l;
+			b_min = 68;
+			b_max = 71;
+		}
+	}
+
+	/* vco_freq = f * M * L / (M +- L)                 */
+	/*          = 26MHz / R * N  with R=65 and N=B*P+A */
+	n = (freq_100khz * m * l * r) / (m_op_l * 260);
+	a = n % p;
+	b = n / p;
+
+	*pll_config = PLL_VAL(a, b);
+
+	/* Debug */
+	printd("TX Freq %u kHz => A = %u, B = %u, band = %d\n", freq_khz, a, b, *band);
+
+	/* Out-of-spec tuning warning */
+#ifdef WARN_OUT_OF_SPEC
+	if (b < b_min || b > b_max)
+		printf("Frequency %u kHz is out of spec\n", (unsigned int)freq_khz);
+#endif
+
+	/* All done */
+	return;
+}
+
+static inline void trf6151_reset(uint16_t reset_id)
+{
+	/* pull the nRESET line low */
+	tsp_act_disable(reset_id);
+	tpu_enq_wait(50);
+	/* release nRESET */
+	tsp_act_enable(reset_id);
+}
+
+void trf6151_init(uint8_t tsp_uid, uint16_t tsp_reset_id)
+{
+	trf6151_tsp_uid = tsp_uid;
+
+	/* Configure the TSPEN which is connected to TRF6151 STROBE */
+	tsp_setup(trf6151_tsp_uid, 0, 1, 1);
+
+	trf6151_reset(tsp_reset_id);
+
+	/* configure TRF6151 for operation */
+	trf6151_power(1);
+	trf6151_reg_write(REG_CFG, TRF6151_PACTRL_CFG | CFG_ILOGIC_INIT_DIS);
+
+	/* FIXME: Uplink / Downlink Calibration */
+}
+
+void trf6151_power(int on)
+{
+	if (on) {
+		trf6151_reg_write(REG_PWR, PWR_REGUL_ON | PWR_BANDGAP_ON);
+		/* wait until regulators are stable (25ms == 27100 qbits) */
+		tpu_enq_wait(5000);
+		tpu_enq_wait(5000);
+		tpu_enq_wait(5000);
+		tpu_enq_wait(5000);
+		tpu_enq_wait(5000);
+		tpu_enq_wait(2100);
+	} else
+		trf6151_reg_write(REG_PWR, PWR_BANDGAP_ON);
+}
+
+/* Set the operational mode of the TRF6151 chip */
+void trf6151_set_mode(enum trf6151_mode mode)
+{
+	uint16_t pwr = (PWR_REGUL_ON | PWR_BANDGAP_ON | (rf_band<<6));
+
+	switch (mode) {
+	case TRF6151_IDLE:
+		/* should we switch of the RF gain for power saving? */
+		break;
+	case TRF6151_RX:
+		pwr |= (PWR_SYNTHE_RX_ON | PWR_RX_MODE);
+		break;
+	case TRF6151_TX:
+#if 0
+		pwr |= (PWR_SYNTHE_TX_ON | PWR_TX_MODE);
+#else // Dieter: we should turn power control on (for TPU: check timing and order !)
+		pwr |= (PWR_SYNTHE_TX_ON | PWR_TX_MODE | PWR_PACTRL_APC | PWR_PACTRL_APCEN); // Dieter: TODO
+#endif
+		break;
+	}
+	trf6151_reg_write(REG_PWR, pwr);
+}
+
+static void trf6151_band_select(enum trf6151_gsm_band band)
+{
+	uint16_t pwr = trf6151_reg_cache[REG_PWR];
+
+	pwr &= ~(3 << 6);
+	pwr |= (band << 6);
+
+	trf6151_reg_write(REG_PWR, pwr);
+}
+
+/* Set ARFCN.  Takes 2 reg_write, i.e. 8 TPU instructions */
+void trf6151_set_arfcn(uint16_t arfcn, int tx)
+{
+	uint32_t freq_khz;
+	uint16_t pll_config;
+	int uplink;
+	enum trf6151_gsm_band pll_band;
+
+	uplink = !!(arfcn & ARFCN_UPLINK);
+	arfcn &= ~ARFCN_UPLINK;
+
+	switch (gsm_arfcn2band(arfcn)) {
+	case GSM_BAND_850:
+	case GSM_BAND_900:
+	case GSM_BAND_1800:
+	case GSM_BAND_1900:
+		/* Supported */
+		break;
+	case GSM_BAND_450:
+	case GSM_BAND_480:
+	case GSM_BAND_750:
+	case GSM_BAND_810:
+		printf("Unsupported band ! YMMV.\n");
+		break;
+	}
+
+	freq_khz = gsm_arfcn2freq10(arfcn, uplink) * 100;
+	printd("ARFCN %u -> %u kHz\n", arfcn, freq_khz);
+
+	if (!tx)
+		trf6151_pll_rx(freq_khz, &pll_config, &pll_band);
+	else
+		trf6151_pll_tx(freq_khz, &pll_config, &pll_band);
+
+	trf6151_band_select(pll_band);
+	trf6151_reg_write(REG_PLL, pll_config);
+
+	rf_band = pll_band;
+	rf_arfcn = arfcn; // TODO: arfcn is referenced at other places
+}
+
+void trf6151_calib_dc_offs(void)
+{
+	uint16_t rx = trf6151_reg_cache[REG_RX];
+
+	/* Set RX CAL Mode bit, it will re-set automatically */
+	trf6151_reg_write(REG_RX, rx | RX_CAL_MODE);
+	/* DC offset calibration can take up to 50us, i.e. 54.16 * 923ns*/
+	tpu_enq_wait(55);
+}
+
+uint8_t trf6151_get_gain_reg(void)
+{
+	uint16_t vga, reg_rx = trf6151_reg_cache[REG_RX];
+	uint8_t gain = 0;
+
+	switch ((reg_rx >> 9) & 3) {
+	case 0:
+		gain += TRF6151_FE_GAIN_LOW;
+		break;
+	case 3:
+		gain += TRF6151_FE_GAIN_HIGH;
+		break;
+	}
+
+	vga = (reg_rx >> RX_VGA_GAIN_SHIFT) & 0x1f;
+	if (vga < 6)
+		vga = 6;
+
+	gain += TRF6151_VGA_GAIN_MIN + (vga - 6) * 2;
+
+	return gain;
+}
+
+uint8_t trf6151_get_gain(void)
+{
+	uint8_t gain;
+	
+	gain = trf6151_vga_dbm;
+	if (trf6151_gain_high)
+		gain += TRF6151_FE_GAIN_HIGH;
+	else
+		gain += TRF6151_FE_GAIN_LOW;
+
+	return gain;
+}
+
+void trf6151_test(uint16_t arfcn)
+{
+	/* Select ARFCN downlink */
+	trf6151_set_arfcn(arfcn, 0);
+
+	trf6151_set_mode(TRF6151_RX);
+	//trf6151_reg_write(REG_PWR, (PWR_SYNTHE_RX_ON | PWR_RX_MODE | PWR_REGUL_ON | (rf_band<<6) | PWR_BANDGAP_ON));
+	/* Wait for PLL stabilization (170us max) */
+	tpu_enq_wait(TRF6151_RX_PLL_DELAY);
+
+	/* Use DC offset calibration after RX mode has been switched on
+	 * (might not be needed) */
+	trf6151_calib_dc_offs();
+
+	tpu_enq_sleep();
+	tpu_enable(1);
+	tpu_wait_idle();
+}
+
+void trf6151_tx_test(uint16_t arfcn)
+{
+	/* Select ARFCN uplink */
+	trf6151_set_arfcn(arfcn | ARFCN_UPLINK, 1);
+
+	trf6151_set_mode(TRF6151_TX);
+	tpu_enq_wait(TRF6151_RX_PLL_DELAY);
+
+	tpu_enq_sleep();
+	tpu_enable(1);
+	tpu_wait_idle();
+}
+
+#define TRF6151_REGWR_QBITS	8	/* 4 GSM qbits + 4 TPU instructions */
+#define TRF6151_RX_TPU_INSTR	4	/* set_gain_reg(1), set_arfcn(2), set_mode(1) */
+
+/* delay caused by this driver programming the TPU for RX mode */
+#define TRF6151_RX_TPU_DELAY	(TRF6151_RX_TPU_INSTR * TRF6151_REGWR_QBITS)
+
+/* prepare a Rx window with the TRF6151 finished at time 'start' (in qbits) */
+void trf6151_rx_window(int16_t start_qbits, uint16_t arfcn)
+{
+	int16_t start_pll_qbits;
+
+	/* power up at the right time _before_ the 'start_qbits' point in time */
+	start_pll_qbits = add_mod5000(start_qbits,  -(TRF6151_RX_PLL_DELAY + TRF6151_RX_TPU_DELAY));
+	tpu_enq_at(start_pll_qbits);
+
+	/* Set the AGC and PLL registers */
+	trf6151_set_arfcn(arfcn, 0);
+	trf6151_set_gain_reg(trf6151_vga_dbm, trf6151_gain_high);
+	trf6151_set_mode(TRF6151_RX);
+
+	/* FIXME: power down at the right time again */
+}
+
+/* prepare a Tx window with the TRF6151 finished at time 'start' (in qbits) */
+void trf6151_tx_window(int16_t start_qbits, uint16_t arfcn)
+{
+#ifdef CONFIG_TX_ENABLE
+	int16_t start_pll_qbits;
+
+	/* power up at the right time _before_ the 'start_qbits' point in time */
+	start_pll_qbits = add_mod5000(start_qbits,  -(TRF6151_TX_PLL_DELAY + TRF6151_RX_TPU_DELAY));
+	tpu_enq_at(start_pll_qbits);
+
+	trf6151_set_arfcn(arfcn, 1);
+	trf6151_set_mode(TRF6151_TX);
+
+	/* FIXME: power down at the right time again */
+#endif
+}
+
+/* Given the expected input level of exp_inp dBm and the target of target_bb
+ * dBm, configure the RF Frontend with the respective gain */
+void trf6151_compute_gain(int16_t exp_inp, int16_t target_bb)
+{
+	/* TRF6151 VGA gain between 14 to 40 dB, plus 20db high/low */
+	int16_t exp_bb, delta;
+
+	/* calculate the dBm8 that we expect at the baseband */
+	exp_bb = exp_inp + system_inherent_gain;
+
+	/* calculate the error that we expect. */
+	delta = target_bb - exp_bb;
+
+	printd("computed gain %d\n", delta);
+	trf6151_set_gain(delta);
+}
+
+int trf6151_iq_swapped(uint16_t band_arfcn, int tx)
+{
+	if (!tx)
+		return 0;
+
+	switch (gsm_arfcn2band(band_arfcn)) {
+		case GSM_BAND_850:
+			return 1;
+		default:
+			break;
+	}
+
+	return 0;
+}
diff --git a/src/target/firmware/solve_envs.py b/src/target/firmware/solve_envs.py
new file mode 100755
index 00000000..0e5f5e8c
--- /dev/null
+++ b/src/target/firmware/solve_envs.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env python2
+
+import sys
+
+def parse(s):
+	return set([x.strip() for x in s.split() if x.strip()])
+
+
+def solve(board_envs, app_envs):
+	if not app_envs:
+		return board_envs
+
+	envs = set()
+
+	if '*' in app_envs:
+		envs.update(board_envs)
+		app_envs.discard('*')
+
+	for e in app_envs:
+		if e.startswith('-'):
+			envs.discard(e[1:])
+		elif e in board_envs:
+			envs.add(e)
+
+	return envs
+
+
+def main(name, board_envs, app_envs):
+	# Parse args
+	board_envs = parse(board_envs)
+	app_envs   = parse(app_envs)
+
+	# Solve
+	envs = solve(board_envs, app_envs)
+
+	# Result
+	print ' '.join(envs)
+
+
+if __name__ == '__main__':
+	main(*sys.argv)
diff --git a/src/target/trx_toolkit/.gitignore b/src/target/trx_toolkit/.gitignore
new file mode 100644
index 00000000..749ccdaf
--- /dev/null
+++ b/src/target/trx_toolkit/.gitignore
@@ -0,0 +1,4 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
diff --git a/src/target/trx_toolkit/README b/src/target/trx_toolkit/README
new file mode 100644
index 00000000..91b6099b
--- /dev/null
+++ b/src/target/trx_toolkit/README
@@ -0,0 +1,34 @@
+TRX toolkit is a set of tools intended for hacking and debugging
+a TRX interface between both transceiver and L1 software, and
+emulating a virtual Um-interface between OsmocomBB and OsmoBTS.
+
+Brief description of available applications:
+
+  - fake_trx.py - main application, that allows to connect both
+    OsmocomBB and OsmoBTS without actual RF hardware. Currently
+    only a single MS may work with a single BTS.
+
+  - clck_gen.py - a peripheral tool aimed to emulate TDMA frame
+    clock generator. Could be used for testing and clock
+    synchronization of multiple applications. It should be noted,
+    that one relays on generic system timer (via Python), so
+    a random clock jitter takes place.
+
+  - ctrl_cmd.py - another peripheral tool, which could be used
+    for sending CTRL commands directly in manual mode, and also
+    for application fuzzing.
+
+  - burst_gen.py - a tool for sending GSM bursts either to L1
+    (OsmoBTS or OsmocomBB) or to TRX (OsmoTRX and GR-GSM TRX).
+    Currently it is only possible to generate random bursts of
+    different types: NB, FB, SB, AB.
+
+  - burst_send.py - a tool for sending existing bursts from a
+    capture file either to L1 (OsmoBTS or OsmocomBB) or to
+    TRX (e.g. OsmoTRX or GR-GSM TRX).
+
+  - trx_sniff.py - Scapy-based TRX protocol sniffer. Allows one
+    to observe a single connection between TRX and L1, and vice
+    versa. Also provides some capabilities for filtering bursts
+    by direction, frame and timeslot numbers, and for recording
+    captured messages to a binary file.
diff --git a/src/target/trx_toolkit/burst_fwd.py b/src/target/trx_toolkit/burst_fwd.py
new file mode 100644
index 00000000..38348495
--- /dev/null
+++ b/src/target/trx_toolkit/burst_fwd.py
@@ -0,0 +1,268 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# BTS <-> BB burst forwarding
+#
+# (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import random
+
+from data_msg import *
+
+class BurstForwarder:
+	# Timeslot filter (drop everything by default)
+	ts_pass = None
+
+	# Freq. filter
+	bts_freq = None
+	bb_freq = None
+
+	# Randomization of RSSI
+	randomize_dl_rssi = False
+	randomize_ul_rssi = False
+
+	# Randomization of ToA
+	randomize_dl_toa256 = False
+	randomize_ul_toa256 = False
+
+	# Timing Advance value indicated by MS (0 by default)
+	# Valid range: 0..63, where each unit means
+	# one GSM symbol advance.
+	ta = 0
+
+	# Timing of Arrival values indicated by transceiver
+	# in units of 1/256 of GSM symbol periods. A pair of
+	# base and threshold values defines a range of ToA value
+	# randomization: from (base - threshold) to (base + threshold).
+	toa256_dl_base = 0
+	toa256_ul_base = 0
+
+	toa256_dl_threshold = 128
+	toa256_ul_threshold = 128
+
+	# RSSI values indicated by transceiver in dBm.
+	# A pair of base and threshold values defines a range of RSSI
+	# randomization: from (base - threshold) to (base + threshold).
+	rssi_dl_base = -60
+	rssi_ul_base = -70
+
+	rssi_dl_threshold = 10
+	rssi_ul_threshold = 5
+
+	# Path loss simulation: DL/UL burst dropping
+	# Indicates how many bursts should be dropped
+	# and which dropping period is used. By default,
+	# period is 1, i.e. every burst (fn % 1 is always 0)
+	burst_dl_drop_amount = 0
+	burst_ul_drop_amount = 0
+	burst_dl_drop_period = 1
+	burst_ul_drop_period = 1
+
+	def __init__(self, bts_link, bb_link):
+		self.bts_link = bts_link
+		self.bb_link = bb_link
+
+	# Converts TA value from symbols to
+	# units of 1/256 of GSM symbol periods
+	def calc_ta256(self):
+		return self.ta * 256
+
+	# Calculates a random ToA value for Downlink bursts
+	def calc_dl_toa256(self):
+		# Check if randomization is required
+		if not self.randomize_dl_toa256:
+			return self.toa256_dl_base
+
+		# Calculate a range for randomization
+		toa256_min = self.toa256_dl_base - self.toa256_dl_threshold
+		toa256_max = self.toa256_dl_base + self.toa256_dl_threshold
+
+		# Generate a random ToA value
+		toa256 = random.randint(toa256_min, toa256_max)
+
+		return toa256
+
+	# Calculates a random ToA value for Uplink bursts
+	def calc_ul_toa256(self):
+		# Check if randomization is required
+		if not self.randomize_ul_toa256:
+			return self.toa256_ul_base
+
+		# Calculate a range for randomization
+		toa256_min = self.toa256_ul_base - self.toa256_ul_threshold
+		toa256_max = self.toa256_ul_base + self.toa256_ul_threshold
+
+		# Generate a random ToA value
+		toa256 = random.randint(toa256_min, toa256_max)
+
+		return toa256
+
+	# Calculates a random RSSI value for Downlink bursts
+	def calc_dl_rssi(self):
+		# Check if randomization is required
+		if not self.randomize_dl_rssi:
+			return self.rssi_dl_base
+
+		# Calculate a range for randomization
+		rssi_min = self.rssi_dl_base - self.rssi_dl_threshold
+		rssi_max = self.rssi_dl_base + self.rssi_dl_threshold
+
+		# Generate a random RSSI value
+		return random.randint(rssi_min, rssi_max)
+
+	# Calculates a random RSSI value for Uplink bursts
+	def calc_ul_rssi(self):
+		# Check if randomization is required
+		if not self.randomize_ul_rssi:
+			return self.rssi_ul_base
+
+		# Calculate a range for randomization
+		rssi_min = self.rssi_ul_base - self.rssi_ul_threshold
+		rssi_max = self.rssi_ul_base + self.rssi_ul_threshold
+
+		# Generate a random RSSI value
+		return random.randint(rssi_min, rssi_max)
+
+	# DL path loss simulation
+	def path_loss_sim_dl(self, msg):
+		# Burst dropping
+		if self.burst_dl_drop_amount > 0:
+			if msg.fn % self.burst_dl_drop_period == 0:
+				print("[~] Simulation: dropping DL burst (fn=%u %% %u == 0)"
+					% (msg.fn, self.burst_dl_drop_period))
+				self.burst_dl_drop_amount -= 1
+				return None
+
+		return msg
+
+	# UL path loss simulation
+	def path_loss_sim_ul(self, msg):
+		# Burst dropping
+		if self.burst_ul_drop_amount > 0:
+			if msg.fn % self.burst_ul_drop_period == 0:
+				print("[~] Simulation: dropping UL burst (fn=%u %% %u == 0)"
+					% (msg.fn, self.burst_ul_drop_period))
+				self.burst_ul_drop_amount -= 1
+				return None
+
+		return msg
+
+	# DL burst preprocessing
+	def preprocess_dl_burst(self, msg):
+		# Calculate both RSSI and ToA values
+		msg.toa256 = self.calc_dl_toa256()
+		msg.rssi = self.calc_dl_rssi()
+
+	# UL burst preprocessing
+	def preprocess_ul_burst(self, msg):
+		# Calculate both RSSI and ToA values,
+		# also apply Timing Advance
+		msg.toa256 = self.calc_ul_toa256()
+		msg.toa256 -= self.calc_ta256()
+		msg.rssi = self.calc_ul_rssi()
+
+	# Converts a L12TRX message to TRX2L1 message
+	def transform_msg(self, msg_raw):
+		# Attempt to parse a message
+		try:
+			msg_l12trx = DATAMSG_L12TRX()
+			msg_l12trx.parse_msg(bytearray(msg_raw))
+		except:
+			print("[!] Dropping unhandled DL message...")
+			return None
+
+		# Compose a new message for L1
+		return msg_l12trx.gen_trx2l1()
+
+	# Downlink handler: BTS -> BB
+	def bts2bb(self):
+		# Read data from socket
+		data, addr = self.bts_link.sock.recvfrom(512)
+
+		# BB is not connected / tuned
+		if self.bb_freq is None:
+			return None
+
+		# Freq. filter
+		if self.bb_freq != self.bts_freq:
+			return None
+
+		# Process a message
+		msg = self.transform_msg(data)
+		if msg is None:
+			return None
+
+		# Timeslot filter
+		if msg.tn != self.ts_pass:
+			return None
+
+		# Path loss simulation
+		msg = self.path_loss_sim_dl(msg)
+		if msg is None:
+			return None
+
+		# Burst preprocessing
+		self.preprocess_dl_burst(msg)
+
+		# Validate and generate the payload
+		payload = msg.gen_msg()
+
+		# Append two unused bytes at the end
+		# in order to keep the compatibility
+		payload += bytearray(2)
+
+		# Send burst to BB
+		self.bb_link.send(payload)
+
+	# Uplink handler: BB -> BTS
+	def bb2bts(self):
+		# Read data from socket
+		data, addr = self.bb_link.sock.recvfrom(512)
+
+		# BTS is not connected / tuned
+		if self.bts_freq is None:
+			return None
+
+		# Freq. filter
+		if self.bb_freq != self.bts_freq:
+			return None
+
+		# Process a message
+		msg = self.transform_msg(data)
+		if msg is None:
+			return None
+
+		# Path loss simulation
+		msg = self.path_loss_sim_ul(msg)
+		if msg is None:
+			return None
+
+		# Burst preprocessing
+		self.preprocess_ul_burst(msg)
+
+		# Validate and generate the payload
+		payload = msg.gen_msg()
+
+		# Append two unused bytes at the end
+		# in order to keep the compatibility
+		payload += bytearray(2)
+
+		# Send burst to BTS
+		self.bts_link.send(payload)
diff --git a/src/target/trx_toolkit/burst_gen.py b/src/target/trx_toolkit/burst_gen.py
new file mode 100755
index 00000000..d83f1378
--- /dev/null
+++ b/src/target/trx_toolkit/burst_gen.py
@@ -0,0 +1,248 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# Auxiliary tool to generate and send random bursts via TRX DATA
+# interface, which may be useful for fuzzing and testing
+#
+# (C) 2017-2018 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from copyright import print_copyright
+CR_HOLDERS = [("2017-2018", "Vadim Yanitskiy <axilirator@gmail.com>")]
+
+import signal
+import getopt
+import sys
+
+from rand_burst_gen import RandBurstGen
+from data_dump import DATADumpFile
+from data_if import DATAInterface
+from gsm_shared import *
+from data_msg import *
+
+class Application:
+	# Application variables
+	remote_addr = "127.0.0.1"
+	bind_addr = "0.0.0.0"
+	base_port = 5700
+	conn_mode = "TRX"
+	output_file = None
+
+	burst_type = None
+	burst_count = 1
+
+	# Common header fields
+	fn = None
+	tn = None
+
+	# Message specific header fields
+	toa256 = None
+	rssi = None
+	pwr = None
+
+	def __init__(self):
+		print_copyright(CR_HOLDERS)
+		self.parse_argv()
+		self.check_argv()
+
+		# Set up signal handlers
+		signal.signal(signal.SIGINT, self.sig_handler)
+
+		# Open requested capture file
+		if self.output_file is not None:
+			self.ddf = DATADumpFile(self.output_file)
+
+	def run(self):
+		# Init DATA interface with TRX or L1
+		if self.conn_mode == "TRX":
+			self.data_if = DATAInterface(self.remote_addr, self.base_port + 2,
+				self.bind_addr, self.base_port + 102)
+		elif self.conn_mode == "L1":
+			self.data_if = DATAInterface(self.remote_addr, self.base_port + 102,
+				self.bind_addr, self.base_port + 2)
+
+		# Init random burst generator
+		burst_gen = RandBurstGen()
+
+		# Init an empty DATA message
+		if self.conn_mode == "TRX":
+			msg = DATAMSG_L12TRX()
+		elif self.conn_mode == "L1":
+			msg = DATAMSG_TRX2L1()
+
+		# Generate a random frame number or use provided one
+		fn_init = msg.rand_fn() if self.fn is None else self.fn
+
+		# Send as much bursts as required
+		for i in range(self.burst_count):
+			# Randomize the message header
+			msg.rand_hdr()
+
+			# Increase and set frame number
+			msg.fn = (fn_init + i) % GSM_HYPERFRAME
+
+			# Set timeslot number
+			if self.tn is not None:
+				msg.tn = self.tn
+
+			# Set transmit power level
+			if self.pwr is not None:
+				msg.pwr = self.pwr
+
+			# Set time of arrival
+			if self.toa256 is not None:
+				msg.toa256 = self.toa256
+
+			# Set RSSI
+			if self.rssi is not None:
+				msg.rssi = self.rssi
+
+			# Generate a random burst
+			if self.burst_type == "NB":
+				burst = burst_gen.gen_nb()
+			elif self.burst_type == "FB":
+				burst = burst_gen.gen_fb()
+			elif self.burst_type == "SB":
+				burst = burst_gen.gen_sb()
+			elif self.burst_type == "AB":
+				burst = burst_gen.gen_ab()
+
+			# Convert to soft-bits in case of TRX -> L1 message
+			if self.conn_mode == "L1":
+				burst = msg.ubit2sbit(burst)
+
+			# Set burst
+			msg.burst = burst
+
+			print("[i] Sending %d/%d %s burst %s to %s..."
+				% (i + 1, self.burst_count, self.burst_type,
+					msg.desc_hdr(), self.conn_mode))
+
+			# Send message
+			self.data_if.send_msg(msg)
+
+			# Append a new message to the capture
+			if self.output_file is not None:
+				self.ddf.append_msg(msg)
+
+	def print_help(self, msg = None):
+		s  = " Usage: " + sys.argv[0] + " [options]\n\n" \
+			 " Some help...\n" \
+			 "  -h --help           this text\n\n"
+
+		s += " TRX interface specific\n" \
+			 "  -o --output-file    Write bursts to a capture file\n"        \
+			 "  -m --conn-mode      Send bursts to: TRX (default) / L1\n"    \
+			 "  -r --remote-addr    Set remote address (default %s)\n"       \
+			 "  -b --bind-addr      Set local address (default %s)\n"        \
+			 "  -p --base-port      Set base port number (default %d)\n\n"
+
+		s += " Burst generation\n" \
+			 "  -b --burst-type     Random burst type (NB, FB, SB, AB)\n"    \
+			 "  -c --burst-count    How much bursts to send (default 1)\n"   \
+			 "  -f --frame-number   Set frame number (default random)\n"     \
+			 "  -t --timeslot       Set timeslot index (default random)\n"   \
+			 "     --pwr            Set power level (default random)\n"      \
+			 "     --rssi           Set RSSI (default random)\n"             \
+			 "     --toa            Set ToA in symbols (default random)\n"   \
+			 "     --toa256         Set ToA in 1/256 symbol periods\n"
+
+		print(s % (self.remote_addr, self.bind_addr, self.base_port))
+
+		if msg is not None:
+			print(msg)
+
+	def parse_argv(self):
+		try:
+			opts, args = getopt.getopt(sys.argv[1:],
+				"o:m:r:b:p:b:c:f:t:h",
+				[
+					"help",
+					"output-file="
+					"conn-mode=",
+					"remote-addr=",
+					"bind-addr=",
+					"base-port=",
+					"burst-type=",
+					"burst-count=",
+					"frame-number=",
+					"timeslot=",
+					"rssi=",
+					"toa=",
+					"toa256=",
+					"pwr=",
+				])
+		except getopt.GetoptError as err:
+			self.print_help("[!] " + str(err))
+			sys.exit(2)
+
+		for o, v in opts:
+			if o in ("-h", "--help"):
+				self.print_help()
+				sys.exit(2)
+
+			elif o in ("-o", "--output-file"):
+				self.output_file = v
+			elif o in ("-m", "--conn-mode"):
+				self.conn_mode = v
+			elif o in ("-r", "--remote-addr"):
+				self.remote_addr = v
+			elif o in ("-b", "--bind-addr"):
+				self.bind_addr = v
+			elif o in ("-p", "--base-port"):
+				self.base_port = int(v)
+
+			elif o in ("-b", "--burst-type"):
+				self.burst_type = v
+			elif o in ("-c", "--burst-count"):
+				self.burst_count = int(v)
+			elif o in ("-f", "--frame-number"):
+				self.fn = int(v)
+			elif o in ("-t", "--timeslot"):
+				self.tn = int(v)
+
+			# Message specific header fields
+			elif o == "--pwr":
+				self.pwr = int(v)
+			elif o == "--rssi":
+				self.rssi = int(v)
+			elif o == "--toa256":
+				self.toa256 = int(v)
+			elif o == "--toa":
+				self.toa256 = int(float(v) * 256.0 + 0.5)
+
+	def check_argv(self):
+		# Check connection mode
+		if self.conn_mode not in ("TRX", "L1"):
+			self.print_help("[!] Unknown connection type")
+			sys.exit(2)
+
+		# Check connection mode
+		if self.burst_type not in ("NB", "FB", "SB", "AB"):
+			self.print_help("[!] Unknown burst type")
+			sys.exit(2)
+
+	def sig_handler(self, signum, frame):
+		print("Signal %d received" % signum)
+		if signum is signal.SIGINT:
+			sys.exit(0)
+
+if __name__ == '__main__':
+	app = Application()
+	app.run()
diff --git a/src/target/trx_toolkit/burst_send.py b/src/target/trx_toolkit/burst_send.py
new file mode 100755
index 00000000..f6c85ba0
--- /dev/null
+++ b/src/target/trx_toolkit/burst_send.py
@@ -0,0 +1,218 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# Auxiliary tool to send existing bursts via TRX DATA interface
+#
+# (C) 2017-2018 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from copyright import print_copyright
+CR_HOLDERS = [("2017-2018", "Vadim Yanitskiy <axilirator@gmail.com>")]
+
+import signal
+import getopt
+import sys
+
+from data_dump import DATADumpFile
+from data_if import DATAInterface
+from gsm_shared import *
+from data_msg import *
+
+class Application:
+	# Application variables
+	remote_addr = "127.0.0.1"
+	bind_addr = "0.0.0.0"
+	base_port = 5700
+	conn_mode = "TRX"
+
+	# Burst source
+	capture_file = None
+
+	# Count limitations
+	msg_skip = None
+	msg_count = None
+
+	# Pass filtering
+	pf_fn_lt = None
+	pf_fn_gt = None
+	pf_tn = None
+
+	def __init__(self):
+		print_copyright(CR_HOLDERS)
+		self.parse_argv()
+
+		# Set up signal handlers
+		signal.signal(signal.SIGINT, self.sig_handler)
+
+		# Open requested capture file
+		self.ddf = DATADumpFile(self.capture_file)
+
+	def run(self):
+		# Init DATA interface with TRX or L1
+		if self.conn_mode == "TRX":
+			self.data_if = DATAInterface(self.remote_addr, self.base_port + 2,
+				self.bind_addr, self.base_port + 102)
+			l12trx = True
+		elif self.conn_mode == "L1":
+			self.data_if = DATAInterface(self.remote_addr, self.base_port + 102,
+				self.bind_addr, self.base_port + 2)
+			l12trx = False
+		else:
+			self.print_help("[!] Unknown connection type")
+			sys.exit(2)
+
+		# Read messages from the capture
+		messages = self.ddf.parse_all(
+			skip = self.msg_skip, count = self.msg_count)
+		if messages is False:
+			pass # FIXME!!!
+
+		for msg in messages:
+			# Pass filter
+			if not self.msg_pass_filter(l12trx, msg):
+				continue
+
+			print("[i] Sending a burst %s to %s..."
+				% (msg.desc_hdr(), self.conn_mode))
+
+			# Send message
+			self.data_if.send_msg(msg)
+
+	def msg_pass_filter(self, l12trx, msg):
+		# Direction filter
+		if isinstance(msg, DATAMSG_L12TRX) and not l12trx:
+			return False
+		elif isinstance(msg, DATAMSG_TRX2L1) and l12trx:
+			return False
+
+		# Timeslot filter
+		if self.pf_tn is not None:
+			if msg.tn != self.pf_tn:
+				return False
+
+		# Frame number filter
+		if self.pf_fn_lt is not None:
+			if msg.fn > self.pf_fn_lt:
+				return False
+		if self.pf_fn_gt is not None:
+			if msg.fn < self.pf_fn_gt:
+				return False
+
+		# Burst passed ;)
+		return True
+
+	def print_help(self, msg = None):
+		s  = " Usage: " + sys.argv[0] + " [options]\n\n" \
+			 " Some help...\n" \
+			 "  -h --help              this text\n\n"
+
+		s += " TRX interface specific\n" \
+			 "  -m --conn-mode         Send bursts to: TRX (default) / L1\n"    \
+			 "  -r --remote-addr       Set remote address (default %s)\n"       \
+			 "  -b --bind-addr         Set bind address (default %s)\n"         \
+			 "  -p --base-port         Set base port number (default %d)\n\n"
+
+		s += " Burst source\n" \
+			 "  -i --capture-file      Read bursts from capture file\n\n" \
+
+		s += " Count limitations (disabled by default)\n" \
+			 "  --msg-skip      NUM    Skip NUM messages before sending\n"   \
+			 "  --msg-count     NUM    Stop after sending NUM messages\n\n"  \
+
+		s += " Filtering (disabled by default)\n" \
+			 "  --timeslot      NUM    TDMA timeslot number [0..7]\n"        \
+			 "  --frame-num-lt  NUM    TDMA frame number lower than NUM\n"   \
+			 "  --frame-num-gt  NUM    TDMA frame number greater than NUM\n"
+
+		print(s % (self.remote_addr, self.bind_addr, self.base_port))
+
+		if msg is not None:
+			print(msg)
+
+	def parse_argv(self):
+		try:
+			opts, args = getopt.getopt(sys.argv[1:],
+				"m:r:b:p:i:h",
+				[
+					"help",
+					"conn-mode=",
+					"remote-addr=",
+					"bind-addr=",
+					"base-port=",
+					"capture-file=",
+					"msg-skip=",
+					"msg-count=",
+					"timeslot=",
+					"frame-num-lt=",
+					"frame-num-gt=",
+				])
+		except getopt.GetoptError as err:
+			self.print_help("[!] " + str(err))
+			sys.exit(2)
+
+		for o, v in opts:
+			if o in ("-h", "--help"):
+				self.print_help()
+				sys.exit(2)
+
+			# Capture file
+			elif o in ("-i", "--capture-file"):
+				self.capture_file = v
+
+			# TRX interface specific
+			elif o in ("-m", "--conn-mode"):
+				self.conn_mode = v
+			elif o in ("-r", "--remote-addr"):
+				self.remote_addr = v
+			elif o in ("-b", "--bind-addr"):
+				self.bind_addr = v
+			elif o in ("-p", "--base-port"):
+				self.base_port = int(v)
+
+			# Count limitations
+			elif o == "--msg-skip":
+				self.msg_skip = int(v)
+			elif o == "--msg-count":
+				self.msg_count = int(v)
+
+			# Timeslot pass filter
+			elif o == "--timeslot":
+				self.pf_tn = int(v)
+				if self.pf_tn < 0 or self.pf_tn > 7:
+					self.print_help("[!] Wrong timeslot value")
+					sys.exit(2)
+
+			# Frame number pass filter
+			elif o == "--frame-num-lt":
+				self.pf_fn_lt = int(v)
+			elif o == "--frame-num-gt":
+				self.pf_fn_gt = int(v)
+
+		if self.capture_file is None:
+			self.print_help("[!] Please specify a capture file")
+			sys.exit(2)
+
+	def sig_handler(self, signum, frame):
+		print("Signal %d received" % signum)
+		if signum is signal.SIGINT:
+			sys.exit(0)
+
+if __name__ == '__main__':
+	app = Application()
+	app.run()
diff --git a/src/target/trx_toolkit/clck_gen.py b/src/target/trx_toolkit/clck_gen.py
new file mode 100755
index 00000000..b488770e
--- /dev/null
+++ b/src/target/trx_toolkit/clck_gen.py
@@ -0,0 +1,116 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# Simple TDMA frame clock generator
+#
+# (C) 2017-2018 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from copyright import print_copyright
+CR_HOLDERS = [("2017-2018", "Vadim Yanitskiy <axilirator@gmail.com>")]
+
+import signal
+import time
+import sys
+
+from threading import Timer
+from udp_link import UDPLink
+from gsm_shared import *
+
+class CLCKGen:
+	# GSM TDMA definitions
+	SEC_DELAY_US = 1000 * 1000
+	GSM_FRAME_US = 4615.0
+
+	# Average loop back delay
+	LO_DELAY_US = 90.0
+
+	# State variables
+	timer = None
+
+	def __init__(self, clck_links, clck_start = 0, ind_period = 102):
+		self.clck_links = clck_links
+		self.ind_period = ind_period
+		self.clck_start = clck_start
+		self.clck_src = clck_start
+
+		# Calculate counter time
+		self.ctr_interval  = self.GSM_FRAME_US - self.LO_DELAY_US
+		self.ctr_interval /= self.SEC_DELAY_US
+		self.ctr_interval *= self.ind_period
+
+	def start(self):
+		# Send the first indication
+		self.send_clck_ind()
+
+	def stop(self):
+		# Stop pending timer
+		if self.timer is not None:
+			self.timer.cancel()
+			self.timer = None
+
+		# Reset the clock source
+		self.clck_src = self.clck_start
+
+	def send_clck_ind(self):
+		# Keep clock cycle
+		if self.clck_src % GSM_HYPERFRAME >= 0:
+			self.clck_src %= GSM_HYPERFRAME
+
+		# We don't need to send so often
+		if self.clck_src % self.ind_period == 0:
+			# Create UDP payload
+			payload = "IND CLOCK %u\0" % self.clck_src
+
+			# Send indication to all UDP links
+			for link in self.clck_links:
+				link.send(payload)
+
+			# Debug print
+			print("[T] %s" % payload)
+
+		# Increase frame count
+		self.clck_src += self.ind_period
+
+		# Schedule a new indication
+		self.timer = Timer(self.ctr_interval, self.send_clck_ind)
+		self.timer.start()
+
+# Just a wrapper for independent usage
+class Application:
+	def __init__(self):
+		# Print copyright
+		print_copyright(CR_HOLDERS)
+
+		# Set up signal handlers
+		signal.signal(signal.SIGINT, self.sig_handler)
+
+	def run(self):
+		self.link = UDPLink("127.0.0.1", 5800, "0.0.0.0", 5700)
+		self.clck = CLCKGen([self.link], ind_period = 51)
+		self.clck.start()
+
+	def sig_handler(self, signum, frame):
+		print("Signal %d received" % signum)
+		if signum is signal.SIGINT:
+			self.clck.stop()
+
+if __name__ == '__main__':
+	app = Application()
+	app.run()
diff --git a/src/target/trx_toolkit/copyright.py b/src/target/trx_toolkit/copyright.py
new file mode 100644
index 00000000..3d3597fd
--- /dev/null
+++ b/src/target/trx_toolkit/copyright.py
@@ -0,0 +1,13 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+def print_copyright(holders = []):
+	# Print copyright holders if any
+	for date, author in holders:
+		print("Copyright (C) %s by %s" % (date, author))
+
+	# Print the license header itself
+	print("License GPLv2+: GNU GPL version 2 or later " \
+		"<http://gnu.org/licenses/gpl.html>\n" \
+		"This is free software: you are free to change and redistribute it.\n" \
+		"There is NO WARRANTY, to the extent permitted by law.\n")
diff --git a/src/target/trx_toolkit/ctrl_cmd.py b/src/target/trx_toolkit/ctrl_cmd.py
new file mode 100755
index 00000000..e56105a8
--- /dev/null
+++ b/src/target/trx_toolkit/ctrl_cmd.py
@@ -0,0 +1,147 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# Auxiliary tool to send custom commands via TRX CTRL interface,
+# which may be useful for testing and fuzzing
+#
+# (C) 2017-2018 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from copyright import print_copyright
+CR_HOLDERS = [("2017-2018", "Vadim Yanitskiy <axilirator@gmail.com>")]
+
+import signal
+import getopt
+import select
+import sys
+
+from udp_link import UDPLink
+
+class Application:
+	# Application variables
+	remote_addr = "127.0.0.1"
+	bind_addr = "0.0.0.0"
+	base_port = 5700
+	bind_port = 0
+	fuzzing = False
+
+	def __init__(self):
+		print_copyright(CR_HOLDERS)
+		self.parse_argv()
+
+		# Set up signal handlers
+		signal.signal(signal.SIGINT, self.sig_handler)
+
+		# Init UDP connection
+		self.ctrl_link = UDPLink(self.remote_addr, self.base_port + 1,
+			self.bind_addr, self.bind_port)
+
+		# Debug print
+		print("[i] Init CTRL interface (%s)" \
+			% self.ctrl_link.desc_link())
+
+	def print_help(self, msg = None):
+		s  = " Usage: " + sys.argv[0] + " [options]\n\n" \
+			 " Some help...\n" \
+			 "  -h --help           this text\n\n"
+
+		s += " TRX interface specific\n" \
+			 "  -r --remote-addr    Set remote address (default %s)\n"   \
+			 "  -p --base-port      Set base port number (default %d)\n" \
+			 "  -P --bind-port      Set local port number (default: random)\n" \
+			 "  -b --bind-addr      Set local address (default %s)\n" \
+			 "  -f --fuzzing        Send raw payloads (without CMD)\n"   \
+
+		print(s % (self.remote_addr, self.base_port, self.bind_addr))
+
+		if msg is not None:
+			print(msg)
+
+	def parse_argv(self):
+		try:
+			opts, args = getopt.getopt(sys.argv[1:],
+				"r:p:P:b:fh",
+				[
+					"help",
+					"fuzzing",
+					"base-port=",
+					"bind-port=",
+					"bind-addr=",
+					"remote-addr=",
+				])
+		except getopt.GetoptError as err:
+			self.print_help("[!] " + str(err))
+			sys.exit(2)
+
+		for o, v in opts:
+			if o in ("-h", "--help"):
+				self.print_help()
+				sys.exit(2)
+
+			elif o in ("-r", "--remote-addr"):
+				self.remote_addr = v
+			elif o in ("-b", "--bind-addr"):
+				self.bind_addr = v
+			elif o in ("-p", "--base-port"):
+				self.base_port = int(v)
+			elif o in ("-P", "--bind-port"):
+				self.bind_port = int(v)
+			elif o in ("-f", "--fuzzing"):
+				self.fuzzing = True
+
+	def run(self):
+		while True:
+			self.print_prompt()
+
+			# Wait until we get any data on any socket
+			socks = [sys.stdin, self.ctrl_link.sock]
+			r_event, w_event, x_event = select.select(socks, [], [])
+
+			# Check for incoming CTRL commands
+			if sys.stdin in r_event:
+				cmd = sys.stdin.readline()
+				self.handle_cmd(cmd)
+
+			if self.ctrl_link.sock in r_event:
+				data, addr = self.ctrl_link.sock.recvfrom(128)
+				sys.stdout.write("\r%s\n" % data.decode())
+				sys.stdout.flush()
+
+	def handle_cmd(self, cmd):
+		# Strip spaces, tabs, etc.
+		cmd = cmd.strip().strip("\0")
+
+		# Send a command
+		if self.fuzzing:
+			self.ctrl_link.send("%s" % cmd)
+		else:
+			self.ctrl_link.send("CMD %s\0" % cmd)
+
+	def print_prompt(self):
+		sys.stdout.write("CTRL# ")
+		sys.stdout.flush()
+
+	def sig_handler(self, signum, frame):
+		print("\n\nSignal %d received" % signum)
+		if signum is signal.SIGINT:
+			sys.exit(0)
+
+if __name__ == '__main__':
+	app = Application()
+	app.run()
diff --git a/src/target/trx_toolkit/ctrl_if.py b/src/target/trx_toolkit/ctrl_if.py
new file mode 100644
index 00000000..1e569a60
--- /dev/null
+++ b/src/target/trx_toolkit/ctrl_if.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# CTRL interface implementation
+#
+# (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from udp_link import UDPLink
+
+class CTRLInterface(UDPLink):
+	def handle_rx(self, data, remote):
+		if not self.verify_req(data):
+			print("[!] Wrong data on CTRL interface")
+			return
+
+		# Attempt to parse a command
+		request = self.prepare_req(data)
+		rc = self.parse_cmd(request)
+
+		if type(rc) is tuple:
+			self.send_response(request, remote, rc[0], rc[1])
+		else:
+			self.send_response(request, remote, rc)
+
+	def verify_req(self, data):
+		# Verify command signature
+		return data.startswith("CMD")
+
+	def prepare_req(self, data):
+		# Strip signature, paddings and \0
+		request = data[4:].strip().strip("\0")
+		# Split into a command and arguments
+		request = request.split(" ")
+		# Now we have something like ["TXTUNE", "941600"]
+		return request
+
+	def verify_cmd(self, request, cmd, argc):
+		# Check if requested command matches
+		if request[0] != cmd:
+			return False
+
+		# And has enough arguments
+		if len(request) - 1 != argc:
+			return False
+
+		return True
+
+	def send_response(self, request, remote, response_code, params = None):
+		# Include status code, for example ["TXTUNE", "0", "941600"]
+		request.insert(1, str(response_code))
+
+		# Optionally append command specific parameters
+		if params is not None:
+			request += params
+
+		# Add the response signature, and join back to string
+		response = "RSP " + " ".join(request) + "\0"
+		# Now we have something like "RSP TXTUNE 0 941600"
+		self.sendto(response, remote)
+
+	def parse_cmd(self, request):
+		raise NotImplementedError
diff --git a/src/target/trx_toolkit/ctrl_if_bb.py b/src/target/trx_toolkit/ctrl_if_bb.py
new file mode 100644
index 00000000..3528c98d
--- /dev/null
+++ b/src/target/trx_toolkit/ctrl_if_bb.py
@@ -0,0 +1,213 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# CTRL interface implementation (OsmocomBB specific)
+#
+# (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from ctrl_if import CTRLInterface
+
+class CTRLInterfaceBB(CTRLInterface):
+	# Internal state variables
+	trx_started = False
+	burst_fwd = None
+	rx_freq = None
+	tx_freq = None
+	pm = None
+
+	def __init__(self, remote_addr, remote_port, bind_addr, bind_port):
+		CTRLInterface.__init__(self, remote_addr, remote_port, bind_addr, bind_port)
+		print("[i] Init CTRL interface for BB (%s)" % self.desc_link())
+
+	def parse_cmd(self, request):
+		# Power control
+		if self.verify_cmd(request, "POWERON", 0):
+			print("[i] Recv POWERON CMD")
+
+			# Ensure transceiver isn't working
+			if self.trx_started:
+				print("[!] Transceiver already started")
+				return -1
+
+			# Ensure RX / TX freq. are set
+			if (self.rx_freq is None) or (self.tx_freq is None):
+				print("[!] RX / TX freq. are not set")
+				return -1
+
+			print("[i] Starting transceiver...")
+			self.trx_started = True
+			return 0
+
+		elif self.verify_cmd(request, "POWEROFF", 0):
+			print("[i] Recv POWEROFF cmd")
+
+			print("[i] Stopping transceiver...")
+			self.trx_started = False
+			return 0
+
+		# Tuning Control
+		elif self.verify_cmd(request, "RXTUNE", 1):
+			print("[i] Recv RXTUNE cmd")
+
+			# TODO: check freq range
+			self.rx_freq = int(request[1]) * 1000
+			self.burst_fwd.bb_freq = self.rx_freq
+			return 0
+
+		elif self.verify_cmd(request, "TXTUNE", 1):
+			print("[i] Recv TXTUNE cmd")
+
+			# TODO: check freq range
+			self.tx_freq = int(request[1]) * 1000
+			return 0
+
+		# Power measurement
+		elif self.verify_cmd(request, "MEASURE", 1):
+			print("[i] Recv MEASURE cmd")
+
+			if self.pm is None:
+				return -1
+
+			# TODO: check freq range
+			meas_freq = int(request[1]) * 1000
+			meas_dbm = str(self.pm.measure(meas_freq))
+
+			return (0, [meas_dbm])
+
+		elif self.verify_cmd(request, "SETSLOT", 2):
+			print("[i] Recv SETSLOT cmd")
+
+			if self.burst_fwd is None:
+				return -1
+
+			# Obtain TS index
+			ts = int(request[1])
+			if ts not in range(0, 8):
+				print("[!] TS index should be in range: 0..7")
+				return -1
+
+			# Parse TS type
+			ts_type = int(request[2])
+
+			# TS activation / deactivation
+			# We don't care about ts_type
+			if ts_type == 0:
+				self.burst_fwd.ts_pass = None
+			else:
+				self.burst_fwd.ts_pass = ts
+
+			return 0
+
+		# Timing Advance
+		elif self.verify_cmd(request, "SETTA", 1):
+			print("[i] Recv SETTA cmd")
+
+			# Save to the BurstForwarder instance
+			self.burst_fwd.ta = ta
+			return 0
+
+		# Timing of Arrival simulation for Uplink
+		# Absolute form: CMD FAKE_TOA <BASE> <THRESH>
+		elif self.verify_cmd(request, "FAKE_TOA", 2):
+			print("[i] Recv FAKE_TOA cmd")
+
+			# Parse and apply both base and threshold
+			self.burst_fwd.toa256_ul_base = int(request[1])
+			self.burst_fwd.toa256_ul_threshold = int(request[2])
+
+			return 0
+
+		# Timing of Arrival simulation for Uplink
+		# Relative form: CMD FAKE_TOA <+-BASE_DELTA>
+		elif self.verify_cmd(request, "FAKE_TOA", 1):
+			print("[i] Recv FAKE_TOA cmd")
+
+			# Parse and apply delta
+			self.burst_fwd.toa256_ul_base += int(request[1])
+
+			return 0
+
+		# RSSI simulation for Uplink
+		# Absolute form: CMD FAKE_RSSI <BASE> <THRESH>
+		elif self.verify_cmd(request, "FAKE_RSSI", 2):
+			print("[i] Recv FAKE_RSSI cmd")
+
+			# Parse and apply both base and threshold
+			self.burst_fwd.rssi_ul_base = int(request[1])
+			self.burst_fwd.rssi_ul_threshold = int(request[2])
+
+			return 0
+
+		# RSSI simulation for Uplink
+		# Relative form: CMD FAKE_RSSI <+-BASE_DELTA>
+		elif self.verify_cmd(request, "FAKE_RSSI", 1):
+			print("[i] Recv FAKE_RSSI cmd")
+
+			# Parse and apply delta
+			self.burst_fwd.rssi_ul_base += int(request[1])
+
+			return 0
+
+		# Path loss simulation for UL: burst dropping
+		# Syntax: CMD FAKE_DROP <AMOUNT>
+		# Dropping pattern: fn % 1 == 0
+		elif self.verify_cmd(request, "FAKE_DROP", 1):
+			print("[i] Recv FAKE_DROP cmd")
+
+			# Parse / validate amount of bursts
+			num = int(request[1])
+			if num < 0:
+				print("[!] FAKE_DROP amount shall not be negative")
+				return -1
+
+			self.burst_fwd.burst_ul_drop_amount = num
+			self.burst_fwd.burst_ul_drop_period = 1
+
+			return 0
+
+		# Path loss simulation for UL: burst dropping
+		# Syntax: CMD FAKE_DROP <AMOUNT> <FN_PERIOD>
+		# Dropping pattern: fn % period == 0
+		elif self.verify_cmd(request, "FAKE_DROP", 2):
+			print("[i] Recv FAKE_DROP cmd")
+
+			# Parse / validate amount of bursts
+			num = int(request[1])
+			if num < 0:
+				print("[!] FAKE_DROP amount shall not be negative")
+				return -1
+
+			# Parse / validate period
+			period = int(request[2])
+			if period <= 0:
+				print("[!] FAKE_DROP period shall be greater than zero")
+				return -1
+
+			self.burst_fwd.burst_ul_drop_amount = num
+			self.burst_fwd.burst_ul_drop_period = period
+
+			return 0
+
+		# Wrong / unknown command
+		else:
+			# We don't care about other commands,
+			# so let's merely ignore them ;)
+			print("[i] Ignore CMD %s" % request[0])
+			return 0
diff --git a/src/target/trx_toolkit/ctrl_if_bts.py b/src/target/trx_toolkit/ctrl_if_bts.py
new file mode 100644
index 00000000..6ac8ffb5
--- /dev/null
+++ b/src/target/trx_toolkit/ctrl_if_bts.py
@@ -0,0 +1,187 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# CTRL interface implementation (OsmoBTS specific)
+#
+# (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from ctrl_if import CTRLInterface
+
+class CTRLInterfaceBTS(CTRLInterface):
+	# Internal state variables
+	trx_started = False
+	burst_fwd = None
+	clck_gen = None
+	rx_freq = None
+	tx_freq = None
+	pm = None
+
+	def __init__(self, remote_addr, remote_port, bind_addr, bind_port):
+		CTRLInterface.__init__(self, remote_addr, remote_port, bind_addr, bind_port)
+		print("[i] Init CTRL interface for BTS (%s)" % self.desc_link())
+
+	def parse_cmd(self, request):
+		# Power control
+		if self.verify_cmd(request, "POWERON", 0):
+			print("[i] Recv POWERON CMD")
+
+			# Ensure transceiver isn't working
+			if self.trx_started:
+				print("[!] Transceiver already started")
+				return -1
+
+			# Ensure RX / TX freq. are set
+			if (self.rx_freq is None) or (self.tx_freq is None):
+				print("[!] RX / TX freq. are not set")
+				return -1
+
+			print("[i] Starting transceiver...")
+			self.trx_started = True
+
+			# Power emulation
+			if self.pm is not None:
+				self.pm.add_bts_list([self.tx_freq])
+
+			# Start clock indications
+			if self.clck_gen is not None:
+				self.clck_gen.start()
+
+			return 0
+
+		elif self.verify_cmd(request, "POWEROFF", 0):
+			print("[i] Recv POWEROFF cmd")
+
+			print("[i] Stopping transceiver...")
+			self.trx_started = False
+
+			# Power emulation
+			if self.pm is not None:
+				self.pm.del_bts_list([self.tx_freq])
+
+			# Stop clock indications
+			if self.clck_gen is not None:
+				self.clck_gen.stop()
+
+			return 0
+
+		# Tuning Control
+		elif self.verify_cmd(request, "RXTUNE", 1):
+			print("[i] Recv RXTUNE cmd")
+
+			# TODO: check freq range
+			self.rx_freq = int(request[1]) * 1000
+			return 0
+
+		elif self.verify_cmd(request, "TXTUNE", 1):
+			print("[i] Recv TXTUNE cmd")
+
+			# TODO: check freq range
+			self.tx_freq = int(request[1]) * 1000
+			self.burst_fwd.bts_freq = self.tx_freq
+			return 0
+
+		# Timing of Arrival simulation for Downlink
+		# Absolute form: CMD FAKE_TOA <BASE> <THRESH>
+		elif self.verify_cmd(request, "FAKE_TOA", 2):
+			print("[i] Recv FAKE_TOA cmd")
+
+			# Parse and apply both base and threshold
+			self.burst_fwd.toa256_dl_base = int(request[1])
+			self.burst_fwd.toa256_dl_threshold = int(request[2])
+
+			return 0
+
+		# Timing of Arrival simulation for Downlink
+		# Relative form: CMD FAKE_TOA <+-BASE_DELTA>
+		elif self.verify_cmd(request, "FAKE_TOA", 1):
+			print("[i] Recv FAKE_TOA cmd")
+
+			# Parse and apply delta
+			self.burst_fwd.toa256_dl_base += int(request[1])
+
+			return 0
+
+		# RSSI simulation for Downlink
+		# Absolute form: CMD FAKE_RSSI <BASE> <THRESH>
+		elif self.verify_cmd(request, "FAKE_RSSI", 2):
+			print("[i] Recv FAKE_RSSI cmd")
+
+			# Parse and apply both base and threshold
+			self.burst_fwd.rssi_dl_base = int(request[1])
+			self.burst_fwd.rssi_dl_threshold = int(request[2])
+
+			return 0
+
+		# RSSI simulation for Downlink
+		# Relative form: CMD FAKE_RSSI <+-BASE_DELTA>
+		elif self.verify_cmd(request, "FAKE_RSSI", 1):
+			print("[i] Recv FAKE_RSSI cmd")
+
+			# Parse and apply delta
+			self.burst_fwd.rssi_dl_base += int(request[1])
+
+			return 0
+
+		# Path loss simulation for DL: burst dropping
+		# Syntax: CMD FAKE_DROP <AMOUNT>
+		# Dropping pattern: fn % 1 == 0
+		elif self.verify_cmd(request, "FAKE_DROP", 1):
+			print("[i] Recv FAKE_DROP cmd")
+
+			# Parse / validate amount of bursts
+			num = int(request[1])
+			if num < 0:
+				print("[!] FAKE_DROP amount shall not be negative")
+				return -1
+
+			self.burst_fwd.burst_dl_drop_amount = num
+			self.burst_fwd.burst_dl_drop_period = 1
+
+			return 0
+
+		# Path loss simulation for DL: burst dropping
+		# Syntax: CMD FAKE_DROP <AMOUNT> <FN_PERIOD>
+		# Dropping pattern: fn % period == 0
+		elif self.verify_cmd(request, "FAKE_DROP", 2):
+			print("[i] Recv FAKE_DROP cmd")
+
+			# Parse / validate amount of bursts
+			num = int(request[1])
+			if num < 0:
+				print("[!] FAKE_DROP amount shall not be negative")
+				return -1
+
+			# Parse / validate period
+			period = int(request[2])
+			if period <= 0:
+				print("[!] FAKE_DROP period shall be greater than zero")
+				return -1
+
+			self.burst_fwd.burst_dl_drop_amount = num
+			self.burst_fwd.burst_dl_drop_period = period
+
+			return 0
+
+		# Wrong / unknown command
+		else:
+			# We don't care about other commands,
+			# so let's merely ignore them ;)
+			print("[i] Ignore CMD %s" % request[0])
+			return 0
diff --git a/src/target/trx_toolkit/data_dump.py b/src/target/trx_toolkit/data_dump.py
new file mode 100644
index 00000000..1d7805e3
--- /dev/null
+++ b/src/target/trx_toolkit/data_dump.py
@@ -0,0 +1,360 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# Helpers for DATA capture management
+#
+# (C) 2018 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import struct
+
+from data_msg import *
+
+class DATADump:
+	# Constants
+	TAG_L12TRX = b'\x01'
+	TAG_TRX2L1 = b'\x02'
+	HDR_LENGTH = 3
+
+	# Generates raw bytes from a DATA message
+	# Return value: raw message bytes
+	def dump_msg(self, msg):
+		# Determine a message type
+		if isinstance(msg, DATAMSG_L12TRX):
+			tag = self.TAG_L12TRX
+		elif isinstance(msg, DATAMSG_TRX2L1):
+			tag = self.TAG_TRX2L1
+		else:
+			raise ValueError("Unknown message type")
+
+		# Generate a message payload
+		msg_raw = msg.gen_msg()
+
+		# Calculate and pack the message length
+		msg_len = len(msg_raw)
+
+		# Pack to unsigned short (2 bytes, BE)
+		msg_len = struct.pack(">H", msg_len)
+
+		# Concatenate a message with header
+		return bytearray(tag + msg_len) + msg_raw
+
+	def parse_hdr(self, hdr):
+		# Extract the header info
+		msg_len = struct.unpack(">H", hdr[1:3])[0]
+		tag = hdr[:1]
+
+		# Check if tag is known
+		if tag == self.TAG_L12TRX:
+			# L1 -> TRX
+			msg = DATAMSG_L12TRX()
+		elif tag == self.TAG_TRX2L1:
+			# TRX -> L1
+			msg = DATAMSG_TRX2L1()
+		else:
+			# Unknown tag
+			return False
+
+		return (msg, msg_len)
+
+class DATADumpFile(DATADump):
+	def __init__(self, capture):
+		# Check if capture file is already opened
+		if isinstance(capture, str):
+			print("[i] Opening capture file '%s'..." % capture)
+			self.f = open(capture, "a+b")
+		else:
+			self.f = capture
+
+	def __del__(self):
+		print("[i] Closing the capture file")
+		self.f.close()
+
+	# Moves the file descriptor before a specified message
+	# Return value:
+	#   True in case of success,
+	#   or False in case of EOF or header parsing error.
+	def _seek2msg(self, idx):
+		# Seek to the begining of the capture
+		self.f.seek(0)
+
+		# Read the capture in loop...
+		for i in range(idx):
+			# Attempt to read a message header
+			hdr_raw = self.f.read(self.HDR_LENGTH)
+			if len(hdr_raw) != self.HDR_LENGTH:
+				return False
+
+			# Attempt to parse it
+			rc = self.parse_hdr(hdr_raw)
+			if rc is False:
+				print("[!] Couldn't parse a message header")
+				return False
+
+			# Expand the header
+			(_, msg_len) = rc
+
+			# Skip a message
+			self.f.seek(msg_len, 1)
+
+		return True
+
+	# Parses a single message at the current descriptor position
+	# Return value:
+	#   a parsed message in case of success,
+	#   or None in case of EOF or header parsing error,
+	#   or False in case of message parsing error.
+	def _parse_msg(self):
+		# Attempt to read a message header
+		hdr_raw = self.f.read(self.HDR_LENGTH)
+		if len(hdr_raw) != self.HDR_LENGTH:
+			return None
+
+		# Attempt to parse it
+		rc = self.parse_hdr(hdr_raw)
+		if rc is False:
+			print("[!] Couldn't parse a message header")
+			return None
+
+		# Expand the header
+		(msg, msg_len) = rc
+
+		# Attempt to read a message
+		msg_raw = self.f.read(msg_len)
+		if len(msg_raw) != msg_len:
+			print("[!] Message length mismatch")
+			return None
+
+		# Attempt to parse a message
+		try:
+			msg_raw = bytearray(msg_raw)
+			msg.parse_msg(msg_raw)
+		except:
+			print("[!] Couldn't parse a message, skipping...")
+			return False
+
+		# Success
+		return msg
+
+	# Parses a particular message defined by index idx
+	# Return value:
+	#   a parsed message in case of success,
+	#   or None in case of EOF or header parsing error,
+	#   or False in case of message parsing error or out of range.
+	def parse_msg(self, idx):
+		# Move descriptor to the begining of requested message
+		rc = self._seek2msg(idx)
+		if not rc:
+			print("[!] Couldn't find requested message")
+			return False
+
+		# Attempt to parse a message
+		return self._parse_msg()
+
+	# Parses all messages from a given file
+	# Return value:
+	#   list of parsed messages,
+	#   or False in case of range error.
+	def parse_all(self, skip = None, count = None):
+		result = []
+
+		# Should we skip some messages?
+		if skip is None:
+			# Seek to the begining of the capture
+			self.f.seek(0)
+		else:
+			rc = self._seek2msg(skip)
+			if not rc:
+				print("[!] Couldn't find requested message")
+				return False
+
+		# Read the capture in loop...
+		while True:
+			# Attempt to parse a message
+			msg = self._parse_msg()
+
+			# EOF or broken header
+			if msg is None:
+				break
+
+			# Skip unparsed messages
+			if msg is False:
+				continue
+
+			# Success, append a message
+			result.append(msg)
+
+			# Count limitation
+			if count is not None:
+				if len(result) == count:
+					break
+
+		return result
+
+	# Writes a new message at the end of the capture
+	def append_msg(self, msg):
+		# Generate raw bytes and write
+		msg_raw = self.dump_msg(msg)
+		self.f.write(msg_raw)
+
+	# Writes a list of messages at the end of the capture
+	def append_all(self, msgs):
+		for msg in msgs:
+			self.append_msg(msg)
+
+# Regression tests
+if __name__ == '__main__':
+	from tempfile import TemporaryFile
+	from gsm_shared import *
+	import random
+
+	# Create a temporary file
+	tf = TemporaryFile()
+
+	# Create an instance of DATA dump manager
+	ddf = DATADumpFile(tf)
+
+	# Generate two random bursts
+	burst_l12trx = []
+	burst_trx2l1 = []
+
+	for i in range(0, GSM_BURST_LEN):
+		ubit = random.randint(0, 1)
+		burst_l12trx.append(ubit)
+
+		sbit = random.randint(-127, 127)
+		burst_trx2l1.append(sbit)
+
+	# Generate a basic list of random messages
+	print("[i] Generating the reference messages")
+	messages_ref = []
+
+	for i in range(100):
+		# Create a message
+		if i % 2:
+			msg = DATAMSG_L12TRX()
+			msg.burst = burst_l12trx
+		else:
+			msg = DATAMSG_TRX2L1()
+			msg.burst = burst_trx2l1
+
+		# Randomize the header
+		msg.rand_hdr()
+
+		# Append
+		messages_ref.append(msg)
+
+	print("[i] Adding the following messages to the capture:")
+	for msg in messages_ref[:3]:
+		print("    %s: burst_len=%d"
+			% (msg.desc_hdr(), len(msg.burst)))
+
+	# Check single message appending
+	ddf.append_msg(messages_ref[0])
+	ddf.append_msg(messages_ref[1])
+	ddf.append_msg(messages_ref[2])
+
+	# Read the written messages back
+	messages_check = ddf.parse_all()
+
+	print("[i] Read the following messages back:")
+	for msg in messages_check:
+		print("    %s: burst_len=%d"
+			% (msg.desc_hdr(), len(msg.burst)))
+
+	# Expecting three messages
+	assert(len(messages_check) == 3)
+
+	# Check the messages
+	for i in range(3):
+		# Compare common header parts and bursts
+		assert(messages_check[i].burst == messages_ref[i].burst)
+		assert(messages_check[i].fn == messages_ref[i].fn)
+		assert(messages_check[i].tn == messages_ref[i].tn)
+
+		# Validate a message
+		assert(messages_check[i].validate())
+
+	print("[?] Check append_msg(): OK")
+
+
+	# Append the pending reference messages
+	ddf.append_all(messages_ref[3:])
+
+	# Read the written messages back
+	messages_check = ddf.parse_all()
+
+	# Check the final amount
+	assert(len(messages_check) == len(messages_ref))
+
+	# Check the messages
+	for i in range(len(messages_check)):
+		# Compare common header parts and bursts
+		assert(messages_check[i].burst == messages_ref[i].burst)
+		assert(messages_check[i].fn == messages_ref[i].fn)
+		assert(messages_check[i].tn == messages_ref[i].tn)
+
+		# Validate a message
+		assert(messages_check[i].validate())
+
+	print("[?] Check append_all(): OK")
+
+
+	# Check parse_msg()
+	msg0 = ddf.parse_msg(0)
+	msg10 = ddf.parse_msg(10)
+
+	# Make sure parsing was successful
+	assert(msg0 and msg10)
+
+	# Compare common header parts and bursts
+	assert(msg0.burst == messages_ref[0].burst)
+	assert(msg0.fn == messages_ref[0].fn)
+	assert(msg0.tn == messages_ref[0].tn)
+
+	assert(msg10.burst == messages_ref[10].burst)
+	assert(msg10.fn == messages_ref[10].fn)
+	assert(msg10.tn == messages_ref[10].tn)
+
+	# Validate both messages
+	assert(msg0.validate())
+	assert(msg10.validate())
+
+	print("[?] Check parse_msg(): OK")
+
+
+	# Check parse_all() with range
+	messages_check = ddf.parse_all(skip = 10, count = 20)
+
+	# Make sure parsing was successful
+	assert(messages_check)
+
+	# Check the amount
+	assert(len(messages_check) == 20)
+
+	for i in range(20):
+		# Compare common header parts and bursts
+		assert(messages_check[i].burst == messages_ref[i + 10].burst)
+		assert(messages_check[i].fn == messages_ref[i + 10].fn)
+		assert(messages_check[i].tn == messages_ref[i + 10].tn)
+
+		# Validate a message
+		assert(messages_check[i].validate())
+
+	print("[?] Check parse_all(): OK")
diff --git a/src/target/trx_toolkit/data_if.py b/src/target/trx_toolkit/data_if.py
new file mode 100644
index 00000000..f4431a46
--- /dev/null
+++ b/src/target/trx_toolkit/data_if.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# DATA interface implementation
+#
+# (C) 2017-2018 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from udp_link import UDPLink
+from data_msg import *
+
+class DATAInterface(UDPLink):
+
+	def send_msg(self, msg):
+		# Validate a message
+		if not msg.validate():
+			raise ValueError("Message incomplete or incorrect")
+
+		# Generate TRX message
+		payload = msg.gen_msg()
+
+		# Send message
+		self.send(payload)
diff --git a/src/target/trx_toolkit/data_msg.py b/src/target/trx_toolkit/data_msg.py
new file mode 100644
index 00000000..ea415ab9
--- /dev/null
+++ b/src/target/trx_toolkit/data_msg.py
@@ -0,0 +1,545 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# DATA interface message definitions and helpers
+#
+# (C) 2018 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import random
+import struct
+
+from gsm_shared import *
+
+class DATAMSG:
+	# Common message fields
+	burst = None
+	fn = None
+	tn = None
+
+	# Common constructor
+	def __init__(self, fn = None, tn = None, burst = None):
+		self.burst = burst
+		self.fn = fn
+		self.tn = tn
+
+	# Generates message specific header
+	def gen_hdr(self):
+		raise NotImplementedError
+
+	# Parses message specific header
+	def parse_hdr(self, hdr):
+		raise NotImplementedError
+
+	# Generates message specific burst
+	def gen_burst(self):
+		raise NotImplementedError
+
+	# Parses message specific burst
+	def parse_burst(self, burst):
+		raise NotImplementedError
+
+	# Generates a random frame number
+	def rand_fn(self):
+		return random.randint(0, GSM_HYPERFRAME)
+
+	# Generates a random timeslot number
+	def rand_tn(self):
+		return random.randint(0, 7)
+
+	# Randomizes the message header
+	def rand_hdr(self):
+		self.fn = self.rand_fn()
+		self.tn = self.rand_tn()
+
+	# Generates human-readable header description
+	def desc_hdr(self):
+		result = ""
+
+		if self.fn is not None:
+			result += ("fn=%u " % self.fn)
+
+		if self.tn is not None:
+			result += ("tn=%u " % self.tn)
+
+		return result
+
+	# Converts unsigned soft-bits {254..0} to soft-bits {-127..127}
+	def usbit2sbit(self, bits):
+		buf = []
+
+		for bit in bits:
+			if bit == 0xff:
+				buf.append(-127)
+			else:
+				buf.append(127 - bit)
+
+		return buf
+
+	# Converts soft-bits {-127..127} to unsigned soft-bits {254..0}
+	def sbit2usbit(self, bits):
+		buf = []
+
+		for bit in bits:
+			buf.append(127 - bit)
+
+		return buf
+
+	# Converts soft-bits {-127..127} to bits {1..0}
+	def sbit2ubit(self, bits):
+		buf = []
+
+		for bit in bits:
+			buf.append(1 if bit < 0 else 0)
+
+		return buf
+
+	# Converts bits {1..0} to soft-bits {-127..127}
+	def ubit2sbit(self, bits):
+		buf = []
+
+		for bit in bits:
+			buf.append(-127 if bit else 127)
+
+		return buf
+
+	# Validates the message fields
+	def validate(self):
+		if self.burst is None:
+			return False
+
+		if len(self.burst) not in (GSM_BURST_LEN, EDGE_BURST_LEN):
+			return False
+
+		if self.fn is None:
+			return False
+
+		if self.fn < 0 or self.fn > GSM_HYPERFRAME:
+			return False
+
+		if self.tn is None:
+			return False
+
+		if self.tn < 0 or self.tn > 7:
+			return False
+
+		return True
+
+	# Generates frame number to bytes
+	def gen_fn(self, fn):
+		# Allocate an empty byte-array
+		buf = bytearray()
+
+		# Big endian, 4 bytes
+		buf.append((fn >> 24) & 0xff)
+		buf.append((fn >> 16) & 0xff)
+		buf.append((fn >>  8) & 0xff)
+		buf.append((fn >>  0) & 0xff)
+
+		return buf
+
+	# Parses frame number from bytes
+	def parse_fn(self, buf):
+		# Big endian, 4 bytes
+		return (buf[0] << 24) \
+			 | (buf[1] << 16) \
+			 | (buf[2] << 8)  \
+			 | (buf[3] << 0)
+
+	# Generates a TRX DATA message
+	def gen_msg(self):
+		# Validate all the fields
+		if not self.validate():
+			raise ValueError("Message incomplete or incorrect")
+
+		# Allocate an empty byte-array
+		buf = bytearray()
+
+		# Put timeslot index
+		buf.append(self.tn)
+
+		# Put frame number
+		fn = self.gen_fn(self.fn)
+		buf += fn
+
+		# Generate message specific header part
+		hdr = self.gen_hdr()
+		buf += hdr
+
+		# Generate burst
+		buf += self.gen_burst()
+
+		return buf
+
+	# Parses a TRX DATA message
+	def parse_msg(self, msg):
+		# Calculate message length
+		length = len(msg)
+
+		# Check length
+		if length < (self.HDR_LEN + GSM_BURST_LEN):
+			raise ValueError("Message is to short")
+
+		# Parse both fn and tn
+		self.fn = self.parse_fn(msg[1:])
+		self.tn = msg[0]
+
+		# Specific message part
+		self.parse_hdr(msg)
+
+		# Copy burst, skipping header
+		msg_burst = msg[self.HDR_LEN:]
+		self.parse_burst(msg_burst)
+
+class DATAMSG_L12TRX(DATAMSG):
+	# Constants
+	HDR_LEN = 6
+	PWR_MIN = 0x00
+	PWR_MAX = 0xff
+
+	# Specific message fields
+	pwr = None
+
+	# Validates the message fields
+	def validate(self):
+		# Validate common fields
+		if not DATAMSG.validate(self):
+			return False
+
+		if self.pwr is None:
+			return False
+
+		if self.pwr < self.PWR_MIN or self.pwr > self.PWR_MAX:
+			return False
+
+		return True
+
+	# Generates a random power level
+	def rand_pwr(self, min = None, max = None):
+		if min is None:
+			min = self.PWR_MIN
+
+		if max is None:
+			max = self.PWR_MAX
+
+		return random.randint(min, max)
+
+	# Randomizes message specific header
+	def rand_hdr(self):
+		DATAMSG.rand_hdr(self)
+		self.pwr = self.rand_pwr()
+
+	# Generates human-readable header description
+	def desc_hdr(self):
+		# Describe the common part
+		result = DATAMSG.desc_hdr(self)
+
+		if self.pwr is not None:
+			result += ("pwr=%u " % self.pwr)
+
+		# Strip useless whitespace and return
+		return result.strip()
+
+	# Generates message specific header part
+	def gen_hdr(self):
+		# Allocate an empty byte-array
+		buf = bytearray()
+
+		# Put power
+		buf.append(self.pwr)
+
+		return buf
+
+	# Parses message specific header part
+	def parse_hdr(self, hdr):
+		# Parse power level
+		self.pwr = hdr[5]
+
+	# Generates message specific burst
+	def gen_burst(self):
+		# Copy burst 'as is'
+		return bytearray(self.burst)
+
+	# Parses message specific burst
+	def parse_burst(self, burst):
+		length = len(burst)
+
+		# Distinguish between GSM and EDGE
+		if length >= EDGE_BURST_LEN:
+			self.burst = list(burst[:EDGE_BURST_LEN])
+		else:
+			self.burst = list(burst[:GSM_BURST_LEN])
+
+	# Transforms this message to TRX2L1 message
+	def gen_trx2l1(self):
+		# Allocate a new message
+		msg = DATAMSG_TRX2L1(fn = self.fn, tn = self.tn)
+
+		# Convert burst bits
+		if self.burst is not None:
+			msg.burst = self.ubit2sbit(self.burst)
+
+		return msg
+
+class DATAMSG_TRX2L1(DATAMSG):
+	# Constants
+	HDR_LEN = 8
+	RSSI_MIN = -120
+	RSSI_MAX = -50
+
+	# TODO: verify this range
+	TOA256_MIN = -256 * 200
+	TOA256_MAX = 256 * 200
+
+	# Specific message fields
+	rssi = None
+	toa256 = None
+
+	# Validates the message fields
+	def validate(self):
+		# Validate common fields
+		if not DATAMSG.validate(self):
+			return False
+
+		if self.rssi is None:
+			return False
+
+		if self.rssi < self.RSSI_MIN or self.rssi > self.RSSI_MAX:
+			return False
+
+		if self.toa256 is None:
+			return False
+
+		if self.toa256 < self.TOA256_MIN or self.toa256 > self.TOA256_MAX:
+			return False
+
+		return True
+
+	# Generates a random RSSI value
+	def rand_rssi(self, min = None, max = None):
+		if min is None:
+			min = self.RSSI_MIN
+
+		if max is None:
+			max = self.RSSI_MAX
+
+		return random.randint(min, max)
+
+	# Generates a ToA (Time of Arrival) value
+	def rand_toa256(self, min = None, max = None):
+		if min is None:
+			min = self.TOA256_MIN
+
+		if max is None:
+			max = self.TOA256_MAX
+
+		return random.randint(min, max)
+
+	# Randomizes message specific header
+	def rand_hdr(self):
+		DATAMSG.rand_hdr(self)
+		self.rssi = self.rand_rssi()
+		self.toa256 = self.rand_toa256()
+
+	# Generates human-readable header description
+	def desc_hdr(self):
+		# Describe the common part
+		result = DATAMSG.desc_hdr(self)
+
+		if self.rssi is not None:
+			result += ("rssi=%d " % self.rssi)
+
+		if self.toa256 is not None:
+			result += ("toa256=%d " % self.toa256)
+
+		# Strip useless whitespace and return
+		return result.strip()
+
+	# Generates message specific header part
+	def gen_hdr(self):
+		# Allocate an empty byte-array
+		buf = bytearray()
+
+		# Put RSSI
+		buf.append(-self.rssi)
+
+		# Encode ToA (Time of Arrival)
+		# Big endian, 2 bytes (int32_t)
+		buf.append((self.toa256 >> 8) & 0xff)
+		buf.append(self.toa256 & 0xff)
+
+		return buf
+
+	# Parses message specific header part
+	def parse_hdr(self, hdr):
+		# Parse RSSI
+		self.rssi = -(hdr[5])
+
+		# Parse ToA (Time of Arrival)
+		self.toa256 = struct.unpack(">h", hdr[6:8])[0]
+
+	# Generates message specific burst
+	def gen_burst(self):
+		# Convert soft-bits to unsigned soft-bits
+		burst_usbits = self.sbit2usbit(self.burst)
+
+		# Encode to bytes
+		return bytearray(burst_usbits)
+
+	# Parses message specific burst
+	def parse_burst(self, burst):
+		length = len(burst)
+
+		# Distinguish between GSM and EDGE
+		if length >= EDGE_BURST_LEN:
+			burst_usbits = list(burst[:EDGE_BURST_LEN])
+		else:
+			burst_usbits = list(burst[:GSM_BURST_LEN])
+
+		# Convert unsigned soft-bits to soft-bits
+		burst_sbits = self.usbit2sbit(burst_usbits)
+
+		# Save
+		self.burst = burst_sbits
+
+	# Transforms this message to L12TRX message
+	def gen_l12trx(self):
+		# Allocate a new message
+		msg = DATAMSG_L12TRX(fn = self.fn, tn = self.tn)
+
+		# Convert burst bits
+		if self.burst is not None:
+			msg.burst = self.sbit2ubit(self.burst)
+
+		return msg
+
+# Regression test
+if __name__ == '__main__':
+	# Common reference data
+	fn = 1024
+	tn = 0
+
+	# Generate two random bursts
+	burst_l12trx_ref = []
+	burst_trx2l1_ref = []
+
+	for i in range(0, GSM_BURST_LEN):
+		ubit = random.randint(0, 1)
+		burst_l12trx_ref.append(ubit)
+
+		sbit = random.randint(-127, 127)
+		burst_trx2l1_ref.append(sbit)
+
+	print("[i] Generating the reference messages")
+
+	# Create messages of both types
+	msg_l12trx_ref = DATAMSG_L12TRX(fn = fn, tn = tn)
+	msg_trx2l1_ref = DATAMSG_TRX2L1(fn = fn, tn = tn)
+
+	# Fill in message specific fields
+	msg_trx2l1_ref.rssi = -88
+	msg_l12trx_ref.pwr = 0x33
+	msg_trx2l1_ref.toa256 = -256
+
+	# Specify the reference bursts
+	msg_l12trx_ref.burst = burst_l12trx_ref
+	msg_trx2l1_ref.burst = burst_trx2l1_ref
+
+	print("[i] Encoding the reference messages")
+
+	# Encode DATA messages
+	l12trx_raw = msg_l12trx_ref.gen_msg()
+	trx2l1_raw = msg_trx2l1_ref.gen_msg()
+
+	print("[i] Parsing generated messages back")
+
+	# Parse generated DATA messages
+	msg_l12trx_dec = DATAMSG_L12TRX()
+	msg_trx2l1_dec = DATAMSG_TRX2L1()
+	msg_l12trx_dec.parse_msg(l12trx_raw)
+	msg_trx2l1_dec.parse_msg(trx2l1_raw)
+
+	print("[i] Comparing decoded messages with the reference")
+
+	# Compare bursts
+	assert(msg_l12trx_dec.burst == burst_l12trx_ref)
+	assert(msg_trx2l1_dec.burst == burst_trx2l1_ref)
+
+	print("[?] Compare bursts: OK")
+
+	# Compare both parsed messages with the reference data
+	assert(msg_l12trx_dec.fn == fn)
+	assert(msg_trx2l1_dec.fn == fn)
+	assert(msg_l12trx_dec.tn == tn)
+	assert(msg_trx2l1_dec.tn == tn)
+
+	print("[?] Compare FN / TN: OK")
+
+	# Compare message specific parts
+	assert(msg_trx2l1_dec.rssi == msg_trx2l1_ref.rssi)
+	assert(msg_l12trx_dec.pwr == msg_l12trx_ref.pwr)
+	assert(msg_trx2l1_dec.toa256 == msg_trx2l1_ref.toa256)
+
+	print("[?] Compare message specific data: OK")
+
+	# Validate header randomization
+	for i in range(0, 100):
+		msg_l12trx_ref.rand_hdr()
+		msg_trx2l1_ref.rand_hdr()
+
+		assert(msg_l12trx_ref.validate())
+		assert(msg_trx2l1_ref.validate())
+
+	print("[?] Validate header randomization: OK")
+
+	# Bit conversation test
+	usbits_ref = list(range(0, 256))
+	sbits_ref = list(range(-127, 128))
+
+	# Test both usbit2sbit() and sbit2usbit()
+	sbits = msg_trx2l1_ref.usbit2sbit(usbits_ref)
+	usbits = msg_trx2l1_ref.sbit2usbit(sbits)
+	assert(usbits[:255] == usbits_ref[:255])
+	assert(usbits[255] == 254)
+
+	print("[?] Check both usbit2sbit() and sbit2usbit(): OK")
+
+	# Test both sbit2ubit() and ubit2sbit()
+	ubits = msg_trx2l1_ref.sbit2ubit(sbits_ref)
+	assert(ubits == ([1] * 127 + [0] * 128))
+
+	sbits = msg_trx2l1_ref.ubit2sbit(ubits)
+	assert(sbits == ([-127] * 127 + [127] * 128))
+
+	print("[?] Check both sbit2ubit() and ubit2sbit(): OK")
+
+	# Test message transformation
+	msg_l12trx_dec = msg_trx2l1_ref.gen_l12trx()
+	msg_trx2l1_dec = msg_l12trx_ref.gen_trx2l1()
+
+	assert(msg_l12trx_dec.fn == msg_trx2l1_ref.fn)
+	assert(msg_l12trx_dec.tn == msg_trx2l1_ref.tn)
+
+	assert(msg_trx2l1_dec.fn == msg_l12trx_ref.fn)
+	assert(msg_trx2l1_dec.tn == msg_l12trx_ref.tn)
+
+	assert(msg_l12trx_dec.burst == msg_l12trx_dec.sbit2ubit(burst_trx2l1_ref))
+	assert(msg_trx2l1_dec.burst == msg_trx2l1_dec.ubit2sbit(burst_l12trx_ref))
+
+	print("[?] Check L12TRX <-> TRX2L1 type transformations: OK")
diff --git a/src/target/trx_toolkit/fake_pm.py b/src/target/trx_toolkit/fake_pm.py
new file mode 100644
index 00000000..840b4e40
--- /dev/null
+++ b/src/target/trx_toolkit/fake_pm.py
@@ -0,0 +1,53 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# Power measurement emulation for BB
+#
+# (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from random import randint
+
+class FakePM:
+	# Freq. list for good power level
+	bts_list = []
+
+	def __init__(self, noise_min, noise_max, bts_min, bts_max):
+		# Save power level ranges
+		self.noise_min = noise_min
+		self.noise_max = noise_max
+		self.bts_min = bts_min
+		self.bts_max = bts_max
+
+	def measure(self, bts):
+		if bts in self.bts_list:
+			return randint(self.bts_min, self.bts_max)
+		else:
+			return randint(self.noise_min, self.noise_max)
+
+	def update_bts_list(self, new_list):
+		self.bts_list = new_list
+
+	def add_bts_list(self, add_list):
+		self.bts_list += add_list
+
+	def del_bts_list(self, del_list):
+		for item in del_list:
+			if item in self.bts_list:
+				self.bts_list.remove(item)
diff --git a/src/target/trx_toolkit/fake_trx.py b/src/target/trx_toolkit/fake_trx.py
new file mode 100755
index 00000000..b818b2a9
--- /dev/null
+++ b/src/target/trx_toolkit/fake_trx.py
@@ -0,0 +1,236 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# Virtual Um-interface (fake transceiver)
+#
+# (C) 2017-2018 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from copyright import print_copyright
+CR_HOLDERS = [("2017-2018", "Vadim Yanitskiy <axilirator@gmail.com>")]
+
+import signal
+import getopt
+import select
+import sys
+
+from ctrl_if_bts import CTRLInterfaceBTS
+from ctrl_if_bb import CTRLInterfaceBB
+from burst_fwd import BurstForwarder
+from fake_pm import FakePM
+
+from udp_link import UDPLink
+from clck_gen import CLCKGen
+
+class Application:
+	# Application variables
+	bts_addr = "127.0.0.1"
+	bb_addr = "127.0.0.1"
+	trx_bind_addr = "0.0.0.0"
+	bts_base_port = 5700
+	bb_base_port = 6700
+
+	# BurstForwarder field randomization
+	randomize_dl_toa256 = False
+	randomize_ul_toa256 = False
+	randomize_dl_rssi = False
+	randomize_ul_rssi = False
+
+	def __init__(self):
+		print_copyright(CR_HOLDERS)
+		self.parse_argv()
+
+		# Set up signal handlers
+		signal.signal(signal.SIGINT, self.sig_handler)
+
+	def run(self):
+		# Init TRX CTRL interface for BTS
+		self.bts_ctrl = CTRLInterfaceBTS(self.bts_addr, self.bts_base_port + 101,
+			self.trx_bind_addr, self.bts_base_port + 1)
+
+		# Init TRX CTRL interface for BB
+		self.bb_ctrl = CTRLInterfaceBB(self.bb_addr, self.bb_base_port + 101,
+			self.trx_bind_addr, self.bb_base_port + 1)
+
+		# Power measurement emulation
+		# Noise: -120 .. -105
+		# BTS: -75 .. -50
+		self.pm = FakePM(-120, -105, -75, -50)
+
+		# Share a FakePM instance between both BTS and BB
+		self.bts_ctrl.pm = self.pm
+		self.bb_ctrl.pm = self.pm
+
+		# Init DATA links
+		self.bts_data = UDPLink(self.bts_addr, self.bts_base_port + 102,
+			self.trx_bind_addr, self.bts_base_port + 2)
+		self.bb_data = UDPLink(self.bb_addr, self.bb_base_port + 102,
+			self.trx_bind_addr, self.bb_base_port + 2)
+
+		# BTS <-> BB burst forwarding
+		self.burst_fwd = BurstForwarder(self.bts_data, self.bb_data)
+		self.burst_fwd.randomize_dl_toa256 = self.randomize_dl_toa256
+		self.burst_fwd.randomize_ul_toa256 = self.randomize_ul_toa256
+		self.burst_fwd.randomize_dl_rssi = self.randomize_dl_rssi
+		self.burst_fwd.randomize_ul_rssi = self.randomize_ul_rssi
+
+		# Share a BurstForwarder instance between BTS and BB
+		self.bts_ctrl.burst_fwd = self.burst_fwd
+		self.bb_ctrl.burst_fwd = self.burst_fwd
+
+		# Provide clock to BTS
+		self.bts_clck = UDPLink(self.bts_addr, self.bts_base_port + 100,
+			self.trx_bind_addr, self.bts_base_port)
+		self.clck_gen = CLCKGen([self.bts_clck])
+		self.bts_ctrl.clck_gen = self.clck_gen
+
+		print("[i] Init complete")
+
+		# Enter main loop
+		while True:
+			socks = [self.bts_ctrl.sock, self.bb_ctrl.sock,
+				self.bts_data.sock, self.bb_data.sock]
+
+			# Wait until we get any data on any socket
+			r_event, w_event, x_event = select.select(socks, [], [])
+
+			# Downlink: BTS -> BB
+			if self.bts_data.sock in r_event:
+				self.burst_fwd.bts2bb()
+
+			# Uplink: BB -> BTS
+			if self.bb_data.sock in r_event:
+				self.burst_fwd.bb2bts()
+
+			# CTRL commands from BTS
+			if self.bts_ctrl.sock in r_event:
+				data, addr = self.bts_ctrl.sock.recvfrom(128)
+				self.bts_ctrl.handle_rx(data.decode(), addr)
+
+			# CTRL commands from BB
+			if self.bb_ctrl.sock in r_event:
+				data, addr = self.bb_ctrl.sock.recvfrom(128)
+				self.bb_ctrl.handle_rx(data.decode(), addr)
+
+	def shutdown(self):
+		print("[i] Shutting down...")
+
+		# Stop clock generator
+		self.clck_gen.stop()
+
+	def print_help(self, msg = None):
+		s  = " Usage: " + sys.argv[0] + " [options]\n\n" \
+			 " Some help...\n" \
+			 "  -h --help           this text\n\n"
+
+		s += " TRX interface specific\n" \
+			 "  -R --bts-addr       Set BTS remote address (default %s)\n"   \
+			 "  -r --bb-addr        Set BB remote address (default %s)\n"    \
+			 "  -P --bts-base-port  Set BTS base port number (default %d)\n" \
+			 "  -p --bb-base-port   Set BB base port number (default %d)\n" \
+			 "  -b --trx-bind-addr  Set TRX bind address (default %s)\n\n"
+
+		s += " Simulation\n" \
+			 "  --rand-dl-rssi      Enable DL RSSI randomization\n"   \
+			 "  --rand-ul-rssi      Enable UL RSSI randomization\n"   \
+			 "  --rand-dl-toa       Enable DL ToA randomization\n"    \
+			 "  --rand-ul-toa       Enable UL ToA randomization\n"
+
+		print(s % (self.bts_addr, self.bb_addr,
+			self.bts_base_port, self.bb_base_port,
+			self.trx_bind_addr))
+
+		if msg is not None:
+			print(msg)
+
+	def parse_argv(self):
+		try:
+			opts, args = getopt.getopt(sys.argv[1:],
+				"R:r:P:p:b:h",
+				[
+					"help",
+					"bts-addr=", "bb-addr=",
+					"bts-base-port=", "bb-base-port=",
+					"trx-bind-addr=",
+					"rand-dl-rssi", "rand-ul-rssi",
+					"rand-dl-toa", "rand-ul-toa",
+				])
+		except getopt.GetoptError as err:
+			self.print_help("[!] " + str(err))
+			sys.exit(2)
+
+		for o, v in opts:
+			if o in ("-h", "--help"):
+				self.print_help()
+				sys.exit(2)
+
+			elif o in ("-R", "--bts-addr"):
+				self.bts_addr = v
+			elif o in ("-r", "--bb-addr"):
+				self.bb_addr = v
+
+			elif o in ("-P", "--bts-base-port"):
+				self.bts_base_port = int(v)
+			elif o in ("-p", "--bb-base-port"):
+				self.bb_base_port = int(v)
+
+			elif o in ("-b", "--trx-bind-addr"):
+				self.trx_bind_addr = v
+
+			# Message field randomization
+			elif o == "rand-dl-rssi":
+				self.randomize_dl_rssi = True
+			elif o == "rand-ul-rssi":
+				self.randomize_ul_rssi = True
+			elif o == "rand-dl-toa":
+				self.randomize_dl_toa256 = True
+			elif o == "rand-ul-toa":
+				self.randomize_ul_toa256 = True
+
+		# Ensure there is no overlap between ports
+		if self.bts_base_port == self.bb_base_port:
+			self.print_help("[!] BTS and BB base ports should be different")
+			sys.exit(2)
+
+		bts_ports = [
+			self.bts_base_port + 0, self.bts_base_port + 100,
+			self.bts_base_port + 1, self.bts_base_port + 101,
+			self.bts_base_port + 2, self.bts_base_port + 102,
+		]
+
+		bb_ports = [
+			self.bb_base_port + 0, self.bb_base_port + 100,
+			self.bb_base_port + 1, self.bb_base_port + 101,
+			self.bb_base_port + 2, self.bb_base_port + 102,
+		]
+
+		for p in bb_ports:
+			if p in bts_ports:
+				self.print_help("[!] BTS and BB ports overlap detected")
+				sys.exit(2)
+
+	def sig_handler(self, signum, frame):
+		print("Signal %d received" % signum)
+		if signum is signal.SIGINT:
+			self.shutdown()
+			sys.exit(0)
+
+if __name__ == '__main__':
+	app = Application()
+	app.run()
diff --git a/src/target/trx_toolkit/gsm_shared.py b/src/target/trx_toolkit/gsm_shared.py
new file mode 100644
index 00000000..d2f8278b
--- /dev/null
+++ b/src/target/trx_toolkit/gsm_shared.py
@@ -0,0 +1,31 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# Common GSM constants
+#
+# (C) 2018 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+# TDMA definitions
+GSM_SUPERFRAME = 26 * 51
+GSM_HYPERFRAME = 2048 * GSM_SUPERFRAME
+
+# Burst length
+GSM_BURST_LEN = 148
+EDGE_BURST_LEN = GSM_BURST_LEN * 3
diff --git a/src/target/trx_toolkit/rand_burst_gen.py b/src/target/trx_toolkit/rand_burst_gen.py
new file mode 100644
index 00000000..46c1e090
--- /dev/null
+++ b/src/target/trx_toolkit/rand_burst_gen.py
@@ -0,0 +1,177 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# Random burst (NB, FB, SB, AB) generator
+#
+# (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import random
+
+from gsm_shared import *
+
+class RandBurstGen:
+
+	# GSM 05.02 Chapter 5.2.3 Normal Burst
+	nb_tsc_list = [
+		[
+			0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0,
+			0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1,
+		],
+		[
+			0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1,
+			1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1,
+		],
+		[
+			0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1,
+			0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0,
+		],
+		[
+			0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0,
+			1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0,
+		],
+		[
+			0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0,
+			1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1,
+		],
+		[
+			0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0,
+			0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0,
+		],
+		[
+			1, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 1,
+			0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1,
+		],
+		[
+			1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0,
+			0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0,
+		],
+	]
+
+	# GSM 05.02 Chapter 5.2.5 SCH training sequence
+	sb_tsc = [
+		1, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0,
+		0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1,
+		0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1,
+		0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1,
+	]
+
+	# GSM 05.02 Chapter 5.2.6 Dummy Burst
+	db_bits = [
+		0, 0, 0,
+		1, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0,
+		0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0,
+		0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0,
+		0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0,
+		0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0,
+		0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0,
+		0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1,
+		1, 1, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1,
+		0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0,
+		0, 0, 0,
+	]
+
+	# GSM 05.02 Chapter 5.2.7 Access burst
+	ab_tsc = [
+		0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1,
+		1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0,
+		1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0,
+	]
+
+	# Generate a normal burst
+	def gen_nb(self, seq_idx = 0):
+		buf = []
+
+		# Tailing bits
+		buf += [0] * 3
+
+		# Random data 1 / 2
+		for i in range(0, 57):
+			buf.append(random.randint(0, 1))
+
+		# Steal flag 1 / 2
+		buf.append(random.randint(0, 1))
+
+		# Training sequence
+		buf += self.nb_tsc_list[seq_idx]
+
+		# Steal flag 2 / 2
+		buf.append(random.randint(0, 1))
+
+		# Random data 2 / 2
+		for i in range(0, 57):
+			buf.append(random.randint(0, 1))
+
+		# Tailing bits
+		buf += [0] * 3
+
+		return buf
+
+	# Generate a frequency correction burst
+	def gen_fb(self):
+		return [0] * GSM_BURST_LEN
+
+	# Generate a synchronization burst
+	def gen_sb(self):
+		buf = []
+
+		# Tailing bits
+		buf += [0] * 3
+
+		# Random data 1 / 2
+		for i in range(0, 39):
+			buf.append(random.randint(0, 1))
+
+		# Training sequence
+		buf += self.sb_tsc
+
+		# Random data 2 / 2
+		for i in range(0, 39):
+			buf.append(random.randint(0, 1))
+
+		# Tailing bits
+		buf += [0] * 3
+
+		return buf
+
+	# Generate a dummy burst
+	def gen_db(self):
+		return self.db_bits
+
+	# Generate an access burst
+	def gen_ab(self):
+		buf = []
+
+		# Tailing bits
+		buf += [0] * 8
+
+		# Training sequence
+		buf += self.ab_tsc
+
+		# Random data
+		for i in range(0, 36):
+			buf.append(random.randint(0, 1))
+
+		# Tailing bits
+		buf += [0] * 3
+
+		# Guard period
+		buf += [0] * 60
+
+		return buf
diff --git a/src/target/trx_toolkit/trx_sniff.py b/src/target/trx_toolkit/trx_sniff.py
new file mode 100755
index 00000000..535bb3f9
--- /dev/null
+++ b/src/target/trx_toolkit/trx_sniff.py
@@ -0,0 +1,286 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# Scapy-based TRX interface sniffer
+#
+# (C) 2018 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from copyright import print_copyright
+CR_HOLDERS = [("2018", "Vadim Yanitskiy <axilirator@gmail.com>")]
+
+import signal
+import getopt
+import sys
+
+import scapy.all
+
+from data_dump import DATADumpFile
+from data_msg import *
+
+class Application:
+	# Application variables
+	sniff_interface = "lo"
+	sniff_base_port = 5700
+	print_bursts = False
+	output_file = None
+
+	# Counters
+	cnt_burst_dropped_num = 0
+	cnt_burst_break = None
+	cnt_burst_num = 0
+
+	cnt_frame_break = None
+	cnt_frame_last = None
+	cnt_frame_num = 0
+
+	# Burst direction fliter
+	bf_dir_l12trx = None
+
+	# Timeslot number filter
+	bf_tn_val = None
+
+	# Frame number fliter
+	bf_fn_lt = None
+	bf_fn_gt = None
+
+	# Internal variables
+	lo_trigger = False
+
+	def __init__(self):
+		print_copyright(CR_HOLDERS)
+		self.parse_argv()
+
+		# Open requested capture file
+		if self.output_file is not None:
+			self.ddf = DATADumpFile(self.output_file)
+
+	def run(self):
+		# Compose a packet filter
+		pkt_filter = "udp and (port %d or port %d)" \
+			% (self.sniff_base_port + 2, self.sniff_base_port + 102)
+
+		print("[i] Listening on interface '%s'..." % self.sniff_interface)
+
+		# Start sniffing...
+		scapy.all.sniff(iface = self.sniff_interface, store = 0,
+			filter = pkt_filter, prn = self.pkt_handler)
+
+		# Scapy registers its own signal handler
+		self.shutdown()
+
+	def pkt_handler(self, ether):
+		# Prevent loopback packet duplication
+		if self.sniff_interface == "lo":
+			self.lo_trigger = not self.lo_trigger
+			if not self.lo_trigger:
+				return
+
+		# Extract a TRX payload
+		ip = ether.payload
+		udp = ip.payload
+		trx = udp.payload
+
+		# Convert to bytearray
+		msg_raw = bytearray(str(trx))
+
+		# Determine a burst direction (L1 <-> TRX)
+		l12trx = udp.sport > udp.dport
+
+		# Create an empty DATA message
+		msg = DATAMSG_L12TRX() if l12trx else DATAMSG_TRX2L1()
+
+		# Attempt to parse the payload as a DATA message
+		try:
+			msg.parse_msg(msg_raw)
+		except:
+			print("[!] Failed to parse message, dropping...")
+			self.cnt_burst_dropped_num += 1
+			return
+
+		# Poke burst pass filter
+		rc = self.burst_pass_filter(l12trx, msg.fn, msg.tn)
+		if rc is False:
+			self.cnt_burst_dropped_num += 1
+			return
+
+		# Debug print
+		print("[i] %s burst: %s" \
+			% ("L1 -> TRX" if l12trx else "TRX -> L1", msg.desc_hdr()))
+
+		# Poke message handler
+		self.msg_handle(msg)
+
+		# Poke burst counter
+		rc = self.burst_count(msg.fn, msg.tn)
+		if rc is True:
+			self.shutdown()
+
+	def burst_pass_filter(self, l12trx, fn, tn):
+		# Direction filter
+		if self.bf_dir_l12trx is not None:
+			if l12trx != self.bf_dir_l12trx:
+				return False
+
+		# Timeslot filter
+		if self.bf_tn_val is not None:
+			if tn != self.bf_tn_val:
+				return False
+
+		# Frame number filter
+		if self.bf_fn_lt is not None:
+			if fn > self.bf_fn_lt:
+				return False
+		if self.bf_fn_gt is not None:
+			if fn < self.bf_fn_gt:
+				return False
+
+		# Burst passed ;)
+		return True
+
+	def msg_handle(self, msg):
+		if self.print_bursts:
+			print(msg.burst)
+
+		# Append a new message to the capture
+		if self.output_file is not None:
+			self.ddf.append_msg(msg)
+
+	def burst_count(self, fn, tn):
+		# Update frame counter
+		if self.cnt_frame_last is None:
+			self.cnt_frame_last = fn
+			self.cnt_frame_num += 1
+		else:
+			if fn != self.cnt_frame_last:
+				self.cnt_frame_num += 1
+
+		# Update burst counter
+		self.cnt_burst_num += 1
+
+		# Stop sniffing after N bursts
+		if self.cnt_burst_break is not None:
+			if self.cnt_burst_num == self.cnt_burst_break:
+				print("[i] Collected required amount of bursts")
+				return True
+
+		# Stop sniffing after N frames
+		if self.cnt_frame_break is not None:
+			if self.cnt_frame_num == self.cnt_frame_break:
+				print("[i] Collected required amount of frames")
+				return True
+
+		return False
+
+	def shutdown(self):
+		print("[i] Shutting down...")
+
+		# Print statistics
+		print("[i] %u bursts handled, %u dropped" \
+			% (self.cnt_burst_num, self.cnt_burst_dropped_num))
+
+		# Exit
+		sys.exit(0)
+
+	def print_help(self, msg = None):
+		s  = " Usage: " + sys.argv[0] + " [options]\n\n" \
+			 " Some help...\n" \
+			 "  -h --help              this text\n\n"
+
+		s += " Sniffing options\n" \
+			 "  -i --sniff-interface   Set network interface (default '%s')\n"  \
+			 "  -p --sniff-base-port   Set base port number (default %d)\n\n"
+
+		s += " Processing (no processing by default)\n" \
+			 "  -o --output-file       Write bursts to file\n"          \
+			 "  -v --print-bits        Print burst bits to stdout\n\n"  \
+
+		s += " Count limitations (disabled by default)\n" \
+			 "  --frame-count   NUM    Stop after sniffing NUM frames\n"  \
+			 "  --burst-count   NUM    Stop after sniffing NUM bursts\n\n"
+
+		s += " Filtering (disabled by default)\n" \
+			 "  --direction     DIR    Burst direction: L12TRX or TRX2L1\n"  \
+			 "  --timeslot      NUM    TDMA timeslot number [0..7]\n"        \
+			 "  --frame-num-lt  NUM    TDMA frame number lower than NUM\n"   \
+			 "  --burst-num-gt  NUM    TDMA frame number greater than NUM\n"
+
+		print(s % (self.sniff_interface, self.sniff_base_port))
+
+		if msg is not None:
+			print(msg)
+
+	def parse_argv(self):
+		try:
+			opts, args = getopt.getopt(sys.argv[1:],
+				"i:p:o:v:h", ["help", "sniff-interface=", "sniff-base-port=",
+					"frame-count=", "burst-count=", "direction=",
+					"timeslot=", "frame-num-lt=", "frame-num-gt=",
+					"output-file=", "print-bits"])
+		except getopt.GetoptError as err:
+			self.print_help("[!] " + str(err))
+			sys.exit(2)
+
+		for o, v in opts:
+			if o in ("-h", "--help"):
+				self.print_help()
+				sys.exit(2)
+
+			elif o in ("-i", "--sniff-interface"):
+				self.sniff_interface = v
+			elif o in ("-p", "--sniff-base-port"):
+				self.sniff_base_port = int(v)
+
+			elif o in ("-o", "--output-file"):
+				self.output_file = v
+			elif o in ("-v", "--print-bits"):
+				self.print_bursts = True
+
+			# Break counters
+			elif o == "--frame-count":
+				self.cnt_frame_break = int(v)
+			elif o == "--burst-count":
+				self.cnt_burst_break = int(v)
+
+			# Direction filter
+			elif o == "--direction":
+				if v == "L12TRX":
+					self.bf_dir_l12trx = True
+				elif v == "TRX2L1":
+					self.bf_dir_l12trx = False
+				else:
+					self.print_help("[!] Wrong direction argument")
+					sys.exit(2)
+
+			# Timeslot pass filter
+			elif o == "--timeslot":
+				self.bf_tn_val = int(v)
+				if self.bf_tn_val < 0 or self.bf_tn_val > 7:
+					self.print_help("[!] Wrong timeslot value")
+					sys.exit(2)
+
+			# Frame number pass filter
+			elif o == "--frame-num-lt":
+				self.bf_fn_lt = int(v)
+			elif o == "--frame-num-gt":
+				self.bf_fn_gt = int(v)
+
+if __name__ == '__main__':
+	app = Application()
+	app.run()
diff --git a/src/target/trx_toolkit/udp_link.py b/src/target/trx_toolkit/udp_link.py
new file mode 100644
index 00000000..b378b635
--- /dev/null
+++ b/src/target/trx_toolkit/udp_link.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python2
+# -*- coding: utf-8 -*-
+
+# TRX Toolkit
+# UDP link implementation
+#
+# (C) 2017 by Vadim Yanitskiy <axilirator@gmail.com>
+#
+# All Rights Reserved
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import socket
+
+class UDPLink:
+	def __init__(self, remote_addr, remote_port, bind_addr = '0.0.0.0', bind_port = 0):
+		self.sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+		self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+		self.sock.bind((bind_addr, bind_port))
+		self.sock.setblocking(0)
+
+		# Save remote info
+		self.remote_addr = remote_addr
+		self.remote_port = remote_port
+
+	def __del__(self):
+		self.sock.close()
+
+	def desc_link(self):
+		(bind_addr, bind_port) = self.sock.getsockname()
+
+		return "L:%s:%u <-> R:%s:%u" \
+			% (bind_addr, bind_port, self.remote_addr, self.remote_port)
+
+	def send(self, data):
+		if type(data) not in [bytearray, bytes]:
+			data = data.encode()
+
+		self.sock.sendto(data, (self.remote_addr, self.remote_port))
+
+	def sendto(self, data, remote):
+		if type(data) not in [bytearray, bytes]:
+			data = data.encode()
+
+		self.sock.sendto(data, remote)
diff --git a/src/target/ui-experiment/README b/src/target/ui-experiment/README
new file mode 100644
index 00000000..81b34d72
--- /dev/null
+++ b/src/target/ui-experiment/README
@@ -0,0 +1,11 @@
+
+This is some exploratory and experimental code related
+to the development of a proper lcd-based ui.
+
+It has been written by Ingo Albrecht <prom@berlin.ccc.de>
+and, lacking further arrangements, should be considered to
+be licensed under the GNU GPL v2 or later.
+
+I have placed this here due to general interest. All of it
+can safely be removed once we have a proper ui.
+
diff --git a/src/target/ui-experiment/display.h b/src/target/ui-experiment/display.h
new file mode 100644
index 00000000..55913700
--- /dev/null
+++ b/src/target/ui-experiment/display.h
@@ -0,0 +1,46 @@
+
+#ifndef _UI_DISPLAY_H
+#define _UI_DISPLAY_H
+
+#include <ui/pixel.h>
+#include <ui/image.h>
+
+/**
+ * Displays - physical display devices
+ *
+ * This layer is introduced tentatively, expecting use
+ * of OSMOCOM on multi-display phones, most likely
+ * with a main screen and a cover screen.
+ *
+ */
+struct display {
+	const char *name;
+
+	pxtype_t pixeltype;
+	pxsize_t width;
+	pxsize_t height;
+
+	/* We always operate on an in-memory frame buffer that 
+	 * can be put on display using damage functions provided
+	 * by the image class.
+	 */
+	struct image *fbuf;
+
+	/*
+	 * We display a top-level widget.
+	 */
+	struct widget *widget;
+
+	/*
+	 * We hold a graphics context, configured for the target
+	 * pixel format.
+	 */
+	struct graphics *graphics;
+
+
+	void (*draw) (struct display *display);
+
+	void *priv;
+};
+
+#endif
diff --git a/src/target/ui-experiment/font.h b/src/target/ui-experiment/font.h
new file mode 100644
index 00000000..5dc6eae7
--- /dev/null
+++ b/src/target/ui-experiment/font.h
diff --git a/src/target/ui-experiment/image.h b/src/target/ui-experiment/image.h
new file mode 100644
index 00000000..13c11f5b
--- /dev/null
+++ b/src/target/ui-experiment/image.h
@@ -0,0 +1,166 @@
+
+#ifndef _UI_IMAGE_H
+#define _UI_IMAGE_H
+
+/* for exit() */
+#include <stdlib.h>
+
+#include <ui/pixel.h>
+#include <ui/font.h>
+
+struct image {
+	pxtype_t type;
+	pxdims_t size;
+	unsigned char *data;
+};
+
+
+struct image font_img_v = {
+	.type = PXTYPE_MONO_V8,
+	.size = {8, 2048},
+	.data = &fontdata_r8x8,
+};
+
+struct image font_img_h = {
+	.type = PXTYPE_MONO_H8,
+	.size = {8, 2048},
+	.data = &fontdata_r8x8_horiz,
+};
+
+px_t
+image_get_pixel(struct image *img, pxoff_t x, pxoff_t y) {
+	unsigned stride, base, offset;
+	const uint8_t *p8;
+	const uint16_t *p16;
+
+	switch(img->type) {
+	case PXTYPE_MONO_V8:
+		stride = img->size.w;
+		base = y / 8;
+		offset = y % 8;
+		p8 = (uint8_t*)(img->data + x + base * stride);
+		return px_from_mono(((*p8) >> offset) & 1);
+	case PXTYPE_MONO_H8:
+		stride = img->size.w / 8;
+		base = x / 8;
+		offset = x % 8;
+		p8 = (uint8_t*)(img->data + base + y * stride);
+		return px_from_mono(((*p8) >> offset) & 1);
+	case PXTYPE_RGB444:
+		stride = img->size.w * 2;
+		p16 = (uint16_t*)(img->data + x * 2 + y * stride);
+		return px_from_rgb444(*p16);
+	}
+
+	return 0;
+}
+
+void
+image_set_pixel(struct image *img, pxoff_t x, pxoff_t y, px_t v) {
+	unsigned stride, base, offset;
+	uint8_t *p8;
+	uint16_t *p16;
+
+	switch(img->type) {
+	case PXTYPE_MONO_V8:
+		stride = img->size.w;
+		base = y / 8;
+		offset = y % 8;
+		p8 = (uint8_t*)(img->data + x + base * stride);
+		*p8 |= (px_to_mono(v) << offset);
+		break;
+	case PXTYPE_MONO_H8:
+		stride = img->size.w / 8;
+		base = x / 8;
+		offset = x % 8;
+		p8 = (uint8_t*)(img->data + base + y * stride);
+		*p8 |= (px_to_mono(v) << offset);
+		break;
+	case PXTYPE_RGB444:
+		stride = img->size.w * 2;
+		p16 = (uint16_t*)(img->data + x * 2 + y * stride);
+		*p16 = px_to_rgb444(v);
+		break;
+	}
+}
+
+void
+image_blit(struct image *dst, pxposn_t dstp,
+		   struct image *src, pxposn_t srcp,
+		   pxdims_t d)
+{
+	unsigned x, y, s;
+
+	printf("blit %dx%d from %dx%d to %dx%d\n", d.w, d.h, srcp.x, srcp.y, dstp.x, dstp.y);
+
+	// *cough* slow.
+	for(y = 0; y < d.h; y++) {
+		for(x = 0; x < d.w; x++) {
+			px_t p = image_get_pixel(src, srcp.x + x, srcp.y + y);
+			image_set_pixel(dst, dstp.x + x, dstp.y + y, p);
+		}
+	}
+}
+
+void
+image_draw_char(struct image *dst, pxposn_t p, char chr) {
+	unsigned char c = (unsigned char)chr;
+	pxposn_t pf = {0,c*8};
+	pxdims_t d = {8,8};
+	image_blit(dst, p, &font_img_h, pf, d);
+}
+
+void
+image_draw_string(struct image *dst, pxposn_t p, char *str) {
+	while(*str) {
+		image_draw_char(dst, p, *str);
+		p.x += 8;
+		str++;
+	}
+}
+
+static void
+image_fill_rect_rgb444(struct image *dst, pxrect_t rect, uint16_t color) {
+	unsigned x, y, s;
+	uint16_t *p;
+
+	unsigned stride = dst->size.w * 2;
+
+	for(y = rect.p.y; y < rect.p.y + rect.d.h; y++) {
+		for(x = rect.p.x; x < rect.p.x + rect.d.w; x++) {
+			p = (uint16_t*)&dst->data[x * 2 + y * stride];
+			*p = color;
+		}
+	}
+}
+
+void
+image_fill_rect(struct image *dst, pxrect_t rect, px_t color)
+{
+	switch(dst->type) {
+	case PXTYPE_MONO_V8:
+		break;
+	case PXTYPE_MONO_H8:
+		break;
+	case PXTYPE_RGB444:
+		image_fill_rect_rgb444(dst, rect, px_to_rgb444(color));
+		break;
+	}
+}
+
+void
+image_draw_hline(struct image *dst, pxposn_t posn, pxoff_t len, px_t color)
+{
+}
+
+void
+image_draw_vline(struct image *dst, pxposn_t posn, pxoff_t len, px_t color)
+{
+}
+
+void
+image_draw_rect(struct image *dst, pxrect_t rect, px_t color)
+{
+}
+
+#endif
diff --git a/src/target/ui-experiment/menu.h b/src/target/ui-experiment/menu.h
new file mode 100644
index 00000000..d9cc97b3
--- /dev/null
+++ b/src/target/ui-experiment/menu.h
@@ -0,0 +1,18 @@
+
+/**
+ * Menus - menus and menu items
+ *
+ * We represent both menus and menu items in a single structure.
+ *
+ * They share the properties of having a title as well as having
+ * interaction callbacks such as on_select.
+ *
+ * Menus have a child item array that is indexed by menu position.
+ * The position of items in this array is used for numeric menu navigation.
+ *
+ */
+struct menu {
+	const char *title;
+	void (*on_select)(void);
+	struct menu *children[10];
+};
diff --git a/src/target/ui-experiment/pixel.h b/src/target/ui-experiment/pixel.h
new file mode 100644
index 00000000..dde28e2a
--- /dev/null
+++ b/src/target/ui-experiment/pixel.h
@@ -0,0 +1,113 @@
+
+#ifndef _UI_PIXEL_H
+#define _UI_PIXEL_H
+
+#include <stdint.h>
+#include <stdio.h>
+
+/** Supported pixel types */
+typedef enum {
+	_PXTYPE_INVALID,
+
+	/** "Generic" pixel type (24/32bit RGB) */
+	PXTYPE_GENERIC,
+
+	/** 8 horizontal mono pixels per byte */
+	PXTYPE_MONO_H8,
+
+	/** 8 vertical mono pixels per byte */
+	PXTYPE_MONO_V8,
+
+	/** 12bit RGB444 colors */
+	PXTYPE_RGB444,
+
+} pxtype_t;
+
+
+/** Generic pixel type */
+typedef uint32_t px_t;
+
+#define PX_R(p) ((uint8_t)((v) >> 16 & 0xFF))
+#define PX_G(p) ((uint8_t)((v) >>  8 & 0xFF))
+#define PX_B(p) ((uint8_t)((v) >>  0 / 0xFF))
+
+#define PX_RGB(r,g,b) ((px_t)((r)<<16|(g)<<8|(b)))
+
+#define PX_BLACK ((px_t)0x000000)
+#define PX_RED   ((px_t)0xFF0000)
+#define PX_GREEN ((px_t)0x00FF00)
+#define PX_BLUE  ((px_t)0x0000FF)
+#define PX_WHITE ((px_t)0xFFFFFF)
+
+
+/* Mono types */
+typedef uint8_t px_mono_t;
+
+#define PX_MONO_BLACK ((px_mono_t)0)
+#define PX_MONO_WHITE ((px_mono_t)1)
+
+inline px_t
+px_from_mono(uint8_t v) {
+	return v ? PX_WHITE : PX_BLACK;
+}
+
+inline uint8_t
+px_to_mono(px_t v) {
+	uint16_t a = (PX_R(v) + PX_G(v) + PX_B(v)) / 3;
+	return (a >= 0x7f) ? 1 : 0;
+}
+
+/* RGB444 */
+typedef uint16_t px_rgb444_t;
+
+#define PX_RGB444_R(p) ((p) >> 8 & 0xf)
+#define PX_RGB444_G(p) ((p) >> 4 & 0xf)
+#define PX_RGB444_B(p) ((p) >> 0 & 0xf)
+
+#define PX_RGB444_RGB(r,g,b) ((px_rgb444_t)((r)<<8|(g)<<4|(b)))
+
+inline px_t
+px_from_rgb444(px_rgb444_t v) {
+	return
+		  PX_RGB444_R(v) << 16 | PX_RGB444_R(v) << 20
+		| PX_RGB444_G(v) <<  8 | PX_RGB444_G(v) << 12
+		| PX_RGB444_B(v) <<  0 | PX_RGB444_B(v) <<  4;
+}
+
+inline uint16_t
+px_to_rgb444(px_t v) {
+	uint8_t r = (v >> 20) & 0xF;
+	uint8_t g = (v >> 12) & 0xF;
+	uint8_t b = (v >> 4)  & 0xF;
+
+	uint16_t res = (r<< 8) | (g << 4) | (b << 0);
+
+	return res;
+}
+
+
+/** Size in pixels */
+typedef uint16_t pxsize_t;
+
+/** Offset in pixels */
+typedef int16_t  pxoff_t;
+
+/** 2D position in pixels */
+typedef struct {
+	pxoff_t x;
+	pxoff_t y;
+} pxposn_t;
+
+/** 2D dimensions in pixels */
+typedef struct {
+	pxsize_t w;
+	pxsize_t h;
+} pxdims_t;
+
+/** 2D rectangle in pixels */
+typedef struct {
+	pxposn_t p;
+	pxdims_t d;
+} pxrect_t;
+
+#endif
diff --git a/src/target/ui-experiment/png2tiny.c b/src/target/ui-experiment/png2tiny.c
new file mode 100644
index 00000000..d314b9a2
--- /dev/null
+++ b/src/target/ui-experiment/png2tiny.c
@@ -0,0 +1,51 @@
+
+#include <stdlib.h>
+
+#include <SDL_image.h>
+
+enum {
+	FORMAT_NONE,
+	FORMAT_C
+};
+
+void
+version(const char *name) {
+	puts(name);
+	//printf("%s rev %s\n", name, REVISION);
+	exit(2);
+}
+
+void
+usage(const char *name) {
+	printf("Usage: %s [-hv] [-f outfmt] [-s outsym] <infile> <outfile>\n");
+	exit(2);
+}
+
+int
+main(int argc, char **argv) {
+	int opt, outfmt;
+	const char *outsym = NULL;
+	SDL_Surface *img;
+
+	while((opt = getopt(argc, argv, "f:s:hv")) != -1) {
+		switch(opt) {
+		case 'f':
+			if(!strcmp(optarg, "c")) {
+				outfmt = FORMAT_C;
+			}
+			break;
+		case 's':
+			outsym = optarg;
+			break;
+		case 'v':
+			version(argv[0]);
+			break;
+		case 'h':
+		default:
+			usage(argv[0]);
+			break;
+		}
+	}
+
+	return 0;
+}
diff --git a/src/target/ui-experiment/screen.h b/src/target/ui-experiment/screen.h
new file mode 100644
index 00000000..1174d9e7
--- /dev/null
+++ b/src/target/ui-experiment/screen.h
@@ -0,0 +1,21 @@
+
+/**
+ * Screens - full-screen dialogs
+ *
+ * These compose the first level of interaction in the UI.
+ *
+ * There is always exactly one active screen, which is in
+ * control of the entire display on which it is displayed.
+ *
+ * Screen activations are stacked, providing interaction depth.
+ *
+ */
+struct screen {
+	const char *name;
+	void (*on_enter)(void);
+	void (*on_leave)(void);
+	void (*on_render)(void);
+	void (*on_key_press)(void);
+	void (*on_key_release)(void);
+};
+
diff --git a/src/target/ui-experiment/sdl.c b/src/target/ui-experiment/sdl.c
new file mode 100644
index 00000000..e6daac70
--- /dev/null
+++ b/src/target/ui-experiment/sdl.c
@@ -0,0 +1,250 @@
+
+#include <ui/display.h>
+#include <ui/image.h>
+#include <ui/sdl.h>
+
+#include <stdio.h>
+
+#include <SDL.h>
+
+#define SDL_PRIV(d) ((struct sdl_display*)(d)->priv)
+
+#define REFRESH_INTERVAL_MSEC 50
+
+struct sdl_display {
+	SDL_Surface *display;
+	SDL_TimerID refresh;
+	unsigned width;
+	unsigned height;
+	unsigned scale;
+};
+
+static Uint32 sdl_redraw_callback(Uint32 interval, void *param) {
+	struct display *display = (struct display*)param;
+
+	display->draw(display);
+
+	return interval;
+}
+
+void
+sdl_init(struct display *display,
+		 unsigned width, unsigned height, unsigned scale)
+{
+	if(SDL_Init(SDL_INIT_VIDEO|SDL_INIT_TIMER)) {
+		printf("Failed to initialize SDL: %s\n", SDL_GetError());
+		exit(1);
+	}
+
+	atexit(&SDL_Quit);
+
+	struct sdl_display *priv = SDL_PRIV(display);
+
+	priv->width = width;
+	priv->height = height;
+	priv->scale = scale;
+
+	priv->display = SDL_SetVideoMode(width * scale, height * scale, 32, 0);
+	if(!priv->display) {
+		printf("Failed to set SDL video mode: %s\n", SDL_GetError());
+		exit(1);
+	}
+
+	priv->refresh = SDL_AddTimer(REFRESH_INTERVAL_MSEC,
+								 &sdl_redraw_callback, display);
+	if(!priv->refresh) {
+		printf("Failed to add refresh timer: %s\n", SDL_GetError());
+		exit(1);
+	}
+}
+
+void
+sdl_draw(struct display *display)
+{
+	struct sdl_display *priv = SDL_PRIV(display);
+
+	struct image *img = display->fbuf;
+
+	SDL_Rect r;
+
+	r.w = priv->scale;
+	r.h = priv->scale;
+
+	if(img->type == PXTYPE_RGB444) {
+		unsigned stride = img->size.w * 2;
+
+		unsigned x, y;
+		for(y = 0; y < img->size.h; y++) {
+			for(x = 0; x < img->size.w; x++) {
+				px_t color = image_get_pixel(img, x, y);
+
+				r.x = x * priv->scale;
+				r.y = y * priv->scale;
+
+				SDL_FillRect(priv->display, &r, color);
+			}
+		}
+	} else {
+		puts("Unsupported framebuffer type for SDL emulator.");
+		exit(1);
+	}
+
+	SDL_UpdateRect(priv->display, 0, 0, 0, 0);
+}
+
+
+static struct sdl_display display_sdl_priv;
+
+uint8_t sdl_fbuf[96*64*2];
+
+struct image display_sdl_fbuf = {
+	.type = PXTYPE_RGB444,
+	.size = {96, 64},
+	.data = &sdl_fbuf
+};
+
+struct display display_sdl = {
+	.name = "Main Display",
+	.fbuf = &display_sdl_fbuf,
+	.priv = &display_sdl_priv,
+	.draw = &sdl_draw
+};
+
+uint16_t fnord_buf[] = {
+	0x0F00,
+	0x00F0,
+	0x000F,
+	0x00FF,
+	0x0F00,
+	0x00F0,
+	0x000F,
+	0x00FF,
+	0x0F00,
+	0x00F0,
+	0x000F,
+	0x00FF,
+	0x0F00,
+	0x00F0,
+	0x000F,
+	0x00FF,
+	0x0F00,
+	0x00F0,
+	0x000F,
+	0x00FF,
+	0x0F00,
+	0x00F0,
+	0x000F,
+	0x00FF,
+	0x0F00,
+	0x00F0,
+	0x000F,
+	0x00FF,
+	0x0F00,
+	0x00F0,
+	0x000F,
+	0x00FF
+
+};
+
+struct image fnord = {
+	.type = PXTYPE_RGB444,
+	.size = {8,4},
+	.data = &fnord_buf
+};
+
+uint8_t fubar_img[] = {
+	0x01, 0x02, 0x03, 0x04,
+	0x05, 0x06, 0x07, 0x08,
+	0x09, 0x0a, 0x0b, 0x0c,
+	0x0d, 0x0e, 0x0f, 0x0f
+
+};
+
+struct image fubar = {
+	.type = PXTYPE_MONO_V8,
+	.size = {8,16},
+	.data = &fubar_img
+};
+
+void
+sdl_run(void)
+{
+	int r;
+	SDL_Event e;
+
+	while((r = SDL_WaitEvent(&e))) {
+
+		if(e.type == SDL_KEYDOWN) {
+			if(e.key.keysym.sym == SDLK_ESCAPE) {
+				puts("Bloody quitter!");
+				break;
+			}
+			if(e.key.keysym.sym == SDLK_SPACE) {
+				pxposn_t dp = {0,0};
+				pxposn_t sp = {0,0};
+				pxdims_t d = {8,4};
+
+				image_blit(&display_sdl_fbuf, dp,
+						   &fnord, sp,
+						   d);
+
+				sp.x = 0;
+				sp.y = 0;
+				dp.x = 5;
+				dp.y = 10;
+				d.w = 8;
+				d.h = 16;
+
+				image_blit(&display_sdl_fbuf, dp,
+						   &fubar, sp,
+						   d);
+
+				pxrect_t r = {{12,0},{40,20}};
+				image_fill_rect(&display_sdl_fbuf,
+								r,
+								0xFF00FF);
+
+
+#if 0
+				dp.x = 0;
+				dp.y = 0;
+
+				image_draw_string(&display_sdl_fbuf, dp,
+								"ABCDEFGHI");
+
+				dp.y += 10;
+
+				image_draw_string(&display_sdl_fbuf, dp,
+								"abcdefghi");
+
+#endif
+
+				sdl_draw(&display_sdl);
+
+			}
+		}
+
+		switch(e.type) {
+		case SDL_KEYDOWN:
+		case SDL_KEYUP:
+			printf("Key %d %d\n", e.key.keysym.sym, e.key.state);
+			break;
+		}
+	}
+
+	if(!r) {
+		printf("Failed to wait for SDL event: %s\n", SDL_GetError());
+		exit(1);
+	}
+
+}
+
+int
+main(void)
+{
+	sdl_init(&display_sdl, 96, 64, 4);
+
+	sdl_run();
+
+	return 0;
+}
diff --git a/src/target/ui-experiment/sdl.h b/src/target/ui-experiment/sdl.h
new file mode 100644
index 00000000..5a3d4752
--- /dev/null
+++ b/src/target/ui-experiment/sdl.h
@@ -0,0 +1,9 @@
+
+#ifndef _UI_SDL_H
+#define _UI_SDL_H
+
+#include <ui/display.h>
+
+extern struct display display_sdl;
+
+#endif
diff --git a/src/target/ui-experiment/ui.h b/src/target/ui-experiment/ui.h
new file mode 100644
index 00000000..9bc7c324
--- /dev/null
+++ b/src/target/ui-experiment/ui.h
@@ -0,0 +1,81 @@
+
+/****** MESSAGING MENU ******/
+
+struct menu menu_message_compose = {
+	.title = "Compose",
+	.help = "Write a new text message."
+};
+
+struct menu menu_message_inbox = {
+	.title = "Inbox",
+	.help = "Incoming text messages"
+};
+
+struct menu menu_message_outbox = {
+	.title = "Outbox",
+	.help = "Outgoing text messages"
+};
+
+struct menu menu_message_sent = {
+	.title = "Sent",
+	.help = "Previously sent text messages"
+};
+
+struct menu menu_messages = {
+	.title = "Messages",
+	.help = "Short message service options",
+	.children = {
+		[0] = &menu_message_compose,
+		[1] = &menu_message_inbox,
+		[2] = &menu_message_outbox,
+		[3] = &menu_message_sent
+	}
+};
+
+/****** NETWORK MENU ******/
+
+struct menu menu_network_about = {
+	.title = "About this network",
+	.help = "Information about your current network",
+};
+
+struct menu menu_network = {
+	.title = "Network",
+	.help = "Network interaction options",
+	.children = {
+	}
+};
+
+/****** SETTINGS MENU ******/
+
+struct menu menu_settings = {
+	.title = "Settings",
+	.help = "Configure your phone",
+	.children = {
+	}
+};
+
+/****** MAIN MENU ******/
+
+struct menu menu_about = {
+	.title = "About",
+	.help = "Information about this phone",
+};
+
+struct menu menu_main = {
+	.title = "Main Menu",
+	.children = {
+		[0] = &menu_messages,
+		[7] = &menu_network,
+		[8] = &menu_settings,
+		[9] = &menu_about,
+	},
+};
+
+
+
+int
+main(void) {
+	&menu_main;
+	return 0;
+};
diff --git a/src/target_dsp/.gitignore b/src/target_dsp/.gitignore
new file mode 100644
index 00000000..5cf144ea
--- /dev/null
+++ b/src/target_dsp/.gitignore
@@ -0,0 +1,4 @@
+*.o
+*.a
+*.coff
+*.bin
diff --git a/src/target_dsp/calypso/Makefile b/src/target_dsp/calypso/Makefile
new file mode 100644
index 00000000..40ee4ec5
--- /dev/null
+++ b/src/target_dsp/calypso/Makefile
@@ -0,0 +1,15 @@
+all: dsp_dump.bin
+
+CROSS=tic54x-coff-
+
+%.o: %.S
+	$(CROSS)as $< -o $@
+
+%.bin: %.coff
+	$(CROSS)objcopy -j .text -O binary $< $@
+
+dsp_dump.coff: bl_stage3.o dsp_dump.lds
+	$(CROSS)ld --script dsp_dump.lds bl_stage3.o -o $@
+
+clean:
+	rm -f *.o *.bin *.coff
diff --git a/src/target_dsp/calypso/bin2cfile.py b/src/target_dsp/calypso/bin2cfile.py
new file mode 100755
index 00000000..9456a6ac
--- /dev/null
+++ b/src/target_dsp/calypso/bin2cfile.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python
+
+import struct
+import sys
+
+def group_by_n(s, n, do_join=True):
+	return ( ''.join(x) for x in zip(*[s[i::n] for i in range(n)]) )
+	
+
+def main(pn, filename):
+	# Get all bytes
+	f = open(filename, 'r')
+	d = f.read()
+	f.close()
+
+	# Get the data
+	ops = ''.join([
+		'0x%04x,%s' % (
+			struct.unpack('=H', x)[0],
+			'\n\t\t\t' if (i&3==3) else ' '
+		)
+		for i, x
+		in enumerate(group_by_n(d, 2))
+	])[:-1]
+
+	ops = '\t\t\t' + ops
+	if ops[-1] == '\t':
+		ops = ops[:-4]
+
+	# Name
+	name = filename.split('.',1)[0]
+
+	# Header / footer
+	print """
+#define _SA_DECL (const uint16_t *)&(const uint16_t [])
+
+static const struct dsp_section %s[] = {
+	{
+		.addr = 0x,
+		.size = 0x%04x,
+		.data = _SA_DECL {
+%s
+		},
+	},
+	{ /* Guard */
+		.addr = 0,
+		.size = 0,
+		.data = NULL,
+	},
+};
+
+#undef _SA_DECL
+""" % (name, len(d)/2, ops)
+
+
+if __name__ == "__main__":
+	main(*sys.argv)
diff --git a/src/target_dsp/calypso/bl_stage3.S b/src/target_dsp/calypso/bl_stage3.S
new file mode 100644
index 00000000..402c3c59
--- /dev/null
+++ b/src/target_dsp/calypso/bl_stage3.S
@@ -0,0 +1,142 @@
+
+BCSR		.equ	0x29
+
+CMD_IDLE	.equ	1		; Do nothing / DSP ready for commands
+CMD_COPY_BLOCK	.equ	2		; (if size == 0, then exec)
+CMD_COPY_MODE	.equ	4		; Select copy mode
+					; (0=code write, 1=data write,
+					;  2=code read,  3=data read,
+					;  4=prom read,  5=drom read)
+CMD_VERSION	.equ	0xffff		; API_RAM[0] = bootloader version
+
+VERSION		.equ	0x0100		; 1.00
+
+
+		.section .apiram
+
+		.org	0x07fc
+bl_addr_hi	.ds	1
+bl_size		.ds	1
+bl_addr_lo	.ds	1
+bl_status	.ds	1
+
+
+		.text
+		.mmregs
+_start:
+		orm     #2, *(BCSR)	; ?
+
+		ld	#0x1f, DP
+		stm	#0x1100, SP
+		stm	#0, AR4
+_done:
+		stm	#_api_ram, AR2
+		st	#CMD_IDLE, @bl_status
+_loop:
+		; Version
+		cmpm	@bl_status, #CMD_VERSION
+		bc	1f, ntc
+
+		bd	_done
+		st	#VERSION, *AR2
+1:
+
+		; Select copy mode
+		cmpm	@bl_status, #CMD_COPY_MODE
+		bc	1f, ntc
+
+		bd	_done
+		mvdm	@_api_ram, AR4
+1:
+
+		; Copy
+		cmpm	@bl_status, #CMD_COPY_BLOCK
+		bc	_loop, ntc
+
+		;   Capture values for copy operations
+		;     A = full address
+		;     AR1 size-1
+		;     AR2 api_ram (set previously)
+		;     AR3 data/code address
+		;     AR4 mode
+
+		ldu	@bl_addr_lo, A
+		stlm	A, AR3
+		add	@bl_addr_hi, 16, A
+
+		ldu	@bl_size, B
+		stlm	B, AR1
+		; mar	*AR1-	; We do this in a delay slot later on ...
+
+			; Start
+		bc	1f, bneq	; B still contains size
+		bacc	A
+
+1:
+			; Select
+		stm	#AR4, AR5	; AR5 = &AR4
+		bit	*AR5, 13	; Test mode(2)
+		bcd	_read_rom, tc
+		mar	*AR1-
+		bit	*AR5, 15	; Test mode(0) lsb
+		bcd	_copy_data, tc
+		bit	*AR5, 14	; Test mode(1)
+		nop
+
+			; Copy to/from Program space
+_copy_prog:
+		bc	_read_prog, tc
+
+				; Copy from API -> prog space	(mode 0)
+_write_prog:
+		rpt	*(AR1)
+		writa	*AR2+
+		b	_done
+
+				; Copy from prog space -> API	(mode 2)
+_read_prog:
+		rpt	*(AR1)
+		reada	*AR2+
+		b	_done
+
+			; Copy to/from Data space
+_copy_data:
+		bc	_read_data, tc
+
+				; Copy from API -> data space	(mode 1)
+_write_data:
+		rpt	*(AR1)
+		mvdd	*AR2+, *AR3+
+		b	_done
+
+				; Copy from data space -> API	(mode 3)
+_read_data:
+		rpt	*(AR1)
+		mvdd	*AR3+, *AR2+
+		b	_done
+
+			; Read from {D,P}ROM bypassing protection
+_read_rom:
+		ldm	AR1, B	; Can't put those two ops in the delay slot of
+		stlm	B, BRC	; 'bc' because of unprotected pipeline conflicts
+		bc	_read_rom_data, tc
+
+_read_rom_prog:
+		rptb	1f - 1
+		call	prom_read_xplt
+1:
+		b	_done
+
+_read_rom_data:
+		rptb	1f - 1
+		call	drom_read_xplt
+1:
+		b	_done
+
+
+drom_read_xplt	.equ	0xe4b8
+prom_read_xplt	.equ	0x7213
+
+
+		.end
+
diff --git a/src/target_dsp/calypso/dsp_dump.lds b/src/target_dsp/calypso/dsp_dump.lds
new file mode 100644
index 00000000..56633026
--- /dev/null
+++ b/src/target_dsp/calypso/dsp_dump.lds
@@ -0,0 +1,22 @@
+OUTPUT_FORMAT("coff1-c54x")
+OUTPUT_ARCH("")
+MEMORY
+{
+	apiram (RWXI) : ORIGIN = 0x0800, LENGTH = 0x2000
+}
+SECTIONS
+{
+	. = 0x0800;
+
+	.apiram :
+	{
+		PROVIDE(_api_ram = .);
+		*(.apiram)
+	} > apiram
+
+	.text :
+	{
+		*(.text)
+	} > apiram
+}
+
diff --git a/src/target_dsp/calypso/dump2coff.py b/src/target_dsp/calypso/dump2coff.py
new file mode 100755
index 00000000..c05a0ffc
--- /dev/null
+++ b/src/target_dsp/calypso/dump2coff.py
@@ -0,0 +1,260 @@
+#!/usr/bin/env python
+
+import re
+import sys
+import struct
+
+DATA = 0
+DATA = 1
+
+
+class Section(object):
+
+	DATA		= 0
+	CODE		= 1
+
+	STYP_NOLOAD	= 0x0002
+	STYP_TEXT	= 0x0020
+	STYP_DATA	= 0x0040
+	STYP_BSS	= 0x0080
+
+	def __init__(self, name, type, start, size, data=None):
+		self.name  = name
+		self.type  = type
+		self.start = start
+		self.size  = size
+		self.data  = data
+
+	@property
+	def flags(self):
+		if self.type == Section.DATA:
+			return Section.STYP_DATA if self.data else Section.STYP_BSS
+		else:
+			return Section.STYP_TEXT if self.data else Section.STYP_NOLOAD
+
+
+class CalypsoCOFF(object):
+
+	F_RELFLG	= 0x0001 # Relocation information stripped from the file
+	F_EXEC		= 0x0002 # File is executable (i.e., no unresolved external references)
+	F_LNNO		= 0x0004 # Line numbers stripped from the file
+	F_LSYMS		= 0x0010 # Local symbols stripped from the file
+	F_LITTLE	= 0x0100 # Little endian
+
+	def __init__(self, data_seg_base=0x80000000):
+		self.sections = {}
+		self.data_seg_base = data_seg_base
+		self.ver_magic = 0x00c1
+		self.tgt_magic = 0x0098
+		self.flags = \
+			CalypsoCOFF.F_RELFLG	|	\
+			CalypsoCOFF.F_EXEC		|	\
+			CalypsoCOFF.F_LNNO		|	\
+			CalypsoCOFF.F_LSYMS		|	\
+			CalypsoCOFF.F_LITTLE
+
+	def _data_pack(self, d):
+		return ''.join(struct.pack('<H', x) for x in d)
+
+	def save(self, filename):
+		# Formats
+		HDR_FILE = '<HHlllHHH'
+		HDR_SECTIONS = '<8sLLllllHHHcc'
+
+		# Optional header
+		oh = ''
+
+		# File header
+		fh = struct.pack(HDR_FILE,
+			self.ver_magic,		# unsigned short  f_ver_magic; /* version magic number */
+			len(self.sections),	# unsigned short  f_nscns;     /* number of section */
+			0,					# long            f_timdat;    /* time and date stamp */
+			0,					# long            f_symptr;    /* file ptr to symbol table */
+			0,					# long            f_nsyms;     /* number entries in the sym table */
+			len(oh),			# unsigned short  f_opthdr;    /* size of optional header */
+			self.flags,			# unsigned short  f_flags;     /* flags */
+			self.tgt_magic,		# unsigned short  f_tgt_magic; /* target magic number */
+		)
+
+		# File header size  + #sections * sizeof(section header)
+		dptr = struct.calcsize(HDR_FILE) + len(oh) + len(self.sections) * struct.calcsize(HDR_SECTIONS)
+
+		# Section headers
+		sh = []
+		sd = []
+
+		sk = lambda x: self.data_seg_base + x.start if x.type==Section.DATA else x.start
+
+		for s in sorted(self.sections.values(), key=sk):
+			# Values
+			if s.type == Section.DATA:
+				mp = 0x80
+				sa = s.start
+			else:
+				mp = 0
+				sa = s.start
+			sptr = dptr if s.data else 0
+
+			# Header
+			sh.append(struct.pack(HDR_SECTIONS,
+				s.name,	# char[8]        s_name;   /* 8-character null padded section name */
+				sa,		# long int       s_paddr;  /* Physical address of section */
+				sa,		# long int       s_vaddr;  /* Virtual address of section */
+				s.size,	# long int       s_size;   /* Section size in bytes */
+				sptr,	# long int       s_scnptr; /* File pointer to raw data */
+				0,		# long int       s_relptr; /* File pointer to relocation entries */
+				0,		# long int       s_lnnoptr;/* File pointer to line number entries */
+				0,		# unsigned short s_nreloc; /* Number of relocation entrie */
+				0,		# unsigned short s_nlnno;  /* Number of line number entries */
+				s.flags,# unsigned short s_flags;  /* Flags (see ``Section header flags'') */
+				'\x00',	# /
+				chr(mp),# char           s_mempage;/* Memory page number */
+			))
+
+			# Data
+			if s.data:
+				sd.append(self._data_pack(s.data))
+				dptr += s.size * 2
+
+		# Write the thing
+		f = open(filename, 'wb')
+
+		f.write(fh)
+		f.write(oh)
+		f.write(''.join(sh))
+		f.write(''.join(sd))
+
+		f.close()
+
+	def add_section(self, name, type, addr, size, data=None):
+		self.sections[name] = Section(name, type, addr, size, data=data)
+
+
+# ----------------------------------------------------------------------------
+# Dump loading
+# ----------------------------------------------------------------------------
+
+RE_DUMP_HDR = re.compile(
+	r"^DSP dump: (\w*) \[([0-9a-fA-F]{5})-([0-9a-fA-F]{5})\]$"
+)
+
+
+def _file_strip_gen(f):
+	while True:
+		l = f.readline()
+		if not l:
+			return
+		yield l.strip()
+
+
+def dump_load_section(fg, sa, ea):
+	data = []
+	ca = sa
+	for l in fg:
+		if not l:
+			break
+
+		ra = int(l[0:5], 16)
+		if ra != ca:
+			raise ValueError('Invalid dump address %05x != %05x', ra, ca)
+
+		v = l[8:].split()
+		if len(v) != 16:
+			raise ValueError('Invalid dump format')
+
+		v = [int(x,16) for x in v]
+		data.extend(v)
+
+		ca += 0x10
+
+	if ca != ea:
+		raise ValueError('Missing dump data %05x != %05x', ra, ea)
+
+	return data
+
+
+def dump_load(filename):
+	# Open file
+	f = open(filename, 'r')
+	fg = _file_strip_gen(f)
+
+	# Scan line by line for a dump header line
+	sections = []
+
+	for l in fg:
+		m = RE_DUMP_HDR.match(l)
+		if not m:
+			continue
+
+		name = m.group(1)
+		sa   = int(m.group(2), 16)
+		ea   = int(m.group(3), 16) + 1
+
+		sections.append((
+			name, sa, ea,
+			dump_load_section(fg, sa, ea),
+		))
+
+	# Done
+	f.close()
+
+	return sections
+
+
+# ----------------------------------------------------------------------------
+# Main
+# ----------------------------------------------------------------------------
+
+def main(pname, dump_filename, out_filename):
+
+	# Section to place in the COFF
+	sections = [
+		# name			type          start    size
+		('.regs',		Section.DATA, 0x00000, 0x0060),
+		('.scratch',	Section.DATA, 0x00060, 0x0020),
+		('.drom',		Section.DATA, 0x09000, 0x5000),
+		('.pdrom',		Section.CODE, 0x0e000, 0x2000),
+		('.prom0',		Section.CODE, 0x07000, 0x7000),
+		('.prom1',		Section.CODE, 0x18000, 0x8000),
+		('.prom2',		Section.CODE, 0x28000, 0x8000),
+		('.prom3',		Section.CODE, 0x38000, 0x2000),
+		('.daram0',		Section.DATA, 0x00080, 0x0780),
+		('.api',		Section.DATA, 0x00800, 0x2000),
+		('.daram1',		Section.DATA, 0x02800, 0x4800),
+	]
+
+	# COFF name -> dump name
+	dump_mapping = {
+		# '.regs' :	'Registers',
+		'.drom' :	'DROM',
+		'.pdrom' :	'PDROM',
+		'.prom0' :	'PROM0',
+		'.prom1' :	'PROM1',
+		'.prom2' :	'PROM2',
+		'.prom3' :	'PROM3',
+	}
+
+	# Load the dump
+	dump_sections = dict([(s[0], s) for s in dump_load(dump_filename)])
+
+	# Create the COFF
+	coff = CalypsoCOFF()
+
+	# Add each section (with data if we have some)
+	for name, type, start, size in sections:
+		# Dumped data ?
+		d_data = None
+		if (name in dump_mapping) and (dump_mapping[name] in dump_sections):
+			d_name, d_sa, d_ea, d_data = dump_sections[dump_mapping[name]]
+
+		# Add sections
+		coff.add_section(name, type, start, size, d_data)
+
+	# Save result
+	coff.save(out_filename)
+
+	return 0
+
+
+if __name__ == '__main__':
+	sys.exit(main(*sys.argv))
diff --git a/src/target_dsp/calypso/ida/README.txt b/src/target_dsp/calypso/ida/README.txt
new file mode 100644
index 00000000..a7939083
--- /dev/null
+++ b/src/target_dsp/calypso/ida/README.txt
@@ -0,0 +1,73 @@
+Here's a few steps to get started quickly and get something readable:
+
+ - Compile a patched for the IDA TMS320C54 module
+
+   I made several enhancement to it to support the calypso better (the tms320c54
+   module is part of the SDK and can be modded and recompiled) :
+
+   - Add support for memory mappings so that the same memory zone can
+     'appear' at several place in the address space (to handle data & code
+		 overlay)
+   - Fix the section handling when loading a file:
+     . to set XPC properly,
+     . to not override section name
+     . to support more than 2 sections
+   - Fix a bug in cross reference detection when dealing with section
+     having selectors != 0
+   - Add stub support for the type system. This allows loading of a .h
+     header file with the NDB structure definition
+   - Add definition for the IO ports so that they are symbolically
+     displayed
+
+   I can't publically distribute the IDA processor module modification
+   because even just the patch contains some hex-rays code, so I'll handle
+   this on a case by case basis. (just ask me privately and we'll work it out)
+
+ - Dump the DSP ROM
+
+   Using the compal_dsp_dump.bin, you must create a text dump of the DSP ROM,
+   just piping the console output to a text file.
+
+ - Generate COFF image
+
+   The dump2coff.py script can convert the text dump into a usable COFF file
+   containing all the correct sections and addresses.
+
+ - Load this COFF image into IDA
+
+   In the load dialog make sure :
+    - Uncheck the 'Fill segment gaps (COFF)' checkbox
+    - Select 'TMS320C54' in 'Change processor'
+    - In 'Analysis Options/Processor specific analysis options' :
+      - 'Choose device name': CALYPSO
+      - 'Data segment address': 0x80000000
+      - 'Add mapping' (do it several time)
+        - From 0x00000060 -> 0x80000060  size 0x6FA0
+        - From 0x00010060 -> 0x80000060  size 0x6FA0
+        - From 0x00020060 -> 0x80000060  size 0x6FA0
+        - From 0x00030060 -> 0x80000060  size 0x6FA0
+        - From 0x8000E000 -> 0x0000E000  size 0x2000
+
+ - Set 'stub' compiler options to allow the type system to load .h files
+
+   In 'Options/Compiler':
+     - Compiler: 'GNU C++'
+     - Calling convention: 'Cdecl'
+     - Memory model: 'Code Near, Data Near'
+     - Pointer size: 'Near 16bit, Far 32bit'
+     - Include directory: '/usr/include' (or a directory with your includes
+       ... needs to exist)
+
+ - Load the NDB types
+
+   - Load the ndb.h file
+   - In the local types view, import all structure / enum into the database
+   - Then declare the following symbol and set them as struct type
+     appropriately.
+
+     0x80000800 api_w_page_0	db_mcu_to_dsp
+     0x80000814 api_w_page_1	db_mcu_to_dsp
+     0x80000828 api_r_page_0	db_dsp_to_mcu
+     0x8000083c api_r_page_1	db_dsp_to_mcu
+     0x800008d4 ndb           	ndb_mcu_dsp
+
diff --git a/src/target_dsp/calypso/ida/ndb.h b/src/target_dsp/calypso/ida/ndb.h
new file mode 100644
index 00000000..ad9c1056
--- /dev/null
+++ b/src/target_dsp/calypso/ida/ndb.h
@@ -0,0 +1,294 @@
+typedef unsigned char API;
+typedef signed char API_SIGNED;
+
+struct db_mcu_to_dsp
+{
+	API d_task_d;
+	API d_burst_d;
+	API d_task_u;
+	API d_burst_u;
+	API d_task_md;
+	API d_background;
+	API d_debug;
+	API d_task_ra;
+	API d_fn;
+	API d_ctrl_tch;
+	API hole;
+	API d_ctrl_abb;
+	API a_a5fn[2];
+	API d_power_ctl;
+	API d_afc;
+	API d_ctrl_system;
+};
+
+struct db_dsp_to_mcu
+{
+	API d_task_d;
+	API d_burst_d;
+	API d_task_u;
+	API d_burst_u;
+	API d_task_md;
+	API d_background;
+	API d_debug;
+	API d_task_ra;
+	API a_serv_demod[4];
+	API a_pm[3];
+	API a_sch[5];
+};
+
+struct param_mcu_dsp
+{
+	API_SIGNED d_transfer_rate;
+	API_SIGNED d_lat_mcu_bridge;
+	API_SIGNED d_lat_mcu_hom2sam;
+	API_SIGNED d_lat_mcu_bef_fast_access;
+	API_SIGNED d_lat_dsp_after_sam;
+	API_SIGNED d_gprs_install_address;
+	API_SIGNED d_misc_config;
+	API_SIGNED d_cn_sw_workaround;
+	API_SIGNED d_hole2_param[4];
+	API_SIGNED d_fb_margin_beg;
+	API_SIGNED d_fb_margin_end;
+	API_SIGNED d_nsubb_idle;
+	API_SIGNED d_nsubb_dedic;
+	API_SIGNED d_fb_thr_det_iacq;
+	API_SIGNED d_fb_thr_det_track;
+	API_SIGNED d_dc_off_thres;
+	API_SIGNED d_dummy_thres;
+	API_SIGNED d_dem_pond_gewl;
+	API_SIGNED d_dem_pond_red;
+	API_SIGNED d_maccthresh1;
+	API_SIGNED d_mldt;
+	API_SIGNED d_maccthresh;
+	API_SIGNED d_gu;
+	API_SIGNED d_go;
+	API_SIGNED d_attmax;
+	API_SIGNED d_sm;
+	API_SIGNED d_b;
+	API_SIGNED d_v42b_switch_hyst;
+	API_SIGNED d_v42b_switch_min;
+	API_SIGNED d_v42b_switch_max;
+	API_SIGNED d_v42b_reset_delay;
+	API_SIGNED d_ldT_hr;
+	API_SIGNED d_maccthresh_hr;
+	API_SIGNED d_maccthresh1_hr;
+	API_SIGNED d_gu_hr;
+	API_SIGNED d_go_hr;
+	API_SIGNED d_b_hr;
+	API_SIGNED d_sm_hr;
+	API_SIGNED d_attmax_hr;
+	API_SIGNED c_mldt_efr;
+	API_SIGNED c_maccthresh_efr;
+	API_SIGNED c_maccthresh1_efr;
+	API_SIGNED c_gu_efr;
+	API_SIGNED c_go_efr;
+	API_SIGNED c_b_efr;
+	API_SIGNED c_sm_efr;
+	API_SIGNED c_attmax_efr;
+	API_SIGNED d_sd_min_thr_tchfs;
+	API_SIGNED d_ma_min_thr_tchfs;
+	API_SIGNED d_md_max_thr_tchfs;
+	API_SIGNED d_md1_max_thr_tchfs;
+	API_SIGNED d_sd_min_thr_tchhs;
+	API_SIGNED d_ma_min_thr_tchhs;
+	API_SIGNED d_sd_av_thr_tchhs;
+	API_SIGNED d_md_max_thr_tchhs;
+	API_SIGNED d_md1_max_thr_tchhs;
+	API_SIGNED d_sd_min_thr_tchefs;
+	API_SIGNED d_ma_min_thr_tchefs;
+	API_SIGNED d_md_max_thr_tchefs;
+	API_SIGNED d_md1_max_thr_tchefs;
+	API_SIGNED d_wed_fil_ini;
+	API_SIGNED d_wed_fil_tc;
+	API_SIGNED d_x_min;
+	API_SIGNED d_x_max;
+	API_SIGNED d_slope;
+	API_SIGNED d_y_min;
+	API_SIGNED d_y_max;
+	API_SIGNED d_wed_diff_threshold;
+	API_SIGNED d_mabfi_min_thr_tchhs;
+	API_SIGNED d_facch_thr;
+	API_SIGNED d_max_ovsp_ul;
+	API_SIGNED d_sync_thres;
+	API_SIGNED d_idle_thres;
+	API_SIGNED d_m1_thres;
+	API_SIGNED d_max_ovsp_dl;
+	API_SIGNED d_gsm_bgd_mgt;
+	API a_fir_holes[4];
+	API a_fir31_uplink[31];
+	API a_fir31_downlink[31];
+};
+
+struct ndb_mcu_dsp
+{
+	API d_dsp_page;
+	API d_error_status;
+	API d_spcx_rif;
+	API d_tch_mode;
+	API d_debug1;
+	API d_dsp_test;
+	API d_version_number1;
+	API d_version_number2;
+	API d_debug_ptr;
+	API d_debug_bk;
+	API d_pll_config;
+	API p_debug_buffer;
+	API d_debug_buffer_size;
+	API d_debug_trace_type;
+	API d_dsp_state;
+	API d_hole1_ndb[2];
+	API d_hole_debug_amr;
+	API d_hole2_ndb[1];
+	API d_mcsi_select;
+	API d_apcdel1_bis;
+	API d_apcdel2_bis;
+	API d_apcdel2;
+	API d_vbctrl2;
+	API d_bulgcal;
+	API d_afcctladd;
+	API d_vbuctrl;
+	API d_vbdctrl;
+	API d_apcdel1;
+	API d_apcoff;
+	API d_bulioff;
+	API d_bulqoff;
+	API d_dai_onoff;
+	API d_auxdac;
+	API d_vbctrl1;
+	API d_bbctrl;
+	API d_fb_det;
+	API d_fb_mode;
+	API a_sync_demod[4];
+	API a_sch26[5];
+	API d_audio_gain_ul;
+	API d_audio_gain_dl;
+	API d_audio_compressor_ctrl;
+	API d_audio_init;
+	API d_audio_status;
+	API d_toneskb_init;
+	API d_toneskb_status;
+	API d_k_x1_t0;
+	API d_k_x1_t1;
+	API d_k_x1_t2;
+	API d_pe_rep;
+	API d_pe_off;
+	API d_se_off;
+	API d_bu_off;
+	API d_t0_on;
+	API d_t0_off;
+	API d_t1_on;
+	API d_t1_off;
+	API d_t2_on;
+	API d_t2_off;
+	API d_k_x1_kt0;
+	API d_k_x1_kt1;
+	API d_dur_kb;
+	API d_shiftdl;
+	API d_shiftul;
+	API d_aec_ctrl;
+	API d_es_level_api;
+	API d_mu_api;
+	API d_melo_osc_used;
+	API d_melo_osc_active;
+	API a_melo_note0[4];
+	API a_melo_note1[4];
+	API a_melo_note2[4];
+	API a_melo_note3[4];
+	API a_melo_note4[4];
+	API a_melo_note5[4];
+	API a_melo_note6[4];
+	API a_melo_note7[4];
+	API d_melody_selection;
+	API a_melo_holes[3];
+	API d_sr_status;
+	API d_sr_param;
+	API d_sr_bit_exact_test;
+	API d_sr_nb_words;
+	API d_sr_db_level;
+	API d_sr_db_noise;
+	API d_sr_mod_size;
+	API a_n_best_words[4];
+	API a_n_best_score[8];
+	API a_dd_1[22];
+	API a_du_1[22];
+	API d_v42b_nego0;
+	API d_v42b_nego1;
+	API d_v42b_control;
+	API d_v42b_ratio_ind;
+	API d_mcu_control;
+	API d_mcu_control_sema;
+	API d_background_enable;
+	API d_background_abort;
+	API d_background_state;
+	API d_max_background;
+	API a_background_tasks[16];
+	API a_back_task_io[16];
+	API d_gea_mode_ovly;
+	API a_gea_kc_ovly[4];
+	API d_hole3_ndb[7];
+	API d_thr_usf_detect;
+	API d_a5mode;
+	API d_sched_mode_gprs_ovly;
+	API d_hole4_ndb[5];
+	API a_ramp[16];
+	API a_cd[15];
+	API a_fd[15];
+	API a_dd_0[22];
+	API a_cu[15];
+	API a_fu[15];
+	API a_du_0[22];
+	API d_rach;
+	API a_kc[4];
+	API d_ra_conf;
+	API d_ra_act;
+	API d_ra_test;
+	API d_ra_statu;
+	API d_ra_statd;
+	API d_fax;
+	API a_data_buf_ul[21];
+	API a_data_buf_dl[37];
+	API a_tty_holes[8];
+	API a_sr_holes0[414];
+	API a_new_aec_holes[12];
+	// API a_sr_holes1[145];
+	struct param_mcu_dsp params;
+	API d_cport_init;
+	API d_cport_ctrl;
+	API a_cport_cfr[2];
+	API d_cport_tcl_tadt;
+	API d_cport_tdat;
+	API d_cport_tvs;
+	API d_cport_status;
+	API d_cport_reg_value;
+	API a_cport_holes[1011];
+	API a_model[1041];
+	API a_eotd_holes[22];
+	API a_amr_config[4];
+	API a_ratscch_ul[6];
+	API a_ratscch_dl[6];
+	API d_amr_snr_est;
+	API a_voice_memo_amr_holes[1];
+	API d_thr_onset_afs;
+	API d_thr_sid_first_afs;
+	API d_thr_ratscch_afs;
+	API d_thr_update_afs;
+	API d_thr_onset_ahs;
+	API d_thr_sid_ahs;
+	API d_thr_ratscch_marker;
+	API d_thr_sp_dgr;
+	API d_thr_soft_bits;
+	API d_holes[61];
+};
+
+enum dsp_error {
+	DSP_ERR_RHEA		= 0x0001,
+	DSP_ERR_IQ_SAMPLES	= 0x0004,
+	DSP_ERR_DMA_PROG	= 0x0008,
+	DSP_ERR_DMA_TASK	= 0x0010,
+	DSP_ERR_DMA_PEND	= 0x0020,
+	DSP_ERR_VM		= 0x0080,
+	DSP_ERR_DMA_UL_TASK	= 0x0100,
+	DSP_ERR_DMA_UL_PROG	= 0x0200,
+	DSP_ERR_DMA_UL_PEND	= 0x0400,
+	DSP_ERR_STACK_OV	= 0x0800,
+};
diff --git a/src/target_dsp/calypso/ida/tms320c54.cfg b/src/target_dsp/calypso/ida/tms320c54.cfg
new file mode 100644
index 00000000..7962bee2
--- /dev/null
+++ b/src/target_dsp/calypso/ida/tms320c54.cfg
@@ -0,0 +1,136 @@
+; Append this to the tms320c54.cfg shipped with IDA

+

+.CALYPSO

+

+; entry _reset 0xff80 Reset vector

+

+;	RIF

+RIF_DXR			0x0000

+RIF_DRR			0x0001

+RIF_SPCX		0x0002

+RIF_SPCR		0x0003

+

+;	CYPHER

+CYPHER_CNTL		0x2800

+CYPHER_CNTL.START			0

+CYPHER_CNTL.RESETSW			1

+CYPHER_CNTL.MODE0			2

+CYPHER_CNTL.MODE1			3

+CYPHER_CNTL.CLK_EN			4

+CYPHER_CNTL.CYPHER_ONLY			5

+

+CYPHER_STATUS_IRQ	0x2801

+CYPHER_STATUS_IRQ.LT_FIN		0

+

+CYPHER_STATUS_WORK	0x2802

+CYPHER_STATUS_WORK.WORKING		0

+

+CYPHER_KC_1		0x2803

+CYPHER_KC_2		0x2804

+CYPHER_KC_3		0x2805

+CYPHER_KC_4		0x2806

+CYPHER_COUNT_1		0x2807

+CYPHER_COUNT_2		0x2808

+CYPHER_DECI_1		0x2809

+CYPHER_DECI_2		0x280A

+CYPHER_DECI_3		0x280B

+CYPHER_DECI_4		0x280C

+CYPHER_DECI_5		0x280D

+CYPHER_DECI_6		0x280E

+CYPHER_DECI_7		0x280F

+CYPHER_DECI_8		0x2810

+CYPHER_ENCI_1		0x2811

+CYPHER_ENCI_2		0x2812

+CYPHER_ENCI_3		0x2813

+CYPHER_ENCI_4		0x2814

+CYPHER_ENCI_5		0x2815

+CYPHER_ENCI_6		0x2816

+CYPHER_ENCI_7		0x2817

+CYPHER_ENCI_8		0x2818

+

+;	MCSI

+MCSI_CONTROL		0x0800

+MCSI_MAIN-PARAMETERS	0x0801

+MCSI_INTERRUPTS		0x0802

+MCSI_CHANNEL-USED	0x0803

+MCSI_OVER-CLK		0x0804

+MCSI_CLK-FREQ		0x0805

+MCSI_STATUS		0x0806

+MCSI_TX0		0x0820

+MCSI_TX1		0x0821

+MCSI_TX2		0x0822

+MCSI_TX3		0x0823

+MCSI_TX4		0x0824

+MCSI_TX5		0x0825

+MCSI_TX6		0x0826

+MCSI_TX7		0x0827

+MCSI_TX8		0x0828

+MCSI_TX9		0x0829

+MCSI_TX10		0x082A

+MCSI_TX11		0x082B

+MCSI_TX12		0x082C

+MCSI_TX13		0x082D

+MCSI_TX14		0x082E

+MCSI_TX15		0x082F

+MCSI_RX0		0x0830

+MCSI_RX1		0x0831

+MCSI_RX2		0x0832

+MCSI_RX3		0x0833

+MCSI_RX4		0x0834

+MCSI_RX5		0x0835

+MCSI_RX6		0x0836

+MCSI_RX7		0x0837

+MCSI_RX8		0x0838

+MCSI_RX9		0x0839

+MCSI_RX10		0x083A

+MCSI_RX11		0x083B

+MCSI_RX12		0x083C

+MCSI_RX13		0x083D

+MCSI_RX14		0x083E

+MCSI_RX15		0x083F

+

+;	RHEA

+RHEA_TRANSFER_RATE	0xF800

+

+RHEA_BRIDGE-CTRL	0xF801

+RHEA_BRIDGE-CTRL.TIMEOUT_ENABLE		8

+RHEA_BRIDGE-CTRL.NSUPV			9

+

+;	API

+API_CONF		0xF900

+API_CONF.RESERVED0			0

+API_CONF.API_HOM			1

+API_CONF.BRIDGE_CLK_EN			2

+

+;	Interrupts

+INT_CNTRL		0xFA00

+INT_CLEAR		0xFA01

+

+;	DMA

+DMA_CONTROLLER_CONF	0xFC00

+DMA_ALLOC_CONFIG	0xFC02

+DMA1_RAD		0xFC10

+DMA1_RDPTH		0xFC12

+DMA1_AAD		0xFC14

+DMA1_ALGTH		0xFC16

+DMA1_CTRL		0xFC18

+DMA1_CUR_OFFSET_API	0xFC1A

+DMA2_RAD		0xFC20

+DMA2_RDPTH		0xFC22

+DMA2_AAD		0xFC24

+DMA2_ALGTH		0xFC26

+DMA2_CTRL		0xFC28

+DMA2_CUR_OFFSET_API	0xFC2A

+DMA3_RAD		0xFC30

+DMA3_RDPTH		0xFC32

+DMA3_AAD		0xFC34

+DMA3_ALGTH		0xFC36

+DMA3_CTRL		0xFC38

+DMA3_CUR_OFFSET_API	0xFC3A

+DMA4_RAD		0xFC40

+DMA4_RDPTH		0xFC42

+DMA4_AAD		0xFC44

+DMA4_ALGTH		0xFC46

+DMA4_CTRL		0xFC48

+DMA4_CUR_OFFSET_API	0xFC4A

+